Juniper JN0-335 Practice Exams
Last updated on Oct 22,2026- Exam Code: JN0-335
- Exam Name: Security, Specialist (JNCIS-SEC)
- Certification Provider: Juniper
- Latest update: Oct 22,2026
Question #71
You are asked to block malicious applications regardless of the port number being used.
In this scenario, which two application security features should be used? (Choose two.)
- A . AppFW
- B . AppQoE
- C . APPID
- D . AppTrack
Correct Answer: A C
Question #72
Which two devices would you use for DDoS protection with Policy Enforcer? (Choose two.)
- A . vQFX
- B . MX
- C . vMX
- D . QFX
Correct Answer: B C
B C
Explanation:
The MX and vMX devices can be used for DDoS protection with Policy Enforcer. Policy Enforcer is a Juniper Networks solution that provides real-time protection from DDoS attacks. It can be used to detect and block malicious traffic, and also provides granular control over user access and policy enforcement. The MX and vMX devices are well-suited for use with Policy Enforcer due to their high-performance hardware and advanced security features.
B C
Explanation:
The MX and vMX devices can be used for DDoS protection with Policy Enforcer. Policy Enforcer is a Juniper Networks solution that provides real-time protection from DDoS attacks. It can be used to detect and block malicious traffic, and also provides granular control over user access and policy enforcement. The MX and vMX devices are well-suited for use with Policy Enforcer due to their high-performance hardware and advanced security features.
Question #73
Regarding static attack object groups, which two statements are true? (Choose two.)
- A . Matching attack objects are automatically added to a custom group.
- B . Group membership automatically changes when Juniper updates the IPS signature database.
- C . Group membership does not automatically change when Juniper updates the IPS signature database.
- D . You must manually add matching attack objects to a custom group.
Correct Answer: C D
Question #74
You have implemented a vSRX in your VMware environment. You want to implement a second vSRX Series device and enable chassis clustering.
Which two statements are correct in this scenario about the control-link settings? (Choose two.)
- A . In the vSwitch security settings, accept promiscuous mode.
- B . In the vSwitch properties settings, set the VLAN ID to None.
- C . In the vSwitch security settings, reject forged transmits.
- D . In the vSwitch security settings, reject MAC address changes.
Correct Answer: A D
Question #75
Your JIMS server is unable to view event logs.
Which two actions would you take to solve this issue? (Choose two.)
- A . Enable the correct host-inbound-traffic rules on the SRX Series devices.
- B . Enable remote event log management within Windows Firewall on the necessary Exchange servers.
- C . Enable remote event log management within Windows Firewall on the necessary domain controllers.
- D . Enable remote event log management within Windows Firewall on the JIMS server.
Correct Answer: C D
C D
Explanation:
JIMS needs to access the event logs from domain controllers to function properly, as it relies on these logs to track user and device activity across the network. If the Windows Firewall on the domain controllers is blocking this access, enabling remote event log management will allow JIMS to retrieve the necessary information.
While it’s less common, ensuring that any firewall settings on the JIMS server itself do not block outgoing requests or responses related to event log management is also crucial. This ensures that JIMS can send out requests and receive responses without any hindrance from its own firewall.
C D
Explanation:
JIMS needs to access the event logs from domain controllers to function properly, as it relies on these logs to track user and device activity across the network. If the Windows Firewall on the domain controllers is blocking this access, enabling remote event log management will allow JIMS to retrieve the necessary information.
While it’s less common, ensuring that any firewall settings on the JIMS server itself do not block outgoing requests or responses related to event log management is also crucial. This ensures that JIMS can send out requests and receive responses without any hindrance from its own firewall.
Question #76
Which two statements are true about the fab interface in a chassis cluster? (Choose two.)
- A . The fab link does not support fragmentation.
- B . The physical interface for the fab link must be specified in the configuration.
- C . The fab link supports traditional interface features.
- D . The Junos OS supports only one fab link.
Correct Answer: A B
A B
Explanation:
The fabric link, used for data traffic synchronization between cluster nodes, is designed to handle packets at full size. It does not support packet fragmentation, which means that packets should be sized appropriately to avoid issues related to packet size limitations on the fab interface.
For chassis clustering, the specific physical interfaces used as fabric links (fab links) must be explicitly defined in the configuration. This specification is crucial to ensure proper data flow between nodes for state synchronization and other clustering functions.
A B
Explanation:
The fabric link, used for data traffic synchronization between cluster nodes, is designed to handle packets at full size. It does not support packet fragmentation, which means that packets should be sized appropriately to avoid issues related to packet size limitations on the fab interface.
For chassis clustering, the specific physical interfaces used as fabric links (fab links) must be explicitly defined in the configuration. This specification is crucial to ensure proper data flow between nodes for state synchronization and other clustering functions.
Question #77
Exhibit
Referring to the exhibit, which two statements are true? (Choose two.)
- A . Nancy logged in to the juniper.net Active Directory domain.
- B . The IP address of Nancy’s client PC is 172.25.11.
- C . The IP address of the authenticating domain controller is 172.25.11.140.
- D . Nancy is a member of the Active Directory sales group.
Correct Answer: A C
Question #78
On an SRX Series firewall, what are two ways that Encrypted Traffic Insights assess the threat of the traffic? (Choose two.)
