Security, Professional (JNCIP-SEC) Practice Questions
The most impressive hallmark of Dumpspedia’s JN0-636 dumps practice exam questions answers is that they have been prepared by the Juniper industry experts who have deep exposure of the actual JNCIP-SEC exam requirements. Our experts are also familiar with the Security, Professional (JNCIP-SEC) exam takers’ requirements.
JN0-636 Juniper Exam Dumps
Once you complete the basic preparation for Security, Professional (JNCIP-SEC) exam, you need to revise the Juniper syllabus and make sure that you are able to answer real JN0-636 exam questions. For that purpose, We offers you a series of JNCIP-SEC practice tests that are devised on the pattern of the real exam.
Free of Charge Regular Updates
Once you make a purchase, you receive regular Security, Professional (JNCIP-SEC) updates from the company on your upcoming exam. It is to keep you informed on the changes in Juniper JN0-636 dumps, exam format and policy (if any) as well in time.
100% Money Back Guarantee of Success
The excellent JN0-636 study material guarantees you a brilliant success in Juniper exam in first attempt. Our money back guarantee is the best evidence of its confidence on the effectiveness of its Security, Professional (JNCIP-SEC) practice exam dumps.
24/7 Customer Care
The efficient Juniper online team is always ready to guide you and answer your JNCIP-SEC related queries promptly.
Free JN0-636 Demo
Our JN0-636 practice questions comes with a free Security, Professional (JNCIP-SEC) demo. You can download it on your PC to compare the quality of other Juniper product with any other available JNCIP-SEC source with you.
Related Certification Exams
JN0-636 PDF vs Testing Engine
Security, Professional (JNCIP-SEC) Questions and Answers
You are asked to deploy Juniper atp appliance in your network. You must ensure that incidents and
alerts are sent to your SIEM.
In this scenario, which logging output format is supported?
The Juniper ATP Appliance platform collects, inspects and analyzes advanced and stealthy web, file, and email-based threats that exploit and infiltrate client browsers, operating systems, emails and applications. Juniper ATP Appliance’s detection of malicious attacks generates incident and event details that can be sent to connected SIEM platforms in CEF, LEEF or Syslog formats1. CEF (Common Event Format) is an open log management standard that improves the interoperability of security-related information from different vendors2. Juniper ATP Appliance supports CEF format for sending events and system audit notifications to SIEM servers. You can configure the CEF format in the Juniper ATP Appliance Central Manager WebUI Config > Notifications > SIEM Settings1. Therefore, the correct answer is C. CEF is a supported logging output format for Juniper ATP Appliance. The other options are incorrect because:
- A. WELF (WebTrends Enhanced Log Format) is a proprietary log format developed by WebTrends Corporation for web analytics3. Juniper ATP Appliance does not support WELF format for SIEM integration.
- D. Binary is a numeric system that uses only two digits: 0 and 1. Binary is not a logging output format for Juniper ATP Appliance or any SIEM platform.
- SIEM Syslog, LEEF and CEF Logging
- Common Event Format Configuration Guide
- WebTrends Enhanced Log Format
You are asked to detect domain generation algorithms
Which two steps will accomplish this goal on an SRX Series firewall? (Choose two.)
According to the Juniper documentation, the steps to detect domain generation algorithms (DGA) on an SRX Series firewall are as follows:
- Define a security-metadata-streaming policy under [edit services]. A security-metadata-streaming policy is a configuration that enables the SRX Series firewall to collect and stream security metadata, such as DNS queries and responses, to Juniper ATP Cloud for analysis. Juniper ATP Cloud uses machine learning models and known pre-computed DGA domain names to provide domain verdicts, which helps in-line blocking and sinkholing of DNS queries on SRX Series firewalls1. You can define a security-metadata-streaming policy by using the following command:
set services security-metadata-streaming policy
- Attach the security-metadata-streaming policy to a security zone. A security zone is a logical grouping of interfaces that have similar security requirements. You can attach the security-metadata-streaming policy to a security zone by using the following command:
set security zones security-zone
The following steps are not required or incorrect:
- Define an advanced-anti-malware policy under [edit services]. An advanced-anti-malware policy is a configuration that enables the SRX Series firewall to scan files for malware using Juniper ATP Cloud. It is not related to DGA detection2.
- Attach the advanced-anti-malware policy to a security policy. A security policy is a configuration that defines the rules for permitting or denying traffic between security zones. It is not related to DGA detection3.
References: 1: Configuring Security Metadata Streaming 2: Configuring Advanced Anti-Malware Policies 3: Configuring Security Policies
In Juniper ATP Cloud, what are two different actions available in a threat prevention policy to deal with an infected host? (Choose two.)
In Juniper ATP Cloud, a threat prevention policy allows you to define how the system should handle an infected host. Two of the available actions are:
- Close the connection: This action will close the connection between the infected host and the destination to which it is trying to connect. This will prevent the host from communicating with the destination and will stop any malicious activity.
- Quarantine the host: This action will isolate the infected host from the network by placing it in a quarantine VLAN. This will prevent the host from communicating with other devices on the network, which will prevent it from spreading malware or exfiltrating data.
Sending a custom message is used to notify the user and administrator of the action taken. Drop the connection silently is not an action available in Juniper ATP Cloud.
According to the Juniper documentation, the threat prevention policy in Juniper ATP Cloud is a configuration that defines the actions and notifications for different threat levels of the traffic. The threat levels are based on the verdicts returned by Juniper ATP Cloud after analyzing the files, URLs, and domains. The threat levels range from 1 to 10, where 1 is the lowest and 10 is the highest1.
The threat prevention policy allows the user to specify different actions for different threat levels. The actions can be applied to the traffic or to the infected host. The actions available for the traffic are:
- Permit: Allows the traffic to pass through the SRX Series device without any interruption.
- Block: Blocks the traffic and sends a reset packet to the client and the server.
- Drop: Drops the traffic silently without sending any reset packet.
- Redirect: Redirects the traffic to a specified URL, such as a warning page or a sinkhole server.
The actions available for the infected host are:
- None: Does not take any action on the infected host.
- Quarantine: Quarantines the infected host by applying a firewall filter that blocks all outbound traffic from the host, except for the traffic to Juniper ATP Cloud or the specified redirect URL.
- Custom: Executes a custom script on the SRX Series device to perform a user-defined action on the infected host, such as sending an email notification or triggering an external system.
Therefore, the two different actions available in a threat prevention policy to deal with an infected host are:
- Block: This action will block the traffic from or to the infected host and send a reset packet to the client and the server. This will prevent the infected host from communicating with the malicious server or spreading the malware to other hosts.
- Quarantine: This action will quarantine the infected host by blocking all outbound traffic from the host, except for the traffic to Juniper ATP Cloud or the redirect URL. This will isolate the infected host from the network and allow the user to remediate the infection.
The following actions are not available or incorrect:
- Send a custom message: This is not an action available in the threat prevention policy. However, the user can use the custom action to execute a script that can send a custom message to the infected host or the administrator.
- Drop the connection silently: This is an action available for the traffic, not for the infected host. It will drop the traffic without sending any reset packet, which may not be effective in stopping the infection or notifying the user.
References: 1: Configuring Threat Prevention Policies