JN0-335 Practice Questions

The configuration shown in the exhibit is for a Juniper SRX Series firewall. The session-init parameter

is used to control how the firewall processes unknown traffic flows. With the session-init parameter

set to 300, any traffic flows that the firewall does not recognize will be dropped after 300

milliseconds. Additionally, every session that enters the device, whether it is known or unknown, will

generate an event, which can be used for logging and troubleshooting purposes. The session-lose

parameter is used to control how the firewall handles established sessions that are terminated.

The question implies a need to reduce the operational load that the Juniper Identity Management Service (JIMS) places on its primary data source, the Domain Controllers (DCs). JIMS's default method of polling DC event logs for user-to-IP address mappings can be resource-intensive. To mitigate this, JIMS can be configured to use alternative data sources. Connecting JIMS to a RADIUS server allows it to collect user-to-IP mappings directly from RADIUS accounting reports. This is a highly efficient and direct method for obtaining identity information at the point of network access (e.g., 802.1X or VPN), thereby reducing or eliminating the need to poll the DCs and lowering their processing load.

B. Connect JIMS to the domain Exchange server: While JIMS can use Exchange server logs as a data source, RADIUS accounting is a more direct and purpose-built mechanism for tracking user-to-IP network sessions, making it a more precise solution.

C. Connect JIMS to the domain SQL server: JIMS does not use a domain SQL server as a data source to acquire user-to-IP address mappings. JIMS uses its own local SQL database for storage.

D. Connect JIMS to another SRX Series device: SRX Series devices are consumers (clients) of the identity information provided by the JIMS server. Connecting another SRX device would increase the load on the JIMS server, not reduce it.

1. Juniper Networks TechLibrary

JIMS Configuration Guide

"Understanding JIMS" Section. This guide details the architecture and data sources for JIMS. It explicitly lists "RADIUS Accounting" as a supported data source alongside "Event Log" and "Microsoft Exchange Server." The guide states

"JIMS can also be configured to collect user identity information from RADIUS accounting servers." This confirms that using RADIUS is a valid method to acquire identity information

which offloads the Domain Controllers.

2. Juniper Networks TechLibrary

JIMS Configuration Guide

"Configuring Data Sources" Section. This section provides configuration details for each data source. The presence of a dedicated configuration chapter for RADIUS Accounting confirms it as an officially supported method to provide user identity data to JIMS

which serves the goal of reducing reliance on DC event log polling. The guide explains how to "Configure JIMS to collect user identity information from RADIUS accounting servers."

By default, when a security policy on a Juniper SRX Series device is modified and committed, the changes only apply to new sessions. Existing, active sessions that were permitted by the original policy are not affected and will continue to pass traffic until they time out or are closed normally. This default behavior ensures stateful session continuity and prevents service disruption for established connections. The device does not re-evaluate active sessions against the modified policy rules; those rules are only consulted for session initiation requests that occur after the policy change.

A. The active sessions allowed by the policy will be dropped. This is incorrect. Dropping all active sessions is a disruptive action and is not the default behavior for a policy modification.

B. Only policy changes that involve modification of the action field will cause the active sessions affected by the change to be dropped. This is incorrect. By default, no part of a policy modification, including a change to the action, will cause active sessions to be dropped.

C. Only policy changes that involve modification of the application will cause the active sessions affected by the change to be dropped. This is incorrect. Similar to other modifications, changing the application in a policy does not, by default, affect existing sessions.

1. Juniper Networks TechLibrary

Junos OS Security Guide. In the section "Understanding Session Management for Security Policies

" it states

"When you modify a security policy

the changes affect new sessions only. Existing sessions are not affected by the policy change."

2. Juniper Networks TechLibrary

Security Policies Configuration Guide for SRX Series Devices. The "Understanding Security Policy Processing" section clarifies the default behavior: "By default

when you modify a security policy

the changes affect new sessions only. Existing sessions are not affected by the policy change." This confirms that established flows are preserved.

