EMT Practice Test

1. Question Content...

---

Question1: What are two supported hypervisors for hosting a vSRX? (Choose two.)

Question2: Clients at a remote office are accessing a website that is against your company Internet policy. You change the action of the security policy that controls HTTP access from permit to deny on the remote office SRX Series device. After committing the policy change, you notice that new users cannot access the website but users that have existing sessions on the device still have access. You want to block all user sessions immediately.
Which change would you make on the SRX Series device to accomplish this task?

Question3: Click the Exhibit button.

Referring to the exhibit, what will happen if client 172.16.128.50 tries to connect to destination
192.168.150.3 using HTTP?

Question4: Click the Exhibit button.

Which feature is enabled with destination NAT as shown in the exhibit?

Question5: You have recently configured an IPsec tunnel between two SRX Series devices. One of the devices is assigned an IP address using DHCP with an IP address that changes frequently. Initial testing indicates that the IPsec tunnel is not working. Troubleshooting has revealed that Phase 1 negotiations are failing.
Which two actions would solve the problem? (Choose two.)

Question6: A link from the branch SRX Series device chassis cluster to the Internet requires more bandwidth.
In this scenario, which command would you issue to begin provisioning a second link?

Question7: Which two statements are true when implementing source NAT on an SRX Series device? (Choose two.)

Question8: Which type of VPN provides a secure method of transporting encrypted IP traffic?

Question9: You want to protect your SRX Series device from the ping-of-death attack coming from the untrust security zone.
How would you accomplish this task?

Question10: Which three Encapsulating Security Payload protocols do the SRX Series devices support with IPsec?
(Choose three.)

Question11: What are three valid virtual interface types for a vSRX? (Choose three.)

Question12: Screens help prevent which three attack types? (Choose three.)

Question13: Which process describes the implementation of screen options on an SRX Series device?

Question14: Click the Exhibit button.

A customer would like to monitor their VPN using dead peer detection.
Referring to the exhibit, for how many minutes was the peer down before the customer was notified?

Question15: Click the Exhibit button.

You have configured NAT on your network so that Host A can communicate with Server B.
You want to ensure that Host C can initiate communication with Host A using Host A's reflexive address.
Referring to the exhibit, which parameter should you configure on the SRX Series device to satisfy this requirement?

Question16: Which SRX5400 component is responsible for performing first pass security policy inspection?

Question17: Click the Exhibit button.

Which statement would explain why the IP-monitoring feature is functioning incorrectly?

Question18: You want to ensure that any certificates used in your IPsec implementation do not expire while in use by your SRX Series devices.
In this scenario, what must be enabled on your devices?

Question19: You need to configure an IPsec tunnel between a remote site and a hub site. The SRX Series device at the remote site receives a dynamic IP address on the external interface that you will use for IPsec.
Which feature would you need to configure in this scenario?

Question20: What are two valid zones available on an SRX Series device? (Choose two.)

Question21: Your network includes IPsec tunnels. One IPsec tunnel transits an SRX Series device with NAT configured. You must ensure that the IPsec tunnels function properly.
Which statement is correct in this scenario?

Question22: Click the Exhibit button.

You notice that your SRX Series device is not blocking HTTP traffic as expected.
Referring to the exhibit, what should you do to solve the problem?

Question23: Which statement describes the function of NAT?

Question24: Which statement describes the function of screen options?

Question25: Click the Exhibit button.

Referring to the exhibit, which action will be taken for traffic coming from the untrust zone going to the trust zone?

Question26: Which host-inbound-traffic security zone parameter would allow access to the REST API configured to listen on custom TCP port 5080?

Question27: Click the Exhibit button.

Referring to the exhibit, which statement is true?

Question28: Which three elements does AH provide in an IPsec implementation? (Choose three.)

Question29: Which two statements about security policy actions are true? (Choose two.)

Question30: What is the function of redundancy group 0 in a chassis cluster?

Question31: You must verify if destination NAT is actively being used by users connecting to an internal server from the Internet.
Which action will accomplish this task on an SRX Series device?

Question32: Click the Exhibit button.

