JNCIA-SEC Practice Test 18 — 15 Questions

Question 1

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

Accepted Answer

It monitors and limits the aggregate rate of all ICMP packet types combined.. The 'icmp all' SCREEN option applies flood protection and threshold monitoring across all ICMP types collectively.

Answer

It blocks ICMP echo requests while allowing ICMP destination unreachable messages.

Answer

It inspects ICMP payloads for encapsulated malicious shellcode.

Answer

It drops all ICMP packets unconditionally without exception.

Question 2

Which hardware component on high-end SRX Series devices provides dedicated processing for security services such as firewall policies, IPsec VPNs, and NAT?

Accepted Answer

Security Processing Unit (SPU). High-end SRX Series devices utilize specialized hardware modules known as Security Processing Units (SPUs) to accelerate data plane security tasks.

Answer

Switch Control Board (SCB)

Answer

Modular Port Concentrator (MPC)

Answer

Routing Engine (RE)

Question 3

When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?

Accepted Answer

It matches TCP traffic destined to port 8080 with a source port falling within 1024-65535.. Custom applications define matching criteria based on IP protocol, source port, and destination port ranges.

Answer

It is automatically converted to a predefined junos-http application by the SRX device.

Answer

It requires inspection via an ALG because custom ports are used for HTTP traffic.

Answer

It matches any packet destined to port 8080 regardless of source port.

Question 4

You are troubleshooting a scenario where an SRX device is performing Static NAT for a web server. External users experience intermittent packet drops when loading large web pages. Flow traceoptions show TCP fragmentation issues and ICMP 'Fragmentation Needed' messages being dropped by the security device. Which feature should be checked or configured to resolve this Path MTU Discovery (PMTUD) issue?

Accepted Answer

Configure TCP MSS (Maximum Segment Size) adjustment on the security policies or zones to prevent packets from exceeding the path MTU.. Path MTU Discovery relies on ICMP 'Fragmentation Needed' messages to tell the sender to reduce packet size. If the SRX drops these ICMP messages or large TCP segments, PMTUD breaks and large web pages stall. Configuring TCP MSS adjustment (clamping) on the security policies or zones ensures TCP segments never exceed the path MTU, preventing fragmentation issues without relying on ICMP.

Answer

Disable the security ALG for TCP streams to allow raw fragmentation forwarding.

Answer

Configure a Destination NAT pool specifically for ICMP fragmentation packets.

Answer

Enable proxy-arp for all fragmented packet ranges on the static NAT interface.

Question 5

An engineer wants to view active security associations (SAs) for an IPsec VPN tunnel to troubleshoot connectivity. Which command should be used?

Accepted Answer

show security ipsec security-associations. 'show security ipsec security-associations' displays the active IPsec SAs for VPN tunnels, including SPI values, encryption/authentication algorithms, and byte counters. This is the correct command to verify Phase 2 SA state for troubleshooting tunnel connectivity.

Answer

show vpn status

Answer

show securityvpn tunnels

Answer

show security ike security-associations

Question 6

You are configuring an SRX firewall with Web Filtering and need to ensure that specific URLs are always permitted regardless of their cloud-assigned category. Where should you define these permitted URLs?

Accepted Answer

In a custom URL category assigned a permit action, referenced in the web-filtering profile.. Custom URL patterns and custom categories allow defining local override rules that take precedence over cloud ratings.

Answer

In the system-wide global bypass list under [edit system services web].

Answer

In the security policy source address book.

Answer

In the AppSecure custom application signature database.

Question 7

Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?

Accepted Answer

show security alg status. The 'show security alg status' command displays the operational status of all ALGs running on the Junos device.

Answer

show security flow status

Answer

show security zones functional-zone

Answer

show system applications

Question 8

An administrator configures Antispam with a DNSBL server. After committing the changes, logs show that no antispam queries are being performed. What is the most common reason for this when configuring DNSBL?

