Pre-Summer Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: validbest

Pass the Juniper JNCIP-SEC JN0-637 Questions and answers with ValidTests

Exam JN0-637 All Questions
Exam JN0-637 Premium Access

View all detail and faqs for the JN0-637 exam

Viewing page 2 out of 4 pages
Viewing questions 11-20 out of questions
Questions # 11:

You are asked to establish a hub-and-spoke IPsec VPN using an SRX Series device as the hub. All of the spoke devices are third-party devices.

Which statement is correct in this scenario?

Options:

A.

You must ensure that you are using aggressive mode when incorporating third-party devices as your spokes.

B.

You must statically configure the next-hop tunnel binding table entries for each of the third-party spoke devices.

C.

You must create a policy-based VPN on the hub device when peering with third-party devices.

D.

You must always peer using loopback addresses when using non-Junos devices as your spokes.

Expert Solution
Questions # 12:

Click the Exhibit button.

Question # 12

Referring to the exhibit, which two statements are true? (Choose two.)

Options:

A.

The traffic is permitted.

B.

The traffic was initiated by the 10.10.102.10 address.

C.

The destination device is not responding.

D.

The traffic is denied.

Expert Solution
Questions # 13:

You are asked to create multiple virtual routers using a single SRX Series device. You must ensure that each virtual router maintains a unique copy of the routing protocol daemon (RPD) process.

Which solution will accomplish this task?

Options:

A.

Secure wire

B.

Tenant system

C.

Transparent mode

D.

Logical system

Expert Solution
Questions # 14:

Exhibit:

Question # 14

Your company uses SRX Series devices to establish an IPsec VPN that connects Site-1 and the HQ networks. You want VoIP traffic to receive priority over data traffic when it is forwarded across the VPN.

Which three actions should you perform in this scenario? (Choose three.)

Options:

A.

Enable next-hop tunnel binding.

B.

Create a firewall filter that identifies VoIP traffic and associates it with the correct forwarding class.

C.

Configure CoS forwarding classes and scheduling parameters.

D.

Enable the copy-outer-dscp parameter so that DSCP header values are copied to the tunneled packets.

E.

Enable the multi-sa parameter to enable two separate IPsec SAs for the VoIP and data traffic.

Expert Solution
Questions # 15:

You have a multinode HA default mode deployment and the ICL is down.

In this scenario, what are two ways that the SRX Series devices verify the activeness of their peers? (Choose two.)

Options:

A.

Custom IP addresses may be configured for the activeness probe.

B.

Fabric link heartbeats are used to verify the activeness of the peers.

C.

Each peer sends a probe with the virtual IP address as the destination IP address.

D.

Each peer sends a probe with the virtual IP address as the source IP address and the upstream router as the destination IP address.

Expert Solution
Questions # 16:

Referring to the exhibit, you are assigned the tenantSYS1 user credentials on an SRX series

device.

In this scenario, which two statements are correct? (Choose two.)

Options:

A.

When you log in to the device, you will be located at the operational mode of the main system hierarchy.

B.

When you log in to the device, you will be located at the operational mode of the Tenant.SY51 logical system hierarchy.

C.

When you log in to the device, you will be permitted to view only the routing tables for the Tenant SYS1 logical system.

D.

When you log in to the device, you will be permitted to view all routing tables available on the on an SYS1 Series device.

Expert Solution
Questions # 17:

Referring to the exhibit, you are attempting to set up a remote access VPN on your SRX series devices.

Question # 17

However you are unsure of which system services you should allow and in which zones they should be allowed to correctly finish the remote access VPN configuration

Which two statements are correct? (Choose two.)

Options:

A.

You should add the host-inbound-traffic system-service ike statement to the Untrust zone.

B.

You should add the host-inbound-traffic system-service ike statement to the VPN zone.

C.

You should add the host-inbound-traffic system-service tcp-encap statement to the Untrust zone

D.

You should add the host-inbound-traffic system-service tcp-encap statement to the VPN zone

Expert Solution
Questions # 18:

Exhibit:

Question # 18

Referring to the exhibit, which IKE mode will be configured on the HQ-Gateway and Subsidiary-Gateway?

Options:

A.

Main mode on both the gateways

B.

Aggressive mode on both the gateways

C.

Main mode on the HQ-Gateway and aggressive mode on the Subsidiary-Gateway

D.

Aggressive mode on the HQ-Gateway and main mode on the Subsidiary-Gateway

Expert Solution
Questions # 19:

You want to configure the SRX Series device to map two peer interfaces together and ensure that there is no switching or routing lookup to forward traffic.

Which feature on the SRX Series device is used to accomplish this task?

Options:

A.

Transparent mode

B.

Secure wire

C.

Mixed mode

D.

Switching mode

Expert Solution
Questions # 20:

You are configuring advanced policy-based routing. You have created a static route with next

hop of an interface in your inet.0 routing table

Question # 20

Question # 20

Referring to the exhibit, what should be changed to solve this issue?

Options:

A.

You should change the routing instance type to virtual-router.

B.

You should move the static route configuration to the main routing instance.

C.

You should move the inet. o table before the routing instance table in your rib-groups configuration.

D.

You should delete the interface-routes configuration under the routing-options hierarchy.

Expert Solution
Viewing page 2 out of 4 pages
Viewing questions 11-20 out of questions