The correct answer is B. Add custom-attack Custom-FTP-Attack to the attacks section and change the action to drop-packet. In the exhibit, the IDP rule is built under rulebase-ips with a match block and a then block.
Attack objects belong inside the match attacks hierarchy because they define what malicious pattern the IDP rule is trying to detect. Juniper's IDP documentation states that attack objects are specified in rules to identify malicious activity and that the rule's attack objects/groups are the attacks the device matches in monitored traffic.
The enforcement behavior belongs in the then action hierarchy. The current rule uses close-client; to meet the requirement, it must be changed to drop-packet. Juniper defines Drop Packet as an IDP action that drops a matching packet before it reaches its destination without closing the connection. Option A keeps the wrong action. Option C is structurally wrong because a custom attack object is not configured under the action section. Option D is also wrong because the notification section controls logging/alert behavior, not attack matching. Reference topics: IDP rulebase, custom attack objects, match attacks hierarchy, IDP actions, drop- packet behavior.

The correct answers are C and D. Static attack object groups are manually defined groups. Juniper states that custom attack groups are static in nature because the attacks are explicitly specified in the group; therefore, those attack groups do not change when the security database is updated. This is the key difference between static groups and dynamic groups. Dynamic groups use matching criteria and can automatically update membership when the signature database changes, but static groups do not behave that way.
Option C is correct because updating the IPS/IDP signature database does not automatically add or remove members from a static attack group. Option D is correct because the administrator must explicitly add the desired attack objects to the custom static group. Option A describes dynamic matching behavior, not static group behavior. Option B is also dynamic-group behavior; Juniper Security Director documentation says dynamic group membership is automatically updated during signature updates based on the group's matching criteria. Static groups are intentionally deterministic: they include only the attacks manually selected by the administrator. Reference topics: IDP attack objects, static attack groups, custom attack groups, dynamic attack groups, IPS signature database updates.

You have exceeded the maximum files submission for your SRX platform size: This statement is correct because file scanning on SRX300 Series device has a limit on the number of files that can be submitted per minute based on the platform size3. For example, SRX320 has a limit of 10 files per minute3.

The correct answer is D. exempt. In Junos IDP, the exempt rulebase is specifically used to prevent selected traffic from triggering known false-positive detections. Juniper's IDP documentation explains that exempt rules can be configured when an IDP policy generates false positives for a particular attack object, source, destination, or traffic pattern. The exempt rulebase lets the administrator exclude matching traffic from attack detection while still allowing the rest of the IDP policy to inspect other traffic normally.
Option A, IPS, is wrong because the IPS rulebase is the main inspection rulebase used to detect and act on attacks. It is where attack objects and actions are commonly applied, but it is not the rulebase designed to eliminate false positives. Option B, monitor, is not the correct false-positive elimination mechanism.
Monitoring can help observe behavior, but it does not exempt traffic from matching an attack object. Option C, signature, is wrong because signatures are attack-detection patterns, not a rulebase type used to suppress false positives. The operational correction for noisy or irrelevant matches is to create an exempt rule for the specific trusted source, destination, or attack object. Reference topics: IDP rulebases, exempt rulebase, false- positive tuning, attack objects, IPS inspection.

The DNS Application Layer Gateway (ALG) is designed to manage and facilitate the successful passage of DNS traffic through a network device such as a firewall or NAT. Here are the correct statements regarding DNS ALG:
The DNS ALG performs DNS doctoring.
DNS doctoring is indeed a function of the DNS ALG where it modifies the payload of DNS responses to ensure that the information is aligned with the NAT policy. For example, it can rewrite the IP addresses in DNS responses to match the internal or external NAT'd IP address that the client should use.
The DNS ALG supports VPN tunnels.
DNS ALG can function across VPN tunnels by managing DNS traffic that traverses the tunnel, ensuring that the DNS queries and responses are correctly handled in environments where IP address translation occurs due to the VPN.