Free Juniper JN0-335 Practice Exams

Juniper JN0-335 Practice Exams

Last updated on Oct 21,2026
  • Exam Code: JN0-335
  • Exam Name: Security, Specialist (JNCIS-SEC)
  • Certification Provider: Juniper
  • Latest update: Oct 21,2026
Question #11

Exhibit

When trying to set up a server protection SSL proxy, you receive the error shown.

What are two reasons for this error? (Choose two.)

  • A . The SSL proxy certificate ID is part of a blocklist.
  • B . The SSL proxy certificate ID does not have the correct renegotiation option set.
  • C . The SSL proxy certificate ID is for a forwarding proxy.
  • D . The SSL proxy certificate ID does not exist.

Reveal Solution Hide Solution

Correct Answer: B D
B D

Explanation:

The error message shown in the exhibit regarding the SSL proxy setup indicates an issue with the type of server certificate being used. The error explicitly states, "Unsupported cert type of server certid." Here are two plausible reasons for this error based on the options provided:

Option B. The SSL proxy certificate ID does not have the correct renegotiation option set.

This option points to a configuration issue related to the properties or capabilities of the certificate, such as renegotiation, which if not set correctly according to the expected requirements of the SSL proxy, might lead to the certificate being unsupported. Renegotiation settings are critical in ensuring secure connections, and mismatches in configuration can result in errors.

Option D. The SSL proxy certificate ID does not exist.

If the certificate ID being referred to in the SSL proxy profile does not exist in the device’s certificate store or is incorrectly referenced, the system will be unable to apply the configuration, leading to an error during the commit operation. This situation would typically result in an error indicating that the system can’t find or recognize the specified certificate ID.
Question #12

What are two requirements for enabling AppQoE? (Choose two.)

  • A . You need two SRX Series device endpoints.
  • B . You need two SRX Series or MX Series device endpoints.
  • C . You need an APPID feature license.
  • D . You need to configure AppQoE for reverse traffic.

Reveal Solution Hide Solution

Correct Answer: B, C
B, C

Explanation:

AppQoE is a feature that enables you to monitor and optimize the quality of experience for applications on your network. It uses application-aware routing and dynamic path selection to choose the best path for each application based on predefined or custom SLA profiles. AppQoE also provides visibility and reporting on application performance and network conditions.

Two requirements for enabling AppQoE are:

You need two SRX Series or MX Series device endpoints: AppQoE can be configured between two SRX Series device endpoints or between an SRX Series device and an MX Series device in a hub-and-spoke or full mesh topology. The devices must run the same version of Junos OS and have the same AppQoE configuration.

You need an APPID feature license: AppQoE requires an APPID feature license to be installed on the SRX Series device. The APPID feature license enables application identification and classification, which are essential for AppQoE to work.

Reference: = Application Quality of Experience Overview, Application Quality of Experience Overview – Juniper Networks, Application Quality of Experience | Junos OS | Juniper Networks
Question #13

Exhibit

You are asked to track BitTorrent traffic on your network. You need to automatically add the workstations to the High_Risk_Workstations feed and the servers to the BitTorrent_Servers feed automatically to help mitigate future threats.

Which two commands would add this functionality to the FindThreat policy? (Choose two.)

A)

B)

C)

D)

  • A . Option A
  • B . Option B
  • C . Option C
  • D . Option D

Reveal Solution Hide Solution

Correct Answer: A D
Question #14

Click the Exhibit button.

Which two statements describe the output shown in the exhibit? (Choose two.)

  • A . Redundancy group 1 experienced an operational failure.
  • B . Redundancy group 1 was administratively failed over.
  • C . Node 0 is controlling traffic for redundancy group 1.
  • D . Node 1 is controlling traffic for redundancy group 1.

Reveal Solution Hide Solution

Correct Answer: C, D
C, D

Explanation:

The output indicates that node1 has a priority of 200 and is marked as "Primary," which means it is currently the active node controlling traffic for redundancy group 1. The "Primary" status designates that this node is handling the traffic for the specified redundancy group.

According to the exhibit, node0 is listed with a priority of 0 and is marked as "Secondary." This status indicates that node0 is currently not controlling traffic for redundancy group 1, serving instead in a standby role ready to take over should node1 fail or become unavailable.
Question #15

Which sequence does an SRX Series device use when implementing stateful session security policies using Layer 3 routes?

  • A . An SRX Series device will perform a security policy search before conducting a longest-match Layer 3 route table lookup.
  • B . An SRX Series device performs a security policy search before implementing an ALG security check on the longest-match Layer 3 route.
  • C . An SRX Series device will conduct a longest-match Layer 3 route table lookup before performing a security policy search.
  • D . An SRX Series device conducts an ALG security check on the longest-match route before performing a security policy search.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The sequence that an SRX Series device uses when implementing stateful session security policies using Layer 3 routes is:

An SRX Series device will conduct a longest-match Layer 3 route table lookup before performing a security policy search: When an SRX Series device receives a packet, it first looks up the destination IP address in the routing table and finds the longest matching route to forward the packet. Then, it performs a security policy search based on the source zone, destination zone, source address, destination address, protocol, and application of the packet. If there is a matching policy that allows the packet, it creates or updates a session entry for the packet and applies any security services configured in the policy.

