Jncis-Fwv (Jn0-532)

Front 1

What are the predefined security zones in an L2 deployment?

Back 1

V1-Trust
V1-Untrust
V1-DMZ

Hint 1

Concepts & Examples ScreenOS Reference Guide, p.100

Front 2

Can predefined security zones be deleted?

Back 2

No.

Hint 2

Concepts & Examples ScreenOS Reference Guide, p.100

Front 3

By default, what policy is applied to traffic flows between to interfaces bound to the same zones?

Back 3

None.

Hint 3

Concepts & Examples ScreenOS Reference Guide, p.101

Front 4

What type of VLAN tagging is supported by ScreenOS devices?

Back 4

802.1q

Hint 4

Concepts & Examples ScreenOS Reference Guide, p.101

Front 5

When dealing with VLAN subinterfaces, are the subinterfaces bound to the same zone as the physical interface?

Back 5

Not necessarily.

Hint 5

Concepts & Examples ScreenOS Reference Guide, p.102

Front 6

Do subinterfaces on the same physical interface need to share the same zone configuration?

Back 6

No.

Hint 6

Concepts & Examples ScreenOS Reference Guide, p.102

Front 7

In ScreenOS, what are the two predefined virtual routers?

Back 7

trust-vr

untrust-vr

Hint 7

Concepts & Examples ScreenOS Reference Guide, p.102

Front 8

When using two virtual routers on a ScreenOS device, is traffic automatically forwarded between zones residing on different VRs?

Back 8

No.

Hint 8

Concepts & Examples ScreenOS Reference Guide, p.102

Front 9

What is the default policy on ScreenOS devices?

Back 9

Deny all traffic in all directions. Some security devices ship with a configured policy which allows outbound traffic from Trust to Untrust and denies all inbound traffic from Untrust to Trust.

Hint 9

Concepts & Examples ScreenOS Reference Guide, p.102

Front 10

What configuration option, when enabled, requires you to create a policy to permit traffic to pass from one interface to another within the same zone?

Back 10

Intrazone blocking

Hint 10

Concepts & Examples ScreenOS Reference Guide, p.102

Front 11

By default, does a security device permit multicast control traffic between zones?

Back 11

No.

Hint 11

Concepts & Examples ScreenOS Reference Guide, p.104

Front 12

What are the two main types of VPN configuration methods?

Back 12

route-based VPN

policy-based VPN

Hint 12

Concepts & Examples ScreenOS Reference Guide, p.104

Front 13

Generally speaking, which VPN configuration method is better for site-to-site VPNs?

Back 13

Route-based VPN

Hint 13

Concepts & Examples ScreenOS Reference Guide, p.105

Front 14

Generally speaking, which VPN configuration method is best for remote-access or dialup VPN?

Back 14

policy-based VPN

Hint 14

Concepts & Examples ScreenOS Reference Guide, p.105

Front 15

To what three entities can PBR be assigned?

Back 15

interface

zone

VR

Hint 15

Concepts & Examples ScreenOS Reference Guide, p.109

Front 16

What command can be used to set the MTU for a device to the maximum for the variable?

Back 16

set envar max-frame-size=9830

Hint 16

Concepts & Examples ScreenOS Reference Guide, p.111

Front 17

What two CLI commands could you use to set a device MTU back to the default?

Back 17

unset envar max-frame-size

set envar max-frame-size=1514

Hint 17

Concepts & Examples ScreenOS Reference Guide, p.111

Front 18

What is the default MTU for a ScreenOS device?

Back 18

1514

Hint 18

Concepts & Examples ScreenOS Reference Guide, p.111

Front 19

When using jumbo frame mode, what caveat is true of packets sent through aggregate interfaces?

Back 19

The packets may be sent out of order.

Hint 19

Concepts & Examples ScreenOS Reference Guide, p.111

Front 20

When using jumbo frame mode, what caveat is true of NSRP forwarding?

Back 20

NSRP forwarding is not supported in jumbo frame mode.

Hint 20

Concepts & Examples ScreenOS Reference Guide, p.111

Front 21

When using jumbo frame mode, is Deep Inspection supported?

Back 21

No.

Hint 21

Concepts & Examples ScreenOS Reference Guide, p.111

Front 22

By default, what virtual routing domain is a user-defined zone placed in?

Back 22

trust-vr

Hint 22

Concepts & Examples ScreenOS Reference Guide, p.112

Front 23

What CLI command would be used to assign the zone "Zoney" to virtual router "Routey"?

Back 23

set zone Zoney vrouter Routey

Hint 23

Concepts & Examples ScreenOS Reference Guide, p.113

Front 24

What CLI command would be used to assign interface ethernet1/1 to zone untrust?

Back 24

set interface ethernet1/1 zone untrust

Hint 24

Concepts & Examples ScreenOS Reference Guide, p.115

Front 25

What CLI command would be used to put IP 192.168.0.1 and subnet 255.255.255.0 on interface ethernet1/1?

Back 25

set interface ethernet1/1 ip 192.168.0.1/24

Hint 25

Concepts & Examples ScreenOS Reference Guide, p.115

Front 26

What CLI command would be used to configure a subinterface tagged with VLAN 100 on ethernet1/1 (using standard subinterface naming conventions), and place it in zone trust?

Back 26

set interface ethernet1/1.100 tag 100 zone trust

Hint 26

Concepts & Examples ScreenOS Reference Guide, p.116

Front 27

What CLI command would configure the trust-vr Virtual Router to use the untrust-vr virtual router as its default gateway?

Back 27

set vrouter trust-vr route 0.0.0.0/0 vrouter untrust-vr

Hint 27

Concepts & Examples ScreenOS Reference Guide, p.117

Front 28

What CLI command would create a default gateway in the untrust-vr to point to gateway 1.1.1.100 on interface ethernet1/1?

Back 28

set vrouter untrust-vr route 0.0.0.0/0 interface ethernet1/1 gateway 1.1.1.100

Hint 28

Concepts & Examples ScreenOS Reference Guide, p.117

Front 29

What CLI command would you use to create a new service group called "mail-pop3" and add the "mail" service to the group?

Back 29

set group service mail-pop3 add mail

Front 30

What CLI command would you use to create a new policy from untrust to trust allowing any sources to access any destination on port 80?

Back 30

set policy from untrust to trust any any http permit

Front 31

What command in the CLI will show a list of configured zones?

Back 31

get zone

Hint 31

Concepts & Examples ScreenOS Reference Guide, p.124

Front 32

What four Function zones exist by default?

Back 32

Self
MGT
HA
VLAN

Hint 32

Concepts & Examples ScreenOS Reference Guide, p.125

Front 33

What default zone serves as a storage area for MIP and VIP addresses?

Back 33

Global Zone

Hint 33

Concepts & Examples ScreenOS Reference Guide, p.126

Front 34

On which zones can you enable SCREEN Options?

Back 34

Every security zone, and the MGT zone.

Hint 34

Concepts & Examples ScreenOS Reference Guide, p.126

Front 35

For traffic to flow between VRs, what must be configured?

Back 35

inter-VR routing

Hint 35

CJSA Part 2, p.9

Front 36

What must be true of an interface before it can be assigned an IP address?

Back 36

It must be assigned to a zone.

Hint 36

CJSA Part 2, p.12

Front 37

What is the name for the software component designed to manage specific protocols, such as SIP or FTP?

Back 37

Application-Layer Gateway

Hint 37

CJFV Part 2, p.18

Front 38

Very briefly, what is the ScreenOS decision process/packet flow?

Back 38

1. Perform a sanity check on the packet.
2. Check for existing session.
3. Check if destination is reachable.
4. Check if traffic is crossing zones.
5. Check if traffic is permitted by policy.
6. Perform ARP query to resolve next hop MAC.

Hint 38

CJFV Part 2, p.20

Front 39

What type of Juniper Firewall/VPN offering supports only a single VSYS?

Back 39

Appliances.

Hint 39

CJFV Part 2, p.26

Front 40

What two main groups can the Juniper firewall/VPN offerings be divided into?

Back 40

Appliances and systems.

Hint 40

CJFV Part 2, p.26

Front 41

What type of Juniper firewall offering is more suited for a large enterprise or carrier environment?

Back 41

System.

Hint 41

CJFV Part 2, p.26

Front 42

Into what component does the ScreenOS image load after the power-on self-test completes?

Back 42

RAM

Hint 42

CJFV Part 3, p.2

Front 43

Generally speaking, what three options are available on a ScreenOS device for management?

Back 43

CLI

WebUI

Security Manager

Hint 43

CJFV Part 3, p.3

Front 44

How would you need to connect to a ScreenOS device in order to view boot-up messages?

Back 44

Console

Hint 44

CJFV Part 3, p.4

Front 45

What type of serial cable is used by a NS-5GT and NS-500?

Back 45

DB9

Hint 45

CJFV Part 3, p.4

Front 46

What type of serial cable is used by SSG-5, NS-25, NS-50, NS-200, and NS-5000?

Back 46

RJ45

Hint 46

CJFV Part 3, p.4

Front 47

What is the default login and password on a Juniper networks device?

Back 47

netscreen/netscreen

Hint 47

CJFV Part 3, p.5

Front 48

Does the "unset all" command modify the ScreenOS configuration loaded into memory?

Back 48

No.

Hint 48

CJFV Part 3, p.5

Front 49

What CLI command can be used to determine product model, serial number, hardware version, and software version?

Back 49

get system

Hint 49

CJFV Part 3, p.6

Front 50

What CLI command can be used to determine whether the device is operating in layer 2 or layer 3 mode?

Back 50

get system

Hint 50

CJFV Part 3, p.6

Front 51

What is another name for Layer 2 mode?

Back 51

transparent

Hint 51

CJFV Part 3, p.6

Front 52

What is another name for Layer 3 mode?

Back 52

NAT/Route mode

Hint 52

CJFV Part 3, p.6

Front 53

What CLI command can be used to obtain interface status, uptime, and management IP information from a ScreenOS device?

Back 53

get system

Hint 53

CJFV Part 3, p.6

Front 54

What is the default IP address of a ScreenOS device?

Back 54

192.168.1.1

Hint 54

CJFV Part 3, p.8

Front 55

What happens if you connect via the WebUI to a 5GT that has no configuration saved in flash memory?

Back 55

The configuration wizard is displayed instead of the login screen.

Hint 55

CJFV Part 3, p.8

Front 56

In terms of administrator configuration, what is one of the first tasks you should perform on a new ScreenOS device?

Back 56

Change the default username, password, or both.

Hint 56

CJFV Part 3, p. 13

Front 57

How many security zones can an interface be a part of?

Back 57

One.

Hint 57

CJFV Part 3, p. 15

Front 58

What is the default zone for an interface that is not assigned to a specific zone?

Back 58

Null

Hint 58

CJFV Part 3, p. 16

Front 59

What function zone hosts the logical and internal interface for remote management connections?

Back 59

Self

Hint 59

CJFV Part 3, p. 16

Front 60

What zone hosts the out-of-band management interface on firewall systems.

Back 60

MGT

Hint 60

CJFV Part 3, p. 16

Front 61

What zone hosts the high availability interfaces?

Back 61

HA

Hint 61

CJFV Part 3, p. 17

Front 62

What zone contains the VLAN1 interface for transparent mode deployments?

Back 62

VLAN

Hint 62

CJFV Part 3, p. 17

Front 63

What zone is used for backward compatibile tunnel support when upgrading from ScreenOS versions before 3.1?

Back 63

Tunnel

Hint 63

CJFV Part 3, p.

Front 64

If you enter the CLI command "set interface e1/1 manage", which management services are available on e1/1?

Back 64

All management services are enabled.

Hint 64

CJFV Part 3, p. 20

Front 65

What management services are enabled by default on interfaces in the trust zone?

Back 65

All services.

Hint 65

CJFV Part 3, p. 21

Front 66

By default, what IP address is used as the management IP on a device with management enabled?

Back 66

The interface IP address.

Hint 66

CJFV Part 3, p. 23

Front 67

What would you do to configure interface "e1/1" so that WebUI and other management traffic can only connect to IP 1.1.1.100?

Back 67

set interface e1/1 manage-ip 1.1.1.100

Hint 67

CJFV Part 3, p. 23

Front 68

What is the only requirement when configuring a separate management IP address for an interface?

Back 68

The IP must come from the same block of subnet addresses as the interface IP.

Hint 68

CJFV Part 3, p. 23

Front 69

What privileges does a root administrator have that a read/write administrator does not have?

Back 69

- Create additional administrators

- Activate and deactivate asset recovery features

- Replace configurations from remote devices to flash memory

Hint 69

CJFV Part 3, p. 27

Front 70

What two CLI commands is a read-only administrator limited to?

Back 70

get

ping

Hint 70

CJFV Part 3, p. 27

Front 71

How many administrators can be created on a ScreenOS device?

Back 71

20

Hint 71

CJFV Part 3, p. 27

Front 72

How many administrators can be logged in simultaneously on a ScreenOS device?

Back 72

10

Hint 72

CJFV Part 3, p. 27

Front 73

What command will change the name of the root administrator to "bob"

Back 73

set admin name bob

Hint 73

CJFV Part 3, p. 28

Front 74

What command will change the password of the root administrator to "qwe123"

Back 74

set admin password qwe123

Hint 74

CJFV Part 3, p. 28

Front 75

How many root users can be defined on a ScreenOS device?

Back 75

One.

Hint 75

CJFV Part 3, p. 28

Front 76

What command would create a new administrator called "bob" with password "qwe123" and read/write access?

Back 76

set admin user bob password qwe123 privilege all

Hint 76

CJFV Part 3, p. 29

Front 77

What is the default timeout on the console port?

Back 77

10 minutes

Hint 77

CJFV Part 3, p. 30

Front 78

What command would disable the console timeout?

Back 78

set console timeout 0

Hint 78

CJFV Part 3, p. 30

Front 79

What CLI command will display the amount of time that an idle telnet session (for management) will stay open?

Back 79

get console

Front 80

What CLI command will tell you whether the configuration has been changed, and whether those changes have been saved?

Back 80

get console

Front 81

What CLI command can be used to change the timeout of a WebUI session to one hour?

Back 81

set admin auth web timeout 60

Front 82

What CLI comand can be used to add the network 1.1.1.0 255.255.255.0 to the list of hosts who are allowed to manage the device.

Back 82

set admin manager-ip 1.1.1.0 255.255.255.0

Front 83

After using the "unset all" command, should you save the configuration, or not before rebooting the device?

Back 83

No.

Front 84

What CLI command can be used to view administrator names and privilege levels?

Back 84

get admin user

Front 85

What CLI command can be used to view administrators who are authorized to SSH to the ScreenOS device?

Back 85

get admin ssh all

Front 86

What CLI command can be used to remove all IP addresses from the list of IP addresses allowed to manage the device?

Back 86

unset admin manager-ip all

Front 87

What four categories of counters are maintained by security devices?

Back 87

Hardware
Flow
Policy
SCREEN

Hint 87

CJFV Part 4, p.2

Front 88

What three types of logs are maintained on ScreenOS devices?

Back 88

Event Log
Traffic Log
Self Log

Hint 88

CJFV Part 4, p.3

Front 89

What two types of alarms are provided by ScreenOS devices?

Back 89

Device-Level Alarm
Traffic Alarm

Hint 89

CJFV Part 4, p.3

Front 90

What log type monitors and records traffic that is permitted or denied based on policies?

