Free Juniper JN0-696 Exam Dumps Questions & Answers

Users at a branch office report that they cannot reach an internal Web server. The users connect through a single SRX Series device to reach the Web server. A security policy has been configured on the device that allows traffic to flow between interfaces in the Trust zone.
What is causing this problem?

• A.There is an antispam configuration problem.
• B.The interface on the device that connects to the Web server is not in the Trust zone.
• C.The IPsec VPN connection between the users and the Web server is down.
• D.There is a host inbound traffic configuration problem.

-- Exhibit --
[edit]
user@SRX-1# show security ike traceoptions
file ike-trace;
flag all;
[edit]
user@SRX-1# show security ipsec traceoptions
flag all;
user@SRX-1> show log ike-trace
...
Jun 13 17:00:33 :500 (Responder) -> 192.168.1.11:500 { 15276b72 6656c3b6 - 4ea713e7
d2487276 [1] / 0x9828a32e } QM; Invalid protocol_id = 0
Jun 13 17:00:34 Received authenticated notification payload unknown from local:192.168.1.10 remote:192.168.1.11 IKEv1 for P1 SA 3075335 Jun 13 17:00:34 iked_pm_ike_spd_notify_receiveD. Negotiation is already failed. Reason: TS
unacceptable.
Jun 13 17:00:34 QM notification `(null)' (40001) (size 8 bytes) from 192.168.1.11 for protocol
Reserved spi[0...3]=0f f0 ce d3
Jun 13 17:00:34 ike_st_i_private: Start
Jun 13 17:00:34 ike_st_o_qm_hash_2: Start
Jun 13 17:00:34 ike_st_o_qm_sa_values: Start
Jun 13 17:00:34 :500 (Responder) -> 192.168.1.11:500 { 15276b72 6656c3b6 - 4ea713e7
d2487276 [1] / 0x9828a32e } QM; Error = No proposal chosen (14)
Jun 13 17:00:34 ike_alloc_negotiation: Start, SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276}
Jun 13 17:00:34 ike_encode_packet: Start, SA = { 0x15276b72 6656c3b6 - 4ea713e7 d2487276 }
/ 65407839, nego = 2
Jun 13 17:00:34 ike_send_packet: Start, send SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276},
nego = 2, dst = 192.168.1.11:500, routing table id = 0
Jun 13 17:00:34 ike_delete_negotiation: Start, SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276},
nego = 2 Jun 13 17:00:34 ike_free_negotiation_info: Start, nego = 2 Jun 13 17:00:34 ike_free_negotiation: Start, nego = 2 Jun 13 17:00:34 IPSec negotiation failed for SA-CFG Unknown for local:192.168.1.10,
remote:192.168.1.11 IKEv1. status: TS unacceptable Jun 13 17:00:34 P2 ed info: flags 0x0, P2 error: TS unacceptable Jun 13 17:00:34 iked_pm_ipsec_sa_done: Phase2 failed 2/3 times for P1 SA 3075335 -- Exhibit -
Click the Exhibit button.
The IPsec tunnel is not establishing between SRX-1 and a remote device.
Referring to the exhibit, what is causing this problem?

• A.IKE Phase 1 IKE ID mismatch
• B.IKE Phase 2 proxy ID mismatch
• C.IKE Phase 1 proposals mismatch
• D.IKE Phase 2 proposals mismatch

Your SRX Series device has the following configuration:
user@host> show security policies
...
Policy: my-policy, State: enabled, Index: 5, Sequence number: 1
Source addresses: any Destination addresses: any
Applications: snmp
Action: reject
From zone: trust, To zone: untrust
...
When traffic matches my-policy, you want the device to silently drop the traffic; however, you notice that the device is replying with ICMP unreachable messages instead.
What is causing this behavior?

• A.the reject action
• B.the trust zone
• C.the snmp application
• D.the untrust zone

In preparation for future expansion, a user decides to configure a stand-alone SRX Series device for chassis-clustering mode. The user enters the command set chassis cluster cluster-id 0 node 0 reboot on the device. After the device reboots, the user sees this output:
user@host> show chassis cluster status
error: Chassis cluster is not enabled.
user@host>
The device does not enter chassis-clustering mode.
What is the problem?

