Juniper JN0-335 Practice Exams
Last updated on Oct 21,2026- Exam Code: JN0-335
- Exam Name: Security, Specialist (JNCIS-SEC)
- Certification Provider: Juniper
- Latest update: Oct 21,2026
Question #1
Which method does the loT Security feature use to identify traffic sourced from IoT devices?
- A . The SRX Series device streams metadata from the loT device transit traffic to Juniper ATP Cloud Juniper ATP Cloud.
- B . The SRX Series device streams transit traffic received from the IoT device to Juniper ATP Cloud.
- C . The SRX Series device identifies loT devices using their MAC address.
- D . The SRX Series device identifies loT devices from metadata extracted from their transit traffic.
Correct Answer: D
D
Explanation:
The metadata is used to identify the type of device, its associated activities and its threat profile. This information is used to determine the appropriate security policy for the device. For more information on loT Security, please refer to the Juniper Security, Specialist (JNCIS-SEC) study guide.
D
Explanation:
The metadata is used to identify the type of device, its associated activities and its threat profile. This information is used to determine the appropriate security policy for the device. For more information on loT Security, please refer to the Juniper Security, Specialist (JNCIS-SEC) study guide.
Question #2
You have deployed an SRX300 Series device and determined that files have stopped being scanned.
In this scenario, what is a reason for this problem?
- A . The software license is a free model and only scans executable type files.
- B . The infected host communicated with a command-and-control server, but it did not download malware.
- C . The file is too small to have a virus.
- D . You have exceeded the maximum files submission for your SRX platform size.
Correct Answer: D
D
Explanation:
You have exceeded the maximum files submission for your SRX platform size: This statement
is correct because file scanning on SRX300 Series device has a limit on the number of files that can be submitted per minute based on the platform size3. For example, SRX320 has a limit of 10 files per minute3.
D
Explanation:
You have exceeded the maximum files submission for your SRX platform size: This statement
is correct because file scanning on SRX300 Series device has a limit on the number of files that can be submitted per minute based on the platform size3. For example, SRX320 has a limit of 10 files per minute3.
Question #3
You are implementing an SRX Series device at a branch office that has low bandwidth and also uses a cloud-based VoIP solution with an outbound policy that permits all traffic.
Which service would you implement at your edge device to prioritize VoIP traffic in this scenario?
- A . AppFW
- B . SIP ALG
- C . AppQoE
- D . AppQoS
Correct Answer: D
D
Explanation:
The service that you would implement at your edge device to prioritize VoIP traffic in this scenario is AppQoS. AppQoS is a feature that enables you to allocate bandwidth and prioritize traffic based on application signatures or custom rules. AppQoS can enhance the quality of service and experience for critical or latency-sensitive applications, such as VoIP. You can configure AppQoS policies to assign different classes of service (CoS) values or queue numbers to different applications or traffic flows. You can also define bandwidth limits, guarantees, or bursts for each class or queue. Reference: = [Application Quality of Service Overview], [Configuring Application Quality of Service]
D
Explanation:
The service that you would implement at your edge device to prioritize VoIP traffic in this scenario is AppQoS. AppQoS is a feature that enables you to allocate bandwidth and prioritize traffic based on application signatures or custom rules. AppQoS can enhance the quality of service and experience for critical or latency-sensitive applications, such as VoIP. You can configure AppQoS policies to assign different classes of service (CoS) values or queue numbers to different applications or traffic flows. You can also define bandwidth limits, guarantees, or bursts for each class or queue. Reference: = [Application Quality of Service Overview], [Configuring Application Quality of Service]
Question #4
Which two statements about unified security policies are correct? (Choose two.)
- A . Unified security policies require an advanced feature license.
- B . Unified security policies are evaluated after global security policies.
- C . Traffic can initially match multiple unified security policies.
- D . APPID results are used to determine the final security policy
Correct Answer: C D
Question #5
Click the Exhibit button.
Referring to the exhibit, what will the SRX Series device do in this configuration?
- A . Packets from the infected hosts with a threat level of 8 will be dropped and a log message will be generated.
- B . Packets from the infected hosts with a threat level of 8 or above will be dropped and a log message will be generated.
- C . Packets from the infected hosts with a threat level of 8 or above will be dropped and no log message will be generated.
