In which scenario is DNS doctoring most commonly needed on a Junos device?

When an internal client resolves an internal server's public DNS name and the server is also behind the same NAT device

When a DNS server is located on a different continent than the clients

When the DNS server itself is behind a destination NAT rule

When an external client resolves a public DNS name for a server that is hosted on the internal network

A company has a web server at 10.0.0.10 and a mail server at 10.0.0.20. Both are reachable from the internet via destination NAT. The administrator wants internal users to access both servers using their public hostnames. What is the most efficient way to achieve this with DNS doctoring?

Use source NAT instead of destination NAT for both servers.

Create a single destination NAT rule that covers both servers.

Configure DNS doctoring globally on the SRX device.

Enable DNS doctoring on each destination NAT rule for the web and mail servers.

Which Junos command can be used to verify that DNS doctoring is enabled on a destination NAT rule?

show configuration security nat destination

show security dns-doctoring status

show security nat destination rule all

When troubleshooting DNS doctoring, which aspect of the DNS packet should you examine to confirm that the response was rewritten?

The TTL value in the DNS response

The destination IP address in the DNS response

The IP address in the answer section of the DNS response

The source IP address in the DNS response

A company has a destination NAT rule that maps 203.0.113.50 to 10.1.1.50. DNS doctoring is enabled. An internal client queries the DNS server and receives 10.1.1.50. The client then initiates a connection to 10.1.1.50. What will happen to the connection?

The connection will be source NATed to the public IP.

The connection will be translated by the destination NAT rule.

The connection will go directly to the server without NAT.

The connection will fail because the private IP is not routable.

Juniper NetworksCertified Professional, Security (JNCIP-SEC)

Domain 4Objective 2

Domain Name System (DNS) Doctoring JN0-637 Practice Questions (Page 1)

Part of the Advanced Network Address Translation (NAT) domain, which makes up ~6% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

Questions 1–5

1foundation · easy
In which scenario is DNS doctoring most commonly needed on a Junos device?
Select an answer first
2application · medium
A company has a web server at 10.0.0.10 and a mail server at 10.0.0.20. Both are reachable from the internet via destination NAT. The administrator wants internal users to access both servers using their public hostnames. What is the most efficient way to achieve this with DNS doctoring?
Select an answer first
3foundation · easy
Which Junos command can be used to verify that DNS doctoring is enabled on a destination NAT rule?
Select an answer first
4foundation · easy
When troubleshooting DNS doctoring, which aspect of the DNS packet should you examine to confirm that the response was rewritten?
Select an answer first
5application · medium
A company has a destination NAT rule that maps 203.0.113.50 to 10.1.1.50. DNS doctoring is enabled. An internal client queries the DNS server and receives 10.1.1.50. The client then initiates a connection to 10.1.1.50. What will happen to the connection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-637

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-637” is a trademark of its owner, used for identification only.