Online Access Free JN0-696 Exam Questions

While attempting to set up IDP on an SRX Series device, the IDP attack database fails to download.
What is one reason for this behavior?

• A.The device's configuration does not include the URL from which to retrieve the attack database.
• B.A firewall filter applied to the loopback interface is preventing the download of the attack database.
• C.The host inbound traffic has not been configured correctly.
• D.The device's Untrust zone to Trust zone security policy does not allow this traffic.

-- Exhibit -user@R1> show log ike-trace Jun 13 07:45:10 ikev2_packet_v1_start: Passing IKE v1.0 packet to IKEv1 library Jun 13 07:45:10 ike_get_sA. Start, SA = { 7fd86fbe 8a99c1f6 - 00000000 00000000 } / 00000000,
remote = 184.0.15.2:500 Jun 13 07:45:10 ike_sa_allocate: Start, SA = { 7fd86fbe 8a99c1f6 - a1bc3f1d e2a45308 } Jun 13 07:45:10 ike_init_isakmp_sA. Start, remote = 184.0.15.2:500, initiator = 0 Jun 13 07:45:10 ike_decode_packet: Start Jun 13 07:45:10 ike_decode_packet: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733} /
00000000, nego = -1
Jun 13 07:45:10 ike_decode_payload_sA. Start
Jun 13 07:45:10 ike_decode_payload_t: Start, # trans = 1
Jun 13 07:45:10 ike_decode_payload_t: Start, # trans = 1
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = afcad713 68a1f1c9 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 27bab5dc 01ea0760 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 6105c422 e76847e4 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 4485152d 18b6bbcd ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = cd604643 35df21f8 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 90cb8091 3ebb696e ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 7d9419a6 5310ca6f ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..16] = 4a131c81 07035845 ...
Jun 13 07:45:10 ike_st_i_viD. VID[0..28] = 69936922 8741c6d4 ...
Jun 13 07:45:10 ike_st_i_sa_proposal: Start
Jun 13 07:45:10 P1 SA payload match failed for sa-cfg to-R2. Abortingnegotiation for tunnel type 2
local:184.0.15.1 remote:184.0.15.2 IKEv1.
Jun 13 07:45:10 iked_pm_ike_spd_select_ike_sa failed. rc 1, error_code: No proposal chosen
Jun 13 07:45:10 ikev2_fb_spd_select_sa_cB. IKEv2 SA select failed with error No proposal
chosen (neg a7e800)
Jun 13 07:45:10 ike_isakmp_sa_reply: Start
Jun 13 07:45:10 ike_state_restart_packet: Start, restart packet SA = { 7fd86fbe 8a99c1f6 -
b8f95b2e f92ca733}, nego = -1
Jun 13 07:45:10 ike_st_i_sa_proposal: Start
Jun 13 07:45:10 ike_st_i_cr: Start
Jun 13 07:45:10 ike_st_i_cert: Start
Jun 13 07:45:10 ike_st_i_private: Start
Jun 13 07:45:10 ike_st_o_sa_values: Start
Jun 13 07:45:10 184.0.15.1:500 (Responder) -> 184.0.15.2:500 { 7fd86fbe 8a99c1f6 - b8f95b2e
f92ca733 [-1] / 0x00000000 } IP; Error = No proposal chosen (14)
Jun 13 07:45:10 ike_alloc_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733}
Jun 13 07:45:10 ike_encode_packet: Start, SA = { 0x7fd86fbe 8a99c1f6 - b8f95b2e f92ca733 } /
b20d590c, nego = 0
Jun 13 07:45:10 ike_send_packet: Start, send SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733},
nego = 0, dst = 184.0.15.2:500, routing table id = 0
Jun 13 07:45:10 ike_delete_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733},
nego = 0
Jun 13 07:45:10 ike_free_negotiation_info: Start, nego = 0
Jun 13 07:45:10 ike_free_negotiation: Start, nego = 0
Jun 13 07:45:10 IKE negotiation fail for local:184.0.15.1, remote:184.0.15.2 IKEv1 with status: No
proposal chosen Jun 13 07:45:10 IKEv1 Error : No proposal chosen Jun 13 07:45:40 P1 SA 3770105 timer expiry. ref cnt 1, timer reason Force delete timer expired
(1), flags 0x330.
Jun 13 07:45:40 iked_pm_ike_sa_delete_done_cB. For p1 sa index 3770105, ref cnt 1, status: Error ok Jun 13 07:45:40 ike_remove_callback: Start, delete SA = { 7fd86fbe 8a99c1f6 - b8f95b2e
f92ca733}, nego = -1
Jun 13 07:45:40 ike_delete_negotiation: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733}, nego = -1 Jun 13 07:45:40 ssh_ike_tunnel_table_entry_delete: Deleting tunnel_iD. 0 from IKE tunnel table Jun 13 07:45:40 ssh_ike_tunnel_table_entry_delete: The tunnel iD. 0 doesn't exist in IKE tunnel
table Jun 13 07:45:40 ike_sa_delete: Start, SA = { 7fd86fbe 8a99c1f6 - b8f95b2e f92ca733 } Jun 13 07:45:40 ike_free_negotiation_isakmp: Start, nego = -1 Jun 13 07:45:40 ike_free_negotiation: Start, nego = -1 Jun 13 07:45:40 IKE SA delete called for p1 sa 3770105 (ref cnt 1) local:184.0.15.1,
remote:184.0.15.2, IKEv1 Jun 13 07:45:40 iked_pm_p1_sa_destroy: p1 sa 3770105 (ref cnt 0), waiting_for_del 0x0 Jun 13 07:45:40 ike_free_sA. Start
-- Exhibit -Click the Exhibit button.
You are asked to troubleshoot a new IPsec VPN between R1 and R2 that is not coming up. You have captured the traceoptions output shown in the exhibit.
What is the reason for the problem?

