Free Security Design, Specialist Exam JN0-1331 Exam Practice Test

You are designing a DDoS solution for an ISP using BGP FlowSpec. You want to ensure that BGP FlowSpec does not overwhelm the ISP's edge routers.Which two requirements should be included in your design? (Choose two.)

• Specify a maximum number BGP FlowSpec prefixes per neighbor
• Implement a route policy to limit advertised routes to /24 subnets
• Implement a route policy to limit advertised routes to any public IP space
• Specify a maximum number of BGP FlowSpec prefixes per device

You are concerned about users attacking the publicly accessible servers in your data center through encrypted channels. You want to block these attacks using your SRX Series devices.In this scenario, which two features should you use? (Choose two.)

• Sky ATP
• IPS
• SSL forward proxy
• SSL reverse proxy

You must design a small branch office firewall solution that provides application usage statistics.In this scenario, which feature would accomplish this task?

• AppFW
• AppTrack
• UTM
• AppQoS

You are designing an enterprise WAN network that must connect multiple sites. You must provide a designproposal for the security elements needed to encrypt traffic between the remote sites. Which feature will secure the traffic?

• BFD
• OSPF
• GRE
• IPsec

Your company has 500 branch sites and the CIO is concerned about minimizing the potential impact of a VPN router being stolen from an enterprise branch site. You want the ability to quickly disable a stolen VPN router while minimizing administrative overhead.Which solution accomplishes this task?

• Implement a certificate-based VPN using a public key infrastructure (PKI)
• Modify your IKE proposals to use Diffie-Hellman group 14 or higher
• Use firewall filters to block traffic from the stolen VPN router
• Rotate VPN pre-shared keys every month

You are concerned about users downloading malicious attachments at work while using encrypted Web mail. You want to block these malicious files using your SRX Series device.In this scenario, which two features should you use? (Choose two.)

• SSL reverse proxy
• SSL forward proxy
• Sky ATP SMTP scanning
• Sky ATP HTTP scanning

You have a site that has two Internet connections but no switch on the outside of the firewall. You want to use ISP-A over ISP-B during normal operations.Which type of chassis cluster design would you propose to satisfy this requirement?

• Propose active/active cluster deployment with separate redundancy groups
• Propose active/passive cluster deployment with separate redundancy groups
• Propose active/active cluster deployment without separate redundancy groups
• Propose active/passive cluster deployment without separate redundancy groups

You are deploying Security Director with the logging and reporting functionality for VMs that use SSDs. You expect to have approximately 20,000 events per second of logging in your network.In this scenario, what is the minimum number of log receiver devices that you should use?

• 4
• 3
• 2
• 1

Policy Enforcer provides which benefit?

• log management
• command and control protection
• centralized management of security devices
• IPsec encryption

Your customer is getting ready to deploy a new WAN architecture. It must be simple to set up, address hub scaling concerns, and allow the automatic addition of new sites without requiring changes to the hub site. They want to deploy either AutoVPN or Auto Discovery VPN.In this scenario, why would you propose Auto Discovery VPN as a solution?

• Your customer requires direct spoke-to-spoke communication
• OSPF support is required
• Only Auto Discovery VPN supports the automatic addition of valid spokes
• Your customer needs to configure the hub site only once