Juniper JN0-696 Actual PDF : Security Support, Professional (JNCSP-SEC)

Why wait to start? ActualPDF emails the complete Juniper Security Support, Professional (JNCSP-SEC) package, 36 JN0-696 practice questions included, about a minute after payment, with customer service answering around the clock if anything goes wrong.

Juniper JN0-696 Exam Overview:

Certification Vendor:	Juniper Networks
Exam Name:	Juniper Security Support, Professional (JNCSP-SEC)
Exam Number:	JN0-696
Certificate Validity Period:	3 years
Available Languages:	English
Exam Format:	Scenario-based questions, Multiple choice
Related Certifications:	JNCIS-SEC JNCIP-SEC
Exam Duration:	90 minutes
Exam Price:	USD 400
Real Exam Qty:	65-75
Recommended Training:	Juniper Networks Training Courses Security (JNCIS-SEC) Training Path
Exam Registration:	Pearson VUE Juniper Exams Juniper Certification Portal
Sample Questions:
Exam Way:	Online proctored or Pearson VUE test center
Pre Condition:	Recommended to hold JNCIS-SEC certification or equivalent networking and security experience.
Official Syllabus URL:	https://www.juniper.net/us/en/training/certification.html

Juniper JN0-696 Exam Syllabus Topics:

JN0-696 Exam FAQ: Before You Book Your Seat

Juniper Security Support, Professional (JNCSP-SEC) Sample Questions:

Question 1

-- Exhibit -
user@host> show security flow session
...
Session ID. 41, Policy name: allow/5, Timeout: 20, Valid In: 172.168.66.143/43886 --> 192.168.100.1/5000;tcp, If: ge-0/0/1.0, Pkts: 1, Bytes: 60 Out: 10.100.1.100/5555 --> 172.168.66.143/43886;tcp, If: ge-0/0/2.0, Pkts: 0, Bytes: 0
user@host> show configuration
...
security { nat { destination { pool server { address 10.100.1.100/32 port 5555; } rule-set rule1 { from zone UNTRUST; rule 1 { match { destination-address 192.168.100.1/32; destination-port 5000; } then { destination-nat pool server; } } } } proxy-arp {
interface ge-0/0/1.0 {
address {
192.168.100.1/32;
}
}
}
}
policies {
from-zone UNTRUST to-zone TRUST {
policy allow {
match {
source-address any;
destination-address any;
application [ junos-ping tcp-5000 ];
}
then {
permit;
}
}
}
}
zones {
security-zone TRUST {
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
protocols {
all; } } } } } security-zone UNTRUST { interfaces { ge-0/0/1.0 { host-inbound-traffic { system-services { ping; } } } } } }
}
applications { application tcp-5000 { protocol tcp; destination-port 5000; }
}
-- Exhibit -Click the Exhibit button.
Your customer is attempting to reach your new server that should be accessible publicly using
192.168.100.100 on TCP port 5000, and internally using 10.100.100.1 on TCP port 5555. You notice a session forms when they attempt to access the server, but they are unable to reach the server.
Referring to the exhibit, what will resolve this problem?

A. The NAT pool server address must be changed to 10.100.100.1/32.
B. The NAT rule set rule1 must match on address 172.168.66.143.
C. There must be a TRUST-to-UNTRUST security policy to allow return traffic.
D. The NAT pool server port must be changed to 5000.

Question 2

-- Exhibit - -- Exhibit -

Click the Exhibit button.
Your company has a Web server in the trust zone. You configure a NAT rule to allow Internet users from the untrust zone to access this Web server. Internet users use the public IP address
70.1.1.1 to access this Web server, but they report that the server is not accessible.
Referring to the exhibit, which configuration change would resolve this problem?

A. set security zones security-zone untrust host-inbound-traffic system-services http
B. set security nat proxy-arp interface fe-0/0/2 address 70.1.1.0/24
C. set security nat destination rule-set http rule 1 match source-address 0.0.0.0/0
D. set security address-book global address web-server 192.168.1.11/32