• A.IKE Phase 1 proposal mismatch
• B.IKE Phase 2 proposal mismatch
• C.IKE Phase 1 mode mismatch
• D.IKE preshared key mismatch

-- Exhibit -
[edit security utm]
user@host# show
custom-objects { url-pattern { blocklist { value [ http://badsite.com http://blocksite.com ]; } acceptlist { value http://juniper.net; } } custom-url-category { blacklist { value blocklist; } whitelist { value acceptlist; } }
}
feature-profile { web-filtering { url-whitelist whitelist; url-blacklist blacklist; type juniper-local; juniper-local {
profile web-filter {
custom-block-message "Site is not allowed";
fallback-settings {
default log-and-permit;
}
}
}
}
}
utm-policy utm1 {
web-filtering {
http-profile web-filter;
}
}
-- Exhibit --
Click the Exhibit button.
You set up Web filtering to allow employees to only access your internal website. You notice that employees are still able to reach websites outside of the blacklists.
Referring the exhibit, which parameter must be changed?

• A.You must use integrated or redirect Web filtering instead of local list filtering.
• B.You must change the fallback-settings parameter to default block.
• C.You must define all sites you want to block using the mime-pattern parameter.
• D.You must define all sites you want to block using the protocol-command parameter.

-- Exhibit -{hold:node0} user@host1> show chassis cluster status Cluster ID. 1 Node Priority Status Preempt Manual failover
Redundancy group: 0 , Failover count: 0 node0 1 hold no no node1 0 lost n/a n/a {hold:node0}
user@host1> show configuration | no-more
system { host-name host1; root-authentication { encrypted-password "$1$KI99zGk6$MbYFuBbpLffu9tn2.sI7l1"; ## SECRET-DATA } name-server { 172.16.10.100; } services { ssh; telnet; web-management { http; } } syslog { user * { any emergency; } file messages { any any; authorization info; } file interactive-commands { interactive-commands any;
}
} } interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.210.14.131/26;
}
}
}
ge-0/0/8 {
unit 0 {
family inet {
address 172.16.1.1/24;
}
}
}
ge-0/0/9 {
unit 0 {
family inet {
address 172.16.10.1/24;
} } } }
security {
policies {
default-policy {
permit-all;
}
}
zones {
functional-zone management {
interfaces {
ge-0/0/0.0;
}
host-inbound-traffic {
system-services {
ssh;
telnet;
ping;
traceroute;
http;
snmp;
}
}
}
security-zone Trust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/9.0;
}
}
security-zone Untrust {
host-inbound-traffic {
system-services {
any-service;
}
}
interfaces {
ge-0/0/8.0;
}
}
}
}
{hold:node1} user@host2> show chassis cluster status Cluster ID. 1 Node Priority Status Preempt Manual failover
Redundancy group: 0 , Failover count: 0 node0 0 lost n/a n/a node1 1 hold no no
{hold:node1}
user@host2> show configuration | no-more
system { host-name host2; root-authentication { encrypted-password "$1$KI99zGk6$MbYFuBbpLffu9tn2.sI7l1"; ## SECRET-DATA } name-server { 172.16.10.100; } services { ssh; telnet; web-management { http; } } syslog { user * { any emergency; } file messages { any any; authorization info; } file interactive-commands {
interactive-commands any;
}
} } interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.210.14.132/26;
}
}
}
ge-0/0/8 {
unit 0 {
family inet {
address 172.16.1.1/24;
}
}
}
ge-0/0/9 {
unit 0 {
family inet {
address 172.16.10.1/24;
}
}
} }
security {
policies {
default-policy {
permit-all;
}
}
zones {
functional-zone management {
interfaces {
ge-0/0/0.0;
}
host-inbound-traffic {
system-services {
ssh;
telnet;
ping;
traceroute;
http;
snmp;
}
}
}
security-zone Trust {
host-inbound-traffic {
system-services {
any-service; } } interfaces { ge-0/0/9.0; } } security-zone Untrust { host-inbound-traffic { system-services { any-service; } } interfaces { ge-0/0/8.0; } } }
}
-- Exhibit -
Click the Exhibit button.
A user attempted to form a chassis cluster on an SRX240; however, the cluster did not form. While investigating the problem, you see the output shown in the exhibit.
What is causing the problem?