Back 90

Traffic log

Hint 90

CJFV Part 4, p.3

Front 91

What log type monitors and records all packets terminated at the security device?

Back 91

Self log

Hint 91

CJFV Part 4, p.3

Front 92

What log type monitors system events such as admin config changes and self-generated alarms and messages?

Back 92

Event Log

Hint 92

CJFV Part 4, p.3

Front 93

What counter tracks the number of packets containing errors?

Back 93

Hardware Counter

Hint 93

CJFV Part 4, p.2

Front 94

What counter tracks the number of packets inspected at the flow level?

Back 94

Flow Counter

Hint 94

CJFV Part 4, p.2

Front 95

What counter tracks the amount of traffic affected by specified policies?

Back 95

Policy Counter

Hint 95

CJFV Part 4, p.2

Front 96

What counter monitors firewall behavior for the entire zone of for a particular interface?

Back 96

SCREEN counter

Hint 96

CJFV Part 4, p.2

Front 97

What type of alarm monitors the overall device load and may have an LED indicated corellated to it?

Back 97

Device-Level Alarm

Hint 97

CJFV Part 4, p.3

Front 98

What type of alarm is generated on a per-policy basis?

Back 98

Traffic alarm

Hint 98

CJFV Part 4, p.3

Front 99

What CLI command could be used to see the statistics counters on interface e1/1?

Back 99

get counter statistics interface e1/1

Hint 99

CJFV Part 4, p.4

Front 100

What CLI command can be used to clear all interface counters?

Back 100

clear counters all

Hint 100

CJFV Part 4, p.4

Front 101

What CLI command can be used to see flow counters for interface e1/1?

Back 101

get counter flow interface e1/1

Hint 101

CJFV Part 4, p.5

Front 102

Does the command "clear counters all" clear hardware or flow counters?

Back 102

Both.

Hint 102

CJFV Part 4, p.5

Front 103

What CLI command can be used to view all events in the event log?

Back 103

get event

Hint 103

CJFV Part 4, p.7

Front 104

What CLI command can be used to view only the events from the event log from source 1.1.1.1?

Back 104

get event src-ip 1.1.1.1

Hint 104

CJFV Part 4, p.7

Front 105

What are the seven log entry severity levels on a ScreenOS device?

Back 105

Emergency
Alert
Critical
Error
Warning
Notification
Information

Hint 105

CJFV Part 4, p.8

Front 106

What CLI command would configure email alerts for event logs of severity "emergency"?

Back 106

set log module system level emergency destination email

Hint 106

CJFV Part 4, p.9

Front 107

What CLI command would set the threshold for the CPU alarm to 70%?

Back 107

set alarm threshold cpu 70

Hint 107

CJFV Part 4, p.10

Front 108

What CLI command would you use to set the primary DNS server IP to 1.1.1.1?

Back 108

set dns host dns1 1.1.1.1

Hint 108

CJFV Part 4, p.12

Front 109

Does ScreenOS support SNMPv1 or SNMPv2?

Back 109

Both.

Hint 109

CJFV Part 4, p.14

Front 110

In what three modes can an interface be configured in?

Back 110

Transparent

Route

NAT

Hint 110

Netscreen JNCIS-FWV Study Guide, p.14

Front 111

If you assign an interface to a layer 2 zone, what mode is it set to?

Back 111

transparent

Hint 111

Netscreen JNCIS-FWV Study Guide, p.14

Front 112

When an interface is in NAT mode, and egress traffic is going to the DMZ zone, is that traffic NATed?

Back 112

No.

Hint 112

Netscreen JNCIS-FWV Study Guide, p.14

Front 113

If using a single virtual router, to what zone must traffic be going in order for NAT mode to perform source address translation?

Back 113

Untrust or DMZ zone.

Hint 113

CJFV Part 5 - Layer 3 Operations, p.42

Front 114

Is it possible to have some Layer 2 interfaces and some Layer 3 interfaces?

Back 114

No.

Hint 114

Netscreen JNCIS-FWV Study Guide, p.14

Front 115

What CLI command will give information about all interfaces, their assigned zone, and whether they are up or down?

Back 115

get interface

Hint 115

Netscreen JNCIS-FWV Study Guide, p.15

Front 116

What CLI command would give specific information about interface e1/1?

Back 116

get interface e1/1

Hint 116

Netscreen JNCIS-FWV Study Guide, p.15

Front 117

What CLI command would remove the IP address from interface e1/1?

Back 117

unset interface e1/1 ip

Hint 117

Netscreen JNCIS-FWV Study Guide, p.16

Front 118

Can you place subinterfaces into the HA zone?

Back 118

No.

Hint 118

Netscreen JNCIS-FWV Study Guide, p.16

Front 119

If you want to dedicate an interface to providing high availability, what zone would you assign it to?

Back 119

HA

Hint 119

Netscreen JNCIS-FWV Study Guide, p.16

Front 120

What type of interface facilitates the function of route-based VPN?

Back 120

tunnel interface

Hint 120

Netscreen JNCIS-FWV Study Guide, p.17

Front 121

What CLI command would create tunnel interface 100 and assign it to the Trust zone?

Back 121

set interface tunnel.100 zone Trust

Hint 121

Netscreen JNCIS-FWV Study Guide, p.17

Front 122

What is true of the maximum bandwidth of a subinterface, as compared to the maximum bandwidth of the physical interface it is associated with?

Back 122

Subinterface maximum bandwidth cannot exceed physical interface maximum bandwidth.

Hint 122

Netscreen JNCIS-FWV Study Guide, p.17

Front 123

Can you change the interface mode of a subinterface?

Back 123

No.

Hint 123

Netscreen JNCIS-FWV Study Guide, p.17

Front 124

How is the interface mode of a subinterface determined?

Back 124

It inherits the interface mode from the physical interface.

Hint 124

Netscreen JNCIS-FWV Study Guide, p.17

Front 125

What three types of interfaces can have subinterfaces?

Back 125

physical interfaces

redundant interfaces

aggregate interfaces

Hint 125

Netscreen JNCIS-FWV Study Guide, p.17

Front 126

What command would set interface e1/1 to route mode?

Back 126

set interface e1/1 route

Hint 126

Netscreen JNCIS-FWV Study Guide, p.17

Front 127

What command would add interface e1/1 to aggregate interface aggregate1?

Back 127

set interface e1/1 aggregate aggregate1

Hint 127

Netscreen JNCIS-FWV Study Guide, p.17

Front 128

What type of interface allows you to increase bandwidth by combining two interfaces together?

Back 128

aggregate interface

Hint 128

Netscreen JNCIS-FWV Study Guide, p.17

Front 129

What type of interface allows you to achieve link-level redundancy by combining two physical interfaces so that one acts as primary and the other as backup?

Back 129

redundant interface

Hint 129

Netscreen JNCIS-FWV Study Guide, p.17

Front 130

Can subinterfaces be grouped into redundant interfaces?

Back 130

No.

Hint 130

Netscreen JNCIS-FWV Study Guide, p.17

Front 131

Regarding connected L2 devices, what is recommended of redundant interfaces?

Back 131

Connect each physical interface in the redundant interface to a different switch.

Hint 131

Netscreen JNCIS-FWV Study Guide, p.17

Front 132

What is the terminology for the configured time period that the backup interface in a redundant interface waits before becoming primary?

Back 132

holddown time

Hint 132

Netscreen JNCIS-FWV Study Guide, p.17

Front 133

If you want to configure a holddown time on a redundant interface, how/when is this configured?

Back 133

It must be configured on each physical interface, before the interface is added to the redundant interface.

Hint 133

Netscreen JNCIS-FWV Study Guide, p.17

Front 134

What CLI command would you use to set the holddown time on interface e1/1 to 10 seconds?

Back 134

set interface e1/1 phy holddown 10

Hint 134

Netscreen JNCIS-FWV Study Guide, p.17

Front 135

If you don't specify a primary interface after creating a redundant interface, which interface is considered primary?

Back 135

Whichever interface was added to the group first.

Hint 135

Netscreen JNCIS-FWV Study Guide, p.18

Front 136

What command would add interface e1/1 to redundant interface "redundant1"?

Back 136

set interface e1/1 group redundant1

Hint 136

Netscreen JNCIS-FWV Study Guide, p.18

Front 137

What command would configure redundant interface "redundant1" to use physical interface "e1/1" as the primary interface?

Back 137

set interface redundant1 primary e1/1

Hint 137

Netscreen JNCIS-FWV Study Guide, p.18

Front 138

What Layer 3 security zones exist by default?

Back 138

Trust
Untrust
DMZ
Global

Hint 138

Netscreen JNCIS-FWV Study Guide, p.21

Front 139

If you know the ID number of a zone, but not the name of the zone, what command could you use to get more information about that zone?

Back 139

get zone id <#>

Hint 139

Netscreen JNCIS-FWV Study Guide, p.22

Front 140

What command is used to get a list of all virtual routers?

Back 140

get vrouter

Hint 140

Netscreen JNCIS-FWV Study Guide, p.23

Front 141

What command would change the default virtual router on a netscreen to "untrust-vr"?

Back 141

set vrouter untrust-vr default-vrouter

Hint 141

Netscreen JNCIS-FWV Study Guide, p.23

Front 142

If you issue the command "set route 1.1.1.0/24 gateway 2.2.2.2" what virtual router is the route added to?

Back 142

Whatever virtual router is designated as the default virtual router.

Hint 142

Netscreen JNCIS-FWV Study Guide, p.24

Front 143

What command would you use to create a route for 1.1.1.0/24 to gateway 2.2.2.2, and add it to the default virtual router, whatever virtual router that is?

Back 143

set route 1.1.1.0/24 gateway 2.2.2.2

Hint 143

Netscreen JNCIS-FWV Study Guide, p.24

Front 144

What command will display the entire routing table?

Back 144

get route

Hint 144

Netscreen JNCIS-FWV Study Guide, p.24

Front 145

What command can you use to get detailed information about a specific route?

Back 145

get route id <#>

Hint 145

Netscreen JNCIS-FWV Study Guide, p.25

Front 146

What command can you use to determine what route on the system would be used to get to 1.1.1.1?

Back 146

get route ip 1.1.1.1

Hint 146

NetScreen JNCIS-FWV Study Guide, p.26

Front 147

If you want to see how long a route has been active, what command would you use?

Back 147

get route id <route-id>

Hint 147

NetScreen JNCIS-FWV Study Guide, p.26

Front 148

What command would show you all policies configured on the device?

Back 148

get policy

Hint 148

NetScreen JNCIS-FWV Study Guide, p.27

Front 149

If a device performs an interzone or intrazone policy lookup for traffic, and finds no match, what is checked next?

Back 149

Global policy list

Hint 149

NetScreen JNCIS-FWV Study Guide, p.27

Front 150

If a device fails to find a policy match after looking in interzone/intrazone and global policy, what is checked next?

Back 150

Nothing, default policy is applied.

Hint 150

NetScreen JNCIS-FWV Study Guide, p.27

Front 151

What command would display verbose information about policy ID 4?

Back 151

get policy id 4

Hint 151

NetScreen JNCIS-FWV Study Guide, p.28

Front 152

What three actions are possible for a policy?

Back 152

permit
deny
tunnel

Hint 152

NetScreen JNCIS-FWV Study Guide, p.28

Front 153

When a policy is created, what policy ID is assigned to that policy?

Back 153

The next sequential available policy ID.

Hint 153

NetScreen JNCIS-FWV Study Guide, p.28

Front 154

If a policy with NAT-src has been configured, but no DIP is specified, what IP will the traffic be NATed to?

Back 154

The egress interface IP address.

Hint 154

NetScreen JNCIS-FWV Study Guide, p.30

Front 155

If traffic from an interface in NAT mode going from zone trust to zone untrust hits a policy NAT that performs a src-NAT to an address other than the address of the egress interface, what IP address is the source NATed to?

Back 155

The IP address specified in the policy.

Hint 155

NetScreen JNCIS-FWV Study Guide, p.30

Front 156

What command would set interface e1/1 to NAT mode?

Back 156

set interface e1/1 nat

Hint 156

NetScreen JNCIS-FWV Study Guide, p.31

Front 157

If an interface is in NAT mode, is NAT-src applied when traffic from that interface egresses on an interface in the DMZ zone?

Back 157

No.

Hint 157

NetScreen JNCIS-FWV Study Guide, p.31

Front 158

What command would you use to NAT all traffic from the "trust" zone to the "dmz" zone behind the egress interface IP?

Back 158

set policy from trust to dmz any any any nat src permit

Hint 158

NetScreen JNCIS-FWV Study Guide, p.31

Front 159

How many concurrent hosts can a DIP pool with a single IP address support?

Back 159

64,500

Hint 159

NetScreen JNCIS-FWV Study Guide, p.32

Front 160

Which DIP pool IDs are reserved by ScreenOS for internal use?

Back 160

1-4

Hint 160

NetScreen JNCIS-FWV Study Guide, p.32

Front 161

What is the first usable DIP pool ID?

Back 161

5

Hint 161

NetScreen JNCIS-FWV Study Guide, p.32

Front 162

What is the DIP ID of 2 most commonly used for?

Back 162

NAT-src instances referring to the egress interface.

Hint 162

NetScreen JNCIS-FWV Study Guide, p.32

Front 163

What command would create a DIP pool with ID 10 on e1/1 with a starting IP of 1.1.1.1 and an ending IP of 1.1.1.255?

Back 163

set interface e1/1 dip 10 1.1.1.1 1.1.1.255

Hint 163

NetScreen JNCIS-FWV Study Guide, p.32

Front 164

What command would create a DIP pool with ID 5 on e1/1 with a starting IP of 1.1.1.1 and an ending IP of 1.1.1.255, WITHOUT performing PAT?

Back 164

set interface e1/1 dip 5 1.1.1.1 1.1.1.255 fix-port

Hint 164

NetScreen JNCIS-FWV Study Guide, p.32

Front 165

What NAT option will make sure the same host gets PAT translation behind the same IP address in the DIP pool, for subsequent connections?

Back 165

Sticky DIP

Hint 165

NetScreen JNCIS-FWV Study Guide, p.32

Front 166

What CLI command will enable sticky DIP?

Back 166

set dip sticky

Hint 166

NetScreen JNCIS-FWV Study Guide, p.32

Front 167

What command would you use to create a DIP pool with ID 10 on interface e1/1 that shifts "192.168.1.x" addresses to "1.1.1.x" addresses? (Start at 192.168.1.1)

Back 167

set interface e1/1 dip 10 shift-from 192.168.1.1 1.1.1.1 1.1.1.255

Hint 167

NetScreen JNCIS-FWV Study Guide, p.33

Front 168

What command would you use to put DIP ID 10 into a policy from trust to untrust that accepts all traffic?

Back 168

set policy from trust to untrust any any any nat src dip-id 10 permit

Hint 168

NetScreen JNCIS-FWV Study Guide, p.33

Front 169

What type of NAT configuration is normally used to work around overlapping networks in a VPN?

Back 169

NAT-dst

Hint 169

NetScreen JNCIS-FWV Study Guide, p.33

Front 170

In terms of zone membership, what is true of the addresses used for NAT-dst?

Back 170

The NAT-dst address needs to resolve to the same zone as the original IP address.

Hint 170

NetScreen JNCIS-FWV Study Guide, p.34

Front 171

What is the most common type of NAT when configuring normal inbound destination NAT?

