JN0-335 Practice Exam Questions with Answers Security, Specialist (JNCIS-SEC) Certification

AppFW and APPID are two application security features that can be used to block malicious applications regardless of the port number being used. AppFW provides policy-based enforcement and control on traffic based on application signatures. By using AppFW, you can block any application traffic not sanctioned by the enterprise. APPID identifies applications based on their behavior and characteristics, regardless of port, protocol, or encryption method. By using APPID, you can classify applications and apply appropriate security policies to them123 References:

• AppSecure: Application Visibility and Control Solution Brief
• Application Firewall | Junos OS | Juniper Networks
• Security Policy Applications and Application Sets | Junos OS | Juniper Networks

SSL proxy is a feature that allows SRX Series devices to act as an intermediary between the client and the server for SSL/TLS encrypted traffic. SRX Series devices support two types of SSL proxy: SSL forward proxy and SSL reverse proxy. SSL forward proxy is also known as web proxy or client-protection, and SSL reverse proxy is also known as server-protection1.

SSL forward proxy enables the SRX Series device to decrypt the client-side traffic and apply security policies before re-encrypting and forwarding it to the server. This allows the SRX Series device to inspect the application data and identify the applications and threats in the encrypted traffic2.

SSL reverse proxy enables the SRX Series device to decrypt the server-side traffic and apply security policies before re-encrypting and forwarding it to the client. This allows the SRX Series device to protect the server from malicious clients and provide load balancing and high availability for the server3.

References:

• Configuring SSL Proxy
• SSL Forward Proxy Overview
• SSL Reverse Proxy Overview

AppTrack: Tracks and reports applications passing through

the device.

• Intrusion Detection and Prevention (IDP): Applies

appropriate attack objects to applications running on

nonstandard ports. Application identification improves IDP

performance by narrowing the scope of attack signatures

for applications without decoders.

• AppFW: Implements an application firewall using

application-based rules.

• AppQoS: Provides quality-of-service (QoS) prioritization

based on application awareness

The AppSecure AppTrack service module is a logging and reporting tool used to share information about application visibility. Once AppID identifies an application, AppTrack notonly monitors and records its usage, it also sends regular application activity update messages. Since these messages are sent by syslog, they can be read by any compatible third-party device, including Juniper Networks JSA Series Secure Analytics Appliances and Contrail Service Orchestration.https://www.juniper.net/content/dam/www/assets/solution-briefs/us/en/appsecure-application-visibility-and-control.pdf

 Juniper ATP Cloud is a cloud-based service that provides advanced malware detection and prevention for the network. It uses machine learning to find and block both known and unknown cyberthreats, analyzing files and network traffic looking for signs of malicious behavior. One of the methods that Juniper ATP Cloud uses to identify zero-day threats is dynamic analysis, which is the process of executing suspicious files or code in a sandbox environment and observing their behavior and network activity. Dynamic analysis can uncover zero-day malware threats and malicious connections, including botnets and command-and-control servers hiding in encrypted traffic, by detecting anomalous or malicious patterns. Dynamic analysis is complemented by other methods, such as static analysis, which examines the file structure and content without executing it, and machine learning, which uses artificial intelligence to classify and predict threats based on previous data and models. References:

• [Juniper Advanced Threat Prevention Products] 1
• [Juniper Advanced Threat Prevention Datasheet] 2
• [Juniper Advanced Threat Prevention | NetworkScreen.com] 3
• [Introduction to Juniper ATP Cloud | ATP Cloud | Juniper Networks] 4
• [JUNIPER ADVANCED THREAT PREVENTION CLOUD SERVICES DESCRIPTION] 5

After JSA receives external events and flows, the data goes through the following steps in the event and flow pipeline 1:

• Event and flow collection: JSA accepts event logs and flow records from various sources by using different protocols and methods. The data is parsed and normalized into a JSA-usable format.
• Event and flow processing: JSA applies rules, custom properties, and anomaly detection to the data. The data is also coalesced, filtered, and forwarded as needed. The data is stored in an asset database and an Ariel database for further analysis and reporting.
• Event and flow correlation: JSA analyzes the data for patterns that indicate malicious activity or policy violations. JSA generates offenses, alerts, and notifications based on the correlation rules and building blocks.
• Event and flow response: JSA responds to the offenses and alerts by taking active measures such as blocking IP addresses, quarantining hosts, or updating reference data. JSA also provides investigation and remediation tools for analysts to handle the incidents. References:
• 1: JSA Events and Flows | Junos OS | Juniper Networks

