An administrator needs to replace an expiring CA certificate used by SSL proxy. What is the correct procedure to avoid service disruption?

Renew the existing CA certificate in place without changing the profile.

Generate a new CA certificate, update the SSL proxy profile, and distribute the new CA to clients.

Delete the old CA certificate and create a new one, but do not update the profile.

Use the same CA certificate but change the private key.

A company wants to inspect HTTPS traffic from internal users to external websites. They have a Juniper SRX with SSL proxy configured. They want to decrypt and inspect traffic to specific high-risk categories (e.g., malware, phishing) but not decrypt traffic to banking sites due to compliance. Which configuration step is essential to achieve this selective decryption?

Create an SSL proxy profile with a custom rule to exclude banking sites, and apply it to the security policy.

Configure a global SSL proxy that decrypts all traffic, then rely on the security policy to block banking sites.

Use a custom security policy to deny banking sites, and enable SSL proxy globally.

Apply SSL proxy to the interface, and use a firewall filter to skip decryption for banking sites.

A company has SSL proxy enabled and wants to ensure that decrypted traffic is inspected by IDP. What must be configured to allow IDP to see the decrypted traffic?

Enable IDP in the SSL proxy profile.

Use a custom application signature to trigger IDP.

Configure a separate security policy for IDP inspection.

Apply an IDP policy to the security policy that also has SSL proxy enabled.

How does a security policy enforce an action on decrypted traffic?

By blocking all encrypted traffic

By modifying the SSL certificate

By encrypting the traffic again with a different key

By matching the decrypted content against policy rules

What is the purpose of the certificate used by SSL proxy when re-encrypting traffic to the client?

To verify the server's identity

To encrypt the server's private key

To authenticate the client to the server

To establish a new SSL session with the client

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 6Objective 3

Configure, Monitor, or Troubleshoot SSL Proxy JN0-336 Practice Questions (Page 2)

Part of the SSL Proxy domain, which makes up ~9% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

Questions 6–10

6application · medium
An administrator needs to replace an expiring CA certificate used by SSL proxy. What is the correct procedure to avoid service disruption?
Select an answer first
7application · medium
A company wants to inspect HTTPS traffic from internal users to external websites. They have a Juniper SRX with SSL proxy configured. They want to decrypt and inspect traffic to specific high-risk categories (e.g., malware, phishing) but not decrypt traffic to banking sites due to compliance. Which configuration step is essential to achieve this selective decryption?
Select an answer first
8application · medium
A company has SSL proxy enabled and wants to ensure that decrypted traffic is inspected by IDP. What must be configured to allow IDP to see the decrypted traffic?
Select an answer first
9foundation · easy
How does a security policy enforce an action on decrypted traffic?
Select an answer first
10foundation · easy
What is the purpose of the certificate used by SSL proxy when re-encrypting traffic to the client?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.