Back 171

MIP

Hint 171

NetScreen JNCIS-FWV Study Guide, p.34

Front 172

Can a MIP be used to translate an entire network range to another network range?

Back 172

Yes.

Hint 172

NetScreen JNCIS-FWV Study Guide, p.34

Front 173

When an internal host is used as the Real IP of a MIP, is outgoing traffic from that host NATed automatically?

Back 173

Yes.

Hint 173

NetScreen JNCIS-FWV Study Guide, p.34

Front 174

What CLI command will give you a list of configured mapped IPs?

Back 174

get mip

Hint 174

NetScreen JNCIS-FWV Study Guide, p.34

Front 175

What type of NAT is used for inbound destination NAT, but allows you to NAT traffic differently based on the destination port?

Back 175

VIP

Hint 175

NetScreen JNCIS-FWV Study Guide, p.35

Front 176

What two components make up a VIP mapping?

Back 176

The VIP address, and the VIP service.

Hint 176

NetScreen JNCIS-FWV Study Guide, p.35

Front 177

On which interfaces can VIPs be configured?

Back 177

Interfaces bound to the untrust zone.

Hint 177

NetScreen JNCIS-FWV Study Guide, p.35

Front 178

In which zone are VIP mappings saved?

Back 178

Global Zone

Hint 178

NetScreen JNCIS-FWV Study Guide, p.35

Front 179

In which zone are MIP mappings saved?

Back 179

Global Zone.

Hint 179

NetScreen JNCIS-FWV Study Guide, p.35

Front 180

What command will display a list of configured VIPs?

Back 180

get vip

Hint 180

NetScreen JNCIS-FWV Study Guide, p.35

Front 181

What command would create a VIP on interface e1/1 that would take traffic destined to 1.1.1.1, port 80 and redirect it to 192.168.1.1, port 8080?

Back 181

set interface e1/1 vip 1.1.1.1 80 <8080-service> 192.168.1.1

Hint 181

NetScreen JNCIS-FWV Study Guide, p.36

Front 182

If interface e1/1 has IP address 2.2.2.2/24, and you try to add a VIP of 1.1.1.1 to that interface via CLI, what output will you receive?

Back 182

###IP 1.1.1.1 is not in the same subnet as interface ethernet1/1

Front 183

What CLI command would you use to allow public hosts in the untrust zone to access a private server in the dmz zone via a vip at 1.1.1.1 and port 80?

Back 183

set policy from untrust to dmz any vip(1.1.1.1) http permit

Hint 183

NetScreen JNCIS-FWV Study Guide, p.36

Front 184

If you have a VIP to NAT port 80 traffic to an internal host listening for HTTP requests on port 8080, what port do you specify in the associated permit rule?

Back 184

80

Hint 184

NetScreen JNCIS-FWV Study Guide, p.36

Front 185

What command would you use to create a mapped IP on interface e1/1 to map 1.1.1.1 to internal host 192.168.1.1? (The internal host is in the trust zone and the NAT IP is in the untrust zone)

Back 185

set interface e1/1 mip 1.1.1.1 host 192.168.1.1 netmask 255.255.255.255 vrouter trust

Hint 185

NetScreen JNCIS-FWV Study Guide, p.35

Front 186

What command would you use to create a policy allowing external hosts from the untrust zone to access a MIP at 1.1.1.1 that NATs to a host in the dmz zone? Allow any source and any service.

Back 186

set policy from untrust to dmz any mip(1.1.1.1) any permit

Hint 186

NetScreen JNCIS-FWV Study Guide, p.35

Front 187

If a packet is not encapsulated, what is considered the source zone for that packet?

Back 187

The zone that the ingress interface or subinterface is bound to.

Hint 187

NetScreen JNCIS-FWV Study Guide, p.36

Front 188

What two packet processing methods can be used, dependent on whether an incoming packet matches an existing session?

Back 188

first packet processing

fast processing

Hint 188

NetScreen JNCIS-FWV Study Guide, p.37

Front 189

When observing a packet leaving your firewall, the source IP address has been changed, even though no policy has been configured to perform this NAT. What is the most likely explanation?

Back 189

The ingress interface is in NAT mode, and the egress interface is in the untrust zone.

Hint 189

NetScreen JNCIS-FWV Study Guide, p.41

Front 190

What hardware component in a NetScreen System is responsible for performing Fast Processing on a packet?

Back 190

Interface ASIC

Hint 190

NetScreen JNCIS-FWV Study Guide, p.41

Front 191

What hardware component is responsible for First Packet Processing?

Back 191

CPU

Hint 191

NetScreen JNCIS-FWV Study Guide, p.41

Front 192

When defining an interface ID for a subinterface (set interface.<ID>), what is the maximum number you can use for the ID?

Back 192

1000

Front 193

If you have four interfaces, e1/1, e1/2, e2/1, and e2/2, which interfaces could be placed in an aggregate interface together?

Back 193

e1/1 and e1/2
or
e2/1 and e2/2

Front 194

If you have four interfaces, e1/1, e1/2, e1/3, and e1/4, which interfaces could be placed in an aggregate interface together?

Back 194

e1/1 and e1/2
or
e1/2 and e1/3
or
e1/3 and e1/4

Front 195

What is the easiest way to see the ID number of all configured zones?

Back 195

get zone

Hint 195

NetScreen JNCIS-FWV Study Guide, p.42

Front 196

In the output of the "get route" command, what does an asterisk next to an entry mean?

Back 196

That the route is active.

Hint 196

NetScreen JNCIS-FWV Study Guide, p.42

Front 197

How many interfaces are on a Fast Ethernet module?

Back 197

2

Hint 197

NetScreen JNCIS-FWV Study Guide, p.42

Front 198

How many interfaces are on a mini-GBIC module?

Back 198

2

Hint 198

NetScreen JNCIS-FWV Study Guide, p.42

Front 199

How many interfaces are on a GBIC module?

Back 199

1

Hint 199

NetScreen JNCIS-FWV Study Guide, p.42

Front 200

Put the following in order:
- new session created
- checks screen options for the zone
- performs policy look-up
- resolves MIPs and VIPs
- performs a route look-up to determine destination zone

Back 200

1) checks SCREEN options for zone
2) resolves MIPs and VIPs
3) performs route look-up to determine destination zone
4) Performs policy look-up
5) New Session Created

Hint 200

NetScreen JNCIS-FWV Study Guide, p.42

Front 201

Why are route look-ups relevant to policy look-ups?

Back 201

Route look-ups determine destination zone, and so also determine what policies will be relevant.

Front 202

Can a tunnel interface have a VLAN ID assigned?

Back 202

No.

Hint 202

NetScreen JNCIS-FWV Study Guide, p.42

Front 203

How do you add an IP address to an interface in the "Null" zone?

Back 203

You cannot.

Hint 203

NetScreen JNCIS-FWV Study Guide, p.42

Front 204

What command do you use to configure an email address for the CA to send a certificate to, after you issue the certificate request?

Back 204

set pki x509 dn email <email-address>

Hint 204

NetScreen JNCIS-FWV Study Guide, p.44

Front 205

What command do you use to configure the CA email address that your certificate request is sent to?

Back 205

set pki x509 default send-to <email-address>

Hint 205

NetScreen JNCIS-FWV Study Guide, p.44

Front 206

What three items are required by a NetScreen in order for a digital certificate to function properly?

Back 206

The certificate assigned to the NetScreen

The signing CA's digital certificate

The CRL

Hint 206

NetScreen JNCIS-FWV Study Guide, p.45

Front 207

What is the signing CA's digital certificate normally called?

Back 207

auth.cer

Hint 207

NetScreen JNCIS-FWV Study Guide, p.45

Front 208

What is the NetScreen's digital certificate normally called?

Back 208

local.cer

Hint 208

NetScreen JNCIS-FWV Study Guide, p.45

Front 209

What two options does a NetScreen have for certificate validation?

Back 209

CRL and OSCP

Hint 209

NetScreen JNCIS-FWV Study Guide, p.45

Front 210

In IKE Main Mode, what takes place in messages 1 and 2?

Back 210

Propose and accept the encryption and authentication algorithms.

Hint 210

NetScreen JNCIS-FWV Study Guide, p.46

Front 211

In IKE Main Mode, what takes place in messages 3 and 4?

Back 211

Execute a DH exchange where the initiator and recipient each exchange a nonce.

Hint 211

NetScreen JNCIS-FWV Study Guide, p.46

Front 212

In terms of IKE negotiation, what is a nonce?

Back 212

A randomly generated number.

Hint 212

NetScreen JNCIS-FWV Study Guide, p.46

Front 213

In IKE Main Mode, what takes place in messages 5 and 6?

Back 213

Send and verify identities.

Hint 213

NetScreen JNCIS-FWV Study Guide, p.46

Front 214

In Aggressive Mode IKE, what takes place in the first message?

Back 214

The initiator proposes the SA, initiates a DH exchange, sends a nonce, and its IKE identity.

Hint 214

NetScreen JNCIS-FWV Study Guide, p.46

Front 215

In Aggressive Mode IKE, what takes place in the second message?

Back 215

The recipient accepts the SA, authenticates the initiator, sends a nonce, its IKE identity and its digital certificate (if applicable)

Hint 215

NetScreen JNCIS-FWV Study Guide, p.46

Front 216

In Aggressive Mode IKE, what takes place in the third message?

Back 216

The initiator authenticates the recipient, confirms the exchange, and sends its digital certificate (if applicable)

Hint 216

NetScreen JNCIS-FWV Study Guide, p.46

Front 217

What three main components make up the structure of a Phase 1 Proposal?

Back 217

Authentication Method

Diffie-Hellman Group

Encryption/Authentication Scheme

Hint 217

NetScreen JNCIS-FWV Study Guide, p.47

Front 218

What three main components make up the structure of a Phase 2 proposal?

Back 218

Perfect Forward Secrecy (on or off)

Encapsulation method (esp or ah)

Encryption/Authentication scheme

Hint 218

NetScreen JNCIS-FWV Study Guide, p.48

Front 219

What command would create a gateway for use with policy based VPN called "gateway" with IP 1.1.1.1, using e1/1 as the outgoing interface, and qwe123 as the preshared key?

Back 219

set ike gateway gateway address 1.1.1.1 outgoing-interface e1/1 preshare qwe123 proposal <proposal-name>

Hint 219

NetScreen JNCIS-FWV Study Guide, p.49

Front 220

What command would create a VPN policy to use a VPN tunnel called "vpnObject" for all traffic from untrust to trust?

Back 220

set policy from untrust to trust any any any tunnel vpn vpnObject

Hint 220

NetScreen JNCIS-FWV Study Guide, p.49

Front 221

After creating a gateway called "VPNgateway", what command would configure an IPSec VPN called "vpnObject" to use that gateway?

Back 221

set vpn vpnObject gateway VPNgateway sec-level <phase2-proposal>

Hint 221

NetScreen JNCIS-FWV Study Guide, p.49

Front 222

What command would bind tunnel interface tunnel0 to VPN vpnObject?

Back 222

set vpn vpnObject bind interface tunnel0

Hint 222

NetScreen JNCIS-FWV Study Guide, p.50

Front 223

What command would configure vrouter "trust-vr" to create a route-based VPN using interface tunnel0 when sending traffic to 192.168.1.0/24?

Back 223

set vrouter trust-vr route 192.168.1.0/24 interface tunnel0

Hint 223

NetScreen JNCIS-FWV Study Guide, p.51

Front 224

What mode needs to be used for IKE when creating VPNs with dynamically addressed peers?

Back 224

Aggressive mode

Hint 224

NetScreen JNCIS-FWV Study Guide, p.54

Front 225

If N is the number of sites, how many tunnels will be necessary to create a fully meshed VPN?

Back 225

[N x (N-1)]/2

Hint 225

NetScreen JNCIS-FWV Study Guide, p.55

Front 226

What two files does a NetScreen rely on for operation?

Back 226

The ScreenOS binary, and the configuration file.

Hint 226

CJFV, Part 4 - Device Management, p.21

Front 227

What command would you use to restore a configuration called config.txt from a TFTP server at 1.1.1.1 to the local device?

Back 227

save config from tftp 1.1.1.1 config.txt to flash

Hint 227

CJFV, Part 4 - Device Management, p.23

Front 228

After restoring a configuration from a TFTP server (without merging), what do you need to do to activate that configuration?

Back 228

Restart the system.

Hint 228

CJFV, Part 4 - Device Management, p.23

Front 229

What command is used to save the current configuration as the "last known good" configuration?

Back 229

save config to last-known-good

Hint 229

CJFV, Part 4- Device Management, p.23

Front 230

What commands would be used to reset the system using the saved "last known good" configuration?

Back 230

exec config rollback enable
reset

Hint 230

CJFV, Part 4- Device Management, p.23

Front 231

What command would be used to upgrade your device using a file, newimage.bin, on a TFTP server at 1.1.1.1?

Back 231

save software from tftp 1.1.1.1 newimage.bin to flash
reset

Hint 231

CJFV, Part 4 - Device Management, p.28

Front 232

What method can you use via the console to reset a system to defaults if you lose the root password?

Back 232

Use the serial number as the username and password.

Hint 232

CJFV, Part 4 - Device Management, p.34

Front 233

To disable recovery via console login, what command would you use?

Back 233

unset admin device-reset

Hint 233

CJFV, Part 4 - Device Management, p.34

Front 234

To disable recovery via the physical pinhole on the exterior of the system, what command would you use?

Back 234

unset admin hw-reset

Hint 234

CJFV, Part 4 - Device Management, p.34

Front 235

What command would create a zone called "Zoney"

Back 235

set zone name zoney

Hint 235

CJFV Part 5 - Layer 3 Operations, p.11

Front 236

What command could you use to test the path to 1.1.1.1 and display each hop along the path?

Back 236

trace-route 1.1.1.1

Hint 236

CJFV Part 5 - Layer 3 Operations, p.23

Front 237

What command will display the debug buffer size in bytes?

Back 237

get dbuf info

Hint 237

CJFV Part 5 - Layer 3 Operations, p.26

Front 238

What command will display the contents of the debug buffer?

Back 238

get dbuf stream

Hint 238

CJFV Part 5 - Layer 3 Operations, p.26

Front 239

What command will set the size of the debug buffer to 32 kilobytes?

Back 239

set dbuf size 32

Hint 239

CJFV Part 5 - Layer 3 Operations, p.26

Front 240

What is the maximum configurable size of the debug buffer, using the command "set dbuf size" ?

Back 240

4096 kilobytes

Front 241

What command will clear the contents of the debug buffer?

Back 241

clear dbuf

Hint 241

CJFV Part 5 - Layer 3 Operations, p.26

Front 242

What command would you use to create a flow filter designed to show one-way traffic to 1.1.1.1?

Back 242

set ffilter dst-ip 1.1.1.1

Hint 242

CJFV Part 5 - Layer 3 Operations, p.28

Front 243

What command would you use to view the current flow filter?

Back 243

get ffilter

Hint 243

CJFV Part 5 - Layer 3 Operations, p.30

Front 244

What command would you use to remove the flow filter with the lowest ID?

Back 244

unset ffilter

Hint 244

CJFV Part 5 - Layer 3 Operations, p.30

Front 245

What will you see in a "debug flow basic" if you have no route to reach the destination IP of a packet the ScreenOS device is inspecting?

Back 245

packet dropped, no route

Hint 245

CJFV Part 5 - Layer 3 Operations, p.37

Front 246

What message will you see in a "debug flow basic" if the packet gets dropped by policy?

