Juniper JN0-335 Practice Exams
Last updated on Oct 21,2026- Exam Code: JN0-335
- Exam Name: Security, Specialist (JNCIS-SEC)
- Certification Provider: Juniper
- Latest update: Oct 21,2026
Question #21
You are deploying a new SRX Series device and you need to log denied traffic.
In this scenario, which two policy parameters are required to accomplish this task? (Choose two.)
- A . session-init
- B . session-close
- C . deny
- D . count
Correct Answer: B C
Question #22
Which two statements are correct about JSA data collection? (Choose two.)
- A . The Event Collector collects information using BGP FlowSpec.
- B . The Flow Collector can use statistical sampling
- C . The Flow Collector parses logs.
- D . The Event Collector parses logs
Correct Answer: B D
B D
Explanation:
The Flow Collector can use statistical sampling to collect and store network flow data in the JSA database. The Event Collector collects information from various sources including syslog, SNMP, NetFlow, and BGP FlowSpec. Both the Flow Collector and the Event Collector parse logs to extract useful information from the logs.
B D
Explanation:
The Flow Collector can use statistical sampling to collect and store network flow data in the JSA database. The Event Collector collects information from various sources including syslog, SNMP, NetFlow, and BGP FlowSpec. Both the Flow Collector and the Event Collector parse logs to extract useful information from the logs.
Question #23
Your company is using the Juniper ATP Cloud free model. The current inspection profile is set at 10 MB You are asked to configure ATP Cloud so that executable files up to 30 MB can be scanned while at the same time minimizing the change in scan time for other file types.
Which configuration should you use in this scenario?
- A . Use the CLI to create a custom profile and increase the scan limit.
- B . Use the ATP Cloud Ul to change the default profile to increase the scan limit for all files to 30 MB.
- C . Use the CLI to change the default profile to increase the scan limit for all files to 30 MB.
- D . Use the ATP Cloud Ul to update a custom profile and increase the scan limit for executable files to 30 MB.
Correct Answer: D
D
Explanation:
In this scenario, you should use the ATP Cloud Ul to create a custom profile and update the scan limit for executable files to 30 MB. This will ensure that executable files up to 30 MB can be scanned, while at the same time minimizing the change in scan time for other file types. To do this, log in to the ATP Cloud Ul and go to the Profiles tab. Click the Create button to create a new profile, and then adjust the scan limits for executable files to 30 MB. Once you have saved the custom profile, you can apply it to the desired systems and the new scan limit will be in effect.
D
Explanation:
In this scenario, you should use the ATP Cloud Ul to create a custom profile and update the scan limit for executable files to 30 MB. This will ensure that executable files up to 30 MB can be scanned, while at the same time minimizing the change in scan time for other file types. To do this, log in to the ATP Cloud Ul and go to the Profiles tab. Click the Create button to create a new profile, and then adjust the scan limits for executable files to 30 MB. Once you have saved the custom profile, you can apply it to the desired systems and the new scan limit will be in effect.
Question #24
Exhibit
Referring to the SRX Series flow module diagram shown in the exhibit, where is application security processed?
- A . Forwarding Lookup
- B . Services ALGs
- C . Security Policy
- D . Screens
Correct Answer: B
Question #25
Click the Exhibit button.
You have implemented SSL client protection proxy. Employees are receiving the error shown in the exhibit.
How do you solve this problem?
- A . Load a known good, but expired. CA certificate onto the SRX Series device.
- B . Install a new SRX Series device to act as the client proxy
- C . Reboot the SRX Series device.
- D . Import the existing certificate to each client device.
Correct Answer: D
D
Explanation:
SSL client protection proxy is a feature that allows you to decrypt and inspect the SSL traffic from
clients to servers. To do this, you need to install a certificate authority (CA) certificate on the SRX Series device and import the same certificate to each client device. This way, the SRX Series device can act as a proxy between the client and the server and perform security checks on the decrypted traffic. If the client device does not have the certificate installed, it will receive an error message like the one shown in the exhibit. Reference: = JNCIS-SEC Certification, Open Learning – Security, Specialist (JNCIS-SEC), SSL Proxy Configuration
D
Explanation:
SSL client protection proxy is a feature that allows you to decrypt and inspect the SSL traffic from
clients to servers. To do this, you need to install a certificate authority (CA) certificate on the SRX Series device and import the same certificate to each client device. This way, the SRX Series device can act as a proxy between the client and the server and perform security checks on the decrypted traffic. If the client device does not have the certificate installed, it will receive an error message like the one shown in the exhibit. Reference: = JNCIS-SEC Certification, Open Learning – Security, Specialist (JNCIS-SEC), SSL Proxy Configuration
Question #26
Which three statements about SRX Series device chassis clusters are true? (Choose three.)
- A . Chassis cluster control links must be configured using RFC 1918 IP addresses.
- B . Chassis cluster member devices synchronize configuration using the control link.
- C . A control link failure causes the secondary cluster node to be disabled.
- D . Recovery from a control link failure requires that the secondary member device be rebooted.
- E . Heartbeat messages verify that the chassis cluster control link is working.
