JNCIA-SEC Practice Test 19 — 15 Questions

Question 1

Which TWO conditions can cause a security policy to be considered shadowed in a Junos configuration? (Choose two.)

Accepted Answer

A preceding policy has 'any' for source, destination, and application, while a subsequent policy specifies a specific subnet.. Option B is correct because when a preceding policy matches 'any' source, destination, and application, it matches all traffic that a subsequent policy specifying a specific subnet would match, so the later policy can never be evaluated and is therefore shadowed. Option C is correct because shadowing occurs whenever an earlier policy in the policy order has identical or broader match criteria than a later policy, causing the later policy to be unreachable in the top-down first-match evaluation used by Junos security policies. Option A is not correct because a policy bound to a non-existent zone is a configuration error, not a shadowing condition, and shadowing specifically concerns overlapping match criteria between ordered policies. Option D is not correct because packet-mode versus flow-mode is a device processing mode and does not by itself cause a policy to be shadowed. Option E is not correct because hit counts are a monitoring feature and have no effect on policy evaluation order or match overlap.

Answer

The shadowed policy is assigned to a non-existent security zone.

Answer

The security device is operating in packet-mode instead of flow-mode.

Answer

The shadowed policy has hit counts enabled while the preceding policy does not.

Question 2

Which THREE types of information are displayed when executing the 'show security flow session extensive' command? (Choose three)

Accepted Answer

NAT translation mapping details. Option A is correct because 'show security flow session extensive' includes NAT translation mapping details, showing the pre- and post-translation source and destination IP addresses and ports for the session. Option B is correct because the extensive output includes AppID classification results, identifying the application recognized for the session (for example, via the application identification engine). Option C is correct because the command displays packet and byte counters for the session in both directions, allowing verification of traffic volume. Option D is incorrect because BGP routing table metric attributes are shown by routing commands such as 'show route detail', not by the flow session extensive output. Option E is incorrect because physical cable length is a Layer 1 property that is not reported by the flow session extensive command.

Answer

BGP routing table metric attributes

Answer

The physical cable length connected to the interface

Question 3

Which THREE methods can be used to examine Junos system log files for security events? (Choose three)

Accepted Answer

Using 'monitor start ' to watch log entries in real time. Option A is correct because the operational-mode command 'monitor start ' streams new entries appended to a Junos log file (e.g., /var/log/messages) to the terminal in real time, which is a valid way to observe security events as they occur. Option C is correct because Junos can forward log messages to remote syslog collection servers via the 'host' statement under 'system syslog', and reviewing those aggregated logs on the external server is a legitimate method for examining security events. Option E is correct because 'show log ' from operational mode displays the contents of a specified log file such as messages or interactive-commands, allowing direct inspection of recorded security events. Option B does not belong because 'edit system syslog' only enters configuration mode to define syslog parameters (files, facilities, severities, hosts) and does not itself display or examine log contents. Option D does not belong because 'clear system log' is not a valid command for viewing logs; clearing removes or truncates log data rather than showing it, so it cannot be used to examine security events.

Answer

Running 'edit system syslog' in configuration mode

Answer

Executing 'clear system log' to view file contents

Question 4

Which TWO characteristics describe the Junos OS CLI? (Choose two)

Accepted Answer

It supports command and parameter completion using the Tab key.. Option B is correct because the Junos OS CLI provides context-sensitive command and parameter completion: pressing the Tab key (or Space) completes a partially typed command or lists valid completions, and '?' displays available commands and options. Option E is correct because the Junos CLI is modal, separating Operational mode (monitoring and troubleshooting, prompt 'user@host>') from Configuration mode (entered with 'configure', prompt 'user@host#'), each with its own command set. Option A is wrong because the CLI never deletes routes on login; routes reside in the routing table and are unaffected by user sessions. Option C is wrong because the Junos CLI is a text-based interface, not a graphical mouse-driven one (that role belongs to J-Web). Option D is wrong because commands are entered as human-readable text, not raw binary machine code.

Answer

It automatically deletes all routes upon login.