Accepted Answer

The system DNS name servers are not configured on the SRX device.. DNSBL (DNS-based block list) lookups require the SRX to resolve the DNSBL zone name (e.g., zen.spamhaus.org) via DNS. If no system name servers are configured under [edit system name-server], the SRX cannot perform the DNS query, so no antispam lookups are sent and the logs show zero queries. The DNSBL server itself is reachable only through DNS resolution, making system DNS configuration a hard prerequisite.

Answer

The antispam license must be activated using a hardware token.

Answer

The SRX security policy lacks an application ALG for SMTP.

Answer

The antispam profile must be attached to an interface rather than a UTM policy.

Question 9

You are troubleshooting a scenario where an SRX device is performing Static NAT. An internal server initiates outbound connections to the internet. When external recipients examine the packets, they see the correct static NAT public IP as the source. However, when the external recipients reply, the packets are dropped by the SRX. Traceoptions reveal 'No session found for packet'. What is the cause of this session lookup failure?

Accepted Answer

The return traffic security policy or session state lookup failed because the incoming return packet did not match the expected session parameters or was blocked by a policy.. The SRX drops return packets with 'No session found for packet' because the return traffic does not match an existing session. For Static NAT, the SRX creates a session when the internal host initiates outbound traffic, but the return packet must match the expected source/destination IP and port. If the return packet is blocked by a security policy or does not match the session parameters (e.g., due to asymmetric routing or policy misconfiguration), the SRX drops it. Option A correctly identifies that the return traffic security policy or session state lookup failed.

Answer

The routing table lacks a default route for static NAT reply packets.

Answer

Static NAT requires explicit source NAT pool definitions for all outbound connections.

Answer

Proxy ARP is not enabled for the internal server's private IP address.

Question 10

Which TWO components are typically analyzed when troubleshooting an IPsec VPN Phase 1 negotiation failure using traceoptions? (Choose two)

Accepted Answer

IKE proposal matching (encryption, authentication, Diffie-Hellman group). Phase 1 (IKE SA) negotiation failures are diagnosed by examining the IKE proposal exchange, so option B is correct: traceoptions output shows whether the initiator and responder agree on encryption algorithm, authentication method, and Diffie-Hellman group, and mismatches here cause the negotiation to fail. Option C is also correct because Phase 1 includes peer authentication, and traceoptions reveals whether the pre-shared key or digital certificate validation (e.g., certificate chain, identity, or hash mismatch) fails during the IKE exchange. Option A is wrong because BGP AS path attributes are routing policy data unrelated to IKE Phase 1. Option D is wrong because SA lifetime and Phase 2 selectors belong to Phase 2 (IPsec SA) negotiation, not Phase 1. Option E is wrong because OSPF neighbor timers are a routing protocol concern, not part of IKE negotiation.

Answer

BGP AS path attributes

Answer

IPsec Security Association lifetime and Phase 2 selectors

Answer

OSPF neighbor adjacency timers

Question 11

Which THREE actions are effective when diagnosing intermittent connectivity issues through an SRX firewall where asymmetric routing is suspected? (Choose three)

Accepted Answer

Inspect active sessions using 'show security flow session' to verify session state progression. Option A is correct because 'show security flow session' displays the session table, letting you confirm whether a session is created, whether it reaches the 'Established' state, and whether packets are being forwarded in both directions, which is essential for spotting asymmetric-routing symptoms like one-way or half-open sessions. Option B is correct because flow traceoptions can log packet processing and explicitly show RPF check failures; since asymmetric routing often causes the return packet to arrive on an interface other than the one the route points to, the SRX drops it on the RPF check, and traceoptions reveals this. Option E is correct because when asymmetric routing cannot be eliminated, 'set security flow tcp-session no-syn-check' allows the SRX to accept TCP packets that do not carry the SYN flag, which is necessary when the SYN and subsequent packets traverse different paths/devices and the firewall never sees the initial handshake. Option C is not appropriate because permitting any-to-any traffic does not diagnose or resolve asymmetric routing and needlessly weakens security. Option D is not appropriate because power-cycling the chassis is a disruptive hardware action that has no bearing on a routing or session-flow diagnosis.