Correct Answer: B C E
B C E
Explanation:
B. Chassis cluster member devices synchronize configuration using the control link: This statement is correct because the control link is used for configuration synchronization among other functions.
C. A control link failure causes the secondary cluster node to be disabled: This statement is correct because a control link failure causes the secondary node to become ineligible for primary role and remain in secondary role until the control link is restored.
E. Heartbeat messages verify that the chassis cluster control link is working: This statement is correct because heartbeat messages are sent periodically over the control link to monitor its status.
B C E
Explanation:
B. Chassis cluster member devices synchronize configuration using the control link: This statement is correct because the control link is used for configuration synchronization among other functions.
C. A control link failure causes the secondary cluster node to be disabled: This statement is correct because a control link failure causes the secondary node to become ineligible for primary role and remain in secondary role until the control link is restored.
E. Heartbeat messages verify that the chassis cluster control link is working: This statement is correct because heartbeat messages are sent periodically over the control link to monitor its status.
Question #27
What are two types of system logs that Junos generates? (Choose two.)
- A . SQL log files
- B . data plane logs
- C . system core dump files
- D . control plane logs
Correct Answer: B D
B D
Explanation:
The two types of system logs that Junos generates are control plane logs and data plane logs. Control plane logs are generated by the Junos operating system and contain system-level events such as system startup and shutdown, configuration changes, and system alarms. Data plane logs are generated by the network protocol processes and contain messages about the status of the network and its components, such as routing, firewall, NAT, and IPS. SQL log files and system core dump files are not types of system logs generated by Junos.
B D
Explanation:
The two types of system logs that Junos generates are control plane logs and data plane logs. Control plane logs are generated by the Junos operating system and contain system-level events such as system startup and shutdown, configuration changes, and system alarms. Data plane logs are generated by the network protocol processes and contain messages about the status of the network and its components, such as routing, firewall, NAT, and IPS. SQL log files and system core dump files are not types of system logs generated by Junos.
Question #28
Which two statements about SRX chassis clustering are correct? (Choose two.)
- A . SRX chassis clustering supports active/passive and active/active for the data plane.
- B . SRX chassis clustering only supports active/passive for the data plane.
- C . SRX chassis clustering supports active/passive for the control plane.
- D . SRX chassis clustering supports active/active for the control plane.
Correct Answer: A C
A C
Explanation:
SRX chassis clustering allows for both active/passive and active/active configurations for the data plane. In an active/passive setup, one node is active (handling traffic) while the other remains passive (idle and waiting to take over in case of failure). In an active/active setup, both nodes can handle traffic simultaneously, distributing different traffic flows or services between them for load balancing and redundancy.
For the control plane, SRX chassis clustering typically operates in an active/passive mode. This means one node actively handles the control plane responsibilities, such as managing routing tables and maintaining sessions, while the other stands by ready to take over these tasks if the active node fails.
A C
Explanation:
SRX chassis clustering allows for both active/passive and active/active configurations for the data plane. In an active/passive setup, one node is active (handling traffic) while the other remains passive (idle and waiting to take over in case of failure). In an active/active setup, both nodes can handle traffic simultaneously, distributing different traffic flows or services between them for load balancing and redundancy.
For the control plane, SRX chassis clustering typically operates in an active/passive mode. This means one node actively handles the control plane responsibilities, such as managing routing tables and maintaining sessions, while the other stands by ready to take over these tasks if the active node fails.
Question #29
Which statement about security policy schedulers is correct?
- A . Multiple policies can use the same scheduler.
- B . A policy can have multiple schedulers.
- C . When the scheduler is disabled, the policy will still be available.
- D . A policy without a defined scheduler will not become active
Correct Answer: A
A
Explanation:
Schedulers can be defined and reused by multiple policies, allowing for more efficient management of policy activation and deactivation. This can be particularly useful for policies that need to be activated during specific time periods, such as business hours or maintenance windows.
A
Explanation:
Schedulers can be defined and reused by multiple policies, allowing for more efficient management of policy activation and deactivation. This can be particularly useful for policies that need to be activated during specific time periods, such as business hours or maintenance windows.
Question #30
Which two statements are correct about security policy changes when using the policy rematch feature? (Choose two.)
- A . When a policy change includes changing the policy’s action from permit to deny, all existing sessions are maintained
- B . When a policy change includes changing the policy’s source or destination address match condition, all existing sessions are dropped.
- C . When a policy change includes changing the policy’s action from permit to deny, all existing sessions are dropped.
- D . When a policy change includes changing the policy’s source or destination address match condition, all existing sessions are reevaluated.
Correct Answer: C D
C D
Explanation:
policy rematch is a feature that enables the device to reevaluate an active session when its associated security policy is modified. The session remains open if it still matches the policy that allowed the session initially. The session is closed if its associated policy is renamed, deactivated, or deleted1.
C D
Explanation:
policy rematch is a feature that enables the device to reevaluate an active session when its associated security policy is modified. The session remains open if it still matches the policy that allowed the session initially. The session is closed if its associated policy is renamed, deactivated, or deleted1.