JNCIA-SEC Practice Test 14 — 15 Questions

Question 1

An administrator is troubleshooting a packet drop issue on an SRX Series device. Which THREE operational commands can help identify where or why packets are being dropped? (Choose three)

Accepted Answer

show interfaces extensive (checking drop/error counters). Option A, 'show interfaces extensive', is correct because it displays detailed per-interface statistics including input/output errors, drops, and queue counters, which directly reveal physical or interface-level packet drops on the SRX. Option B, 'show security flow traceoptions', is correct because when flow traceoptions are enabled, this command shows the captured debug output that traces a packet's path through the flow module and identifies exactly where the flow processing drops it. Option C, 'show security flow session', is correct because it displays session state and per-session packet/byte counters, letting the administrator see whether sessions are being created, denied, or dropped and correlate drops with session handling. Option D, 'show bios motherboard temperature', is not relevant because it only reports hardware thermal readings and does not identify packet drops. Option E, 'show power supply redundancy', is not relevant because it only reports power supply status and redundancy, which has nothing to do with packet drop troubleshooting.

Answer

show bios motherboard temperature

Answer

show power supply redundancy

Question 2

What is the primary function of Junos security 'Screens' on an SRX Series gateway?

Accepted Answer

Protecting the network against network layer attacks and protocol anomalies (DoS/DDoS mitigation). Screen options provide comprehensive protection against network attacks, such as SYN floods, IP spoofing, and ICMP floods.

Answer

Managing graphical user interface web access

Answer

Encrypting VPN tunnels

Answer

Translating private IP addresses to public IP addresses

Question 3

You are configuring a branch SRX Series device and need to verify the current zone assignments for all interfaces. Which operational command displays interfaces along with their associated security zones?

Accepted Answer

show security zones. The command 'show security zones' displays security zones and their assigned interfaces.

Answer

show zones interface-mapping

Answer

show interfaces security-zone

Answer

show firewall zones

Question 4

An administrator needs to configure a redundant interface on an SRX Series device to combine two physical interfaces into a single logical interface for high availability and link resiliency. Which interface type should be configured?

Accepted Answer

ae. In Junos OS, aggregated Ethernet interfaces are designated with the prefix 'ae' (e.g., ae0, ae1), allowing multiple physical ports to be bundled together.

Answer

fxp0

Answer

reth

Answer

lo0

Question 5

You are troubleshooting a high CPU condition on the Routing Engine and suspect that intensive logging might be the cause. Where would you check the configuration for security log rates or stream settings?

Accepted Answer

[edit security log]. Security log rates and stream settings are configured under the [edit security log] hierarchy. This includes parameters such as the maximum number of logs per second, the log mode (stream, event, etc.), and the format. The [edit system syslog] hierarchy handles system-wide syslog configuration, not security-specific log rates. The other options are either invalid or unrelated to security log rate limiting.

Answer

[edit system syslog]

Answer

[edit chassis forwarding-options log]

Answer

[edit security policies log]

Question 6

You need to perform packet capture on an SRX Series device to analyze suspicious traffic hitting an interface. Which built-in Junos utility should you use?

Accepted Answer

monitor traffic interface ge-0/0/0. The 'monitor traffic interface ge-0/0/0' command is the built-in Junos utility for capturing packets on a specific interface. It is essentially a wrapper around tcpdump that runs in the CLI operational mode, displaying packet headers (and optionally full payloads with 'detail' or 'extensive') in real time. It requires no shell access and is the standard first-line packet capture tool on SRX.

Answer

show security packet-capture interface

Answer

request diagnostic capture start

Answer

start shell tcpdump -i ge-0/0/0

Question 7

An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?

Accepted Answer

show security flow session. The command 'show security flow session' displays active flow sessions on the SRX, including source and destination addresses, ports, and NAT translations. It is the primary operational command to verify whether source NAT is being applied and to inspect session state. Administrators use it to confirm that a session exists and that the translated address/port is correct.

Answer

show security nat translation summary

Answer

show system nat active-translations

Answer

show route forwarding-table destination nat

Question 8

Which Junos configuration statement defines a static NAT rule mapping the public IP 203.0.113.5 to the internal private IP 192.168.1.5?

Accepted Answer

set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.5/32 then static-nat prefix 192.168.1.5/32. The correct Junos syntax for static NAT is 'set security nat static rule-set rule match destination-address /32 then static-nat prefix /32'. This maps the public IP 203.0.113.5 to the internal 192.168.1.5 using the static NAT rule-set structure, which is the only valid syntax among the options.

