JN0-336 Exam Dumps - Security, Specialist (JNCIS-SEC)

The correct answers are B and C. Adaptive Threat Profiling allows SRX Series Firewalls to act either as inline enforcement devices or as tap-based sensors. In an inline deployment, the SRX is directly in the traffic path and can enforce policy actions such as blocking, denying, or adding threat indicators to Security Intelligence feeds for real-time mitigation. In a tap deployment, the SRX observes copied traffic from a TAP/SPAN-style feed and contributes intelligence without being the active forwarding device. Juniper’s ATP Cloud documentation states that Adaptive Threat Profiling enables SRX devices to be deployed as sensors on Tap ports, identifying and sharing intelligence to inline devices for real-time enforcement. It also describes a “Tap-based SRX Series Firewall sensor” and contrasts it with an inline device.

Option A, bridge, is not the deployment mode being tested here. Bridge/transparent forwarding is a firewall deployment style, not the named Adaptive Threat Profiling mode. Option D, promiscuous, is also wrong; promiscuous mode is an interface behavior, not the ATP Adaptive Threat Profiling deployment model. Reference topics: ATP Cloud, Adaptive Threat Profiling, tap sensors, inline enforcement, Security Intelligence feeds.

The correct answers are A and D. Juniper documentation describes domain PC probing as a supplement to event-log reading. When a user logs in to the domain, the domain controller event log normally provides the user-to-IP mapping. If that IP address-to-username mapping is not available from the event log, JIMS initiates a domain PC probe to the endpoint to obtain the active username and domain. JIMS can also use probes to determine a device’s status after the logged-in state expires, so the operational idea is not blind periodic probing; it is used to resolve or validate identity state when normal event-log information is missing or stale.

Option D is correct because the result of identity collection is reported back to SRX Series devices. JIMS generates reports containing IP address, username, and group relationship information, keeps a list of reports communicated to SRX devices, and sends those reports so SRX devices can create authentication-table entries for identity-aware policy enforcement. Options B and C are wrong because the tested PC-probe behavior is not “every 30 seconds” or “every 60 seconds.” Those values confuse PC probing with other timers or query intervals. Reference topics: JIMS, domain PC probing, event-log identity mapping, SRX authentication table, identity-aware security policies.

The correct answers are A and D. In IKEv1-based IPsec VPNs, there are two distinct negotiation phases. IKEv1 Phase 1 establishes the secure and authenticated IKE channel between peers. That means the IKE SA is built during Phase 1. Juniper describes Phase 1 as the negotiation of proposals for how to authenticate and secure the channel, including encryption algorithms, authentication algorithms, Diffie-Hellman group, and authentication method.

IKEv1 Phase 2 then uses that secure channel to negotiate the IPsec SAs that protect actual user traffic through the VPN. Juniper states that Phase 2 negotiates security associations to secure the data traversing the IPsec tunnel, and that the Phase 2 proposal includes the security protocol, such as ESP or AH, plus the selected encryption and authentication algorithms. Option B is wrong because IKEv1 SAs are not established in Phase 2; Phase 2 creates IPsec SAs. Option C is wrong because Phase 1 does not create the data-plane IPsec SA; it creates the secure IKE control channel used for Phase 2 negotiation. Reference topics: IPsec VPN, IKEv1 Phase 1, IKE SA, IKEv1 Phase 2, IPsec SA, ESP/AH proposals.