A security team needs to detect a new malware that uses a specific sequence of packets. The malware is not detected by any predefined attack objects. Which approach should they take to create a custom detection?

Use a compound attack object that combines multiple signatures.

Create a custom signature-based attack object that matches the packet sequence.

Create a custom anomaly-based attack object that detects unusual traffic patterns.

Use a predefined attack object and modify its threshold.

What is the primary purpose of a custom attack object in an IDP policy?

To override the default action for all predefined attacks

To change the order of rule evaluation

To disable predefined attack objects

To define a new signature or anomaly pattern not covered by predefined objects

An IDP policy has a rulebase with multiple rules. The administrator wants to ensure that a specific rule is always evaluated before others, regardless of the order in which they are added. What is the best practice to achieve this?

Use a rulebase with a 'first-match' policy.

Place the rule at the top of the rulebase manually.

Create a separate rulebase for that rule.

Assign a higher priority value to the rule.

Which step is required after editing an IDP policy for the changes to take effect?

Reinstall the IDP signature package

Juniper NetworksCertified Specialist, Security (JNCIS-SEC)

Domain 1Objective 2

IDP Policy JN0-336 Practice Questions (Page 3)

Part of the Intrusion Detection and Prevention (IDP) domain, which makes up ~10% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

Questions 11–15

11application · medium
A security team needs to detect a new malware that uses a specific sequence of packets. The malware is not detected by any predefined attack objects. Which approach should they take to create a custom detection?
Select an answer first
12foundation · easy
What is the primary purpose of a custom attack object in an IDP policy?
Select an answer first
13expert · medium
An IDP policy has a rulebase with multiple rules. The administrator wants to ensure that a specific rule is always evaluated before others, regardless of the order in which they are added. What is the best practice to achieve this?
Select an answer first
14foundation · easy
Which type of attack object relies on detecting deviations from normal traffic patterns rather than matching a specific byte sequence?
Select an answer first
15foundation · easy
Which step is required after editing an IDP policy for the changes to take effect?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-336

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-336” is a trademark of its owner, used for identification only.