Security, Specialist (JNCIS-SEC) practice questions

1. Question 1 of 25

   Select 2

   Regarding static attack object groups, which two statements are true? (Choose two.)

   • AMatching attack objects are automatically added to a custom group.
   • BGroup membership automatically changes when Juniper updates the IPS signature database.
   • CGroup membership does not automatically change when Juniper updates the IPS signature database.
   • DYou must manually add matching attack objects to a custom group.

   Show answer

   Correct answer: C, D

   How others answered

   • CD75%
   • AB25%

2. Question 2 of 25

   Select 2

   You are deploying a new SRX Series device and you need to log denied traffic. In this scenario, which two policy parameters are required to accomplish this task? (Choose two.)

   • Asession-init
   • Bsession-close
   • Cdeny
   • Dcount

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

3. Question 3 of 25

   You are asked to reduce the load that the JIMS server places on your corporate domain controller. Which action should you take in this situation?

   • AConnect JIMS to the RADIUS server.
   • BConnect JIMS to the domain Exchange server.
   • CConnect JIMS to the domain SQL server.
   • DConnect JIMS to another SRX Series device.

   Show answer

   Correct answer: A

   How others answered

   • A86%
   • B14%

4. Question 4 of 25

   Select 2

   Which two statements about unified security policies are correct? (Choose two.)

   • AUnified security policies require an advanced feature license.
   • BUnified security policies are evaluated after global security policies.
   • CTraffic can initially match multiple unified security policies.
   • DAPPID results are used to determine the final security policy match.

   Show answer

   Correct answer: C, D

   How others answered

   • D50%
   • CD50%

   Most people chose D, not CD. Verify this one against the vendor documentation.

5. Question 5 of 25

   Select 2

   Click the Exhibit button.

   

   Referring to the exhibit, which two statements describe the type of proxy used? (Choose two.)

   • Aforward proxy
   • Bclient protection proxy
   • Cserver protection proxy
   • Dreverse proxy

   Show answer

   Correct answer: A, B

   How others answered

   • AB71%
   • AC29%

   Only 71% agreed on this answer — treat it as contested rather than settled.

6. Question 6 of 25

   You have deployed an SRX300 Series device and determined that files have stopped being scanned. In this scenario, what is a reason for this problem?

   • AThe software license is a free model and only scans executable type files.
   • BThe infected host communicated with a command-and-control server, but it did not download malware.
   • CThe file is too small to have a virus.
   • DYou have exceeded the maximum files submission for your SRX platform size.

   Show answer

   Correct answer: D

   How others answered

   • D100%

7. Question 7 of 25

   Select 3

   Which three statements about SRX Series device chassis clusters are true? (Choose three.)

   • AChassis cluster control links must be configured using RFC 1918 IP addresses.
   • BChassis cluster member devices synchronize configuration using the control link.
   • CA control link failure causes the secondary cluster node to be disabled.
   • DRecovery from a control link failure requires that the secondary member device be rebooted.
   • EHeartbeat messages verify that the chassis cluster control link is working.

   Show answer

   Correct answer: B, C, E

   How others answered

   • BCE50%
   • BE50%

   Only 50% agreed on this answer — treat it as contested rather than settled.

8. Question 8 of 25

   Select 2

   Which two statements are correct about security policy changes when using the policy rematch feature? (Choose two.)

   • AWhen a policy change includes changing the policy's action from permit to deny, all existing sessions are maintained.
   • BWhen a policy change includes changing the policy's source or destination address match condition, all existing sessions are dropped.
   • CWhen a policy change includes changing the policy's action from permit to deny, all existing sessions are dropped.
   • DWhen a policy change includes changing the policy's source or destination address match condition, all existing sessions are reevaluated.

   Show answer

   Correct answer: C, D

   How others answered

   • CD75%
   • BC25%

9. Question 9 of 25

   Select 2

   You are asked to block malicious applications regardless of the port number being used. In this scenario, which two application security features should be used? (Choose two.)

   • AAppFW
   • BAppQoE
   • CAPPID
   • DAppTrack

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

10. Question 10 of 25

    A client has attempted communication with a known command-and-control server and it has reached the configured threat level threshold. Which feed will the client's IP address be automatically added in this situation?

    • Athe command-and-control cloud feed
    • Bthe allowlist and blocklist feed
    • Cthe custom cloud feed
    • Dthe infected host cloud feed

    Show answer

    Correct answer: D

    How others answered

    • D100%

11. Question 11 of 25

    When a security policy is deleted, which statement is correct about the default behavior for active sessions allowed by that policy?

    • AThe active sessions allowed by the policy will be dropped.
    • BThe active sessions allowed by the policy will be marked as a legacy flow and will continue to be forwarded.
    • CThe active sessions allowed by the policy will be reevaluated by the cached policy rules.
    • DThe active sessions allowed by the policy will continue unchanged.

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • B22%
    • D11%

    Only 67% agreed on this answer — treat it as contested rather than settled.

12. Question 12 of 25

    You are asked to determine how much traffic a popular gaming application is generating on your network. Which action will you perform to accomplish this task?

    • AEnable AppQoS on the proper security zones.
    • BEnable APBR on the proper security zones.
    • CEnable screen options on the proper security zones.
    • DEnable AppTrack on the proper security zones.

    Show answer

    Correct answer: D

    How others answered

    • D100%

13. Question 13 of 25

    How does the SSL proxy detect if encryption is being used?