Reference: = [Security Policies Overview], [Security Policy Processing Overview]
Question #16

Which two statements are true about Juniper ATP Cloud? (Choose two.)

  • A . Dynamic analysis is always performed to determine if a file contains malware.
  • B . If the cache lookup determines that a file contains malware, performed to verify the results.
  • C . Dynamic analysis is not always necessary to determine if a file contains malware.
  • D . If the cache lookup determines that a file contains malware, static analysis is not performed to verify the results.

Reveal Solution Hide Solution

Correct Answer: C D
C D

Explanation:

Dynamic analysis is not always necessary to determine if a file contains malware, as the ATP Cloud uses a cache lookup to quickly identify known malicious files. If the cache lookup determines that a file contains malware, static analysis is not performed to verify the results. This information can be found on the Juniper website here: https://www.juniper.net/documentation/en_US/release-independent/security/jnpr-security-srx-series/inform
Question #17

Click the Exhibit button.

You are validating the configuration template for device access. The commands in the exhibit have been entered to secure IP access to an SRX Series device.

Referring to the exhibit, which two statements are true? (Choose two.)

  • A . The device manager can access the device from 192.168.11.248.
  • B . The loopback interface blocks invalid traffic on its entry into the device.
  • C . The loopback interface blocks invalid traffic on its exit from the device.
  • D . The device manager can access the device from 10.253.1.2.

Reveal Solution Hide Solution

Correct Answer: B, D
B, D

Explanation:

The commands in the exhibit show how to configure a firewall filter on the loopback interface (lo0) of an SRX Series device. The loopback interface is a gateway for all the control traffic that enters the Routing Engine of the device. The firewall filter can be used to monitor and protect this control traffic from various attacks. Two statements that are true based on the exhibit are:

The loopback interface blocks invalid traffic on its entry into the device: The firewall filter applied on lo0 has a term that matches any packet with an invalid source address (such as 0.0.0.0/8 or 127.0.0.0/8) and discards it. This prevents spoofing or DoS attacks using invalid source addresses. The device manager can access the device from 10.253.1.2: The firewall filter applied on lo0 has a term that matches any packet with a source address of 10.253.1.2 and accepts it. This allows the device manager to access the device from this IP address using protocols such as SSH, Telnet, HTTP, or HTTPS.

Reference: = Firewall Filter Support on Loopback Interface, [MX/SRX] The behavior of firewall filters that are applied on the loopback interfaces in virtual routers
Question #18

When a security policy is deleted, which statement is correct about the default behavior of active sessions allowed by that policy?

  • A . The active sessions allowed by the policy will be dropped.
  • B . The active sessions allowed by the policy will be marked as a legacy flow and will continue to be forwarded.
  • C . The active sessions allowed by the policy will be reevaluated by the cached
  • D . The active sessions allowed by the policy will continue

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

When a security policy is deleted, the existing sessions that were previously allowed by that policy are not immediately dropped; instead, they are typically treated as legacy flows. This means they are allowed to continue until they naturally end or until the session timeout is reached. This behavior ensures that deleting a policy does not abruptly disrupt ongoing traffic flows that were previously authorized by that policy. This approach helps in avoiding unintended service disruptions, especially in production environments where active connections may be critical to operations.
Question #19

Which two statements are correct about SSL proxy server protection? (Choose two.)

  • A . You do not need to configure the servers to use the SSL proxy the function on the SRX Series device.
  • B . You must load the server certificates on the SRX Series device.
  • C . The servers must be configured to use the SSL proxy function on the SRX Series device.
  • D . You must import the root CA on the servers.

Reveal Solution Hide Solution

Correct Answer: A B
A B

Explanation:

When using SSL proxy, the servers themselves do not require any special configuration to utilize the SSL proxy function on the SRX device. The SSL proxy operates transparently, intercepting and decrypting SSL/TLS traffic before it reaches the servers.

For the SSL proxy to function effectively, especially in server protection mode where it impersonates the server to the client, it is necessary to load the server’s certificates onto the SRX device. This allows the SRX to establish a trusted connection with the client using the server’s credentials.
Question #20

After JSA receives external events and flows, which two steps occur? (Choose two.)

  • A . After formatting the data, the data is stored in an asset database.
  • B . Before formatting the data, the data is analyzed for relevant information.
  • C . Before the information is filtered, the information is formatted
  • D . After the information is filtered, JSA responds with active measures

Reveal Solution Hide Solution

Correct Answer: A C
A C

Explanation:

When JSA (Juniper Secure Analytics) receives external events and flows, the typical processing steps are:

Option C. Before the information is filtered, the information is formatted.

Data formatting is an initial step in the process where raw data from events and flows is converted into a standard format that can be more easily processed and analyzed by JSA.

Option A. After formatting the data, the data is stored in an asset database.

Once the data is formatted, it is stored in an asset database. This database acts as a repository for all the formatted data, enabling JSA to perform further analysis, correlation, and eventually, to maintain a comprehensive view of the network assets and activities.

These steps are part of JSA’s comprehensive approach to security event management, which involves collecting, normalizing, and analyzing data to identify potential security threats and vulnerabilities efficiently.
Previous Questions Next Questions