JN0-335 Exam Dumps : Security, Specialist (JNCIS-SEC)

 To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a set of rules that defines the actions to be taken for traffic thatmatches a specific category of threat feeds, such as infected hosts, command and control servers, or botnets. By adding a security intelligence policy to the permit portion of the security policy, you can enable the SRX Series device to dynamically update the infected hosts feed based on the advanced anti-malware policy results, and block the traffic from or to the infected hosts. Options B, C, and D are not correct because they do not enable the automatic addition of infected hosts to the feed or the blocking of their communication. References: The answer can be verified from Juniper’s official documentation on security intelligence and advanced anti-malware available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• Advanced Anti-Malware Feature Guide for Security Devices
• Configuring Security Intelligence Policy on the SRX Series Device
• [Configuring Advanced Anti-Malware Policy on the SRX Series Device]

 The show security policies policy-name detail command shows policy counters for a configured policy. Policy counters display the number of packets and bytes that match the policy, as well as the number of sessions that are created, denied, or closed by the policy. Policy counters can help monitor and troubleshoot the traffic flow and security policy enforcement on the SRX firewall1.

The show security policies policy-name detail command does not display details about the default security policy, which is the implicit policy that is applied when no other policy matches the traffic. The default security policy can be viewed by using the show security policies default-policy command2.

The show security policies policy-name detail command does not identify the different custom policies enabled, which are the user-defined policies that specify the action and conditions for the traffic between zones. The custom policies can be viewed by using the show security policies command without any options1.

The show security policies policy-name detail command does not show the system log files for the local SRX Series device, which are the files that record the events and messages generated by the device. The system log files can be viewed by using the show log command with the name of the file3. References:

• 1: show security policies | Junos OS | Juniper Networks
• 2: Understanding Default Security Policies | Junos OS | Juniper Networks
• 3: show log | Junos OS | Juniper Networks

Statistical sampling is a technique that reduces the amount of flow data that is sent to JSA by sampling a subset of packets from the network device. Statistical sampling can help reduce network bandwidth and storage requirements, but it also increases processor utilization on the network device and decreases event correlation accuracy on JSA. Statistical sampling can also affect the accuracy of reports and searches that are based on flow data. Therefore, it is recommended to use statistical sampling only when necessary and with caution12.

BGP FlowSpec is not used to collect traffic flows from Junos OS devices, but to distribute firewall filter rules to routers that participate in BGP. BGP FlowSpec can help mitigate distributed denial-of-service (DDoS) attacks by filtering unwanted traffic based on flow attributes such as source and destination IP addresses, ports, and protocols3.

Superflows are not a method of collecting network traffic flows, but a way of grouping individual flows that match certain criteria into a single record. Superflows can help detect common attack vectors and reduce the number of flows that are stored on JSA. Superflows do not reduce traffic licensing requirements, but they can help optimize the performance and storage of JSA4. References:

• 1: Flow Sources | JSA 7.5.0 | Juniper Networks
• 2: JSA Events and Flows | JSA 7.5.0 | Juniper Networks
• 3: Understanding BGP FlowSpec
• 4: Superflows | JSA 7.5.0 | Juniper Networks