JNCIA-SEC Practice Test 16 — 15 Questions

Question 1

You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?

Accepted Answer

set applications application MY-HTTP protocol tcp destination-port 8080. Custom applications define protocol and destination port under [edit applications application].

Answer

set security zones application-override MY-HTTP port 8080

Answer

set firewall family inet filter MY-FILTER term 1 then port 8080

Answer

set security applications MY-HTTP tcp port 8080

Question 2

You are troubleshooting a scenario where an SRX Series device is performing Destination NAT. You notice that sessions are being created in the flow table, but the translation is failing because the packet hits a rule in a different rule-set. How does Junos OS evaluate multiple Destination NAT rule-sets?

Accepted Answer

Rule-sets are evaluated in the order they appear in the configuration; the first matching rule-set and rule are applied.. Junos OS evaluates destination NAT rule-sets in the order they appear in the configuration (top-down), and within a rule-set, rules are also evaluated top-down. The first rule-set whose match conditions are satisfied applies its translation, and subsequent rule-sets are not evaluated. This deterministic ordering is why rule placement matters — a broad rule placed earlier can shadow a more specific rule placed later.

Answer

All matching rule-sets are applied in parallel, which can cause translation conflicts.

Answer

Rule-sets are evaluated based on the most specific destination IP address match across all rule-sets simultaneously.

Answer

Destination NAT rule-sets are evaluated alphabetically by rule-set name.

Question 3

An administrator is configuring a Unified Threat Management (UTM) policy on a Juniper SRX Series device to protect internal users from downloading malicious software. Which UTM feature should the administrator enable and configure to scan HTTP and FTP traffic for viruses?

Accepted Answer

Antivirus. The antivirus (AV) feature in Juniper UTM is responsible for scanning traffic protocols such HTTP, FTP, SMTP, and POP3 for malicious payloads. Web filtering specifically controls access to URL categories, antispam processes email, and content filtering blocks files based on MIME types or extensions.

Answer

Content filtering

Answer

Antispam

Answer

Web filtering

Question 4

What is the purpose of the 'commit confirmed' command in Junos OS on an SRX Series device?

Accepted Answer

It tests the configuration and applies it temporarily, automatically reverting if not confirmed within a timeout period.. 'commit confirmed' automatically rolls back the configuration if a confirmation command is not issued within a specified time limit, preventing lockout.

Answer

It permanently saves the configuration without any rollback capability.

Answer

It confirms that the hardware is operating correctly.

Answer

It sends an email confirmation of the commit to the admin.

Question 5

You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?

Accepted Answer

[edit security zones security-zone screen ]. SCREEN options are applied under the security zones hierarchy to protect interfaces assigned to that zone.

Answer

[edit security policies from-zone to-zone screen]

Answer

[edit interfaces screen ]

Answer

[edit security screen id spoofing]

Question 6

You are troubleshooting a connectivity issue where traffic between two custom zones is being blocked despite a policy permitting it. Upon reviewing the security policies using the CLI command 'show security policies', you notice that an earlier policy with broader match criteria is catching the traffic and applying a deny action. What security policy concept is causing this behavior?

Accepted Answer

Policy shadowing. Policy ordering is sequential in Junos. The first matching policy is applied, and broader policies placed higher in the list can shadow subsequent specific policies.

Answer

Stateful inspection timeout

Answer

Reverse path forwarding mismatch

Answer

Zone segregation failure

Question 7

How can an administrator check the active Junos OS version running on an SRX Series device?

Accepted Answer

show version. The show version command displays the active software version and hardware model details.

Answer

show system software-status

Answer

show chassis version

Answer

show system package installed

Question 8

An engineer is troubleshooting a potential Denial of Service (DoS) attack. They want to check if screen options have dropped any packets on a specific security zone. Which command should be used?

Accepted Answer

show security screen statistics zone . The command 'show security screen statistics zone ' displays screen option drop counters for a specific security zone, allowing the engineer to see exactly which screen checks (SYN flood, ICMP flood, etc.) have dropped packets in that zone. This is the precise command for troubleshooting screen-related drops on a per-zone basis.

Answer

show security attack statistics

Answer

show firewall log

Answer

show security flow screen-drops

Question 9

An administrator sets up a virtual router routing instance on an SRX Series device to isolate customer traffic. How do security policies interact with traffic passing between different routing instances or security zones within virtual routers?

Accepted Answer

Security policies continue to be enforced based on security zone membership, and inter-zone traffic requires explicit policy rules regardless of virtual router boundaries.. Security policies on SRX devices are bound to security zones, and zones can span virtual routers or be assigned per routing instance depending on configuration, requiring explicit inter-zone policies.

