Juniper Networks Certified Internet Specialist, SEC (JNCIS-SEC) Set 3

All interfaces in a zone must belong to the same routing instance. ✘ All interfaces in a routing instance must belong to the same zone. ✘ All interfaces in a zone must be in inet.0. ✘ Each interface in a VR must belong to a unique security zone. ✔

zones ✘ policies ✘ address book ✘ NAT configuration ✔

A TCP RST is sent and the session is restarted. ✘ The TCP connection is closed gracefully and the data content is dropped. ✘ TCP traffic is allowed and an SNMP trap is sent. ✘ AV scanning is restarted. ✔

The implicit default security policy permits all traffic. ✘ Traffic destined to the device itself always requires a security policy. ✘ Traffic destined to the device's incoming interface does not require a security policy. ✘ The factory-default configuration permits all traffic from all interfaces. ✔

You cannot assign an interface to a functional zone. ✘ You can specifiy a functional zone in a security policy. ✘ Security zones must have a scheduler applied. ✘ You can use a security zone for traffic destined for the device itself. ✔

Both DoS and propagation attacks exploit and take control of all unprotected network devices. ✘ Propagation attacks focus on suspicious packet formation using the DoS SYN-ACK-ACK proxy flood. ✘ DoS attacks are directed at the network protection devices, while propagation attacks are directed at the servers. ✘ DoS attacks are exploits in nature, while propagation attacks use trust relationships to take control of the devices. ✔

when one of the tunnel peers has a dynamic IP address ✘ when one of the tunnel peers wants to force main mode to be used ✘ when fragmentation of the IKE packet is required between the two peers ✘ when one of the tunnel peers wants to specify a different phase 1 proposal ✔

VPN establishment ✘ packet-based forwarding ✘ stateful packet processing ✘ Network Address Translation ✔

Route entry for the session changed. ✘ Security policy for the session changed. ✘ The ARP table entry for the source IP address timed out. ✘ No traffic matched the session during the timeout period. ✔

transit zone ✘ default zone ✘ security zone ✘ functional zone ✔