Free Juniper JN0-331 Practice Test & Real Exam Questions

Exam Code/Number: JN0-331
Exam Name/Title: SEC,Specialist(JNCIS-SEC)
Certification Provider: Juniper
Corresponding Certification: JNCIS

Exam Questions: 131
Updated On: Oct 07, 2026

Question #10

Which three options represent IDP policy match conditions? (Choose three.)

A. destination-address

B. service

C. to-zone

D. attacks

E. port

Discussion 0

Correct Answer: A,C,D Vote an answer

Question #11

Click the Exhibit button.

Based on the exhibit, client PC 192.168.10.10 cannot ping 1.1.1.2. Which is a potential cause for this problem?

A. No security policy exists for the ICMP reply packet from the untrust zone to the trust zone.

B. The security policy from the trust zone to the untrust zone does not permit ping.

C. The trust zone does not have ping enabled as a host-inbound-traffic service.

D. The untrust zone does not have a management policy configured.

Discussion 0

Correct Answer: B Vote an answer

Question #12

You want to allow your device to establish OSPF adjacencies with a neighboring device connected to interface ge-0/0/3.0. Interface ge-0/0/3.0 is a member of the HR zone. Under which configuration hierarchy must you permit OSPF traffic?

A. [edit security zones protocol-zone HR host-inbound-traffic]

B. [edit security policies from-zone HR to-zone HR]

C. [edit security zones security-zone HR host-inbound-traffic protocols]

D. [edit security zones functional-zone management protocols]

Discussion 0

Correct Answer: C Vote an answer

Question #13

You must configure a SCREEN option that would protect your device from a session table flood. Which configuration meets this requirement?

A. [edit security screen]
user@hostl# show
ids-option protectFromFlood {
icmp {
ip-sweep threshold 5000;
flood threshold 2000;
}}

B. [edit security screen]
user@hostl# show
ids-option protectFromFlood {
udp {
flood threshold 5000;
}}

C. [edit security screen]
user@hostl# show
ids-option protectFromFlood {
tcp {
syn-flood {
attack-threshold 2000;
destination-threshold 2000;
}}}

D. [edit security screen]
user@hostl# show
ids-option protectFromFlood {
limit-session {
source-ip-based 1200;
destination-ip-based 1200;
}}

Discussion 0

Correct Answer: D Vote an answer

Question #14

Click the Exhibit button. [edit security nat source] user@host# show
rule-set 1 {
from interface ge-0/0/2.0;
to zone untrust;
rule 1A {
match {
destination-address 1.1.70.0/24;
}
then {
source-nat interface;
}}}
Which type of source NAT is configured in the exhibit?

A. interface-based source NAT

B. static source NAT

C. pool-based source NAT without PAT

D. pool-based source NAT with PAT

Discussion 0

Correct Answer: A Vote an answer

Question #15

Which type of zone is used by traffic transiting the device?

A. security zone

B. default zone

C. functional zone

D. transit zone

Discussion 0

Correct Answer: A Vote an answer

Question #16

Which three advanced permit actions within security policies are valid? (Choose three.)

A. Mark permitted traffic for IDP processing.

B. Mark permitted traffic for firewall user authentication.

C. Associate permitted traffic with a NAT rule.

D. Associate permitted traffic with an IPsec tunnel.

E. Mark permitted traffic for SCREEN options.

Discussion 0

Correct Answer: A,B,D Vote an answer

Question #17

Which two statements regarding firewall user authentication client groups are true? (Choose two.)

A. Client groups are referenced in security policy in the same manner in which individual clients are referenced.

B. Individual clients are configured under client groups in the configuration hierarchy.

C. Client groups are configured under individual clients in the configuration hierarchy.

D. Client groups are used to simplify configuration by enabling firewall user authentication without security policy.

Discussion 0

Correct Answer: A,C Vote an answer

Question #18

Which two statements regarding external authentication servers for firewall user authentication are true? (Choose two.)

A. Up to three external authentication server types can be used simultaneously.

B. If the local password database is not configured in the authentication order, and the configured authentication server is unreachable, authentication is not performed.

C. Only one external authentication server type can be used simultaneously.

D. If the local password database is not configured in the authentication order, and the configured authentication server rejects the authentication request, authentication is not performed.

Discussion 0

Correct Answer: C,D Vote an answer

Download Free Juniper JN0-331 Demo

Simply submit your e-mail address below to get started with our free demo of your Juniper JN0-331 exam.