- D . Packets from the infected hosts with a threat level of 8 will be dropped and no log message will be generated.
Correct Answer: C
C
Explanation:
The exhibit shows a configuration snippet for security intelligence on an SRX Series device. Security intelligence is a feature that allows you to block or monitor traffic from malicious sources based on threat intelligence feeds from Juniper ATP Cloud or other providers. The configuration defines a profile for ATP Infected-Hosts, which is a feed that contains IP addresses of hosts that are infected with malware and communicate with command-and-control servers. The configuration also defines a rule for threat level 8, which is a parameter that indicates the severity of the threat.
Based on this configuration, the SRX Series device will do the following:
Packets from the infected hosts with a threat level of 8 or above will be dropped: The action block-and-drop under the rule means that the device will block any traffic from the infected hosts that have a threat level equal to or higher than 8. This will prevent the hosts from sending or receiving malicious commands or data.
No log message will be generated: The absence of any log option under the rule means that the device will not generate any log message for the blocked traffic. This may reduce the load on the device and the logging server, but it may also limit the visibility and analysis of the security events. Reference: = Security Intelligence Theory, Firewall Filter Support on Loopback Interface
C
Explanation:
The exhibit shows a configuration snippet for security intelligence on an SRX Series device. Security intelligence is a feature that allows you to block or monitor traffic from malicious sources based on threat intelligence feeds from Juniper ATP Cloud or other providers. The configuration defines a profile for ATP Infected-Hosts, which is a feed that contains IP addresses of hosts that are infected with malware and communicate with command-and-control servers. The configuration also defines a rule for threat level 8, which is a parameter that indicates the severity of the threat.
Based on this configuration, the SRX Series device will do the following:
Packets from the infected hosts with a threat level of 8 or above will be dropped: The action block-and-drop under the rule means that the device will block any traffic from the infected hosts that have a threat level equal to or higher than 8. This will prevent the hosts from sending or receiving malicious commands or data.
No log message will be generated: The absence of any log option under the rule means that the device will not generate any log message for the blocked traffic. This may reduce the load on the device and the logging server, but it may also limit the visibility and analysis of the security events. Reference: = Security Intelligence Theory, Firewall Filter Support on Loopback Interface
Question #6
You are asked to determine how much traffic a popular gaming application is generating on your network.
Which action will you perform to accomplish this task?
- A . Enable AppQoS on the proper security zones
- B . Enable APBR on the proper security zones
- C . Enable screen options on the proper security zones
- D . Enable AppTrack on the proper security zones.
Correct Answer: D
D
Explanation:
AppTrack is a feature of Juniper Networks firewall solutions that allows administrators to track applications, users, and the amount of traffic generated by those applications on the network. AppTrack can be enabled on specific security zones of the network to monitor traffic on those zones. This feature can be used to determine how much traffic a popular gaming application isgenerating on the network. For more information, please refer to the Juniper Networks JNCIS-SEC Study Guide.
D
Explanation:
AppTrack is a feature of Juniper Networks firewall solutions that allows administrators to track applications, users, and the amount of traffic generated by those applications on the network. AppTrack can be enabled on specific security zones of the network to monitor traffic on those zones. This feature can be used to determine how much traffic a popular gaming application isgenerating on the network. For more information, please refer to the Juniper Networks JNCIS-SEC Study Guide.
Question #7
You want to permit access to an application but block application sub.
Which two security policy features provide this capability? (Choose two.)
- A . URL filtering
- B . micro application detection
- C . content filtering
- D . APPID
Correct Answer: B D
B D
Explanation:
Micro application detection is a feature that enables more granular control over applications by identifying and taking action on sub-features or specific behaviors within an application. For example, allowing access to Facebook while blocking Facebook Chat.
Application Identification (APPID) is a feature that identifies and controls applications based on their traffic patterns and characteristics. APPID can be configured to recognize not only the main application but also its various subcomponents, allowing for precise control over what is allowed or blocked.
B D
Explanation:
Micro application detection is a feature that enables more granular control over applications by identifying and taking action on sub-features or specific behaviors within an application. For example, allowing access to Facebook while blocking Facebook Chat.
Application Identification (APPID) is a feature that identifies and controls applications based on their traffic patterns and characteristics. APPID can be configured to recognize not only the main application but also its various subcomponents, allowing for precise control over what is allowed or blocked.
