EMT Practice Test

1. Question Content...

---

Question1: You are configuring transparent mode on an SRX Series device. You must permit IP-based traffic only, and BPDUs must be restricted to the VLANs from which they originate.
Which configuration accomplishes these objectives?
A)

B)

C)

D)

Question2: You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.
Which command would be used to solve the problem?

Question3: Click the Exhibit button.

You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.
Referring to the exhibit, which two statements should you add to the configuration to accomplish this task?
(Choose two.)

Question4: Exhibit.

Referring to the exhibit, which two statements are true? (Choose two.)

Question5: What are two important function of the Juniper Networks ATP appliance solution? (Choose two.).

Question6: Your organization has multiple Active Directory domain to control user access. You must ensure that security polices are passing traffic based upon the user's access rights.
What would you use to assist your SRX series devices to accomplish this task?

Question7: Click the Exhibit button.

You have configured tenant systems on your SRX Series device.
Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Question8: Click the Exhibit button.

Referring to the exhibit, what is the maximum number of zones that are able to be created within all logical systems?

Question9: Click the Exhibit button.

Referring to the exhibit, what is the maximum number of zones that are able to be created within all logical systems?

Question10: Click the Exhibit button.

The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?
A)

B)

C)

D)

Question11: Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

Question12: Click the Exhibit button.

Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)

Question13: An administrator wants to implement persistent NAT for an internal resource so that external hosts are able to initiate communications to the resource, with the internal resource having previously sent packets to the external hosts.
Which configuration setting is used to accomplish this goal?

Question14: You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.
Which command would be used to solve the problem?

Question15: Which feature of Sky ATP is deployed with Policy Enforcer?

Question16: You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.
Which firewall filter will accomplish this task?
A)

B)

C)

D)

Question17: You have the NAT rule, shown in the exhibit, applied to allow communication across an IPsec tunnel between your two sites with identical networks. Which statement is correct in this scenario?

Question18: In which two ways are tenant systems different from logical systems? (Choose two.)

Question19: Click the Exhibit button.

You have configured tenant systems on your SRX Series device.
Referring to the exhibit, which two actions should you take to facilitate inter-TSYS communication? (Choose two.)

Question20: Click the Exhibit button.

You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5. However, the two hosts cannot communicate with each other.
Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)

Question21: Click the Exhibit button.

A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies.
Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?
A)

B)

C)

D)

Question22: Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

Question23: You are connecting two remote sites to your corporate headquarters site; you must ensure that all traffic is secured and only uses a single Phase 2 SA for both sites.
In this scenario, which VPN should be used?

Question24: Click the Exhibit button.

You are asked to look at a configuration that is designed to take all traffic with a specific source IP address and forward the traffic to a traffic analysis server for further evaluation. The configuration is not working as intended.
Referring to the exhibit, which change must be made to correct the configuration?

Question25: You are asked to implement the session cache feature on an SRX5400.
In this scenario, what information does a session cache entry record? (Choose two.)

Question26: Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

Question27: Click the Exhibit button.

Which type of NAT is shown in the exhibit?

Question28: Click the Exhibit button.

Which statement is correct regarding the information show in the exhibit?

Question29: Click the Exhibit button.

The IKE policy and proposal are configured properly on both devices as shown in the exhibit. Which configuration snippet will complete the IKE configuration on the branch SRX Series device?
A)

B)

C)

D)

Question30: Click the Exhibit button.

Your company has purchased a competitor and now must connect the new network to the existing one. The competitor's gateway device is receiving its ISP address using DHCP. Communication between the two sites must be secured; however, obtaining a static public IP address for the new site gateway is not an option at this time. The company has several requirements for this solution:
* A site-to-site IPsec VPN must be used to secure traffic between the two sites;
* The IKE identity on the new site gateway device must use the hostname option; and
* Internet traffic from each site should exit through its local Internet connection.
The configuration shown in the exhibit has been applied to the new site's SRX, but the secure tunnel is not working.
In this scenario, what configuration change is needed for the tunnel to come up?

Question31: Click the Exhibit button.

A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies.
Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?
A)

B)

C)

D)

Question32: Click the Exhibit button.

A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.
Referring to the exhibit, what is the problem?

