A security team needs to detect a proprietary protocol that is not covered by predefined attack objects. They want to create a custom attack object that matches a specific byte pattern in the payload. Which type of attack object should they create?

Signature-based attack object with a custom pattern.

Anomaly-based attack object with a custom threshold.

Compound attack object with multiple signatures.

Stateful signature attack object with a custom protocol.

An IDP policy has two rules: Rule 1 matches 'HTTP:INVALID-REQUEST' with action 'ignore', and Rule 2 matches 'HTTP:INVALID-REQUEST' with action 'drop'. The rules are in order: Rule 1 then Rule 2. What happens to a packet that matches both rules?

The packet is ignored because Rule 1 matches first and the action 'ignore' terminates the rule evaluation.

The packet is dropped because Rule 2's action is more severe.

The packet is passed to the next rule because 'ignore' is not a terminating action.

The packet is both ignored and dropped, resulting in a drop.

A security analyst is tuning an IDP policy to reduce false positives. The policy uses a custom attack object that triggers on a specific pattern. The analyst wants to ensure that the attack object only triggers when the pattern appears in a specific application context, not in any traffic. What is the most effective way to achieve this?

Change the rule action to 'ignore' to stop false positives.

Increase the threshold of the attack object to require more occurrences.

Modify the attack object to include a protocol binding to the specific application.

Move the rule to the bottom of the rulebase to reduce its priority.

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 1Objective 2

IDP Policy JN0-336 Practice Questions (Page 1)

Part of the Intrusion Detection and Prevention (IDP) domain, which makes up ~10% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

Questions 1–5

1application · medium
A security team needs to detect a proprietary protocol that is not covered by predefined attack objects. They want to create a custom attack object that matches a specific byte pattern in the payload. Which type of attack object should they create?
Select an answer first
2expert · medium
An IDP policy has two rules: Rule 1 matches 'HTTP:INVALID-REQUEST' with action 'ignore', and Rule 2 matches 'HTTP:INVALID-REQUEST' with action 'drop'. The rules are in order: Rule 1 then Rule 2. What happens to a packet that matches both rules?
Select an answer first
3expert · medium
A security analyst is tuning an IDP policy to reduce false positives. The policy uses a custom attack object that triggers on a specific pattern. The analyst wants to ensure that the attack object only triggers when the pattern appears in a specific application context, not in any traffic. What is the most effective way to achieve this?
Select an answer first
4foundation · easy
Which component of an IDP policy contains a set of match conditions and associated actions that are evaluated against traffic?
Select an answer first
5application · easy
A company wants to detect and log all attempts to exploit a known vulnerability in their web application. The IDP policy should not block the traffic, but should generate an alert for each attempt. Which action should be configured on the IDP rule?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.

IDP Policy JN0-336 Practice Questions (Page 1)

Questions 1–5

A security team needs to detect a proprietary protocol that is not covered by predefined attack objects. They want to create a custom attack object that matches a specific byte pattern in the payload. Which type of attack object should they create?

An IDP policy has two rules: Rule 1 matches 'HTTP:INVALID-REQUEST' with action 'ignore', and Rule 2 matches 'HTTP:INVALID-REQUEST' with action 'drop'. The rules are in order: Rule 1 then Rule 2. What happens to a packet that matches both rules?

Which component of an IDP policy contains a set of match conditions and associated actions that are evaluated against traffic?

A company wants to detect and log all attempts to exploit a known vulnerability in their web application. The IDP policy should not block the traffic, but should generate an alert for each attempt. Which action should be configured on the IDP rule?

Keep studying — Intrusion Detection and Prevention (IDP)