Free Security, Professional (JNCIP-SEC) Exam JN0-637 Exam Practice Test

What are three requirements to run OSPF over GRE over IPsec? (Choose Three)

• The GRE interface must be configured in OSPF Area 0.
• The OSPF interface must be placed in a zone and must have GRE configured
• Overlapping addresses should exist between remote networks.
• The GRE interface must be placed in a zone and must have OSPF configured in is host
• Overlapping addresses should not exist between remote networks.

You want to configure the SRX Series device to map two peer interfaces together and ensure that there is no switching or routing lookup to forward traffic.Which feature on the SRX Series device is used to accomplish this task?

• Transparent mode
• Secure wire
• Mixed mode
• Switching mode

A company has acquired a new branch office that has the same address space as one of its local networks, 192.168.100.0/24. The offices need to communicate with each other.Which two NAT configurations will satisfy this requirement? (Choose two.)

• [edit security nat source]
• user@OfficeA# show rule-set OfficeBtoA { from zone OfficeB;
• to zone OfficeA; rule 1 {
• match {
• source-address 192.168.210.0/24; destination-address 192.168.200.0/24;
• }
• then {
• source-nat { interface; }
• }
• }
• }
• [edit security nat static]
• user@OfficeA# show rule-set From-Office-B { from interface ge-0/0/0.0;
• rule 1 {
• match {
• destination-address 192.168.200.0/24;
• }
• then {
• static-nat {
• prefix { 192.168.100.0/24; }
• }
• }
• }
• }
• [edit security nat static]
• user@OfficeB# show rule-set From-Office-A { from interface ge-0/0/0.0;
• rule 1 {
• match {
• destination-address 192.168.210.0/24;
• }
• then {
• static-nat {
• prefix { 192.168.100.0/24; }
• }
• }
• }
• }
• [edit security nat source]
• user@OfficeB# show rule-set OfficeAtoB { from zone OfficeA;
• to zone OfficeB; rule 1 {
• match {
• source-address 192.168.200.0/24; destination-address 192.168.210.0/24;
• }
• then {
• source-nat { interface; }
• }
• }
• }

Which two statements are true regarding NAT64? (Choose two.)

• An SRX Series device should be in flow-based forwarding mode for IPv4.
• An SRX Series device should be in packet-based forwarding mode for IPv4.
• An SRX Series device should be in packet-based forwarding mode for IPv6.
• An SRX Series device should be in flow-based forwarding mode for IPv6.

You are deploying a large-scale VPN spanning six sites. You need to choose a VPN technology that satisfies the following requirements:All sites must have secure reachability to all other sites.New spoke sites can be added without explicit configuration on the hub site. All spoke-to-spoke communication must traverse the hub site.Which VPN technology will satisfy these requirements?

• ADVPN
• Group VPN
• Secure Connect VPN
• AutoVPN

Which two elements are necessary to configure a rule under an APBR profile? (Choose Two)instance typematch conditionthen actionRIB group

• Instance type: While routing instances are used in APBR, the "instance type" itself is not configured within the APBR rule. You define the instance type separately when configuring the routing instance.
• RIB group: RIB groups are used for route management and are not directly involved in APBR rule configuration.

You are deploying threat remediation to endpoints connected through third-party devices. In this scenario, which three statements are correct? (Choose three.)

• All third-party switches must support AAA/RADIUS and Dynamic Authorization Extensions to the RADIUS protocol.
• The connector uses an API to gather endpoint MAC address information from the RADIUS server.
• All third-party switches in the specified network are automatically mapped and registered with the RADIUS server.
• The connector queries the RADIUS server for the infected host endpoint details and initiates a change of authorization (CoA) for the infected host.
• The RADIUS server sends Status-Server messages to update infected host information to the connector.

A company has acquired a new branch office that has the same address space of one of its local networks, 192.168.100/24. The offices need to communicate with each other.Which two NAT configurations will satisfy this requirement? (Choose two.)[edit security nat source] user@OfficeA# show rule-set OfficeBtoA {from zone OfficeB; to zone OfficeA; rule 1 {match {source-address 192.168.210.0/24; destination-address 192.168.200.0/24;}then {source-nat { interface;}}}}[edit security nat static]user@OfficeA# show rule-set From-Office-B { from interface ge-0/0/0.0;rule 1 {match {destination-address 192.168.200.0/24;}then {static-nat {prefix 192.168.100.0/24;}}}}[edit security nat static]user@OfficeB# show rule-set From-Office-A { from interface ge-0/0/0.0;rule 1 {match {destination-address 192.168.210.0/24;}then {static-nat {prefix 192.168.100.0/24;}}}}[edit security nat source] user@OfficeB# show rule-set OfficeAtoB {from zone OfficeA; to zone OfficeB; rule 1 {match {source-address 192.168.200.0/24; destination-address 192.168.210.0/24;}then {source-nat { interface;}}}}

• By configuring source NAT, the source IP addresses from Office B (192.168.210.0/24) will be translated when communicating with Office A (192.168.200.0/24). This method ensures that there is no overlap in address space when packets are transmitted between the two offices.
• Option D (Correct):
• This is a source NAT rule configured on Office B, which translates the source addresses from Office A to prevent address conflicts. It ensures that when traffic is initiated from Office A to Office B, the overlapping address range (192.168.100.0/24) is translated.
• Options B and C (Incorrect):
• These options involve static NAT rules that map address ranges between the two offices, but they do not resolve the overlapping IP address space issue effectively. Static NAT is not the optimal solution in this scenario since the problem involves address space conflict, which requires translation of source addresses during communication.
• Juniper

Which two statements are correct about advanced policy-based routing?

• It can use the application system cache to route traffic.
• The associated routing instance should be configured as a virtual router instance.
• It cannot use the application system cache to route traffic.
• The associated routing instance should be configured as a forwarding instance.

What are three configurable monitor components for a service redundancy group? (Choose two)

• Interface
• BFD
• hardware alarm
• IP
• ARP