Juniper JN0-331 Actual Free Exam Questions & Community Discussion

Exam Code/Number: JN0-331
Exam Name/Title: SEC,Specialist(JNCIS-SEC)
Certification Provider: Juniper
Corresponding Certification: JNCIS

Exam Questions: 131
Updated On: Aug 15, 2026

Question #21

You are required to configure a SCREEN option that enables IP source route option
detection.
Which two configurations meet this requirement? (Choose two.)

A. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
strict-source-route-option;
record-route-option;
}}

B. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
source-route-option;
}}

C. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
loose-source-route-option;
strict-source-route-option;
}}

D. [edit security screen]
user@host# show
ids-option protectFromFlood {
ip {
record-route-option;
security-option;
}}

Discussion 0

Correct Answer: B,C Vote an answer

Question #22

Which three security concerns can be addressed by a tunnel mode IPsec VPN secured by AH? (Choose three.)

A. outer IP header confidentiality

B. data confidentiality

C. data authentication

D. data integrity

E. outer IP header authentication

Discussion 0

Correct Answer: C,D,E Vote an answer

Question #23

Which two statements are true regarding redundancy groups? (Choose two.)

A. The primary role can be shared for redundancy group 0 when the active-active option is enabled.

B. Redundancy group 0 manages the control plane failover between the nodes of a cluster.

C. The preempt option determines the primary and secondary roles for redundancy group 0 during a failure and recovery scenario.

D. When priority settings are equal and the members participating in a cluster are initialized at the same time, the primary role for redundancy group 0 is assigned to node 0.

Discussion 0

Correct Answer: B,D Vote an answer

Question #24

Which two statements describe the purpose of a security policy? (Choose two.)

A. It controls host inbound services on a zone.

B. It enables traffic counting and logging.

C. It enforces a set of rules for transit traffic.

D. It controls administrator rights to access the device.

Discussion 0

Correct Answer: B,C Vote an answer

Question #25

Click the Exhibit button. [edit security nat source] user@host# show
rule-set 1 {
from interface ge-0/0/2.0;
to zone untrust;
rule 1A {
match {
destination-address 1.1.70.0/24;
}
then {
source-nat interface;
}}}
Which type of source NAT is configured in the exhibit?

A. pool-based source NAT without PAT

B. pool-based source NAT with PAT

C. interface-based source NAT

D. static source NAT

Discussion 0

Correct Answer: C Vote an answer

Question #26

Click the Exhibit button.

Based on the exhibit, client PC 192.168.10.10 cannot ping 1.1.1.2. Which is a potential cause for this problem?

A. The trust zone does not have ping enabled as a host-inbound-traffic service.

B. The security policy from the trust zone to the untrust zone does not permit ping.

C. No security policy exists for the ICMP reply packet from the untrust zone to the trust zone.

D. The untrust zone does not have a management policy configured.

Discussion 0

Correct Answer: B Vote an answer

Question #27

Which three statements are true regarding IDP? (Choose three.)

A. IDP inspects traffic up to the Presentation layer.

B. IDP cannot be used in conjunction with other JUNOS Software security features such as SCREEN options, zones, and security policy.

C. IDP can drop packets, close sessions, prevent future sessions, and log attacks for review by network administrators when an attack is detected.

D. IDP searches the data stream for specific attack patterns.

E. IDP inspects traffic up to the Application layer.

Discussion 0

Correct Answer: C,D,E Vote an answer

Question #28

Which configuration shows a pool-based source NAT without PAT'?

A. [edit security nat source]
user@host# show
pool A {
address { 207.17.137.1/32 to 207.17.137.254/32;
}
overflow-pool interface;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
port no-translation;
}}}

B. [edit security nat source]
user@host# show
pool A {
address {207.17.137.1/32 to 207.17.137.254/32;
}
port no-translation;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
}}}

C. [edit security nat source]
user@host# show
pool A {
address { 207.17.137.1/32 to 207.17.137.254/32;
}}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
port no-translation;
}}
}

D. [edit security nat source]
user@host# show
pool A {
address {207.17.137.1/32 to 207.17.137.254/32;
}
overflow-pool interface;
}
rule-set 1A {
from zone trust;
to zone untrust;
rule 1 {
match {
source-address 10.1.10.0/24;
}
then {
source-nat pool A;
}}}

Discussion 0

Correct Answer: B Vote an answer

Question #29

Which statement regarding the implementation of an IDP policy template is true?

A. IDP policy templates are included in the factory-default configuration.

B. IDP policy templates are enabled using a commit script.

C. IDP policy templates are automatically installed as the active IDP policy.

D. IDP policy templates can be downloaded without an IDP license.

Discussion 0

Correct Answer: B Vote an answer

Question #30

Where do you configure SCREEN options?

A. zones on which an attack might arrive

B. zones you want to protect from attack

C. interfaces on which an attack might arrive

D. interfaces you want to protect from attack

Discussion 0

Correct Answer: A Vote an answer

Download Free Juniper JN0-331 Demo

Simply submit your e-mail address below to get started with our free demo of your Juniper JN0-331 exam.