JNCIA-SEC Practice Test 15 — 15 Questions

Question 1

An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The configuration fails to commit because the address set contains a reference to a non-existent address object.. If an address object referenced within an address set is deleted from the address book, Junos retains the reference in the candidate configuration but will fail validation upon commit if dangling references are left unresolved, depending on the object type. Actually, Junos generates a commit error if an address set references a non-existent address object.

Answer

The address set automatically deletes the reference and commits successfully.

Answer

The SRX device ignores the missing address object and continues operating with the remaining two addresses.

Answer

The entire address book is automatically purged by the parser.

Question 2

An auditor points out that a security policy configured on your SRX device is completely shadowed by an earlier policy in the same zone pair. What does policy shadowing mean in this context?

Accepted Answer

A preceding policy has broader or identical match criteria that catches all traffic intended for the subsequent policy.. Policy shadowing occurs when a preceding policy completely encompasses the match criteria of a subsequent policy, rendering the later policy unreachable.

Answer

The shadowed policy is missing a valid source zone definition.

Answer

The routing engine has cached an old version of the policy table.

Answer

The shadowed policy is using global scope instead of zone-based scope.

Question 3

You are troubleshooting an issue where an application timeout occurs intermittently. You suspect that session timeouts might be too short for this specific application. Where can you adjust TCP session timeout values globally on an SRX Series device?

Accepted Answer

[edit security flow timeout]. The correct location to adjust TCP session timeout values globally on an SRX Series device is under the [edit security flow timeout] hierarchy. This configuration stanza allows you to set global timeouts for various session types, including TCP, UDP, ICMP, and others. By modifying the TCP timeout value here, you affect all sessions that do not have a more specific timeout defined elsewhere, such as in an application definition. This is the standard method for tuning session timeouts to prevent premature termination of long-lived or idle applications.

Answer

[edit security policies timeout]

Answer

[edit applications session-timeout]

Answer

[edit system services timeout]

Question 4

What is the primary function of the Junos Express Antivirus engine on SRX Series firewalls?

Accepted Answer

To detect and block malware within network traffic streams.. The Junos Express Antivirus engine on SRX Series firewalls is designed to detect and block malware within network traffic streams. It inspects files and content passing through the firewall, using signatures and heuristics to identify malicious code, and can block or quarantine infected files in real time.

Answer

To inspect Layer 7 application handshakes for AppID classification.

Answer

To filter out unsolicited bulk email messages over SMTP.

Answer

To categorize URLs into security and productivity groups.

Question 5

Which Junos CLI command displays the version and status of the Integrated Web Filtering engine?

Accepted Answer

show security utm web-filtering status. Operational commands starting with 'show security utm web-filtering' display status and version details.

Answer

show utm engine status web-filter

Answer

show security license web-filtering detail

Answer

show system software web-filter

Question 6

A network engineer is setting up a vSRX Virtual Firewall in a cloud environment. Which component acts as the control plane equivalent to a physical Routing Engine?

Accepted Answer

Virtual Routing Engine (vRE). In a vSRX deployment, the control plane functionality is handled by the virtual Routing Engine (vRE), running as a virtual machine instance.

Answer

Virtual Interface Card (VIC)

Answer

Virtual Forwarding Plane (vFP)

Answer

Virtual Security Processor (vSP)

Question 7

Which TWO logs or log categories can an administrator examine to troubleshoot security policy actions such as permits and denies? (Choose two)

Accepted Answer

RT_FLOW session initiation and close logs (RT_FLOW_SESSION_INIT / RT_FLOW_SESSION_CLOSE). Option C is correct because RT_FLOW session logs, specifically RT_FLOW_SESSION_INIT and RT_FLOW_SESSION_CLOSE, are generated by the flow module and record the security policy action (permit or deny) applied to each session along with source/destination details, making them the primary log category for troubleshooting policy permits and denies. Option D is correct because security policy traceoptions log files capture detailed policy evaluation events, including which policy matched and whether the action was permit or deny, and are specifically designed for in-depth security policy troubleshooting. Option A is incorrect because routing protocol daemon (rpd) logs pertain to routing protocol adjacencies, route updates, and next-hop resolution, not security policy enforcement. Option B is incorrect because chassis environmental logs report hardware conditions such as temperature, fan, and power supply status, which are unrelated to policy actions. Option E is incorrect because system kernel boot logs record kernel initialization and boot-time messages, not per-session security policy decisions.

Answer

Routing protocol daemon (rpd) logs

Answer

Chassis environmental logs

Answer

System kernel boot logs

Question 8

Which TWO statements are true regarding Junos OS address sets and their usage in security policies? (Choose two)

Accepted Answer

Address sets can be used in security policies anywhere individual address objects are accepted.. Address sets group multiple address objects and can be referenced in policies as source or destination match criteria.

