Juniper Networks · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You have configured Destination NAT on a SRX Series device to forward web traffic to an internal server. External clients attempt to connect, but the security logs show sessions are being dropped by the security policy. Which security zone and IP address combination must the security policy permit?
From the untrusted zone to the untrusted zone, using the public destination IP address.
From the untrusted zone to the trusted zone, using the pre-translation public IP address.
From the untrusted zone to the trusted zone, using the internal private IP address of the server.
Security policies for Destination NAT evaluate the post-translation destination IP and the target internal zone.
From the trusted zone to the untrusted zone, using the public destination IP address.
You manage an SRX device where multiple internal subnets require Source NAT out to the internet using a shared pool of public IP addresses. However, specific internal servers must always map to a dedicated, unique public IP address to maintain whitelisting on external partner firewalls. How should you configure this requirement?
Use interface-based NAT for the servers and pool-based NAT for the remaining internal subnets.
Configure a specific source NAT rule matching the server's IP address placed above the general rule in the rule-set evaluation order.
Junos evaluates rules within a rule-set sequentially; placing the more specific rule first ensures the server matches the dedicated translation.
Configure Static NAT for the entire subnet and override individual host entries using Source NAT pools.
Enable persistent-nat on the general source NAT pool and bind the server's MAC address to the public IP.
An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?
show security nat translation summary
show system nat active-translations
show route forwarding-table destination nat
show security flow session
The 'show security flow session' command displays active session table entries showing pre-NAT and post-NAT IP addresses and ports.
When configuring NAT rule sets on a Junos OS device, in what order are different types of NAT evaluated?
Destination NAT is evaluated first, followed by Source NAT, and then Static NAT.
The evaluation order in Junos OS security NAT is Destination NAT, then Source NAT, then Static NAT.
All NAT types are evaluated simultaneously using parallel hardware lookups.
Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.
Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.
An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?
set security nat destination rule-set rs1 rule r1 then translation pool web-pool
set security nat source pool web-pool address 192.168.1.100 port 8443
set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool
set security nat destination pool web-pool address 192.168.1.100 port 8443
This is the correct syntax for creating a destination NAT pool specifying the translated IP and port.
A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?
The security policy action is set to permit instead of translating, causing port reuse collisions.
Port exhaustion has occurred because all available source ports for the single translation IP are in use.
A single IP address provides a limited number of source ports for PAT, which can be exhausted by heavy traffic.
The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.
Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.
Want more Network Address Translation practice?
Practice this domainYou are configuring physical interfaces on an SRX Series gateway. Which command structure is used to assign an interface to a specific security zone in Junos?
set firewall zone-mapping interface <interface> zone <name>
set interfaces <name> security-zone <zone>
set routing-options zones <name> interface <interface>
set security zones security-zone <name> interfaces <interface>
Security zones are populated with interfaces under the security configuration hierarchy.
A network engineer is setting up a vSRX Virtual Firewall in a cloud environment. Which component acts as the control plane equivalent to a physical Routing Engine?
Virtual Routing Engine (vRE)
The vRE functions as the control plane for the vSRX, handling management, routing protocols, and configuration.
Virtual Interface Card (VIC)
Virtual Forwarding Plane (vFP)
Virtual Security Processor (vSP)
An administrator configures a high availability (HA) cluster on two SRX550 devices. During failover testing, they observe that stateful sessions are abruptly dropped. Which feature must be properly synchronized between the primary and secondary nodes to prevent session drop during failover?
Session synchronization
Session synchronization ensures active stateful flows are mirrored to the backup node, enabling hitless failover.
NAT pool reservation sync
IDP signature database sync
Routing table synchronization
An enterprise network uses a vSRX deployed on a hypervisor. The administrator needs to allocate additional vCPUs to improve throughput. Which component's performance is primarily enhanced by increasing vCPUs on a vSRX?
CLI responsiveness and SSH login speed
Junos Space management communication
Virtual Forwarding Plane (vFP) data path processing
Increasing vCPUs directly scales the vFP packet processing capabilities and overall data throughput.
Virtual Routing Engine (vRE) control plane convergence
While troubleshooting traffic flow through an SRX Series device, you notice that packets are evaluated against security policies before a specific lookup. According to the SRX traffic flow mechanics, what is the very first action performed on an incoming packet entering an interface?
Security policy lookup
NAT rule evaluation
Session lookup (flow table lookup)
The SRX first checks if a matching session already exists in the flow table to fast-path established traffic.
