Juniper JN0-335 Security, Specialist (JNCIS-SEC) Exam Practice Test

Encrypted Traffic Insights is a feature of Juniper ATP Cloud and SRX Series firewalls that can detect malicious threats that are hidden in encrypted traffic without intercepting and decrypting the traffic. It permits organizations greater visibility and policy control over encrypted traffic, without requiring resource-intensive SSL Decryption1.

Encrypted Traffic Insights assesses the threat of the traffic by using two methods:

• It validates the certificates used by the external servers that the internal hosts are trying to connect to. It compares the certificate signatures with a blocklist of known malicious certificates and also checks the certificate validity, issuer, and subject. If the certificate is invalid or matches a malicious signature, the connection is blocked or alerted2.
• It reviews the timing and frequency of the connections to the external servers. It uses behavior analysis and machine learning to identify patterns and anomalies that indicate malicious activity, such as command and control (C&C) communications, botnet traffic, or data exfiltration. It also uses threat intelligence feeds to enrich the analysis and provide additional context2.

Encrypted Traffic Insights does not decrypt the file or the data in a sandbox or to validate the hash, as these methods would require breaking the encryption of the traffic, which would violate data privacy laws and introduce latency and performance issues21. References:

• 3: SRX5400, SRX5600, SRX5800 Firewalls Datasheet - Juniper Networks
• 2: Encrypted Traffic Insights Overview and Benefits | ATP Cloud | Juniper …
• 1: Juniper Networks Expands Connected Security Portfolio with Encrypted …

 To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a set of rules that defines the actions to be taken for traffic thatmatches a specific category of threat feeds, such as infected hosts, command and control servers, or botnets. By adding a security intelligence policy to the permit portion of the security policy, you can enable the SRX Series device to dynamically update the infected hosts feed based on the advanced anti-malware policy results, and block the traffic from or to the infected hosts. Options B, C, and D are not correct because they do not enable the automatic addition of infected hosts to the feed or the blocking of their communication. References: The answer can be verified from Juniper’s official documentation on security intelligence and advanced anti-malware available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• Advanced Anti-Malware Feature Guide for Security Devices
• Configuring Security Intelligence Policy on the SRX Series Device
• [Configuring Advanced Anti-Malware Policy on the SRX Series Device]

Unified policies are security policies that enable you to use dynamic applications as match conditions along with the existing 5-tuple or 6-tuple (with user firewall) match conditions to detect application changes over time3 If the traffic matches the security policy rule, one or more actions defined in the policy are applied to the traffic3 During the initial policy lookup phase, which occurs prior to a dynamic application being identified, if there are multiple policies in the potential policy list, the SRX Series Firewall applies the default security policy until a more explicit match has occurred2 The policy that best matches the application is the final policy2 APPID results are used to determine the final security policy1 References:

• 1: Unified Security Policies | Junos OS | Juniper Networks
• 2: Unified Policies Support for Flow | Junos OS | Juniper Networks
• 3: Unified Policy Overview - TechLibrary - Juniper Networks

 Juniper Secure Analytics (JSA) is a security information and event management (SIEM) system that consolidates, analyzes, and manages surveillance data from network devices, endpoints, and applications1

JSA uses two features to configure alerts based on certain criteria: building blocks and events2

Building blocks are reusable components that define common characteristics of network activity, such as IP addresses, ports, protocols, usernames, or threat categories. Building blocks can be used to create custom rules, searches, reports, and filters that can trigger alerts when certain conditions are met2

Events are records of network activity that are collected and normalized by JSA. Events can be classified into different categories, such as offenses, flows, logs, or anomalies. Events can also be correlated with other data sources, such as vulnerability scanners, threat intelligence feeds, or asset databases, to provide more context and insight. Events can trigger alerts when they match predefined or custom rules that specify the severity, frequency, or duration of the activity2

References: 1: JSA Series Secure Analytics - Juniper Networks 2: Juniper Secure Analytics Users Guide

