Free Practice Questions for Juniper JN0-335 Exam

A policy scheduler is a feature that allows you to specify when a security policy is in effect. You can configure a policy scheduler to start at a specific date and time or start on a recurrent basis, such as daily, weekly, or monthly. A policy scheduler determines the time frame that a security policy is actively evaluated and enforced by the SRX Series device2

A policy scheduler can only be applied to security policies that have the action of permit or reject. A policy scheduler cannot be applied to security policies that have the action of deny. A policy scheduler is not related to the policy-rematch feature, which is used to reevaluate existing sessions when a security policy is modified. A policy scheduler cannot be dynamically activated based on traffic flow volumes2 References:

1: Juniper Security Specialist (JNCIS-SEC) (JN0-334) | Study Guide 3

2: Junos OS Security Configuration Guide | Configuring Policy Schedulers 4

B: Chassis cluster member devices synchronize configuration using the control link. The control link is used to exchange control messages and configuration information between the two nodes of a chassis cluster1. The primary node pushes the configuration to the secondary node and ensures that both nodes have the same configuration2.

C: A control link failure causes the secondary cluster node to be disabled. If the control link fails, the primary node cannot communicate with the secondary node and assumes that the secondary node is down1. The primary node then disables the secondary node and takes over all the traffic processing2.

E: Heartbeat messages verify that the chassis cluster control link is working. The control link also carries heartbeat messages that are exchanged between the two nodes every 500 milliseconds by default1. The heartbeat messages indicate the status and health of the nodes and the control link2.

A: Chassis cluster control links must be configured using RFC 1918 IP addresses. This is a false statement. The control link can use any IP address range as long as it is not in conflict with other interfaces or routes on the cluster nodes1. RFC 1918 IP addresses are private addresses that are not routable on the Internet4.

D: Recovery from a control link failure requires that the secondary member device be rebooted. This is also a false statement. Recovery from a control link failure does not require rebooting the secondary node1. The secondary node can rejoin the cluster when the control link is restored and the configuration is synchronized2.

References:

1: Configuring Chassis Clustering on SRX Series Devices

2: Chassis Cluster User Guide for SRX Series Devices

3: Connecting SRX Series Firewalls to Create a Chassis Cluster

4: RFC 1918 - Address Allocation for Private Internets

https://supportportal.juniper.net/s/article/SRX-Secondary-node-of-a-Chassis-Cluster-is-in-Disabled-state-how-do-you-find-the-cause

A vSRX is a virtualized security platform that runs on various hypervisors and cloud environments. It provides firewall and NAT services, as well as other security features, such as IPS, VPN, UTM, and AppSecure. A single vSRX can fulfill the minimum requirements for providing firewall and NAT services in a private cloud, as it can be deployed as a gateway or an edge device, and can scale up or down as needed. A vSRX can also interoperate with other Juniper and third-party products, such as Contrail Networking, Junos Space Security Director, and Sky ATP. A single vSRX is more cost-effective and simpler to manage than having separate vSRX instances for firewall and NAT services. A cSRX is a containerized version of vSRX that runs on Linux-based platforms. It provides similar security features as vSRX, but with a smaller footprint and faster deployment. However, a cSRX is not yet supported on all cloud environments, and it may have some limitations compared to vSRX, such as lower throughput and fewer interfaces. Therefore, a single cSRX may not be able to fulfill the minimum requirements for providing firewall and NAT services in a private cloud, depending on the specific cloud platform and the performance and scalability needs. A cSRX for firewall services and a separate cSRX for NAT services would also introduce more complexity and overhead than a single vSRX. References: vSRX Overview, cSRX Overview, JNCIP-SEC Certification

The session table is a limited resource for SRX Series devices. If the session table is full, any new sessions will be rejected by the device. The aggressive session-aging mechanism accelerates the session timeout process when the number of sessions in the session table exceeds the specified high-watermark threshold. This mechanism minimizes the likelihood that the SRX Series devices will reject new sessions when the session table becomes full1. To perform aggressive session aging, you need to configure the following parameters1:

early-ageout –During aggressive session aging, the sessions with an age-out time lower than the early-ageout threshold are marked as invalid. The early-ageout configuration specifies the timeout value, in seconds, that will be applied once the high-watermark value is met. For example, if you set the early-ageout to 30 seconds, any session that has been inactive for at least 30 seconds will be aged out when the high-watermark is reached2.

high-watermark –The device performs aggressive session aging when the number of sessions in the session table exceeds the high-watermark threshold. The high-watermark configuration specifies the percentage of how much of the session table can be allocated before applying a more aggressive age-out timer. For example, if you set the high-watermark to 90 percent, the device will start aging out sessions more aggressively when the session table reaches 90 percent of its capacity3.