Answer

Reconfigure all firewall security policies to permit any-to-any traffic

Answer

Restart the device chassis power supplies

Question 12

Which TWO factors are important when analyzing session table exhaustion issues on an SRX Series firewall? (Choose two)

Accepted Answer

Identifying top sources or application types generating high session volumes. Option C is correct because session table exhaustion is fundamentally caused by high session creation rates, so identifying the top talkers—source IPs, destination IPs, or application types (e.g., via show security flow session summary or session statistics)—pinpoints what is consuming the table and drives mitigation such as application-aware policing or ALGs. Option D is correct because each SRX platform has a documented maximum session capacity (for example, branch SRX models support far fewer sessions than high-end SRX5000 line cards), and knowing that hardware limit tells you whether the table is genuinely exhausted or whether a timeout/aging issue is at play. Option A is not relevant because physical cable integrity affects link up/down and packet loss, not session table occupancy. Option B is not relevant because BGP route convergence timers influence routing stability and reconvergence, not the number of active flow sessions. Option E is not relevant because NTP accuracy affects timestamps, logs, and certificate validity, but it does not directly cause or explain session table exhaustion.

Answer

Checking interface cable physical integrity

Answer

Verifying BGP route convergence timers

Answer

Inspecting NTP time synchronization accuracy

Question 13

Which TWO operational tasks can be performed using Junos traceoptions for security flow and NAT troubleshooting? (Choose two)

Accepted Answer

Tracing packet evaluation through NAT rule-sets and translation stages.. Option B is correct because Junos traceoptions for security flow can log how packets are evaluated against NAT rule-sets, including which rule matches and the resulting translation (source/destination NAT) applied at each stage. Option C is correct because security flow traceoptions capture session creation and teardown, route lookups, and security policy match decisions, which are exactly the events needed to debug flow and policy behavior. Options A, D, and E are not related to traceoptions: flashing BIOS firmware is a hardware/boot task, modifying configuration syntax is done via configuration mode (not traceoptions), and resetting administrator credentials is a recovery/authentication operation, not a flow/NAT debugging function.

Answer

Flashing system BIOS firmware during bootup.

Answer

Modifying active configuration syntax dynamically during live debugging.

Answer

Resetting administrator password credentials.

Question 14

Which TWO statements describe the purpose of NAT on Juniper Networks SRX Series devices? (Choose two)

Accepted Answer

Allowing internal private networks to communicate with external public networks.. Option D is correct because NAT on SRX Series devices translates private RFC 1918 source addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) into routable public addresses, enabling internal hosts to reach external networks such as the Internet. Option E is correct because source NAT (interface or pool-based) lets many internal hosts share one or a few public IPv4 addresses via PAT/port translation, which conserves the limited public IPv4 address space. Option A is wrong because NAT is a translation function, not a routing protocol, and does not replace OSPF or BGP. Option B is wrong because NAT performs address/port translation, not encryption; that is the role of IPsec or other VPN technologies. Option C is wrong because SRX security policies still control traffic flow between zones regardless of NAT, and NAT alone does not permit or deny traffic.

Answer

Replacing the function of internal routing protocols like OSPF and BGP.

Answer

Providing mandatory encryption for all packet payloads traversing security zones.

Answer

Eliminating the need for security policies on the SRX device.

Question 15

Which THREE components are required when defining a standard zone-based security policy in Junos OS? (Choose three.)

Accepted Answer

Source zone. In Junos OS zone-based security policies, every policy must specify the source zone (option B) and the destination zone (option D) because the policy is applied to traffic flowing between two distinct security zones, and the zone pair defines the context in which the policy is evaluated. Option C is also required: each policy must contain match criteria such as source address, destination address, and application (or application-set) to identify which traffic the policy governs, along with the then action (permit, deny, or reject). Option A is incorrect because a static route in inet.3 is used for MPLS/VPN next-hop resolution and is not a required element of a security policy. Option E is incorrect because an integrated Layer 2 bridging profile relates to transparent-mode/bridging configuration and is not part of a standard zone-based security policy definition.

Answer

A static routing table entry in inet.3

Answer

An integrated Layer 2 bridging profile