Answer

It only supports graphical mouse navigation.

Answer

It requires typing raw binary machine code for all commands.

Question 5

Which TWO statements are true regarding Interface-based Source NAT in Junos OS? (Choose two)

Accepted Answer

It is configured using the 'then source-nat interface' statement in a source NAT rule.. Option A is correct because Interface-based Source NAT in Junos OS is indeed configured by adding the 'then source-nat interface' action to a source NAT rule, which tells the device to use the egress interface's address for translation. Option C is correct because this NAT type translates the original source IP address to the primary IP address of the outbound (egress) interface, which is the defining behavior of interface-based source NAT. Option B is incorrect because in the Junos NAT processing order, Destination NAT is evaluated before Source NAT, not after. Option D is incorrect because interface-based source NAT does not use an address pool at all; it uses the interface address, so no pool of 10 public IPs is required. Option E is incorrect because Proxy ARP is not a requirement for interface-based source NAT; it is typically used in other NAT or routing scenarios and is not mandated here.

Answer

It is evaluated before Destination NAT in the Junos processing pipeline.

Answer

It requires an explicit address pool containing at least 10 public IP addresses.

Answer

It requires Proxy ARP configured on all internal interfaces.

Question 6

An administrator suspects that asymmetric routing is disrupting traffic flow through an SRX Series device. Which THREE symptoms or diagnostic indicators point toward asymmetric routing? (Choose three)

Accepted Answer

Flow traceoptions show drops with reasons such as "No session found" or reverse path validation failures.. Option B is correct because flow traceoptions (set security flow traceoptions) log packet-processing decisions, and asymmetric routing typically produces drops such as "No session found" (the return packet hits a different SRX that has no matching session) or reverse-path forwarding (RPF) validation failures when the return path differs from the incoming interface. Option D is correct because if the SYN traverses the SRX but the SYN-ACK returns via a different path that bypasses the device, the SRX never sees the completing packet, so the session stays in the 'SynSent' state and the handshake never completes. Option E is correct because asymmetric flows cause packets to arrive on interfaces that do not match the expected zone/interface pairing or session direction, triggering zone-mismatch or pairing errors and failed session creation. Option A is not a symptom of asymmetric routing, since chassis cluster failover is driven by redundancy-group monitoring and heartbeats, not by path asymmetry. Option C is also not indicative, because asymmetric routing causes forwarding/session drops rather than a Routing Engine CPU spike to 100%.

Answer

The chassis cluster fails over immediately.

Answer

CPU utilization on the Routing Engine spikes to 100%.

Question 7

When configuring the unified security policy framework on Junos OS, which TWO elements are key components that extend traditional layer 4 firewall policies into layer 7 application and threat visibility?

Accepted Answer

Unified Threat Management (UTM) or security services profiles. Option A is correct because UTM/security services profiles (antivirus, anti-spam, content filtering, IPS, and AppTrack) attach layer 7 inspection and threat prevention to a policy, providing the application and threat visibility that plain L4 rules lack. Option B is correct because Application Identification (AppID) is the Junos engine that detects and classifies applications (including nested/evasive ones) so policies can match on application rather than just port/protocol, which is the foundation for extending L4 policies into layer 7. Option C is not part of the unified security policy framework since static MAC filtering is a layer 2 access control, not application/threat inspection. Option D is incorrect because static port-based service objects are exactly the traditional layer 4 matching construct that the unified policy extends beyond. Option E is incorrect because layer 2 bridging control protocols (e.g., STP, LLDP) are switching functions unrelated to layer 7 application and threat visibility.