The Junos IPS feature is a security service that is integrated on SRX Series devices, which are high-performance network security platforms that offer firewall, VPN, IPS, application security, and unified threat management capabilities. The Junos IPS feature uses various methods to detect and prevent intrusions, such as signature-based detection, protocol anomaly detection, behavioral anomaly detection, and custom signatures. Signature-based detection compares network traffic against predefined patterns of known attacks and blocks traffic when a match is found. Protocol anomaly detection monitors network traffic for deviations from the expected or normal behavior of common protocols, such as HTTP, FTP, SMTP, and DNS, and blocks traffic when an anomaly is detected. Behavioral anomaly detection monitors network traffic forchanges in the baseline behavior of hosts, networks, or applications, and blocks traffic when a significant deviation is detected. Custom signatures allow administrators to create their own patterns of attacks based on specific criteria, such as IP addresses, ports, protocols, or payload content, and block traffic when a match is found. The Junos IPS feature does not use sandboxing to detect unknown attacks, as this is a function of the Juniper ATP Cloud service, which is a cloud-based service that provides advanced malware detection and prevention for the network. The Junos IPS feature is not a standalone platform, but rather a service that runs on SRX Series devices, which can be deployed as physical or virtual appliances. References:

• [Juniper Security, Professional (JNCIP-SEC) Reference Materials] 1
• [Juniper Security, Specialist (JNCIS-SEC) Reference Materials] 2
• [Junos OS Security Configuration Guide] 3
• [Junos OS Security Feature Guide] 4
• [Junos OS Security Feature Support Reference] 5

To log denied traffic, you need to configure a security policy with the action of deny and the option of log session-init. The deny action blocks the traffic that matches the policy criteria, and the log session-init option generates a log entry when the session is denied. The session-close option is not required, as it only logs the end of a session. The count option is not required, as it only increments a counter for the policy. References:

• [SRX] How to log traffic that is denied by default system security policy1
• [SRX] How to log traffic for the default deny policy2
• How to log traffic dropped by Juniper SRX firewalls3

Juniper Identity Management Service (JIMS) is a service that collects and maintains a large database of user, device, and group information from identity sources, enabling SRX Series Service Gateways to rapidly identify users in a large, distributed enterprise1. JIMS supports the following identity sources: Microsoft Active Directory on Windows Server 2008 R2 and later, and Microsoft Exchange Server 2010 with Service Pack 3 (SP3) and later2. JIMS collects username and device IP addresses from these sources by monitoring the event logs of the Active Directory domain controllers and the Exchange servers3. JIMS does not use DNS or OpenLDAP service ports as identity sources. References:

• Juniper Identity Management Service User Guide, Introduction section
• Supported Identity Sources, Juniper Identity Management Service 1.6.0 Release Notes
• Configure Juniper Identity Management Service to Obtain User Identity Information, Junos OS Security Configuration Guide

Juniper ATP Cloud is a cloud-based service that provides advanced threat prevention for SRX Series devices. Juniper ATP Cloud can inspect files for malware by sending them to the cloud or performing a hash lookup. To reduce delays in the inspection of files, Juniper ATP Cloud performs the following two functions12:

• Juniper ATP Cloud allows the creation of allowlists. Allowlists are lists of trusted files or domains that are not sent to the cloud for inspection. This reduces the network traffic and the processing time for the files that are known to be safe. You can create allowlists from the Juniper ATP Cloud Web UI or the SRX Series device CLI.
• Juniper ATP Cloud performs a cache lookup on files. Cache lookup is a feature that checks if a file has been previously scanned by Juniper ATP Cloud and returns the cached verdict. This avoids sending the same file to the cloud again and saves bandwidth and time. Cache lookup is enabled by default and can be configured from the SRX Series device CLI. References:
• Juniper ATP Cloud User Guide
• Juniper ATP Cloud Deployment Guide for SRX Series Devices

 The configuration shown in the exhibit is a pre-ID default policy, which is a security policy that applies to traffic that cannot be identified by the SRX Series device before the user authentication process is complete. The pre-ID default policy has the following characteristics1:

• It is applied to all traffic that matches the from-zone and to-zone parameters, regardless of the source and destination addresses or applications.
• It can only have the permit action, and it cannot be deleted or renamed.
• It can have optional parameters such as log, session-timeout, and session-class.

The session-timeout parameter specifies the maximum time that a session can remain idle before it is closed by the SRX Series device. The session-timeout parameter can have different values for different types of traffic, such as TCP, UDP, or others. The others parameter applies to traffic that is not TCP or UDP, such as ICMP or GRE. The value of the others parameter is in seconds, not milliseconds. Therefore, the others 300 parameter means unidentified traffic flows will be dropped in 300 seconds, not milliseconds2. This statement is correct, so option B is a valid answer.