Host A is attempting to connect to Host B using the domain name, which is tied to a public IP address. All attempts to connect to Host B have failed. You have examined the configuration on your SRX340 and determined that a NAT policy is required.
Referring to the exhibit, which two NAT types will allow Host A to connect to Host B? (Choose two.)

Question33: In a chassis cluster, which two characteristics are true regarding reth interfaces? (Choose two.)

Question34: What are the maximum number of redundancy groups that would be used on a chassis cluster?

Question35: You are asked to change when your SRX high availability failover occurs. One network interface is considered more important than others in the high availability configuration. You want to prioritize failover based on the state of that interface.
Which configuration would accomplish this task?

Question36: Which interface is used exclusively to forward Ethernet-switching traffic between two chassis cluster nodes?

Question37: You want to trigger failover of redundancy group 1 currently running on node 0 and make node 1 the primary node the redundancy group 1.
Which command would be used accomplish this task?

Question38: What are three defined zone types on an SRX Series device?

Question39: What are two fields that an SRX Series device examines to determine if a packet is associated with an existing flow? (Choose two.)

Question40: Click the exhibit button.

You are configuring security policies with Junos Space Security Director.
Referring to the exhibit, which two statements are true? (Choose two.)

Question41: Which statement is true about high availability (HA) chassis clusters for the SRX Series device?

Question42: What are three characteristics of session-based forwarding, compared to packet-based forwarding, on an SRX Series device? (Choose three.)

Question43: You are changing the default vCPU allocation on a vSRX.
How are the additional vCPUs allocated in this scenario?

Question44: You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase 1 negotiation succeeds and the Phase 2 negotiation fails.
Which two configuration parameters should you verify are correct? (Choose two.)

Question45: Which statement is true about functional zones?

Question46: What is the correct ordering of Junos policy evaluation from first to last?

Question47: Which two statements are true about global security policies? (Choose two.)

Question48: You are asked to support source NAT for an application that requires that its original source port not be changed.
Which configuration would satisfy the requirement?

Question49: Which feature is used when you want to permit traffic on an SRX Series device only at specific times?

Question50: A session token on an SRX Series device is derived from what information? (Choose two.)

Question51: Click to the Exhibit button.

Referring to the exhibit, what does proxy ARP allow?

Question52: Which two modes are supported during the Phase 1 IKE negotiations used to establish an IPsec tunnel?
(Choose two.)

Question53: Which three statements describes traditional firewalls? (Choose three.)

Question54: Click the Exhibit button.

Users at a remote office are unable to access an FTP server located at the remote corporate data center as expected. The remote FTP server is listening on the non-standard TCP port 2121.
Referring to the exhibit, what is causing the problem?

Question55: Which action will restrict SSH access to an SRX Series device from a specific IP address which is connected to a security zone named trust?

Question56: Click the Exhibit button.

Referring to the exhibit, what will happen if client 172.16.128.50 tries to connect to destination
192.168.150.111 using HTTP?

Question57: Click the Exhibit button.

You are monitoring traffic, on your SRX300 that was configured using the factory default security parameters. You notice that the SRX300 is not blocking traffic between Host A and Host B as expected.
Referring to the exhibit, what is causing this issue?

Question58: You want to implement IPsec on your SRX Series devices, but you do not want to use a preshared key.
Which IPsec implementation should you use?

Question59: After an SRX Series device processes the first packet of a session, how are subsequent packets for the same session processed?

Question60: Your internal webserver uses port 8088 for inbound connections. You want to allow external HTTP traffic to connect to the webserver.
Which two actions would accomplish this task? (Choose two.)

Question61: Which statement is true about Perfect Forward Secrecy (PFS)?

Question62: Click the exhibit button.

Referring to the exhibit, which statement is true?

Question63: Click the Exhibit button.

The inside server must communicate with the external DNS server. The internal DNS server address is
10.100.75.75. The external DNS server address is 75.75.76.76. Traffic from the inside server to the DNS server fails.
Referring to the exhibit, what is causing the problem?

Question64: You have configured source NAT with port address translation. You also need to guarantee that the same IP address is assigned from the source NAT pool to a specific host for multiple concurrent sessions.
Which NAT parameter would meet this requirement?