Screen option inspection
You are configuring a branch SRX Series device and need to verify the operational state of the integrated interface modules. Which CLI command should you use to check the physical and link status of all network ports on a compact SRX device?
show security policies
show route summary
show chassis hardware
show interfaces terse
This command provides a concise summary of physical and logical interface statuses and IP addresses.
Want more Srx Series Service Gateways practice?
Practice this domainAn administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?
show security policy match-port 443
show security flow session destination-port 443
Correct. Filtering sessions by destination-port provides targeted troubleshooting visibility.
show route protocol bgp port 443
show firewall filter port 443
You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?
set system syslog file packet-log
set security flow traceoptions file flow-debug
Correct. Flow traceoptions are specifically designed to log packet processing and drop reasons within the security flow engine.
request security app-firewall log clear
set firewall filter debug term 1 then count
While inspecting the security session table using 'show security flow session', you notice a session in the 'P' state. What does this state indicate?
The session is prioritized for quality of service (QoS).
The session is pending and waiting for a TCP synchronization or return packet to be fully established.
Correct. 'P' indicates pending state in the security session table.
The session is operating in passive FTP mode.
The session is permanently blocked due to a security policy violation.
You need to verify the operational status of an IPsec VPN tunnel on an SRX Series device. Which command provides detailed tunnel status including Phase 1 and Phase 2 associations?
show security ipsec security-associations
Correct. This command shows Phase 2 IPsec security associations and traffic statistics.
show security flow vpn-status
show security ike sa-detail
show vpn ipsec active
Where are system log messages related to security policies typically directed when default logging configurations are used?
Directly to the active user terminal screen by default
To the kernel crash dump utility
To the boot-time NVRAM partition
To the local log file configured under system syslog, such as interactive-commands or security-log
Correct. Junos routes security policy logs to configured syslog files.
You suspect that Network Address Translation (NAT) is misconfigured for a server pool. Which command should you use to examine active NAT translation entries?
show route forwarding-table destination-nat
show security alg status
show security flow active-nat
show security nat translation
Correct. This command displays active NAT translation table entries and mappings.
Want more Monitoring And Troubleshooting practice?
Practice this domainWhere are address books defined when configuring zone-based security policies in Junos OS?
Only under the system services configuration menu.
At the global security hierarchy or within individual security zones.
Correct. Address books can be configured globally or tied specifically to a security zone.
Inside the interface configuration stanza for each physical port.
Exclusively within the routing-options hierarchy.
An administrator configures a security policy with a custom application definition that matches TCP port 8080. When testing the policy, traffic on port 8080 is matched, but the application identification engine flags the traffic as 'junos-http'. What is the reason for this behavior?
The default policy evaluation order places global policies above custom application rules.
Custom applications are disabled by default when security policies are compiled.
Junos AppID uses deep packet inspection and overrides custom port definitions with recognized protocol signatures.
Correct. AppID uses protocol signatures to identify traffic regardless of custom port definitions or standard port mappings.
The security policy must be changed from zone-based to global to support custom applications.
Which statement accurately describes zone-based security policies in Junos OS?
Security policies are always applied globally and do not require zone definitions.
Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.
Correct. Junos OS enforces a strict default-deny policy between security zones.
Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.
Policies defined under the global context take precedence over all zone-based policies.
An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?
Attaching a security screen profile to the DMZ zone.
Enabling AppID match criteria by specifying applications within the security policy.
Correct. By incorporating application terms in the match criteria, Junos uses AppID to inspect and classify traffic before enforcing the policy action.
Enabling stateless firewall filters on the egress interface.
Configuring global policies with an idle-timeout parameter.
You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?
An application set containing both HTTP and HTTPS.
Correct. Application sets allow administrators to group multiple applications and reference them as a single entity in security policies.
An address book entry containing the web server IP addresses.
A global policy with a service term.
A security zone profile containing the protocols.
You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?
Configuring security flow traceoptions to log packet processing details.
Correct. Security flow traceoptions provide detailed debugging output regarding packet matching against security policies and zones.
Using 'ping' with the 'do-not-fragment' bit set.
Checking the system log file for routing protocol errors.
Running 'show firewall' to inspect interface filter counters.
Want more Security Policies practice?
Practice this domainWhich THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)
Server type (such as rbl or svbl)
Defining the server type specifies the protocol format expected.
Server domain name or IP address
The DNSBL server address is required to query the blacklist database.
SMTP encryption certificate and private key
Expected DNS reply code or threshold IP indicating spam
The SRX checks the DNS query return value against configured threshold IPs to identify spam.
