JNCIA-SEC Practice Test 12 — 15 Questions

Question 1

An administrator configures a Source NAT rule with an address pool. When verifying traffic, the administrator notices that multiple distinct internal subnets are matching the rule. How can the administrator restrict the source NAT rule to apply only to a specific subnet while leaving other subnets un-translated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Specify an exact prefix under the rule's 'match source-address' statement.. The correct way to restrict a source NAT rule to a specific subnet is to specify an exact prefix under the rule's 'match source-address' statement. This directly limits the rule to only match traffic from that subnet, leaving other subnets unmatched and therefore untranslated. This is the standard Junos NAT configuration approach.

Answer

Apply a firewall filter on the ingress interface to drop un-translated subnets.

Answer

Configure static routes for un-translated subnets pointing to the loopback interface.

Answer

Configure the rule-set source zone with individual interface subnets.

Question 2

Which THREE statements are true regarding global security policies in Junos OS? (Choose three.)

Accepted Answer

Global policies support matching on applications, source addresses, and destination addresses.. Option A is correct because global policies in Junos OS support the same match criteria as zone-based policies, including applications, source addresses, and destination addresses, allowing flexible traffic identification. Option C is correct because the Junos security policy evaluation order processes zone-based policies first and then global policies, so global policies act as a fallback for traffic not matched by zone-specific rules. Option D is correct because global policies are defined without a from-zone/to-zone context, so a single rule can apply across multiple zones without declaring individual source-to-destination zone pairs. Option B is incorrect because global policies are configured under the global policy hierarchy and do not require an explicit zone pair declaration. Option E is incorrect because global policies are evaluated after, not before, zone-based policies, so they do not take precedence over them.

Answer

Global policies require an explicit zone pair declaration in the configuration hierarchy.

Answer

Global policies take precedence over any configured zone-based security policies.

Question 3

An administrator is configuring syslog output on an SRX Series device to troubleshoot security events. Which TWO actions must be taken to ensure logs are successfully sent to an external syslog server? (Choose two)

Accepted Answer

Specify the facility and severity level to be logged.. Option C is correct because Junos syslog configuration requires you to define which messages are captured by specifying a facility (such as `security`, `authorization`, or `daemon`) and a severity level (such as `info`, `notice`, or `any`) under `[edit system syslog]`; without this, no log messages are selected for transmission. Option D is correct because you must configure the external syslog server's IP address as a host destination under `[edit system syslog host <ip-address>]` so the device knows where to send the selected log messages. Option A is incorrect because firewall filters on external interfaces do not need to be disabled for syslog traffic to egress; syslog uses UDP/TCP port 514 and is not blocked by the mere presence of filters unless explicitly configured to drop it. Option B is incorrect because the syslog daemon starts automatically and does not require a Routing Engine reboot to initialize after configuration changes. Option E is incorrect because security flow traceoptions are used for debugging packet flow processing and writing trace files, not for sending security logs to an external syslog server.

Answer

Disable all active firewall filters on external interfaces.

Answer

Reboot the Routing Engine to initialize the syslog daemon.

Answer

Enable security flow traceoptions globally.

Question 4

You are troubleshooting a Junos security device where a Static NAT rule is configured for an internal server. Internal users access the server using its public IP address. You notice that traffic from internal clients hitting the static NAT IP creates asymmetric routing or fails because source translation is absent. How does Junos handle internal clients accessing a server via its static NAT public IP without explicit hairpin NAT?

Accepted Answer

Without hairpin source NAT, the internal server responds directly to the internal client, causing the client to drop the packet due to mismatched source/destination IP states.. When an internal client accesses an internal server via its static NAT public IP, the packet is translated to the server's private IP, but the source IP remains the client's private IP. The server responds directly to the client's private IP, bypassing the Junos device. The client, expecting the response from the public IP it originally sent the packet to, sees a response from a different source IP and drops the packet due to mismatched session state. This is why hairpin NAT (source NAT for internal-to-internal traffic) is needed.

Answer

Static NAT automatically applies hairpin source NAT when source and destination zones are identical.

Answer

Proxy ARP automatically intercepts internal static NAT requests and rewrites the source IP.

Answer

Junos automatically converts internal static NAT requests into loopback tunnel traffic.