AppTrack is the application tracking feature within Junos OS for SRX Series devices. Its primary purpose is to identify applications and collect detailed statistics about their traffic flows. This includes data such as byte and packet counts, and the duration of the session, which directly supports option C. Furthermore, AppTrack functionality is not restricted to the primary routing instance; it can be configured and utilized within user-defined logical systems on an SRX Series device, making option A correct. This allows for granular application visibility and reporting on a per-logical-system basis.

B. AppTrack identifies and blocks traffic flows that might be malicious regardless of the ports being used.

AppTrack's function is to identify and report on application traffic, not to block it. Blocking is handled by security policies, such as those in Application Firewall (AppFW) or IPS.

D. AppTrack can only be configured in the main logical system on an SRX Series device.

This is incorrect. Official Juniper documentation confirms that AppTrack is supported on user-defined logical systems, not just the main (root) logical system.

1. Juniper Networks TechLibrary. (2023). AppTrack Overview. "AppTrack provides application tracking and reporting. The AppTrack feature collects statistics for application flows

such as bytes

packets

and duration." This source validates option C.

2. Juniper Networks TechLibrary. (2023). AppTrack for Logical Systems Overview. "Starting with Junos OS Release 12.1X44-D10 and Junos OS Release 17.3R1

AppTrack is supported on logical systems for SRX Series devices." This source validates option A and invalidates option D.

3. Juniper Networks TechLibrary. (2023). Application Firewall Overview. "Application firewall (AppFW) provides application-aware security policy enforcement... AppFW policies enforce security rules for traffic

such as allowing or denying traffic to or from a specified application." This source differentiates the blocking function of AppFW from the tracking function of AppTrack

invalidating option B.

The scenario describes a classic Security Information and Event Management (SIEM) use case: correlating specific events (failed password attempts) from a device over a defined time window (five minutes) and triggering an alert when a threshold (three times) is met. Juniper Secure Analytics (JSA) is Juniper's SIEM and network security management platform. It is specifically designed to collect, process, and correlate event and flow data from disparate sources to detect and alert on threats, such as the brute-force or password-guessing activity described in the question.

A. Adaptive Threat Profiling: This feature dynamically creates and applies security policies based on threat feeds and user/device context for enforcement on SRX firewalls, rather than correlating log events for alerting.

C. Juniper Identity Management Service: JIMS collects and provides user identity information (e.g., user-to-IP mapping) to SRX devices for identity-based policies, but it does not perform event correlation or alerting.

D. Intrusion Prevention System: An IPS inspects network traffic in real-time to block known attack patterns (signatures). It does not perform the stateful, time-based correlation of system log events required by the scenario.

1. Juniper Secure Analytics (JSA): The official JSA documentation states

"Juniper Secure Analytics (JSA) is a network security management platform that provides a comprehensive view of your network's security posture... JSA uses a powerful rules engine to correlate security events and network flow data to detect and alert you to potential threats." This directly aligns with the question's requirement.

Source: Juniper Networks TechLibrary

"JSA Administration Guide

" Overview section.

2. Adaptive Threat Profiling: "Adaptive threat profiling enables the SRX Series Firewall to use threat feeds to stop threats at the firewall. You can create policies that use these feeds to block traffic from malicious hosts..." This describes policy enforcement

not event correlation.

Source: Juniper Networks TechLibrary

"Adaptive Threat Profiling Overview."

3. Juniper Identity Management Service (JIMS): "The Juniper Identity Management Service (JIMS) collects user identity information... and then provides the information to SRX Series devices

which use it to enforce identity-based security policies." This confirms its role is identity provision

not event analysis.

Source: Juniper Networks TechLibrary

"Juniper Identity Management Service (JIMS) Overview."

4. Intrusion Prevention System (IPS): "The Intrusion Prevention System (IPS) feature on SRX Series Firewalls provides protection against network- and application-level attacks by inspecting traffic for malicious patterns." This highlights its focus on real-time traffic inspection against signatures.

Source: Juniper Networks TechLibrary

"Intrusion Prevention System (IPS) for SRX Series Overview."

Policy Enforcer, a component of Juniper's Security Director, automates threat mitigation by integrating with Juniper networking devices. For a comprehensive DDoS protection strategy, Policy Enforcer utilizes:

1. MX Series Routers: These act as the primary enforcement point at the network edge. They are designed to handle high traffic volumes and can apply advanced filtering, such as flowspec rules, pushed by Policy Enforcer to block DDoS attack traffic before it enters the network.