AppTrack is a logging and reporting tool that provides statistics for analyzing bandwidth usage of your network. When enabled, AppTrack collects byte, packet, and duration statistics for application flows in the specified zone. AppTrack sends log messages through syslog, providing application activity update messages. AppTrack can be used to share information for application visibility with devices such as Security Threat Response Manager (STRM)12 References:

• 1: Application Tracking | Junos OS | Juniper Networks
• 2: application-tracking | Junos OS | Juniper Networks

To manually failover the primary Routing Engine in an SRX Series high availability cluster pair, you need to issue the request chassis cluster failover redundancy-group group-id node node-id command on the primary node, where group-id is the redundancy group number and node-id is the node number of the secondary node. This command initiates a graceful failover of the specified redundancy group to the secondary node, making it the new primary node. The other options are not necessary or correct for this task. Option A would disable the chassis cluster and reboot the primary node, which is not a graceful failover. Option B is not relevant, as the control link recovery solution is used to restore the control link connectivity between the nodes, not to initiate a failover. Option D would not trigger a failover, as the priority of the secondary node would only take effect after a reboot or a control link failure. References:

• Chassis Cluster Redundancy Group Manual Failover
• Initiating a Chassis Cluster Manual Redundancy Group Failover
• SRX Getting Started - Troubleshoot High Availability (HA)

The infected host cloud feed is a list of IP addresses that have been identified as compromised or infected by malware. The feed is updated by Juniper ATP Cloud based on the detection of malicious activity from the hosts, such as contacting known command-and-control servers. When a host on the network reaches the configured threat level threshold, its IP address is automatically added to the infected host cloud feed and blocked from communicating with any other hosts on the Internet. The other feeds are not relevant for this situation. The command-and-control cloud feed is a list of IP addresses that are known to be used by malware for remote control and communication. The allowlist and blocklist feed is a user-defined list of IP addresses that are either allowed or denied by the SRX Series device. The custom cloud feed is a user-defined list of IP addresses that are associated with a specific category or threat level. References:

• Infected Hosts: More Information
• Juniper’s Attacker IP feed bolsters threat protection with SecIntel
• ATP Appliance and SRX Series Threat Level Comparison Chart

After JSA receives external events and flows, the data goes through the following steps in the event and flow pipeline 1:

• Event and flow collection: JSA accepts event logs and flow records from various sources by using different protocols and methods. The data is parsed and normalized into a JSA-usable format.
• Event and flow processing: JSA applies rules, custom properties, and anomaly detection to the data. The data is also coalesced, filtered, and forwarded as needed. The data is stored in an asset database and an Ariel database for further analysis and reporting.
• Event and flow correlation: JSA analyzes the data for patterns that indicate malicious activity or policy violations. JSA generates offenses, alerts, and notifications based on the correlation rules and building blocks.
• Event and flow response: JSA responds to the offenses and alerts by taking active measures such as blocking IP addresses, quarantining hosts, or updating reference data. JSA also provides investigation and remediation tools for analysts to handle the incidents. References:
• 1: JSA Events and Flows | Junos OS | Juniper Networks

AppQoS is a service that allows you to prioritize and manage the quality of service (QoS) for different types of applications on SRX Series devices. AppQoS uses application signatures to identify and classify the traffic, and then applies QoS policies to assign bandwidth, priority, and scheduling parameters to the traffic. AppQoS can help you optimize the performance of critical applications, such as VoIP, and ensure that they get the required bandwidth and latency in a congested network12. In this scenario, you can use AppQoS to prioritize the VoIP traffic over other traffic and guarantee its QoS on the SRX Series device at the branch office. References:

• Understanding Application Quality of Service
• Configuring Application Quality of Service

 https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/security-application-identification-predefined-signatures.html

 The show security policies policy-name detail command shows policy counters for a configured policy. Policy counters display the number of packets and bytes that match the policy, as well as the number of sessions that are created, denied, or closed by the policy. Policy counters can help monitor and troubleshoot the traffic flow and security policy enforcement on the SRX firewall1.