• A.The configurations are not identical.
• B.The cluster IDs do not match.
• C.The fxp0 interface is not configured.
• D.The ge-0/0/0 interface is configured.

-- Exhibit --
[edit]
user@SRX-1# show security ike traceoptions
file ike-trace;
flag all;
[edit]
user@SRX-1# show security ipsec traceoptions
flag all;
user@SRX-1> show log ike-trace
...
Jun 13 17:00:33 :500 (Responder) -> 192.168.1.11:500 { 15276b72 6656c3b6 - 4ea713e7
d2487276 [1] / 0x9828a32e } QM; Invalid protocol_id = 0
Jun 13 17:00:34 Received authenticated notification payload unknown from local:192.168.1.10 remote:192.168.1.11 IKEv1 for P1 SA 3075335 Jun 13 17:00:34 iked_pm_ike_spd_notify_receiveD. Negotiation is already failed. Reason: TS
unacceptable.
Jun 13 17:00:34 QM notification `(null)' (40001) (size 8 bytes) from 192.168.1.11 for protocol
Reserved spi[0...3]=0f f0 ce d3
Jun 13 17:00:34 ike_st_i_private: Start
Jun 13 17:00:34 ike_st_o_qm_hash_2: Start
Jun 13 17:00:34 ike_st_o_qm_sa_values: Start
Jun 13 17:00:34 :500 (Responder) -> 192.168.1.11:500 { 15276b72 6656c3b6 - 4ea713e7
d2487276 [1] / 0x9828a32e } QM; Error = No proposal chosen (14)
Jun 13 17:00:34 ike_alloc_negotiation: Start, SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276}
Jun 13 17:00:34 ike_encode_packet: Start, SA = { 0x15276b72 6656c3b6 - 4ea713e7 d2487276 }
/ 65407839, nego = 2
Jun 13 17:00:34 ike_send_packet: Start, send SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276},
nego = 2, dst = 192.168.1.11:500, routing table id = 0
Jun 13 17:00:34 ike_delete_negotiation: Start, SA = { 15276b72 6656c3b6 - 4ea713e7 d2487276},
nego = 2 Jun 13 17:00:34 ike_free_negotiation_info: Start, nego = 2 Jun 13 17:00:34 ike_free_negotiation: Start, nego = 2 Jun 13 17:00:34 IPSec negotiation failed for SA-CFG Unknown for local:192.168.1.10,
remote:192.168.1.11 IKEv1. status: TS unacceptable Jun 13 17:00:34 P2 ed info: flags 0x0, P2 error: TS unacceptable Jun 13 17:00:34 iked_pm_ipsec_sa_done: Phase2 failed 2/3 times for P1 SA 3075335 -- Exhibit -
Click the Exhibit button.
The IPsec tunnel is not establishing between SRX-1 and a remote device.
Referring to the exhibit, what is causing this problem?

• A.IKE Phase 1 proposals mismatch
• B.IKE Phase 2 proposals mismatch
• C.IKE Phase 1 IKE ID mismatch
• D.IKE Phase 2 proxy ID mismatch