Question 5

An administrator needs to ensure that Antispam inspection is applied only to inbound mail destined for the corporate mail server. How should this be achieved in the security policy configuration?

Accepted Answer

Attach an antispam-enabled UTM policy exclusively to the security policy permitting SMTP traffic from the untrusted zone to the mail server.. Antispam is bound to a UTM policy, which in turn is attached to a specific security policy governing the mail server traffic flow.

Answer

Configure a global antispam filter under the [edit security utm] hierarchy.

Answer

Apply the antispam profile directly to the egress interface facing the mail server.

Answer

Enable antispam globally within the system services configuration.

Question 6

Which TWO methods can be used to access the Junos CLI on an SRX Series device during initial setup or routine administration? (Choose two)

Accepted Answer

Local console serial connection. Option A (Local console serial connection) is correct because the SRX Series provides an RJ-45 or mini-USB console port that gives out-of-band CLI access using settings such as 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control, which is the standard method for initial setup when no network is configured. Option E (Secure Shell (SSH) over network interfaces) is correct because once an interface has an IP address and the device is reachable, Junos supports SSH (TCP port 22) for encrypted remote CLI administration, which is the recommended in-band management method. Option B is incorrect because SRX devices do not offer a Bluetooth pairing app for CLI access. Option C is incorrect because Telnet is not enabled by default on Junos and is disabled for security reasons; it must be explicitly configured under the [system services telnet] hierarchy. Option D is incorrect because the SPC (Services Processing Card) does not expose a VGA and USB keyboard interface for direct CLI access.

Answer

Bluetooth pairing app

Answer

Unencrypted Telnet by default

Answer

VGA monitor and USB keyboard directly plugged into SPC

Question 7

An administrator configures a unified security policy with a custom application signature. However, traffic matching the expected port is failing because the application identification engine (AppID) has not yet recognized the session payload. What mechanism does Junos use to handle initial packets while AppID inspects the traffic?

Accepted Answer

Traffic is initially evaluated using preliminary port-based match criteria until application identification completes.. When AppID is enabled in a security policy, Junos initially permits or denies packets based on traditional port-based matching until AppID identifies the application, after which the policy action is re-evaluated.

Answer

Traffic is dropped until AppID completes full packet payload decryption.

Answer

Traffic is immediately forwarded to the CPU for software-based deep packet inspection, bypassing the PFE.

Answer

Traffic is rejected with an ICMP redirection message prompting re-transmission.

Question 8

An administrator is configuring Source NAT on an SRX Series device. Which THREE match criteria can be used within a Source NAT rule set or rule to identify traffic for translation? (Choose three)

Accepted Answer

Application or protocol / port. In Junos security NAT on SRX Series devices, a source NAT rule set is matched using a from clause that can reference source-address (D), destination-address (C), and application or application-set, which defines protocol/port criteria (B); these are the standard traffic-identification match conditions for source NAT. Option D is correct because the source address/prefix is the primary match that selects which internal hosts are translated. Option C is correct because destination address/prefix can be used to restrict translation to traffic destined for specific external networks. Option B is correct because application or protocol/port match criteria allow the rule to translate only specific services such as HTTP or DNS. Option A is incorrect because CPU utilization threshold is not a NAT match criterion; it is a system resource metric, not part of a source NAT rule. Option E is incorrect because chassis cluster node serial number is not a match condition in a source NAT rule set or rule.

Answer

CPU utilization threshold

Answer

Chassis cluster node serial number

Question 9

When reviewing security policies, you notice multiple rules defined within the same source-zone and destination-zone context. Which Junos feature allows you to group these related policies together for easier management and readability?

Accepted Answer

Policy sets. Junos policy terms can be organized and grouped using policy sets, allowing administrators to apply administrative containers to multiple security policies.

Answer

Virtual security domains

Answer

Zone clusters

Answer

Security profiles

Question 10

By default, what action does an SRX Series device take when traffic does not match any configured security policy between two zones?

Accepted Answer

Drop the traffic silently via the implicit deny policy.. By default, an SRX Series device enforces an implicit deny-all policy for any traffic that does not match an explicitly configured security policy between zones. This default behavior drops the traffic silently without sending any notification to the source, which is a fundamental security posture of the Junos zone-based firewall.