The log parameter enables the SRX Series device to generate a log message for each session that matches the pre-ID default policy. The log parameter can have two values: session-init and session-close. The session-init value logs the session when it is created, and the session-close value logs the session when it is closed. The session-init value is useful for identifying the source and destination of the unidentified traffic, while the session-close value is useful for measuring the duration and volume of the traffic3. The configuration shown in the exhibit has the session-init value, which means every session that enters the SRX Series device will generate an event. This statement is correct, so option C is a valid answer.

The session-class parameter is used to assign a priority to the sessions that match the pre-ID default policy. The session-class parameter can have four values: high, medium-high, medium-low, and low. The session-class parameter is useful for managing the resources allocated to the sessions and for applying quality of service (QoS) policies. The session-class parameter is not only used when troubleshooting, but also when optimizing the performance and security of the SRX Series device4. This statement is incorrect, so option A is not a valid answer.

Replacing the session-init parameter with session-lose will not log unidentified flows, but rather log the sessions that are closed due to session timeout or other reasons. This will not help in identifying the source and destination of the unidentified traffic, but rather provide information about the duration and volume of the traffic. This statement is incorrect, so option D is not a valid answer.

References:

• Pre-ID Default Policy Overview
• Configuring Session Timeout Values for Security Policies
• Configuring Logging for Security Policies
• Configuring Session Class for Security Policies

The count logging parameter displays the number of packets that match the firewall filter term in a tabular format. The count parameter also creates a counter that you can view with the show firewall command. The other logging parameters (permit, session-init, and session-close) do not show tabular data, but rather log the packets that match the term to a system log file or a user-specified file. References:

• Understanding Firewall Filter Counters
• Configuring Firewall Filter Counters
• show firewall

• Referring to the exhibit, we can see that the output of the show chassis cluster status command on both nodes shows that they have the same cluster ID, node ID, priority, and status. The status for both nodes is primary, which means that they are both active and ready to process traffic for all redundancy groups1.
• This situation can occur when the control link between the two nodes is down or not configured properly, and the heartbeat messages cannot be exchanged. Without the heartbeat messages, each node assumes that the other node is down and takes over the primary role for all redundancy groups12.
• This is not a desirable state for the cluster, as it can cause traffic disruption, configuration inconsistency, and split-brain scenarios. To resolve this issue, the control link should be checked and fixed, and the cluster should be synchronized12.

References:

• 1: Troubleshooting an SRX Chassis Cluster with One Node in the Primary State and the Other Node in the Disabled State
• 2: SRX Series Chassis Cluster Configuration Overview

Policy Enforcer is a Junos Space Security Director component that allows updated security policies to be deployed across Juniper SRX Series firewalls, MX Series 5G Universal Routing Platforms, EX Series Ethernet Switches, QFX Series Switches, and third-party network devices1. Policy Enforcer can leverage the DDoS protection feature of Juniper devices to detect and mitigate DDoS attacks on the network. The DDoS protection feature is based on two main components: the classification of host-bound control plane traffic and a hierarchical set of individual- and aggregate-level policers that cap the volume of control plane traffic that each protocol type is able to send to the Routing Engine (RE) for processing2. The DDoS protection feature is supported on MX Series routers and QFX Series switches, among other devices3. Therefore, the correct devices to use for DDoS protection with Policy Enforcer are MX and QFX.

The other options are not correct for the following reasons:

• vQFX is a virtual switch that emulates the QFX Series switches for testing and development purposes. It does not support the DDoS protection feature4.
• vMX is a virtual router that emulates the MX Series routers for testing and development purposes. It does not support the DDoS protection feature.

References: Policy Enforcer DDoS Protection Case Study Protection against distributed denial of service (DDoS) attacks vQFX10000 Overview [vMX Overview]

References: IDP Policy Rules and IDP Rule Bases, rulebase-ips, Exam Name: Security, Specialist (JNCIS-SEC) Version: DEMO - Lead2Pass