Answer

Security policies automatically permit all traffic between virtual routers.

Answer

Virtual routers replace security zones entirely.

Answer

Security policies are bypassed when virtual routers are used.

Question 10

An administrator is deploying an SRX Series firewall at a branch office. The security policy must inspect SMTP traffic for spam and also scan HTTP downloads for viruses. The administrator needs to create a UTM policy that applies both antispam and antivirus profiles. Which statement is correct about the UTM policy configuration?

Accepted Answer

A single UTM policy can reference multiple UTM profiles, and the policy is then applied to a security policy.. A UTM policy acts as a container for multiple UTM profiles, such as antivirus, antispam, and web filtering. It is then referenced in a security policy to apply those profiles to matching traffic. This design allows a single security policy to perform multiple inspection tasks without needing separate rules for each profile. The administrator can create one UTM policy containing both antivirus and antispam profiles, then apply it to the relevant security policy.

Answer

UTM policies are applied globally and cannot be referenced in individual security policies.

Answer

Each UTM profile must be applied directly to a security policy; UTM policies are only used for logging.

Answer

Only one UTM profile can be active per UTM policy, so the administrator must choose between antivirus and antispam.

Question 11

An administrator implements AppID within the unified security policy framework on an SRX Series device to identify and control specific cloud-based applications. The initial policy uses a broad match for 'junos-ssl' at the transport layer, while a subsequent policy specifies 'junos-facebook' using AppID. How does the SRX policy engine evaluate and re-evaluate traffic when application identification takes multiple packets to determine?

Accepted Answer

The SRX evaluates the initial packets against transport-layer criteria, and once AppID identifies the specific application, it re-evaluates the session against application-specific policies.. When AppID is used, the SRX first evaluates initial packets against transport-layer criteria (e.g., junos-ssl), and once enough packets are inspected to identify the specific application (e.g., junos-facebook), it re-evaluates the session against application-specific policies. This allows a broad transport rule to permit the initial handshake while a more specific AppID rule can then apply. The session is not terminated just because AppID is not immediate.

Answer

The session is terminated immediately upon initial packet inspection because the AppID cannot be determined instantly.

Answer

AppID policies are evaluated before any transport layer policies, regardless of rule ordering.

Answer

Application identification only occurs for the return traffic stream.

Question 12

What happens to return traffic for an established session that was originally permitted by a security policy?

Accepted Answer

Return traffic is automatically permitted by the stateful inspection engine without requiring a reverse security policy.. Junos is a stateful firewall; return traffic belonging to an established session is automatically permitted without needing a separate return policy.

Answer

Return traffic is dropped unless stateless firewall filters permit it.

Answer

Return traffic is evaluated against global policies only.

Answer

A separate security policy allowing traffic from the destination zone back to the source zone must be explicitly configured.

Question 13

An administrator configures security policies using logical systems (LSYS) on an enterprise SRX Series device. What is the primary benefit of deploying logical systems on an SRX gateway?

Accepted Answer

Logical systems partition a single physical SRX device into multiple virtual firewall instances with independent administrative domains, routing tables, and policies.. Logical systems (LSYS) on an SRX Series device partition a single physical firewall into multiple independent virtual firewall instances. Each logical system has its own administrative domain, routing table, security policies, zones, and interfaces, allowing service providers or large enterprises to isolate tenants or departments on shared hardware. This provides multi-tenancy without deploying separate physical devices, reducing cost and management overhead.

Answer

Logical systems increase physical interface bandwidth by aggregating ports.

Answer

Logical systems accelerate IPsec encryption throughput.

Answer

Logical systems replace the need for high-availability clustering.

Question 14

An administrator configures Content Filtering to block all .exe files, but users report that they can still download .exe files over encrypted HTTPS connections. What is the most likely reason for this?

Accepted Answer

HTTPS decryption (SSL proxy) is not configured, so the firewall cannot inspect the encrypted payload for file extensions.. Content filtering on Juniper SRX devices inspects traffic at the application layer, but for HTTPS traffic, the payload is encrypted. Without SSL proxy (HTTPS decryption) configured, the firewall cannot see the file extension inside the encrypted stream, so it cannot block .exe files. Thus, the most likely reason is that HTTPS decryption is not configured.

Answer

Content filtering only supports FTP traffic.

Answer

The content filtering license has expired.

Answer

The SRX control plane lacks memory.

Question 15

You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?

Accepted Answer

snmp. SNMP is a system service in Junos host-inbound-traffic configuration.

Answer

management-service snmp

Answer

protocols snmp-server

Answer

routing-protocols snmp