Answer

Forward the traffic to the default gateway for inspection.

Answer

Permit the traffic and generate an informational system log.

Answer

Prompt the user with a captive portal redirect.

Question 11

An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?

Accepted Answer

SSH access is restricted only to the specific interface where the service was explicitly enabled, unless enabled at the zone level.. Host-inbound-traffic settings can be configured globally for the zone or overridden per interface. Allowing SSH on one interface does not automatically enable it on other interfaces unless configured at the zone level or explicitly enabled on those interfaces.

Answer

SSH traffic is dropped by security policies because host-inbound traffic bypasses security policies entirely.

Answer

SSH access is automatically permitted on all interfaces within that security zone.

Answer

SSH access is blocked on all interfaces because host-inbound traffic must be defined under the global zone level.

Question 12

An administrator configures a security policy on a SRX Series device with the action set to 'count'. What is the primary function of this action in Junos security policies?

Accepted Answer

It permits the matching traffic while maintaining packet and byte counters.. The 'count' action allows traffic matching the policy to be permitted while incrementing packet and byte counters for traffic monitoring and auditing purposes.

Answer

It mirrors the matching traffic packet headers to a designated analyzer port.

Answer

It drops the packet and logs the event to the local event log.

Answer

It sends a TCP reset to the client and server.

Question 13

Which THREE parameters can be used as match criteria within a Junos security policy? (Choose three.)

Accepted Answer

Applications or application sets. Option A is correct because a Junos security policy can match on applications or application sets, which are defined objects (e.g., junos-http, junos-ssh) that identify the traffic by protocol and port. Option D is correct because Junos User Firewall (integrated user firewall) allows policies to match on user identities sourced from Active Directory or ICAP, enabling role-based enforcement. Option E is correct because security policies match on source-address and destination-address entries drawn from address books (zones' address-book objects). Option B is not a security policy match criterion; BGP AS path attributes are used in routing policy (policy-statement) for route selection, not in security policy. Option C is also not a match criterion in a standard Junos security policy; MAC addresses are matched in Layer 2 switching/filter contexts (e.g., family ethernet-switching firewall filters), not in security policy match conditions.

Answer

BGP AS path attributes

Answer

Physical interface MAC addresses

Question 14

During the initial physical deployment of an SRX Series gateway, how does an administrator typically connect to the device out-of-band for initial CLI configuration?

Accepted Answer

By connecting a serial console cable to the CONSOLE port and using a terminal emulator.. During initial physical deployment, an SRX Series gateway has no IP configuration, no management reachability, and no credentials set, so the only reliable out-of-band path is the physical CONSOLE port. Administrators attach a serial rollover cable (typically RJ-45 to DB-9/USB) and use a terminal emulator at 9600 baud, 8-N-1, no flow control to reach the Junos CLI login prompt. This works even when the device is in a factory-default or unbootable state, making it the standard first-touch method.

Answer

By using SSH over the default management interface fxp0 with DHCP enabled.

Answer

By connecting an Ethernet cable to any data port and browsing to http://192.168.1.1

Answer

By inserting a pre-formatted USB drive containing a root password file into the FXP0 port.

Question 15

Which THREE parameters can be configured when tuning an Antivirus profile in Junos OS UTM? (Choose three.)

Accepted Answer

Action upon virus detection (e.g., block or permit). Option A is correct because a Junos OS UTM antivirus profile lets you set the action taken when a virus is detected, such as block (drop), permit, or log-and-permit, configured via the 'then' action under the antivirus profile. Option B is correct because the antivirus profile is organized into protocol-specific sub-profiles for HTTP, FTP, SMTP, POP3, and IMAP, each of which can be individually enabled and tuned. Option C is correct because the antivirus profile includes a maximum content/file size setting (e.g., 'max-content-size') that limits how large a file will be scanned, after which it is passed or handled per policy. Option D is not part of antivirus tuning; URL rating server timeout belongs to the Web filtering (URL filtering) configuration, not the antivirus profile. Option E is also unrelated to antivirus; DNSBL blacklist server domain is configured under the antispam (E-mail filtering) UTM feature, not the antivirus profile.

Answer

URL rating server timeout threshold

Answer

DNSBL blacklist server domain