Juniper JN0-335 Practice Exams
Last updated on Oct 21,2026- Exam Code: JN0-335
- Exam Name: Security, Specialist (JNCIS-SEC)
- Certification Provider: Juniper
- Latest update: Oct 21,2026
Question #31
A client has attempted communication with a known command-and-control server and it has reached the configured threat level threshold.
Which feed will the clients IP address be automatically added to in this situation?
- A . the command-and-control cloud feed
- B . the allowlist and blocklist feed
- C . the custom cloud feed
- D . the infected host cloud feed
Correct Answer: D
D
Explanation:
Infected hosts are internal hosts that have been compromised by malware and are communicating with external C&C servers3. Juniper ATP Cloud provides infected host feeds that list internal IP addresses or subnets of infected hosts along with a threat level3. Once the Juniper ATP Cloud global threshold for an infected host is met, that host is added to the infected host feed and assigned a threat level of 10 by the cloud4. You can also configure your SRX Series device to block traffic from these IP addresses using security policies4.
D
Explanation:
Infected hosts are internal hosts that have been compromised by malware and are communicating with external C&C servers3. Juniper ATP Cloud provides infected host feeds that list internal IP addresses or subnets of infected hosts along with a threat level3. Once the Juniper ATP Cloud global threshold for an infected host is met, that host is added to the infected host feed and assigned a threat level of 10 by the cloud4. You can also configure your SRX Series device to block traffic from these IP addresses using security policies4.
Question #32
You are experiencing excessive packet loss on one of your two WAN links route traffic from the degraded link to the working link
Which AppSecure component would you use to accomplish this task?
- A . AppFW
- B . AppQoE
- C . AppQoS
- D . APBR
Correct Answer: D
D
Explanation:
APBR (Application Path-Based Routing) is an AppSecure component which can be used to route traffic from the degraded link to the working link in order to reduce packet loss. APBR is a policy-based routing solution that allows you to configure rules to direct traffic to the most appropriate path, based on application, user, or network metrics.
D
Explanation:
APBR (Application Path-Based Routing) is an AppSecure component which can be used to route traffic from the degraded link to the working link in order to reduce packet loss. APBR is a policy-based routing solution that allows you to configure rules to direct traffic to the most appropriate path, based on application, user, or network metrics.
Question #33
You administer a JSA host and want to include a rule that sets a threshold for excessive firewall denies and sends an SNMP trap after receiving related syslog messages from an SRX Series firewall.
Which JSA rule type satisfies this requirement?
- A . common
- B . offense
- C . flow
- D . event
Correct Answer: B
B
Explanation:
An offense rule in JSA is designed to aggregate multiple events or log entries based on specified criteria into a single offense, which can then trigger responses such as notifications or actions like sending an SNMP trap. This type of rule is well-suited for scenarios where you need to monitor for patterns or rates of events, such as excessive firewall denies, and take action when these exceed defined thresholds. Offense rules can analyze both event and flow data, making them highly versatile for comprehensive security monitoring.
B
Explanation:
An offense rule in JSA is designed to aggregate multiple events or log entries based on specified criteria into a single offense, which can then trigger responses such as notifications or actions like sending an SNMP trap. This type of rule is well-suited for scenarios where you need to monitor for patterns or rates of events, such as excessive firewall denies, and take action when these exceed defined thresholds. Offense rules can analyze both event and flow data, making them highly versatile for comprehensive security monitoring.
Question #34
Your manager asks you to provide firewall and NAT services in a private cloud.
Which two solutions will fulfill the minimum requirements for this deployment? (Choose two.)
- A . a single vSRX
- B . a vSRX for firewall services and a separate vSRX for NAT services
- C . a cSRX for firewall services and a separate cSRX for NAT services
- D . a single cSRX
Correct Answer: A D
A D
Explanation:
A single vSRX instance is capable of handling both firewall and NAT services simultaneously. This solution provides a streamlined and resource-efficient way to secure and manage network traffic within a private cloud environment.
