单选题When an SRX series device receives an ESP packet, what happens?（）AIf the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, it willBIf the destination IP address in the outer IP header of ESP does not match the IP address of the ingress interface, it willCIf the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based packet.DIf the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based of inner header, it will decrypt the packet.
单选题
When an SRX series device receives an ESP packet, what happens?（）
A
If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, it will
B
If the destination IP address in the outer IP header of ESP does not match the IP address of the ingress interface, it will
C
If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based packet.
D
If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based of inner header, it will decrypt the packet.
参考解析
解析：
暂无解析
相关考题：
When configuring a single SRX210 as a firewall enforcer to a MAG4610 active／passive cluster, which statement supports a fault－tolerant configuration?() A. The cluster VIP is defined on the MAG4610 cluster, and the VIP of the cluster is defined as an instance on the SRX Series device.B. The cluster VIP is not defined on the MAG4610 cluster, and the IP address of both the active and passive nodes of the cluster are defined as separate instances on the SRX Series device.C. The cluster VIP is defined on the MAG4610 cluster, and the IP address of the active node is defined as an instance on the SRX Series device.D. The cluster VIP is not defined on the MAG4610 cluster, and the IP address of the passive node is defined as an instance on the SRX Series device.
The SRX device receives a packet and determines that it does not match an existing session.After SCREEN options are evaluated, what is evaluated next?() A. source NATB. destination NATC. route lookupD. zone lookup
Which statement is true regarding the Junos OS for security platforms?() A. SRX Series devices can store sessions in a session table.B. SRX Series devices accept all traffic by default.C. SRX Series devices must operate only in packet-based mode.D. SRX Series devices must operate only in flow-based mode.
What is a type of firewall enforcer supported by the Junos Pulse Access Control Service?() A. Checkpoint firewallB. SRX Series deviceC. DP sensorD. MX Series device
What is the first CoS process performed when a packet enters a JUNOS device?() A.Rewrite MarkerB.Multifield ClassifierC.PolicingD.BA Classifier
What is a type of firewall enforcer supported by the Junos Pulse Access Control Service?（）A、Checkpoint firewallB、SRX Series deviceC、DP sensorD、MX Series device
You are configuring an active/passive cluster of SRX Series devices as the firewall enforcer on a MAG Series device.Which statement is true?（）A、Multiple Infranet Enforcer instances are created with a single serial number of an SRX Series device defined in each configuration.B、A single Infranet Enforcer instance is created with both serial numbers of the clustered SRX Series devices defined in the configuration.C、Multiple Infranet Enforcer instances are created with a single IP address of an SRX Series device defined in each configuration.D、A single Infranet enforcer instance is created with the VIP of the clustered SRX Series device defined in the configuration.
What are two rulebase types within an IPS policy on an SRX Series device?（） (Choose two.)A、rulebase-ipsB、rulebase-ignoreC、rulebase-idpD、rulebase-exempt
Which three components can be leveraged when defining a local whitelist or blacklist for antispam on a branch SRX Series device? (Choose three.)（）A、spam assassin filtering scoreB、sender countryC、sender IP addressD、sender domainE、sender e-mail address
Which two statements are true about the Websense redirect Web filter solution? （）(Choose two.)A、The Websense redirect Web filter solution does not require a license on the SRX device.B、The Websense server provides the SRX device with a category for the URL and the SRX device then matches the category decides to permit or deny the URL.C、The Websense server provides the SRX device with a decision as to whether the SRX device permits or denies the URL.D、When the Websense server does not know the category of the URL, it sends a request back to the SRX device SurfControl server in the cloud.
The same Web site is visited for the second time using a branch SRX Series Services Gateway configured with SurfControl integrated Web filtering.Which statement is true?（）A、The SRX device sends the URL to the SurfControl server in the cloud and the SurfControl server provides the SRX.B、The SRX device sends the URL to the SurfControl server in the cloud and the SurfControl server asks the SRX device previously visited.C、The SRX device looks at its local cache to find the category of the URL.D、The SRX device does not perform any Web filtering operation as the Web site has already been visited.
Which three are necessary for antispam to function properly on a branch SRX Series device? （）(Choose three.)A、an antispam licenseB、DNS servers configured on the SRX Series deviceC、SMTP services on SRXD、a UTM profile with an antispam configuration in the appropriate security policyE、antivirus (full or express)
When an SRX series device receives an ESP packet, what happens?（）A、If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, it willB、If the destination IP address in the outer IP header of ESP does not match the IP address of the ingress interface, it willC、If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based packet.D、If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based of inner header, it will decrypt the packet.
You are performing the initial setup of a new MAG Series device and have installed a valid CA- signed certificate on the MAG Series device. Connectivity to an existing SRX Series firewall enforcer cannot be obtained.What are two explanations for this behavior?（）A、The MAG Series device has multiple ports associated with the certificate.B、The MAG Series device's serial number needs to be configured on the SRX Series device.C、The SRX Series device must have a certificate signed by the same authority as the MAG Series device.D、The MAG Series device and SRX Series device are not synchronized to an NTP server.
