JN0-637 無料問題集「Juniper Security, Professional (JNCIP-SEC)」

（A）TLS 1.2 traffic will be sent to routing instance R2 and forwarded to next hop 10.2.0.1.

（B）TLS 1.2 traffic will be sent to routing instance R1 and forwarded to next hop 10.1.0.1.

（C）TLS 1.2 traffic will be sent to routing instance R2 but not forwarded to the next hop.

（D）TLS 1.2 traffic will be sent to routing instance R1 but not forwarded to the next hop.

（A）If the received packet is addressed to the ingress interface, then the device first performs a security policy evaluation for the junos-host zone.

（B）If the received packet is destined for an interface other than the ingress interface, then the device performs a security policy evaluation based on the ingress and egress zone.

（C）If the received packet is addressed to the ingress interface, then the device first examines the host- inbound-traffic configuration for the ingress interface and zone.

（D）If the received packet is destined for an interface other than the ingress interface, then the device performs a security policy evaluation for the junos-host zone.

（A）The original destination port is used for the source port for the session.

（B）Only a specific host can initiate a session to the reflexive address after the initial session.

（C）Both the internal and the external host can initiate a session after the initial translation.

（D）Any external host will be able to initiate a session to the reflexive address.

（A）Enable OSPF for both interchassis link interfaces and tum on the dynamic-neighbors parameter.

（B）Enable HA link encryption in the IPsec profile on both nodes.

（C）Install the Junos IKE package on both nodes.

（D）Configure a VPN profile for the HA traffic and apply to both nodes.

（E）Enable HA link encryption in the IKE profile on both nodes,

（A）All spoke-to-spoke IPsec communication will pass through the hub.

（B）AutoVPN requires OSPF over IPsec to discover and add new spokes.

（C）New spoke sites can be added without explicit configuration on the hub.

（D）Direct spoke-to-spoke tunnels can be established automatically.

（A）The application services bypass is not configured on the APBR rule.

（B）IDP disable is not configured on the APBR rule.

（C）The session did not properly reclassify midstream to the correct APBR rule.

（D）The APBR rule does a match on the first packet.

（A）Secure wire

（B）Logical system

（C）Transparent mode

（D）Tenant system

（A）[edit security nat source]
user@OfficeA# show rule-set OfficeBtoA {
from zone OfficeB;
to zone OfficeA;
rule 1 {
match {
source-address 192.168.210.0/24;
destination-address 192.168.200.0/24;
}
then {
source-nat {
interface;
}
}
}
}

（B）[edit security nat source]
user@OfficeB# show rule-set OfficeAtoB {
from zone OfficeA;
to zone OfficeB;
rule 1 {
match {
source-address 192.168.200.0/24;
destination-address 192.168.210.0/24;
}
then {
source-nat {
interface;
}
}
}
}

（C）[edit security nat static]
user@OfficeA# show rule-set From-Office-B {
from interface ge-0/0/0.0;
rule 1 {
match {
destination-address 192.168.200.0/24;
}
then {
static-nat {
prefix 192.168.100.0/24;
}
}
}
}

（D）[edit security nat static]
user@OfficeB# show rule-set From-Office-A {
from interface ge-0/0/0.0;
rule 1 {
match {
destination-address 192.168.210.0/24;
}
then {
static-nat {
prefix 192.168.100.0/24;
}
}
}
}

（A）Enable next-hop tunnel binding.

（B）Enable the copy-outer-dscp parameter so that DSCP header values are copied to the tunneled packets.

（C）Enable the multi-sa parameter to enable two separate IPsec SAs for the VoIP and data traffic.

（D）Configure CoS forwarding classes and scheduling parameters.

（E）Create a firewall filter that identifies VoIP traffic and associates it with the correct forwarding class.

（A）The ICL traffic can be encrypted.

（B）The ICL is the local device management interface in a multinode HA environment.

（C）The ICL uses a separate routing instance to communicate with remote multinode HA peers.

（D）The ICL is strictly a Layer 2 interface.