Free JN0-336 sample questions

Correct answer: The SSH session state is not synchronized as part of any redundancy group by default.

In a Junos OS chassis cluster, redundancy group 0 (RG0) is responsible for the failover of the Routing Engines. However, by default, RG0 does not synchronize the state of host-inbound traffic (like SSH or Telnet sessions to the device itself). User transit traffic is handled by data plane redundancy groups (RG1+), which do synchronize session states. Therefore, the termination of the SSH session during an RE failover is expected default behavior.

Correct answer: Add the file's SHA256 hash to the allowlist (whitelist) under the ATP Cloud configuration.

Juniper ATP Cloud allows for exceptions to be made using allowlists (whitelists) and blocklists (blacklists). To allow a specific file regardless of its threat score, its SHA256 hash should be added to the allowlist. This ensures that only that exact file is permitted, providing a more secure and granular exception than whitelisting an entire IP address, URL, or file type.

Correct answer: Configure a route-based VPN and define traffic selectors within the IPsec policy.

While policy-based VPNs inherently use the policy match for the proxy-id, the modern and more flexible approach on SRX devices is to use a route-based VPN. To interoperate with devices that require specific proxy-ids (also known as traffic selectors), you can define them explicitly within the `[edit security ipsec vpn ]` hierarchy. This allows the flexibility of a route-based VPN (using st0 interfaces) while satisfying the strict traffic selector requirements of the peer.

Correct answers: The SRX device has not been configured with the correct JIMS server IP address and client secret.; The SRX's security policy referencing the 'Contractors' group is positioned after a more general `any-any-permit` policy.

If the SRX cannot authenticate and communicate with the JIMS server via the REST API, it cannot retrieve the required user and group information. An incorrect IP address or a mismatched client secret will cause this communication to fail, preventing the SRX from enforcing identity-based policies.

Junos security policies are evaluated sequentially from top to bottom. If a broader policy that permits the traffic (e.g., from source-address any to destination-address any) is placed before the more specific identity-aware policy, the traffic will match the first rule and be permitted. The identity-aware policy will never be evaluated.

Correct answer: False

This statement is false. For SSL Forward Proxy to function without causing certificate errors on client machines, the root CA certificate configured on the SRX must be installed and trusted by the clients' web browsers. The SRX acts as a man-in-the-middle, re-signing server certificates with its own CA. If clients do not trust this CA, they will receive security warnings for every HTTPS site they visit.

Correct answer: Configure SSL Forward Proxy with a whitelist for financial/healthcare domains. Apply an ATP Cloud policy to the decrypted traffic. Enable Encrypted Traffic Insights (ETI) for all traffic to gain visibility into the whitelisted sessions.

This is the optimal solution. It meets all requirements by using a multi-layered approach: 1. **SSL Forward Proxy with a whitelist:** This selectively decrypts general web traffic while bypassing decryption for sensitive domains (Requirement 2). 2. **ATP Cloud on decrypted traffic:** This allows deep inspection for malware in the non-sensitive traffic (Requirement 1). 3. **Encrypted Traffic Insights (ETI):** ETI analyzes metadata from ALL sessions, including the non-decrypted ones. This provides threat intelligence (like C2 detection based on connection patterns and certificate info) for the whitelisted traffic without violating privacy (Requirement 3). 4. **Selective Decryption:** This approach minimizes the performance load compared to decrypting all traffic (Requirement 4).

Correct answer: The attack object itself

Within the configuration of a custom IDP attack object, the `direction` attribute is used to specify the flow direction of the traffic to be matched. The options are typically `client-to-server`, `server-to-client`, or `any`. This is a fundamental part of the attack signature definition itself.

Correct answer: Preprovision Profiles

Preprovision profiles in Security Director are used to define a template of settings that are automatically applied to a device when it is first discovered and onboarded, particularly through ZTP. This profile can include device-specific settings, authentication details, and initial configuration templates, ensuring that new devices come online with a correct and secure baseline configuration.

Correct answer: To synchronize real-time session state and in-flight data between the nodes.

The fabric link (or data link) is a dedicated connection between the two nodes of a chassis cluster. Its main purpose is to synchronize the real-time objects (RTOs), such as session state, for redundancy groups RG1 and higher. This ensures that if a failover occurs, the new primary node has all the necessary session information to continue processing traffic without interruption.

Correct answers: IPsec protocol (ESP or AH); Encryption algorithm (such as AES-256)

The IPsec protocol, which determines whether to use Encapsulating Security Payload (ESP) or Authentication Header (AH), is a key parameter negotiated during the IKE Phase 2 (Quick Mode) exchange.

The encryption algorithm (e.g., AES, 3DES) and the authentication algorithm (e.g., SHA-256, HMAC-SHA1) used to protect the actual data traffic are defined in the IPsec proposal and negotiated during IKE Phase 2. A mismatch here is a common cause of Phase 2 failure.