JN0-335 Exam Dumps : Security, Specialist (JNCIS-SEC)

 To implement IPS on your SRX Series device, you need to download and install the IPS signature database. The IPS signature database contains the attack signatures and predefined attack groups that are used to detect and prevent intrusions. You can download the IPS signature database from the Juniper Networks website or from a local server. You can install the IPS signature database manually or automatically. You do not need to enroll the SRX Series device with Juniper ATP Cloud or reboot the SRX Series device to implement IPS34 References:

• Configuring the IPS Policy on SRX Series Devices Using NSM
• Installing SRX 1400 with IPS activation ??? | SRX - Juniper Networks
• Download an IPS Signature | J-Web for SRX Series 21.2 - Juniper Networks
• IPS Configuration (CLI) | Junos OS | Juniper Networks

 This is because the error message indicates that the client device does not trust the certificate authority that issued the certificate for the external server. Therefore, you need to import the root CA certificate from the SRX Series device to the client device and add it to the trusted certificate store. This will allow the client device to verify the identity of the SRX Series device and accept the certificates it generates for the external servers3.

The other options are not correct because:

• A. Load a known good, but expired. CA certificate onto the SRX Series device. This will not solve the problem because the client device will still reject the certificates from the SRX Series device if they are signed by an expired CA certificate. The expiration date of the CA certificate is one of the factors that the client device checks when validating the certificate2.
• B. Install a new SRX Series device to act as the client proxy. This will not solve the problem because the new SRX Series device will still need to have a root CA certificate configured and imported to the client devices. The problem is not with the SRX Series device itself, but with the trust relationship between the SRX Series device and the client devices2.
• C. Reboot the SRX Series device. This will not solve the problem because rebooting the SRX Series device will not change the configuration or the certificates on the SRX Series device or the client devices. The problem is not caused by a temporary glitch or a malfunction, but by a mismatch between the certificates on the SRX Series device and the client devices2.

I hope this helps you understand the problem and the solution better. If you want to learn more about SSL client protection proxy, you can check out the following references:

• SSL Proxy Overview
• Configuring SSL Forward Proxy
• Configuring a Root CA Certificate
• SSL Proxy - Client Protection

The SRX Series device will drop packets from the infected hosts with a threat level of 8 and no log message will be generated. This is because the security intelligence profile “ATP_Infected-Hosts” has a rule “Rule-1” that matches packets with a threat level of 8 and the action is to block and drop them. There is no log option specified in the action, so no log message will be generated. Options A and B are not correct because the rule only matches packets with a threat level of 8, not 8 or above. Option C is not correct because the action is to drop, not permit, the packets. References: The answer can be verified from Juniper’s official documentation on security intelligence available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• security-intelligence | Junos OS
• Configure the Security Intelligence Policy on the SRX Series Device