Back 246

packet dropped, denied by policy

Hint 246

CJFV Part 5 - Layer 3 Operations, p.38

Front 247

If using multiple virtual routers, to what zone must traffic be going in order for NAT mode to perform source address translation?

Back 247

The egress zone must be a member of the untrust-vr, and the ingress zone must be in NAT mode.

Hint 247

CJFV Part 5 - Layer 3 Operations, p.42

Front 248

What command would create an address called Internal, in zone Trust, with address 1.1.1.1?

Back 248

set address Trust Internal 1.1.1.0/32

Hint 248

CJFV Part 6 - Basic Policy Configuration, p.7

Front 249

What command would create an address in zone Untrust, called Google, whose address resolves to www.google.com?

Back 249

set address Untrust Google www.google.com

Hint 249

CJFV Part 6 - Basic Policy Configuration, p.7

Front 250

What command will display all service objects that exist by default?

Back 250

get service pre-defined

Hint 250

CJFV Part 6 - Basic Policy Configuration, p.12

Front 251

What command will create a custom service object called Service that matches TCP destination port 1000?

Back 251

set service Service protocol tcp dst-port 1000-1000

Hint 251

CJFV Part 6 - Basic Policy Configuration, p.13

Front 252

What command will move policy 5 to before policy 4 in the policy order?

Back 252

set policy move 5 before 4

Hint 252

CJFV Part 6 - Basic Policy Configuration, p.19

Front 253

What command would create a new address group in zone Trust, called "internal-hosts" and add host1 to the group?

Back 253

set group address Trust internal-hosts add host1

Front 254

What command will list all service groups?

Back 254

get group service

Hint 254

CJFV Part 6 - Basic Policy Configuration, p.30

Front 255

What command will display specific information about a service group called service-group?

Back 255

get group service service-group

Hint 255

CJFV Part 6 - Basic Policy Configuration, p.30

Front 256

What command would create a policy in the global zone to deny all traffic?

Back 256

set policy global any any any deny

Hint 256

CJFV Part 6 - Basic Policy Configuration, p.43

Front 257

What command could you use to determine if intra-zone block is enabled in zone Trust?

Back 257

get zone trust

Hint 257

CJFV Part 6 - Basic Policy Configuration, p.49

Front 258

Will the snoop command show you packets handled via the CPU, ASIC processor, or both?

Back 258

Only CPU

Hint 258

CJFV Part 6 - Basic Policy Configuration, p.50

Front 259

What command can be used to determine if any snoop filters are currently defined?

Back 259

snoop info

Hint 259

CJFV Part 6 - Basic Policy Configuration, p.51

Front 260

What command will turn snoop on?

Back 260

snoop

Hint 260

CJFV Part 6 - Basic Policy Configuration, p.51

Front 261

What two methods can you use to disable snoop after turning it on?

Back 261

"snoop off" command, or press Esc key

Hint 261

CJFV Part 6 - Basic Policy Configuration, p.51

Front 262

What command would you use to filter snoop for packets destined to 1.1.1.1?

Back 262

snoop filter ip dst-ip 1.1.1.1

Hint 262

CJFV Part 6 - Basic Policy Configuration, p.54

Front 263

What command is used to display data captured with the snoop command?

Back 263

get db stream

Hint 263

CJFV Part 6 - Basic Policy Configuration, p.55

Front 264

When using logging on a policy, when is traffic logged, by default?

Back 264

When a session is closed.

Hint 264

CJFV Part 7 - Basic Policy Configuration, p.8

Front 265

What command would you use to create a policy from trust to untrust to permit any traffic, and log the traffic when the session closes?

Back 265

set policy from trust to untrust any any any permit logging

Hint 265

CJFV Part 6 - Basic Policy Configuration, p.8

Front 266

What command would you use to create a policy from trust to untrust to permit any traffic, and log the traffic when the session is opened?

Back 266

set policy from trust to untrust any any any permit logging session-init

Hint 266

CJFV Part 6 - Basic Policy Configuration, p.8

Front 267

What command is used to display the traffic log?

Back 267

get log traffic

Hint 267

CJFV Part 6 - Basic Policy Configuration, p.10

Front 268

What command would create a policy from trust to untrust that permits all traffic, and enable counting on that policy?

Back 268

set policy from trust to untrust any any any permit count

Hint 268

CJFV Part 6 - Basic Policy Configuration, p.12

Front 269

From within the "(policy:1)" context, what command will enable counting?

Back 269

set count

Hint 269

CJFV Part 6 - Basic Policy Configuration, p.12

Front 270

From within the "(policy:1)" context, what command will enable counting with alarm thresholds for more than 1000 B/sec or 50 KB/minute?

Back 270

set count alarm 1000 50

Hint 270

CJFV Part 6 - Basic Policy Configuration, p.12

Front 271

What command would show policy counters from the last day on policy id 20?

Back 271

get counter policy 20 day

Hint 271

CJFV Part 6 - Basic Policy Configuration, p.14

Front 272

What two types of of time objects can be used in policies?

Back 272

Recurrent times, and one-time scheduling.

Hint 272

CJFV Part 6 - Basic Policy Configuration, p.15

Front 273

What command would create a time object called "Timer" that matches Friday from 01:00 to 02:00 and 03:00 to 04:00?

Back 273

set scheduler Timer recurrent friday start 01:00 stop 02:00 start 03:00 stop 04:00

Hint 273

CJFV Part 6 - Basic Policy Configuration, p.17

Front 274

What command would create a time object called "Timer" that matches the dates 1/1/12 to 1/10/12?

Back 274

set scheduler Timer once start 01/01/2012 00:00 stop 01/10/2012 23:59

Hint 274

CJFV Part 6 - Basic Policy Configuration, p.17

Front 275

What command would create a policy from Trust to Untrust that allows any traffic but only during times matching scheduler object "Timer"?

Back 275

set policy from trust to untrust any any any permit schedule Timer

Hint 275

CJFV Part 6 - Basic Policy Configuration, p.20

Front 276

By default, how long is an authentication good for?

Back 276

As long as the session remains active, plus 10 minutes.

Hint 276

CJFV Part 6 - Basic Policy Configuration, p.22

Front 277

What command would change the length of time that an authentication is good for to 20 minutes after the close of the authenticated session?

Back 277

set auth-server local timeout 20

Hint 277

CJFV Part 6 - Basic Policy Configuration, p.22

Front 278

What three services does policy-based authentication work for?

Back 278

Telnet, FTP, HTTP

Hint 278

CJFV Part 6 - Basic Policy Configuration, p.22

Front 279

What command would create a user bob with password qwe123, for use with an authentication policy?

Back 279

set user bob password qwe123

Hint 279

CJFV Part 6 - Basic Policy Configuration, p.27

Front 280

What type of authentication requires a user to actively browse to a specific IP address before they can generate authenticated traffic?

Back 280

WebAuth

Hint 280

CJFV Part 6 - Basic Policy Configuration, p.24

Front 281

What command would create a policy from trust to untrust that allows any traffic, but only if webauth is performed?

Back 281

set policy from trust to untrust any any any permit webauth

Hint 281

CJFV Part 6 - Basic Policy Configuration, p.30

Front 282

What command would create a policy from trust to untrust that allows any traffic, but requires standard authentication?

Back 282

set policy from trust to untrust any any any permit auth

Hint 282

CJFV Part 6 - Basic Policy Configuration, p.30

Front 283

What series of commands would enable WebAuth on interface e1/1 to IP address 1.1.1.1, and require HTTPS?

Back 283

set interface e1/1 webauth

set interface e1/1 webauth ssl-only

set interface e1/1 webauth-ip 1.1.1.1

Front 284

What command would show all currently authenticated users?

Back 284

get user all

Front 285

What command will show authentication login statistics?

Back 285

get auth table

Front 286

What type of NAT provides bidirectional translation?

Back 286

MIP

Hint 286

CJFV Part 8 - Address Translation, p.3

Front 287

If you want to have a single public address map to multiple internal servers, what type of NAT should you use?

Back 287

VIP

Hint 287

CJFV Part 8 - Address Translation, p.5

Front 288

What command would you use to display all configured DIP addresses?

Back 288

get dip

Hint 288

CJFV Part 8 - Address Translation, p.18

Front 289

What command would create a NAT-dst policy from untrust to trust that directs HTTP traffic from any host to address PublicIP to port 8080 on host 1.1.1.1?

Back 289

set policy from untrust to trust any PublicIP http nat dst ip 1.1.1.1 port 8080 permit

Hint 289

CJFV Part 8 - Address Translation, p.31

Front 290

Should MIP addresses be defined on the internal or external interface?

Back 290

external

Hint 290

CJFV Part 8 - Address Translation, p.46

Front 291

What type of NAT can use addresses that are not associated with the interface on which the NAT is placed?

Back 291

MIP

Hint 291

CJFV Part 8 - Address Translation, p.46

Front 292

If an overlap exists between MIP and VIP mappings, which one takes precedence?

Back 292

MIP

Hint 292

CJFV Part 8 - Address Translation, p.60

Front 293

What takes precedence, MIP/VIP or unidirectional translation?

Back 293

MIP/VIP

Hint 293

CJFV Part 8 - Address Translation, p.60

Front 294

What takes precedence, policy-based or interface-based NAT?

Back 294

policy-based

Hint 294

CJFV Part 8 - Address Translation, p.60

Front 295

What does CIA stand for, in regard to the three driving concerns for network security?

Back 295

Confidentiality
Integrity
Authentication

Hint 295

CJFV Part 9 - VPN Concepts, p.3

Front 296

What method of encryption uses the same key for encryption and decryption?

Back 296

Symmetric Key Encryption

Hint 296

CJFV Part 9 - VPN Concepts, p.5

Front 297

What method of encryption uses one key that is secret and known only to the owner, and one key that is widely distributed and can be accessed by anyone?

Back 297

Asymmetric Key/Public Key Encryption

Hint 297

CJFV Part 9 - VPN Concepts, p.6

Front 298

What is the major drawback of Public Key Encryption?

Back 298

Large key size means that public keys are extremely slow and generally not feasible for bulk data encryption.

Hint 298

CJFV Part 9 - VPN Concepts, p.6

Front 299

How many bits are in an MD5 hash?

Back 299

128

Hint 299

CJFV Part 9 - VPN Concepts, p.7

Front 300

How many bits are in a SHA-1 hash?

Back 300

160

Hint 300

CJFV Part 9 - VPN Concepts, p.7

Front 301

What is the authentication process that appends a hashed pre-shared key to data, so that the receiver can validate the source of the data?

Back 301

Hashed Method Authentication Code (HMAC)

Hint 301

CJFV Part 9 - VPN Concepts, p.10

Front 302

How large is the prime number used for Diffie-Hellman group 1?

Back 302

768 bits

Hint 302

CJFV Part 9 - VPN Concepts, p.13

Front 303

How large is the prime number used for Diffie-Hellman group 2?

Back 303

1024 bits

Hint 303

CJFV Part 9 - VPN Concepts, p.13

Front 304

How large is the prime number used for Diffie-Hellman group 5?

Back 304

1536 bits

Hint 304

CJFV Part 9 - VPN Concepts, p.13

Front 305

What three Diffie-Hellman groups are supported by ScreenOS devices?

Back 305

1, 2, and 5

Hint 305

CJFV Part 9 - VPN Concepts, p.13

Front 306

What two protocols are defined in the IPSec standard?

Back 306

ESP and AH

Hint 306

CJFV Part 9 - VPN Concepts, p.17

Front 307

Of the two protocols defined in the IPSec standard, which does NOT provide encryption?

Back 307

AH

Hint 307

CJFV Part 9 - VPN Concepts, p.17

Front 308

In what two modes can IPSec be implemented?

Back 308

Tunnel mode and Transport mode.

Hint 308

CJFV Part 9 - VPN Concepts, p.18

Front 309

How many bits are in the SPI field of an ESP packet header?

Back 309

32

Hint 309

CJFV Part 9 - VPN Concepts, p. 20

Front 310

What is the protocol number of ESP traffic?

Back 310

50

Hint 310

CJFV Part 9 - VPN Concepts, p. 20

Front 311

What is the protocol number of AH traffic?

Back 311

51

Hint 311

CJFV Part 9 - VPN Concepts, p. 21

Front 312

What port and protocol does the Internet Key Exchange protocol use?

Back 312

UDP port 500

Hint 312

CJFV Part 9 - VPN Concepts, p. 23

Front 313

What values are used to uniquely identify a Security Association?

Back 313

- SPI number
- Destination IP address
- Security Protocol (ESP/AH)

Hint 313

CJFV Part 9 - VPN Concepts, p. 24

Front 314

If one peer has a dynamically assigned peer address, what changes need to be made to IKE Phase 1?

Back 314

IKE Phase 1 should use aggressive mode.

Hint 314

CJFV Part 9 - VPN Concepts, p. 27

Front 315

Which packets of Phase 1 are used to determine the encryption algorithm, hash algorithm, DH group, and authentication method?

Back 315

Packets one and two.

Hint 315

CJFV Part 9 - VPN Concepts, p. 29

Front 316

Of the two protocols defined in the IPSec standard, which does NOT provide encryption?

Back 316

AH

Hint 316

CJFV Part 9 - VPN Concepts, p.17

Front 317

In what two modes can IPSec be implemented?

Back 317

Tunnel mode and Transport mode.

Hint 317

CJFV Part 9 - VPN Concepts, p.18

Front 318

What values are used to uniquely identify a Security Association?

Back 318

- SPI number
- Destination IP address
- Security Protocol (ESP/AH)

Hint 318

CJFV Part 9 - VPN Concepts, p. 24

Front 319

If one peer has a dynamically assigned peer address, what changes need to be made to IKE Phase 1?

Back 319

IKE Phase 1 should use aggressive mode.

Hint 319

CJFV Part 9 - VPN Concepts, p. 27

Front 320

Which packets of Phase 1 are used to determine the encryption algorithm, hash algorithm, DH group, and authentication method?

Back 320

Packets one and two.

Hint 320

CJFV Part 9 - VPN Concepts, p. 29

Front 321

What is the main purpose of IKE Quick Mode packet 3?

Back 321

To acknowledge information sent in Quick Mode packet 2, and complete tunnel establishment.

Hint 321

CJFV Part 9 - VPN Concepts, p. 32

Front 322

When using IKE aggressive mode to allow a VPN tunnel with a DAIP peer, which device should send Phase 1 Packet 1?

Back 322

The device with the dynamic IP.

Hint 322

CJFV Part 9 - VPN Concepts, p.33

Front 323

If using a policy-based VPN, what action do you use in the policy for the traffic that you intend to encrypt?

Back 323

Tunnel

Hint 323

CJFV Part 10 - VPN Concepts, p.2

Front 324

What CLI command would you use to create a peer gateway called VPNpeer, at 1.1.1.1, to go out interface e1/1, using a preshared key, qwe123 with standard security level?

Back 324

set ike gateway VPNpeer address 1.1.1.1 outgoing-interface e1/1 preshare qwe123 sec-level standard

Hint 324

CJFV Part 10 - VPN Concepts, p.5

Front 325

What CLI command would you use to create a Phase 2 called p2-VPN, using a configured gateway called VPNpeer with standard security level?

Back 325

set vpn p2-VPN gateway VPNpeer sec-level standard

Hint 325

CJFV Part 10 - VPN Concepts, p.10

Front 326

What caveat is true of policy-based VPN if the user traffic and outgoing interface for a VPN are in the same zone?

