-- Exhibit -

-- Exhibit -Click the Exhibit button. You are troubleshooting a communication problem between a trust zone and an untrust zone in
the network, where PC-1 cannot ping PC-2.
Referring to the exhibit, which configuration change on SRX-1 would resolve this problem? Add a security policy to allow ICMP traffic from the untrust zone to the trust zone.

• A. Add an address book entry for address 70.1.1.2.
• B. Add a security policy to allow ICMP traffic from the trust zone to the untrust zone.
• C. Configure proxy-arp under the [edit security nat] hierarchy.

-- Exhibit -

-- Exhibit -
Click the Exhibit button.
Referring to the exhibit, PC-1 is unable to ping Server-1. Traffic from PC-1 to Server-1 arrives on interface fe-0/0/3 but return traffic from Server-1 to PC-1 should be sent out from interface fe0/0/2.
What would you change on SRX-1 to resolve this problem?

• A. Disable TCP SYN check and TCP sequence check.
• B. Configure a security policy to allow traffic from the DMZ zone to the untrust-2 zone.
• C. Move both interface fe-0/0/2 and fe-0/0/3 to the same security zone.
• D. Configure a security policy to allow traffic from the DMZ zone to the untrust-1 zone.

-- Exhibit -user@host> show log flow.log Jun 12 20:00:45 host clear-log[ ]: logfile cleared Jun 12 20:01:10 20:01:10.412643:CID-0:RT:172.23.1.20/2526->10.3.202.56/443;6> matched filter
to_https: ...
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: fe-0/0/6.0:172.23.1.20/2526->10.3.202.56/443, tcp, flag 2 syn
...
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:check self-traffic on fe-0/0/6.0, in_tunnel 0x0
...
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:flow_first_rule_dst_xlate: DST xlate: 10.3.202.56(443) to 10.25.0.3(443), rule/pool id 2/2.
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:flow_first_routing: vr_id 0, call flow_route_lookup(): src_ip 172.23.1.20, x_dst_ip 10.25.0.3, in ifp fe-0/0/6.0, out ifp N/A sp 2526, dp 443, ip_proto 6, tos 0
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:Doing DESTINATION addr route-lookup
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: routed (x_dst_ip 10.25.0.3) from managed (fe0/0/6.0 in 0) to ge-0/0/1.4093, Next-hop: 10.25.0.3
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:flow_first_policy_search: policy search from zone managed-> zone trust (0x110,0x9de01bb,0x1bb)
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: app 58, timeout 1800s, curr ageout 20s
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: permitted by policy default-policy-00(2)
...
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:flow_xlate_pak
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: post addr xlation: 172.23.1.20->10.25.0.3.
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: post addr xlation: 172.23.1.20->10.25.0.3.
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:skip pre-frag: is_tunnel_if- 0, is_if_mtu_configured- 0
Jun 12 20:01:10 20:01:10.412643:CID-0:RT:mbuf 0x42344180, exit nh 0xb00010
Jun 12 20:01:10 20:01:10.412643:CID-0:RT: ----- flow_process_pkt rc 0x0 (fp rc 0)
-- Exhibit -
Click the Exhibit button.
You want to allow Web-based management of your SRX Series device through fe-0/0/6.0. This interface belongs to the managed zone with an IP address of 10.3.202.56. You are unable to open an HTTPS connection and have enabled traceoptions to troubleshoot the problem.
Referring to the exhibit, what is causing this problem?

• A. The lo0 interface is not configured in the managed zone.
• B. The HTTPS protocol is not enabled in the trust zone.
• C. The HTTPS protocol is not enabled in the managed zone.
• D. The packet was diverted to the wrong zone.

-- Exhibit -
user@host> show security flow session
...
Session ID. 41, Policy name: allow/5, Timeout: 20, Valid In: 172.168.66.143/43886 --> 192.168.100.1/5000;tcp, If: ge-0/0/1.0, Pkts: 1, Bytes: 60 Out: 10.100.1.100/5555 --> 172.168.66.143/43886;tcp, If: ge-0/0/2.0, Pkts: 0, Bytes: 0
user@host> show configuration
...
security { nat { destination { pool server { address 10.100.1.100/32 port 5555; } rule-set rule1 { from zone UNTRUST; rule 1 { match { destination-address 192.168.100.1/32; destination-port 5000; } then { destination-nat pool server; } } } } proxy-arp {
interface ge-0/0/1.0 {
address {
192.168.100.1/32;
}
}
}
}
policies {
from-zone UNTRUST to-zone TRUST {
policy allow {
match {
source-address any;
destination-address any;
application [ junos-ping tcp-5000 ];
}
then {
permit;
}
}
}
}
zones {
security-zone TRUST {
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
protocols {
all; } } } } } security-zone UNTRUST { interfaces { ge-0/0/1.0 { host-inbound-traffic { system-services { ping; } } } } } }
}
applications { application tcp-5000 { protocol tcp; destination-port 5000; }
}
-- Exhibit -Click the Exhibit button.
Your customer is attempting to reach your new server that should be accessible publicly using
192.168.100.100 on TCP port 5000, and internally using 10.100.100.1 on TCP port 5555. You notice a session forms when they attempt to access the server, but they are unable to reach the server.
Referring to the exhibit, what will resolve this problem?

• A. There must be a TRUST-to-UNTRUST security policy to allow return traffic.
• B. The NAT pool server port must be changed to 5000.
• C. The NAT rule set rule1 must match on address 172.168.66.143.
• D. The NAT pool server address must be changed to 10.100.100.1/32.