[Q64-Q84] Get New 2023 Juniper JN0-636 Exam Dumps Bundle On flat Updated Dumps!

Get New 2023 Juniper exam JN0-636 Dumps Bundle On flat Updated Dumps!

Full JN0-636 Practice Test and 140 unique questions with explanations waiting just for you, get it now!

NEW QUESTION # 64
You configure Source NAT using a pool of addresses that are in the same subnet range as the external ge-0/0/0 interface on your vSRX device. Traffic that is exiting the internal network can reach external destinations, but the return traffic is being dropped by the service provider router.
Referring to the exhibit, what must be enabled on the vSRX device to solve this problem?

A. STUN
B. Persistent NAT
C. DNS Doctoring
D. Proxy ARP

Answer: C

NEW QUESTION # 65
You are asked to implement a Dynamic IPsec VPN on your new SRX240. You are required to facilitate up to 5 simultaneous users.
Which two statements must be considered when accomplishing the task?

A. You must acquire at least three additional licenses.
B. You must use main mode for your IKE phase 1 policy.
C. You must be a policy-based VPN.
D. Your devices must be in a chassis cluster.

Answer: A,C

NEW QUESTION # 66
What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

A. Analysis
B. Detection
C. Filtration
D. Statistics

Answer: A,B

Explanation:
https://www.juniper.net/us/en/products-services/security/advanced-threat-prevention/

NEW QUESTION # 67
The IPsec VPN on your SRX Series device establishes both the Phase 1 and Phase 2 security associations. Users are able to pass traffic through the VPN. During peak VPN usage times, users complain about decreased performance. Network connections outside of the VPN are not seriously impacted.
Which two actions will resolve the problem? (Choose two.)

A. Lower the MSS setting in the security flow stanza for IPsec VPNs.
B. Lower the MTU size on the interface to reduce the likelihood of packet fragmentation.
C. Verify that the PKI certificate used to establish the VPN is being properly verified using either the CPL or OCSP.
D. Verify that NAT-T is not disabled in the properties of the phase 1 gateway.

Answer: A,B

NEW QUESTION # 68
Exhibit

You are trying to configure an IPsec tunnel between SRX Series devices in the corporate office and branch1.
You have committed the configuration shown in the exhibit, but the IPsec tunnel is not establishing.
In this scenario, what would solve this problem.

A. Change the IKE proposal-set to compatible on the branch1 and corporate devices.
B. Change the IKE mode to aggressive on the branch1 and corporate devices.
C. Change the local identity to inet advpn on the branch1 device.
D. Add multipoint to the st0.0 interface configuration on the branch1 device.

Answer: C

NEW QUESTION # 69
You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.
Which firewall filter will accomplish this task?

Answer: D

NEW QUESTION # 70
You are trying to configure an IPsec tunnel between SRX Series devices in the corporate office and branch1. You have committed the configuration shown in the exhibit, but the IPsec tunnel is not establishing.
In this scenario, what would solve this problem?

A. Change the IKE proposal-set to compatible on the branch1 and corporate devices.
B. Change the IKE mode to aggressive on the branch1 and corporate devices.
C. Change the local identity to inet advpn on the branch1 device.
D. Add multipoint to the st0.0 interface configuration on the branch1 device.

Answer: C

NEW QUESTION # 71
You have noticed a high number of TCP-based attacks directed toward your primary edge device.
You are asked to configure the IDP feature on your SRX Series device to block this attack.
Which two IDP attack objects would you configure to solve this problem? (Choose two.)

A. Network
B. host
C. Protocol anomaly
D. Signature

Answer: C,D

NEW QUESTION # 72
Referring to the exhibit, which three protocols will be allowed on the ge-0/0/5.0 interface?
(Choose three.)

A. OSPF
B. IPsec
C. NTP
D. DHCP
E. IBGP

Answer: A,B,C

NEW QUESTION # 73
An administrator wants to configure an SRX Series device to log binary security events for tenant systems.
Referring to the exhibit, which statement would complete the configuration?