The show security policies policy-name detail command does not display details about the default security policy, which is the implicit policy that is applied when no other policy matches the traffic. The default security policy can be viewed by using the show security policies default-policy command2.

The show security policies policy-name detail command does not identify the different custom policies enabled, which are the user-defined policies that specify the action and conditions for the traffic between zones. The custom policies can be viewed by using the show security policies command without any options1.

The show security policies policy-name detail command does not show the system log files for the local SRX Series device, which are the files that record the events and messages generated by the device. The system log files can be viewed by using the show log command with the name of the file3. References:

• 1: show security policies | Junos OS | Juniper Networks
• 2: Understanding Default Security Policies | Junos OS | Juniper Networks
• 3: show log | Junos OS | Juniper Networks

A vSRX is a virtualized security platform that runs on various hypervisors and cloud environments. It provides firewall and NAT services, as well as other security features, such as IPS, VPN, UTM, and AppSecure. A single vSRX can fulfill the minimum requirements for providing firewall and NAT services in a private cloud, as it can be deployed as a gateway or an edge device, and can scale up or down as needed. A vSRX can also interoperate with other Juniper and third-party products, such as Contrail Networking, Junos Space Security Director, and Sky ATP. A single vSRX is more cost-effective and simpler to manage than having separate vSRX instances for firewall and NAT services. A cSRX is a containerized version of vSRX that runs on Linux-based platforms. It provides similar security features as vSRX, but with a smaller footprint and faster deployment. However, a cSRX is not yet supported on all cloud environments, and it may have some limitations compared to vSRX, such as lower throughput and fewer interfaces. Therefore, a single cSRX may not be able to fulfill the minimum requirements for providing firewall and NAT services in a private cloud, depending on the specific cloud platform and the performance and scalability needs. A cSRX for firewall services and a separate cSRX for NAT services would also introduce more complexity and overhead than a single vSRX. References: vSRX Overview, cSRX Overview, JNCIP-SEC Certification

References:

• Security Policies Feature Guide for Security Devices
• Application Security User Guide for Security Devices
• Understanding Micro Application Detection
• Configuring Micro Application Detection
• Content Filtering Feature Guide for Security Devices

= SSL proxy server protection is a type of reverse proxy that enables the SRX Series device to act as an intermediary between external clients and internal servers that use SSL encryption. SSL proxy server protection provides benefits such as load balancing, caching, compression, encryption, authentication, and application firewalling. To enable SSL proxy server protection, you do not need to configure the servers to use the SSL proxy function on the SRX Series device. The SRX Series device will terminate the SSL connection from the client and initiate a new SSL connection to the server, without requiring any changes on the server side. However, you must load the server certificates on the SRX Series device, so that the SRX Series device can present the server certificate to the client and establish a secure connection. You must also import the root CA on the servers, so that the servers can trust the SRX Series device as a valid intermediary and accept the connection from the SRX Series device. References: SSL Proxy, Configuring SSL Proxy, JNCIP-SEC Certification

To log denied traffic, you need to configure a security policy with the action of deny and the option of log session-init. The deny action blocks the traffic that matches the policy criteria, and the log session-init option generates a log entry when the session is denied. The session-close option is not required, as it only logs the end of a session. The count option is not required, as it only increments a counter for the policy. References:

• [SRX] How to log traffic that is denied by default system security policy1
• [SRX] How to log traffic for the default deny policy2
• How to log traffic dropped by Juniper SRX firewalls3

= The vSRX is a virtual firewall that offers the same features as the physical SRX Series firewalls, but in a virtualized form factor for delivering security services that scale to match network demand. The vSRX supports Juniper Contrail Networking and third-party software-defined networking (SDN) solutions, which enable dynamic and automated network provisioning and management. The vSRX also integrates with cloud orchestration tools such as OpenStack, which allow for flexible deployment and configuration of virtual machines and networks. The vSRX provides granular security for the workloads that run within the virtual network on the public or private cloud. It supports next-generation firewall capabilities, such as application security, intrusion prevention, user identity, and role-based access control. It also supports advanced threat prevention features, such as malware sandboxing, threat intelligence feeds, and encrypted traffic inspection. The vSRX can protect the network from both internal and external threats, and enforce consistent security policies across the entire network. References:

• vSRX Virtual Firewall | Juniper Networks US
• vSRX Documentation | Juniper Networks
• Understand vSRX Virtual Firewall with Microsoft Azure Cloud

Juniper ATP Cloud is a cloud-based threat detection service that protects all hosts in your network against evolving security threats. Juniper ATP Cloud performs the following tasks:

• It extracts potentially malicious objects and files from the traffic and sends them to the cloud for analysis.
• It uses multiple antivirus software packages to analyze files and identify known malicious files quickly. It also uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify new malware and add it to the known list of malware.
• It correlates between newly identified malware and known command and control (C&C) sites to aid analysis.
• It blocks known malicious file downloads and outbound C&C traffic.
• It provides features such as DNS, Encrypted Traffic Insights (ETI) and IoT security if you have ATP Cloud premium license.

Based on this information, we can infer the following:

• Option B is correct because Juniper ATP Cloud uses multiple antivirus software packages to analyze files, as well as other techniques, to provide robust coverage against sophisticated, evasive threats.
• Option D is correct because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, which are unknown and undetected by traditional antivirus solutions. Instead, it uses other techniques, such as machine learning, sandboxing, and behavioral analysis, to identify and mitigate zero-day threats.
• Option A is incorrect because Juniper ATP Cloud does not only use one antivirus software package to analyze files, but multiple ones, as well as other techniques.
• Option C is incorrect because Juniper ATP Cloud does not use antivirus software packages to protect against zero-day threats, but other techniques.

References: Juniper Security, Specialist (JNCIS-SEC) Reference Materials and Juniper Security, Professional (JNCIP-SEC) Reference Materials

https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-access-control-capabilities-and-remote-access-vpn

https://blogs.juniper.net/en-us/security/juniper-strengthens-connected-security-portfolio-with-new-risk-based-access-control-capabilities-and-remote-access-vpn

• Referring to the SRX Series flow module diagram shown in the exhibit, application security is processed at the Services ALGs stage. Application Layer Gateways (ALGs) are software components that enable the SRX Series device to provide application-level security for specific protocols and applications1.
• ALGs inspect the application layer payload of packets and perform various actions, such as modifying the payload, opening pinholes, creating sessions, applying security policies, and enforcing application-specific behavior12.
• ALGs are required for protocols and applications that embed IP address information or port numbers in the application layer data, that open secondary connections, or that are dynamically assigned ports1. Some examples of protocols and applications that require ALGs are FTP, SIP, H.323, RTSP, PPTP, and DNS2.
• ALGs are configured as part of the security policy and are applied to the traffic that matches the policy criteria. ALGs can also be enabled or disabled globally or per zone12.

References:

• 1: Application Layer Gateways Overview
• 2: Application Layer Gateways Feature Guide for Security Devices

Juniper ATP Cloud is a cloud-based service that provides advanced threat prevention for SRX Series devices. Juniper ATP Cloud can inspect files for malware by sending them to the cloud or performing a hash lookup. To reduce delays in the inspection of files, Juniper ATP Cloud performs the following two functions12:

• Juniper ATP Cloud allows the creation of allowlists. Allowlists are lists of trusted files or domains that are not sent to the cloud for inspection. This reduces the network traffic and the processing time for the files that are known to be safe. You can create allowlists from the Juniper ATP Cloud Web UI or the SRX Series device CLI.
• Juniper ATP Cloud performs a cache lookup on files. Cache lookup is a feature that checks if a file has been previously scanned by Juniper ATP Cloud and returns the cached verdict. This avoids sending the same file to the cloud again and saves bandwidth and time. Cache lookup is enabled by default and can be configured from the SRX Series device CLI. References:
• Juniper ATP Cloud User Guide
• Juniper ATP Cloud Deployment Guide for SRX Series Devices

