Workflow JN0-336 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After a security incident, an administrator wants to identify all files that were blocked by ATP Cloud in the last 24 hours. Which report or feature should be used?

   • AThe Traffic Report, filtered by destination IP.
   • BThe Configuration Report, filtered by policy name.
   • CThe System Log, filtered by severity.
   • DThe Threat Report, filtered by 'blocked' action and the last 24 hours.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Where can an administrator view detailed reports about threats detected by ATP Cloud?

   • AIn the Juniper Support portal
   • BIn the SRX CLI
   • CIn the ATP Cloud portal
   • DIn the syslog server
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a security incident, an analyst notices that ATP Cloud flagged a file as malicious, but the file was not blocked because the policy action was set to 'permit'. The analyst wants to ensure that this specific file is blocked in the future. What is the most effective action?

   • AAdd the file's hash to the ATP Cloud block list.
   • BConfigure the SRX to drop all traffic from the source IP that downloaded the file.
   • CChange the ATP Cloud policy action to 'block' for all traffic.
   • DDisable the ATP Cloud policy for that file type.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the overall Juniper ATP Cloud workflow, what is the sequence of events after traffic is redirected to the cloud for inspection?

   • AThreat detection, then reporting, then policy enforcement
   • BReporting, then threat detection, then policy enforcement
   • CPolicy enforcement, then threat detection, then reporting
   • DThreat detection, then policy enforcement, then reporting
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise is deploying ATP Cloud across multiple SRX devices. The security team wants to ensure that if one SRX is down, traffic is still inspected by ATP Cloud. They also want to minimize the risk of false positives blocking legitimate traffic. Which approach best meets these requirements?

   • AUse a load balancer to distribute traffic across multiple SRX devices, each with ATP Cloud enabled.
   • BSet the ATP Cloud policy action to 'permit' on all SRX devices.
   • CConfigure each SRX with a redirect profile and set the fallback action to 'block'.
   • DConfigure the SRX to send all traffic to a secondary ATP Cloud tenant.
   Reveal Solution Discussion Select an answer first