Security Profiles JN0-637 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A managed security provider operates a Junos device with logical systems for two customers. Customer A requires deep packet inspection for HTTP traffic, while Customer B requires only basic stateful inspection. The provider wants to enforce these different requirements without creating conflicting policy rules. What is the most efficient way to achieve this?

   • AConfigure IDP at the chassis level and disable it per-interface using firewall filters.
   • BCreate a single security profile with IDP enabled and apply it to all policies in both logical systems.
   • CUse separate security policies with different ALGs configured for each customer.
   • DApply a security profile with an IDP policy to Customer A's policies and a default security profile to Customer B's policies.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is configuring a security profile for a tenant that handles both FTP and HTTP traffic. The profile must ensure that FTP sessions are properly inspected and that HTTP traffic is protected against common web attacks. Which components should be included?

   • AConfigure screen options for both FTP and HTTP and enable IDP.
   • BEnable the HTTP ALG and configure screen options for FTP.
   • CEnable the FTP ALG and configure an IDP policy for HTTP attack detection.
   • DEnable both FTP and HTTP ALGs and disable IDP.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Junos device is configured with a tenant system that has a default security profile allowing all traffic. A specific security policy within that tenant has a custom security profile that blocks certain application services. The administrator notices that traffic matching the policy is not being blocked as expected. What is the most likely cause?

   • AThe security profile is applied at the interface level, overriding the policy-level profile.
   • BThe application services in the custom profile are not supported by the tenant system.
   • CThe default security profile is blocking the traffic before the policy is evaluated.
   • DThe custom security profile is not applied to the policy; the default profile is being inherited.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A Junos device has a logical system with a default security profile that blocks FTP. A specific policy in that logical system has a custom security profile that allows FTP. The administrator tests the policy and finds FTP is still blocked. The custom profile is correctly attached to the policy. What is the most likely reason for the block?

   • AThe security policy is not matching the FTP traffic, so the default profile is applied.
   • BThe FTP ALG is disabled in the custom security profile, preventing FTP from being allowed.
   • CThe custom security profile is not inheriting the default profile's settings, causing a conflict.
   • DThe default security profile is applied at the interface level, overriding the policy-level custom profile.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A service provider offers managed security to multiple tenants on a single Junos device. Each tenant has different security requirements, including specific screen options and ALGs. The provider wants to ensure that each tenant's traffic is inspected according to its own profile without affecting others. What is the best approach?

   • AUse a global security profile and override it per-tenant using firewall filters.
   • BConfigure a single security profile with all screen options and ALGs enabled for all tenants.
   • CApply security profiles at the interface level for each tenant's ingress interface.
   • DConfigure a unique security profile for each tenant and apply it to the tenant's policies.
   Reveal Solution Discussion Select an answer first