Question #8
Click the Exhibit button.
You are asked to create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device.
What needs to be added to this configuration to complete this task?
- A . Add a security intelligence policy to the permit portion of the security policy.
- B . Add an action to the permit portion of the security policy.
- C . Add logging to the permit portion of the security policy.
- D . Add a match rule to the security policy with an appropriate threat level.
Correct Answer: A
A
Explanation:
To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a policy that allows you to block or monitor traffic from malicious sources based on threat intelligence feeds from Juniper ATP Cloud or other providers. One of the feeds that you can use is the Infected-Hosts feed, which contains IP addresses of hosts that are infected with malware and communicate with command-and-control servers. You can create a profile and a rule for the Infected-Hosts feed and specify the threat level and the action to take for the infected hosts. Then, you can link the security intelligence policy with the firewall policy and apply it to the traffic that you want to protect. Reference: = Security Intelligence Overview, Configuring Security Intelligence Policy, Configure the Security Intelligence Policy on the SRX Series Device
A
Explanation:
To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a policy that allows you to block or monitor traffic from malicious sources based on threat intelligence feeds from Juniper ATP Cloud or other providers. One of the feeds that you can use is the Infected-Hosts feed, which contains IP addresses of hosts that are infected with malware and communicate with command-and-control servers. You can create a profile and a rule for the Infected-Hosts feed and specify the threat level and the action to take for the infected hosts. Then, you can link the security intelligence policy with the firewall policy and apply it to the traffic that you want to protect. Reference: = Security Intelligence Overview, Configuring Security Intelligence Policy, Configure the Security Intelligence Policy on the SRX Series Device
Question #9
You are asked to reduce the load that the JIMS server places on your
Which action should you take in this situation?
- A . Connect JIMS to the RADIUS server
- B . Connect JIMS to the domain Exchange server
- C . Connect JIMS to the domain SQL server.
- D . Connect JIMS to another SRX Series device.
Correct Answer: D
D
Explanation:
JIMS server is a Juniper Identity Management Service that collects user identity information from different authentication sources for SRX Series devices12. It can connect to SRX Series devices and CSO platform in your network1.
D
Explanation:
JIMS server is a Juniper Identity Management Service that collects user identity information from different authentication sources for SRX Series devices12. It can connect to SRX Series devices and CSO platform in your network1.
Question #10
Which statement defines the function of an Application Layer Gateway (ALG)?
- A . The ALG uses software processes for permitting or disallowing specific IP address ranges.
- B . The ALG uses software that is used by a single TCP session using the same port numbers as the application.
- C . The ALG contains protocols that use one application session for each TCP session.
- D . The ALG uses software processes for managing specific protocols.
Correct Answer: D
D
Explanation:
The statement that defines the function of an Application Layer Gateway (ALG) is: The ALG uses software processes for managing specific protocols. An ALG is a security component that operates at the application layer (layer 7) of the OSI model and handles data associated with certain application protocols, such as SIP, FTP, RTSP, etc. An ALG acts as a proxy or intermediary between the client and the server applications and performs various functions, such as address and port translation, resource allocation, application response control, and synchronization of data and control traffic. An ALG can also inspect and modify the application payload to enable firewall or NAT traversal, prevent spoofing or DoS attacks, or enforce granular security policies based on application-specific commands. Reference: = Application-level gateway – Wikipedia, What Is an Application Layer Gateway (ALG)? | F5, What is ALG •• Application Layer Gateway | 3CX
D
Explanation:
The statement that defines the function of an Application Layer Gateway (ALG) is: The ALG uses software processes for managing specific protocols. An ALG is a security component that operates at the application layer (layer 7) of the OSI model and handles data associated with certain application protocols, such as SIP, FTP, RTSP, etc. An ALG acts as a proxy or intermediary between the client and the server applications and performs various functions, such as address and port translation, resource allocation, application response control, and synchronization of data and control traffic. An ALG can also inspect and modify the application payload to enable firewall or NAT traversal, prevent spoofing or DoS attacks, or enforce granular security policies based on application-specific commands. Reference: = Application-level gateway – Wikipedia, What Is an Application Layer Gateway (ALG)? | F5, What is ALG •• Application Layer Gateway | 3CX