Exam JN0-634 topic 1 question 60 discussion

Actual exam question from Juniper's JN0-634

Question #: 60
Topic #: 1

Click the Exhibit button.

Referring to the exhibit, the host has been automatically blocked from communicating on the network because a malicious file was downloaded. You cleaned the infected host and changed the investigation status to Resolved Fixed.
What does Sky ATP do if the host then attempts to download a malicious file that would result in a threat score of 10?

A. Sky ATP does not log the connection attempt and an SRX Series device does not allow the host to communicate on the network.
B. Sky ATP logs the connection attempt and an SRX Series device does not allow the host to communicate on the network.
C. Sky ATP logs the connection attempt and an SRX Series device allows the host to communicate on the network.
D. Sky ATP does not log the connection attempt and an SRX Series device allows the host to communicate on the network.

Show Suggested Answer

Suggested Answer: C 🗳️

by jaruch8412 at April 19, 2019, 9:38 a.m.

Comments

Submit Cancel

MuadDib

6 years, 3 months ago

https://www.juniper.net/documentation/en_US/release-independent/sky-atp/topics/reference/general/sky-atp-filescan-overview.html In the second screen you can see clearly that the file is logged and blocked at different timestamps for the same machine, so that should lead you to think the answer would be B.

upvoted 1 times

...

MuadDib

6 years, 3 months ago

The Juniper SRX web documentation isn't clear on this, but it does say that the host level will go back to 0, because of the Resolve fixed status. Therefore it should allow it through. The only other feasible option is the one put forward by jaruch. But that answer can also not be confirmed so far.

upvoted 1 times

...

Chucky

6 years, 3 months ago

I cannot find a good source to confirm this answer. There's no such information on Juniper web documentation.

upvoted 1 times

...

MuadDib

6 years, 3 months ago

I would go with the current answer, C, since after you resolve it, the level goes back to 0 and the next one will be allowed through.

upvoted 1 times

...

jaruch8412

6 years, 4 months ago

In my opinion the correct answer is B https://www.juniper.net/documentation/en_US/junos-space18.3/policy-enforcer/topics/concept/junos-space-policy-enforcer-sky-atp-host-detail.html

upvoted 1 times

...