Juniper Networks · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?
show security nat translation summary
show system nat active-translations
show route forwarding-table destination nat
show security flow session
show security flow session displays active sessions with their translation details, letting the administrator confirm whether source NAT is applied. It satisfies the stem's requirement for an operational command to verify source translation, unlike pool or rule-set commands that show configuration rather than live sessions.
An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?
set security nat destination rule-set rs1 rule r1 then translation pool web-pool
set security nat source pool web-pool address 192.168.1.100 port 8443
set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool
set security nat destination pool web-pool address 192.168.1.100 port 8443
The destination NAT pool defines the translated address and port. Specifying the private IP with port 8443 in the pool maps inbound port 443 traffic to the internal web server's actual listening port, satisfying the required translation.
A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?
The security policy action is set to permit instead of translating, causing port reuse collisions.
Port exhaustion has occurred because all available source ports for the single translation IP are in use.
With a single translation address, PAT is limited to roughly 64,000 source ports; heavy concurrent tab usage exhausts them, so new sessions cannot be translated and stall in closing state, producing the intermittent failures described.
The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.
Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.
An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?
The security policy is evaluating the post-translation source IP instead of the pre-translation IP.
Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.
Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.
The source NAT rule is missing the 'then source-nat interface' action statement.
Interface-based source NAT requires the 'then source-nat interface' action to translate the source address to the egress interface IP. Without it, the rule matches but performs no translation, so packets leave with the original private address, matching the observed symptom.
An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?
Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).
Hairpin NAT, or source NAT for intra-zone traffic, rewrites the source address so return packets from the internal server traverse the firewall rather than bypassing it. Without it, the server replies directly to the client, which discards the unexpected response.
Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.
Enable proxy ARP on the internal interface for the public destination IP address.
Configure a static route on the internal hosts pointing directly to the internal server IP.
Which Junos configuration block is required to define a static NAT rule set mapping external IP addresses to internal servers?
set security policies from-zone <zone> to-zone <zone> static-nat
set security nat static rule-set <name> from zone <zone>
A static NAT rule set must declare its source zone before rules and then-match clauses are evaluated, so the from zone statement is required to bind the rule set to traffic entering that zone. Without it, the rule set lacks the context Junos needs to apply the static mapping.
set security nat destination rule-set <name> from zone <zone>
set security nat source rule-set <name> from zone <zone>
Want more Network Address Translation practice?
Practice this domainYou are configuring physical interfaces on an SRX Series gateway. Which command structure is used to assign an interface to a specific security zone in Junos?
set firewall zone-mapping interface <interface> zone <name>
set interfaces <name> security-zone <zone>
set routing-options zones <name> interface <interface>
set security zones security-zone <name> interfaces <interface>
Assigning an interface to a zone uses the security-zone hierarchy under `set security zones`, binding the physical interface with the `interfaces` keyword. This satisfies the stem's requirement for the Junos command structure that places an SRX physical interface into a named security zone.
A network engineer is setting up a vSRX Virtual Firewall in a cloud environment. Which component acts as the control plane equivalent to a physical Routing Engine?
Virtual Routing Engine (vRE)
The vRE provides the control plane functions of the vSRX, running routing protocols and management daemons, exactly mirroring a physical Routing Engine. It satisfies the cloud scenario's requirement for a distinct control plane component separate from the forwarding plane, which is handled by the Virtual Forwarding Engine.
Virtual Interface Card (VIC)
Virtual Forwarding Plane (vFP)
Virtual Security Processor (vSP)
An administrator configures a high availability (HA) cluster on two SRX550 devices. During failover testing, they observe that stateful sessions are abruptly dropped. Which feature must be properly synchronized between the primary and secondary nodes to prevent session drop during failover?
Session synchronization
Session synchronisation replicates stateful flow data — session tables, NAT translations and ALG state — from primary to secondary SRX550, so established sessions survive failover without re-establishment. Without it, the secondary has no matching session entry and drops traffic, exactly the abrupt session loss observed during failover testing.
NAT pool reservation sync
IDP signature database sync
Routing table synchronization
An enterprise network uses a vSRX deployed on a hypervisor. The administrator needs to allocate additional vCPUs to improve throughput. Which component's performance is primarily enhanced by increasing vCPUs on a vSRX?
