JNCIA-SEC Practice Test 13 — 15 Questions

Question 1

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

Accepted Answer

ALGs interact with the security flow module to create temporary session table entries for data connections.. Option A is correct because Junos ALGs work with the security flow module to open temporary pinholes in the session table for the dynamically negotiated data connections, such as FTP data channels or SIP media streams, so return traffic is permitted without a separate policy. Option E is correct because ALGs parse the control channel packets (for example, FTP PORT/PASV commands or SIP/SDP INVITE messages) to learn the IP addresses and ports that will be used for the subsequent data sessions, then track those sessions. Option B is wrong because ALGs are software processes in the Junos flow daemon, not dedicated encryption ASICs. Option C is wrong because ALGs supplement, not replace, security policies; policies still govern whether the control and data traffic is allowed. Option D is wrong because ALGs are built into Junos OS for supported protocols and are not compiled from source per application.

Answer

ALGs are hardware-accelerated ASICs dedicated exclusively to packet encryption.

Answer

ALGs replace security policies entirely for all complex application traffic.

Answer

ALGs must be manually compiled from source code for each custom application.

Question 2

An administrator wants to monitor security screening checks such as SYN flood protection counters. Which operational command should be used?

Accepted Answer

show security screen statistics. The correct command to monitor security screening checks such as SYN flood protection counters is 'show security screen statistics', which displays per-zone screen option counters including SYN flood, ICMP flood, UDP flood, and other screen attack statistics. This command directly surfaces the screening check counters the administrator needs.

Answer

show system screening-counters

Answer

show security attack-mitigation status

Answer

show security flow flood-protection

Question 3

An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?

Accepted Answer

Junos resolves the FQDN to IP addresses dynamically and updates the policy match criteria accordingly.. Junos OS supports DNS-based address objects (fqdn) where the SRX periodically resolves the domain name to IP addresses and updates the security policy match table dynamically.

Answer

Junos rejects DNS names in address books because security policies require static IP subnets.

Answer

DNS names are only resolved once when the device boots up or when the configuration is committed.

Answer

DNS-based address objects require AppSecure licenses to function.

Question 4

Which keyword is used in a Junos source NAT rule to specify that traffic should be translated to the IP address of the egress interface?

Accepted Answer

interface. In a Junos source NAT rule, the 'interface' keyword tells the SRX to translate the source address to the IP address of the egress interface. This is configured under 'then source-nat interface' within the rule. It is the standard way to perform interface-based PAT without defining an address pool.

Answer

address-pool

Answer

egress-ip

Answer

self

Question 5

What is the default action taken by Junos OS when traffic does not match any configured security policy between two zones?

Accepted Answer

The traffic is silently dropped.. By default, Junos OS denies all traffic that does not match any configured security policy between two zones. This default-deny behavior is a fundamental security principle: if no policy explicitly permits the traffic, it is dropped. The drop is silent, meaning no reject message is sent back to the source, which helps prevent information leakage.

Answer

The traffic is redirected to the default gateway routing instance.

Answer

The traffic is queued for administrative review.

Answer

The traffic is permitted and an alert is logged.

Question 6

While debugging NAT, you notice that session creation fails due to port block allocation failure. Which command helps inspect dynamic IP and port (DIPP) NAT usage?

Accepted Answer

show security nat source pool detail. The command 'show security nat source pool detail' displays detailed information about source NAT pools, including the number of allocated port blocks and usage statistics. This directly helps inspect DIPP (Dynamic IP and Port) NAT usage and diagnose port block allocation failures.

Answer

show route forwarding-table dipp

Answer

show security flow dipp-status

Answer

show security translation port-blocks

Question 7

What is the primary difference between a zone-based security policy and a global security policy in Junos OS?

Accepted Answer

Global policies apply across all security zones without requiring explicit source and destination zone pairs in the rule.. Global security policies in Junos OS are applied across all zones and do not require the administrator to specify source-zone and destination-zone pairs, unlike zone-based policies which are bound to a specific zone context (from-zone X to-zone Y). This makes global policies useful for rules that must apply universally, such as blanket deny rules or logging policies. Zone-based policies, by contrast, are evaluated within the context of a specific inter-zone traffic flow.

Answer

Global policies bypass stateful inspection, whereas zone-based policies enforce it.

Answer

Zone-based policies are evaluated after global policies.

Answer

Global policies can only be used for IPv6 traffic, while zone-based policies handle IPv4.

Question 8

You need to configure a security policy that inspects traffic for computer viruses and malware as part of the unified security policy framework. Which security feature must be referenced within the policy action?

Accepted Answer

A UTM anti-virus profile.. Within the Junos unified security policy framework, UTM (Unified Threat Management) features such as anti-virus, anti-spam, content filtering, and web filtering are invoked by referencing a UTM profile in the policy's then action. To inspect traffic for viruses and malware, the policy must reference a UTM anti-virus profile, which defines the scan engine, fallback behavior, and notification options. Without this profile binding, the policy simply permits or denies traffic without deep inspection.

Answer

A Junos screen profile.

Answer

An IPsec VPN gateway proposal.

Answer

A stateless firewall filter action.

Question 9

What is the default action of Junos OS when an administrator exits configuration mode without committing changes?

Accepted Answer

The candidate configuration changes are discarded.. In Junos OS, configuration changes are made to a candidate configuration and only become active when committed. If an administrator exits configuration mode without running 'commit,' the candidate configuration changes are discarded, and the device reverts to the last committed configuration.

