JNCIA-SEC Practice Test 17 — 15 Questions

Question 1

A network engineer is troubleshooting traffic drop issues on an SRX Series device. The transit traffic passes through the device, but sessions are not being created. Where in the SRX packet processing architecture does the security check (policy evaluation, screen checking, and zone verification) occur?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Flow processing engine after the initial route lookup and packet reassembly phases.. On SRX Series gateways, the security check occurs in the Flow processing engine (SPU/PFE level for transit traffic) after the packet passes through the transit-based processing stages and initial route lookup.

Answer

In the Routing Engine (RE) during the initial TCP three-way handshake before session creation.

Answer

In the system memory cache prior to interface ingress classification.

Answer

In the Junos kernel control plane daemon (rpd) prior to hardware forwarding.

Question 2

An administrator is reviewing the packet flow logic on an SRX and wants to understand how unicast Reverse Path Forwarding (uRPF) check is performed. At what point in the packet flow is the uRPF check executed?

Accepted Answer

During the early stage of packet processing, immediately following interface checks and prior to session lookup. uRPF checks the source IP address of an incoming packet against the routing table to verify that the return path matches the ingress interface, occurring early in the flow pipeline after interface checks.

Answer

Only when a session timeout occurs

Answer

After the security policy has completely finished processing

Answer

Inside the NAT translation module

Question 3

Which TWO commands can be used to view IDP configuration status and threat detection statistics? (Choose two)

Accepted Answer

show security idp status. Option A, `show security idp status`, is correct because on Juniper SRX devices this operational command displays the IDP configuration/operational status, including whether IDP is enabled and the policy/rule set state. Option B, `show security idp statistics`, is correct because it reports IDP threat detection statistics such as attack counters and protocol anomaly counts. The remaining options are not valid Junos operational commands for this purpose: `show firewall idp-counters`, `show security flow idp-status`, and `show system idp-status` do not exist in the IDP CLI hierarchy and therefore cannot display IDP configuration status or threat statistics.

Answer

show firewall idp-counters

Answer

show security flow idp-status

Answer

show system idp-status

Question 4

Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?

Accepted Answer

junos-host. The Junos 'junos-host' functional zone handles traffic destined for or originated by the routing engine.

Answer

junos-global

Answer

junos-mgmt

Answer

junos-internal

Question 5

You need to modify the default session timeout for a specific custom application in Junos OS. Where is application timeout configured?

Accepted Answer

[edit applications application inactivity-timeout ]. Application timeouts can be configured under the applications hierarchy or custom application definition by specifying inactivity timeout values.

Answer

[edit security policies timeout application]

Answer

[edit security zones security-zone timeout application]

Answer

[edit security flow timeout application <app-name>]

Question 6

An engineer is troubleshooting a potential Denial of Service (DoS) attack. Where can they check real-time attack log entries generated by security screens?

Accepted Answer

The security log file or system log configured for screen events. Security screen (DoS protection) events are logged to the configured system log or security log file, so checking that log is where real-time attack entries appear. Screens such as SYN flood, ICMP flood, and session-limit screens generate log messages that administrators can review to confirm an active DoS condition.

Answer

The routing protocol trace file

Answer

The kernel crash dump directory

Answer

The chassis hardware alarm log

Question 7

An administrator notices that Antivirus scanning is causing high latency for VoIP and real-time streaming traffic passing through the SRX firewall. How should the administrator resolve this issue while maintaining security for web traffic?

Accepted Answer

Remove the UTM policy profile attachment from the security policy specifically handling real-time VoIP traffic.. To prevent latency-sensitive traffic (like VoIP) from being impacted by UTM, the security policy matching VoIP traffic should omit the UTM policy profile attachment.

Answer

Convert the antivirus profile from stream mode to batch mode.

Answer

Disable stateful inspection globally across the device.

Answer

Configure a higher priority routing metric for VoIP packets.

Question 8

You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?