Similar to the vSRX, a single cSRX can also provide both firewall and NAT services. The cSRX, being a containerized version of the SRX, is particularly suited for environments where high density and microservices architectures are used, offering high performance in a compact form factor.
A D
Explanation:
A single vSRX instance is capable of handling both firewall and NAT services simultaneously. This solution provides a streamlined and resource-efficient way to secure and manage network traffic within a private cloud environment.
Similar to the vSRX, a single cSRX can also provide both firewall and NAT services. The cSRX, being a containerized version of the SRX, is particularly suited for environments where high density and microservices architectures are used, offering high performance in a compact form factor.
Question #35
You are asked to find systems running applications that increase the risks on your network. You must ensure these systems are processed through IPS and Juniper ATP Cloud for malware and virus protection.
Which Juniper Networks solution will accomplish this task?
- A . JIMS
- B . Encrypted Traffic Insights
- C . UTM
- D . Adaptive Threat Profiling
Correct Answer: D
D
Explanation:
Adaptive Threat Profiling (ATP) is a Juniper Networks solution that enables organizations to detect malicious activity on their networks and process it through IPS and Juniper ATP Cloud for malware and virus protection. ATP is powered by Juniper’s advanced Machine Learning and Artificial Intelligence (AI) capabilities, allowing it to detect and block malicious activity in real-time. ATP is integrated with Juniper’s Unified Threat Management (UTM) and Encrypted Traffic Insights (ETI) solutions, providing an end-to-end network protection solution.
D
Explanation:
Adaptive Threat Profiling (ATP) is a Juniper Networks solution that enables organizations to detect malicious activity on their networks and process it through IPS and Juniper ATP Cloud for malware and virus protection. ATP is powered by Juniper’s advanced Machine Learning and Artificial Intelligence (AI) capabilities, allowing it to detect and block malicious activity in real-time. ATP is integrated with Juniper’s Unified Threat Management (UTM) and Encrypted Traffic Insights (ETI) solutions, providing an end-to-end network protection solution.
Question #36
You are configuring logging for a security policy.
In this scenario, in which two situations would log entries be generated? (Choose two.)
- A . every 10 minutes
- B . at session initialization
- C . every 60 seconds
- D . at session close
Correct Answer: B D
B D
Explanation:
Log entries would be generated in two situations: at session initialization and at session close. At session initialization, the log entry would include details about the connection, such as the source and destination IP addresses, the service being used, and the action taken by the security policy. At session close, the log entry would include details about the connection, such as the duration of the session, the bytes sent/received, and the action taken by the security policy. For more information, you can refer to the Juniper Security documentation at https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/security-log-co
B D
Explanation:
Log entries would be generated in two situations: at session initialization and at session close. At session initialization, the log entry would include details about the connection, such as the source and destination IP addresses, the service being used, and the action taken by the security policy. At session close, the log entry would include details about the connection, such as the duration of the session, the bytes sent/received, and the action taken by the security policy. For more information, you can refer to the Juniper Security documentation at https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/security-log-co
Question #37
Which two statements are true about the vSRX? (Choose two.)
- A . It does not have VMXNET3 vNIC support.
- B . It has VMXNET3 vNIC support.
- C . UNIX is the base OS.
- D . Linux is the base OS.
Correct Answer: B D
Question #38
You want to control when cluster failovers occur.
In this scenario, which two specific parameters would you configure on an SRX Series device? (Choose two.)
- A . heartbeat-interval
- B . heartbeat-address
- C . heartbeat-cos
- D . heartbeat-threshold
Correct Answer: A, D
A, D
Explanation:
To control when cluster failovers occur, you need to configure two specific parameters on an SRX Series device: heartbeat-interval and heartbeat-threshold. These parameters determine how often the nodes in a cluster exchange heartbeat messages and how many consecutive heartbeats can be missed before a failover is triggered. The heartbeat-interval specifies the time interval in seconds between each heartbeat message. The default value is 1 second and the range is from 0.1 to 10 seconds. The heartbeat-threshold specifies the number of consecutive heartbeats that must be missed before a failover occurs. The default value is 3 and the range is from 2 to 255.
