Client and Server Protection JN0-336 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has SSL proxy enabled in transparent mode for client protection. Users report that some HTTPS sites show certificate errors, but others work. The SRX logs show that the certificate errors occur for sites that use Extended Validation (EV) certificates. What is the most likely cause and solution?

   • AThe SRX's certificate is not trusted by the browser; the solution is to use a public CA-signed certificate on the SRX.
   • BThe SRX is not configured to support EV certificates; enable EV certificate support.
   • CThe EV certificates are pinned by the sites; the solution is to add those sites to the SSL proxy bypass list.
   • DThe SRX's generated certificate does not include the EV indicator, so browsers show a warning; the solution is to install the SRX's CA certificate on clients.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In which deployment mode does the SSL proxy require the client to be explicitly configured to use the proxy?

   • AReverse proxy mode
   • BBypass mode
   • CExplicit mode
   • DTransparent mode
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   After the SSL proxy decrypts the client's request, what does it do before forwarding the traffic to the destination server?

   • AIt immediately re-encrypts the traffic and sends it to the server
   • BIt stores the decrypted content in a cache for future requests
   • CIt inspects the content against security policies and then re-encrypts it for the server
   • DIt sends the decrypted traffic directly to the server without encryption
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a server protection scenario, how does an SSL proxy typically handle the TLS connection from an external client?

   • AIt forwards the encrypted traffic directly to the server without decryption
   • BIt requires the server to send its private key to the proxy for decryption
   • CIt only inspects the TLS handshake and then allows the encrypted session to pass through
   • DIt terminates the client's TLS connection, inspects the plaintext, and then creates a new TLS connection to the server
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How are security policies typically applied to SSL proxy traffic?

   • ABy encrypting the traffic with a different algorithm based on the destination
   • BBy using firewall rules that match on the decrypted traffic's source, destination, and content
   • CBy requiring the client to authenticate with a username and password
   • DBy configuring the client's browser to block specific websites
   Reveal Solution Discussion Select an answer first