JNCIA-SEC Practice Test 11 — 15 Questions

Question 1

When configuring Kaspersky-based Antivirus on an SRX Series device, which operational mode reduces resource consumption by only scanning files matching specific high-risk protocol extensions?

Accepted Answer

Extension-based or type-based scanning filtering. Kaspersky antivirus on SRX supports extension-based filtering to optimize performance by skipping non-risk file types.

Answer

Passive monitor mode

Answer

Stateless AV filtering

Answer

Fast-track scanning mode

Question 2

Which statement is true regarding Junos OS security zone interfaces?

Accepted Answer

An interface must be assigned to a security zone before it can pass transit traffic.. An interface can belong to one security zone at a time.

Answer

An interface can be assigned to multiple security zones simultaneously.

Answer

Loopback interfaces must be assigned to security zones to function.

Answer

Management interfaces (fxp0) must be assigned to security zones for CLI access.

Question 3

Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)

Accepted Answer

show security flow session. Valid operational commands include showing security zones and security flow sessions.

Answer

show system applications builtin

Answer

show security policy ruleset evaluate

Answer

show configuration security address-book

Question 4

Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?

Accepted Answer

SCREEN options. SCREEN options provide attack detection and mitigation for layer 3 and layer 4 DoS attacks.

Answer

Firewall filter policers

Answer

IPsec VPN tunnels

Answer

Application Layer Gateways (ALGs)

Question 5

A network administrator needs to prevent users in the engineering department from uploading company source code to unauthorized cloud file-sharing services via web browsers. Which configuration mechanism within Juniper UTM content filtering accomplishes this task?

Accepted Answer

Enabling content filtering with a profile targeting specific upload MIME types or file extensions. Content filtering inspects HTTP and SMTP traffic to block or permit transfers based on MIME types, file extensions, or file sizes. By specifying blocking rules for specific upload MIME types, the administrator can prevent the unauthorized transmission of files.

Answer

Enabling integrated web filtering with a policy action of block for the File Sharing category

Answer

Configuring a custom URL category with a block action

Answer

Configuring antispam filters to drop outbound HTTP requests containing attachments

Question 6

Which command is used to verify the configuration of address books in Junos OS?

Accepted Answer

show configuration security address-book. The 'show configuration security address-book' command displays the configured address books in configuration mode.

Answer

show system address-books

Answer

show security address-book operational

Answer

show security flow address-book

Question 7

Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single unit in security policies?

Accepted Answer

Application set. An application set groups multiple applications together.

Answer

Application bundle

Answer

Application group

Answer

Application profile

Question 8

Which Junos OS feature is responsible for translating port numbers for protocols like FTP during transit across security zones?

Accepted Answer

Application Layer Gateway (ALG). ALGs handle port translation and protocol parsing for complex applications.

Answer

Host-inbound traffic

Answer

SCREEN options

Answer

NAT (Network Address Translation)

Question 9

Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)

Accepted Answer

TCP SYN flood rate limiting. SCREEN option profiles contain Layer 3/4 attack protections such as IP spoofing and SYN flood limits.

Answer

Deep packet URL filtering and virus signature inspection

Answer

NAT pool port exhaustion mitigation

Answer

Dynamic routing protocol authentication keys

Question 10

You need to modify an existing security policy to add a new IP address to an existing address set used in the policy match criteria. Which configuration hierarchy should you access to update the address set?

Accepted Answer

[edit security address-book] or within the specific zone's address-book configuration.. Address sets are configured within address books, either globally or under specific zones.

Answer

[edit security policies] directly within the policy match criteria.

Answer

[edit interfaces]

Answer

[edit routing-options]

Question 11

You want to create a security policy that applies to traffic originating from a specific address book entry named 'HQ-Net' in the 'trust' zone destined for 'Branch-Net' in the 'untrust' zone. Where must the 'HQ-Net' address be defined?

Accepted Answer

Within the address-book configuration of the 'trust' zone or at the global address-book level.. Address entries can be defined either globally or inside the specific zone configuration.

Answer

Directly within the system login configuration block.

Answer

Inside the routing-options static route definition.

Answer

As an interface unit attribute under the [edit interfaces] hierarchy.

Question 12

Which interface type on an SRX Series device is typically used to connect internal local area networks (LANs) to the security gateway?

Accepted Answer

Gigabit Ethernet (ge- / xe-) interfaces. Gigabit Ethernet (ge-) or similar physical and logical interfaces are used to connect local networks.

Answer

fab0 and fab1

Answer

lc-0/0/0

Answer

fxp0

Question 13

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

Accepted Answer

Under the security zone host-inbound-traffic system-services icmp configuration.. ICMP echo request must be enabled under the host-inbound-traffic configuration for the specific security zone or interface.

Answer

Inside the junos-icmp application object definition.

Answer

Inside the global SCREEN option profile under ICMP flood settings.

Answer

Under the security policies between the untrust and trust zones.

Question 14

You are troubleshooting a Junos security device where a Destination NAT rule is configured. External users reach the virtual IP, but traffic fails to establish a TCP 3-way handshake. Using 'monitor traffic', you observe SYN packets arriving at the external interface and leaving the internal interface towards the server. However, no SYN-ACK packets return from the server. What is the most likely networking or routing reason on the internal network causing this?

Accepted Answer

The internal server's default gateway does not point to the SRX device, causing asymmetric routing where return packets bypass the firewall.. If SYN packets reach the internal server but no SYN-ACK returns, the server is likely sending its response to a different next-hop — typically its default gateway is not the SRX, so return traffic bypasses the firewall and the session never completes. This is classic asymmetric routing: the SRX sees only one direction of the flow, so it cannot establish the session or perform the reverse NAT translation. The fix is to point the server's default gateway to the SRX internal interface.

Answer

The security policy is evaluating pre-translation source ports instead of post-translation source ports.

Answer

Proxy ARP is disabled on the internal interface of the SRX.

Answer

The destination NAT rule is missing the port translation statement, causing the server to drop unrecognized ports.

Question 15

You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?

Accepted Answer

Create a screen profile with ICMP flood parameters and apply that profile under the security zone configuration.. ICMP flood protection is configured inside a screen profile under [edit security screen], and that profile is then applied to the security zone.

Answer

Set [edit security zones security-zone trust screen icmp-flood threshold 1000] directly.

Answer

Enable ICMP inspection inside the junos-icmp application definition.

Answer

Apply ICMP flood options directly under the [edit security policies] hierarchy.