JN0-335 Exam Dumps - Juniper JNCIS-SEC Questions and Answers

Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. It assigns a threat level to each attacker IP address from 1 to 10, with 10 being the highest severity. Once the target threshold ismet, Juniper ATP Cloud continues looking for threats for a configurable duration from 0 to 10 minutes. This allows Juniper ATP Cloud to collect more information about the attacker and the attack vector, and to update the threat intelligence accordingly. The other options are incorrect. Option A is not configurable, and option D is not consistent with the documentation. References:

• Juniper Advanced Threat Prevention Cloud | Juniper Networks
• Juniper’s Attacker IP feed bolsters threat protection with SecIntel

 To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a set of rules that defines the actions to be taken for traffic thatmatches a specific category of threat feeds, such as infected hosts, command and control servers, or botnets. By adding a security intelligence policy to the permit portion of the security policy, you can enable the SRX Series device to dynamically update the infected hosts feed based on the advanced anti-malware policy results, and block the traffic from or to the infected hosts. Options B, C, and D are not correct because they do not enable the automatic addition of infected hosts to the feed or the blocking of their communication. References: The answer can be verified from Juniper’s official documentation on security intelligence and advanced anti-malware available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• Advanced Anti-Malware Feature Guide for Security Devices
• Configuring Security Intelligence Policy on the SRX Series Device
• [Configuring Advanced Anti-Malware Policy on the SRX Series Device]

https://www.juniper.net/documentation/us/en/software/junos/security-iot/topics/topic-map/security-iot-overview.html SRX does not identify the iot device. It streams the metadata to Juniper ATP cloud and Junipe ATP cloud identifies the device.

Encrypted Traffic Insights is a feature of Juniper ATP Cloud and SRX Series firewalls that can detect malicious threats that are hidden in encrypted traffic without intercepting and decrypting the traffic. It permits organizations greater visibility and policy control over encrypted traffic, without requiring resource-intensive SSL Decryption1.

Encrypted Traffic Insights assesses the threat of the traffic by using two methods:

• It validates the certificates used by the external servers that the internal hosts are trying to connect to. It compares the certificate signatures with a blocklist of known malicious certificates and also checks the certificate validity, issuer, and subject. If the certificate is invalid or matches a malicious signature, the connection is blocked or alerted2.
• It reviews the timing and frequency of the connections to the external servers. It uses behavior analysis and machine learning to identify patterns and anomalies that indicate malicious activity, such as command and control (C&C) communications, botnet traffic, or data exfiltration. It also uses threat intelligence feeds to enrich the analysis and provide additional context2.

Encrypted Traffic Insights does not decrypt the file or the data in a sandbox or to validate the hash, as these methods would require breaking the encryption of the traffic, which would violate data privacy laws and introduce latency and performance issues21. References:

• 3: SRX5400, SRX5600, SRX5800 Firewalls Datasheet - Juniper Networks
• 2: Encrypted Traffic Insights Overview and Benefits | ATP Cloud | Juniper …
• 1: Juniper Networks Expands Connected Security Portfolio with Encrypted …

To manually failover the primary Routing Engine in an SRX Series high availability cluster pair, you need to issue the request chassis cluster failover redundancy-group group-id node node-id command on the primary node, where group-id is the redundancy group number and node-id is the node number of the secondary node. This command initiates a graceful failover of the specified redundancy group to the secondary node, making it the new primary node. The other options are not necessary or correct for this task. Option A would disable the chassis cluster and reboot the primary node, which is not a graceful failover. Option B is not relevant, as the control link recovery solution is used to restore the control link connectivity between the nodes, not to initiate a failover. Option D would not trigger a failover, as the priority of the secondary node would only take effect after a reboot or a control link failure. References:

• Chassis Cluster Redundancy Group Manual Failover
• Initiating a Chassis Cluster Manual Redundancy Group Failover
• SRX Getting Started - Troubleshoot High Availability (HA)

SSL proxy uses application identification services to dynamically detect if a particular session is SSL encrypted.https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/security-ssl-proxy-unified-policies.html

The Juniper Networks solution that will accomplish the task of alerting if the wrong password is used more than three times on a single device within five minutes is Juniper Secure Analytics (JSA). JSA is a security intelligence platform that collects, analyzes, and correlates network data from various sources, such as firewalls, routers, switches, servers, and applications. JSA can detect and respond to threats, anomalies, and vulnerabilities in real time using rules, offenses, reports, and dashboards. JSA can also integrate with JIMS (Juniper Identity Management Service) to obtain user identity information from Active Directory domains or syslog sources. JSA can use this information to create custom rules that trigger offenses or alerts based on user behavior or activity, such as failed login attempts or password changes.

References := Juniper Secure Analytics Troubleshooting Guide, Juniper Identity Management Service User Guide

Adaptive Threat Profiling is a feature that allows SRX Series Firewalls to generate, propagate, and consume threat feeds based on their own advanced detection and policy-match events. This feature enables you to configure security or IDP policies that, when matched, inject the source IP address, destination IP address, source identity, or destination identity into a threat feed, which can be leveraged by other devices as a dynamic-address-group (DAG). With adaptive threat profiling, the Juniper ATP Cloud service acts as a feed-aggregator and consolidates feeds from SRX across your enterprise and shares the deduplicated results back to all SRX Series Firewalls in the realm at regular intervals. SRX Series Firewalls can then use these feeds to perform further actions against the traffic. This feature allows you to find systems running applications that increase the risks on your network and ensure these systems are processed through IPS and Juniper ATP Cloud for malware and virus protection1. References:

• Adaptive Threat Profiling Overview and Configuration
• Adaptive Threat Profiling Overview
• Juniper Launches Adaptive Threat Profiling, New VPN Features
• Juniper Networks Answers Who and What is On the Network with Risk-Based Access Control Capabilities and New VPN Application
• Adaptive Threat Profiling Overview | SD Cloud

 vSRX is a virtual firewall that runs on various cloud platforms, including AWS and OpenStack. AWS is a cloud service provider that offers infrastructure as a service (IaaS) solutions, such as compute, storage, and networking resources. OpenStack is an open source software platform that enables cloud orchestration, which is the automated management of cloud resources and services. vSRX supports both AWS and OpenStack as deployment options, and integrates with their features and tools. For example, vSRX can use cloud-init to automate the initialization of vSRX instances in AWS and OpenStack environments. vSRX can also leverage the security groups and elastic IP addresses of AWS, and the network and security services of OpenStack. References:

• vSRX Deployment Guide for AWS
• vSRX Virtual Firewall
• Use Cloud-Init in an OpenStack Environment to Automate the Initialization of vSRX Instances