Pass the Juniper JNCIS-SEC JN0-335 Questions and answers with ExamsMirror

 SSL proxy is a transparent proxy that performs SSL encryption and decryption between the client and the server. It allows inspection of encrypted traffic by terminating the SSL connection from either end and applying security policies to the clear text. SSL proxy can leverage pre-match or post-match results to determine whether to apply SSL proxy to a session. Pre-match results are based on the initial packet of the session, while post-match results are based on the application identification after the session is established. In the exhibit, the session shows that the application services identification is “ssl-proxy”, which means that SSL proxy is applied based on the pre-match results. The cache lookup status for application services is “on”, which means that the SRX Series device uses the application system cache to store the pre-match results for faster processing. Therefore, the correct answer is D. SSL proxy leverages pre-match result. References: = SSL Proxy, Configuring SSL Proxy, and Application System Cache

JIMS uses eventlogs on Domain contollers or Exchange Servers to determine logon events. So to decrease the load on a Domain Controller you could use the Exchange Server to read logs.

References:

Juniper Identity Management Service (JIMS) Documentation

Juniper Identity Management Service User Guide

Overview | JIMS | Juniper Networks

Juniper - ExamsBoost

Juniper Identity Management Service Overview

The DNS ALG is an application layer gateway that handles data associated with locating and translating domain names into IP addresses. The DNS ALG supports the following features:

DDNS: The DNS ALG supports dynamic DNS (DDNS), which allows hosts to update their DNS records dynamically when their IP addresses change. The DNS ALG monitors the DDNS update messages and performs the necessary address transformations2

DNS doctoring: The DNS ALG performs DNS doctoring, which is a process of modifying the DNS responses to match the NAT address translation. This is done to resolve the problems introduced by NAT, such as the mismatch between the internal and external IP addresses of a host. The DNS ALG performs the IPv4 and IPv6 address transformations for both DNS and DDNS responses2

The DNS ALG does not support VPN tunnels or NAT itself. The DNS ALG works with NAT, but does not perform NAT. The DNS ALG only supports UDP traffic, not TCP traffic2 References:

1: Juniper Security Specialist (JNCIS-SEC) (JN0-334) | Study Guide 3

2: Junos OS Security Configuration Guide | DNS ALG 1

 JIMS domain PC probes are a mechanism to obtain username to IP address mapping information from devices in a customer’s domain. JIMS initiates a domain PC probe when it receives a request from an SRX Series device for a username to IP address mapping that is not found in the domain security event log. JIMS uses the administrative credentials configured for PC probes to access the device and query the Windows Management Instrumentation (WMI) service for the username to IP address mapping12 References:

1: Juniper Identity Management Service Feature Guide - TechLibrary - Juniper Networks

2: Juniper Identity Management Service (JIMS) Documentation - Juniper Networks

Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. It assigns a threat level to each attacker IP address from 1 to 10, with 10 being the highest severity. Once the target threshold ismet, Juniper ATP Cloud continues looking for threats for a configurable duration from 0 to 10 minutes. This allows Juniper ATP Cloud to collect more information about the attacker and the attack vector, and to update the threat intelligence accordingly. The other options are incorrect. Option A is not configurable, and option D is not consistent with the documentation. References:

Juniper Advanced Threat Prevention Cloud | Juniper Networks

Juniper’s Attacker IP feed bolsters threat protection with SecIntel

 A chassis cluster is a pair of SRX Series devices that are connected and configured to operate as a single node, providing high availability and load balancing for traffic flows1. A chassis cluster consists of two nodes: one primary and one secondary. Each node can host one or more redundancy groups, which are logical entities that group the interfaces and services that need to fail over together in case of a node failure2. Redundancy group 0 is a special group that monitors the control plane of the cluster, such as the routing engine and the control link. Redundancy group 0 is always active on the primary node and standby on the secondary node3. Therefore, option A is false. Each chassis cluster member requires a unique node ID value, which can be either 0 or 1, to identify itself within the cluster4. However, the cluster ID value is the same for both nodes, and it is used to identify the cluster as a whole. Therefore, option B is false. Each chassis cluster member device can host active redundancy groups, depending on the configuration and the status of the nodes. By default, the primary node hosts all the redundancy groups, but you can configure some groups to be preempted by the secondary node if it has a higher priority or load-sharing between the nodes if they have the same priority. Therefore, option C is true. Chassis cluster member devices must be the same model, because different models have different hardware and software specifications that may not be compatible with each other in a cluster. Therefore, option D is true. References:

Chassis Cluster User Guide for SRX Series Devices

Understanding Chassis Cluster Redundancy Groups

Understanding Redundancy Group 0

Understanding Chassis Cluster Node IDs

[Understanding Chassis Cluster Cluster IDs]

[Configuring Chassis Cluster Redundancy Group Settings]

[Chassis Cluster Feature Guide for SRX Series Devices]

 vSRX is a virtual firewall that runs on various cloud platforms, including AWS and OpenStack. AWS is a cloud service provider that offers infrastructure as a service (IaaS) solutions, such as compute, storage, and networking resources. OpenStack is an open source software platform that enables cloud orchestration, which is the automated management of cloud resources and services. vSRX supports both AWS and OpenStack as deployment options, and integrates with their features and tools. For example, vSRX can use cloud-init to automate the initialization of vSRX instances in AWS and OpenStack environments. vSRX can also leverage the security groups and elastic IP addresses of AWS, and the network and security services of OpenStack. References:

vSRX Deployment Guide for AWS

vSRX Virtual Firewall

Use Cloud-Init in an OpenStack Environment to Automate the Initialization of vSRX Instances

The count logging parameter displays the number of packets that match the firewall filter term in a tabular format. The count parameter also creates a counter that you can view with the show firewall command. The other logging parameters (permit, session-init, and session-close) do not show tabular data, but rather log the packets that match the term to a system log file or a user-specified file. References:

Understanding Firewall Filter Counters

Configuring Firewall Filter Counters

show firewall

Adaptive Threat Profiling is a feature that allows SRX Series Firewalls to generate, propagate, and consume threat feeds based on their own advanced detection and policy-match events. This feature enables you to configure security or IDP policies that, when matched, inject the source IP address, destination IP address, source identity, or destination identity into a threat feed, which can be leveraged by other devices as a dynamic-address-group (DAG). With adaptive threat profiling, the Juniper ATP Cloud service acts as a feed-aggregator and consolidates feeds from SRX across your enterprise and shares the deduplicated results back to all SRX Series Firewalls in the realm at regular intervals. SRX Series Firewalls can then use these feeds to perform further actions against the traffic. This feature allows you to find systems running applications that increase the risks on your network and ensure these systems are processed through IPS and Juniper ATP Cloud for malware and virus protection1. References:

Adaptive Threat Profiling Overview and Configuration

Adaptive Threat Profiling Overview

Juniper Launches Adaptive Threat Profiling, New VPN Features

Juniper Networks Answers Who and What is On the Network with Risk-Based Access Control Capabilities and New VPN Application

Adaptive Threat Profiling Overview | SD Cloud

Based on the information from the exhibit, node0 is the primary node for both redundancy group 0 (RG0) and redundancy group 1 (RG1). RG0 is responsible for the control plane, which includes the Routing Engine and the management interface. RG1 is responsible for the data plane, which includes the interfaces and services. Therefore, node0 is the active node for the data plane, and node1 is the active node for the control plane34 References:

Chassis Cluster Redundancy Groups | Junos OS | Juniper Networks

Troubleshooting a Redundancy Group that Does Not Fail Over in an SRX Chassis Cluster | Junos OS | Juniper Networks

Understanding Chassis Cluster Redundancy Group 0: Routing Engines | Junos OS | Juniper Networks

Understanding Chassis Cluster Redundancy Groups 1 Through 128 | Junos OS | Juniper Networks