单选题You are validating the configuration of your SRX Series device and see the output shown below. What does this indicate?（）A The SRX Series device has been configured correctly, the Junos Pulse Access Control Service is reachable on the network, and the SRX Series device is waiting to receive the initial connection from the Junos Pulse Access Control Service.B The SRX Series device has confirmed that the Junos Pulse Access Control Service is configured and is reachable on the network, the SRX Series device is waiting to receive the connection from the Junos Pulse Access Control Service, and all that remains to be accomplished is to configure the SRX Series device.C The SRX Series device is configured correctly and connected to the Junos Pulse Access Control Service. All that remains to be done to complete the configuration is to configure the SRX Series device on the Junos Pulse Access Control Service.D Both the Junos Pulse Access Control Service and the SRX Series device are configured correctly and communicating with each other.
单选题You are configuring an active/passive cluster of SRX Series devices as the firewall enforcer on a MAG Series device.Which statement is true?（）AMultiple Infranet Enforcer instances are created with a single serial number of an SRX Series device defined in each configuration.BA single Infranet Enforcer instance is created with both serial numbers of the clustered SRX Series devices defined in the configuration.CMultiple Infranet Enforcer instances are created with a single IP address of an SRX Series device defined in each configuration.DA single Infranet enforcer instance is created with the VIP of the clustered SRX Series device defined in the configuration.
多选题Which three situations will trigger an e-mail to be flagged as spam if a branch SRX Series device has been properly configured with antispam inspection enabled for the appropriate security policy? （）(Choose three.)AThe server sending the e-mail to the SRX Series device is a known open SMTP relay.BThe server sending the e-mail to the SRX Series device is running unknown SMTP server software.CThe server sending the e-mail to the SRX Series device is on an IP address range that is known to be dynamically assigned.DThe e-mail that the server is sending to the SRX Series device has a virus in its attachment.EThe server sending the e-mail to the SRX Series device is a known spammer IP address.
多选题Which three components can be leveraged when defining a local whitelist or blacklist for antispam on a branch SRX Series device? (Choose three.)（）Aspam assassin filtering scoreBsender countryCsender IP addressDsender domainEsender e-mail address
单选题A network administrator repeatedly receives support calls about network issues. After investigating the issues, the administrator finds that the source NAT pool is running out of addresses.To be notified that the pool is close to exhaustion, what should the administrator configure?（）AUse the pool-utilization-alarm raise-threshold under the security nat source stanza.BUse a trap-group with a category of services under the SNMP stanza.CUse an external script that will run a show command on the SRX Series device to see when the pool is close to exhaustion.DConfigure a syslog message to trigger a notification when the pool is close to exhaustion.
单选题The SRX device receives a packet and determines that it does not match an existing session.After SCREEN options are evaluated, what is evaluated next?（）Asource NATBdestination NATCroute lookupDzone lookup
单选题When configuring a single SRX210 as a firewall enforcer to a MAG4610 active/passive cluster, which statement supports a fault-tolerant configuration?（）AThe cluster VIP is defined on the MAG4610 cluster, and the VIP of the cluster is defined as an instance on the SRX Series device.BThe cluster VIP is not defined on the MAG4610 cluster, and the IP address of both the active and passive nodes of the cluster are defined as separate instances on the SRX Series device.CThe cluster VIP is defined on the MAG4610 cluster, and the IP address of the active node is defined as an instance on the SRX Series device.DThe cluster VIP is not defined on the MAG4610 cluster, and the IP address of the passive node is defined as an instance on the SRX Series device.
多选题You are performing the initial setup of a new MAG Series device and have installed a valid CA- signed certificate on the MAG Series device. Connectivity to an existing SRX Series firewall enforcer cannot be obtained.What are two explanations for this behavior?（）AThe MAG Series device has multiple ports associated with the certificate.BThe MAG Series device's serial number needs to be configured on the SRX Series device.CThe SRX Series device must have a certificate signed by the same authority as the MAG Series device.DThe MAG Series device and SRX Series device are not synchronized to an NTP server.
多选题What are two rulebase types within an IPS policy on an SRX Series device?（） (Choose two.)Arulebase-ipsBrulebase-ignoreCrulebase-idpDrulebase-exempt
单选题What is the first CoS process performed when a packet enters a JUNOS device?（）ARewrite MarkerBMultifield ClassifierCPolicingDBA Classifier
多选题Which three are necessary for antispam to function properly on a branch SRX Series device? （）(Choose three.)Aan antispam licenseBDNS servers configured on the SRX Series deviceCSMTP services on SRXDa UTM profile with an antispam configuration in the appropriate security policyEantivirus (full or express)
单选题You are installing a MAG Series device for access control using an SRX Series device as the firewall enforcer. The MAG Series device resides in the same security zone as users. However, the users reside in different subnets and use the SRX Series device as an IP gateway.Which statement is true?（）AYou must configure a security policy on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.BNo security policy is necessary on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.CYou must configure host-inbound traffic on the SRX Series device to allow SSL traffic between the MAG Series device and the user devices.DYou must configure host-inbound traffic on the SRX Series device to allow EAP traffic between the MAG Series device and the user devices.
单选题The same Web site is visited for the second time using a branch SRX Series Services Gateway configured with SurfControl integrated Web filtering.Which statement is true?（）AThe SRX device sends the URL to the SurfControl server in the cloud and the SurfControl server provides the SRX.BThe SRX device sends the URL to the SurfControl server in the cloud and the SurfControl server asks the SRX device previously visited.CThe SRX device looks at its local cache to find the category of the URL.DThe SRX device does not perform any Web filtering operation as the Web site has already been visited.