Accepted Answer

SIP Application Layer Gateway (ALG). SIP uses dynamic ports for RTP streams, requiring the SIP ALG to be active and operational.

Answer

SCREEN options with UDP flood protection

Answer

Global address book entry for RTP ports

Answer

TCP proxy enabled on the security zone

Question 9

Which Junos command displays the operational status of all SCREEN options and their associated counters across security zones?

Accepted Answer

show security screen statistics. The 'show security screen statistics' command shows hit and drop counters for SCREEN options.

Answer

show firewall screen-counters

Answer

show security zones screen-status

Answer

show system screen attack-log

Question 10

You need to verify the resource utilization of the Routing Engine on an SRX Series gateway, specifically checking CPU load averages and memory usage. Which command should you execute?

Accepted Answer

show chassis routing-engine. The 'show chassis routing-engine' command is the standard Junos operational command that displays Routing Engine status, including CPU load averages (1/5/15 minute), memory utilization (DRAM and installed/available), temperature, uptime, and mastership state. On SRX Series gateways, the Routing Engine handles control-plane functions, so this command is the correct way to verify its resource utilization.

Answer

show spc cpu-utilization

Answer

show security flow status

Answer

show memory summary

Question 11

An administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?

Accepted Answer

show security flow session destination-port 443. The correct command is 'show security flow session destination-port 443', which filters the active session table by destination port 443. This command is part of the SRX flow session operational toolkit and directly answers the requirement to view sessions matching a specific destination port.

Answer

show security policy match-port 443

Answer

show route protocol bgp port 443

Answer

show firewall filter port 443

Question 12

Which TWO commands are used to troubleshoot IPsec VPN tunnels on an SRX Series device? (Choose two)

Accepted Answer

show security ike security-associations. Option C, 'show security ike security-associations', is correct because it displays the status of IKE Phase 1 security associations (main/aggressive mode negotiations, peer addresses, and SA states) that must be established before an IPsec tunnel can come up. Option E, 'show security ipsec security-associations', is correct because it shows the Phase 2 IPsec SAs, including the SPI values, tunnel index, and encryption/authentication parameters used to verify that the data tunnel is actually active. Option A, 'show chassis cluster status', only reports chassis cluster failover and redundancy states, which is unrelated to IPsec tunnel troubleshooting. Option B, 'show firewall filter counters', displays packet counts for stateless firewall filters and does not reveal IKE or IPsec SA information. Option D, 'show interface bgp summary', reports BGP neighbor and routing session status, which is a routing protocol check rather than an IPsec VPN diagnostic.

Answer

show chassis cluster status

Answer

show firewall filter counters

Answer

show interface bgp summary

Question 13

Which command allows an administrator to view configured security policies on an SRX Series device?

Accepted Answer

show security policies. The 'show security policies' command is the standard Junos operational command that lists all configured security policies on an SRX, including zone context, source/destination addresses, applications, and actions. It is the direct way to view the policy set applied to traffic traversing the device.

Answer

show firewall policies

Answer

show policy security

Answer

show security flow policies

Question 14

You need to log every time a specific security policy is hit by traffic, including when a session is closed. Which action modifier should you configure within the security policy?

Accepted Answer

Configure 'then { permit; log { session-init; session-close; } }'.. The 'log' option in a security policy can include session-init and session-close logging.

Answer

Configure 'then { permit; syslog source-address; }'.

Answer

Configure 'then { permit; alarm; }'.

Answer

Configure 'then { permit; count; }'.

Question 15

Which command allows an administrator to view real-time interface throughput and error statistics on an SRX Series firewall?

Accepted Answer

show interfaces statistics. The command 'show interfaces statistics' displays real-time interface throughput, packet counts, error counters, and other per-interface statistics on an SRX Series firewall. It is the standard operational command for viewing interface-level performance and error data.

Answer

show system interface status

Answer

show chassis hardware

Answer

show security flow statistics