Reference: = Configuring Chassis Clustering on SRX Series Devices, Chassis Cluster Redundancy Group Failover
A, D
Explanation:
To control when cluster failovers occur, you need to configure two specific parameters on an SRX Series device: heartbeat-interval and heartbeat-threshold. These parameters determine how often the nodes in a cluster exchange heartbeat messages and how many consecutive heartbeats can be missed before a failover is triggered. The heartbeat-interval specifies the time interval in seconds between each heartbeat message. The default value is 1 second and the range is from 0.1 to 10 seconds. The heartbeat-threshold specifies the number of consecutive heartbeats that must be missed before a failover occurs. The default value is 3 and the range is from 2 to 255.
Reference: = Configuring Chassis Clustering on SRX Series Devices, Chassis Cluster Redundancy Group Failover
Question #39
You set up the Juniper ATP Appliance solution on your network and notice that the macOS files are not being analyzed……… malware.
In this scenario, what must you do?
- A . Under Config > System Profiles ≥ Secondary Cores workspace, enable macOs Detection.
- B . You must obtain a Apple Mac Mini device and install the secondary core software.
- C . Under Config -> System Profiles →≥ Secondary Cores workspace, create a macOS profile
- D . Create a macOS virtual machine on the JATP Appliance and install the secondary core software.
Correct Answer: C
Question #40
Which two statements are correct about the Junos IPS feature? (Choose two.)
- A . IPS is integrated as a security service on SRX Series devices.
- B . IPS uses sandboxing to detect unknown attacks.
- C . IPS is a standalone platform running on dedicated hardware or as a virtual device.
- D . IPS uses protocol anomaly rules to detect unknown attacks.
Correct Answer: A, D
A, D
Explanation:
Junos IPS is a feature that provides intrusion prevention and detection services on SRX Series devices. It monitors network traffic and compares it against predefined signatures or custom rules to identify and block malicious or unwanted packets. Two statements that are correct about the Junos IPS feature are:
IPS is integrated as a security service on SRX Series devices: Junos IPS is not a separate platform or device, but a security service that runs on SRX Series firewalls. It can be enabled and configured as part of the security policy on the SRX Series device and applied to specific zones, interfaces, or traffic flows.
IPS uses protocol anomaly rules to detect unknown attacks: Junos IPS uses two types of rules to detect attacks: signature rules and protocol anomaly rules. Signature rules match traffic against known attack patterns or signatures and block them based on predefined actions. Protocol anomaly rules detect deviations from the expected behavior or structure of common protocols, such as TCP, UDP, ICMP, etc. Protocol anomaly rules can help identify unknown or zero-day attacks that may not have a signature yet.
Reference: = Intrusion Detection and Prevention Feature Guide for Security Devices, Understanding Intrusion Detection and Prevention for SRX Series Devices, Understanding Signature Rules and Protocol Anomaly Rules
A, D
Explanation:
Junos IPS is a feature that provides intrusion prevention and detection services on SRX Series devices. It monitors network traffic and compares it against predefined signatures or custom rules to identify and block malicious or unwanted packets. Two statements that are correct about the Junos IPS feature are:
IPS is integrated as a security service on SRX Series devices: Junos IPS is not a separate platform or device, but a security service that runs on SRX Series firewalls. It can be enabled and configured as part of the security policy on the SRX Series device and applied to specific zones, interfaces, or traffic flows.
IPS uses protocol anomaly rules to detect unknown attacks: Junos IPS uses two types of rules to detect attacks: signature rules and protocol anomaly rules. Signature rules match traffic against known attack patterns or signatures and block them based on predefined actions. Protocol anomaly rules detect deviations from the expected behavior or structure of common protocols, such as TCP, UDP, ICMP, etc. Protocol anomaly rules can help identify unknown or zero-day attacks that may not have a signature yet.
Reference: = Intrusion Detection and Prevention Feature Guide for Security Devices, Understanding Intrusion Detection and Prevention for SRX Series Devices, Understanding Signature Rules and Protocol Anomaly Rules