2. QFX Series Switches: These are used as enforcement points within the data center or campus. They provide a second layer of defense by blocking malicious traffic closer to the protected servers or endpoints, preventing lateral movement and mitigating attacks that bypass edge defenses.

A. vQFX: While the virtualized QFX is a supported platform, QFX (D) represents the entire product series, which is the more general and architecturally distinct component (switch) in this solution.

C. vMX: Similar to vQFX, the virtualized MX is supported, but MX (B) represents the entire product series and the primary architectural role (edge router) for DDoS mitigation.

1. Juniper Networks TechLibrary

"Policy Enforcer Overview": "Policy Enforcer...provides the ability to deploy threat prevention policies on SRX Series devices and EX Series and QFX Series switches. It also provides an option to use MX Series routers as a network enforcement point to block C&C traffic." This document explicitly names both MX and QFX series as enforcement points for Policy Enforcer.

Source: Juniper Networks Documentation

Security Director Policy Enforcer User Guide.

2. Juniper Networks TechLibrary

"Understanding Junos OS DDoS Protection on Routers": This document details the extensive DDoS protection capabilities built into Junos OS for platforms including the MX Series. It describes how these routers "protect the Routing Engine and the Packet Forwarding Engine from DDoS attacks to ensure uninterrupted operation of the network." This establishes the MX Series as a core device for DDoS protection.

Source: Juniper Networks Documentation

Junos OS Denial-of-Service Protection.

3. Juniper Networks White Paper

"Juniper Connected Security: Stop Threats Faster": Solution architecture diagrams and descriptions in Juniper's security white papers consistently depict MX Series routers at the edge and QFX Series switches in the data center

both acting as enforcement points orchestrated by Security Director and Policy Enforcer for a layered security posture

including DDoS mitigation.

Source: Juniper Networks White Papers and Solution Briefs on Connected Security.

The cSRX Container Firewall is a virtualized security appliance designed for containerized environments. It provides core security services, including a stateful firewall, Network Address Translation (NAT), and an Intrusion Prevention System (IPS), as stated in option A. While the inclusion of "UTM services" is an overstatement (as most UTM features like anti-virus and web filtering are unsupported), the option correctly identifies the primary security functions. Additionally, the cSRX integrates advanced routing capabilities, supporting dynamic routing protocols such as BGP, OSPF, and IS-IS, making option C correct. These features allow it to be deployed in complex network topologies within a container ecosystem.

B: This is incorrect because the cSRX supports both Layer 2 (transparent or "bump-in-the-wire") mode and Layer 3 (route) mode, offering flexible deployment options.

D: This is incorrect. The standard factory-default configuration for SRX series devices, including cSRX, defines only two security zones: trust and untrust. A management zone is not created by default.

1. Juniper Networks Documentation (Data Sheet): cSRX Container Firewall Data Sheet.

Reference for A & C: Under the "Features and Benefits" table

the "Firewall and VPN Features" section lists "Stateful firewall

" "Network address translation (NAT)

" and "Intrusion prevention system (IPS)." The "Routing Protocols" section explicitly lists "BGP

" "OSPF

" and "IS-IS."

2. Juniper Networks Documentation (Technical Documentation): cSRX Container Firewall Overview.

Reference for B: This document states

"The cSRX can be deployed in either Layer 2 (transparent) mode or Layer 3 (routing) mode." This directly contradicts the "only supports Layer 2" claim.

3. Juniper Networks Documentation (Technical Documentation): Security Feature Guide for Junos OS.

Reference for A (UTM inaccuracy): In the "Feature Support on cSRX" section

the guide explicitly states

"Most UTM features are not supported on cSRX." This confirms the inaccuracy in option A

but the option's other points are correct.

4. Juniper Networks Documentation (Technical Documentation): Junos OS Security Configuration Guide.

Reference for D: The "Understanding the Default Security Configuration on SRX Series Devices" section details the factory-default settings

which include preconfigured trust and untrust zones but no management zone.

