Juniper Updated JN0-336 Exam Questions and Answers by deen

The correct answers are C and D. The cSRX is Juniper’s containerized SRX firewall, intended for lightweight virtual and container environments where rapid deployment and high density matter. Juniper’s cSRX documentation lists supported security capabilities including basic firewall policy, NAT, Intrusion Detection and Prevention, content security/UTM functions, ATP Cloud, SSL Proxy, AppID, AppFW, and AppTrack. That supports option C, because cSRX provides SRX security services in a containerized footprint rather than requiring a full VM-based firewall appliance.

Option D is also correct because Juniper identifies the cSRX’s small footprint and minimum resource reservation requirements as key benefits; it is designed to scale more densely than VM-based firewall options. Juniper’s Day One cSRX guide specifically identifies faster deployment, a small footprint, and reduced resource consumption as major benefits. Option A is not the best answer for this exam item because the question asks for cSRX deployment benefits, not merely forwarding-mode support. Option B is wrong because the tested cSRX advantage is not a default three-zone configuration. Reference topics: cSRX container firewall, virtual SRX deployment, firewall/NAT/IPS/UTM services, lightweight resource footprint.

The correct answer is D. exempt. In Junos IDP, the exempt rulebase is specifically used to prevent selected traffic from triggering known false-positive detections. Juniper’s IDP documentation explains that exempt rules can be configured when an IDP policy generates false positives for a particular attack object, source, destination, or traffic pattern. The exempt rulebase lets the administrator exclude matching traffic from attack detection while still allowing the rest of the IDP policy to inspect other traffic normally.

Option A, IPS, is wrong because the IPS rulebase is the main inspection rulebase used to detect and act on attacks. It is where attack objects and actions are commonly applied, but it is not the rulebase designed to eliminate false positives. Option B, monitor, is not the correct false-positive elimination mechanism. Monitoring can help observe behavior, but it does not exempt traffic from matching an attack object. Option C, signature, is wrong because signatures are attack-detection patterns, not a rulebase type used to suppress false positives. The operational correction for noisy or irrelevant matches is to create an exempt rule for the specific trusted source, destination, or attack object. Reference topics: IDP rulebases, exempt rulebase, false-positive tuning, attack objects, IPS inspection.

The correct answer is A. the action taken is defined in the IDP policy that includes this attack object. The exhibit defines a custom attack object named BGP-DEFEND under the security idp custom-attack hierarchy. The custom object includes metadata such as recommended-action drop, severity critical, and signature match conditions such as BGP update AS-path context and pattern 65501. However, an attack object by itself does not determine the final enforcement behavior. The attack object defines what to match; the IDP policy rule that references the object defines what action to take when that match occurs. Juniper describes attack objects as objects used inside IDP rules to identify malicious activity, while IDP rules include rule actions such as drop-packet, drop-connection, close-client, close-server, recommended, and others.

Option B is wrong because the firewall security policy enables IDP inspection by applying an IDP policy, but the IDP action is not selected directly by the normal security policy. Options C and D are too absolute. Even though the custom object shows recommended-action drop, that is only used if the IDP rule action invokes recommended behavior. Without seeing the IDP policy rule action, you cannot conclude reject or drop. Reference topics: IDP custom attack objects, IDP policy rule actions, recommended action, signature-based attack matching.

The correct answer is A. It uses AppID services. Juniper SSL proxy does not rely only on TCP/443 or a static destination-port assumption. It uses Application Identification services to dynamically determine whether the session is SSL/TLS encrypted. Juniper states directly that SSL proxy uses application identification services to detect whether a session is SSL encrypted, and SSL proxy is allowed only when the session is identified as encrypted. If the application system cache marks the session as Encrypted=Yes, SSL proxy can transition into proxy processing; if the session is marked Encrypted=No, SSL proxy ignores it.

Option B is wrong because packet length does not reliably identify SSL/TLS encryption. Option C is a common trap: many SSL/TLS sessions use port 443, but SSL/TLS can run on nonstandard ports, and non-SSL applications can also use port 443. Junos uses AppID to avoid that weak assumption. Option D is wrong because a CA is used to sign or validate certificates during SSL forward or reverse proxy operations; it is not the mechanism used to detect whether a session is encrypted. Reference topics: SSL Proxy, AppID, encrypted session detection, application system cache, SSL/TLS inspection.