POP3/IMAP proxy port numbers
When configuring Antispam on an SRX Series device using the SBL (Spam Black List) feature, what is the primary function of the block/permit action list?
To inspect the payload of HTTPS encrypted webmail traffic for spam keywords.
To rewrite the headers of outgoing spam messages before they reach the mail server.
To quarantine infected executable attachments found inside incoming emails.
To query external DNSBL servers and apply local overrides for known good or bad senders.
The antispam profile integrates with DNSBL services and allows local custom block and permit rules.
You are configuring a UTM policy on a Juniper SRX firewall that includes antivirus, web filtering, and antispam profiles. To apply these UTM services to traffic, where must the UTM policy profile be explicitly attached in the Junos configuration?
Under the [edit security zones security-zone <zone> utm-profile] hierarchy.
Under the [edit security policies from-zone <zone> to-zone <zone> policy <name> match] hierarchy.
Under the [edit interfaces <interface> unit <0> family inet utm] hierarchy.
Under the [edit security policies from-zone <zone> to-zone <zone> policy <name> then] hierarchy.
UTM policies are attached within the 'then' statement of a security policy to enforce inspection on matched sessions.
An administrator configures Unified Threat Management (UTM) antivirus inspection on an SRX device using the Junos Express antivirus engine. During high-traffic periods, users report that large file downloads are failing or timing out. Which CLI command or configuration adjustment is most appropriate to resolve this issue by increasing the maximum file size limit inspected by the antivirus engine?
set security utm default-profile antivirus max-buffer-size <size>
set security utm feature-profile antivirus profile default http-profile maximum-file-size <size>
The maximum-file-size parameter under the HTTP profile of the UTM antivirus configuration controls the threshold for file inspection.
set security flow tcp-mss <size>
set security utm engine stream-scanning max-object-size <size>
Which TWO actions can be configured when a URL is matched against a blocked category in an Integrated Web Filtering profile on an SRX Series device? (Choose two.)
Send an SNMP trap and instantly reboot the device control plane.
Block the connection and display a custom HTML block page message.
SRX web filtering supports displaying custom block notification pages.
Redirect the user browser session to a predefined warning URL.
Redirect action sends the user to a specific destination URL upon block.
Automatically rewrite the HTTP request header to inject user authentication tokens.
Drop the packet silently without sending any notification to the client.
An enterprise network uses Juniper SRX Series devices running Junos OS with Integrated Web Filtering. Due to privacy regulations, the administrator needs to ensure that specific sensitive URLs are not logged by the cloud rating server or the local SRX log. Which CLI parameter should be adjusted within the web-filtering profile?
set security log mode stream-disable
set security utm feature-profile web-filtering profile <name> custom-block-message <text>
set security utm feature-profile web-filtering profile <name> disable-cloud-logging
set security utm feature-profile web-filtering profile <name> no-log
The 'no-log' command disables logging of URLs matched by the specific web-filtering profile.
Want more Content Security practice?
Practice this domainWhich statement accurately describes a security zone in Junos OS?
Interfaces belonging to different security zones can communicate without a security policy if they are on the same VLAN.
A security zone is required to contain at least one interface before policies can reference it.
A security zone is a logical grouping of interfaces used to define trust boundaries.
Security zones establish boundaries for enforcing security policies.
Interfaces can belong to multiple security zones simultaneously.
Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?
show security flow status
show security alg status
This command lists all supported ALGs and shows whether they are enabled or disabled.
show security zones functional-zone
show system applications
You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?
Security group
Address set
Address sets allow grouping multiple address objects.
Address book
Prefix list
You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?
tcp syn-flood alarm-threshold <value>
The alarm threshold or threshold parameter under 'tcp syn-flood' handles SYN flood detection settings.
icmp flood limit <value>
ip spoofing check
tcp-syn-flood attack-threshold
An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?
The global address book entry takes precedence.
Both entries are merged into a combined IP range.
The zone-specific address book entry takes precedence.
Local zone-specific address books are evaluated first before the global address book.
Junos generates a compilation error due to duplicate names.
An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?
[edit security flow alg ftp mode transparent]
[edit security zones security-zone untrust alg ftp]
[edit security alg ftp disable]
The global ALG configuration allows disabling specific protocol helpers like FTP under [edit security alg].
[edit applications application junos-ftp alg none]
Want more Junos OS Security Objects practice?
Practice this domainThe JNCIA-SEC exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Network Address Translation, Srx Series Service Gateways, Monitoring And Troubleshooting, Security Policies, Content Security, Junos OS Security Objects. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Juniper Networks JNCIA-SEC exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.