Juniper Identity Management Service (JIMS) primarily gathers user-to-IP address mappings by reading security event logs from domain controllers. The domain PC probe is a supplementary mechanism. It is triggered only when JIMS receives a query for an IP address for which it has no user mapping from the event logs. In this scenario, JIMS actively probes the PC at that IP address to determine the logged-in user, thereby resolving the identity.

A: This is incorrect. The PC probe is an active query to an endpoint, not the analysis of domain controller logs. Log analysis is a separate, primary data collection method.

C: This is incorrect. JIMS retrieves user group membership information directly from the Active Directory domain controller using LDAP, not by probing individual PCs.

D: This is incorrect. The information flow is reversed. JIMS initiates the probe to build its identity database; the SRX Series device then queries JIMS for that information.

1. Juniper Networks. (2023). Juniper Identity Management Service (JIMS) Administration Guide.

Reference: In the "Understanding How JIMS Collects User Identity Information" section

it states: "If JIMS does not find a user for an IP address in the event log source

it can probe the PC with that IP address to get the username of the logged-in user." This directly supports option B as the correct trigger for a PC probe.

Reference: The same guide

in the "Configure an Active Directory Source" section

details how JIMS uses LDAP to query for group information

which invalidates option C.

Reference: The overall architecture described in the guide shows the SRX as a client of JIMS

querying it for information. JIMS is the component that actively collects data

invalidating option D.

The exhibit shows the output of the CLI command show chassis cluster status.

• Redundancy-group 0 and 1 list Node 1 as PRIMARY and Node 2 as “lost heartbeat/unknown.”

• In Juniper chassis-cluster terminology, a node that does not exchange control-plane keepalives is marked lost-heartbeat (or unknown) and is treated as down; the surviving node automatically assumes the PRIMARY role for every redundancy group.

Therefore, the cluster is operating in a degraded, single-node state because Node 2 is down.

A. Split-brain would display PRIMARY/PRIMARY from each node’s perspective; exhibit shows only one PRIMARY.

B. Node 1 is the active PRIMARY in all redundancy groups, proving it is alive.

D. “Lost-heartbeat/unknown” on Node 2 indicates a fault; cluster health is not normal.

1. Juniper Networks

“SRX Series High Availability Guide

” 22.2R1

Chapter 6 ‘Monitoring a Chassis Cluster’

p. 224–225: description of show chassis cluster status fields; ‘lost-heartbeat’ indicates node failure.

2. Juniper KB21420

“Understanding the output of ‘show chassis cluster status’

” section ‘Node status values’: states ‘lost-heartbeat/unknown = node down

surviving node becomes Primary for all RGs.’

3. Juniper Networks TechLibrary

CLI reference “show chassis cluster status

” Junos OS 22.2

paragraph ‘If the peer node is not reachable

status field shows lost or unknown.’

Juniper's Application Identification (AppID) service uses advanced deep packet inspection (DPI) techniques to analyze Layer 7 traffic. This capability allows it to identify specific applications that are tunneled or "nested" within other protocols, such as identifying a specific social media function within general web traffic.

While both AppID and Intrusion Detection and Prevention (IDP) rely on signatures, their signature packages are separate and serve distinct functions. The AppID signature package is designed specifically to identify and classify applications for policy enforcement. In contrast, the IDP signature database contains patterns to detect attacks and malicious activity within network traffic.

B. Application identification cannot identify nested applications that are within Layer 7. This is incorrect. A core feature of AppID is its ability to use DPI to identify applications nested within other Layer 7 protocols.

C. Application signatures are the same as IDP signatures. This is incorrect. AppID and IDP use separate and distinct signature databases, each tailored for its specific purpose (application classification vs. threat detection).

1. Juniper Networks TechLibrary

Application Security for SRX Series and NFX Series

"Understanding Application Identification" section. This document states

"AppID can identify applications that are nested within other applications." This directly supports the correctness of option A.

2. Juniper Networks TechLibrary

Application Security for SRX Series and NFX Series

"Understanding the Application Signature Package" section. This source clarifies

"The application signature package is separate from the IDP signature database... The application signature package contains application signatures that identify applications for the AppID feature." This directly supports the correctness of option D.