Back 326

Policy-based VPN will not work -- you need to configure a route-based VPN.

Hint 326

CJFV Part 10 - VPN Concepts, p. 16

Front 327

What CLI command will configure a policy for policy-based VPN to direct traffic to VPN p2-VPN?

Back 327

set policy from trust to untrust <source> <destination> any tunnel vpn p2-VPN

Hint 327

CJFV Part 10 - VPN Concepts, p.17

Front 328

If you have a policy-based VPN that directs all traffic from the network associated with your firewall's trust interface, what ping command can you use to test the tunnel?

Back 328

ping x.x.x.x from trust

Hint 328

CJFV Part 10 - VPN Concepts, p.20

Front 329

What "get" command can be used to verify that Phase 1 completed successfully?

Back 329

get ike cookie / get ike cookies

Hint 329

CJFV Part 10 - VPN Concepts, p.21

Front 330

What "get" command can be used to verify that Phase 2 completed successfully?

Back 330

get sa active

Hint 330

CJFV Part 10 - VPN Concepts, p.21

Front 331

What "get event" command can be used to see all messages in the event log related to VPN?

Back 331

get event type 536

Hint 331

CJFV Part 10 - VPN Concepts, p.25

Front 332

What is true of tunnel interface configuration if you need to use a MIP or DIP in the tunnel?

Back 332

The tunnel interface must have an IP address.

Hint 332

CJFV Part 11 - VPN Concepts, p.5

Front 333

In terms of address assignment, if two devices are using route-based VPN, what must be true of addressed tunnel interfaces in order for routing to function properly?

Back 333

The tunnel interfaces must be in the same subnet.

Front 334

What must be true of your tunnel interface if you want to use MIP and DIP addresses in the VPN tunnel?

Back 334

The tunnel interface must have a fixed IP address.

Front 335

In terms of zone membership, what must be true of a tunnel interface and the interface from which that tunnel interface borrows its IP?

Back 335

The two interfaces must be in the same zone.

Hint 335

CJFV Part 11, p.6

Front 336

Is there a limit to the number of tunnel interfaces that a device can support?

Back 336

Yes, but the number varies by appliance.

Hint 336

CJFV Part 11, p.8

Front 337

If Intrazone Blocking is enabled, and a tunnel interface resides in the same zone as where the traffic originzted, is policy required for the traffic to pass?

Back 337

Yes.

Hint 337

CJFV Part 11, p.8

Front 338

What CLI command would create tunnel interface "tunnel.100" and assign it to the "Trust" zone?

Back 338

set interface tunnel.100 zone trust

Hint 338

CJFV Part 11, p.8

Front 339

What CLI command would create unnumbered tunnel interface "tunnel.100," and configure the tunnel interface to borrow the IP of the e1/1 interface?

Back 339

set interface tunnel.100 ip unnumbered interface trust

Hint 339

CJFV Part 11, p.8

Front 340

What command would create an Autokey IKE entry called "CorporateVPN" to use IKE gateway "toCorporate" with standard security level?

Back 340

set vpn CorporateVPN gateway toCorporate sec-level standard

Hint 340

CJFV Part 11, p.13

Front 341

What command would bind Autokey IKE entry "CorporateVPN" to tunnel interface tunnel.1

Back 341

set vpn CorporateVPN bind interface tunnel.1

Hint 341

CJFV Part 11, p.13

Front 342

If using route-based VPNs, how do you determine what traffic should go through the VPN tunnel?

Back 342

By creating a route for that traffic to use the tunnel interface.

Hint 342

CJFV Part 11, p.16

Front 343

What to events of type 00536 normally pertain to?

Back 343

VPN

Hint 343

CJFV Part 11, p.24

Front 344

What algorithm can be used to calculate the total number of VPN tunnels that will be required in a fully meshed VPN between "N" sites?

Back 344

[N x (N-1)]/2

Hint 344

JNCIS-FWV Study Guide, p.55

Front 345

How do you view the NHTB table?

Back 345

It is not possible to view the next-hop tunnel binding table.

Hint 345

JNCIS-FWV Study Guide, p.60

Front 346

What table is used to assign multiple VPN tunnels to a single tunnel interface?

Back 346

The next-hop tunnel binding (NHTB) table.

Hint 346

JNCIS-FWV Study Guide, p.60

Front 347

What CLI command would be used to create an NHTB table entry for tunnel interface tunnel.10 to use 10.1.1.1 as the IP for the vpn "VPN1"

Back 347

set interface tunnel.10 nhtb 10.1.1.1 vpn VPN1

Hint 347

JNCIS-FWV Study Guide, p.60

Front 348

What type of packets are sent through the VPN tunnel if VPN monitoring is used?

Back 348

ICMP echo requests

Hint 348

JNCIS-FWV Study Guide, p.66

Front 349

What command will set VPN monitoring to send a tunnel test packet every 30 seconds?

Back 349

set vpnmonitor frequency 30

Hint 349

JNCIS-FWV Study Guide, p.66

Front 350

What is the default value for VPN monitoring frequency?

Back 350

10 seconds

Hint 350

JNCIS-FWV Study Guide, p.66

Front 351

What is the default threshold for number of consecutive successful or failed responses, in VPN monitoring?

Back 351

10

Hint 351

JNCIS-FWV Study Guide, p.67

Front 352

What CLI command would set the VPN monitoring threshold to 50?

Back 352

set vpnmonitor threshold 50

Hint 352

JNCIS-FWV Study Guide, p.66

Front 353

What CLI comand would set up vpn monitoring on the CorpVPN VPN to ping from the tunnel.1 interface to the destination IP 1.1.1.1?

Back 353

set vpn CorpVPN source-interface tunnel.1 destination-ip 1.1.1.1

Hint 353

JNCIS-FWV Study Guide, p.67

Front 354

What does the rekey option do, in regards to VPN monitoring?

Back 354

Even if the tunnel is not currently up, the firewall will send tunnel test packets that attempt to establish the VPN tunnel.

Hint 354

JNCIS-FWV Study Guide, p.67

Front 355

What does the optimization option do, in regard to VPN monitoring?

Back 355

1) The device will consider incoming traffic through the tunnel equivalent to tunnel test packets, and will not mark the VPN as down, regardless of whether ICMP echo requests are successful.

2) If there is incoming AND outgoing traffic in the VPN tunnel, the firewall suppresses ICMP tunnel test packets altogether.

Hint 355

JNCIS-FWV Study Guide, p.67

Front 356

What two mechanisms are used to monitor members of a VPN group?

Back 356

1) IKE Heartbeats
2) IKE Recovery Attempts

Hint 356

JNCIS-FWV Study Guide, p.68

Front 357

What CLI command would set up IKE heartbeat monitoring to gateway gateway_a, and set the number of heartbeats to send to the default value?

Back 357

set ike gateway gateway_a heartbeat hello 5
or
set ike gateway gateway_a heartbeat

Hint 357

JNCIS-FWV Study Guide, p.68

Front 358

What CLI command would be used on a VPN group member to configure its weight to 10 in group id 10 of the CorpVPN VPN?

Back 358

set vpn-group id 10 vpn CorpVPN weight 10

Hint 358

JNCIS-FWV Study Guide, p.69

Front 359

When using VPN groups, what CLI command is necessary to prevent failover packets from being dropped?

Back 359

unset flow tcp-syn-check-in-tunnel

Hint 359

JNCIS-FWV Study Guide, p.69

Front 360

What CLI command will enable IKE debugging?

Back 360

debug ike basic | detail

Hint 360

JNCIS-FWV Study Guide, p.71

Front 361

What CLI command will give you verbose information about a specific IKE SA?

Back 361

get sa id <id#>

Hint 361

JNCIS-FWV Study Guide, p.72

Front 362

What does the error "Phase 2: No policy exists for the proxy ID received" normally indicate?

Back 362

The encryption domains do not match up on the devices.

Hint 362

JNCIS-FWV Study Guide, p.74

Front 363

What does the error "Rejected an IKE packet because there were no acceptable Phase 1 proposals" normally indicate?

Back 363

That the phase 1 proposals do not match on the VPN peers.

Hint 363

JNCIS-FWV Study Guide, p.75

Front 364

What does the error "Rejected an IKE packet because there were no acceptable Phase 2 proposals" normally indicate?

Back 364

That the phase 2 proposals on the VPN peers do not match.

Hint 364

JNCIS-FWV Study Guide, p.76

Front 365

What does the error "Rejected an IKE packet because an initial Phase 1 packet arrived from an unrecognized peer gateway." normally indicate?

Back 365

That the outgoing interface for a given VPN has been incorrectly specified.

Hint 365

JNCIS-FWV Study Guide, p.78

Front 366

Is g3-esp-aes-md5 an acceptable Phase 2 proposal? Why?

Back 366

No. Only Diffie-Hellman groups 1, 2, and 5 are supported.

Hint 366

JNCIS-FWV Study Guide, p.78

Front 367

In terms of a phase 2 proposal, such as g1-esp-aes-sha, what are the valid values for the section before the first dash? (g1 above)

Back 367

nopfs, g1, g2, g5

Hint 367

JNCIS-FWV Study Guide, p.78

Front 368

During main mode, in which messages is the nonce exchanged?

Back 368

MM3 and MM4

Hint 368

JNCIS-FWV Study Guide, p.78

Front 369

How many tunnels are required for fully meshed bidirectional traffic between 20 firewalls?

Back 369

( 20 x ( 20 - 1 ) ) / 2
----------
( 20 x 19 ) / 2
----------
( 380 ) / 2
----------
190

Hint 369

JNCIS-FWV Study Guide, p.79

Front 370

If you configure your VPN tunnel to use the wrong outgoing interface, what error will you see when the other side of the VPN attempts to set up the tunnel?

Back 370

"packet arrived from an unrecognized peer gateway"

Hint 370

JNCIS-FWV Study Guide, p.79

Front 371

Based on the following output from "get ike cookie", how long has the Phase 1 SA been active?
resent-tmr 7166032 lifetime 28800 lt-recv 28800 nxt_rekey 28379 cert-expire 0

Back 371

421 seconds (lifetime - nxt_rekey)

Hint 371

JNCIS-FWV Study Guide, p.79

Front 372

Based on the following output from "get sa", how long has the Phase 2 SA most likely been active?
00000001< 1.1.1.1 500 esp:3des/sha1 e3270b99 3193 unlim A/- 2 0
00000001> 1.1.1.1 500 esp:3des/sha1 3c472af5 3193 unlim A/- 1 0

Back 372

3600 (default lifetime) - 3193, or 407 seconds.

Hint 372

JNCIS-FWV Study Guide, p.80

Front 373

Based on the following output from "get sa", is VPN monitoring being used?
00000001< 1.1.1.1 500 esp:3des/sha1 e3270b99 3193 unlim A/- 2 0
00000001> 1.1.1.1 500 esp:3des/sha1 3c472af5 3193 unlim A/- 1 0

Back 373

No. If VPN monitoring was enabled, we'd see A/Up or A/Down in the status column, instead of A/-

Hint 373

JNCIS-FWV Study Guide, p.80

Front 374

Do more relevant VPN setup error messages normally come from the initiator or the recipient of a VPN negotiation?

Back 374

The recipient.

Hint 374

JNCIS-FWV Study Guide, p.85

Front 375

What components need to be loaded on a irewall to support digital certificates for VPN authentication?

Back 375

The CA's digitial certificate, the local certificate assigned to the device, and the CRL

Hint 375

JNCIS-FWV Study Guide, p.86

Front 376

Given the following information, if the VPN tunnel to the primary firewall were to fail, which firewall would be next in line?
Firewall 1: VPN Group 1 – Weight 3
Firewall 2: VPN Group 1 – Weight 1
Firewall 3: VPN Group 1 – Weight 4
Firewall 4: VPN Group 1 – Weight 2

Back 376

Firewall 1 (Firewall 3 would be the primary firewall in the group)

Hint 376

JNCIS-FWV Study Guide, p.86

Front 377

What Phase 1 mode should be used in order to establish a VPN with a dynamic peer?

Back 377

Aggressive Mode

Hint 377

JNCIS-FWV Study Guide, p.86

Front 378

What is the default proxy-id for a route-based VPN?

Back 378

There is none.

Hint 378

JNCIS-FWV Study Guide, p.86

Front 379

Generally speaking, what two access methods does "Local Management" refer to?

Back 379

Access via an interface bound to the Trust zone, and direct console access.

Hint 379

JNCIS-FWV Study Guide, p.88

Front 380

What is the term used to describe an IP address assigned to an interface for the sole purpose of management?

Back 380

Manage IP

Hint 380

JNCIS-FWV Study Guide, p.88

Front 381

What CLI command can you use to find out if any manage IPs are in use on interface ethernet1?

Back 381

get interface ethernet1

Hint 381

JNCIS-FWV Study Guide, p.89

Front 382

When you assign a Manage IP to an interface, can the actual IP of the interface still be used to manage the firewall?

Back 382

No.

Hint 382

JNCIS-FWV Study Guide, p.89

Front 383

Can a manage IP be in a different network than the actual IP of an interface?

Back 383

No.

Hint 383

JNCIS-FWV Study Guide, p.89

Front 384

What is the difference between a manage IP and a manager IP?

Back 384

A manage IP is the IP address assigned to an interface for the purposes of management, while a manager IP is the IP address of a host, range or network that can access the device in order to manage it.

Hint 384

JNCIS-FWV Study Guide, p.90

Front 385

What manager IP is configured on a firewall, by default?

Back 385

None.

Hint 385

JNCIS-FWV Study Guide, p.90

Front 386

Are manager IP addresses global, or assigned on a per-interface basis?

Back 386

Global.

Hint 386

JNCIS-FWV Study Guide, p.90

Front 387

If no manager IPs are configured on a device, can the device be managed?

Back 387

Yes. Any address will be allowed to manage the device.

Hint 387

JNCIS-FWV Study Guide, p.90

Front 388

What CLI command will add the network 192.168.0.0/24 to the list of manager IPs?

Back 388

set admin manager-ip 192.168.0.0 255.255.255.0

Hint 388

JNCIS-FWV Study Guide, p.90

Front 389

What CLI command will give you a list of currently configured manager IPs?

Back 389

get admin manager-ip

Hint 389

JNCIS-FWV Study Guide, p.90

Front 390

What three methods of CLI access are supported on a ScreenOS device?

Back 390

telnet, SSH, and console

Hint 390

JNCIS-FWV Study Guide, p.91

Front 391

What is the main difference between CLI and WebUI management, in terms of saving the configuration?

Back 391

In CLI, you have to issue the save command to save configuration, while in WebUI, configurations are written to memory as they are applied.

Hint 391

JNCIS-FWV Study Guide, p.91

Front 392

Is it recommended to use SSHv1 or SSHv2 for SSH access to the ScreenOS device?

Back 392

SSHv2

Hint 392

JNCIS-FWV Study Guide, p.91

Front 393

What version of SSH access is supported on a ScreenOS device?

Back 393

SSHv1, and SSHv2

Hint 393

JNCIS-FWV Study Guide, p.91

Front 394

By default, do any interfaces have telnet management enabled?

Back 394

Yes, interfaces assigned to the Trust zone.

Hint 394

JNCIS-FWV Study Guide, p.92

Front 395

What commands would enable SSHv2 management on interface ethernet1?