• A.Node ID 0 is not valid for a chassis cluster.
• B.Cluster ID 0 is not valid for a chassis cluster.
• C.An SRX Series device will only enter chassis-clustering mode when it finds a peer that is also configured for chassis-clustering mode.
• D.An SRX Series device will not enter chassis-clustering mode unless the fxp0 and fxp1 interfaces are defined in the configuration.

-- Exhibit --
user@host> show log ibgp-trace
...
Jun 12 10:21:08 10:21:08.367627:CID-0:RT:192.168.2.1/49170->192.168.1.1/179;6> matched
filter ibgp-traffic:
Jun 12 10:21:08 10:21:08.367747:CID-0:RT:packet [64] ipid = 11792, @423f741c
Jun 12 10:21:08 10:21:08.367747:CID-0:RT:---- flow_process_pkt: (thd 2): flow_ctxt type 15,
common flag 0x0, mbuf 0x423f7200, rtbl_idx = 0
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: flow process pak fast ifl 71 in_ifp ge-0/0/3.0
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: ge-0/0/3.0:192.168.2.1/49170->192.168.1.1/179,
tcp, flag 2 syn
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: find flow: table 0x4f161150, hash 15898(0xffff), sa 192.168.2.1, da 192.168.1.1, sp 49170, dp 179, proto 6, tok 7 Jun 12 10:21:08 10:21:08.367747:CID-0:RT: no session found, start first path. in_tunnel - 0,
from_cp_flag - 0 Jun 12 10:21:08 10:21:08.367747:CID-0:RT: flow_first_create_session Jun 12 10:21:08 10:21:08.367747:CID-0:RT:Doing DESTINATION addr route-lookup
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: routed (x_dst_ip 192.168.1.1) from trust (ge-0/0/3.0 in 0) to lo0.0, Next-hop: 92.168.1.1 Jun 12 10:21:08 10:21:08.367747:CID-0:RT:flow_first_policy_search: policy search from zone
trust-> zone loopback-zone (0x0,0xc01200b3,0xb3)
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: policy has timeout 900
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: app 0, timeout 1800s, curr ageout 20s
Jun 12 10:21:08 10:21:08.367747:CID-0:RT: permitted by policy allow-bgp(8)
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: flow_first_install_session======> 0x5394a110
Jun 12 10:21:08 10:21:08.368250:CID-0:RT:flow_first_service_lookup(): natp(0x5394a110):
app_id, 0(0).
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: service lookup identified service 0.
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: flow_first_final_check: in 0/3.0>, out
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: existing vector list 2-49c75930.
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: Session (id:137) created for first pak 2
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: post addr xlation: 192.168.2.1->192.168.1.1.
Jun 12 10:21:08 10:21:08.368250:CID-0:RT:check self-traffic on lo0.0, in_tunnel 0x0
Jun 12 10:21:08 10:21:08.368250:CID-0:RT:retcode: 0xa01
Jun 12 10:21:08 10:21:08.368250:CID-0:RT:pak_for_self : proto 6, dst port 179, action 0x0
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: flow_first_create_session
Jun 12 10:21:08 10:21:08.368250:CID-0:RT: flow_first_in_dst_nat: in , out A> dst_adr
192.168.1.1, sp 49170, dp 179
Jun 12 10:21:08 10:21:08.368752:CID-0:RT: chose interface lo0.0 as incoming nat if.
Jun 12 10:21:08 10:21:08.368752:CID-0:RT: packet droppeD. for self but not interested
Jun 12 10:21:08 10:21:08.368752:CID-0:RT: packet dropped, packet droppeD. for self but not
interested.
Jun 12 10:21:08 10:21:08.368752:CID-0:RT: flow find session returns error.
Jun 12 10:21:08 10:21:08.368752:CID-0:RT: ----- flow_process_pkt rc 0x7 (fp rc -1)
-- Exhibit --
Click the Exhibit button.
You are asked to troubleshoot a new IBGP peering problem on your SRX Series device. The IBGP peering is not establishing.
Referring to the outputs in the exhibit, what is causing the problem?

• A.The host inbound traffic configuration does not include the BGP parameter.
• B.The loopback interface does not have the correct IP address assigned to it.
• C.The traffic is not being accepted by the security policy.
• D.NAT is translating the destination IP addresses.