Applications and Application Layer Gateways (ALGs) JN0-232 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An SRX is configured with NAT for internal SIP phones. The SIP ALG is enabled. The administrator notices that calls are failing when the phones are behind the SRX. The administrator suspects the ALG is modifying the SDP payload incorrectly. What is the best way to resolve this issue?

   • AEnable the SIP ALG and configure it to not modify the SDP payload.
   • BUse a different ALG for SIP traffic.
   • CChange the NAT configuration to use static NAT for the SIP phones.
   • DDisable the SIP ALG and configure the security policy to allow the RTP media ports explicitly.
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A company is deploying an SRX to protect its network. The security team wants to understand which ALGs are enabled by default. What is the default state of ALGs on Junos SRX?

   • AAll ALGs are disabled by default.
   • BMost ALGs are enabled by default.
   • CALGs are enabled only when a security policy references them.
   • DOnly the FTP ALG is enabled by default.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An administrator is configuring an SRX to support FTP for external users accessing an internal FTP server. The FTP ALG is enabled. The administrator wants to ensure that only passive FTP is allowed, not active FTP. What is the best way to achieve this?

   • AConfigure the FTP ALG to only support passive FTP.
   • BEnable the FTP ALG and configure the security policy to deny the FTP data port 20.
   • CDisable the FTP ALG and configure the security policy to allow only the FTP data port range used for passive FTP.
   • DUse a custom application object for FTP that only matches passive FTP traffic.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does an ALG interact with security policies in Junos OS?

   • AIt bypasses security policies entirely for all traffic.
   • BIt requires a separate security policy for each ALG.
   • CIt blocks all traffic that does not match the ALG's signature.
   • DIt can dynamically open ports in the security policy to allow application data channels.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of configuring a custom application object in Junos OS?

   • ATo define a new application for use in security policies when the built-in application list is insufficient.
   • BTo replace the need for security policies entirely.
   • CTo automatically block all traffic on the specified port.
   • DTo encrypt traffic for the specified application.
   Reveal Solution Discussion Select an answer first