Answer

The changes are saved to a temporary backup file only.

Answer

The changes are automatically saved and committed.

Answer

The device reboots to clear the memory.

Question 10

You are configuring a security policy that needs to match multiple specific applications (HTTP, HTTPS, and SSH) within a single rule. How should you specify these applications in the Junos CLI?

Accepted Answer

set security policies from-zone trust to-zone untrust policy p1 match application [ junos-http junos-https junos-ssh ]. In Junos CLI, when matching multiple applications within a single security policy, you must enclose the list of applications in square brackets [ ], which is the standard Junos syntax for specifying a set of values. The correct command uses 'application [ junos-http junos-https junos-ssh ]' to match any of the three applications. This tells the policy to accept traffic if it matches any application in the list.

Answer

set security policies from-zone trust to-zone untrust policy p1 match application junos-http, junos-https, junos-ssh

Answer

set security policies from-zone trust to-zone untrust policy p1 match application-group junos-all-services

Answer

set security policies from-zone trust to-zone untrust policy p1 match application multiple junos-http+junos-https

Question 11

An administrator is analyzing the active session table using the 'show security flow session' command to diagnose asymmetric routing. Which TWO pieces of information are displayed in the session table output that help identify this issue? (Choose two)

Accepted Answer

Packet and byte counters incrementing for both the client-to-server and server-to-client directions.. Option B is correct because the session table shows separate packet and byte counters for each direction (client-to-server and server-to-client); in asymmetric routing, one direction's counters may increment while the other's do not, or the reverse path may be missing entirely, revealing that return traffic is taking a different path. Option D is correct because the session output lists the incoming and outgoing interfaces (and zones) for both the forward and reverse flows, so if the ingress/egress interfaces for the two directions differ from what symmetric routing would dictate, the administrator can pinpoint the asymmetry. Option A is not part of the session table output—CPU core/SPU assignment is not displayed as a field for identifying asymmetric routing. Option C is wrong because BGP path attributes are not shown in 'show security flow session' output; they would be viewed via routing table or BGP commands. Option E is also incorrect because administrative distance is a routing-table attribute, not a field in the session table.

Answer

The exact CPU core processing the session flow.

Answer

The complete BGP path attribute list for the session route.

Answer

The administrative distance of the route used to establish the session.

Question 12

While reviewing security flow traceoptions output, you see a packet dropped with the reason "Session table full". What is the immediate consequence of this event on incoming new traffic?

Accepted Answer

New traffic attempting to create a session is dropped until session table space becomes available.. When the security session table reaches its maximum capacity, new session creation requests are dropped until sessions expire or are cleared.

Answer

The SRX automatically reboots to clear memory.

Answer

Existing established sessions are immediately terminated to make room for new traffic.

Answer

Traffic is switched to stateless forwarding mode bypassing the security engine.

Question 13

Which THREE parameters can be configured within a custom application definition in Junos OS? (Choose three)

Accepted Answer

IP protocol (e.g., tcp, udp). In a Junos OS custom application definition (set applications application ...), the configurable match parameters include the IP protocol via 'protocol tcp|udp|icmp|...' (option C), the destination port via 'destination-port ' (option D), and the source port via 'source-port ' (option E); these three fields define the traffic signature the application matches. Option A is incorrect because SCREEN profiles are applied at the zone level (set security zones security-zone screen ), not inside an application definition. Option B is incorrect because security zone binding is a zone/interface configuration, not a parameter of an application object.

Answer

SCREEN option profile assignment

Answer

Security zone binding

Question 14

Which THREE operational commands are valid for troubleshooting NAT and flow sessions on a Junos OS SRX Series device? (Choose three)

Accepted Answer

show security nat pool. Option A, 'show security nat pool', is correct because it displays configured NAT pools on an SRX, including pool name, address ranges, port ranges, and utilization statistics, which is essential for verifying that source or destination NAT pools are correctly defined and not exhausted. Option B, 'show security flow session', is correct because it lists active flow sessions with their NAT translations (source/destination addresses and ports before and after translation), letting you confirm that traffic is being matched and translated as expected. Option E, 'show security nat rule-set', is correct because it shows the configured NAT rule sets, their rules, and match conditions, which is necessary to verify that the intended NAT rules exist and are ordered correctly. Option C, 'show system nat-cache status', is not a valid Junos OS command on SRX, as there is no such nat-cache status operational command. Option D, 'show firewall nat-counters', is also not a valid Junos OS SRX command; NAT-related counters are viewed through other commands such as 'show security nat source summary' or 'show security flow session', not a 'show firewall nat-counters' command.

Answer

show system nat-cache status

Answer

show firewall nat-counters

Question 15

Which Junos configuration block is required to define a static NAT rule set mapping external IP addresses to internal servers?

Accepted Answer

set security nat static rule-set from zone . Static NAT on Junos SRX is configured under the [edit security nat static] hierarchy, and each rule-set must be bound to a zone using the 'from zone ' statement. The correct syntax is 'set security nat static rule-set from zone ', which defines the rule-set and its source zone context. This is the required starting block before adding rule definitions and host mappings.

Answer

set security policies from-zone to-zone static-nat

Answer

set security nat destination rule-set from zone

Answer

set security nat source rule-set from zone