JN0-335 Exam Dumps : Security, Specialist (JNCIS-SEC)

SRX Series device chassis clusters are created by physically connecting two identical cluster-supported SRX Series devices using a pair of the same type of Ethernet connections. The connection is made for both a control link and a fabric (data) link between the two devices. The chassis cluster data plane is connected with revenue ports, which are the ports that carry user traffic. The chassis cluster can contain a maximum of two devices, as only two nodes can form a cluster. The chassis cluster data plane is not connected with SPC ports, which are the ports that provide services processing. The chassis cluster cannot contain more than two devices, as this would violate the cluster design. References: Chassis Cluster Overview, Connecting SRX Series Firewalls to Create a Chassis Cluster

Statistical sampling is a technique that reduces the amount of flow data that is sent to JSA by sampling a subset of packets from the network device. Statistical sampling can help reduce network bandwidth and storage requirements, but it also increases processor utilization on the network device and decreases event correlation accuracy on JSA. Statistical sampling can also affect the accuracy of reports and searches that are based on flow data. Therefore, it is recommended to use statistical sampling only when necessary and with caution12.

BGP FlowSpec is not used to collect traffic flows from Junos OS devices, but to distribute firewall filter rules to routers that participate in BGP. BGP FlowSpec can help mitigate distributed denial-of-service (DDoS) attacks by filtering unwanted traffic based on flow attributes such as source and destination IP addresses, ports, and protocols3.

Superflows are not a method of collecting network traffic flows, but a way of grouping individual flows that match certain criteria into a single record. Superflows can help detect common attack vectors and reduce the number of flows that are stored on JSA. Superflows do not reduce traffic licensing requirements, but they can help optimize the performance and storage of JSA4. References:

• 1: Flow Sources | JSA 7.5.0 | Juniper Networks
• 2: JSA Events and Flows | JSA 7.5.0 | Juniper Networks
• 3: Understanding BGP FlowSpec
• 4: Superflows | JSA 7.5.0 | Juniper Networks

• Referring to the SRX Series flow module diagram shown in the exhibit, application security is processed at the Services ALGs stage. Application Layer Gateways (ALGs) are software components that enable the SRX Series device to provide application-level security for specific protocols and applications1.
• ALGs inspect the application layer payload of packets and perform various actions, such as modifying the payload, opening pinholes, creating sessions, applying security policies, and enforcing application-specific behavior12.
• ALGs are required for protocols and applications that embed IP address information or port numbers in the application layer data, that open secondary connections, or that are dynamically assigned ports1. Some examples of protocols and applications that require ALGs are FTP, SIP, H.323, RTSP, PPTP, and DNS2.
• ALGs are configured as part of the security policy and are applied to the traffic that matches the policy criteria. ALGs can also be enabled or disabled globally or per zone12.

References:

• 1: Application Layer Gateways Overview
• 2: Application Layer Gateways Feature Guide for Security Devices