Adaptive Threat Profiling is a feature that allows SRX Series Firewalls to generate, propagate, and consume threat feeds based on their own advanced detection and policy-match events. This feature enables you to configure security or IDP policies that, when matched, inject the source IP address, destination IP address, source identity, or destination identity into a threat feed, which can be leveraged by other devices as a dynamic-address-group (DAG). With adaptive threat profiling, the Juniper ATP Cloud service acts as a feed-aggregator and consolidates feeds from SRX across your enterprise and shares the deduplicated results back to all SRX Series Firewalls in the realm at regular intervals. SRX Series Firewalls can then use these feeds to perform further actions against the traffic. This feature allows you to find systems running applications that increase the risks on your network and ensure these systems are processed through IPS and Juniper ATP Cloud for malware and virus protection1. References:

• Adaptive Threat Profiling Overview and Configuration
• Adaptive Threat Profiling Overview
• Juniper Launches Adaptive Threat Profiling, New VPN Features
• Juniper Networks Answers Who and What is On the Network with Risk-Based Access Control Capabilities and New VPN Application
• Adaptive Threat Profiling Overview | SD Cloud

An Application Layer Gateway (ALG) is a software component that is designed to manage specific protocols such as Session Initiation Protocol (SIP) or FTP on Juniper Networks devices running Junos OS. The ALG module is responsible for Application-Layer aware packet processing on switches1. The ALG can perform various functions such as modifying the payload and header of packets, opening secondary connections, translating addresses and ports, and applying security policies1. The ALG does not use software processes for permitting or disallowing specific IP address ranges, as this is the function of firewall filters or security zones2. The ALG does not use software that is used by a single TCP session using the same port numbers as the application, as this is the definition of a stateful firewall3. The ALG does not contain protocols that use one application session for each TCP session, as this is the characteristic of some application protocols such as HTTP or SMTP4. References:

• 1: ALG Overview | Junos OS | Juniper Networks
• 2: Firewall Filters Overview | Junos OS | Juniper Networks
• 3: Stateful Firewall Overview | Junos OS | Juniper Networks
• 4: Application Layer Protocols | Junos OS | Juniper Networks

 JSA supports high availability (HA) clusters, which are two JSA hosts that act as a single system. The primary host is the active host and the secondary host is the standby host. If the primary host fails, the secondary host takes over and becomes the active host1 To configure an HA cluster, you must ensure that the software versions on both primary and secondary hosts are the same, and that the cluster virtual IP address is an unused IP address on the same subnet as the primary and secondary hosts1 The secondary host does not backup multiple JSA primary hosts, as each HA cluster consists of only one primary and one secondary host1 The primary and secondary hosts do not need to be configured with the same storage devices, as long as they have enough disk space to store the same amount of data2 References:

• 1: HA Clusters | Junos OS | Juniper Networks
• 2: JSA Virtual Appliance | Juniper Networks US

Based on the exhibit, Nancy logged in to the juniper.net Active Directory domain, as shown by the domain name in the user identity information. The IP address of the authenticating domain controller is 172.25.11.140, as shown by the domain controller address in the user identity information. The IP address of Nancy’s client PC is not 172.25.11, but 172.25.11.11, as shown by the source IP address in the user identity information. Nancy is not a member of the Active Directory sales group, but of the marketing group, as shown by the group name in the user identity information34 References:

• active-directory-access | Junos OS | Juniper Networks
• 13. Juniper SRX Active Directory Integration - RAYKA
• Configure Juniper Identity Management Service to Obtain User Identity …
• Create an Active Directory Profile | SD Cloud | Juniper Networks

 Juniper ATP Cloud profiles let you define which files to send to the cloud for inspection. You can group types of files to be scanned together (such as.tar,.exe, and.java) under a common name and create multiple profiles based on the content you want scanned. Then enter the profile names on eligible SRX Series devices to apply them1. To update a custom profile, you can use the ATP Cloud Ul and navigate to Configure > File Inspection Management > Profiles. There you can edit the existing profile and change the scan limit for executable files to 30 MB, while keeping the scan limit for other files at 10 MB. This way, you can scan larger executable files without increasing the scan time for other file types. References: File Inspection Profiles Overview