Question 3

-- Exhibit -user@R1> show log ike-trace Jun 13 07:45:10 ikev2_packet_v1_start: Passing IKE v1.0 packet to IKEv1 library Jun 13 07:45:10 ike_get_sA. Start, SA = { 7fd86fbe 8a99c1f6 - 00000000 00000000 } / 00000000,
remote = 184.0.15.2:500 Jun 13 07:45:10 ike_sa_allocate: Start, SA = { 7fd86fbe 8a99c1f6 - a1bc3f1d e2a45308 } Jun 13 07:45:10 ike_init_isakmp_sA. Start, remote = 184.0.15.2:500, initiator = 0 Jun 13 07:45:10 ike_decode_packet: Start Jun 13 07:45:10 ike_decode_packet: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733} /
00000000, nego = -1
Jun 13 07:45:10 ike_decode_payload_sA. Start
Jun 13 07:45:10 ike_decode_payload_t: Start, # trans = 1
Jun 13 07:45:10 ike_decode_payload_t: Start, # trans = 1
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = afcad713 68a1f1c9 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 27bab5dc 01ea0760 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 6105c422 e76847e4 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 4485152d 18b6bbcd ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = cd604643 35df21f8 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 90cb8091 3ebb696e ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 7d9419a6 5310ca6f ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 4a131c81 07035845 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..28] = 69936922 8741c6d4 ...
Jun 13 07:45:10 ike_st_i_sa_proposal: Start
Jun 13 07:45:10 P1 SA payload match failed for sa-cfg to-R2. Abortingnegotiation for tunnel type 2
local:184.0.15.1 remote:184.0.15.2 IKEv1.
Jun 13 07:45:10 iked_pm_ike_spd_select_ike_sa failed. rc 1, error_code: No proposal chosen
Jun 13 07:45:10 ikev2_fb_spd_select_sa_cB. IKEv2 SA select failed with error No proposal
chosen (neg a7e800)
Jun 13 07:45:10 ike_isakmp_sa_reply: Start
Jun 13 07:45:10 ike_state_restart_packet: Start, restart packet SA = { 7fd86fbe 8a99c1f6 -
b8f95b2e f92ca733}, nego = -1
Jun 13 07:45:10 ike_st_i_sa_proposal: Start
Jun 13 07:45:10 ike_st_i_cr: Start
Jun 13 07:45:10 ike_st_i_cert: Start
Jun 13 07:45:10 ike_st_i_private: Start
Jun 13 07:45:10 ike_st_o_sa_values: Start
Jun 13 07:45:10 184.0.15.1:500 (Responder) -> 184.0.15.2:500 { 7fd86fbe 8a99c1f6 - b8f95b2e
f92ca733 [-1] / 0x00000000 } IP; Error = No proposal chosen (14)
Jun 13 07:45:10 ike_alloc_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733}
Jun 13 07:45:10 ike_encode_packet: Start, SA = { 0x7fd86fbe 8a99c1f6 - b8f95b2e f92ca733 } /
b20d590c, nego = 0
Jun 13 07:45:10 ike_send_packet: Start, send SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733},
nego = 0, dst = 184.0.15.2:500, routing table id = 0
Jun 13 07:45:10 ike_delete_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733},
nego = 0
Jun 13 07:45:10 ike_free_negotiation_info: Start, nego = 0
Jun 13 07:45:10 ike_free_negotiation: Start, nego = 0
Jun 13 07:45:10 IKE negotiation fail for local:184.0.15.1, remote:184.0.15.2 IKEv1 with status: No
proposal chosen Jun 13 07:45:10 IKEv1 Error : No proposal chosen Jun 13 07:45:40 P1 SA 3770105 timer expiry. ref cnt 1, timer reason Force delete timer expired
(1), flags 0x330.
Jun 13 07:45:40 iked_pm_ike_sa_delete_done_cB. For p1 sa index 3770105, ref cnt 1, status: Error ok Jun 13 07:45:40 ike_remove_callback: Start, delete SA = { 7fd86fbe 8a99c1f6 - b8f95b2e
f92ca733}, nego = -1
Jun 13 07:45:40 ike_delete_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733}, nego = -1 Jun 13 07:45:40 ssh_ike_tunnel_table_entry_delete: Deleting tunnel_iD. 0 from IKE tunnel table Jun 13 07:45:40 ssh_ike_tunnel_table_entry_delete: The tunnel iD. 0 doesn't exist in IKE tunnel
table Jun 13 07:45:40 ike_sa_delete: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733 } Jun 13 07:45:40 ike_free_negotiation_isakmp: Start, nego = -1 Jun 13 07:45:40 ike_free_negotiation: Start, nego = -1 Jun 13 07:45:40 IKE SA delete called for p1 sa 3770105 (ref cnt 1) local:184.0.15.1,
remote:184.0.15.2, IKEv1 Jun 13 07:45:40 iked_pm_p1_sa_destroy: p1 sa 3770105 (ref cnt 0), waiting_for_del 0x0 Jun 13 07:45:40 ike_free_sA. Start
-- Exhibit -Click the Exhibit button.
You are asked to troubleshoot a new IPsec VPN between R1 and R2 that is not coming up. You have captured the traceoptions output shown in the exhibit.
What is the reason for the problem?

A. IKE Phase 2 proposal mismatch
B. IKE preshared key mismatch
C. IKE Phase 1 proposal mismatch
D. IKE Phase 1 mode mismatch

Question 4

You recently configured the antivirus feature profile on your Junos device. The security policy is sending traffic for antivirus scanning. However, the traffic is being blocked and you repeatedly receive the system log message that the scan engine is not ready. You must not allow the traffic to be dropped when the scan engine is not ready.
Which action will resolve this problem?

A. Configure an antivirus content size limit to minimize the scanning of large files.
B. Configure an antivirus fallback option to permit the traffic when the scan engine is not ready.
C. Configure antivirus trickling to prevent the scan engine from timing out.
D. Configure an antivirus file scanning extension list to reduce the number of files for scanning.

Solutions: