EMT Practice Test

1. Question Content...

A. Choice A

B. Choice B

C. Choice C

D. Choice D

E. Choice E

Was this helpful? Upvote!

Question List

Question1: -- Exhibit --
user@host> show configuration
...
security {
nat {
destination {
pool server {
address 10.100.100.1/32 port 5555;
}
rule-set rule1 {
from zone UNTRUST;
rule 1 {
match {
destination-address 192.168.100.1/32;
destination-port 5000;
}
then {
destination-nat pool server;
}
}
}
}
proxy-arp {
interface ge-0/0/1.0 {
address {
192.168.100.1/32;
}
}
}
}
policies {
from-zone UNTRUST to-zone TRUST {
policy allow {
match {
source-address any;
destination-address any;
application [ junos-ping tcp-5000 ];
}
then {
permit;
}
}
}
}
zones {
security-zone TRUST {
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
protocols {
all;
}
}
}
}
}
security-zone UNTRUST {
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
}
}
}
}
applications {
application tcp-5000 {
protocol tcp;
destination-port 5000;
}
}
-- Exhibit --
Click the Exhibit button.
Your customer is attempting to reach a new server that should be accessible publicly using
192.168.100.100 on TCP port 5000, and internally using 10.100.100.1 on TCP port 5555. You notice no sessions form when the customer attempts to access the server.
Referring to the exhibit, what will resolve this problem?

Question2: -- Exhibit -

-- Exhibit --
Click the Exhibit button.
You have created a new VPN tunnel to your partner's site but IKE Phase 1 is not coming up. You check the trace log and find the following log message:
Jun
[IKED 2] iked_pm_id_validate id NOT matched.
Considering the topology and the SRX Series device's configuration shown in the exhibit, which modification is needed under [edit security gateway Partner]?

Question3: Click the Exhibit button.

A customer is using a destination NAT to a remote webserver, but the configuration is not working.
Referring to the exhibit, which configuration changes will resolve this problem?

Question4: -- Exhibit -

-- Exhibit --
Click the Exhibit button.
Your company has a Web server in the trust zone. You configure a NAT rule to allow Internet users from the untrust zone to access this Web server. Internet users use the public IP address 70.1.1.1 to access this Web server, but they report that the server is not accessible.
Referring to the exhibit, which configuration change would resolve this problem?

Question5: -- Exhibit --
[edit security utm]
user@host# show
custom-objects {
url-pattern {
blocklist {
value [ http://badsite.com http://blocksite.com ];
}
acceptlist {
value http://juniper.net;
}
}
custom-url-category {
blacklist {
value blocklist;
}
whitelist {
value acceptlist;
}
}
}
feature-profile {
web-filtering {
url-whitelist whitelist;
url-blacklist blacklist;
type juniper-local;
juniper-local {
profile web-filter {
custom-block-message "Site is not allowed";
fallback-settings {
default log-and-permit;
}
}
}
}
}
utm-policy utm1 {
web-filtering {
http-profile web-filter;
}
}
-- Exhibit --
Click the Exhibit button.
You set up Web filtering to allow employees to only access your internal website. You notice that employees are still able to reach websites outside of the blacklists.
Referring the exhibit, which parameter must be changed?

Question8: -- Exhibit -

-- Exhibit --
Click the Exhibit button.
You are asked to troubleshoot a new IPsec VPN that is not establishing. You do not receive any output from the show security ike security-associations command.
Referring to the exhibit, which section of the configuration is causing the problem?

Question9: LAN 1 and LAN 2 are experiencing network communication problems. While troubleshooting, you add one address book to a security policy. You must verify that the address book was added to the security policy.
Which command will accomplish this task?

Question10: Click the Exhibit button.

You are implementing a high availability chassis cluster on an SRX Series device. You would like to manage both devices through the J-Web utility. However, when you try to log in to the second device using SSL HTTP, you receive a message from your Web browser indicating that the message has timed out.
Why you are receiving this message?