CLI responsiveness and SSH login speed
Junos Space management communication
Virtual Forwarding Plane (vFP) data path processing
The vFP handles all data-plane packet forwarding, so adding vCPUs scales its parallel processing threads and raises throughput. The control plane and hypervisor management components are not the forwarding bottleneck, making vFP the component whose performance increases.
Virtual Routing Engine (vRE) control plane convergence
You are configuring a branch SRX Series device and need to verify the operational state of the integrated interface modules. Which CLI command should you use to check the physical and link status of all network ports on a compact SRX device?
show security policies
show route summary
show chassis hardware
show interfaces terse
On compact SRX devices, show interfaces terse lists every interface with its admin, link and protocol state in one compact table, confirming physical and link status of the integrated modules. It satisfies the stem's need to verify operational state across all ports quickly.
Which hardware architecture distinction is characteristic of enterprise-grade SRX Series gateways (such as SRX4100 or SRX4600) compared to entry-level branch SRX models?
Enterprise SRX models feature separation of control plane (RE) and data/security plane (SPC) hardware architecture
Enterprise SRX platforms physically separate the Routing Engine control plane from the Services Processing Card data plane, so forwarding and security processing scale independently of routing. Entry-level branch models instead run both functions on shared, integrated hardware.
Enterprise SRX devices run ScreenOS instead of Junos OS
Branch SRX devices do not support security policies
Branch SRX models use modular SPCs while enterprise models use fixed ports
Want more Srx Series Service Gateways practice?
Practice this domainAn administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?
show security policy match-port 443
show security flow session destination-port 443
The destination-port keyword filters flow sessions by the remote port, so port 443 isolates HTTPS traffic. This matches the stem's requirement to view active sessions for a specific destination port on the SRX, whereas source-port or bare session filters would not narrow results correctly.
show route protocol bgp port 443
show firewall filter port 443
You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?
set system syslog file packet-log
set security flow traceoptions file flow-debug
The security flow traceoptions file directive defines the log file that receives flow-processing debug output, satisfying the requirement to capture detailed packet flow logs for the specified source. Traceoptions flags then record session creation, policy lookup and drop decisions for that traffic.
request security app-firewall log clear
set firewall filter debug term 1 then count
While inspecting the security session table using 'show security flow session', you notice a session in the 'P' state. What does this state indicate?
The session is prioritized for quality of service (QoS).
The session is pending and waiting for a TCP synchronization or return packet to be fully established.
The 'P' state in the Junos security flow session table denotes a pending session awaiting full establishment. It appears when the firewall has seen only the initial packet, such as a TCP SYN, and is waiting for the return packet to complete the three-way handshake before the session becomes active.
The session is operating in passive FTP mode.
The session is permanently blocked due to a security policy violation.
Where are system log messages related to security policies typically directed when default logging configurations are used?
Directly to the active user terminal screen by default
To the kernel crash dump utility
To the boot-time NVRAM partition
To the local log file configured under system syslog, such as interactive-commands or security-log
Junos default logging writes security policy events to the local syslog facilities defined under system syslog, typically security-log and interactive-commands files. No remote server is configured by default, so messages remain in those local files.
An administrator notices that traffic between two trusted security zones is being dropped unexpectedly. Which command should be used first to verify if the security policy is matching the traffic?
show system alarms
show security flow session
show route
show security policies hit-count
The hit-count counter increments each time a policy rule matches a session, so running it reveals whether any policy is actually matching the dropped inter-zone traffic. This directly confirms a match failure rather than an implicit deny or routing issue.
How can an administrator check the active Junos OS version running on an SRX Series device?
show system software-status
show chassis version
show version
The show version operational command displays the active Junos OS release, build and model information on the SRX, satisfying the requirement to check the running software version. It reports the current image rather than alternate or rollback partitions.
show system package installed
Want more Monitoring And Troubleshooting practice?
Practice this domainWhere are address books defined when configuring zone-based security policies in Junos OS?
Only under the system services configuration menu.
At the global security hierarchy or within individual security zones.
Address books can be defined at the global `[edit security address-book]` hierarchy or bound to a specific zone under `[edit security zones security-zone <name> address-book]`. This satisfies the stem's requirement by allowing both global and per-zone scope, so policies reference the appropriate book depending on where the object is declared.
Inside the interface configuration stanza for each physical port.
Exclusively within the routing-options hierarchy.
Which statement accurately describes zone-based security policies in Junos OS?
Security policies are always applied globally and do not require zone definitions.
Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.
Inter-zone traffic is denied by default because Junos OS evaluates sessions against security policies applied between zone pairs; no policy means no session, so packets are dropped. This satisfies the stem's requirement that only explicitly permitted traffic crosses zone boundaries, unlike intra-zone traffic, which is permitted by default.
Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.
Policies defined under the global context take precedence over all zone-based policies.
An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?
Attaching a security screen profile to the DMZ zone.
Enabling AppID match criteria by specifying applications within the security policy.
Specifying applications as match criteria activates the AppID engine, which performs application identification before the policy action is evaluated. This satisfies the stem's constraint that DMZ-to-Internal traffic be inspected by an application-identification engine first, since the Junos security policy only invokes AppID when application match criteria are configured.
Enabling stateless firewall filters on the egress interface.
Configuring global policies with an idle-timeout parameter.
You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?
An application set containing both HTTP and HTTPS.
An application set groups HTTP and HTTPS into a single named object, satisfying the requirement to bundle both applications cleanly before referencing them in the zone-to-zone policy. Junos matches the set as one unit, so the policy from 'users' to 'internet' stays concise rather than listing each application separately.
An address book entry containing the web server IP addresses.
A global policy with a service term.
A security zone profile containing the protocols.
You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?
Configuring security flow traceoptions to log packet processing details.
Security flow traceoptions log each packet's path through the flow module, exposing exactly which policy lookup occurs and why no session forms. This directly verifies zone mismatches or failed match criteria, since the trace shows the ingress and egress zone evaluation that the absent session cannot reveal.
Using 'ping' with the 'do-not-fragment' bit set.
Checking the system log file for routing protocol errors.
Running 'show firewall' to inspect interface filter counters.
You have multiple security policies configured within the context of a specific source and destination zone. A new requirement dictates that a specific subset of users must be denied access while everyone else in the same zone remains permitted. How should you order your security policies to achieve this without disrupting existing traffic?
Place the general permit policy above the deny policy and set the deny policy action to 'reject'.
Place the explicit deny policy for the specific subset of users above the general permit policy.
Junos evaluates security policies top-down, first match wins. Placing the explicit deny for the specific user subset above the general permit ensures those users are blocked before the broader rule is evaluated, while everyone else falls through to the permit, preserving existing traffic flows.
Convert the policies to global policies and place them at the bottom of the evaluation list.
Use an address set to combine the users and rely on automatic policy sorting by IP prefix length.
Want more Security Policies practice?
Practice this domainWhich statement accurately describes a security zone in Junos OS?
Interfaces belonging to different security zones can communicate without a security policy if they are on the same VLAN.
A security zone is required to contain at least one interface before policies can reference it.
A security zone is a logical grouping of interfaces used to define trust boundaries.
Interfaces are bound to zones, and zone membership establishes the trust boundary that policies reference when permitting or denying traffic between network segments. This logical grouping is what lets Junos apply distinct security treatment per boundary, satisfying the requirement for a definition of trust boundaries.
Interfaces can belong to multiple security zones simultaneously.
Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?
show security flow status
show security alg status
`show security alg status` queries the ALG status table directly, listing each configured Application Layer Gateway and whether it is enabled or disabled. This satisfies the stem's requirement to display currently active ALGs and their status, unlike commands that show ALG configuration or session details instead.
show security zones functional-zone
show system applications
You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?
Security group
Address set
An address set groups multiple address objects, including IPv4 subnets and ranges, under one named object referenced in security policies. It satisfies the requirement because address books store subnets and ranges as separate objects, and only a set combines them.
Address book
Prefix list
An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?
The global address book entry takes precedence.
Both entries are merged into a combined IP range.
The zone-specific address book entry takes precedence.
Junos resolves address book lookups using the most specific match, so a zone-specific book overrides the global book for traffic originating in that zone. Because both entries share the same host name but define different subnets, the zone-scoped definition supplies the IP used for policy matching.
Junos generates a compilation error due to duplicate names.
You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?
[edit security policies from-zone <zone> to-zone <zone> screen]
[edit interfaces <interface-name> screen <profile-name>]
[edit security screen id spoofing]
[edit security zones security-zone <zone-name> screen <profile-name>]
Screens are attached to security zones: after defining a profile, for example 'set security screen ids-option untrust-screen ip spoofing', you apply it with 'set security zones security-zone untrust screen untrust-screen'. Every interface in that zone is then protected for traffic arriving on it. The spoofing check drops packets whose source address routes back through a different zone, similar to a uRPF check.
