Free Security, Specialist (JN0-336) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Security, Specialist (JN0-336) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which IDP detection method uses a known attack pattern together with protocol, direction, and flow context?

   1. A. Protocol anomaly detection
   2. B. Stateful signature detection
   3. C. Source-address matching
   4. D. Transport-port matching

   Answer: B

   Explanation: The guide states, "Signature attack objects detect known attacks using stateful attack signatures." These signatures incorporate attack context; protocol anomaly detection instead checks deviations from protocol rules.

   Reference: IDP Policy Rules and IDP Rule Bases — Understand IDP Policy Rules > IDP Rule Objects > Table 1, Signature Attack Objects

2. 2In IKEv1, what is the purpose of Phase 1?

   1. A. To select routes for protected destination networks
   2. B. To negotiate individual data-traffic IPsec SAs
   3. C. To encapsulate every data packet in UDP
   4. D. To establish an authenticated, secure negotiation channel

   Answer: D

   Explanation: The guide states, "In Phase 1, participants establish a secure channel in which to negotiate the IPsec security association (SA)." Phase 2 negotiates the data-traffic SAs; routing and data encapsulation are distinct functions.

   Reference: IPsec VPN User Guide — p. 110, IPsec VPN with Autokey IKE Configuration Overview

3. 3In the Juniper ATP Cloud architecture, which responsibility belongs to the SRX firewall?

   1. A. Running the cloud malware analysis pipeline
   2. B. Aggregating threat intelligence for every tenant
   3. C. Extracting file content and enforcing inline blocking
   4. D. Hosting the ATP Cloud service portal

   Answer: C

   Explanation: The component table assigns the SRX this responsibility: "Submits extracted file content for analysis and detected C&C hits inside the customer network." It also performs inline blocking; cloud analysis, feed aggregation, and the portal are separate components.

   Reference: Juniper ATP Cloud Administrator Guide — p. 6, Table 1, SRX Series Firewall

4. 4Which pair is suitable for forming an SRX chassis cluster under the documented hardware and software prerequisites?

   1. A. Identical supported firewall models running the same Junos OS version
   2. B. Identical supported firewall models running different Junos OS versions
   3. C. Different supported firewall models running the same Junos OS version
   4. D. Different supported firewall models running different Junos OS versions

   Answer: A

   Explanation: The guide requires, "A pair of identical, supported Firewalls running the same Junos OS version". Both model compatibility and software-version consistency matter, not just one of them.

   Reference: Chassis Cluster User Guide for SRX Series Devices — p. 16, Chassis Cluster Workflow > Workflow

5. 5What is a primary benefit of using JIMS information in SRX security policies when users move between IP networks?

   1. A. User access can follow identity and group membership rather than a fixed IP mapping.
   2. B. User access follows the physical interface's MAC address regardless of identity.
   3. C. Every user receives access according only to the current subnet's trust level.
   4. D. Every user's group membership is replaced by a permanent IP address.

   Answer: A

   Explanation: The guide states, "JIMS allows administrators to control the access to firewall policies using group memberships". Its automated user/device-to-IP correlation supports access as addresses change, rather than binding authorization permanently to an old address.

   Reference: Juniper Identity Management Service User Guide — p. 2, Benefits of JIMS, Reduced administrative tasks

6. 6Which pairing correctly identifies the protection roles of the two SSL proxy types on an SRX?

   1. A. Forward protects internal servers; reverse protects internal clients.
   2. B. Forward protects internal clients; reverse protects internal servers.
   3. C. Forward protects both sides; reverse is limited to management traffic.
   4. D. Forward is limited to management traffic; reverse protects both sides.

   Answer: B

   Explanation: The guide identifies "Client-protection SSL proxy also known as forward proxy" and "Server-protection SSL proxy also known as reverse proxy". Forward handles locally initiated outbound sessions; reverse handles externally initiated sessions to local servers.

   Reference: SSL Proxy — Types of SSL Proxy

7. 7What is included in the Junos Space virtual appliance used to host Junos Space Security Director?

   1. A. Only a Security Director application package for an existing Windows server
   2. B. Only a firewall data-plane image without management services
   3. C. Preconfigured Network Management Platform software, operating system, and application stack
   4. D. An empty virtual machine definition without platform software

   Answer: C

   Explanation: The installation guide states, "The Junos Space virtual appliance consists of preconfigured Junos Space Network Management Platform software with a built-in operating system and application stack". This is the management-platform appliance, not an empty VM or a firewall image.

   Reference: Security Director Installation Overview — Security Director Installation Overview, Junos Space Virtual Appliance

8. 8An IDP detector flags a malformed protocol message because it deviates from the applicable RFC. Which attack-object type provides this detection?

   1. A. Signature attack object
   2. B. Custom attack group
   3. C. Protocol anomaly attack object
   4. D. Predefined attack group

   Answer: C

   Explanation: The guide explains, "Protocol anomaly detection works by finding deviations from protocol standards, most often defined by RFCs and common RFC extensions." The decision is based on protocol conformance rather than a signature or group membership.

   Reference: IDP Policy Rules and IDP Rule Bases — Understand IDP Policy Rules > IDP Rule Objects > Table 1, Protocol Anomaly Attack Objects

9. 9What does enabling perfect forward secrecy add to IKEv1 Phase 2 key generation?

   1. A. Reuse of the preceding Phase 2 keys
   2. B. A new Diffie-Hellman exchange for each Phase 2 tunnel
   3. C. Replacement of peer authentication with sequence checks
   4. D. Elimination of the need for Phase 1 negotiation

   Answer: B

   Explanation: The guide states, "PFS addresses this security risk by forcing a new DH key exchange to occur for each Phase 2 tunnel." This makes Phase 2 keys independent; it does not eliminate Phase 1 or peer authentication.

   Reference: IPsec VPN User Guide — pp. 6–7, Perfect Forward Secrecy

10. 10Which ATP Cloud feed identifies remote servers associated with botnet command and control?

    1. A. C&C cloud feed
    2. B. GeoIP cloud feed
    3. C. Infected host cloud feed
    4. D. Allowlist cloud feed

    Answer: A

    Explanation: The guide states, "C&C feeds are essentially a list of servers that are known C&C for botnets." GeoIP identifies geographic regions, infected-host feeds identify potentially compromised local endpoints, and allowlists identify trusted addresses.

    Reference: Juniper ATP Cloud Administrator Guide — p. 5, Table 1, C&C cloud feeds