Question11: -- Exhibit --
user@host> show security flow session
...
Session ID. 41, Policy name: allow/5, Timeout: 20, Valid
In: 172.168.66.143/43886 --> 192.168.100.1/5000;tcp, If: ge-0/0/1.0, Pkts: 1, Bytes: 60 Out: 10.100.1.100/5555 --> 172.168.66.143/43886;tcp, If: ge-0/0/2.0, Pkts: 0, Bytes: 0 user@host> show configuration
...
security {
nat {
destination {
pool server {
address 10.100.1.100/32 port 5555;
}
rule-set rule1 {
from zone UNTRUST;
rule 1 {
match {
destination-address 192.168.100.1/32;
destination-port 5000;
}
then {
destination-nat pool server;
}
}
}
}
proxy-arp {
interface ge-0/0/1.0 {
address {
192.168.100.1/32;
}
}
}
}
policies {
from-zone UNTRUST to-zone TRUST {
policy allow {
match {
source-address any;
destination-address any;
application [ junos-ping tcp-5000 ];
}
then {
permit;
}
}
}
}
zones {
security-zone TRUST {
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
protocols {
all;
}
}
}
}
}
security-zone UNTRUST {
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
}
}
}
}
applications {
application tcp-5000 {
protocol tcp;
destination-port 5000;
}
}
-- Exhibit --
Click the Exhibit button.
Your customer is attempting to reach your new server that should be accessible publicly using
192.168.100.100 on TCP port 5000, and internally using 10.100.100.1 on TCP port 5555. You notice a session forms when they attempt to access the server, but they are unable to reach the server.
Referring to the exhibit, what will resolve this problem?

Question12: While attempting to commit a configuration for a new address book, you received the error message shown below.
Zone specific address books are not allowed when there are global address books defined error: commit failed: (statements constraint check failed)

How would you resolve this error?

Question13: -- Exhibit --
user@host> request services application-identification application copy junos:AIM-HTTP-API error: Cannot commit to junos configure DB.
----------------------------------------------------------------------
could not lock modified database
mgd xcommit failed
Copy application junos:AIM-HTTP-API failed.
-- Exhibit --
Click the Exhibit button.
You want to make a custom copy of the junos: AIM-HTTP-API application signature. However, when you attempt to copy the application signature, you receive the error shown in the exhibit.
What is causing the problem?

Question14: -- Exhibit --
user@host> show configuration security utm
custom-objects {
url-pattern {
block-juniper {
value *.spammer.com;
}
}
custom-url-category {
blacklist {
value block-juniper;
}
}
}
feature-profile {
anti-spam {
address-blacklist block-juniper;
sbl {
profile myprofile {
no-sbl-default-server;
spam-action block;
}
}
}
}
utm-policy wildcard-policy {
anti-spam {
smtp-profile myprofile;
}
}
-- Exhibit --
Click the Exhibit button.
You added a blacklist to your antispam policy to block any e-mails from the spammer.com domain.
However, your users are complaining that they are still receiving spam e-mails from that domain. You run the utm test-string test and confirm that the blacklist is not working.
Referring to the exhibit, what is causing this problem?

Question15: Click the Exhibit button.

A customer wants to create a chassis cluster with the SRX Series devices shown in the exhibit. The customer is not able to create the chassis cluster. In this scenario, what would solve the problem?

Question16: -- Exhibit -

-- Exhibit --
Click the Exhibit button.
There is an existing chassis cluster connected to the corporate network 192.168.1.0/24. You are asked to connect another department to this VLAN. To achieve this, you add a new chassis cluster to the network.
After connecting to the network, the cluster experiences traffic problems. You have verified that the addresses and VLAN IDs are configured correctly.
Referring to the exhibit, which configuration would resolve this problem?

Question18: Click the Exhibit button.

Your customer reports that user1 is not able to access the protected resources on a dynamic VPN. To troubleshoot the connection issue between user1 and the protected resources you enable traceoptions.
Referring to the exhibit, which configuration steps are correct?

Question19: Click the Exhibit button.

You configured a route-based VPN, but users complain that they cannot pass traffic through it.
Referring to the exhibit, what is causing the problem?

