JNCIA-SEC Practice Test 2 — 10 Questions

Question 1

Where are system log messages related to security policies typically directed when default logging configurations are used?

Accepted Answer

To the local log file configured under system syslog, such as interactive-commands or security-log. Security policy logs are sent via security daemon (secd) and flow module to the local syslog utility, usually directed to a file or remote collector.

Answer

Directly to the active user terminal screen by default

Answer

To the kernel crash dump utility

Answer

To the boot-time NVRAM partition

Question 2

An administrator configures Destination NAT to forward incoming traffic on port 80 to an internal server. After committing, the administrator notices that ping tests to the destination NAT public IP address fail. What is the standard behavior of Destination NAT regarding ICMP ping requests?

Accepted Answer

Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.. Destination NAT rules that match specific TCP/UDP ports (like port 80) do not translate ICMP traffic because ICMP does not use ports. Therefore, ping requests to the public IP are not forwarded to the internal server, resulting in failed pings unless an ICMP-specific Destination NAT rule is configured. This is standard Junos behavior.

Answer

ICMP ping requests are dropped by the Junos control plane as a security hardening default.

Answer

Destination NAT automatically translates and responds to all ICMP echo requests by default.

Answer

Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.

Question 3

Which Junos configuration hierarchy is used to define a UTM Web Filtering profile?

Accepted Answer

[edit security utm feature-profile web-filtering profile <name>]. UTM feature profiles are configured under the [edit security utm feature-profile web-filtering] hierarchy.

Answer

[edit firewall utm-policy web-filter]

Answer

[edit security web-filter profile <name>]

Answer

[edit applications utm web-filtering]

Question 4

You are configuring a security policy and need to reference a group of IP addresses that frequently changes. You decide to use an address set. How do you add individual address entries into this address set?

Accepted Answer

By referencing the individual address entries within the address-set definition statement.. An address set in Junos is a named container that groups multiple address book entries. To add individual address entries into the set, you reference them within the address-set definition using the 'address' statement (e.g., 'set security address-book global address-set MySet address Server1'). This creates a logical group that can be referenced in policies.

Answer

By applying firewall filter terms to the address set container.

Answer

By assigning the address set to an interface unit.

Answer

By listing raw IP subnet masks directly inside the security policy match statement.

Question 5

Which statement correctly describes a Junos security zone requirement before you can apply a security policy referencing that zone?

Accepted Answer

The zone must have at least one active interface assigned to it.. Before a security policy can reference a zone, that zone must have at least one active interface assigned to it. Junos requires zones to be bound to physical or logical interfaces so the device knows which ingress and egress points the zone represents; a zone with no interfaces cannot participate in policy evaluation.

Answer

The zone must be assigned to a virtual router routing instance.

Answer

The zone must have screen options enabled for DoS protection.

Answer

The zone must have an IPv4 address assigned directly to the zone context.

Question 6

Which THREE parameters can be configured within a UTM policy profile on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

Antispam profile reference. A UTM policy profile on a Juniper SRX is essentially a container that binds together the various content-security profiles applied to traffic, so option B (Antispam profile reference) is correct because the UTM policy specifies which antispam profile to use for matching traffic. Option D (Antivirus profile reference) is correct because the UTM policy likewise references an antivirus profile to scan sessions for malware. Option E (Web-filtering profile reference) is correct because the UTM policy also references a web-filtering (URL filtering) profile to categorize and block or permit web content. Options A and C are incorrect: IPsec VPN IKE gateway settings are configured under the VPN/IKE hierarchy, not inside a UTM policy, and BGP routing protocol parameters belong to routing-options/protocols configuration, which is unrelated to UTM content security.

Answer

IPsec VPNike gateway settings

Answer

BGP routing protocol parameters

Question 7

Which THREE types of logging modifiers are available when configuring logging in a Junos security policy? (Choose three.)

Accepted Answer

session-init. In Junos security policy configuration, the log option accepts three logging modifiers: session-init, session-close, and periodic. Option B (session-init) is correct because it generates a log entry when a session is first established, capturing the initial session setup details. Option D (session-close) is correct because it logs when a session is torn down, recording session termination information such as bytes transferred. Option E (periodic) is correct because it produces log entries at regular intervals during the lifetime of a long-lived session, providing ongoing session statistics. Options A (packet-drop-immediate) and C (state-change-alert) are not valid Junos logging modifiers for security policies; they do not exist as configurable log options in the Junos security policy syntax.

Answer

packet-drop-immediate

Answer

state-change-alert

Question 8

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

Accepted Answer

Security zones. Security zones, address books, and screen options are all configured under [edit security].

Answer

VLAN bridge domain definitions

Answer

BGP routing protocol peering parameters

Question 9

An administrator needs to troubleshoot an intermittent application failure across an SRX Series firewall. They decide to use security flow traceoptions with a specific match condition for the client and server IP addresses. Where are the resulting trace files saved by default on the SRX Series device?

Accepted Answer

/var/log/. By default, Junos trace files are stored in the /var/log/ directory.

Answer

/var/tmp/trace/

Answer

/var/db/security/logs/

Answer

/config/logging/

Question 10

An administrator configures Content Filtering to block executable files (.exe). Users report that they can still download archives containing executable files inside them (.zip). What is the recommended way to prevent users from bypassing file extension blocks using compressed archives?

Accepted Answer

Add archive file extensions (such as .zip and .rar) to the content filtering block list.. To prevent users from bypassing file extension blocks using archives, content filtering or antivirus profiles should be configured to block archive types (.zip, .rar) or block password-protected/unscannable archives.

Answer

Convert the security policy from stateless to stateful inspection.

Answer

Enable BGP routing route-reflection for HTTP traffic.

Answer

Disable HTTP proxy caching on the client browsers.