Question33: A user is unable to reach a necessary resource. You discover the path through the SRX Series device includes several security features. The traffic is not being evaluated by any security policies.
In this scenario, which two components within the flow module would affect the traffic? (Choose two.)

Question34: You are asked to configure a security policy on the SRX Series device. After committing the policy, you receive the "Policy is out of sync between RE and PFE <SPU-name(s)>." error.
Which command would be used to solve the problem?

Question35: You are asked to merge to corporate network with the network from a recently acquired company. Both networks use the same private IPv4 address space (172.25.126.0/24). An SRX Series device servers as the gateway for each network.
Which solution allows you to merge the two networks without modifying the current address assignments?

Question36: Click the Exhibit button.

Referring to the exhibit, which three types of traffic would be examined by the IPS policy between Switch-1 and Switch-2? (Choose three.)

Question37: Exhibit.

Referring to the exhibit, a spoke member of an ADVPN is not functioning correctly.
Which two commands will solve this problem? (Choose two.)

Question38: Click the Exhibit button.

You deployed a site-to-site IPsec VPN connecting two data centers together using SRX5800s. After examining the performance of the IPsec VPN, you decide to enable IPsec performance acceleration to increase the rate of traffic that can be sent through the tunnel.
Referring to the exhibit, which two statements should you add to the configuration to accomplish this task?
(Choose two.)

Question39: You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.
Which firewall filter will accomplish this task?

Question40: Click the Exhibit button.

You are implementing a new branch site and want to ensure Internet traffic is sent directly to your ISP and other traffic is sent to your company headquarters. You have configured filter-based forwarding to accomplish this objective. You verify proper functionality using the outputs shown in the exhibit.
Which two statements are true in this scenario? (Choose two.)

Question41: You are asked to configure an IPsec VPN between two SRX Series devices that allows for processing of CoS on the intermediate routers.
What will satisfy this requirement?

Question42: When would you use the port-overloading-factor 1 setting?

Question43: Exhibit.

A hub member of an ADVPN is not functioning correctly.
Referring the exhibit, which action should you take to solve the problem?

Question44: Click the Exhibit button.

A user reports trouble when using SSH to a server outside your organization. The traffic traverses an SRX Series device that is performing NAT and applying security policies.
Referring to the exhibit, which configuration will allow you to see the bidirectional flow through the SRX Series device?
A)

B)

C)

D)

Question45: Click the Exhibit button.

A host is unable to communicate with a webserver. Referring to the exhibit, which statement is correct?

Question46: You have designed the firewall filter shown in the exhibit to limit SSH control traffic to yours SRX Series device without affecting other traffic.
Which two statement are true in this scenario? (Choose two.)

Question47: Which two log format types are supported by the JATP appliance? (Choose two.)

Question48: Which three roles or protocols are required when configuring an ADVPN? (Choose three.)

Question49: In a Juniper ATP Appliance, what would be a reason for the mitigation rule to be in the failed-remove state?

Question50: Click the Exhibit button.

Which type of NAT is shown in the exhibit?

Question51: Click the Exhibit button.

The exhibit shows a snippet of a security flow trace. A user cannot open an SSH session to a server. Which action will solve the problem?

Question52: Which three roles or protocols are required when configuring an ADVPN? (Choose three.)

Question53: Click the Exhibit button.

Referring to the exhibit, which IPS deployment mode is running on the SRX5800 device?

Question54: Click the Exhibit button.

You are implementing a new branch site and want to ensure Internet traffic is sent directly to your ISP and other traffic is sent to your company headquarters. You have configured filter-based forwarding to accomplish this objective. You verify proper functionality using the outputs shown in the exhibit.
Which two statements are true in this scenario? (Choose two.)

Question55: You must implement an IPsec VPN on an SRX Series device using PKI certificates for authentication. As part of the implementation, you are required to ensure that the certificate submission, renewal, and retrieval processes are handled automatically from the certificate authority.
In this scenario, which statement is correct.

Question56: Click the Exhibit button.

You have configured an ADVPN that is operational. However, OSPF will not establish correctly across the ADVPN tunnels.
Referring to the exhibit, which two commands will solve the problem? (Choose two.)