Question20: -- Exhibit --
Apr 27 19:11:09 company-fw init: low_mem_signal_processes: send signal 16 to routing Apr 27 19:11:09 company-fw /kernel: KERNEL_MEMORY_CRITICAL: System low on free memory, notifying init (#4).
Apr 27 19:11:09 company-fw rpd[1268]: Processing low memory signal
Apr 27 19:11:09 company-fw init: low_mem_signal_processes: send signal 16 to idp-policy Apr 27 19:11:09 company-fw idpd[1295]: Processing low memory signal Apr 27 19:11:10 company-fw idpd[1987]: IDP_SECURITY_INSTALL_RESULT: security package install result Done;Install aborted due to system reaching low memory condition!)
-- Exhibit --
Click the Exhibit button.
You are troubleshooting a problem where the IDP signature database update on your Junos device has failed.
Referring to the exhibit, which action will resolve this problem?

Question21: You have deployed AppID on your SRX Series device. You want to block all HTTP connections. However, there is a packet-monitoring device that shows the SRX Series device is still allowing some packets through to the webservers on TCP port 80.
In this scenario, which statement is correct?

Question22: Click the Exhibit button.

You are troubleshooting an IPsec VPN which is not establishing.
Which two issues would cause the message shown in the exhibit? (Choose two.)

Question23: -- Exhibit --
user@SRX-1> show configuration security ike
traceoptions {
file ike-trace;
flag all;
}
policy juniper {
proposal-set standard;
pre-shared-key ascii-text "$ $ znCO hKMXtuMX - gTz "; ## SECRET-DATA
}
gateway juniper {
ike-policy juniper;
address 192.168.1.11;
external-interface fe-0/0/7;
}
user@SRX-1> show configuration security ipsec
traceoptions {
flag all;
}
policy juniper {
proposal-set standard;
}
vpn juniper {
bind-interface st0.0;
ike {
gateway juniper;
ipsec-policy juniper;
}
}
user@SRX-1> show security ike security-associations
user@SRX-1> show security ipsec security-associations
Total active tunnels: 0
user@SRX-1> show log ike-trace
...
Jun 13 16:21:33 ike_st_o_all_done: MESSAGE: Phase 1 { 0x3f669946 90eba0c7 - 0x76bdffab f8770040 } / 00000000, version = 1.0, xchg = Identity protect, auth_method = Pre shared keys, Responder, cipher = 3des-cbc, hash = sha1, prf = hmac-sha1, life = 0 kB / 28800 sec, key l Jun 13 16:21:33 192.168.1.10:500 (Responder) -> 192.168.1.11:500 { 3f669946 90eba0c7 - 76bdffab f8770040 [-1] / 0x00000000 } IP; MESSAGE: Phase 1 version = 1.0, auth_method = Pre shared keys, cipher = 3des-cbc, hash = sha1, prf = hmac-sha1, life = 0 kB / 28800 sec, key Jun 13 16:21:33 ike_encode_packet: Start, SA = { 0x3f669946 90eba0c7 - 76bdffab f8770040 } /
00000000, nego = -1
Jun 13 16:21:33 ike_send_packet: Start, send SA = { 3f669946 90eba0c7 - 76bdffab f8770040}, nego = -1, dst = 192.168.1.11:500, routing table id = 0 Jun 13 16:21:33 ike_send_notify: Connected, SA = { 3f669946 90eba0c7 - 76bdffab f8770040}, nego = -1 Jun 13 16:21:33 iked_pm_ike_sa_done: local:192.168.1.10, remote:192.168.1.11 IKEv1 Jun 13 16:21:33 iked_pm_id_validate id NOT matched.
Jun 13 16:21:33 P1 SA 3075313 timer expiry. ref cnt 1, timer reason Defer delete timer expired (3), flags
0x331.
Jun 13 16:21:33 iked_pm_ike_sa_delete_notify_done_cB. For p1 sa index 3075313, ref cnt 1, status: Error ok Jun 13 16:21:33 ike_expire_callback: Start, expire SA = { 3f669946 90eba0c7 - 76bdffab f8770040}, nego
= -1
Jun 13 16:21:33 ike_alloc_negotiation: Start, SA = { 3f669946 90eba0c7 - 76bdffab f8770040}
...
-- Exhibit --
Click the Exhibit button.
You are troubleshooting a new IPsec VPN that is not establishing between SRX-1 and a remote end device.
Referring to the exhibit, what is causing the problem?

