A network administrator is troubleshooting why certain IDP events are not appearing in the logs on their SRX device. They have verified that the IDP policy is correctly applied and that the traffic is matching the rule. What should they check next to ensure the events are being logged?

Verify that the 'log' action is enabled in the IDP rule.

Confirm that the attack group is set to 'recommend' action.

Check if the SRX is in transparent mode; logging is not supported in this mode.

Ensure that the IDP sensor is configured on a separate management interface.

A security analyst notices that the IDP on their SRX is not detecting a known exploit that was recently published. The IDP signature database is up to date, and the traffic is being inspected. What is the most likely reason for the missed detection?

The attack group is disabled in the IDP policy.

The IDP policy is set to 'recommend' action, which does not detect attacks.

The SRX is in flow mode, which does not support IDP.

The attack is using an evasion technique that the current signature set does not cover.

A service provider has been using a custom IDP policy on their SRX devices to protect customer networks. Recently, they have observed an increase in false positives where legitimate encrypted traffic (TLS) is being flagged as malicious. The IDP policy uses the 'recommend' action for the 'SSL' attack group. The security team wants to reduce false positives while maintaining detection of actual SSL-based attacks. Which configuration change should they make?

Disable the SSL attack group entirely in the IDP policy.

Enable SSL inspection and configure the IDP policy to ignore sessions with self-signed certificates.

Create a custom attack group that excludes specific signatures known to cause false positives and apply it to the SSL rule.

Change the action from 'recommend' to 'no-action' for the SSL attack group.

A security analyst is investigating a security incident and needs to see the IDP logs for a specific time period. They want to filter the logs to show only events from the last hour. Which command should they use?

show log idp | except "2023-10-01 10:00:00"

show log idp since "2023-10-01 10:00:00"

show log idp | match "2023-10-01 10:00:00"

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 1Objective 3

Configure, Monitor, or Troubleshoot IDP JN0-336 Practice Questions (Page 1)

Part of the Intrusion Detection and Prevention (IDP) domain, which makes up ~10% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

Questions 1–5

1application · medium
A network administrator is troubleshooting why certain IDP events are not appearing in the logs on their SRX device. They have verified that the IDP policy is correctly applied and that the traffic is matching the rule. What should they check next to ensure the events are being logged?
Select an answer first
2expert · hard
A security analyst notices that the IDP on their SRX is not detecting a known exploit that was recently published. The IDP signature database is up to date, and the traffic is being inspected. What is the most likely reason for the missed detection?
Select an answer first
3foundation · easy
When an IDP rule triggers on normal user traffic that is not malicious, what is this situation called?
Select an answer first
4expert · hard
A service provider has been using a custom IDP policy on their SRX devices to protect customer networks. Recently, they have observed an increase in false positives where legitimate encrypted traffic (TLS) is being flagged as malicious. The IDP policy uses the 'recommend' action for the 'SSL' attack group. The security team wants to reduce false positives while maintaining detection of actual SSL-based attacks. Which configuration change should they make?
Select an answer first
5application · medium
A security analyst is investigating a security incident and needs to see the IDP logs for a specific time period. They want to filter the logs to show only events from the last hour. Which command should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.

Configure, Monitor, or Troubleshoot IDP JN0-336 Practice Questions (Page 1)

Questions 1–5

A network administrator is troubleshooting why certain IDP events are not appearing in the logs on their SRX device. They have verified that the IDP policy is correctly applied and that the traffic is matching the rule. What should they check next to ensure the events are being logged?

A security analyst notices that the IDP on their SRX is not detecting a known exploit that was recently published. The IDP signature database is up to date, and the traffic is being inspected. What is the most likely reason for the missed detection?

When an IDP rule triggers on normal user traffic that is not malicious, what is this situation called?

A security analyst is investigating a security incident and needs to see the IDP logs for a specific time period. They want to filter the logs to show only events from the last hour. Which command should they use?

Keep studying — Intrusion Detection and Prevention (IDP)