NEW QUESTION NO: 50
You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface.
Which configuration would accomplish this task?
A. Configure IP monitoring of the important interface's IP address and adjust the heartbeat interval and heartbeat threshold to the shortest settings.
B. Create a VRRP group configuration that lists the reth's IP address as the VIP while using each physical interface that make up the reth definition of each SRX HA pair.
C. Create a separate redundancy group to isolate the important interface; set the priority of the new redundancy group to 255.
D. Configure interface monitor inside the redundancy group that contains the important physical interface; adjust the weight associated with the monitored interface to 255.
Answer: D

NEW QUESTION NO: 51
What are three valid virtual interface types for a vSRX? (Choose three.)
A. SR-IOV
B. fxp0
C. eth0
D. VMXNET 3
E. virtio
Answer: A,B,D

NEW QUESTION NO: 52
Which SRX5400 component is responsible for performing first pass security policy inspection?
A. Services Processing Unit
B. Switch Control Board
C. Modular Port Concentrator
D. Routing Engine
Answer: A

NEW QUESTION NO: 53
Which two statements about security policy actions are true? (Choose two.)
A. The log action requires an additional terminating action.
B. The log action implies an accept action.
C. The count action requires an additional terminating action.
D. The count action implies an accept action.
Answer: A,C

NEW QUESTION NO: 54
Click the Exhibit button.

You notice that your SRX Series device is not blocking HTTP traffic as expected.
Referring to the exhibit, what should you do to solve the problem?
A. Reboot the SRX Series device.
B. Configure the SRX Series device to operate in packet-based mode.
C. Move the deny-httppolicy to the bottom of the policy list.
D. Commit the configuration.
Answer: A

NEW QUESTION NO: 55
You are asked to support source NAT for an application that requires that its original source port not be changed.
Which configuration would satisfy the requirement?
A. Configure the egress interface to source NAT fixed-port status.
B. Configure a source NAT rule that references an IP address pool with interface proxy ARP enabled.
C. Configure a source NAT rule that sets the egress interface to the overloadstatus.
D. Configure a source NAT rule that references an IP address pool with the port no-translation parameter enabled.
Answer: D

NEW QUESTION NO: 56
Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?
A. fab0
B. swfab0
C. me0
D. fxp0
Answer: B

NEW QUESTION NO: 57
Which action will restrict SSH access to an SRX Series device from a specific IP address which is connected to a security zone named trust?
A. Implement a security policy from security zone trust to security zone junos-host.
B. Implement a firewall filter on the security zone trust.
C. Implement host-inbound-traffic system-services to allow SSH.
D. Implement a security policy from security zone junos-host to security zone trust.
Answer: A

NEW QUESTION NO: 58
Which host-inbound-traffic security zone parameter would allow access to the REST API configured to listen on custom TCP port 5080?
A. http
B. any-service
C. xnm-clear-text
D. all
Answer: B

NEW QUESTION NO: 59
Which statement describes the function of NAT?
A. NAT detects various attacks on traffic entering a security device.
B. NAT encrypts transit traffic in a tunnel.
C. NAT translates a public address to a private address.
D. NAT restricts or permits users individually or in a group.
Answer: C

NEW QUESTION NO: 60
Click the exhibit button.

Referring to the exhibit, which statement is true?
A. Packets entering the interface are being dropped because of a stateless filter.
B. Packets entering the interface matching an ALG are getting dropped.
C. TCP packets entering the interface are failing the TCP sequence check.
D. Packets entering the interface are getting dropped because the interface is not bound to a zone.
Answer: D