JN0-637 practice questions 61–70

1. Question 61 · 70 in bank

   You configured two SRX Series devices in an active/passive multinode HA setup. You just rebooted both devices. In this scenario, which statement is correct?

   • ABoth devices are in the active state until the activeness determination process Is completed
   • BBoth devices are in the passive state until the activeness determination process is completed.
   • CBoth devices start in a hold state until the activeness determination process is completed.
   • DBoth devices start in the undiscovered state until the activeness determination process Is completed.

   Show answer

   Answer: C

   Next question

2. Question 62 · 70 in bank

   Select 2

   You need to generate a certificate for a PKI-based site-to-site VPN. The peer is expecting to use your domain name, vpn.Juniper.net, to establish the VPN. Your domain name, vpn.juniper.net, resolves to 10.100.0.5. Which two configuration elements are required when you generate your certificate request? (Choose two.)

   • Aemail [email protected]
   • Bip-address 10.100.0.5
   • Cdomain-name vpn.juniper.net
   • Dsubject CN=vpn.juniper.net

   Show answer

   Answer: BD

   Next question

3. Question 63 · 70 in bank

   Click the Exhibit button.

   

   You are asked to establish IBGP between two nodes, but the session is not established. To troubleshoot this problem, you configured trace options to monitor BGP protocol message exchanges. Referring to the exhibit, which action would solve the problem?

   • AAdd BGP to the lo0 host-inbound-traffic configuration.
   • BModify the security policy to permit the BGP packets.
   • CAdd the junos-host zone policy to permit the BGP packets.
   • DAdd a firewall filter to lo0 that permits the BGP packets.

   Show answer

   Answer: A

   Next question

4. Question 64 · 70 in bank

   Select 2

   Which two statements about transparent mode and Ethernet switching mode on an SRX Series device are correct? (Choose two.)

   • AIn transparent mode, IRB Interfaces must be placed in a security zone
   • BIn Ethernet switching mode Layer 2 Interfaces must be placed in a security zone.
   • CIn transparent mode, Layer 2 interfaces must be placed in a security zone.
   • DIn Ethernet switching mode. IRB Interfaces must be placed in a security zone.

   Show answer

   Answer: CD

   Next question

5. Question 65 · 70 in bank

   Click the Exhibit button.

   

   You implement persistent NAT to allow any device on the external side of the firewall to initiate traffic once the initial translation has been established. Communication is not working according to the design requirements. Referring to the exhibit, which statement is correct?

   • AThe any-remote-host parameter does not support interface-based NAT and needs an IP pool to work.
   • BThe target-host parameter should be used instead of the any-remote-host parameter.
   • CThe target-host-port parameter should be used instead of the any-remote-host parameter.
   • DThe port-overloading parameter needs to be turned off in the NAT source interface configuration.

   Show answer

   Answer: D

   Next question

6. Question 66 · 70 in bank

   Select 2

   You are deploying IPsec VPNs to securely connect several enterprise sites with OSPF for dynamic routing. Some of these sites are secured by third- party devices not running Junos. Which two statements are true for this deployment? (Choose two.)

   • AOSPF over IPsec can be used for intersite dynamic routing.
   • BSites with overlapping address spaces can be supported.
   • COSPF over GRE over IPsec is required to enable intersite dynamic routing.
   • DSites with overlapping address spaces cannot be supported.

   Show answer

   Answer: BC

   Next question

7. Question 67 · 70 in bank

   Select 2

   Which two statements are correct about DNS doctoring? (Choose two.)

   • AThe DNS ALG must be disabled.
   • BProxy ARP is required if your NAT pool for the server is on the same subnet as the uplink interface.
   • CProxy ARP is required if your NAT pool for the server is on a different subnet as the uplink interface.
   • DThe DNS ALG must be enabled.

   Show answer

   Answer: BD

   Next question

8. Question 68 · 70 in bank

   Select 3

   Click to the Exhibit button.

   

   Your company uses SRX Series devices to establish an IPsec VPN that connects Site-1 and the HQ networks. You want VoIP traffic to receive priority over data traffic when it is forwarded across the VPN. Which three actions should you perform in this scenario? (Choose three.)

   • AEnable the copy-outer-dscp parameter so that DSCP header values are copied to the tunneled packets.
   • BEnable next-hop tunnel blinding.
   • DCreate a firewall filter that identifies VoIP traffic and associates it with the correct forwarding class.
   • EEnable the multi-sa parameter to enable two separate IPsec SAs for the VoIP and data traffic. E. Configure CoS forwarding classes and scheduling parameters.

   Show answer

   Answer: ADE

   Next question

9. Question 69 · 70 in bank

   Select 2

   Click the Exhibit button.

   

   Referring to the exhibit, which two statements are correct? (Choose two.)

   • AYou cannot secure intra-VLAN traffic with a security policy on this device.
   • BYou can secure inter-VLAN traffic with a security policy on this device.
   • CThe device can pass Layer 2 and Layer 3 traffic at the same time.
   • DThe device cannot pass Layer 2 and Layer 3 traffic at the same time.

   Show answer

   Answer: AB

   Next question

10. Question 70 · 70 in bank

    Select 2

    Click to the Exhibit button.

    

    Which two statements are correct about the NAT configuration shown in the exhibit? (Choose two.)

    • AAny external host will be able to initiate a session to the reflexive address.
    • BThe original destination port is used for the source port for the session.
    • COnly a specific host can initiate a session to the reflexive address after the initial session.
    • DOnly an internal host can initiate a session after translation.

    Show answer

    Answer: CD

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

JN0-637 practice, question 61. 70 questions available.