Answer

Static MAC-address filtering lists

Answer

Traditional static port-based service objects

Answer

Layer 2 bridging control protocols

Question 8

When troubleshooting performance degradation on an SRX Series device, which THREE operational commands help identify resource bottlenecks in the forwarding and control planes? (Choose three)

Accepted Answer

show chassis routing-engine. Option A, show chassis routing-engine, is correct because it reports Routing Engine CPU utilization, memory usage, and load averages, directly exposing control-plane resource bottlenecks on the SRX. Option C, show system resources, is correct because it displays overall CPU, memory, and process-level utilization, helping identify which processes are consuming resources across the control plane. Option E, show security flow session summary, is correct because it shows session counts and utilization against the flow session capacity, revealing forwarding-plane resource exhaustion that causes performance degradation. Option B, show security alg status, only lists ALG enablement states and does not report resource utilization, so it does not identify bottlenecks. Option D, show security policies summary, merely counts configured policies and provides no performance or resource metrics.

Answer

show security alg status

Answer

show security policies summary

Question 9

When troubleshooting a Source NAT configuration where internal users cannot reach external resources, which TWO verification checks should an administrator perform? (Choose two)

Accepted Answer

Verify rule hit counters and matches using 'show security nat rule-set'.. Option C is correct because 'show security nat rule-set' displays the hit counters and match statistics for each source NAT rule, so an administrator can confirm whether traffic is actually matching the intended rule and whether the rule is being evaluated in the correct rule-set order. Option E is correct because 'show security flow session' reveals the active sessions and their NAT translations, letting the administrator verify that source NAT is being applied to the internal users' traffic and that translated addresses/ports are present. Options A, B, and D do not belong: SNMP community strings are for monitoring/management access and have no bearing on NAT translation, interface duplex mismatches would cause link-level errors rather than a NAT rule problem, and BGP peer state affects route propagation to external networks but does not verify whether source NAT is correctly matching and translating internal user traffic.

Answer

Verify SNMP community string configurations.

Answer

Verify interface duplex settings on internal switch ports.

Answer

Verify BGP peer state for external routing tables.

Question 10

When configuring a Source NAT pool with multiple IP addresses on a Junos OS device, which TWO allocation methods or behaviors apply to how addresses and ports are assigned? (Choose two)

Accepted Answer

Sessions are distributed across multiple pool IP addresses to balance utilization.. Option C is correct because a Junos source NAT pool with multiple addresses distributes translated sessions across the pool's IP addresses, balancing utilization rather than pinning all translations to one address. Option E is correct because when a source NAT pool is configured, Junos performs Port Address Translation (PAT), allocating available source ports from each pool IP address so many internal hosts can share the pool addresses. Option A is wrong because allocation is not a simple round-robin without port translation; PAT port allocation is involved. Option B is wrong because NAT translation concerns IP addresses and ports, not forcing all hosts to share one static MAC address. Option D is wrong because PAT uses the dynamic/ephemeral source port range, not a static restriction to well-known ports 0-1023.

Answer

Pool addresses are assigned exclusively on a round-robin basis without port translation.

Answer

All internal hosts are forced to share exactly one single static MAC address regardless of pool size.

Answer

Port allocation is static and restricted to well-known ports (0-1023).

Question 11

Which THREE methods can be used to modify the order of existing security policies in Junos OS? (Choose three.)

Accepted Answer

Using the 'insert ... before' configuration command.. Option A is correct because Junos OS supports the 'insert' configuration command with the 'before' keyword (e.g., 'insert security policies from-zone trust to-zone untrust policy P1 before policy P2') to reposition an existing policy ahead of another. Option C is correct for the same reason: the 'insert ... after' form (e.g., 'insert ... policy P1 after policy P2') reorders an existing policy to follow a specified policy. Option E is correct because deleting a policy and recreating it at the desired point in the policy list effectively changes its evaluation order, since Junos evaluates policies top-down. Option B is not a Junos feature—there is no automated priority metric based on IP prefix length for ordering security policies. Option D is invalid because there is no 'sort security-policies auto' operational command in Junos OS; policy order is controlled through configuration, not an operational sort command.

Answer

Configuring an automated priority metric based on IP prefix length.

Answer

Using the 'sort security-policies auto' operational command.

Question 12

An administrator is reviewing policy shadowing and rule optimization on an SRX Series device. Which THREE conditions must be met for one security policy to completely shadow (make redundant) a subsequent security policy?