A vSRX is a virtualized security platform that runs on various hypervisors and cloud environments. It provides firewall and NAT services, as well as other security features, such as IPS, VPN, UTM, and AppSecure. A single vSRX can fulfill the minimum requirements for providing firewall and NAT services in a private cloud, as it can be deployed as a gateway or an edge device, and can scale up or down as needed. A vSRX can also interoperate with other Juniper and third-party products, such as Contrail Networking, Junos Space Security Director, and Sky ATP. A single vSRX is more cost-effective and simpler to manage than having separate vSRX instances for firewall and NAT services. A cSRX is a containerized version of vSRX that runs on Linux-based platforms. It provides similar security features as vSRX, but with a smaller footprint and faster deployment. However, a cSRX is not yet supported on all cloud environments, and it may have some limitations compared to vSRX, such as lower throughput and fewer interfaces. Therefore, a single cSRX may not be able to fulfill the minimum requirements for providing firewall and NAT services in a private cloud, depending on the specific cloud platform and the performance and scalability needs. A cSRX for firewall services and a separate cSRX for NAT services would also introduce more complexity and overhead than a single vSRX. References: vSRX Overview, cSRX Overview, JNCIP-SEC Certification

Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. Juniper ATP Cloud performs the following tasks:

• It extracts potentially malicious objects and files from the traffic and sends them to the cloud for analysis.
• It uses multiple antivirus software packages to analyze files and identify known malicious files quickly. It also uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify new malware and add it to the known list of malware.
• It correlates between newly identified malware and known command and control (C&C) sites to aid analysis.
• It blocks known malicious file downloads and outbound C&C traffic.
• It provides features such as DNS, Encrypted Traffic Insights (ETI) and IoT security if you have ATP Cloud premium license.

Based on this information, we can infer the following:

• Option B is correct because Juniper ATP Cloud uses multiple antivirus software packages to analyze files, as well as other techniques, to provide robust coverage against sophisticated, evasive threats.
• Option D is correct because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, which are unknown and undetected by traditional antivirus solutions. Instead, it uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify and mitigate zero-day threats.
• Option A is incorrect because Juniper ATP Cloud does not only use one antivirus software package to analyze files, but multiple ones, as well as other techniques.
• Option C is incorrect because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, but other techniques.

References: Juniper Security, Specialist (JNCIS-SEC) Reference Materials and Juniper Security, Professional (JNCIP-SEC) Reference Materials

https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-access-control-capabilities-and-remote-access-vpn

https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-access-control-capabilities-and-remote-access-vpn

A reth LAG is a redundant Ethernet interface that includes one or more physical interfaces from each node of a chassis cluster. A reth LAG provides increased bandwidth and link availability for the cluster. To configure a reth LAG, you need to follow these steps:

• Configure the physical interfaces on each node as aggregated Ethernet interfaces with the same speed and duplex settings. This is required to ensure that the links can form a LAG andpass traffic correctly. You can use different cable types (such as copper or fiber-optic) for the links, but the speed must be the same.
• Configure the reth interface with the redundant-ether-options statement and specify the aggregated Ethernet interfaces as child links. You should have at least two interfaces (one from each node) in the reth LAG, but you can add more for redundancy and load balancing. You can also specify the minimum-links statement to set the minimum number of child links that must be up for the reth interface to be up. The default value is one, but you can change it to a higher value if needed.
• Configure the reth interface with the appropriate IP address, security zone, and other settings as needed. You can also enable LACP on the reth interface to dynamically negotiate the LAG parameters with the peer devices.

References:

• [Aggregated Ethernet Interfaces in a Chassis Cluster] 1
• [Chassis Cluster Redundant Ethernet Interfaces] 2
• [LACP / LAG on Chassis Cluster - Interface Monitoring?] 3
• [URGENT (LAG - RETH Interconnect)] 4

 AppQoE is an AppSecure component that provides application quality of experience by monitoring the network performance and dynamically adjusting the traffic routing based on predefined policies1. AppQoE can detect excessive packet loss on a WAN link and route the traffic to another link that has better performance2. AppQoE can also prioritize the traffic based on the application type and user group3. AppQoE is suitable for accomplishing the task of routing traffic from the degraded link to the working link.

The other options are not correct for the following reasons:

• AppFW is an AppSecure component that provides application firewalling by enforcing granular policies to allow, deny, or limit access to applications based on user roles, locations, and devices4. AppFW does not monitor or adjust the traffic routing based on network performance.
• AppQoS is an AppSecure component that provides application quality of service by allocating bandwidth and shaping traffic based on application priority and user group. AppQoS does not monitor or adjust the traffic routing based on network performance.
• APBR is an AppSecure component that provides application-based routing by selecting the best path for each application based on predefined criteria such as latency, jitter, packet loss, and cost. APBR does not monitor the network performance dynamically or adjust the traffic routing automatically.