Answer

set security nat static pool p1 public 203.0.113.5 private 192.168.1.5

Answer

set security nat destination rule-set rs1 rule r1 match source-address 203.0.113.5 then static-nat 192.168.1.5

Answer

set security nat source static-map public 203.0.113.5 internal 192.168.1.5

Question 9

Which TWO elements are required within a Junos Destination NAT rule definition? (Choose two)

Accepted Answer

Then destination-nat pool statement. In a Junos Destination NAT rule, the match destination-address statement (option E) is required because it identifies which original destination IP address (or prefix) the rule applies to, and without a match condition the rule cannot select traffic for translation. The then destination-nat pool statement (option C) is also required because it specifies the pool of translated destination addresses that the matched traffic will be rewritten to, completing the NAT action. Options A, B, and D are not required elements of a Destination NAT rule: a global routing instance override is an optional routing-instance setting, an interface MTU command is unrelated to NAT rule definition, and a source NAT pool binding belongs to Source NAT configuration rather than Destination NAT.

Answer

Global routing instance override

Answer

Interface MTU command

Answer

Source NAT pool binding

Question 10

An administrator configures Source NAT with a pool. Users can access external websites, but traceroute packets originating from internal hosts towards external destinations fail to display intermediate router hops. What is the most common reason traceroute fails through certain Junos Source NAT / PAT implementations?

Accepted Answer

ICMP Time Exceeded error packets returning from routers do not always map back to the PAT session state or are blocked by security policies.. Traceroute relies on ICMP Time Exceeded messages generated by intermediate routers when TTL expires. With PAT, the returning ICMP error must be mapped back to the original session; if the SRX cannot correlate the ICMP payload to an existing PAT session, or if security policy blocks the ICMP error, the traceroute output shows no intermediate hops. This is the most common reason traceroute fails through PAT.

Answer

Proxy ARP intercepts ICMP TTL expiry messages on the egress interface.

Answer

Source NAT pools inherently disable ICMP protocol support globally.

Answer

Traceroute packets require Static NAT to function across security firewalls.

Question 11

Which command allows an administrator to view system log files directly from the Junos CLI?

Accepted Answer

show log messages. The 'show log messages' command is the standard Junos CLI operational command for viewing the contents of the system log file (typically /var/log/messages). Junos stores logs in /var/log/ and the 'show log <filename>' syntax reads them directly without needing shell access. 'show log messages' specifically displays the main system log containing general system events, security events, and daemon messages.

Answer

view log file

Answer

read log system

Answer

display system log

Question 12

An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?

Accepted Answer

set security nat destination pool web-pool address 192.168.1.100 port 8443. Destination NAT pools in Junos are defined under the [security nat destination] hierarchy, where the pool name and its translated address/port are configured. The correct command 'set security nat destination pool web-pool address 192.168.1.100 port 8443' creates the pool that the destination NAT rule will reference in its 'then destination-nat pool' action. This is the pool definition step, distinct from the rule-set/rule that performs the actual matching and translation binding.

Answer

set security nat destination rule-set rs1 rule r1 then translation pool web-pool

Answer

set security nat source pool web-pool address 192.168.1.100 port 8443

Answer

set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool

Question 13

An administrator configures Source NAT for an internal subnet. After committing the changes, users report that they can access external websites via IP addresses, but domain name resolution (DNS) is failing. Investigation shows DNS UDP port 53 traffic is being blocked or failing NAT translation. What is the most likely reason?

Accepted Answer

Security policies do not permit UDP port 53 (DNS) traffic between the source and destination zones.. The most likely reason DNS is failing while IP-based access works is that the security policy does not permit UDP port 53 traffic between the relevant zones. Source NAT translates addresses but does not bypass security policy evaluation; if the policy does not allow DNS, the traffic is dropped. This is a common oversight when configuring NAT without corresponding security policies.

Answer

Source NAT automatically disables DNS Application Layer Gateways (ALGs), causing DNS packets to be dropped.

Answer

Source NAT pools strip UDP port headers, preventing DNS responses from matching.

Answer

DNS traffic requires Static NAT and cannot traverse Source NAT pools.

Question 14

You are configuring physical interfaces on an SRX Series gateway. Which command structure is used to assign an interface to a specific security zone in Junos?

Accepted Answer

set security zones security-zone interfaces . In Junos, security zones are configured under the [security zones] hierarchy. The correct syntax is 'set security zones security-zone interfaces ', which binds a physical or logical interface to a named zone. This is the standard Junos CLI structure used on SRX devices for zone assignment.

Answer

set firewall zone-mapping interface zone

Answer

set interfaces security-zone

Answer

set routing-options zones interface

Question 15

An administrator configures a security zone and enables the 'udp-flood' SCREEN option with a specified threshold. How does Junos measure UDP flood attacks for this option?

Accepted Answer

By measuring the rate of incoming UDP packets per second destined for the zone.. The UDP flood SCREEN option monitors the rate of incoming UDP packets per second destined for the zone and triggers when the rate exceeds the configured threshold.

Answer

By inspecting UDP payloads for malformed signatures.

Answer

By counting the total number of active UDP sessions from all sources combined.

Answer

By tracking the duration of UDP flows and flagging long-lived streams.