JN0-335 Exam Dumps : Security, Specialist (JNCIS-SEC)

Statistical sampling is a technique that reduces the amount of flow data that is sent to JSA by sampling a subset of packets from the network device. Statistical sampling can help reduce network bandwidth and storage requirements, but it also increases processor utilization on the network device and decreases event correlation accuracy on JSA. Statistical sampling can also affect the accuracy of reports and searches that are based on flow data. Therefore, it is recommended to use statistical sampling only when necessary and with caution12.

BGP FlowSpec is not used to collect traffic flows from Junos OS devices, but to distribute firewall filter rules to routers that participate in BGP. BGP FlowSpec can help mitigate distributed denial-of-service (DDoS) attacks by filtering unwanted traffic based on flow attributes such as source and destination IP addresses, ports, and protocols3.

Superflows are not a method of collecting network traffic flows, but a way of grouping individual flows that match certain criteria into a single record. Superflows can help detect common attack vectors and reduce the number of flows that are stored on JSA. Superflows do not reduce traffic licensing requirements, but they can help optimize the performance and storage of JSA4. References:

• 1: Flow Sources | JSA 7.5.0 | Juniper Networks
• 2: JSA Events and Flows | JSA 7.5.0 | Juniper Networks
• 3: Understanding BGP FlowSpec
• 4: Superflows | JSA 7.5.0 | Juniper Networks

The vSRX is a virtual firewall that offers the same features as the physical SRX Series firewalls, but in a virtualized form factor for delivering security services that scale to match network demand. It offers the same features as the SRX appliance, including core firewall, robust networking, full next-gen capabilities, and automated life-cycle management1

The vSRX supports Layer 2 and Layer 3 configurations, which means it can operate as a transparent or a routed firewall, depending on the network topology and requirements. The vSRX can also support multiple routing instances, such as virtual routers, virtual switches, and logical systems, to provide logical separation and isolation of traffic2

The vSRX provides clustering, which enables two or more vSRX instances to act as a single, logical device that provides high availability, load balancing, and scalability. The vSRX cluster can synchronize configuration and session information, and support stateful failover and redundancy groups3

The cSRX is a containerized firewall that offers a compact footprint with a high-density firewall for virtualized and cloud environments. It is designed to secure microservices and containerized applications, and provide network visibility and threat prevention4

The cSRX does not support Layer 2 and Layer 3 configurations, as it is intended to be a lightweight and agile firewall that does not perform dynamic routing or networking functions. The cSRX relies on the underlying container orchestration platform, such as Kubernetes or Docker, to provide the network connectivity and management4

The cSRX does not provide clustering, as it is designed to leverage the native resiliency and scalability features of the container orchestration platform. The cSRX can be deployed as a standalone firewall or as part of a service chain, and can be dynamically scaled up or down based on the demand4

The cSRX has faster boot times than the vSRX, as it can be instantiated in seconds, compared to minutes for the vSRX. The cSRX also has a smaller image size and memory requirement than the vSRX, as it is optimized for containerized environments4

The cSRX provides NAT, IPS, and UTM services, similar to the vSRX, but with some limitations. The cSRX does not support IPSec VPN, application identification, user firewall, or SSL proxy. The cSRX also has lower performance and throughput than the vSRX, as it is constrained by the container resources and the orchestration platform4

References: 1: vSRX Virtual Firewall | Juniper Networks US 2: vSRX Virtual Firewall for VMware - TechLibrary - Juniper Networks 3: vSRX Cluster Overview - TechLibrary - Juniper Networks 4: Juniper vSRX versus cSRX - TechLibrary - Juniper Networks

 To create a security policy that will automatically add infected hosts to the infected hosts feed and block further communication through the SRX Series device, you need to add a security intelligence policy to the permit portion of the security policy. A security intelligence policy is a set of rules that defines the actions to be taken for traffic thatmatches a specific category of threat feeds, such as infected hosts, command and control servers, or botnets. By adding a security intelligence policy to the permit portion of the security policy, you can enable the SRX Series device to dynamically update the infected hosts feed based on the advanced anti-malware policy results, and block the traffic from or to the infected hosts. Options B, C, and D are not correct because they do not enable the automatic addition of infected hosts to the feed or the blocking of their communication. References: The answer can be verified from Juniper’s official documentation on security intelligence and advanced anti-malware available on their website. Here are some relevant links:

• Security Intelligence Feature Guide for Security Devices
• Advanced Anti-Malware Feature Guide for Security Devices
• Configuring Security Intelligence Policy on the SRX Series Device
• [Configuring Advanced Anti-Malware Policy on the SRX Series Device]