References: AppSecure Overview Understanding AppQoE Configuring AppQoE Understanding AppFW [Understanding AppQoS] [Understanding APBR]

 JSA supports high availability (HA) clusters, which are two JSA hosts that act as a single system. The primary host is the active host and the secondary host is the standby host. If the primary host fails, the secondary host takes over and becomes the active host1 To configure an HA cluster, you must ensure that the software versions on both primary and secondary hosts are the same, and that the cluster virtual IP address is an unused IP address on the same subnet as the primary and secondary hosts1 The secondary host does not backup multiple JSA primary hosts, as each HA cluster consists of only one primary and one secondary host1 The primary and secondary hosts do not need to be configured with the same storage devices, as long as they have enough disk space to store the same amount of data2 References:

• 1: HA Clusters | Junos OS | Juniper Networks
• 2: JSA Virtual Appliance | Juniper Networks US

AppQoS is a service that allows you to prioritize and manage the quality of service (QoS) for different types of applications on SRX Series devices. AppQoS uses application signatures to identify and classify the traffic, and then applies QoS policies to assign bandwidth, priority, and scheduling parameters to the traffic. AppQoS can help you optimize the performance of critical applications, such as VoIP, and ensure that they get the required bandwidth and latency in a congested network12. In this scenario, you can use AppQoS to prioritize the VoIP traffic over other traffic and guarantee its QoS on the SRX Series device at the branch office. References:

• Understanding Application Quality of Service
• Configuring Application Quality of Service

= The vSRX is a virtual firewall that offers the same features as the physical SRX Series firewalls, but in a virtualized form factor for delivering security services that scale to match network demand. The vSRX supports Juniper Contrail Networking and third-party software-defined networking (SDN) solutions, which enable dynamic and automated network provisioning and management. The vSRX also integrates with cloud orchestration tools such as OpenStack, which allow for flexible deployment and configuration of virtual machines and networks. The vSRX provides granular security for the workloads that run within the virtual network on the public or private cloud. It supports next-generation firewall capabilities, such as application security, intrusion prevention, user identity, and role-based access control. It also supports advanced threat prevention features, such as malware sandboxing, threat intelligence feeds, and encrypted traffic inspection. The vSRX can protect the network from both internal and external threats, and enforce consistent security policies across the entire network. References:

• vSRX Virtual Firewall | Juniper Networks US
• vSRX Documentation | Juniper Networks
• Understand vSRX Virtual Firewall with Microsoft Azure Cloud

• AppTrack is a logging and reporting tool that provides statistics for analyzing bandwidth usage of your network. It can be enabled on any logical system on an SRX Series device1. AppTrack collects byte, packet, and duration statistics for application flows in the specified zone2. AppTrack sends log messages through syslog providing application activity update messages1.
• AppTrack does not identify or block traffic flows that might be malicious. That is the function of AppSecure, which is a suite of application security tools that includes AppID, AppFW, AppQoS, and AppDoS3. AppTrack is a complementary tool that provides visibility into the types of applications traversing through the SRX Series gateway4.
• AppTrack can be configured in any logical system on an SRX Series device, not just the main one1. This allows for more flexibility and granularity in monitoring application traffic across different logical systems.

References:

• 1: Application Tracking | Junos OS | Juniper Networks
• 2: application-tracking | Junos OS | Juniper Networks
• 3: Juniper Networks AppSecure | NetworkScreen.com
• 4: [SRX] AppTrack log messages continue to get generated even after disabling the feature - Juniper Networks

AppTrack is a logging and reporting tool that provides statistics for analyzing bandwidth usage of your network. When enabled, AppTrack collects byte, packet, and duration statistics for application flows in the specified zone. AppTrack sends log messages through syslog, providing application activity update messages. AppTrack can be used to share information for application visibility with devices such as Security Threat Response Manager (STRM)12 References:

• 1: Application Tracking | Junos OS | Juniper Networks
• 2: application-tracking | Junos OS | Juniper Networks

= SSL proxy server protection is a type of reverse proxy that enables the SRX Series device to act as an intermediary between external clients and internal servers that use SSL encryption. SSL proxy server protection provides benefits such as load balancing, caching, compression, encryption, authentication, and application firewalling. To enable SSL proxy server protection, you do not need to configure the servers to use the SSL proxy function on the SRX Series device. The SRX Series device will terminate the SSL connection from the client and initiate a new SSL connection to the server, without requiring any changes on the server side. However, you must load the server certificates on the SRX Series device, so that the SRX Series device can present the server certificate to the client and establish a secure connection. You must also import the root CA on the servers, so that the servers can trust the SRX Series device as a valid intermediary and accept the connection from the SRX Series device. References: SSL Proxy, Configuring SSL Proxy, JNCIP-SEC Certification