Juniper JN0-335 Practice Exams
Last updated on Oct 22,2026- Exam Code: JN0-335
- Exam Name: Security, Specialist (JNCIS-SEC)
- Certification Provider: Juniper
- Latest update: Oct 22,2026
Question #61
You want to show tabular data for operational mode commands.
In this scenario, which logging parameter will provide this function?
- A . permit
- B . count
- C . session-init
- D . session-close
Correct Answer: B
B
Explanation:
The logging parameter that will provide the function of showing tabular data for operational mode commands is count. The count parameter displays the number of packets and bytes that match a security policy and the action taken by the policy. The count parameter can be used with the show security policies hit-count command to display the policy counters in a tabular format. The count parameter can also be used with the show security flow session command to display the session counters in a tabular format. Reference: = show security policies hit-count, show security flow session
B
Explanation:
The logging parameter that will provide the function of showing tabular data for operational mode commands is count. The count parameter displays the number of packets and bytes that match a security policy and the action taken by the policy. The count parameter can be used with the show security policies hit-count command to display the policy counters in a tabular format. The count parameter can also be used with the show security flow session command to display the session counters in a tabular format. Reference: = show security policies hit-count, show security flow session
Question #62
Which two statements about SRX Series device chassis clusters are true? (Choose two.)
- A . Redundancy group 0 is only active on the cluster backup node.
- B . Each chassis cluster member requires a unique cluster ID value.
- C . Each chassis cluster member device can host active redundancy groups
- D . Chassis cluster member devices must be the same model.
Correct Answer: C D
C D
Explanation:
In a chassis cluster, both nodes can host active redundancy groups. The active redundancy groups can be distributed between the two nodes, depending on the configuration and failover status, allowing each node to handle traffic for different sets of services or interfaces.
For the chassis clustering to function correctly, both nodes in the cluster must be of the same model. This requirement ensures that the hardware capabilities, such as processing power and interface compatibility, are identical, which is crucial for maintaining consistent performance and behavior between cluster nodes.
C D
Explanation:
In a chassis cluster, both nodes can host active redundancy groups. The active redundancy groups can be distributed between the two nodes, depending on the configuration and failover status, allowing each node to handle traffic for different sets of services or interfaces.
For the chassis clustering to function correctly, both nodes in the cluster must be of the same model. This requirement ensures that the hardware capabilities, such as processing power and interface compatibility, are identical, which is crucial for maintaining consistent performance and behavior between cluster nodes.
Question #63
Exhibit
Referring to the exhibit, which two statements describe the type of proxy used? (Choose two.)
- A . forward proxy
- B . client protection proxy
- C . server protection proxy
- D . reverse proxy
Correct Answer: A D
A D
Explanation:
In the exhibit, the SRX Firewall could be acting as a forward proxy, managing outbound internet requests from internal users or clients within a private network to the internet. Forward proxies are commonly used to control and monitor outbound traffic, provide content caching to improve load times, and enforce company policies.
The scenario can also imply a reverse proxy setup where the SRX Firewall might be configured to direct incoming requests from the internet to the web application. Reverse proxies are used to balance load, enhance security, manage SSL encryption, and provide additional caching functionalities for inbound traffic to servers.
A D
Explanation:
In the exhibit, the SRX Firewall could be acting as a forward proxy, managing outbound internet requests from internal users or clients within a private network to the internet. Forward proxies are commonly used to control and monitor outbound traffic, provide content caching to improve load times, and enforce company policies.
The scenario can also imply a reverse proxy setup where the SRX Firewall might be configured to direct incoming requests from the internet to the web application. Reverse proxies are used to balance load, enhance security, manage SSL encryption, and provide additional caching functionalities for inbound traffic to servers.
Question #64
Exhibit
Referring to the exhibit, what do you determine about the status of the cluster.
- A . Both nodes determine that they are in a primary state.
- B . Node 1 is down
- C . Node 2 is down.
- D . There are no issues with the cluster.
Correct Answer: B
Question #65
Which statement regarding Juniper Identity Management Service (JIMS) domain PC probes is true?
- A . JIMS domain PC probes analyze domain controller security event logs at60-mmute intervals by default.
- B . JIMS domain PC probes are triggered if no username to IP address mapping is found in the domain security event log.
- C . JIMS domain PC probes are triggered to map usernames to group membership information.
- D . JIMS domain PC probes are initiated by an SRX Series device to verify authentication table information.
Correct Answer: B
B
Explanation:
Juniper Identity Management Service (JIMS) domain PC probes are used to map usernames to IP addresses in the domain security event log. This allows for the SRX Series device to verify authentication table information, such as group membership. The probes are triggered whenever a username to IP address mapping is not found in the domain security event log. By default, the probes are executed at 60-minute intervals.
B
Explanation:
Juniper Identity Management Service (JIMS) domain PC probes are used to map usernames to IP addresses in the domain security event log. This allows for the SRX Series device to verify authentication table information, such as group membership. The probes are triggered whenever a username to IP address mapping is not found in the domain security event log. By default, the probes are executed at 60-minute intervals.
Question #66
Exhibit
You just finished setting up your command-and-control (C&C) category with Juniper ATP Cloud. You notice that all of the feeds have zero objects in them.
Which statement is correct in this scenario?
- A . The security intelligence policy must be configured; on a unified security policy
- B . Use the commit full command to start the download.
- C . No action is required, the feeds take a few minutes to download.
- D . Set the maximum C&C entries within the Juniper ATP Cloud GUI.