Back 395

set ssh version v2
set ssh enable
set interface ethernet1 manage ssh

Hint 395

JNCIS-FWV Study Guide, p.92

Front 396

What CLI commands are necessary to enable telnet on interface ethernet1?

Back 396

set interface ethernet1 manage telnet

Hint 396

JNCIS-FWV Study Guide, p.92

Front 397

What CLI command will enable WebUI management on interface ethernet1?

Back 397

set interface ethernet1 web

Hint 397

JNCIS-FWV Study Guide, p.92

Front 398

What CLI command will enable SSL-encrypted WebUI management on interface ethernet1?

Back 398

set interface ethernet1 ssl

Hint 398

JNCIS-FWV Study Guide, p.92

Front 399

What CLI command will create a juser called johndoe with password qwe123 and read-only access?

Back 399

set admin user johndoe password qwe123 privilege all

Hint 399

JNCIS-FWV Study Guide, p.93

Front 400

What two privilege levels can be assigned to an administrative user with the "set admin user" CLI command?

Back 400

all, read-only

Hint 400

JNCIS-FWV Study Guide, p.93

Front 401

How many root users can be configured on a ScreenOS device?

Back 401

One.

Hint 401

JNCIS-FWV Study Guide, p.93

Front 402

What is the main difference in access privileges between the root user and an administrator with privilege level "all"?

Back 402

The root user can add, modify, and remove other administrative users.

Hint 402

JNCIS-FWV Study Guide, p.94

Front 403

What log is responsible for monitoring packets which terminate at the ScreenOS device itself?

Back 403

The Self Log

Hint 403

JNCIS-FWV Study Guide, p.95

Front 404

What CLI command will enable self logging?

Back 404

set firewall log-self

Hint 404

JNCIS-FWV Study Guide, p.95

Front 405

What is the usual source and destination of a self log entry?

Back 405

Source: null
Destination: self

Hint 405

JNCIS-FWV Study Guide, p.95

Front 406

What CLI command is used to view the self log?

Back 406

get log self

Hint 406

JNCIS-FWV Study Guide, p.95

Front 407

To what levels are logs in the event log categorized and assigned into?

Back 407

Emergency
Alert
Critical
Error
Warning
Notification
Information
Debugging

Hint 407

JNCIS-FWV Study Guide, p.95-97

Front 408

What severity level would a SYN attack be logged as in the event log?

Back 408

Emergency

Hint 408

JNCIS-FWV Study Guide, p.95

Front 409

What severity level would a Tear Drop attack be logged as in the event log?

Back 409

Emergency

Hint 409

JNCIS-FWV Study Guide, p.95

Front 410

What severity level would a Ping of Death attack be logged as in the event log?

Back 410

Emergency

Hint 410

JNCIS-FWV Study Guide, p.95

Front 411

What severity level would more than three authentication failures be logged as in the event log?

Back 411

Alert

Hint 411

JNCIS-FWV Study Guide, p.95

Front 412

What severity level would a WinNuke attack be logged as in the event log?

Back 412

Alert

Hint 412

JNCIS-FWV Study Guide, p.95

Front 413

What severity level would an IP Spoofing attack be logged as in the event log?

Back 413

Alert

Hint 413

JNCIS-FWV Study Guide, p.95

Front 414

What severity level would a Source Route Option attack be logged as in the event log?

Back 414

Alert

Hint 414

JNCIS-FWV Study Guide, p.95

Front 415

What severity level would a LAND attack be logged as in the event log?

Back 415

Alert

Hint 415

JNCIS-FWV Study Guide, p.95

Front 416

What severity level would an ICMP flood be logged as in the event log?

Back 416

Alert

Hint 416

JNCIS-FWV Study Guide, p.95

Front 417

What severity level would a port scan be logged as in the event log?

Back 417

Alert

Hint 417

JNCIS-FWV Study Guide, p.95

Front 418

What severity level would an Address Sweep be logged as in the event log?

Back 418

Alert

Hint 418

JNCIS-FWV Study Guide, p.95

Front 419

What severity level would an Communication error with an external server such as WebSense be logged as in the event log?

Back 419

Alert

Hint 419

JNCIS-FWV Study Guide, p.95

Front 420

What severity level would a Denied policy alarm be logged as in the event log?

Back 420

Alert

Hint 420

JNCIS-FWV Study Guide, p.95

Front 421

What severity level would an Incorrect CA cert used be logged as in the event log?

Back 421

Alert

Hint 421

JNCIS-FWV Study Guide, p.95

Front 422

What severity level would a DHCP range exhausted error be logged as in the event log?

Back 422

Alert

Hint 422

JNCIS-FWV Study Guide, p.95

Front 423

What severity level would an Exceeded BGP Limits error be logged as in the event log?

Back 423

Alert

Hint 423

JNCIS-FWV Study Guide, p.96

Front 424

What severity level would a System upgrade failure error be logged as in the event log?

Back 424

Alert

Hint 424

JNCIS-FWV Study Guide, p.96

Front 425

What severity level would a Bad packet settings error be logged as in the event log?

Back 425

Critical

Hint 425

JNCIS-FWV Study Guide, p.96

Front 426

What severity level would a Blocked Traffic through Screen error be logged as in the event log?

Back 426

Critical

Hint 426

JNCIS-FWV Study Guide, p.96

Front 427

What severity level would a Issue with High Availability error be logged as in the event log?

Back 427

Critical

Hint 427

JNCIS-FWV Study Guide, p.96

Front 428

What severity level would a Low resources error be logged as in the event log?

Back 428

Critical

Hint 428

JNCIS-FWV Study Guide, p.96

Front 429

What severity level would a VIP connectivity error be logged as in the event log?

Back 429

Critical

Hint 429

JNCIS-FWV Study Guide, p.96

Front 430

What severity level would a SSH failure error be logged as in the event log?

Back 430

Critical

Hint 430

JNCIS-FWV Study Guide, p.96

Front 431

What severity level would a VPN monitoring status change mesage be logged as in the event log?

Back 431

Critical

Hint 431

JNCIS-FWV Study Guide, p.96

Front 432

What severity level would a dynamic routing error be logged as in the event log?

Back 432

Critical

Hint 432

JNCIS-FWV Study Guide, p.96

Front 433

What severity level would a SSH negotiation failure error be logged as in the event log?

Back 433

Error

Hint 433

JNCIS-FWV Study Guide, p.96

Front 434

What severity level would an AV scanning error be logged as in the event log?

Back 434

Error

Hint 434

JNCIS-FWV Study Guide, p.96

Front 435

What severity level would a SMTP issue be logged as in the event log?

Back 435

Warning

Hint 435

JNCIS-FWV Study Guide, p.96

Front 436

What severity level would a Administrative login, logout, or single login failure be logged as in the event log?

Back 436

Warning

Hint 436

JNCIS-FWV Study Guide, p.96

Front 437

What severity level would a SYSLOG status or failure be logged as in the event log?

Back 437

Warning

Hint 437

JNCIS-FWV Study Guide, p.96

Front 438

In the event log, under what severity level would an administrative configuration change normally show up?

Back 438

Notification

Hint 438

JNCIS-FWV Study Guide, p.97

Front 439

In the event log, under what severity level would a failure that does not affect the functioning of the firewall normally show up?

Back 439

Notification

Hint 439

JNCIS-FWV Study Guide, p.97

Front 440

In the event log, under what severity level would general information about system operations normally show up?

Back 440

Information

Hint 440

JNCIS-FWV Study Guide, p.97

Front 441

What CLI command is used to view all "emergency" level events in the event log?

Back 441

get event level emergency

Hint 441

JNCIS-FWV Study Guide, p.97

Front 442

What CLI command is used to view all "warning" level alerts in the event log?

Back 442

get event level warning

Hint 442

JNCIS-FWV Study Guide, p.97

Front 443

What CLI command is used to view traffic logs related to policy ID 5?

Back 443

get log traffic policy 5

Hint 443

JNCIS-FWV Study Guide, p.98

Front 444

What CLI command is used to view the flow counters on all interfaces?

Back 444

get counter flow

Hint 444

JNCIS-FWV Study Guide, p.98

Front 445

What CLI command is used to view the flow counters for the Untrust zone?

Back 445

get counter flow zone Untrust

Hint 445

JNCIS-FWV Study Guide, p.99

Front 446

What CLI command is used to view the screen counters for the Untrust zone?

Back 446

get counter screen zone Untrust

Hint 446

JNCIS-FWV Study Guide, p.99

Front 447

What CLI command is used to view the hardware counters on interface ethernet1?

Back 447

get counter statistics interface ethernet1

Hint 447

JNCIS-FWV Study Guide, p.100

Front 448

What CLI command is used to view the hardware counters for zone Untrust?

Back 448

get counter statistics zone Untrust

Hint 448

JNCIS-FWV Study Guide, p.101

Front 449

What option needs to be enabled on a policy in order for that policy to create policy counters?

Back 449

Count

Hint 449

JNCIS-FWV Study Guide, p.101

Front 450

What CLI command would view the policy counter for policy 5?

Back 450

get counter policy 5

Hint 450

JNCIS-FWV Study Guide, p.101

Front 451

What version of the SNMP protocol is supported by ScreenOS?

Back 451

SNMPv1, SNMPv2

Hint 451

JNCIS-FWV Study Guide, p.101

Front 452

What would you append to the end of a CLI policy creation command to create a traffic alarm when that policy sees more then 50 bytes of traffic per second?

Back 452

alarm 50(B/s)

Hint 452

JNCIS-FWV Study Guide, p.105

Front 453

How many SNMP communities and members can you configure on a ScreenOS device?

Back 453

Three communities with up to 8 members each.

Hint 453

JNCIS-FWV Study Guide, p.105

Front 454

How many syslog servers can be configured on a ScreenOS device?

Back 454

Four.

Hint 454

JNCIS-FWV Study Guide, p.101

Front 455

How many email addresses can you configure for an alert?

Back 455

Up to two specific addresses.

Hint 455

JNCIS-FWV Study Guide, p.109

Front 456

What are the four default SNMP traps?

Back 456

Cold Start Trap
Trap for SNMP Authentication Failure
Traps for System Alarms
Traps for Traffic Alarms

Hint 456

JNCIS-FWV Study Guide, p.102

Front 457

Which type of counter would show the number of incoming and outgoing VLAN-tagged packets? How would you view that counter on interface ethernet1?

Back 457

Flow counter.
get counter flow interface ethernet1

Hint 457

JNCIS-FWV Study Guide, p.99

Front 458

Where are debug messages stored on a ScreenOS device?

Back 458

The debug buffer (dbuf)

Hint 458

JNCIS-FWV Study Guide, p.110

Front 459

What is the minimum and maximum size of the ScreenOS debug buffer?

Back 459

32 KB minimum, 4096 KB maximum

Hint 459

JNCIS-FWV Study Guide, p.110

Front 460

What can you do if the ScreenOS debug buffer is filling too quickly for you to collect all of the information you need?

Back 460

Increase the size of the debug buffer.

Hint 460

JNCIS-FWV Study Guide, p.110

Front 461

Where are events generated by snoop stored on the ScreenOS device?

Back 461

In the debug buffer (dbuf)

Hint 461

JNCIS-FWV Study Guide, p.111

Front 462

What snoop command would you use to filter for packets sourced from 1.1.1.1?

Back 462

snoop filter ip src-ip 1.1.1.1

Hint 462

JNCIS-FWV Study Guide, p.112

Front 463

What snoop command would you use to filter for packets destined to 1.1.1.1?

Back 463

snoop filter ip dst-ip 1.1.1.1

Hint 463

JNCIS-FWV Study Guide, p.112

Front 464

What snoop command would you use to filter for traffic to or from port 80?

Back 464

snoop filter ip port 80

Hint 464

JNCIS-FWV Study Guide, p.112

Front 465

What snoop command would you use to filter for traffic sourced from port 80?

Back 465

snoop filter ip src-port 80

Hint 465

JNCIS-FWV Study Guide, p.112

Front 466

What snoop command would you use to filter for traffic destined to port 80?

Back 466

snoop filter ip dst-port 80

Hint 466

JNCIS-FWV Study Guide, p.112

Front 467

What snoop command would you use to filter for traffic on interface ethernet1?

Back 467

snoop filter ip interface ethernet1

Hint 467

JNCIS-FWV Study Guide, p.112

Front 468

What snoop command would you use to filter for only ESP traffic?

Back 468

snoop filter ip ip-proto 50

Hint 468

JNCIS-FWV Study Guide, p.112

Front 469

If you issue two snoop commands with different filters, does the snoop logic use AND or OR to combine the filters?

Back 469

AND

Hint 469

JNCIS-FWV Study Guide, p.113

Front 470

What CLI command can you use to view the events captured by snoop?

Back 470

get dbuf stream

Hint 470

JNCIS-FWV Study Guide, p.113

Front 471

In snoop output, what does the "vhl" field represent?

Back 471

Protocol version and header length (in 32-bit words)

Hint 471

JNCIS-FWV Study Guide, p.113

Front 472

What does the output "vhl=45" indicate in snoop output?

Back 472

IP version 4, with a header length of 160 (5 32-bit words)

Hint 472

JNCIS-FWV Study Guide, p.113

Front 473

Do flow filters capture ingress traffic, egress traffic, or both?

Back 473

Ingress only.

Hint 473

JNCIS-FWV Study Guide, p.114

Front 474

Can you use a flow filter to view traffic originating at the firewall?

Back 474

No. Flow filters only capture ingress traffic.

Hint 474

JNCIS-FWV Study Guide, p.114-115

Front 475

What CLI command can be used to enable basic verbosity flow debugging?

Back 475

debug flow basic

Hint 475

JNCIS-FWV Study Guide, p.115

Front 476

What CLI command can be used to enable detailed verbosity flow debugging?

Back 476

debug flow detail

Hint 476

JNCIS-FWV Study Guide, p.115

Front 477

As a general rule of thumb, should basic or detailed flow debugs be used in most applications?

Back 477

Basic.

Hint 477

JNCIS-FWV Study Guide, p.115

Front 478

What CLI command would you use to create a flow filter that displays all traffic from 1.1.1.1?

Back 478

set ffilter src-ip 1.1.1.1

Hint 478

JNCIS-FWV Study Guide, p.115

Front 479

What CLI command would you use to create a flow filter that displays traffic destined to port 80?

Back 479

set ffilter dst-port 80

Hint 479

JNCIS-FWV Study Guide, p.115

Front 480

What CLI command would you use to create a flow filter that displays traffic sourced from port 80?

Back 480

set ffilter src-port 80

Hint 480

JNCIS-FWV Study Guide, p.115

Front 481

What CLI command would you use to create a flow filter that displays all UDP traffic?

Back 481

set ffilter ip-proto 17

Hint 481

JNCIS-FWV Study Guide, p.115-116

Front 482

What CLI command will remove the flow filter with the lowest ID?

Back 482

unset ffilter

Hint 482

JNCIS-FWV Study Guide, p.116

Front 483

What CLI command would you use to remove a flow filter with ID 5?

Back 483

unset ffilter 5

Hint 483

JNCIS-FWV Study Guide, p.116

Front 484

What CLI command would you use to clear all flow filters?

Back 484

This is not possible -- flow filters can be removed only one at a time.

Hint 484

JNCIS-FWV Study Guide, p.116

Front 485

When you remove a flow filter, do other flow filter IDs change, or remain the same?

Back 485

Assuming the removed filter was not the last (highest ID) flow filter the IDs shift so that the first flow filter is 0 and the flow filter IDs are sequential.

