多选题Users can define policy to control traffic flow between which two components？（）Afrom a zone to the device itselfBfrom a zone to the same zoneCfrom a zone to a different zoneDfrom one interface to another interface

第1题：

第2题：

Which two of these are characteristics of an IPS device？（）

• A、 passively listens to network traffic
• B、 is an active device in the traffic path
• C、 has a permissive interface that is used to monitor networks
• D、 traffic arrives on one IPS interface and exits on another

第3题：

第4题：

You want to allow your device to establish OSPF adjacencies with a neighboring device connected tointerface ge-0/0/3.0. Interface ge-0/0/3.0 is a member of the HR zone.Under which configuration hierarchy must you permit OSPF traffic？（）

• A、[edit security policies from-zone HR to-zone HR]
• B、[edit security zones functional-zone management protocols]
• C、[edit security zones protocol-zone HR host-inbound-traffic]
• D、[edit security zones security-zone HR host-inbound-traffic protocols]

第5题：

You want to allow your device to establish OSPF adjacencies with a neighboring device connected to interface ge-0/0/3.0. Interface ge-0/0/3.0 is a member of the HR zone.Under which configuration hierarchy must you permit OSPF traffic?（）

• A、[edit security policies from-zone HR to-zone HR]
• B、[edit security zones functional-zone management protocols]
• C、[edit security zones protocol-zone HR host-inbound-traffic]
• D、[edit security zones security-zone HR host-inbound-traffic protocols]

第6题：

第7题：

Which statement best describes Cisco IOS Zone-Based Policy Firewall？（）

• A、A router interface can belong to multiple zones.
• B、Policy maps are used to classify traffic into different traffic classes， and class maps are used to assignaction to the traffic classes.
• C、The pass action works in only one direction
• D、A zone-pair is bidirectional because it specifies traffic flowing among the interfaces within the zone-pair in both directions.

第8题：

第9题：

Which two actions can be configured to allow traffic to traverse an interface when zone-based security isbeing employed？（）

• A、Pass
• B、Flow
• C、Allow
• D、Inspect

第10题：

You are installing a MAG Series device for access control using an SRX Series device as the firewall enforcer. The MAG Series device resides in the same security zone as users. However, the users reside in different subnets and use the SRX Series device as an IP gateway.Which statement is true?（）

• A、You must configure a security policy on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.
• B、No security policy is necessary on the SRX Series device to allow traffic to flow from the user devices to the MAG Series device.
• C、You must configure host-inbound traffic on the SRX Series device to allow SSL traffic between the MAG Series device and the user devices.
• D、You must configure host-inbound traffic on the SRX Series device to allow EAP traffic between the MAG Series device and the user devices.