Correct Answer: C
C
Explanation:
According to the Juniper Networks JNCIS-SEC Study Guide, when you set up your command-and-control (C&C) category with Juniper ATP Cloud, all of the feeds will initially have zero objects in them. This is normal, as it can take a few minutes for the feeds to download. No action is required in this scenario and you will notice the feeds start to populate with objects once the download is complete.
C
Explanation:
According to the Juniper Networks JNCIS-SEC Study Guide, when you set up your command-and-control (C&C) category with Juniper ATP Cloud, all of the feeds will initially have zero objects in them. This is normal, as it can take a few minutes for the feeds to download. No action is required in this scenario and you will notice the feeds start to populate with objects once the download is complete.
Question #67
While working on an SRX firewall, you execute the show security policies policy-name <name> detail command.
Which function does this command accomplish?
- A . It displays details about the default security policy.
- B . It identifies the different custom policies enabled.
- C . It shows the system log files for the local SRX Series device.
- D . It shows policy counters for a configured policy.
Correct Answer: D
D
Explanation:
The function that the show security policies policy-name <name> detail command accomplishes is showing policy counters for a configured policy. Policy counters are statistics that indicate how many times a policy has been matched by traffic and what actions have been taken by the policy. Policy counters can help you monitor and troubleshoot the performance and effectiveness of your security policies. The show security policies policy-name <name> detail command displays detailed information about a specific policy, such as its source zone, destination zone, description, state, hit count, byte count, packet count, action count, and session count.
Reference: = show security policies, show security policies information, [SRX] How to troubleshoot a security policy that is not passing data
D
Explanation:
The function that the show security policies policy-name <name> detail command accomplishes is showing policy counters for a configured policy. Policy counters are statistics that indicate how many times a policy has been matched by traffic and what actions have been taken by the policy. Policy counters can help you monitor and troubleshoot the performance and effectiveness of your security policies. The show security policies policy-name <name> detail command displays detailed information about a specific policy, such as its source zone, destination zone, description, state, hit count, byte count, packet count, action count, and session count.
Reference: = show security policies, show security policies information, [SRX] How to troubleshoot a security policy that is not passing data
Question #68
Which two statements are correct about a policy scheduler? (Choose two.)
- A . A policy scheduler can only be applied when using the policy-rematch feature.
- B . A policy scheduler can be dynamically activated based on traffic flow volumes.
- C . A policy scheduler can be defined using a daily schedule.
- D . A policy scheduler determines the time frame that a security policy is actively evaluated.
Correct Answer: C, D
C, D
Explanation:
A policy scheduler is a feature that allows a security policy to be activated or deactivated for a specified time period. You can define schedulers for a single or recurrent time slot within which a policy is active.
Two statements that are correct about a policy scheduler are:
A policy scheduler can be defined using a daily schedule: You can configure a scheduler to be active every day for a certain time interval, such as from 8:00 AM to 5:00 PM. You can also exclude specific days from the daily schedule, such as weekends or holidays.
A policy scheduler determines the time frame that a security policy is actively evaluated: When you associate a scheduler with a security policy, the policy is only available for policy lookup during the time frame specified by the scheduler. When the scheduler is off, the policy is inactive and cannot be matched by any traffic.
Reference: = Scheduling Security Policies, Configuring Schedulers for a Daily Schedule Excluding One Day
C, D
Explanation:
A policy scheduler is a feature that allows a security policy to be activated or deactivated for a specified time period. You can define schedulers for a single or recurrent time slot within which a policy is active.
Two statements that are correct about a policy scheduler are:
A policy scheduler can be defined using a daily schedule: You can configure a scheduler to be active every day for a certain time interval, such as from 8:00 AM to 5:00 PM. You can also exclude specific days from the daily schedule, such as weekends or holidays.
A policy scheduler determines the time frame that a security policy is actively evaluated: When you associate a scheduler with a security policy, the policy is only available for policy lookup during the time frame specified by the scheduler. When the scheduler is off, the policy is inactive and cannot be matched by any traffic.
Reference: = Scheduling Security Policies, Configuring Schedulers for a Daily Schedule Excluding One Day
Question #69
You are asked to ensure that if the session table on your SRX Series device gets close to exhausting its resources, that you enforce a more aggress.ve age-out of existing flows.
In this scenario, which two statements are correct? (Choose two.)
- A . The early-ageout configuration specifies the timeout value, in seconds, that will be applied once the low-watermark value is met.
- B . The early-ageout configuration specifies the timeout value, in seconds, that will be applied once the high-watermark value is met.
- C . The high-watermark configuration specifies the percentage of how much of the session table is left before disabling a more aggressive age- out timer.
- D . The high-watermark configuration specifies the percentage of how much of the session table can be allocated before applying a more aggressive age-out timer
Correct Answer: B D
B D
Explanation:
The early-ageout configuration specifies the timeout value, in seconds, that will be applied once the high-watermark value is met. The high-watermark configuration specifies the percentage of how much of the session table can be allocated before applying a more aggressive age-out timer. This ensures that the session table does not become full and cause traffic issues, and also ensures that existing flows are aged out quickly when the table begins to get close to being full.
B D
Explanation:
The early-ageout configuration specifies the timeout value, in seconds, that will be applied once the high-watermark value is met. The high-watermark configuration specifies the percentage of how much of the session table can be allocated before applying a more aggressive age-out timer. This ensures that the session table does not become full and cause traffic issues, and also ensures that existing flows are aged out quickly when the table begins to get close to being full.
Question #70
Which two statements are true about mixing traditional and unified security policies? (Choose two.)
- A . When a packet matches a unified security policy, the evaluation process terminates
- B . Traditional security policies must come before unified security policies
- C . Unified security policies must come before traditional security policies
- D . When a packet matches a traditional security policy, the evaluation process terminates
Correct Answer: A D