Hint 485

JNCIS-FWV Study Guide, p.116

Front 486

When you create multiple flow filters, are the flow filter statements combined with an AND or an OR?

Back 486

OR

Hint 486

JNCIS-FWV Study Guide, p.116

Front 487

To create a flow filter using AND logic, what do you need to do?

Back 487

Use multiple arguments with a single flow filter.

Hint 487

JNCIS-FWV Study Guide, p.117

Front 488

What CLI command would create a flow filter to filter for anything to destination IP 1.1.1.1 and destination port 80?

Back 488

set ffilter dst-ip 1.1.1.1 dst-port 80

Hint 488

JNCIS-FWV Study Guide, p.117

Front 489

What CLI command will display open connections on the ScreenOS device?

Back 489

get session

Hint 489

JNCIS-FWV Study Guide, p.121

Front 490

In what two ways can you disable snoop?

Back 490

By running "snoop off" or pressing the Escape key.

Front 491

What CLI command would set the maximum bandwidth for interface ethernet1 to 50Kbps?

Back 491

set interface ethernet1 bandwidth 50

Hint 491

JNCIS-FWV Study Guide, p.132

Front 492

What is the valid range for assigning traffic priority when managing bandwidth?

Back 492

0-7

Hint 492

JNCIS-FWV Study Guide, p.133

Front 493

What priority level for traffic priority will give your traffic the highest possible priority?

Back 493

0

Hint 493

JNCIS-FWV Study Guide, p.133

Front 494

What priority level for traffic priority will give your traffic the lowest possible priority?

Back 494

7

Hint 494

JNCIS-FWV Study Guide, p.133

Front 495

What CLI command will deactivate bandwidth management system-wide?

Back 495

set traffic-shaping mode off

Hint 495

JNCIS-FWV Study Guide, p.134

Front 496

What CLI command will configure the ScreenOS device to activate bandwidth management if there is a policy configured with bandwidth management, but disable bandwidth management if there is no policy configured with bandwidth management?

Back 496

set traffic-shaping mode auto

Hint 496

JNCIS-FWV Study Guide, p.134

Front 497

Does Guaranteed Bandwidth have an associated traffic priority?

Back 497

No.

Hint 497

JNCIS-FWV Study Guide, p.134

Front 498

If there is more than one policy with the same traffic priority fighting over maximum bandwidth limits, how is the bandwidth allocated?

Back 498

On a round-robin basis.

Hint 498

JNCIS-FWV Study Guide, p.134

Front 499

What CLI command would be used to map DSCP markings to traffic priorities on the ScreenOS device?

Back 499

set traffic-shaping ip_precedence n0 n1 n2 n3 n4 n5 n6 n7

Hint 499

JNCIS-FWV Study Guide, p.135

Front 500

If you intend to use bandwidth management on a policy, what option must be enabled?

Back 500

Count.

Hint 500

JNCIS-FWV Study Guide, p.133

Front 501

What CLI command would create a policy to allow the following traffic, guarantee 10Kbps, assign priority 1, and a maximum bandwidth of 150Kbps, with DSCP disabled?
Source: 1.1.1.1 (Trust zone)
Destination: 2.2.2.2 (Untrust zone)
Service: http

Back 501

set policy from Trust to Untrust 1.1.1.1 2.2.2.2 http permit count gbw 10 priority 1 mbw 150 dscp disable

Hint 501

JNCIS-FWV Study Guide, p.135

Front 502

Can bandwidth management policies be modified via the CLI?

Back 502

No, only through the WebUI.

Hint 502

JNCIS-FWV Study Guide, p.135

Front 503

Which bits of the DSCP marking are used by a ScreenOS device when mapping to priority levels?

Back 503

The first three bits.

Hint 503

JNCIS-FWV Study Guide, p.138

Front 504

How many priority queues exist on a ScreenOS device for bandwidth management?

Back 504

8

Hint 504

JNCIS-FWV Study Guide, p.136

Front 505

What is the default maximum bandwidth and priority assigned to policies with no bandwidth management enabled?

Back 505

Unlimited bandwidth (-1) and Lowest Priority (7)

Hint 505

JNCIS-FWV Study Guide, p.138

Front 506

Can a vsys be set to transparent mode?

Back 506

No.

Hint 506

JNCIS-FWV Study Guide, p.140

Front 507

When a vsys is defined, what three zones are created for its use?

Back 507

Trust-<vsys>, Untrust-Tun-<vsys>, and Global-<vsys>

Hint 507

JNCIS-FWV Study Guide, p.140

Front 508

What commands are necessary to create a vsys called "Virtual" with an admin named "Virtual-admin" with password "qwe123" ?

Back 508

set vsys Virtual
set admin name Virtual-admin
set admin password qwe123

Hint 508

JNCIS-FWV Study Guide, p.140

Front 509

When you are in a vsys context, what command will return you to the root system?

Back 509

exit

Hint 509

JNCIS-FWV Study Guide, p.141

Front 510

From the root system, what commands will set the default virtual router of vsys "Virtual" to "Vrouter1" ?

Back 510

enter vsys Virtual
set vrouter Vrouter1 default-vrouter

Hint 510

JNCIS-FWV Study Guide, p.141

Front 511

From the root system, what command is used to enter a vsys called "Virtual" ?

Back 511

enter vsys Virtual

Hint 511

JNCIS-FWV Study Guide, p.141

Front 512

What types of admins can create a new virtual system?

Back 512

The root, and read/write root system admins.

Hint 512

JNCIS-FWV Study Guide, p.141

Front 513

Do a root-level write/read administrator and a write/read Virtual System administrator have the same permissions within the relevant vsys?

Back 513

Yes.

Hint 513

JNCIS-FWV Study Guide, p.141

Front 514

Can subinterfaces be created within a vsys?

Back 514

Yes.

Hint 514

JNCIS-FWV Study Guide, p.142

Front 515

Can a write/read Virtual System administrator create subinterfaces within the relevant vsys?

Back 515

No. Only a root-level write/read admin can create subinterfaces within a vsys.

Hint 515

JNCIS-FWV Study Guide, p.142

Front 516

Where do the default settings of a vsys come from?

Back 516

From the root system.

Hint 516

JNCIS-FWV Study Guide, p.142

Front 517

In regard to vsys sharing, what components of the root system are shared by default?

Back 517

The untrust-vr, untrust zone, and any interfaces bound to the untrust zone.

Hint 517

JNCIS-FWV Study Guide, p.142

Front 518

What command would allow a virtual router called "Vrouter1" to be shared with virtual systems?

Back 518

set vrouter Vrouter1 shared

Hint 518

JNCIS-FWV Study Guide, p.142

Front 519

What needs to be done before sharing an unshared virtual router?

Back 519

Nothing -- this can be done at any time.

Hint 519

JNCIS-FWV Study Guide, p.142

Front 520

What needs to be done before unsharing a shared virtual router?

Back 520

All Virtual Systems need to be deleted.

Hint 520

JNCIS-FWV Study Guide, p.142

Front 521

What command will set a zone called "Zoney" to be shared with virtual systems?

Back 521

set zone Zoney shared

Hint 521

JNCIS-FWV Study Guide, p.143

Front 522

When sharing zones with virtual systems, what caveat regarding virtual router membership is true?

Back 522

To make a zone shareable, it must be bound to a shared virtual router.

Hint 522

JNCIS-FWV Study Guide, p.143

Front 523

What administrators can import an interface into a vsys?

Back 523

Only the root administrator.

Hint 523

JNCIS-FWV Study Guide, p.143

Front 524

What commands do you need to run to import interface ethernet1 to vsys "Virtual1"?

Back 524

unset interface ethernet1 ip
set interface ethernet1 zone null
enter vsys Virtual1
set interface ethernet1 import

Hint 524

JNCIS-FWV Study Guide, p.143

Front 525

What commands do you need to run to attach ethernet1 to the root system, if it has previously been attached to vsys "Virtual1"?

Back 525

enter vsys Virtual1
unset interface ethernet1 ip
set interface ethernet1 zone null
unset interface ethernet1 import

Hint 525

JNCIS-FWV Study Guide, p.143-144

Front 526

For through traffic, what two methods of traffic classification exist to assign traffic to virtual systems?

Back 526

VLAN-based traffic classification, and IP-based traffic classification

Hint 526

JNCIS-FWV Study Guide, p.144

Front 527

What CLI command would enable IP-based classification on the zone "Zoney" ?

Back 527

set zone Zoney ip-classification

Hint 527

JNCIS-FWV Study Guide, p.147

Front 528

Before exporting an interface from a vsys back to the rootsys, what zone does the interface need to be assigned to?

Back 528

Null.

Hint 528

JNCIS-FWV Study Guide, p.148

Front 529

How many virtual routers can a vsys have?

Back 529

One.

Hint 529

JNCIS-FWV Study Guide, p.151

Front 530

If you want a vsys to use a shared root system virtual router instead of its own default virtual router, what do you add to the end of the "set vsys" command?

Back 530

vrouter share <vrouter-name>

Hint 530

JNCIS-FWV Study Guide, p.140

Front 531

If both ingress and egress IP-classification found matching virtual systems, but the interfaces were bound to different shared security zones, what would happen to the traffic?

Back 531

The traffic would be dropped.

Hint 531

JNCIS-FWV Study Guide, p.145-146

Front 532

When you create vsys subinterfaces, are they in NAT mode or route mode, by default?

Back 532

NAT mode

Hint 532

JNCIS-FWV Study Guide, p.146-147

Front 533

Can a vsys be configured to use both IP-based and VLAN-based classification at the same time?

Back 533

Yes.

Hint 533

JNCIS-FWV Study Guide, p.147

Front 534

What options for debugging does a read-only vsys administrator have?

Back 534

None. A read-only administrator can only "get" and "ping"

Hint 534

JNCIS-FWV Study Guide, p.142

Front 535

What does NSRP stand for?

Back 535

NetScreen Redundancy Protocol

Hint 535

JNCIS-FWV Study Guide, p.152

Front 536

What CLI command would configure a firewall with NSRP cluster ID 7?

Back 536

set nsrp cluster id 7

Hint 536

JNCIS-FWV Study Guide, p.152

Front 537

What are the valid values for NSRP cluster ID?

Back 537

1 through 7

Hint 537

JNCIS-FWV Study Guide, p.152

Front 538

What CLI command would configure an NSRP cluster with the name "Cluster" ?

Back 538

set nsrp cluster name Cluster

Hint 538

JNCIS-FWV Study Guide, p.153

Front 539

What does VSD stand for?

Back 539

Virtual Security Device

Hint 539

JNCIS-FWV Study Guide, p.153

Front 540

What is the default cluster group for ScreenOS clusters?

Back 540

VSD Group 0

Hint 540

JNCIS-FWV Study Guide, p.153

Front 541

What happens to configured security interfaces when a firewall becomes a cluster member?

Back 541

They convert to Virtual Security Interfaces (VSIs)

Hint 541

JNCIS-FWV Study Guide, p.153

Front 542

Once an interface becomes a VSI for VSD group 0, can you make that interface a local interface again?

Back 542

No.

Hint 542

JNCIS-FWV Study Guide, p.153

Front 543

If you want to remove a VSI, what is the recommended process?

Back 543

Remove VSD group 0, and then create a new VSD group.

Hint 543

JNCIS-FWV Study Guide, p.153

Front 544

When creating a cluster, what routes are included in the cluster routing table?

Back 544

Directly connected routes for the interfaces which became VSIs

Hint 544

JNCIS-FWV Study Guide, p.153

Front 545

What is the default priority assigned to a VSD group member?

Back 545

100

Hint 545

JNCIS-FWV Study Guide, p.153

Front 546

As a cluster member's priority approaches 0, does it have a higher or lower priority within the cluster?

Back 546

Higher.

Hint 546

JNCIS-FWV Study Guide, p.153

Front 547

If two VSD group members have the same priority number, which one will be the master for the cluster?

Back 547

The one with the lowest MAC address.

Hint 547

JNCIS-FWV Study Guide, p.153

Front 548

What clustering option allows a group member with a higher priority to resume as master once it recovers from a failure?

Back 548

The preempt option.

Hint 548

JNCIS-FWV Study Guide, p.154

Front 549

What CLI command will enable preempt mode on VSD 7?

Back 549

set nsrp vsd-group id 7 preempt

Hint 549

JNCIS-FWV Study Guide, p.154

Front 550

What preempt mode configuration option is used to delay the preempt failover for a specified amount of time?

Back 550

The hold down timer.

Hint 550

JNCIS-FWV Study Guide, p.154

Front 551

What CLI command would turn on preempt mode for VSD 5, and set the hold down timer to 10 minutes?

Back 551

set nsrp vsd-group id 5 preempt hold-down 600

Hint 551

JNCIS-FWV Study Guide, p.154

Front 552

What is the valid range for the preempt mode hold-down timer?

Back 552

0-600 seconds.

Hint 552

JNCIS-FWV Study Guide, p.154

Front 553

In NSRP what will be member state of the device that is next in line to take over, should the master fail?

Back 553

Primary Backup

Hint 553

JNCIS-FWV Study Guide, p.154

Front 554

In NSRP, what is the member state of the device processing traffic sent to VSIs?

Back 554

Master

Hint 554

JNCIS-FWV Study Guide, p.154

Front 555

In NSRP, what is the transient state that a group member is in while it joins a VSD group during boot or immediately after being added?

Back 555

Initial

Hint 555

JNCIS-FWV Study Guide, p.154

Front 556

What NSRP member state is assigned purposefully by an administrator to prevent a member from participating in the election process?

Back 556

Ineligible

Hint 556

JNCIS-FWV Study Guide, p.154

Front 557

What NSRP member state indicates a system check has determined the device has a problem?

Back 557

Inoperable

Hint 557

JNCIS-FWV Study Guide, p.154

Front 558

If the HA LED on a device is not lit, what does that indicate?

Back 558

The device is not enabled for NSRP.

Hint 558

JNCIS-FWV Study Guide, p.154

Front 559

If the HA LED on a device is green, what does that indicate?

Back 559

The device is enabled for NSRP, is the master in one or more VSD groups and is not inoperable.

Hint 559

JNCIS-FWV Study Guide, p.155

Front 560

If the HA LED on a device is yellow, what does that indicate?

Back 560

The device is enabled for NSRP, is not the master in any VSD group, and is not inoperable.

Hint 560

JNCIS-FWV Study Guide, p.155

Front 561

If the HA LED on a device is red, what does that indicate?

Back 561

The device is enabled for NSRP, but is currently inoperable.

Hint 561

JNCIS-FWV Study Guide, p.155

Front 562

What is the term used for the amount of time that a VSD group member stays in the initial state?

Back 562

Initial State Hold-Down Time

Hint 562

JNCIS-FWV Study Guide, p.155

Front 563

What is the default value for the initial state hold-down timer?

Back 563

5

Hint 563

JNCIS-FWV Study Guide, p.155

Front 564

How do you determine the initial-state hold-down time of a VSD group member?

Back 564

Multiply the initial-state hold-down value by the VSD heartbeat interval.

Hint 564

JNCIS-FWV Study Guide, p.155

Front 565

What is the minimum value for the initial state hold-down timer?

Back 565

5

Hint 565

JNCIS-FWV Study Guide, p.155

Front 566

What CLI command would set the initial state hold-down timer to 10 on VSD group 4?

