Pass the Juniper JNCIS-SEC JN0-335 Questions and answers with CertsForce

Based on the exhibit, Nancy logged in to the juniper.net Active Directory domain, as shown by the domain name in the user identity information. The IP address of the authenticating domain controller is 172.25.11.140, as shown by the domain controller address in the user identity information. The IP address of Nancy’s client PC is not 172.25.11, but 172.25.11.11, as shown by the source IP address in the user identity information. Nancy is not a member of the Active Directory sales group, but of the marketing group, as shown by the group name in the user identity information34 References:

active-directory-access | Junos OS | Juniper Networks

13. Juniper SRX Active Directory Integration - RAYKA

Configure Juniper Identity Management Service to Obtain User Identity …

Create an Active Directory Profile | SD Cloud | Juniper Networks

The cSRX is a containerized version of the SRX Series device that runs on Linux platforms. The cSRX has the following benefits for deploying in a virtual environment:

The cSRX supports Layer 2 and Layer 3 deployments, which means it can operate as a transparent or a routed firewall. The cSRX can also support multiple routing instances and virtual routers2

The cSRX supports firewall, NAT, IPS, and UTM services, which means it can provide comprehensive security features for protecting the virtual network. The cSRX can also support application identification, user firewall, and VPN services2

The cSRX default configuration does not contain three default zones: trust, untrust, and management. The cSRX default configuration contains only one zone: junos-host. The cSRX does not have low memory requirements. The cSRX requires at least 2 GB of memory and 2 CPU cores to run2 References:

1: Juniper Security Specialist (JNCIS-SEC) (JN0-334) | Study Guide 3

2: Junos OS Security Configuration Guide | cSRX Overview 4

AppQoS is a feature that enables you to identify and control access to specific applications and provides the granularity of the stateful firewall rule base to match and enforce quality of service (QoS) at the application layer. AppQoS expands the capability of Junos OS class of service (CoS) to include the following capabilities12:

Re-write DSCP values based on Layer-7 application types. DSCP values are used to convey the packet’s quality of service through both the forwarding class and a loss priority.

Assign a forwarding class based on the application type. Forwarding classes are used to group packets with similar QoS requirements and map them to output queues on the egress interface.

Rate-limit traffic based on the application type. Rate limiters are used to control the transmission speed and volume for the associated queues. You can configure rate limiters and profiles to specify the bandwidth, burst size, and action for each application type.

AppQoS does not have the capability to re-write the TTL or reserve bandwidth. Re-writing the TTL is not related to QoS and could cause routing loops or packet drops. Reserving bandwidth is a function of traffic engineering, not AppQoS. References:

1: Application QoS | Junos OS | Juniper Networks

2: AppQoS for Tenant Systems | Junos OS | Juniper Networks

 JSA supports high availability (HA) clusters, which are two JSA hosts that act as a single system. The primary host is the active host and the secondary host is the standby host. If the primary host fails, the secondary host takes over and becomes the active host1 To configure an HA cluster, you must ensure that the software versions on both primary and secondary hosts are the same, and that the cluster virtual IP address is an unused IP address on the same subnet as the primary and secondary hosts1 The secondary host does not backup multiple JSA primary hosts, as each HA cluster consists of only one primary and one secondary host1 The primary and secondary hosts do not need to be configured with the same storage devices, as long as they have enough disk space to store the same amount of data2 References:

1: HA Clusters | Junos OS | Juniper Networks

2: JSA Virtual Appliance | Juniper Networks US

The infected host cloud feed is a list of IP addresses that have been identified as compromised or infected by malware. The feed is updated by Juniper ATP Cloud based on the detection of malicious activity from the hosts, such as contacting known command-and-control servers. When a host on the network reaches the configured threat level threshold, its IP address is automatically added to the infected host cloud feed and blocked from communicating with any other hosts on the Internet. The other feeds are not relevant for this situation. The command-and-control cloud feed is a list of IP addresses that are known to be used by malware for remote control and communication. The allowlist and blocklist feed is a user-defined list of IP addresses that are either allowed or denied by the SRX Series device. The custom cloud feed is a user-defined list of IP addresses that are associated with a specific category or threat level. References:

Infected Hosts: More Information

Juniper’s Attacker IP feed bolsters threat protection with SecIntel

ATP Appliance and SRX Series Threat Level Comparison Chart

In a Juniper Networks chassis clustering setup, when you enable chassis clustering on two devices and assign a cluster ID and a node ID to each device, the correct order for rebooting the devices is: C. Reboot the primary device, then the secondary device. Explanation: After assigning the cluster ID and node ID to each device, it is a good practice to reboot the primary device first. This ensures that the primary device comes online with the specified cluster and node IDs. Once the primary device is up and running, you can then reboot the secondary device. The secondary device will recognize the existing cluster and node IDs assigned to the primary device and join the cluster accordingly.

vSRX is a virtual firewall that runs on various hypervisors, such as VMware ESXi, Microsoft Hyper-V, and KVM. vSRX provides security and networking services at the perimeter or edge of virtualized environments. vSRX supports different versions of VMware ESXi, Hyper-V, and KVM, depending on the Junos OS release and the vSRXflavor. Citrix Hypervisor and Oracle VM are not supported hypervisors for vSRX. References:

vSRX Overview

Understand vSRX with Microsoft Hyper-V

Requirements for vSRX Virtual Firewall on VMware

vSRX Deployment Guide for Microsoft Hyper-V

vSRX Chassis Cluster/High Availability support for vSRX

The fab interface is the data link between the nodes of a chassis cluster and is used to forward traffic between the chassis and to synchronize the data plane software’s dynamic runtime state. Real-time objects (RTOs) are exchanged on the fab interface to maintain session synchronization for operations such as authentication, NAT, ALGs, and IPsec. In an active/active configuration, inter-chassis transit traffic is sent over the fab interface, as traffic arriving on a node that needs to be processed on the other or traffic processed on a node that needs to exit through an interface on the other is forwarded over the fabric. The fab interface does not enable configuration synchronization, as this is done by the control link. Heartbeat signals sent on the fab interface monitor the health of the data plane link, not the control plane link. References: Chassis Cluster Fabric Interfaces, HA Chassis cluster, difference between Swfab and Fab

The SRX Series device will drop packets from the infected hosts with a threat level of 8 and no log message will be generated. This is because the security intelligence profile “ATP_Infected-Hosts” has a rule “Rule-1” that matches packets with a threat level of 8 and the action is to block and drop them. There is no log option specified in the action, so no log message will be generated. Options A and B are not correct because the rule only matches packets with a threat level of 8, not 8 or above. Option C is not correct because the action is to drop, not permit, the packets. References: The answer can be verified from Juniper’s official documentation on security intelligence available on their website. Here are some relevant links:

Security Intelligence Feature Guide for Security Devices

security-intelligence | Junos OS

Configure the Security Intelligence Policy on the SRX Series Device