Junos OS Security Objects

Which statement accurately describes a security zone in Junos OS?

Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?

You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?

An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?

You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?

An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?

Which statement is true regarding Junos OS address books?

When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?

An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?

An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?

Which statement best describes an Application Layer Gateway (ALG) in Junos OS?

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Which command is used to verify the configuration of address books in Junos OS?

You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?

An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?

Which statement is true regarding Junos OS predefined applications?

Which command displays the configured security policies in Junos OS?

An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?

Which type of Junos OS address book entry is available to all security zones on the device without needing to be redefined?

An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?

You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?

An administrator configures a security zone and enables traceoptions for security flow. Where are these traceoptions configured in the Junos OS hierarchy?

Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?

You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?

You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?

Which command is used to display active security sessions currently tracked by the Junos OS flow module?

Which statement correctly identifies the purpose of Junos OS functional zones?

You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?

Which Junos command displays the operational status of all SCREEN options and their associated counters across security zones?

An administrator configures an application set in Junos OS. What is the primary function of an application set?

You are configuring an SRX Series device and want to ensure that all traffic entering the untrusted zone is checked for LAND attacks. Which configuration steps are required?

An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?

Which statement is true regarding the default security zone behavior in Junos OS?

You need to modify the default session timeout for a specific custom application in Junos OS. Where is application timeout configured?

An administrator configures an address book containing an IPv6 address prefix. How does Junos OS handle IPv6 addresses in security policies compared to IPv4?

Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single unit in security policies?

Which statement is true regarding Junos OS security zone interfaces?

An administrator configures a security zone and applies a SCREEN profile that includes 'limit-session source-ip'. What is the function of this specific SCREEN option?

An administrator configures a security zone and enables the 'udp-flood' SCREEN option with a specified threshold. How does Junos measure UDP flood attacks for this option?

You want to create an address set that combines two address sets and one individual IP address object. Is this supported in Junos OS?

Which Junos OS feature is responsible for translating port numbers for protocols like FTP during transit across security zones?

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?

An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?

Which TWO methods can be used to define IP addresses in Junos OS address books? (Choose two)

Which TWO statements are correct regarding Junos OS security zones? (Choose two)

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Which TWO actions occur when an Application Layer Gateway (ALG) inspects traffic in Junos OS? (Choose two)

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Which TWO statements are true regarding Junos OS global address books versus zone-specific address books? (Choose two)

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Which THREE services can be enabled under host-inbound-traffic system-services in Junos OS security zones? (Choose three)

Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Which THREE parameters can be configured within a custom application definition in Junos OS? (Choose three)

Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)

Which THREE settings can be configured under a security zone in Junos OS? (Choose three)

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

Which TWO statements are true regarding Junos OS address sets and their usage in security policies? (Choose two)

An administrator needs to create a new security zone named 'dmz' on an SRX Series device and assign the interface ge-0/0/2 to it. Which configuration mode command accomplishes this?

You are configuring a custom application named 'my-app' on an SRX Series device. You need to define it to match TCP traffic destined for port 8080 and also match UDP traffic on port 53. Which configuration correctly defines this application?

An administrator wants to create an address book entry for a subnet 192.168.1.0/24 and another for a single host 192.168.1.10. Both should be available globally across all zones. Which configuration achieves this?

An administrator needs to create a custom application in Junos OS that matches TCP traffic destined for port 8443 and terminates the session when the server sends a TCP RST. The application should not attempt to match any payload content. Which configuration statement set completes this custom application definition?

A network administrator is configuring a new security zone on an SRX Series device and wants to assign a logical interface to it. The interface is already configured with an IP address and is currently unassigned to any zone. Which configuration statement correctly assigns the interface ge-0/0/1.0 to the zone named TRUST?

A network engineer is configuring a custom application on an SRX Series device to match a proprietary protocol that uses UDP port 5000 and requires a timeout of 300 seconds. The engineer also needs to ensure that the application can be used in a security policy. Which configuration statement is required to define this custom application?

An administrator is configuring an address book entry in a security zone on an SRX Series device. The administrator needs to create an address book entry that represents a specific host with IP address 192.168.1.100 and a network with prefix 10.0.0.0/24. Which TWO address book object types can be used to accomplish this? (Choose two.)

An administrator wants to verify which security zones are currently configured on an SRX Series device and which interfaces are assigned to each zone. Which operational mode command provides this information in a concise, tabular format?

An administrator is defining a custom application in Junos OS to match a proprietary protocol that uses both TCP and UDP on different ports. The application must be referenced in a security policy. Which TWO statements are true about custom application definitions in Junos OS? (Choose two.)

A network engineer is configuring an SRX Series device with multiple security zones. The engineer wants to ensure that traffic from the trust zone to the untrust zone is inspected by a specific application firewall rule that matches HTTP traffic on port 8080. However, the engineer notices that the traffic is not being inspected. Which action should be taken to resolve this issue?

An administrator is configuring a custom application set on an SRX Series device to group multiple applications for use in a security policy. The application set will include both predefined and custom applications. Which two statements are true about application sets in Junos OS? (Choose two.)