Therefore, the correct statements are B and D.

References: Understanding Aggressive Session Aging high-watermark early-ageout

A reth LAG is a redundant Ethernet interface that includes one or more physical interfaces from each node of a chassis cluster. A reth LAG provides increased bandwidth and link availability for the cluster. To configure a reth LAG, you need to follow these steps:

Configure the physical interfaces on each node as aggregated Ethernet interfaces with the same speed and duplex settings. This is required to ensure that the links can form a LAG andpass traffic correctly. You can use different cable types (such as copper or fiber-optic) for the links, but the speed must be the same.

Configure the reth interface with the redundant-ether-options statement and specify the aggregated Ethernet interfaces as child links. You should have at least two interfaces (one from each node) in the reth LAG, but you can add more for redundancy and load balancing. You can also specify the minimum-links statement to set the minimum number of child links that must be up for the reth interface to be up. The default value is one, but you can change it to a higher value if needed.

Configure the reth interface with the appropriate IP address, security zone, and other settings as needed. You can also enable LACP on the reth interface to dynamically negotiate the LAG parameters with the peer devices.

References:

[Aggregated Ethernet Interfaces in a Chassis Cluster] 1

[Chassis Cluster Redundant Ethernet Interfaces] 2

[LACP / LAG on Chassis Cluster - Interface Monitoring?] 3

[URGENT (LAG - RETH Interconnect)] 4

SRX chassis clustering is a high availability feature that allows two SRX Series devices to operate as a single logical device. The two devices are connected by a control link and a fabric link, which are used to synchronize the configuration, state, and traffic between the nodes. The control plane is responsible for managing the cluster configuration, monitoring the health and status of the nodes, and performing failover operations. The data plane is responsible for processing and forwarding the traffic through the cluster. SRX chassis clustering supports two modes for the data plane: active/passive and active/active. In active/passive mode, only one node is active for each redundancy group, which is a logical grouping of interfaces and services. The active node handles all the traffic for the redundancy group, while the passive node acts as a backup. In active/active mode, both nodes are active for different redundancy groups, and they can share the traffic load for the cluster. SRX chassis clustering supports only one mode for the control plane: active/passive. In this mode, only one node is the primary node, which is the master of the cluster configuration and the source of truth for the cluster state. The primary node also initiates the failover process in case of a node or interface failure. The other node is the secondary node, which is the slave of the cluster configuration and the backup of the cluster state. The secondary node takes over the primary role if the primary node fails or is manually disabled. References: Chassis Cluster Overview, SRX Series Chassis Cluster Configuration Overview, Chassis Cluster Overview

The SRX Series device will drop packets from the infected hosts with a threat level of 8 and no log message will be generated. This is because the security intelligence profile “ATP_Infected-Hosts” has a rule “Rule-1” that matches packets with a threat level of 8 and the action is to block and drop them. There is no log option specified in the action, so no log message will be generated. Options A and B are not correct because the rule only matches packets with a threat level of 8, not 8 or above. Option C is not correct because the action is to drop, not permit, the packets. References: The answer can be verified from Juniper’s official documentation on security intelligence available on their website. Here are some relevant links:

Security Intelligence Feature Guide for Security Devices

security-intelligence | Junos OS

Configure the Security Intelligence Policy on the SRX Series Device

To manually failover the primary Routing Engine in an SRX Series high availability cluster pair, you need to issue the request chassis cluster failover redundancy-group group-id node node-id command on the primary node, where group-id is the redundancy group number and node-id is the node number of the secondary node. This command initiates a graceful failover of the specified redundancy group to the secondary node, making it the new primary node. The other options are not necessary or correct for this task. Option A would disable the chassis cluster and reboot the primary node, which is not a graceful failover. Option B is not relevant, as the control link recovery solution is used to restore the control link connectivity between the nodes, not to initiate a failover. Option D would not trigger a failover, as the priority of the secondary node would only take effect after a reboot or a control link failure. References:

Chassis Cluster Redundancy Group Manual Failover

Initiating a Chassis Cluster Manual Redundancy Group Failover

SRX Getting Started - Troubleshoot High Availability (HA)

Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. It assigns a threat level to each attacker IP address from 1 to 10, with 10 being the highest severity. Once the target threshold ismet, Juniper ATP Cloud continues looking for threats for a configurable duration from 0 to 10 minutes. This allows Juniper ATP Cloud to collect more information about the attacker and the attack vector, and to update the threat intelligence accordingly. The other options are incorrect. Option A is not configurable, and option D is not consistent with the documentation. References:

Juniper Advanced Threat Prevention Cloud | Juniper Networks

Juniper’s Attacker IP feed bolsters threat protection with SecIntel