Pre-Order Your Security - Specialist (JNCIS-SEC) JN0-336

The correct answers are C and D. Once the SSL proxy profile already exists, the SRX still needs a security policy that matches the SSL/TLS traffic and applies the SSL proxy profile as an application service. Juniper’s SSL proxy configuration procedure explicitly shows creating the security policy match criteria and then applying the SSL proxy profile with then permit application-services ssl-proxy profile-name. It also states that SSL forward and reverse proxy require the profile to be configured at the firewall rule level.

Option D is correct because SSL proxy is not an end goal by itself; it decrypts SSL/TLS traffic so Layer 7 security services can inspect it. Juniper states that decrypted SSL traffic is available for security services and provides examples where the SSL proxy profile and a Content Security/UTM policy are both attached to the same security policy. Option A is wrong because host-inbound-traffic HTTPS controls HTTPS access to the SRX itself, not transit SSL proxy inspection. Option B is wrong because SSL proxy profiles are not referenced under a security zone for this function; they are applied under the matching security policy. Reference topics: SSL Proxy, SSL proxy profile, security policy application-services, Layer 7 inspection, UTM/IDP/ATP integration.

The correct answers are B and C. IDP false positives occur when legitimate traffic matches an attack signature or attack object incorrectly. One valid way to reduce false positives is to remove the problematic attack object from the IDP rule, especially when that object is not relevant to the protected application, server role, or traffic direction. Juniper defines attack objects as the items specified in IDP rules to identify malicious activity, so removing an irrelevant or noisy attack object directly reduces unwanted matches.

Option C is also correct because Juniper specifically recommends using an exempt rulebase when an IDP rule uses an attack object group containing attack objects that produce false positives or irrelevant log records. Exempt rules can exclude a specific source, destination, or source/destination pair from matching an IDP rule, preventing unnecessary alarms.

Option A is wrong because changing the action to a lower severity response does not reduce the false positive; it only changes what happens after the false match occurs. Option D is wrong because a terminal rule at the end of the rule base does not prevent earlier false-positive matches. Reference topics: IDP, attack objects, exempt rulebase, false-positive tuning, IDP rule matching.

The correct answer is C. device policy rules. In Junos Space Security Director, policy scope matters. A rule intended for one specific SRX Series device must be placed in a device policy, because Juniper defines a device policy as a firewall policy created per device and used when you want to push a unique firewall policy configuration per device. Security Director also distinguishes this from group policies, which are shared with multiple devices, and from all-devices policy rules, which are global in scope rather than device-specific.

Option A is wrong because all-devices prerules are global rules evaluated before device-specific rules; they are not intended for a unique single-device exception. Option B is wrong because group policy prerules apply to devices within a group, not to one individually targeted SRX firewall. Option D is wrong because all-devices postrules are still globally scoped, even though they occur later in policy order. The clean Security Director design is to use device policy rules when the policy must apply only to one SRX device. Reference topics: Security Director, firewall policy hierarchy, device policy, group policy, all-devices prerules/postrules.