Question57: You opened a support ticket with JTAC for your Juniper ATP appliance. JTAC asks you to set up access to the device using the reverse SSH connection.Which three setting must be configured to satisfy this request? (Choose three.)

Question58: The monitor traffic interface command is being used to capture the packets destined to and the from the SRX Series device.
In this scenario, which two statements related to the feature are true? (Choose two.)

Question59: Click the Exhibit button.

When attempting to enroll an SRX Series device to JATP, you receive the error shown in the exhibit. What is the cause of the error?

Question60: Click the Exhibit button.

Your company has purchased a competitor and now must connect the new network to the existing one. The competitor's gateway device is receiving its ISP address using DHCP. Communication between the two sites must be secured; however, obtaining a static public IP address for the new site gateway is not an option at this time. The company has several requirements for this solution:
* A site-to-site IPsec VPN must be used to secure traffic between the two sites;
* The IKE identity on the new site gateway device must use the hostname option; and
* Internet traffic from each site should exit through its local Internet connection.
The configuration shown in the exhibit has been applied to the new site's SRX, but the secure tunnel is not working.
In this scenario, what configuration change is needed for the tunnel to come up?

Question61: You have noticed a high number of TCP-based attacks directed toward your primary edge device. You are asked to configure the IDP feature on your SRX Series device to block this attack.
Which two IDP attack objects would you configure to solve this problem? (Choose two.)

Question62: Click the Exhibit button.

You have configured an ADVPN that is operational. However, OSPF will not establish correctly across the ADVPN tunnels.
Referring to the exhibit, which two commands will solve the problem? (Choose two.)

Question63: Which three type of peer devices are supported for Cos-Based IPsec VPN?

Question64: Click the Exhibit button.

Your company has purchased a competitor and now must connect the new network to the existing one. The competitor's gateway device is receiving its ISP address using DHCP. Communication between the two sites must be secured; however, obtaining a static public IP address for the new site gateway is not an option at this time. The company has several requirements for this solution:
A site-to-site IPsec VPN must be used to secure traffic between the two sites; The IKE identity on the new site gateway device must use the hostname option; and Internet traffic from each site should exit through its local Internet connection.
The configuration shown in the exhibit has been applied to the new site's SRX, but the secure tunnel is not working.
In this scenario, what configuration change is needed for the tunnel to come up?

Question65: Click the Exhibit button.

Referring to the exhibit, which three topologies are supported by Policy Enforcer? (Choose three.)

Question66: You are configuring transparent mode on an SRX Series device. You must permit IP-based traffic only, and BPDUs must be restricted to the VLANs from which they originate.
Which configuration accomplishes these objectives?

Question67: You are asked to configure a new SRX Series CPE device at a remote office. The device must participate in forwarding MPLS and IPsec traffic.
Which two statements are true regarding this implementation? (Choose two.)

Question68: Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)

Question69: You are asked to configure an SRX Series device to bypass all security features for IP traffic from the engineering department.
Which firewall filter will accomplish this task?
A)

B)

C)

D)

Question70: Which interface family is required for Layer 2 transparent mode on SRX Series devices?

Question71: Click the Exhibit button.

Which statement is correct regarding the information show in the exhibit?

Question72: Which two VPN features are supported with CoS-based IPsec VPNs? (Choose two.)

Question73: Click the Exhibit button.

You have two hosts on the same subnet connecting to an SRX340 on interfaces ge-0/0/4 and ge-0/0/5.
However, the two hosts cannot communicate with each other.
Referring to the exhibit, what are two actions that would solve this problem? (Choose two.)

Question74: Click the Exhibit button.

Which type of NAT is shown in the exhibit?

Question75: Click the Exhibit button.

A user is trying to reach a company's website, but the connection errors out. The security policies are configured correctly.
Referring to the exhibit, what is the problem?

Question76: You have configured static NAT for a webserver in your DMZ. Both internal and external users can reach the webserver using the webserver's IP address. However, only internal users can reach the webserver using the webserver's DNS name. When external users attempt to reach the webserver using the webserver's DNS name, an error message is received.
Which action would solve this problem?

Question77: Which two statements are true about ADVPN members? (Choose two.)