Question24: -- Exhibit --
{hold:node0}
user@host1> show chassis cluster status
Cluster ID. 1
Node Priority Status Preempt Manual failover
Redundancy group: 0 , Failover count: 0
node0 hold no 1 no
node1 0 lost n/a n/a
{hold:node0}
user@host1> show configuration | no-more
system {
host-name host1;
root-authentication {
encrypted-password "$1$KI99zGk6$MbYFuBbpLffu9tn2.sI7l1"; ## SECRET-DATA
}
name-server {
172.16.10.100;
}
services {
ssh;
telnet;
web-management {
http;
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.210.14.131/26;
}
}
}
ge-0/0/8 {
unit 0 {
family inet {
address 172.16.1.1/24;
}
}
}
ge-0/0/9 {
unit 0 {
family inet {
address 172.16.10.1/24;
}
}
}
}
security {
policies {
default-policy {
permit-all;
}
}
zones {
functional-zone management {
interfaces {
ge-0/0/0.0;
}
host-inbound-traffic {
system-services {
ssh;
telnet;
ping;
traceroute;
http;
snmp;
}
}
}
security-zone Trust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/9.0;
}
}
security-zone Untrust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/8.0;
}
}
}
}
----------------
{hold:node1}
user@host2> show chassis cluster status
Cluster ID. 1
Node Priority Status Preempt Manual failover
Redundancy group: 0 , Failover count: 0
node0 0 lost n/a n/a
node1 1 hold no no
{hold:node1}
user@host2> show configuration | no-more
system {
host-name host2;
root-authentication {
encrypted-password "$1$KI99zGk6$MbYFuBbpLffu9tn2.sI7l1"; ## SECRET-DATA
}
name-server {
172.16.10.100;
}
services {
ssh;
telnet;
web-management {
http;
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.210.14.132/26;
}
}
}
ge-0/0/8 {
unit 0 {
family inet {
address 172.16.1.1/24;
}
}
}
ge-0/0/9 {
unit 0 {
family inet {
address 172.16.10.1/24;
}
}
}
}
security {
policies {
default-policy {
permit-all;
}
}
zones {
functional-zone management {
interfaces {
ge-0/0/0.0;
}
host-inbound-traffic {
system-services {
ssh;
telnet;
ping;
traceroute;
http;
snmp;
}
}
}
security-zone Trust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/9.0;
}
}
security-zone Untrust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/8.0;
}
}
}
}
-- Exhibit --
Click the Exhibit button.
A user attempted to form a chassis cluster on an SRX240; however, the cluster did not form. While investigating the problem, you see the output shown in the exhibit.
What is causing the problem?

Question25: Click the Exhibit button.

A customer wants to commit a configuration but receives the error shown in the exhibit.
What would solve the problem?

Question27: Users begin complaining that they are not able to access resources. You start your troubleshooting by reviewing the security associations.
Which two methods would you use to troubleshoot this problem? (Choose two.)

Question28: Click the Exhibit button.

You recently configured a chassis cluster between two branch SRX Series devices and realize that the cluster is not functional, with node device status lost.
Referring to the exhibit, which two actions will correct this problem? (Choose two.)

Question30: Click the Exhibit button.

You are implementing UTM on an SRX Series device to block the advertisements and special events URL category, however, traffic for those categories is still passing through.
Referring to the exhibit, why is this happening?

Question33: Click the Exhibit button.

A customer configured DHCP relay. After committing the configuration, the DHCP server does not provide addresses and you suspect that a configuration is missing. The server is connected to ge-0/0/8 and the hosts are connected to ge-0/0/7 through a switch. The server IP address is 192.18.24.38.
Referring to the exhibit, which two commands would be used to solve the problem? (Choose two.)

Question34: -- Exhibit --
{primary:node0}
user@host> show configuration chassis | display inheritance
cluster {
redundancy-group 1 {
node 0 priority 200;
node 1 priority 100;
interface-monitor {
ge-0/0/12 weight 255;
ge-5/0/12 weight 255;
}
}
}
-- Exhibit --
Click the Exhibit button.
A customer reports that their SRX failover is not working as expected. They expected node1 to become the primary node for the control plane when interface ge-0/0/12 failed. However, when ge-0/0/12 failed, node0 remained the primary node. They send you the output shown in the exhibit.
What is causing this problem?

Question35: Click the Exhibit button.

A customer created a security policy and is not receiving any logs from permitted sessions, you are asked to obtain the logs for the customer.
Which parameter must you add to the configuration shown in the exhibit to accomplish this task?