A. Configure the tenant as TSYS1 for the pi security profile.
B. Configure the tenant as local for the pi security profile
C. Configure the tenant as master for the pi security profile.
D. Configure the tenant as root for the pi security profile.

Answer: D

NEW QUESTION # 74
You have set up Security Director with Policy Enforcer and have configured 12 third-party feeds and a Sky ATP feed. You are also injecting 16 feeds using the available open API. You want to add another compatible feed using the available open API, but Policy Enforcer is not receiving the new feed.
What is the problem in this scenario?

A. You cannot add more than 16 feeds through the available open API
B. You have reached the maximum limit of 29 total feeds
C. You must wait 48 hours for the feed to update
D. You cannot add more than 16 feeds with the available open API

Answer: B

Explanation:
https://www.juniper.net/documentation/en_US/release-independent/sky-atp/information- products/pathway-pages/sky-atp-admin-guide.pdf page 110

NEW QUESTION # 75
All interfaces involved in transparent mode are configured with which protocol family?

A. ethernet - switching
B. mpls
C. inet
D. bridge

Answer: B

NEW QUESTION # 76
You want to use selective stateless packet-based forwarding based on the source address.
In this scenario, which command will allow traffic to bypass the SRX Series device flow daemon?

A. set firewall family inet filter bypass_flowd term t1 then routing-instance stateless
B. set firewall family inet filter bypas3_flowd term t1 then virtual-channel stateless
C. set firewall family inet filter bypaa3_flowd term t1 then skip-services accept
D. set firewall family inet filter bypass__f lowd term t1 then packet-mode

Answer: C

NEW QUESTION # 77
You are asked to merge to corporate network with the network from a recently acquired company.
Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network.
Which solution allows you to merge the two networks without modifying the current address assignments?

A. NAT46
B. double NAT
C. persistent NAT
D. source NAT

Answer: B

Explanation:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB21286

NEW QUESTION # 78
Exhibit

Referring to the exhibit, which two statements are true? (Choose two.)

A. The data that traverses the ge-0/070 interface is secured by a secure association key.
B. The data that traverses the ge-O/0/0 interface is secured by a connectivity association key.
C. The data that traverses the ge-070/0 interface can be intercepted and read by anyone.
D. The data that traverses the ge-070/0 interface cannot be intercepted and read by anyone.

Answer: C,D

NEW QUESTION # 79
Exhibit

Which two statements are correct about the output shown in the exhibit. (Choose two.)

A. The packet is an SSH packet
B. The source address is translated.
C. The destination address is translated.
D. The packet matches a user-configured policy

Answer: A,B

NEW QUESTION # 80
Exhibit

You areasked to establish an IBGP peering between the SRX Series device and the router, but the session is not being established. In the security flow trace on the SRX device, packet drops are observed as shown in the exhibit.
What is the correct action to solve the problem on the SRX device?

A. Create a firewall filter to accept the BGP traffic
B. Configure destination NAT for BGP traffic.
C. Add BGP to the Allowed host-inbound-traffic for the interface
D. Modify the security policy to allow the BGP traffic.

Answer: A

NEW QUESTION # 81
Exhibit

Referring to the exhibit, which two statements are true? (Choose two.)

A. You must manually create the suspicious_Endpoint3 feed in the Juniper ATP Cloud interface.
B. The 3uspicious_Endpoint3 feed is only usable by the SRX-1 device.
C. The 3uspiciou3_Endpoint3 feed is usable by any SRX Series device that is a part of the same realm as SRX-1
D. Juniper ATP Cloud automatically creates the 3uopi'cioua_Endpoints feed after you commit the security policy.

Answer: B,C

NEW QUESTION # 82
Exhibit

You have recently configured Adaptive Threat Profiling and notice 20 IP address entries in the monitoring section of the Juniper ATP Cloud portal that do not match the number of entries locally on the SRX Series device, as shown in the exhibit.
What is the correct action to solve this problem on the SRX device?