- A . It decrypts the file in a sandbox.
- B . It validates the certificates used.
- C . It decrypts the data to validate the hash.
- D . It reviews the timing and frequency of the connections.
Correct Answer: B, D
B, D
Explanation:
Encrypted Traffic Insights is a feature that enables the SRX Series firewall and the ATP Cloud to detect malicious threats that are hidden in encrypted traffic without decrypting the traffic. It does so by analyzing the metadata and connection patterns of the encrypted sessions.
Two ways that Encrypted Traffic Insights assess the threat of the traffic are:
It validates the certificates used: The SRX Series firewall extracts the server certificate from the encrypted session and compares its signature with a blocklist of known malicious certificates provided by ATP Cloud. If there is a match, the session is blocked and reported as a threat.
It reviews the timing and frequency of the connections: The SRX Series firewall sends the connection details, such as source and destination IP addresses, ports, protocols, and timestamps, to ATP Cloud. ATP Cloud applies behavior analysis and machine learning algorithms to detect anomalous or suspicious patterns of connections, such as high frequency, low duration, or unusual timing. Reference: = Juniper Networks Expands Connected Security Portfolio with Encrypted Traffic Analysis for Juniper Advanced Threat Prevention and SecIntel for Mist Wireless, Encrypted Traffic Insights Overview, Configure Encrypted Traffic Insights
B, D
Explanation:
Encrypted Traffic Insights is a feature that enables the SRX Series firewall and the ATP Cloud to detect malicious threats that are hidden in encrypted traffic without decrypting the traffic. It does so by analyzing the metadata and connection patterns of the encrypted sessions.
Two ways that Encrypted Traffic Insights assess the threat of the traffic are:
It validates the certificates used: The SRX Series firewall extracts the server certificate from the encrypted session and compares its signature with a blocklist of known malicious certificates provided by ATP Cloud. If there is a match, the session is blocked and reported as a threat.
It reviews the timing and frequency of the connections: The SRX Series firewall sends the connection details, such as source and destination IP addresses, ports, protocols, and timestamps, to ATP Cloud. ATP Cloud applies behavior analysis and machine learning algorithms to detect anomalous or suspicious patterns of connections, such as high frequency, low duration, or unusual timing. Reference: = Juniper Networks Expands Connected Security Portfolio with Encrypted Traffic Analysis for Juniper Advanced Threat Prevention and SecIntel for Mist Wireless, Encrypted Traffic Insights Overview, Configure Encrypted Traffic Insights
Question #79
Which two statements are correct about chassis clustering? (Choose two.)
- A . The node ID value ranges from 1 to 255.
- B . The node ID is used to identify each device in the chassis cluster.
- C . A system reboot is required to activate changes to the cluster.
- D . The cluster ID is used to identify each device in the chassis cluster.
Correct Answer: B C
B C
Explanation:
In chassis clustering, the node ID is indeed used to uniquely identify each device within the cluster. This allows for individual addressing and management of devices within the cluster configuration, which is crucial for operations and maintenance.
Typically, activating changes that involve chassis clustering configuration, such as setting or changing the node ID or forming a new cluster, requires a reboot of the devices. This ensures that all configuration changes are properly applied and that the devices can synchronize their states as part of the cluster.
B C
Explanation:
In chassis clustering, the node ID is indeed used to uniquely identify each device within the cluster. This allows for individual addressing and management of devices within the cluster configuration, which is crucial for operations and maintenance.
Typically, activating changes that involve chassis clustering configuration, such as setting or changing the node ID or forming a new cluster, requires a reboot of the devices. This ensures that all configuration changes are properly applied and that the devices can synchronize their states as part of the cluster.
Question #80
What are two benefits of using a vSRX in a software-defined network? (Choose two.)
- A . scalability
- B . no required software license
- C . granular security
- D . infinite number of interfaces
Correct Answer: A C
A C
Explanation:
– Scalability: vSRX instances can be easily added or removed as the needs of the network change, making it a flexible option for scaling in a software-defined network.
– Granular Security: vSRX allows for granular security policies to be enforced at the virtual interface level, making it an effective solution for securing traffic in a software-defined network.
The two benefits of using a vSRX in a software-defined network are scalability and granular security. Scalability allows you to increase the number of resources available to meet the demands of network traffic, while granular security provides a level of control and flexibility to your network security that is not possible with a traditional firewall. With a vSRX, you can create multiple levels of security policies, rules, and access control lists to ensure that only authorized traffic can enter and exit your network. Additionally, you would not require a software license to use the vSRX, making it an economical solution for those looking for increased security and flexibility.
A C
Explanation:
– Scalability: vSRX instances can be easily added or removed as the needs of the network change, making it a flexible option for scaling in a software-defined network.
– Granular Security: vSRX allows for granular security policies to be enforced at the virtual interface level, making it an effective solution for securing traffic in a software-defined network.
The two benefits of using a vSRX in a software-defined network are scalability and granular security. Scalability allows you to increase the number of resources available to meet the demands of network traffic, while granular security provides a level of control and flexibility to your network security that is not possible with a traditional firewall. With a vSRX, you can create multiple levels of security policies, rules, and access control lists to ensure that only authorized traffic can enter and exit your network. Additionally, you would not require a software license to use the vSRX, making it an economical solution for those looking for increased security and flexibility.