QUESTION: 17

To analyze and detect malware, Juniper ATP Cloud performs which two functions? (Choose two.)

cache lookup: to see if the file is seen already and known to be malicious
antivirus scan: with a single vendor solution to see if the file contains any potential threats
dynamic analysis: to see what happens if you execute the file in a real environment
static analysis: to see what happens if you execute the file in a real environment

Answer(s): A,C

Explanation:

Juniper ATP Cloud performs cache lookup to see if the file is seen already and known to be malicious and dynamic analysis to see what happens if you execute the file in a real environment.

Cache lookup is one of the functions that Juniper ATP Cloud performs to analyze and detect malware. Cache lookup is the first step in the pipeline approach that Juniper ATP Cloud uses to examine files. Cache lookup checks whether the file has been seen before and whether it has a stored verdict in the database. If the file is known to be malicious, the verdict is returned to the SRX Series Firewall and the file is dropped. If the file is not found in the cache, the analysis continues with the other techniques.
Dynamic analysis is another function that Juniper ATP Cloud performs to analyze and detect malware. Dynamic analysis runs the file in a sandbox environment and observes its behavior and actions. Dynamic analysis can reveal the hidden or obfuscated functionality of malware, such as network connections, file modifications, registry changes, and process injections. Dynamic analysis can also detect zero-day threats and evasive malware that try to avoid static analysis.

Reference:

How is Malware Analyzed and Detected? | ATP Cloud | Juniper Networks

Reveal Solution Next Question

QUESTION: 18

Exhibit

You are validating bidirectional traffic flows through your IPsec tunnel. The 4546 session represents traffic being sourced from the remote end of the IPsec tunnel. The 4547 session represents traffic that is sourced from the local network destined to the remote network.
Which statement is correct regarding the output shown in the exhibit?

The remote gateway address for the IPsec tunnel is 10.20.20.2
The session information indicates that the IPsec tunnel has not been established
The local gateway address for the IPsec tunnel is 10.20.20.2
NAT is being used to change the source address of outgoing packets

Answer(s): C

Explanation:

According to the output shown in the exhibit, which is a security flow session on an SRX Series device, the correct statement is that the local gateway address for the IPsec tunnel is 10.20.20.2. This is indicated by the line In: 10.20.20.2/2060 -> 10.20.20.1/3382, which shows that the source IP address of the incoming packet is 10.20.20.2, which is the local gateway address of the IPsec tunnel. The destination IP address of the incoming packet is 10.20.20.1, which is the remote gateway address of the IPsec tunnel.
The following statements are incorrect or not supported by the output:
The remote gateway address for the IPsec tunnel is 10.20.20.2. This is false, as explained above. The remote gateway address for the IPsec tunnel is 10.20.20.1, not 10.20.20.2. The session information indicates that the IPsec tunnel has not been established. This is false, as the output shows that there are two active sessions with the communication tag IPSec VPN: vpn1, which indicates that the IPsec tunnel has been established and is named vpn. NAT is being used to change the source address of outgoing packets. This is not supported by the output, as there is no indication of NAT being applied to the outgoing packets. The source IP address of the outgoing packet is 192.168.1.1, which is the same as the source IP address of the original packet. If NAT was being used, the source IP address of the outgoing packet would be different from the source IP address of the original packet.

Reference:

1: show security flow session - Technical Documentation - Support - Juniper Networks

Reveal Solution Next Question

QUESTION: 19

Exhibit

Which two statements are correct about the output shown in the exhibit? (Choose two.)

The packet is silently discarded.
The packet is part of an existing session.
The packet is part of a new session.
The packet is explicitly rejected.

Answer(s): A,C

Explanation:

The packet is silently discarded because the traceoptions output shows that the packet is dropped with the flag flow_spu_drop, which indicates that the packet is dropped by the SPU without sending any response to the sender. The traceoptions output also shows the reason for the drop as "no session found, start first path. in_tunnel - 0, from_cp_flag - 0" which means that the packet does not match any existing session and is not part of a tunnel or a control plane traffic. The packet is part of a new session because the traceoptions output shows that the packet is the first packet of a TCP connection with the flag flow_tcp_syn, which indicates that the packet has the SYN flag set. The traceoptions output also shows that the packet is processed in the first path packet flow with the message "no session found, start first path" which means that the packet is initiating a new session.

Reference:

traceoptions (Security Flow) | Junos OS | Juniper Networks [SRX] How to interpret Flow TraceOptions output for NAT troubleshooting

Reveal Solution Next Question

QUESTION: 20

You are asked to provide single sign-on (SSO) to Juniper ATP Cloud.
Which two steps accomplish this goal? (Choose two.)

Configure Microsoft Azure as the service provider (SP).
Configure Microsoft Azure as the identity provider (IdP).
Configure Juniper ATP Cloud as the service provider (SP).
Configure Juniper ATP Cloud as the identity provider (IdP).

Answer(s): B,C

Explanation:

To provide single sign-on (SSO) to Juniper ATP Cloud, you need to configure the following:
Microsoft Azure as the identity provider (IdP): This allows users to authenticate to Juniper ATP Cloud using their Azure credentials.
Juniper ATP Cloud as the service provider (SP): This allows Juniper ATP Cloud to accept the authentication from Microsoft Azure and provide SSO access to the users. Configuring Microsoft Azure as the service provider (SP) and Juniper ATP Cloud as the identity provider (IdP) are not the correct steps to provide SSO, as the roles are reversed.

Reveal Solution Next Question

Free JN0-636 Exam Braindumps (page: 6)

QUESTION: 17

Explanation:

Reference:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation:

JN0-636 Discussions & Posts