References: Unified Security Policies, Understanding Security Policy Elements, Anyone with good understanding of Unified Security Policies (SRX)

Policy Enforcer is a Junos Space Security Director component that allows updated security policies to be deployed across Juniper SRX Series firewalls, MX Series 5G Universal Routing Platforms, EX Series Ethernet Switches, QFX Series Switches, and third-party network devices1. Policy Enforcer can leverage the DDoS protection feature of Juniper devices to detect and mitigate DDoS attacks on the network. The DDoS protection feature is based on two main components: the classification of host-bound control plane traffic and a hierarchical set of individual- and aggregate-level policers that cap the volume of control plane traffic that each protocol type is able to send to the Routing Engine (RE) for processing2. The DDoS protection feature is supported on MX Series routers and QFX Series switches, among other devices3. Therefore, the correct devices to use for DDoS protection with Policy Enforcer are MX and QFX.

The other options are not correct for the following reasons:

• vQFX is a virtual switch that emulates the QFX Series switches for testing and development purposes. It does not support the DDoS protection feature4.
• vMX is a virtual router that emulates the MX Series routers for testing and development purposes. It does not support the DDoS protection feature.

References: Policy Enforcer DDoS Protection Case Study Protection against distributed denial of service (DDoS) attacks vQFX10000 Overview [vMX Overview]

Junos OS generates system log messages (also called syslog messages) to record system events that occur on the device, such as routine operations, failure and error conditions, and critical conditions that might require urgent resolution1. System log messages can be sent to different destinations, such as files, remote hosts, userterminals, or the system console2. There are two types of system logs that Junos generates: data plane logs and control plane logs3.

Data plane logs are generated by the Packet Forwarding Engine (PFE), which is responsible for forwarding packets according to the information in the forwarding table. Data plane logs include information about firewall filters, policers, NAT, IPSec, and other features that are applied to the traffic passing through the device4.

Control plane logs are generated by the Routing Engine (RE), which is responsible for running the routing protocols, managing the configuration, and maintaining the routing and forwarding tables. Control plane logs include information about system processes, libraries, services, and applications that run on the device14.

SQL log files and system core dump files are not types of system logs that Junos generates. SQL log files are used by database management systems to store queries and transactions. System core dump files are generated when a process crashes and dumps its memory contents to a file for debugging purposes. References:

• 1: System Logging Overview | Junos OS | Juniper Networks
• 2: syslog (System) | Junos OS | Juniper Networks
• 3: What are two types of system logs that Junos generates? (Choose two …) | Exam4Training
• 4: System Log Messages | Junos OS | Juniper Networks
• [5]: Core dump - Wikipedia

 Juniper ATP Cloud is a cloud-based service that provides advanced malware detection and prevention for the network. It uses machine learning to find and block both known and unknown cyberthreats, analyzing files and network traffic looking for signs of malicious behavior. One of the methods that Juniper ATP Cloud uses to identify zero-day threats is dynamic analysis, which is the process of executing suspicious files or code in a sandbox environment and observing their behavior and network activity. Dynamic analysis can uncover zero-day malware threats and malicious connections, including botnets and command-and-control servers hiding in encrypted traffic, by detecting anomalous or malicious patterns. Dynamic analysis is complemented by other methods, such as static analysis, which examines the file structure and content without executing it, and machine learning, which uses artificial intelligence to classify and predict threats based on previous data and models. References:

• [Juniper Advanced Threat Prevention Products] 1
• [Juniper Advanced Threat Prevention Datasheet] 2
• [Juniper Advanced Threat Prevention | NetworkScreen.com] 3
• [Introduction to Juniper ATP Cloud | ATP Cloud | Juniper Networks] 4
• [JUNIPER ADVANCED THREAT PREVENTION CLOUD SERVICES DESCRIPTION] 5

SSL proxy uses application identification services to dynamically detect if a particular session is SSL encrypted.https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/security-ssl-proxy-unified-policies.html