JN0-336 Practice Questions

The correct answers are C and

D.  

Once the SSL proxy profile already exists, the SRX still needs a security policy that matches the SSL/TLS traffic and applies the SSL proxy profile as an application service. Juniper’s SSL proxy configuration procedure explicitly shows creating the security policy match criteria and then applying the SSL proxy profile with then permit application-services ssl-proxy profile-name. It also states that SSL forward and reverse proxy require the profile to be configured at the firewall rule level.

Option D is correct because SSL proxy is not an end goal by itself; it decrypts SSL/TLS traffic so Layer 7 security services can inspect it. Juniper states that decrypted SSL traffic is available for security services and provides examples where the SSL proxy profile and a Content Security/UTM policy are both attached to the same security policy. Option A is wrong because host-inbound-traffic HTTPS controls HTTPS access to the SRX itself, not transit SSL proxy inspection. Option B is wrong because SSL proxy profiles are not referenced under a security zone for this function; they are applied under the matching security policy. Reference topics: SSL Proxy, SSL proxy profile, security policy application-services, Layer 7 inspection, UTM/IDP/ATP integration.

The correct answers are A, B, and

D.  

In Security Director, the Shared Objects workspace is used for reusable objects that can be referenced by policies across managed devices. Juniper documentation shows that address objects are created from Configure > Shared Objects > Addresses, and those address objects can be used across devices in firewall, NAT, IPS, and VPN services. This supports option B, because IP address/address objects are classic shared objects.

Option A is correct because Geo IP policies are created from Configure > Shared Objects > Geo IP. Juniper’s procedure explicitly places Geo IP under the Shared Objects path. Option D is also correct because policy enforcement groups are created from Configure > Shared Objects > Policy Enforcement Groups and are used to group endpoints such as IP addresses, subnets, or locations for policy-enforcement workflows.

Option C is wrong because audit logs are monitoring records, not reusable shared objects; Juniper places them under Monitor > Audit Logs, where they track login history and user-initiated tasks. Option E is wrong because policy rules are created and managed inside firewall, NAT, IPS, or threat policies, not as independent Shared Objects. Reference topics: Security Director, Shared Objects, address objects, Geo IP, policy enforcement groups.

The correct answers are B and

D.  

A terminal rule is specifically designed to stop further rule evaluation. Juniper states that the IDP rule-matching algorithm normally checks traffic against all matching rules in the rulebase, but when a terminal rule matches the source, destination, zones, and application, IDP does not continue to check subsequent rules for that same traffic. Juniper also warns that traffic matching a terminal rule is not compared to later rules even if it does not match the attack object inside that terminal rule.

Option D is also correct because the Ignore Connection action stops scanning traffic for the rest of the connection if an attack match is found. Juniper defines Ignore Connection as disabling the rulebase for that specific connection after a match. Option A is wrong because a close action closes the connection by sending reset behavior, but it is not the rule-processing control mechanism being tested. Option C is a trap: the exempt rulebase is used to suppress known false positives after an IPS rule match, but the two direct mechanisms that end IDP rule processing are terminal rule matching and ignore connection. Reference topics: IDP rulebases, terminal rules, Ignore Connection action, rule-matching algorithm, false-positive exemption.

The correct answers are A and

C.  

To log denied traffic on an SRX Series Firewall, the security policy must deny the traffic and must generate a log at session initiation. Juniper’s security policy monitoring documentation states that to view logs from denied connections, you enable logging on session-init. Juniper’s traffic-logging guidance also states that for a security policy with a deny action, traffic logs must be generated when a session starts.

Option C is required because the policy action must be deny; otherwise the traffic is not denied by that policy. Option A is required because denied traffic does not complete a normal permitted session lifecycle, so session-init is the correct logging stage for denied connection attempts. Option B, session-close, is used to log permitted sessions after teardown or conclusion; it is not the required parameter for denied traffic. Option D, count, increments policy counters but does not create traffic logs. The correct configuration concept is: match the unwanted traffic, apply then deny, and enable then log session-init. Reference topics: SRX security policies, deny action, session-init logging, traffic log generation, policy counters.

The correct answers are A and

C.  

Juniper ATP Cloud uses a malware-analysis pipeline. When a file is submitted, the first step is a cache lookup based on the file hash. Juniper explains that if the file has already been analyzed, the stored verdict is returned to the SRX Series Firewall and there is no need to re-analyze the file. That directly supports C and eliminates B, because analysis does not continue when a cached verdict is found.

If the cache lookup does not return a verdict, the remaining ATP Cloud analysis techniques are used. Juniper describes the pipeline model in which each analysis technique creates a verdict number, and those verdicts are combined into a final verdict score from 0 to 10. That final threat score is what the SRX compares against ATP Cloud policy settings to permit or block the session.

Option D is wrong because ATP Cloud does not simply return the first score generated by any one feature. The expected behavior is cumulative/final scoring across the remaining analysis pipeline. Reference topics: Juniper ATP Cloud, malware analysis pipeline, cache lookup, verdict number, threat score, SRX enforcement.