An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?
Functional zone
A functional zone is a built-in Junos OS zone type reserved for special system functions, including the management interface used for out-of-band access. Unlike security zones, which host data-plane interfaces and enforce inter-zone policies, functional zones such as junos-host and the management zone handle control-plane traffic, satisfying the out-of-band management constraint.
Untrusted zone
Transit zone
Security zone
Want more Junos OS Security Objects practice?
Practice this domainWhich THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)
Server type (such as rbl or svbl)
The SRX DNSBL profile requires a server type, selecting rbl for IP-based or svbl for URL-based blacklists, which determines how returned addresses are interpreted during Antispam inspection. Without this parameter the profile cannot be committed, so it is mandatory.
Server domain name or IP address
The profile must identify the DNSBL provider by domain name or IP address, since the SRX queries that server to resolve whether a sending IP or URL is listed. This parameter supplies the lookup target required for Antispam inspection to function.
SMTP encryption certificate and private key
Expected DNS reply code or threshold IP indicating spam
The profile must define the expected DNS reply code or threshold IP that signals a spam listing, because the SRX compares the DNSBL response against this value to decide whether to flag, block or tag the message.
POP3/IMAP proxy port numbers
Which TWO actions can be configured when a URL is matched against a blocked category in an Integrated Web Filtering profile on an SRX Series device? (Choose two.)
Send an SNMP trap and instantly reboot the device control plane.
Block the connection and display a custom HTML block page message.
Integrated Web Filtering permits a block action that terminates the connection and serves a custom HTML block page message to the user. This satisfies the requirement for a configurable action when a URL matches a blocked category.
Redirect the user browser session to a predefined warning URL.
Integrated Web Filtering permits a redirect action, sending the blocked request to a predefined warning URL rather than silently dropping it. This satisfies the stem's requirement for a configurable response when a URL matches a blocked category, letting the SRX notify the user via their browser session.
Automatically rewrite the HTTP request header to inject user authentication tokens.
Drop the packet silently without sending any notification to the client.
An administrator needs to configure basic web filtering on a Juniper SRX Series device using the Integrated Web Filtering feature. Which license is strictly required on the SRX Series device to enable communication with the cloud-based web filtering rating server?
An IDP (Intrusion Detection and Prevention) license
An AppSecure license
An Anti-Virus license
An Integrated Web Filtering license
Integrated Web Filtering queries a cloud-based rating server, so the SRX needs the corresponding subscription licence installed and validated. Without this licence, the device cannot communicate with the rating server, and web filtering falls back to local blocklists only.
What is the default action taken by a Juniper SRX UTM Antivirus profile when an infected file is detected within an HTTP stream using the Express antivirus engine?
Strip the infected payload and deliver the sanitized file to the client.
Quarantine the file into an internal flash memory directory for manual review.
Permit the file and generate an alarm log.
Block the file transfer and terminate the session.
With the Express antivirus engine, detecting an infected file in an HTTP stream causes the SRX to block the file transfer and terminate the session, preventing delivery. This default action stops the malware reaching the client rather than merely logging it.
When configuring Kaspersky-based Antivirus on an SRX Series device, which operational mode reduces resource consumption by only scanning files matching specific high-risk protocol extensions?
Passive monitor mode
Stateless AV filtering
Extension-based or type-based scanning filtering
Extension-based scanning filters files by their extension or type, so the SRX only submits high-risk formats to the Kaspersky engine. This directly satisfies the stem's resource-consumption constraint, since unmatched files bypass inspection entirely, cutting CPU and memory load compared with scanning every protocol's traffic indiscriminately.
Fast-track scanning mode
Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?
Web filtering
Antivirus
Antispam
Antispam inspects SMTP traffic, applying heuristic and reputation checks to identify unsolicited bulk commercial email. It is the UTM feature specifically responsible for mail-borne spam filtering on SRX Series firewalls, matching the stem's requirement for the feature that examines incoming SMTP for bulk email.
Content filtering
Want more Content Security practice?
Practice this domainThe JNCIA-SEC exam has 65 questions and must be completed in 90 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Network Address Translation, Srx Series Service Gateways, Monitoring And Troubleshooting, Security Policies, Junos OS Security Objects, Content Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Juniper Networks JNCIA-SEC exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.