JN0-636 Online Practice Questions and Answers

Correct Answer: AB

Explanation: To block all known Tor network IP addresses on an SRX Series device, the following steps must be taken:

Enroll the devices with Juniper ATP Appliance or Juniper ATP Cloud: both of these services provide threat intelligence feeds that include known IP addresses associated with the Tor network. By enrolling the SRX Series device, the device

will have access to the latest Tor network IP addresses, and it can then use this information to block traffic from those IP addresses. Creating a custom feed containing all current known MAC addresses, is not a valid option since Tor network

uses IP addresses, MAC addresses are not used to identify the Tor network.

Enable a third-party Tor feed may be used but it's not necessary as Juniper ATP Appliance and Juniper ATP Cloud already provide the same feature.

Correct Answer: A

Correct Answer: C

Reference: https://kb.juniper.net/InfoCenter/index? page=contentandid=KB33979andcat=JATP_SERIESandactp=LIST

Correct Answer: BD

Explanation: To detect domain generation algorithms (DGAs) on an SRX Series firewall, you can use the security-metadata-streaming and advanced-anti-malware features. The first step is to define a security-metadata-streaming policy under

[edit services], which allows the firewall to receive and process metadata from a third- party security intelligence service. This metadata includes information about DGAs, which the firewall can use to identify and block malicious traffic. The

second step is to attach the security-metadata-streaming policy to a security policy, this will enable the firewall to inspect traffic against the DGA domains provided by the intelligence service.

The third step is to enable the advanced-anti-malware feature on the firewall, and attach an advanced-anti-malware policy to a security policy. This allows the firewall to detect and block malware based on signatures and behavioral analysis,

which can also detect and block traffic associated with DGAs.

Correct Answer: AD

Explanation: To enforce IDP policies on HTTP traffic on an SRX Series device, the following actions must be performed:

Choose an attacks type in the predefined-attacks-group HTTP-All: This allows the SRX Series device to match on specific types of attacks that can occur within HTTP traffic. For example, it can match on SQL injection or cross-site scripting

(XSS) attacks.

Match on application junos-http: This allows the SRX Series device to match on HTTP traffic specifically, as opposed to other types of traffic. It is necessary to properly identify the traffic that needs to be protected. Disabling screen options on

the Untrust zone and specifying an action of None are not necessary to enforce IDP policies on HTTP traffic. The first one is a feature used to prevent certain types of attacks, the second one is used to take no action in case of a match.

Correct Answer: B

Correct Answer: AC

Explanation: Juniper ATP Cloud supports two main modes of operation:

Global mode: In this mode, the Juniper ATP Cloud service analyzes all files and network traffic that pass through the cloud-based service. It uses a combination of static and dynamic analysis techniques, as well as machine learning, to detect

and block malicious files, even if they are not known to traditional anti-virus software. Private mode: In this mode, the Juniper ATP Cloud service analyzes only the files and network traffic that are specifically uploaded or submitted for analysis

by the user. It uses the same analysis techniques as in global mode, but the user has more control over which files and network traffic are analyzed and can be used to analyze files that are behind the firewall.

Correct Answer: CD

Correct Answer: C

Correct Answer: ADE

Reference: https://www.juniper.net/documentation/en_US/junos-space17.2/policy- enforcer/topics/concept/ policy-enforcer-deployment-supported-topologies.html