Juniper JN0-336 Exam Dumps - Actual Questions Answers

The correct answer is B. ip-notify. When administrators want visibility without enforcement impact, ip-notify is the correct IP action. Juniper Security Director documentation defines IP Notify as an IP action that does not take any action against future traffic but logs the event. That is exactly the requirement in the question: traffic matching the IDP condition must not be blocked, closed, or rate-limited until administrators have reviewed the events and decided whether enforcement is appropriate.

Option A, ip-block, is wrong because it blocks future packets matching the IP action rule. That would immediately impact traffic. Option C, ip-connection-rate-limit, is wrong because it limits the connection rate and therefore changes traffic behavior before administrators complete evaluation. Option D, ip-close, is also wrong because it closes matching future sessions by sending reset packets to the client and server, which is disruptive. In a safe evaluation or tuning phase, the proper approach is to log and observe first, then move to stronger actions such as block, close, or rate-limit only after the detected condition has been validated. Reference topics: IDP IP actions, ip-notify, event logging, non-disruptive evaluation mode, IDP policy tuning.

The correct answers are A and D. Juniper ATP Cloud reduces inspection delay in two practical ways: trusted allowlists and cache lookup. An allowlist contains known trusted IP addresses, hashes, email addresses, and URLs; Juniper states that content downloaded from locations on the allowlist does not have to be inspected for malware. That eliminates unnecessary cloud-analysis cycles for known trusted sources or objects.

Option D is also correct because ATP Cloud performs a real-time cache lookup before deeper analysis. Juniper explains that when a file is uploaded, ATP Cloud first checks whether the file has been analyzed before; if it has, the stored verdict is returned to the SRX Series Firewall and there is no need to re-analyze the file. This directly reduces inspection delay and enables faster enforcement. Option B is wrong because ATP Cloud does not rely on a single antivirus engine; it uses a pipeline that can include cache lookup, antivirus, static analysis, dynamic analysis, and machine learning. Option C is wrong because inspection bypass is not delegated to end users. Reference topics: ATP Cloud, allowlists, file inspection workflow, cache lookup, malware analysis pipeline.

The correct answers are A and B. In an SRX chassis cluster, the cluster ID identifies the chassis cluster, and valid operational cluster IDs are nonzero values. Juniper’s chassis cluster command documentation states that the system uses the chassis cluster ID and node ID to apply the correct node-specific configuration, and the command writes the chassis cluster ID and node ID to EPROM. When the cluster ID is set to 0, clustering is disabled; therefore, the HA cluster configuration is effectively ignored because the device is no longer operating as a chassis-cluster member.

Option B is also correct because Juniper states that chassis cluster ID and node ID changes take effect only after the system is rebooted. That is why the operational command format includes the reboot behavior when setting cluster-id and node. Option C is wrong because node ID 0 is valid; it identifies node0 in the two-node cluster. Option D is wrong because SRX chassis clusters use node IDs 0 and 1 only; the 1–255 range applies to cluster IDs, not node IDs. Reference topics: HA Clustering, cluster ID, node ID, EPROM, chassis cluster enablement, node-specific configuration.