JN0-336 Exam Dumps - Security, Specialist (JNCIS-SEC)

The correct answers are A and C. To use user identity information on an SRX Series Firewall, the firewall must first be able to obtain identity mappings from an identity source or identity provider, such as Active Directory, JIMS, Aruba ClearPass, or another supported identity-aware firewall component. Juniper’s identity-aware firewall documentation states that identity parameters are used to configure security policies so authenticated users receive the correct level of access, and that firewalls can query JIMS, obtain user identity information, and then enforce security policy decisions.

Option A is required because identity-aware enforcement only happens when security policies include user identity match criteria, such as source identity, users, roles, or groups. Juniper’s source-identity policy reference states that source identities are used as match criteria in security policies, and when configured, traffic is matched against authentication-table entries before policy lookup completes. Option C is required because the SRX must be configured with an identity source/provider so it can populate or query identity mappings. Option B is not an SRX configuration task and is not generally required because users may already exist in appropriate AD groups. Option D is wrong for this question; the required SRX tasks are configuring identity integration and identity-aware policies, not adding a separate “user identity” license. Reference topics: Identity-Aware Security Policies, identity source/provider, authentication table, source-identity policy matching.

The correct answers are B and D. In VPN cryptography, hashing is used for authentication and integrity checking, not confidentiality. Juniper’s IPsec documentation describes MD5 as producing a 128-bit hash, also called a digital signature or message digest, from a message of arbitrary length. It also describes SHA as producing a 160-bit hash from a message of arbitrary length. That directly supports option B because a hash function takes variable-length input and produces a fixed-size digest.

Option D is also correct because Juniper states that the resulting hash is used like a fingerprint of the input to verify content and source authenticity and integrity. Juniper’s IPsec overview further explains that Junos compares the calculated message digest against the expected digest to verify that the message has not been tampered with.

Option A is wrong because hashing is not compression; it is one-way digest generation. Option C is wrong because encryption protects confidentiality, while hashing validates integrity and authenticity. In IPsec, algorithms such as AES, DES, and 3DES provide encryption, while MD5, SHA-1, and SHA-2 provide hashing/HMAC-based authentication. Reference topics: IPsec VPN, hashing, HMAC, MD5, SHA, message digest, data integrity.

The correct answer is B. The IPsec VPN is established, and traffic is passing through . The exhibit shows nonzero ESP encrypted bytes , ESP decrypted bytes , encrypted packets , and decrypted packets . On an SRX Series Firewall, those counters indicate that the device is both encrypting outbound traffic into the IPsec tunnel and decrypting inbound ESP traffic from the remote peer. Juniper’s show security ipsec statistics reference identifies ESP statistics as the counters for encrypted/decrypted bytes and packets, and Juniper troubleshooting guidance states that incrementing encrypted and decrypted packet counters confirm traffic flow across the VPN.

Option A is wrong because the error counters show AH authentication failures: 0, Replay errors: 0, ESP authentication failures: 0, ESP decryption failures: 0, Bad headers: 0, and Bad trailers: 0. Option C is wrong because encrypted and decrypted ESP packet counters would not increment if the IPsec tunnel were not established. Option D is wrong because traffic is clearly passing; the nonzero ESP counters prove packet movement through the tunnel. Reference topics: IPsec VPN, ESP statistics, encrypted/decrypted counters, tunnel verification, IPsec troubleshooting.

The correct answers are A and D. In IKEv1-based IPsec VPNs, there are two distinct negotiation phases. IKEv1 Phase 1 establishes the secure and authenticated IKE channel between peers. That means the IKE SA is built during Phase 1. Juniper describes Phase 1 as the negotiation of proposals for how to authenticate and secure the channel, including encryption algorithms, authentication algorithms, Diffie-Hellman group, and authentication method.

IKEv1 Phase 2 then uses that secure channel to negotiate the IPsec SAs that protect actual user traffic through the VPN. Juniper states that Phase 2 negotiates security associations to secure the data traversing the IPsec tunnel, and that the Phase 2 proposal includes the security protocol, such as ESP or AH, plus the selected encryption and authentication algorithms. Option B is wrong because IKEv1 SAs are not established in Phase 2; Phase 2 creates IPsec SAs. Option C is wrong because Phase 1 does not create the data-plane IPsec SA; it creates the secure IKE control channel used for Phase 2 negotiation. Reference topics: IPsec VPN, IKEv1 Phase 1, IKE SA, IKEv1 Phase 2, IPsec SA, ESP/AH proposals.

The correct answers are B, D, and E. Security Director device onboarding depends on management reachability and valid administrative access. Juniper’s device discovery documentation states that Junos Space discovers network devices using SSH, with optional ping and SNMP, and connects to the physical device to retrieve running configuration and status information. It also explains that device authentication uses administrator login credentials, SSH credentials, SNMP settings, or keys depending on the discovery method.

Option E is required because Security Director must target a reachable management IP address or hostname. Juniper’s discovery-profile workflow explicitly uses the target IP address, hostname, IP range, or subnet to locate devices. Option D is required because invalid username/password or insufficient privileges prevent discovery and management; Juniper’s device-management guidance identifies credentials as required input for discovering devices. Option B is required because onboarding uses SSH, so the correct SSH service and port must be reachable. Juniper’s device access procedure explicitly includes a Port field for the SSH connection.

Option A is wrong because chassis serial number is not the normal troubleshooting field for Security Director discovery. Option C is wrong because active security policies do not determine whether Security Director can initially discover and onboard the device. Reference topics: Security Director, device discovery, SSH access, management IP reachability, authentication credentials.