    • AIt uses application identity services.
    • BIt verifies the length of the packet.
    • CIt queries the client device.
    • DIt looks at the destination port number.

    Show answer

    Correct answer: A

    How others answered

    • A100%

14. Question 14 of 25

    Select 2

    Which two statements are correct when considering IPS rule base evaluation? (Choose two.)

    • AIPS evaluates rules concurrently.
    • BIPS applies the most severe action to traffic matching multiple rules.
    • CIPS evaluates rules sequentially.
    • DIPS applies the least severe action to traffic matching multiple rules.

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

15. Question 15 of 25

    Select 2

    You have implemented a vSRX in your VMware environment. You want to implement a second vSRX Series device and enable chassis clustering. Which two statements are correct in this scenario about the control-link settings. (Choose two.)

    • AIn the vSwitch security settings, accept promiscuous mode.
    • BIn the vSwitch properties settings, set the VLAN ID to None.
    • CIn the vSwitch security settings, reject forged transmits.
    • DIn the vSwitch security settings, reject MAC address changes.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

16. Question 16 of 25

    Select 2

    Which two statements are true about the vSRX? (Choose two.)

    • AIt does not have VMXNET3 vNIC support.
    • BIt has VMXNET3 vNIC support.
    • CUNIX is the base OS.
    • DLinux is the base OS.

    Show answer

    Correct answer: B, D

    How others answered

    • BD100%

17. Question 17 of 25

    Click the Exhibit button.

    

    Using the information from the exhibit, which statement is correct?

    • ARedundancy group 1 is in an ineligible state.
    • BNode1 is the active node for the control plane.
    • CThere are no issues with the cluster.
    • DRedundancy group 0 is in an ineligible state.

    Show answer

    Correct answer: A

    How others answered

    • A100%

18. Question 18 of 25

    You want to manually failover the primary Routing Engine in an SRX Series high availability cluster pair. Which step is necessary to accomplish this task?

    • AIssue the set chassis cluster disable reboot command on the primary node.
    • BImplement the control link recovery solution before adjusting the priorities.
    • CManually request the failover and identify the secondary node.
    • DAdjust the priority in the configuration on the secondary node.

    Show answer

    Correct answer: C

    How others answered

    • C75%
    • A25%

19. Question 19 of 25

    Select 2

    You want to permit access to an application but block application sub-features that enable users to upload content. Which two security policy features provide this capability? (Choose two.)

    • AURL filtering
    • Bmicro application detection
    • Ccontent filtering
    • DAPPID

    Show answer

    Correct answer: B, D

    How others answered

    • BD100%

20. Question 20 of 25

    Which statement regarding Juniper Identity Management Service (JIMS) domain PC probes is true?

    • AJIMS domain PC probes analyze domain controller security event logs at 60-minute intervals by default.
    • BJIMS domain PC probes are triggered if no username to IP address mapping is found in the domain security event log.
    • CJIMS domain PC probes are triggered to map usernames to group membership information.
    • DJIMS domain PC probes are initiated by an SRX Series device to verify authentication table information.

    Show answer

    Correct answer: B

    How others answered

    • B100%

21. Question 21 of 25

    Select 2

    Your manager asks you to provide firewall and NAT services in a private cloud. Which two solutions will fulfill the minimum requirements for this deployment? (Choose two.)

    • Aa single vSRX
    • Ba vSRX for firewall services and a separate vSRX for NAT services
    • Ca cSRX for firewall services and a separate cSRX for NAT services
    • Da single cSRX

    Show answer

    Correct answer: A, D

    How others answered

    • AC67%
    • AD33%

    Most people chose AC, not AD. Verify this one against the vendor documentation.

22. Question 22 of 25

    Select 2

    Which two statements are true about mixing traditional and unified security policies? (Choose two.)

    • AWhen a packet matches a unified security policy, the evaluation process terminates.
    • BTraditional security policies must come before unified security policies.
    • CUnified security policies must come before traditional security policies.
    • DWhen a packet matches a traditional security policy, the evaluation process terminates.

    Show answer

    Correct answer: B, D

    How others answered

    • AD50%
    • BD50%

    Most people chose AD, not BD. Verify this one against the vendor documentation.

23. Question 23 of 25

    Click the Exhibit button.

    

    Referring to the exhibit, what do you determine about the status of the cluster?

    • ABoth nodes determine that they are in a primary state.
    • BNode 1 is down.
    • CNode 2 is down.
    • DThere are no issues with the cluster.

    Show answer

    Correct answer: A

    How others answered

    • A100%

24. Question 24 of 25

    Select 2

    Which two features are configurable on Juniper Secure Analytics (JSA) to ensure that alerts are triggered when matching certain criteria? (Choose two.)

    • Abuilding blocks
    • Bassets
    • Cevents
    • Dtests

    Show answer

    Correct answer: A, C

    How others answered

    • AC57%
    • AD29%
    • BC14%

    Only 57% agreed on this answer — treat it as contested rather than settled.

25. Question 25 of 25

    Select 2

    You are asked to implement IPS on your SRX Series device. In this scenario, which two tasks must be completed before a configuration will work? (Choose two.)

    • ADownload the IPS signature database.
    • BEnroll the SRX Series device with Juniper ATP Cloud.
    • CInstall the IPS signature database.
    • DReboot the SRX Series device.

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

JN0-335 practice, question 1 of 25