JNCIA-SEC Practice Test 10 — 10 Questions

Question 1

An administrator configures a security zone and applies a SCREEN profile that includes 'limit-session source-ip'. What is the function of this specific SCREEN option?

Accepted Answer

It restricts the total number of sessions any single source IP address can open through that zone.. The 'limit-session source-ip' SCREEN option limits the number of concurrent sessions a single source IP address can establish, protecting against resource exhaustion and flood attacks.

Answer

It drops packets originating from source IPs that have invalid subnet masks.

Answer

It limits the rate of new TCP connections per second from a source IP.

Answer

It blocks all traffic from a source IP address permanently after it sends a single packet.

Question 2

An administrator notices that the SRX firewall is failing to inspect encrypted HTTPS traffic for web filtering and antivirus violations. The security policy currently permits traffic from the trust zone to the untrust zone with a UTM profile attached. What must be configured to enable content security inspection on this HTTPS traffic?

Accepted Answer

Configure an SSL proxy profile and apply it to the security policy alongside the UTM profile. UTM security features on Juniper SRX devices inspect cleartext protocols by default. To inspect HTTPS (SSL/TLS) traffic, the firewall must perform SSL proxy decryption (Forward Proxy) to decrypt the session, inspect the content using the UTM profile, and re-encrypt it before forwarding.

Answer

Enable SSH inspection within the content filtering profile configuration hierarchy

Answer

Change the security policy action from permit to tunnel for encrypted sessions

Answer

Upgrade the Juniper Secure Connect license to enable TLS deep packet inspection in the UTM profile

Question 3

What is the default action taken by a Juniper SRX UTM Antivirus profile when an infected file is detected within an HTTP stream using the Express antivirus engine?

Accepted Answer

Block the file transfer and terminate the session.. The default action for Juniper UTM antivirus when malware is detected in transit is to block the file transfer and drop the stream.

Answer

Strip the infected payload and deliver the sanitized file to the client.

Answer

Quarantine the file into an internal flash memory directory for manual review.

Answer

Permit the file and generate an alarm log.

Question 4

A network engineer has deployed a new SRX300 Series Services Gateway at a branch office and needs to verify that the interfaces are physically up and operating at the correct speed and duplex settings. Which operational command should the engineer execute to view this interface state information?

Accepted Answer

show interfaces ge-0/0/0. The command 'show interfaces ge-0/0/0' displays detailed operational status for the specified interface, including link state (up/down), speed, duplex, and error counters. This is the correct command to verify physical layer status and negotiated speed/duplex on an SRX300.

Answer

show security policies

Answer

show chassis hardware

Answer

show interfaces terse

Question 5

An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?

Accepted Answer

source-route. The source route option in SCREEN profiles detects and blocks packets containing IP source routing headers.

Answer

ip spoofing

Answer

land attack

Answer

tear-drop

Question 6

You are configuring security policies on an SRX Series device that uses destination NAT. In what order does Junos evaluate security policies relative to destination NAT processing?

Accepted Answer

Destination NAT is evaluated first; security policies are then evaluated using the post-NAT destination addresses.. On Junos SRX, destination NAT is evaluated before security policy lookup, and the security policy is then matched against the post-NAT destination address. This means the policy must reference the translated (inside) address, not the original public address. The order is: packet arrives, destination NAT is applied, then the security policy is evaluated using the translated destination IP.

Answer

Destination NAT and security policies are evaluated simultaneously in parallel.

Answer

Security policies are evaluated before destination NAT, using pre-NAT IP addresses.

Answer

Security policies are evaluated twice: once pre-NAT and once post-NAT.

Question 7

An administrator configures Web Filtering and wants to view summary statistics of blocked categories. Which operational command should be executed?

Accepted Answer

show security utm web-filtering statistics. Operational commands under 'show security utm web-filtering statistics' provide details on categories blocked and queries processed.

Answer

show system services web-filtering summary

Answer

show security flow session statistics utm

Answer

show utm web-filter counters

Question 8

You are configuring an SRX Series device and want to ensure that all traffic entering the untrusted zone is checked for LAND attacks. Which configuration steps are required?

Accepted Answer

Create a screen profile containing the 'land' option and apply that profile to the untrusted security zone.. To enable LAND attack protection, you must create a screen profile with 'land' enabled and apply that profile to the untrusted security zone.

Answer

Enable LAND protection globally under [edit security flow] and attach it to the interface.

Answer

Define a firewall filter checking for identical source and destination IPs and apply it as an input filter on the interface.

Answer

Enable the LAND Application Layer Gateway under [edit security alg].

Question 9

Which TWO items are valid options when specifying source addresses in a security policy match statement? (Choose two.)

Accepted Answer

An individual IP address or subnet prefix (e.g., 192.168.1.0/24). In a security policy match statement, source addresses are specified using address objects, so option B is correct because an individual IP address or subnet prefix such as 192.168.1.0/24 can be entered directly as a source address value. Option C is also correct because an address book entry name such as trust-servers is the standard way to reference a predefined address object in the source-address field of a policy rule. Option A is not valid because MAC addresses are layer-2 identifiers and are not used in security policy source-address matching, which operates on layer-3/layer-4 information. Option D is not valid because a physical interface name such as ge-0/0/0.0 is used in zone or interface matching, not as a source address value. Option E is not valid because a BGP autonomous system number is routing metadata and cannot be used as a source address in a security policy match statement.

Answer

A MAC address string (e.g., 00:11:22:33:44:55)

Answer

A physical interface name (e.g., ge-0/0/0.0)

Answer

A BGP autonomous system number (e.g., ASN 65000)

Question 10

What is the primary function of the Antispam feature on Juniper SRX Series firewalls?

Accepted Answer

To detect and filter unsolicited bulk email messages over SMTP.. Antispam identifies and blocks unsolicited bulk commercial emails arriving over SMTP.

Answer

To inspect Layer 4 port numbers for port scanning attacks.

Answer

To block malicious executable file downloads from websites.

Answer

To categorize web traffic into productivity groups.