Answer

Address sets require an AppSecure license to function in security policies.

Answer

Address sets automatically translate IPv4 addresses into IPv6 equivalents.

Answer

Address sets are restricted to destination matching only and cannot be used as source match criteria.

Question 9

Which Junos configuration command removes an existing Source NAT rule named 'rule1' from a rule-set named 'rs1'?

Accepted Answer

delete security nat source rule-set rs1 rule rule1. The correct Junos command to remove a configuration element is 'delete', followed by the full configuration path. To remove a Source NAT rule named 'rule1' from rule-set 'rs1', the path is 'security nat source rule-set rs1 rule rule1', so 'delete security nat source rule-set rs1 rule rule1' is correct. This removes the rule from the candidate configuration, which must then be committed.

Answer

deactivate security nat source rule-set rs1 rule rule1

Answer

clear security nat rule-set rs1 rule rule1

Answer

remove security nat source rule-set rs1 rule rule1

Question 10

An administrator has configured multiple rules within a single Source NAT rule-set. When traffic traverses the SRX device, how does Junos OS determine which specific rule within the rule-set is applied?

Accepted Answer

Rules are evaluated top-down; the first rule matching the packet's criteria is applied.. In Junos OS Source NAT rule-sets, rules are evaluated in the order they are configured, from top to bottom. The first rule whose match criteria (source address, destination address, etc.) are satisfied by the packet is applied, and no further rules are evaluated. This deterministic order allows administrators to prioritize specific translations.

Answer

Rules are evaluated based on specificity; the most specific match is always applied regardless of configuration order.

Answer

Rules are evaluated using hashing algorithms to distribute translation loads evenly across rules.

Answer

All matching rules are combined, and translations are applied concurrently.

Question 11

An administrator is deploying a new SRX Series Services Gateway in a branch office and needs to configure operational interfaces. Which command family should the administrator use to assign an IP address to a physical interface in Junos OS?

Accepted Answer

set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24. In Junos OS, logical unit numbers (such as unit 0) are required on interfaces to assign IP addresses. The configuration path is set under interfaces [interface-name] unit [number] family inet address [ip-address].

Answer

set security zones security-zone trust interface ge-0/0/0 address 192.168.1.1/24

Answer

set interface ge-0/0/0 ip-address 192.168.1.1 netmask 255.255.255.0

Answer

set system services interface ge-0/0/0 address 192.168.1.1/24

Question 12

You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?

Accepted Answer

Yes, you can configure 'set security zones security-zone trust host-inbound-traffic system-services all'.. Junos host-inbound-traffic allows specifying 'all' under system-services or protocols to permit everything, though it is discouraged for security reasons.

Answer

No, host-inbound traffic cannot allow wildcard services for security compliance reasons.

Answer

Yes, by using the 'any' keyword instead of 'all'.

Answer

No, every service must be explicitly listed individually.

Question 13

When reviewing security policies, you see the term 'junos-any' used in the application match field. What does this represent?

Accepted Answer

It matches all applications and protocols.. The term 'junos-any' in the application match field is a predefined application that matches all applications and protocols. It is essentially a wildcard that allows any IP traffic, regardless of protocol or port. This is useful when you want a policy to permit or deny all traffic without specifying individual applications.

Answer

It matches internal management traffic destined for the routing engine.

Answer

It matches only standard web traffic (HTTP and HTTPS).

Answer

It matches only encrypted IPsec sessions.

Question 14

Which Junos operational command allows an administrator to verify the configuration syntax and structure of all NAT rules before committing?

Accepted Answer

commit check. The 'commit check' command validates the candidate configuration for syntax errors, semantic errors, and structural issues without committing it. It checks all configuration hierarchies, including security NAT rules, and reports any errors. This is the standard Junos operational command to verify configuration before committing.

Answer

test security nat syntax

Answer

verify security nat configuration

Answer

check nat rules

Question 15

Which TWO features or settings are associated with troubleshooting or optimizing Port Address Translation (PAT) in Junos OS? (Choose two)

Accepted Answer

Persistent NAT configuration for port consistency. Option A is correct because Persistent NAT in Junos OS is a PAT-related feature that keeps the same NAT source port mapping for a given internal host, ensuring port consistency for applications that require stable translations. Option D is correct because the 'show security nat pool' operational command displays PAT pool statistics, including port utilization, which is essential for troubleshooting and optimizing PAT pool exhaustion. Option B is incorrect because static ARP entries are unrelated to PAT port translation and are not required per PAT port. Option C is incorrect because NAT timers are not tuned by modifying control plane CPU priority. Option E is incorrect because disabling flow-based forwarding globally would break normal Junos security processing and is not a PAT troubleshooting or optimization setting.

Answer

Configuring static ARP entries for every PAT port

Answer

Modifying control plane CPU priority for NAT timers

Answer

Disabling flow-based forwarding globally