Back 566

set nsrp vsd-group id 4 init-hold 10

Hint 566

JNCIS-FWV Study Guide, p.155

Front 567

What CLI command will set a member of VSD group 5 to ineligible state?

Back 567

set nsrp vsd-group 5 mode ineligible

Hint 567

JNCIS-FWV Study Guide, p.155

Front 568

What five pieces of information are included in a VSD heartbeat message?

Back 568

Unit ID
VSD Group ID
VSD Group Member Status
Device Priority
RTO Peer Information

Hint 568

JNCIS-FWV Study Guide, p.155

Front 569

What are the possible values for the VSD heartbeat interval?

Back 569

200, 600, 800, or 1000 milliseconds

Hint 569

JNCIS-FWV Study Guide, p.155

Front 570

Does the VSD heartbeat interval configuration apply to specific VSD groups, or to all configured groups?

Back 570

All -- it is a global change.

Hint 570

JNCIS-FWV Study Guide, p.155

Front 571

What CLI command will set the VSD heartbeat interval to 800 milliseconds?

Back 571

set nsrp vsd-group hb-interval 800

Hint 571

JNCIS-FWV Study Guide, p.155

Front 572

What is the default heartbeat threshold on a ScreenOS device?

Back 572

3

Hint 572

JNCIS-FWV Study Guide, p.156

Front 573

What CLI command would configure a device so that it can miss 8 NSD heartbeats before it is deemed as failed?

Back 573

set nsrp vsd hb-threshold 8

Hint 573

JNCIS-FWV Study Guide, p.156

Front 574

Can ScreenOS devices in transparent mode be configured for active/passive failover?

Back 574

Yes.

Hint 574

JNCIS-FWV Study Guide, p.156

Front 575

What is the main advantage of an active/passive cluster over an active/active cluster?

Back 575

Ease of configuration.

Hint 575

JNCIS-FWV Study Guide, p.156

Front 576

What CLI command would assign a ScreenOS device to a cluster with ID 4?

Back 576

set nsrp cluster id 4

Hint 576

JNCIS-FWV Study Guide, p.156

Front 577

What CLI commands would set up authentication and encryption for cluster status traffic?

Back 577

set nsrp auth password <password>
set nsrp encrypt password <password>

Hint 577

JNCIS-FWV Study Guide, p.156

Front 578

What command would configure your cluster to monitor interface ethernet1?

Back 578

set nsrp monitor interface ethernet1

Hint 578

JNCIS-FWV Study Guide, p.156

Front 579

What CLI command would configure a secondary path through ethernet0 for cluster status traffic, should the primary path fail?

Back 579

set nsrp secondary-path ethernet0

Hint 579

JNCIS-FWV Study Guide, p.157

Front 580

What CLI command would configure a cluster to send ten gratuitous ARPs when it becomes the new master of a cluster?

Back 580

set nsrp arp 10

Hint 580

JNCIS-FWV Study Guide, p.157

Front 581

What CLI command can be used to determine if one clustered firewall's configuration is out of sync with the other?

Back 581

exec nsrp sync global-config check-sum

Hint 581

JNCIS-FWV Study Guide, p.157

Front 582

If a cluster becomes out of sync, what CLI command can be used to resync the members without rebooting?

Back 582

exec nsrp sync global-config run

Hint 582

JNCIS-FWV Study Guide, p.157

Front 583

If cluster members become out of sync, what CLI command can be run to synchronize the members on the next reboot?

Back 583

exec nsrp sync global-config save

Hint 583

JNCIS-FWV Study Guide, p.157

Front 584

What two caveats should you observe when attempting to resync your cluster?

Back 584

1) Always resync from the master.
2) Perform an "unset all" on the target to clear previous configuration.

Hint 584

JNCIS-FWV Study Guide, p.157

Front 585

What CLI command would synchronize a single file, called bob.txt between cluster members?

Back 585

exec nsrp sync file name bob.txt from peer

Hint 585

JNCIS-FWV Study Guide, p.158

Front 586

What CLI command would synchronize all files between cluster members?

Back 586

exec nsrp sync file from peer

Hint 586

JNCIS-FWV Study Guide, p.158

Front 587

By default, do NSRP cluster members synchronize Run-Time Objects?

Back 587

No.

Hint 587

JNCIS-FWV Study Guide, p.158

Front 588

What CLI command enables RTO synchronization?

Back 588

set nsrp rto-mirror sync

Hint 588

JNCIS-FWV Study Guide, p.158

Front 589

What CLI command will resync RTO data manually, if RTO sync is disabled then re-enabled?

Back 589

exec nsrp sync rto all

Hint 589

JNCIS-FWV Study Guide, p.159

Front 590

What are the RTO components eligible to sync independently in an NSRP cluster?

Back 590

arp
auth-table
dhcp
dns
l2tp
phase1-sa
pki
rm
session
vpn

Hint 590

JNCIS-FWV Study Guide, p.159

Front 591

What CLI command would change the interval of the RTO heartbeat to 10?

Back 591

set nsrp rto-mirror hb-interval 10

Hint 591

JNCIS-FWV Study Guide, p.159

Front 592

What CLI command would change the threshold for missed RTO heartbeats to 5?

Back 592

set nsrp rto-mirror hb-threshold 5

Hint 592

JNCIS-FWV Study Guide, p.159

Front 593

What CLI command will disable RTO synchronization entirely?

Back 593

set nsrp rto-mirror session off

Hint 593

JNCIS-FWV Study Guide, p.159

Front 594

What CLI command would disable clock synchronization between cluster members?

Back 594

set ntp no-ha-sync

Hint 594

JNCIS-FWV Study Guide, p.159

Front 595

Why is it recommended to disable NSRP time synchronization and use NTP instead?

Back 595

NSRP time sync occurs at the second level, but NTP occurs at the sub-second level.

Hint 595

JNCIS-FWV Study Guide, p.159

Front 596

When two interfaces are used for NSRP HA, what are each of the interfaces used for?

Back 596

One is used for control messages, and the other is used for data messages.

Hint 596

JNCIS-FWV Study Guide, p.160

Front 597

If you have two FastEthernet interfaces used as NSRP HA interfaces, and one fails, what type of data will transfer over the remaining HA interface?

Back 597

Control messages only

Hint 597

JNCIS-FWV Study Guide, p.160

Front 598

If you have two gigabit interfaces used as NSRP HA interfaces, and one fails, what type of data will transfer over the remaining HA interface?

Back 598

Both control and data messages.

Hint 598

JNCIS-FWV Study Guide, p.160

Front 599

What two types of control messages are transmitted by an NSRP cluster member?

Back 599

Heartbeats and HA messages

Hint 599

JNCIS-FWV Study Guide, p.160

Front 600

What three types of heartbeats are used by an NSRP cluster member?

Back 600

VSD group heartbeats, RTO heartbeats, and HA physical link heartbeats

Hint 600

JNCIS-FWV Study Guide, p.160

Front 601

What type of NSRP cluster traffic are broadcast messages from the HA interfaces of both firewalls to monitor the status of the actual HA interfaces?

Back 601

HA physical link heartbeats.

Hint 601

JNCIS-FWV Study Guide, p.160

Front 602

What two types of HA messages does an NSRP cluster member transmit?

Back 602

Configuration messages and RTO messages

Hint 602

JNCIS-FWV Study Guide, p.160

Front 603

What happens to an IP packet that arrives on a device that is the backup of the VSD group?

Back 603

The packet is forwarded over the HA link to the master.

Hint 603

JNCIS-FWV Study Guide, p.160

Front 604

What solution allows a HA device to tell if the corresponding HA port of its peer has failed, even if using a switch to connect the two devices?

Back 604

Link Probes

Hint 604

JNCIS-FWV Study Guide, p.160

Front 605

What CLI command will send 10 link probes out interface ethernet0 on a HA member, destined to MAC address AA:AA?

Back 605

exec nsrp probe ethernet0 AA:AA count 10

Hint 605

JNCIS-FWV Study Guide, p.161

Front 606

What CLI command will configure automatic link probing on a cluster member, and send link probes every 10 seconds, with a threshold of 3 link probes?

Back 606

set nsrp ha-link probe interval 10 threshold 3

Hint 606

JNCIS-FWV Study Guide, p.161

Front 607

Can firewalls in transparent mode be configured in an active/active cluster?

Back 607

No.

Hint 607

JNCIS-FWV Study Guide, p.161

Front 608

Can you cluster together two firewalls of different models?

Back 608

No.

Hint 608

JNCIS-FWV Study Guide, p.161

Front 609

What are the valid values for the device/VSD group failover threshold?

Back 609

1-255

Hint 609

JNCIS-FWV Study Guide, p.165

Front 610

What is the default value of the device/VSD group failover threshold?

Back 610

255

Hint 610

JNCIS-FWV Study Guide, p.165

Front 611

What CLI command would set the NSRP failover threshold for a device to 100?

Back 611

set nsrp monitor threshold 100

Hint 611

JNCIS-FWV Study Guide, p.165

Front 612

What CLI command would configure NSRP interface monitoring on ethernet0, with a weight of the minimum allowed value?

Back 612

set nsrp monitor interface ethernet0 weight 1

Hint 612

JNCIS-FWV Study Guide, p.165

Front 613

What CLI command would configure NSRP zone monitoring for the Untrust zone, with the maximum allowable weight?

Back 613

set nsrp monitor zone Untrust weight 255

Hint 613

JNCIS-FWV Study Guide, p.165

Front 614

What CLI command would configure NSRP IP address monitoring to monitor IP 1.1.1.1 with weight of 100?

Back 614

set nsrp track-ip 1.1.1.1 weight 100

Hint 614

JNCIS-FWV Study Guide, p.165

Front 615

Out of the different components that you can monitor with NSRP, which one has a threshold that can be manually changed?

Back 615

IP address monitoring

Hint 615

JNCIS-FWV Study Guide, p.165

Front 616

What CLI command would change the NSRP IP address monitoring threshold to 10?

Back 616

set nsrp monitor track-ip threshold 10

Hint 616

JNCIS-FWV Study Guide, p.165

Front 617

What CLI command can be used to prevent both firewalls from going into standby mode if a monitored IP address goes down?

Back 617

set nsrp vsd-group master-always-exist

Hint 617

JNCIS-FWV Study Guide, p.166

Front 618

Is bandwidth management configuration synchronized across a cluster?

Back 618

No.

Hint 618

JNCIS-FWV Study Guide, p.152

Front 619

Is user account information synchronized across a cluster?

Back 619

No.

Hint 619

JNCIS-FWV Study Guide, p.152

Front 620

If both NTP and NSRP time sync are enabled?

Back 620

The time may become unsyncrhonized -- it is recommended to disable NSRP and use NTP.

Hint 620

JNCIS-FWV Study Guide, p.170

Front 621

What does the name of a Layer 2 security zone have to begin with?

Back 621

"L2-"

Hint 621

Concepts and Examples ScreenOS Reference Guide, p.129

Front 622

When creating a Layer 2 security zone, what should the VLAN ID number be?

Back 622

1

Hint 622

Concepts and Examples ScreenOS Reference Guide, p.129

Front 623

What needs to be done before you can remove a zone?

Back 623

Unbind all interfaces bound to that zone.

Hint 623

Concepts and Examples ScreenOS Reference Guide, p.129

Front 624

What CLI commands would change the name of the zone "Zone1" to "Zone2"?

Back 624

unset zone Zone1
set zone name Zone2

Hint 624

Concepts and Examples ScreenOS Reference Guide, p.129

Front 625

What CLI command would enable Intra-Zone blocking on zone "Zoney"?

Back 625

set zone Zoney block

Hint 625

Concepts and Examples ScreenOS Reference Guide, p.129

Front 626

What CLI command would delete zone "Zoney" ?

Back 626

unset zone Zoney

Hint 626

Concepts and Examples ScreenOS Reference Guide, p.129

Front 627

What components make up the name of a physical interface?

Back 627

Media type, slot number, and index number.

Hint 627

Concepts and Examples ScreenOS Reference Guide, p.134

Front 628

What would the name be of the wireless interface with the lowest index in the lowest slot?

Back 628

wireless0/0

Hint 628

Concepts and Examples ScreenOS Reference Guide, p.134

Front 629

To what zone can a wireless interface NOT be bound?

Back 629

Untrust

Hint 629

Concepts and Examples ScreenOS Reference Guide, p.134

Front 630

What is the terminology for a group that allows you to group multiple Ethernet and wireless interfaces together?

Back 630

A bridge group (bgroup)

Hint 630

Concepts and Examples ScreenOS Reference Guide, p.135

Front 631

How many IP addresses are assigned to a bgroup interface?

Back 631

One.

Hint 631

Concepts and Examples ScreenOS Reference Guide, p.135

Front 632

What type of VPN tunnel interface must be assigned to a specific physical interface from which it borrows its IP address?

Back 632

An unnumbered tunnel interface.

Hint 632

Concepts & Examples ScreenOS Reference Guide, p.137

Front 633

Why is it a good practice to put all tunnel interfaces into a zone with their own virtual router?

Back 633

So that if the VPN fails, traffic is dropped instead of being redirected to a route that would send it clear-text.

Hint 633

Concepts & Examples ScreenOS Reference Guide, p.138

Front 634

What types of tunnel interfaces can support policy-based NAT?

Back 634

Only a tunnel interface with an IP address/netmask.

Hint 634

Concepts & Examples ScreenOS Reference Guide, p.139

Front 635

What are the four logical link states possible for a tunnel interface?

Back 635

up, down, ready and inactive

Hint 635

Concepts & Examples ScreenOS Reference Guide, p.140

Front 636

Before deleting a tunnel interface that hosts MIPs or DIPs, what must be done?

Back 636

Delete any policies referencing the NAT objects, and delete the MIPs and DIP pools from the tunnel interface.

Hint 636

Concepts & Examples ScreenOS Reference Guide, p.140

Front 637

What is the only type of WAN interface that can be bound to an L2 security zone?

Back 637

ADSL

Hint 637

Concepts & Examples ScreenOS Reference Guide, p.143

Front 638

Can a subinterface be bound to an L2 security zone?

Back 638

No -- a subinterface requires an IP address, so cannot be bound to an L2 security zone.

Hint 638

Concepts & Examples ScreenOS Reference Guide, p.143

Front 639

Before adding an interface to a group, what security zone does that interface need to be assigned to?

Back 639

Null.

Hint 639

Concepts & Examples ScreenOS Reference Guide, p.143

Front 640

What CLI command would set interface e1/1 to be administratively down?

Back 640

set interface e1/1 phy link-down

Hint 640

Concepts & Examples ScreenOS Reference Guide, p.147

Front 641

In which L3 zone can you NOT assign multiple secondary IP addresses to an interface?

Back 641

Untrust

Hint 641

Concepts & Examples ScreenOS Reference Guide, p.149

Front 642

What CLI command would add a secondary IP of 1.1.1.1/24 to interface ethernet1/1?

Back 642

set interface ethernet1/1 ip 1.1.1.1/24 secondary

Hint 642

Concepts & Examples ScreenOS Reference Guide, p.150

Front 643

What is the lowest numbered loopback interface that can exist on a ScreenOS device?

Back 643

loopback.1

Hint 643

Concepts & Examples ScreenOS Reference Guide, p.156

Front 644

What is the highest numbered loopback interface that can exist on a ScreenOS device?

Back 644

This is platform specific.

Hint 644

Concepts & Examples ScreenOS Reference Guide, p.156