Accepted Answer

Both policies must belong to the exact same zone pair or be global policies.. For a security policy to completely shadow a subsequent policy on an SRX, the two policies must be evaluated in the same context, so option A is correct: they must belong to the exact same zone pair (for example, trust-to-untrust) or both be global policies, since policies in different zone pairs or contexts are not compared against each other. Option D is correct because SRX security policies are evaluated top-down in first-match order, so the shadowing policy must appear higher in the policy list than the policy it makes redundant. Option E is correct because the preceding policy must match at least everything the subsequent policy matches — its source, destination, and application criteria must be broader than or identical to the subsequent policy's criteria — so the later policy can never be reached. Option B is incorrect because shadowing is about match scope and evaluation order, not about requiring a deny action before a permit action; a broader permit policy can shadow a narrower permit policy just as well. Option C is incorrect because dynamic application identification versus static ports is not a requirement for shadowing; the relevant issue is whether the match criteria of the earlier policy encompass those of the later policy.

Answer

The preceding policy must have a 'deny' action while the subsequent policy has a 'permit' action.

Answer

The subsequent policy must use dynamic application identification while the preceding policy uses static port numbers.

Question 13

An administrator is troubleshooting an antivirus profile on an SRX Series device where certain archive files (.zip) containing test malware are bypassing inspection. Which THREE configuration elements or factors should the administrator verify? (Choose three.)

Accepted Answer

Confirm whether password-protected or encrypted archives are configured to be blocked or bypassed.. Option B is correct because Junos antivirus profiles can be configured to either block or bypass password-protected/encrypted archives; if the action is set to bypass, .zip files containing malware will not be inspected, so the administrator must verify this setting. Option C is correct because the antivirus profile has a max-file-size limit (default 10 MB in many Junos versions); any archive larger than this limit is skipped, allowing malware to pass uninspected. Option D is correct because the archive-depth setting controls how many levels of nested compressed files are decompressed and scanned; if set too low, malware hidden in nested archives inside the .zip will not be inspected. Option A is incorrect because AppID is a separate identification service and does not need to be disabled for antivirus inspection to work; disabling it would not fix the bypass issue. Option E is incorrect because antispam whitelists apply to email sender/IP/MIME filtering for antispam, not to antivirus archive inspection, and whitelisting a MIME type would not cause .zip files to bypass antivirus scanning.

Answer

Ensure the AppID service object is explicitly disabled for all antivirus inspection policies.

Answer

Verify that the antispam whitelist contains the specific MIME type of the .zip file.

Question 14

Which TWO tools or commands are used to check the operational status and active associations of IPsec VPNs? (Choose two)

Accepted Answer

show security ipsec security-associations. Option A, `show security ipsec security-associations`, is correct because it displays the operational status of IPsec Phase 2 SAs, including the SPI, encryption/authentication algorithms, and traffic statistics for each tunnel. Option D, `show security ike security-associations`, is correct because it shows the operational status of IKE Phase 1 SAs, including peer addresses, role, state, and lifetime, which are the active associations that establish the IPsec VPN. Option B, `show security screen statistics`, is not correct because it reports firewall screen (IDS/DoS protection) counters, not IPsec VPN status. Option C, `show firewall filter`, is not correct because it displays firewall filter configuration or counters, not VPN associations. Option E, `show security alg status`, is not correct because it lists the enabled/disabled state of application layer gateways, which is unrelated to IPsec SA status.

Answer

show security screen statistics

Answer

show firewall filter

Answer

show security alg status

Question 15

While inspecting the security session table using 'show security flow session', you notice a session in the 'P' state. What does this state indicate?

Accepted Answer

The session is pending and waiting for a TCP synchronization or return packet to be fully established.. In Junos OS SRX session management, the 'P' flag indicates a pending session waiting for a return packet or complete three-way handshake before becoming active.

Answer

The session is prioritized for quality of service (QoS).

Answer

The session is operating in passive FTP mode.

Answer

The session is permanently blocked due to a security policy violation.