单选题Which type of source NAT is configured in the exhibit？（） [edit security nat destination] user@host# show pool A { address 10.1.10.5/32； } rule-set 1 { from zone untrust； rule 1A { match { destination-address 100.0.0.1/32； } then { destination-nat pool 

第1题：

Assume the default-policy has not been configured.Given the configuration shown in the exhibit， which two statements about traffic from host_a inthe HR zone to host_b in the trust zone are true？（） [edit security policies from-zone HR to-zone trust] user@host# show policy one { match { source-address any； destination-address any； application [ junos-http junos-ftp ]； } then { permit； } } policy two { match { source-address host_a； destination-address host_b； application [ junos-http junos-smtp ]； } then { deny； } }

• A、DNS traffic is denied.
• B、HTTP traffic is denied.
• C、FTP traffic is permitted.
• D、SMTP traffic is permitted.

第2题：

Interface ge-0/0/2.0 of your device is attached to the Internet and is configured with an IP address andnetwork mask of 71.33.252.17/24. A webserver with IP address 10.20.20.1 isrunning an HTTP service on TCP port 8080. The webserver is attached to the ge-0/0/0.0 interface of yourdevice. You must use NAT to make the webserver reachable from the Internet using port translation.Which type of NAT must you configure？（）

• A、source NAT with address shifting
• B、pool-based source NAT
• C、static destination NAT
• D、pool-based destination NAT

第3题：

Which configuration shows the correct application of a security policy scheduler?（）

• A、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn myTunnel; } scheduler-name now; } } }
• B、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn myTunnel; } } } scheduler-name now; }
• C、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn scheduler-name now; } } } }
• D、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; scheduler-name now; } then { permit { tunnel { ipsec-vpn myTunnel; } } } scheduler-name now; }myTunnel;

第4题：

Your task is to provision the Junos security platform to permit transit packets from the Private zone to the External zone by using an IPsec VPN and log information at the time of session close.Which configuration meets this requirement?（）

• A、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts;destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } log { session-init; } } }
• B、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; } } count { session-close; } } }
• C、[edit security policies from-zone Private to-zone External] user@host# showpolicy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN;} } log { session-close; } } }
• D、[edit security policies from-zone Private to-zone External] user@host# show policy allowTransit { match { source-address PrivateHosts; destination-address ExtServers; application ExtApps; } then { permit { tunnel { ipsec-vpn VPN; log; count session-close; } } } }

第5题：

Which statement is true about a NAT rule action of off?（）

• A、The NAT action of off is only supported for destination NAT rule-sets.
• B、The NAT action of off is only supported for source NAT rule-sets.
• C、The NAT action of off is useful for detailed control of NAT.
• D、The NAT action of off is useful for disabling NAT when a pool is exhausted

第6题：

Given the configuration shown in the exhibit， which statement is true about traffic from host_ato host_b？（） [edit security policies from-zone HR to-zone trust] user@host# showpolicy two { match { source-address subnet_a； destination-address host_b； application [ junos-telnet junos-ping ]； } then { reject； } } policy one { match { source-address host_a； destination-address subnet_b； application any； } then { permit； } } host_a is in subnet_a and host_b is in subnet_b.

• A、DNS traffic is denied.
• B、Telnet traffic is denied.
• C、SMTP traffic is denied.
• D、Ping traffic is permitted

第7题：

第8题：

第9题：

第10题：

第11题：

第12题：

第13题：

Interface ge-0/0/2.0 of your device is attached to the Internet and is configured with an IP address and network mask of 71.33.252.17/24. A Web server with IP address 10.20.20.1 is running an HTTP service on TCP port 8080. The Web server is attached to the ge-0/0/0.0 interface of your device. You must use NAT to make the Web server reachable from the Internet using port translation. Which type of NAT must you configure?（）

• A、source NAT with address shifting
• B、pool-based source NAT
• C、static destination NAT
• D、pool-based destination NAT

第14题：

A network administrator wants to permit Telnet traffic initiated from the address book entry the10net in a zone called UNTRUST to the address book entry Server in a zone called TRUST. However, the administrator does not want the server to be able to initiate any type of traffic from the TRUST zone to the UNTRUST zone. Which configuration statement would correctly accomplish this task?（）

• A、from-zone UNTRUST to-zone TRUST { policy DenyServer { match { source-address any; destination-address any; application any; } then { deny; } } } from-zone TRUST to-zone UNTRUST { policy AllowTelnetin { match { source-address the10net; destination-address Server; application junos-telnet; } then { permit; } } }
• B、from-zone TRUST to-zone UNTRUST { policy DenyServer { match { source-address Server; destination-address any; application any; } then {deny; } } } from-zone UNTRUST to-zone TRUST { policy AllowTelnetin { match { source-address the10net; destination-address Server; application junos-telnet; } then { permit; } } }
• C、from-zone UNTRUST to-zone TRUST { policy AllowTelnetin { match { source-address the10net; destination-address Server; application junos-ftp; } then { permit; } } }
• D、from-zone TRUST to-zone UNTRUST { policy DenyServer { match { source-address Server; destination-address any; application any; } then { permit; } } } from-zone UNTRUST to-zone TRUST { policy AllowTelnetin { match {source-address the10net; destination-address Server; application junos-telnet; } then { permit; } } }

第15题：

Which statement is true about a NAT rule action of off？（）

• A、The NAT action of off is only supported for destination NAT rule-sets.
• B、The NAT action of off is only supported for source NAT rule-sets.
• C、The NAT action of off is useful for detailed control of NAT
• D、The NAT action of off is useful for disabling NAT when a pool is exhausted.

第16题：

Which type of source NAT is configured in the exhibit？（） [edit security nat destination] user@host# show pool A { address 10.1.10.5/32； } rule-set 1 { from zone untrust； rule 1A { match { destination-address 100.0.0.1/32； } then { destination-nat pool A； } } }

• A、static destination NAT
• B、static source NAT
• C、pool-based destination NAT without PAT
• D、pool-based destination NAT with PAT

第17题：

Which type of source NAT is configured in the exhibit？（） [edit security nat source] user@host# show rule-set 1 { from interface ge-0/0/2.0； to zone untrust； rule 1A {match { destination-address 1.1.70.0/24； } then { source-nat interface； } } }

• A、interface-based source NAT
• B、static source NAT
• C、pool-based source NAT with PAT
• D、pool-based source NAT without PAT

第18题：

第19题：

第20题：

第21题：

第22题：

第23题：

第24题：