最新なJuniper JN0-331問題集（131題）、真実試験の問題を全部にカバー！

質問 1：
Regarding a route-based versus policy-based IPsec VPN, which statement is true?
A. A route-based VPN is better suited for dialup or remote access compared to a policy-based VPN.
B. A route-based VPN cannot have a deny action in a policy; a policy-based VPN can have a deny action.
C. A route-based VPN uses a policy referencing the IPsec VPN; a policy-based VPN policy does not use a policy referencing the IPsec VPN.
D. A route-based VPN generally uses less resources than a policy-based VPN.
正解：D

質問 2：
Click the Exhibit button.
[edit security nat destination]
user@host# show
pool A {
address 10.1.10.5/32;
}
rule-set 1 {
from zone untrust;
rule 1A {
match {
destination-address 100.0.0.1/32;
}
then {
destination-nat pool A;
}}}
Which type of source NAT is configured in the exhibit?
A. static destination NAT
B. static source NAT
C. pool-based destination NAT with PAT
D. pool-based destination NAT without PAT
正解：D

質問 3：
Which attribute is required for all IKE phase 2 negotiations?
A. main or aggressive mode
B. preshared key
C. Diffie-Hellman group key
D. proxy-ID
正解：D

質問 4：
Click the Exhibit button.
[edit security policies]
user@host# show
from-zone Private to-zone External {
policy MyTraffic {
match {
source-address myHosts;
destination-address ExtServers;
application [ junos-ftp junos-bgp ];
}
then {
permit {
tunnel {
ipsec-vpn vpnTunnel;
}}}}}
policy-rematch;
In the exhibit, you decided to change myHosts addresses.
What will happen to the new sessions matching the policy and in-progress sessions that had
already matched the policy?
A. New sessions will be evaluated. In-progress sessions will be re-evaluated.
B. New sessions will be evaluated. All in-progress sessions will continue.
C. New sessions will halt until all in-progress sessions are re-evaluated. In-progress sessions will be re-evaluated and possibly dropped.
D. New sessions will be evaluated. All in-progress sessions will be dropped.
正解：A

質問 5：
Which two external authentication server types are supported by JUNOS Software for firewall user authentication? (Choose two.)
A. TACACS+
B. RADIUS
C. IIS
D. LDAP
正解：B,D

質問 6：
Which configuration shows a pool-based source NAT without PAT'?
A. [edit security nat source]
user@host# show
pool A {
address {207.17.137.1/32 to 207.17.137.254/32;
}
overflow-pool interface;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
}}}
B. [edit security nat source]
user@host# show
pool A {
address { 207.17.137.1/32 to 207.17.137.254/32;
}}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
port no-translation;
}}
}
C. [edit security nat source]
user@host# show
pool A {
address {207.17.137.1/32 to 207.17.137.254/32;
}
port no-translation;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
}}}
D. [edit security nat source]
user@host# show
pool A {
address { 207.17.137.1/32 to 207.17.137.254/32;
}
overflow-pool interface;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
port no-translation;
}}}
正解：C

質問 7：
Click the Exhibit button.
[edit security]
user@host# show
ike {
policy ike-policy1 {
mode main;
proposal-set standard;
pre-shared-key ascii-text "$9$GFjm5OBEclM5QCuO1yrYgo"; ## SECRET-DATA
}
gateway remote-ike {
ike-policy ike-policy1;
address 172.19.51.170;
external-interface ge-0/0/3.0;
}}
ipsec {
policy vpn-policy1 {
proposal-set standard;
}
vpn remote-vpn {
ike {
gateway remote-ike;
ipsec-policy vpn-policy1;
}}}
Assuming you want to configure a route-based VPN, which command is required to bind the VPN
to secure tunnel interface st0.0?
A. set ipsec policy vpn-policy1 bind-interface st0.0
B. set ike gateway remote-ike bind-interface st0.0
C. set ike policy ike-policy1 bind-interface st0.0
D. set ipsec vpn remote-vpn bind-interface st0.0
正解：D