JN0-333 試験問題を無料オンラインアクセス

You want to implement IPsec on your SRX Series devices, but you do not want to use a preshared key.
Which IPsec implementation should you use?

• A.tunnel mode
• B.aggressive mode
• C.next-hop tunnel binding
• D.public key infrastructure

Which SRX5400 component is responsible for performing first pass security policy inspection?

• A.Routing Engine
• B.Modular Port Concentrator
• C.Switch Control Board
• D.Services Processing Unit

You recently configured an IPsec VPN between two SRX Series devices. You notice that the Phase1 negotiation succeeds and the Phase 2 negotiation fails.
Which two configuration parameters should you verify are correct? (Choose two.)

• A.Verify that the VPN tunnel configuration references the correct IKE gateway.
• B.Verify that the IKE gateway proposals on the initiator and responder are the same.
• C.Verify that the IPsec policy references the correct IKE proposals.
• D.Verify that the IKE initiator is configured for main mode.

Which statement is true about Perfect Forward Secrecy (PFS)?

• A.PFS increases security by forcing the peers to perform a second DH exchange during Phase 2.
• B.PFS is used to resolve compatibility issues with third-party IPsec peers.
• C.PFS increases the IPsec VPN encryption key length and uses RSA or DSA certificates.
• D.PFS is implemented during Phase 1 of IKE negotiations and decreases the amount of time required for IKE negotiations to complete.

Which feature is used when you want to permit traffic on an SRX Series device only at specific times?

• A.counters
• B.scheduler
• C.pass-through authentication
• D.ALGs