Security, Professional Exam Questions PDF download

QUESTION: 16

Your company wants to use the Juniper Seclntel feeds to block access to known command and control servers, but they do not want to use Security Director to manage the feeds.
Which two Juniper devices work in this situation? (Choose two)

EX Series devices
MX Series devices
SRX Series devices
QFX Series devices

Answer(s): B,C

Explanation:

Juniper MX and SRX series devices support the integration of Seclntel feeds, which provide information about known command and control servers, for the purpose of blocking access to them. These devices can be configured to use the Seclntel feeds without the need for Security Director to manage the feeds.
EX series and QFX series devices are not capable of working in this situation, as they do not support the integration of Seclntel feeds.
According to the Juniper documentation, the two Juniper devices that work in this situation are MX Series devices and SRX Series devices. These devices can use the Juniper SecIntel feeds to block access to known command and control servers without using Security Director to manage the feeds. The Juniper SecIntel feeds are curated and verified threat intelligence data that are continuously collected from Juniper ATP Cloud, Juniper Threat Labs, and other sources. The SecIntel feeds include command and control IPs, URLs, certificate hashes, and domains that are used by attackers to control malware or maintain their connection to the network.
The MX Series devices and the SRX Series devices can subscribe to the SecIntel feeds by using the following steps:
Configure the SecIntel service on the device by specifying the SecIntel URL, the SecIntel policy, and the SecIntel license.
Configure the SecIntel policy on the device by specifying the SecIntel feeds, the SecIntel actions, and the SecIntel logging.
Apply the SecIntel policy to the security zones or the firewall policies on the device by using the secintel-policy option.
Once the SecIntel service is configured and applied, the MX Series devices and the SRX Series devices will receive the SecIntel feeds from Juniper ATP Cloud and use them to block the traffic from or to the command and control servers. The SecIntel service will also send the SecIntel logs to Juniper ATP Cloud or a third-party SIEM solution for further analysis and reporting. The following devices are not suitable or incorrect for this situation:
EX Series devices: EX Series devices are Ethernet switches that can integrate with SecIntel to block infected hosts at the switch port. However, they cannot use the SecIntel feeds to block command and control servers, as they do not support the SecIntel service or policy. QFX Series devices: QFX Series devices are Ethernet switches that can integrate with SecIntel to block infected hosts at the switch port. However, they cannot use the SecIntel feeds to block command and control servers, as they do not support the SecIntel service or policy.

Reference:

1: SecIntel Threat Intelligence 2: Configuring SecIntel Service 3: Configuring SecIntel Policy 4: Applying SecIntel Policy : [SecIntel Logging] : [SecIntel Integration with EX Series Switches] :
[SecIntel Integration with QFX Series Switches]

Reveal Solution Next Question

QUESTION: 17

To analyze and detect malware, Juniper ATP Cloud performs which two functions? (Choose two.)

cache lookup: to see if the file is seen already and known to be malicious
antivirus scan: with a single vendor solution to see if the file contains any potential threats
dynamic analysis: to see what happens if you execute the file in a real environment
static analysis: to see what happens if you execute the file in a real environment

Answer(s): A,C

Explanation:

Juniper ATP Cloud performs cache lookup to see if the file is seen already and known to be malicious and dynamic analysis to see what happens if you execute the file in a real environment.

Cache lookup is one of the functions that Juniper ATP Cloud performs to analyze and detect malware. Cache lookup is the first step in the pipeline approach that Juniper ATP Cloud uses to examine files. Cache lookup checks whether the file has been seen before and whether it has a stored verdict in the database. If the file is known to be malicious, the verdict is returned to the SRX Series Firewall and the file is dropped. If the file is not found in the cache, the analysis continues with the other techniques.
Dynamic analysis is another function that Juniper ATP Cloud performs to analyze and detect malware. Dynamic analysis runs the file in a sandbox environment and observes its behavior and actions. Dynamic analysis can reveal the hidden or obfuscated functionality of malware, such as network connections, file modifications, registry changes, and process injections. Dynamic analysis can also detect zero-day threats and evasive malware that try to avoid static analysis.

Reference:

How is Malware Analyzed and Detected? | ATP Cloud | Juniper Networks

Reveal Solution Next Question

QUESTION: 18

Exhibit

You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?

The remote gateway address for the IPsec tunnel is 10.20.20.2
The session information indicates that the IPsec tunnel has not been established
The local gateway address for the IPsec tunnel is 10.20.20.2
NAT is being used to change the source address of outgoing packets

Answer(s): C

Explanation:

According to the output shown in the exhibit, which is a security flow session on an SRX Series device, the correct statement is that the local gateway address for the IPsec tunnel is 10.20.20.2. This is indicated by the line In: 10.20.20.2/2060 -> 10.20.20.1/3382, which shows that the source IP address of the incoming packet is 10.20.20.2, which is the local gateway address of the IPsec tunnel. The destination IP address of the incoming packet is 10.20.20.1, which is the remote gateway address of the IPsec tunnel.
The following statements are incorrect or not supported by the output:
The remote gateway address for the IPsec tunnel is 10.20.20.2. This is false, as explained above. The remote gateway address for the IPsec tunnel is 10.20.20.1, not 10.20.20.2. The session information indicates that the IPsec tunnel has not been established. This is false, as the output shows that there are two active sessions with the communication tag IPSec VPN: vpn1, which indicates that the IPsec tunnel has been established and is named vpn. NAT is being used to change the source address of outgoing packets. This is not supported by the output, as there is no indication of NAT being applied to the outgoing packets. The source IP address of the outgoing packet is 192.168.1.1, which is the same as the source IP address of the original packet. If NAT was being used, the source IP address of the outgoing packet would be different from the source IP address of the original packet.

Reference:

1: show security flow session - Technical Documentation - Support - Juniper Networks

Reveal Solution Next Question

QUESTION: 19

Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

The packet is silently discarded.
The packet is part of an existing session.
The packet is part of a new session.
The packet is explicitly rejected.

Answer(s): A,C

Explanation:

The packet is silently discarded because the traceoptions output shows that the packet is dropped with the flag flow_spu_drop, which indicates that the packet is dropped by the SPU without sending any response to the sender. The traceoptions output also shows the reason for the drop as "no session found, start first path. in_tunnel - 0, from_cp_flag - 0" which means that the packet does not match any existing session and is not part of a tunnel or a control plane traffic. The packet is part of a new session because the traceoptions output shows that the packet is the first packet of a TCP connection with the flag flow_tcp_syn, which indicates that the packet has the SYN flag set. The traceoptions output also shows that the packet is processed in the first path packet flow with the message "no session found, start first path" which means that the packet is initiating a new session.

Reference:

traceoptions (Security Flow) | Junos OS | Juniper Networks [SRX] How to interpret Flow TraceOptions output for NAT troubleshooting

Reveal Solution Next Question

QUESTION: 20

You are asked to provide single sign-on (SSO) to Juniper ATP Cloud.
Which two steps accomplish this goal? (Choose two.)

Configure Microsoft Azure as the service provider (SP).
Configure Microsoft Azure as the identity provider (IdP).
Configure Juniper ATP Cloud as the service provider (SP).
Configure Juniper ATP Cloud as the identity provider (IdP).

Answer(s): B,C

Explanation:

To provide single sign-on (SSO) to Juniper ATP Cloud, you need to configure the following:
Microsoft Azure as the identity provider (IdP): This allows users to authenticate to Juniper ATP Cloud using their Azure credentials.
Juniper ATP Cloud as the service provider (SP): This allows Juniper ATP Cloud to accept the authentication from Microsoft Azure and provide SSO access to the users. Configuring Microsoft Azure as the service provider (SP) and Juniper ATP Cloud as the identity provider (IdP) are not the correct steps to provide SSO, as the roles are reversed.

Reveal Solution Next Question

Juniper Security, Professional JN0-636 Dumps in PDF

Free Juniper JN0-636 Real Questions (page: 14)

QUESTION: 16

Explanation:

Reference:

QUESTION: 17

Explanation:

Reference:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation: