JNCIA-SEC Practice Exam 2 — 20 Questions

Question 1

Which THREE parameters are typically required when defining a custom URL pattern object for use in web filtering overrides? (Choose three.)

Accepted Answer

Matching type (such as exact, prefix, or suffix). Custom URL patterns in Junos UTM allow specifying matching criteria such as URL strings, matching types, and actions.

Answer

SSL private key password

Answer

DNSBL server IP address

Question 2

Which THREE actions can be configured within a Content Filtering profile when a matched file type or MIME type violation occurs? (Choose three.)

Accepted Answer

Display a custom block message. Content filtering actions include blocking the transfer, logging the event, and displaying a custom block message.

Answer

Automatic quarantine to local flash storage

Answer

Automatic file sanitization (macro removal)

Question 3

Which command is used to clear UTM antivirus statistics counters on an SRX Series firewall?

Accepted Answer

clear security utm antivirus statistics. Junos OS clear commands ('clear security utm antivirus statistics') reset operational counters for monitoring purposes.

Answer

clear system antivirus counters

Answer

request security utm antivirus clear-stats

Answer

reset security utm antivirus counters

Question 4

You are configuring Antivirus inspection on an SRX Series firewall and want to ensure that files larger than 20 MB are not scanned, in order to prevent CPU and memory exhaustion on the processing cards. Which CLI command configures this maximum file size limit for HTTP streams?

Accepted Answer

set security utm feature-profile antivirus profile default http-profile maximum-file-size 20. Antivirus profiles allow setting the maximum file size for stream inspection to prevent resource exhaustion.

Answer

set security utm antivirus max-size 20mb

Answer

set security flow max-file-size 20

Answer

set security utm stream-scanning file-limit 20

Question 5

What is the primary role of Unified Threat Management (UTM) on Juniper SRX Series firewalls?

Accepted Answer

To combine multiple security features (antivirus, web filtering, antispam, content filtering) into a single firewall platform.. UTM integrates multiple security features such as antivirus, web filtering, antispam, and content filtering into a single gateway device.

Answer

To provide high-availability failover between routing engines.

Answer

To optimize BGP routing path selections.

Answer

To manage IPsec VPN tunnel key exchanges.

Question 6

Which TWO methods can be used to check the operational health and status of the UTM engines on a Juniper SRX Series device? (Choose two.)

Accepted Answer

The 'show security utm web-filtering status' command.. Operational commands starting with 'show security utm ...' display engine status and health information.

Answer

The 'show chassis cluster status' command.

Answer

The 'show interfaces terse' command.

Answer

The 'show system routing-table' command.

Question 7

When configuring an Integrated Web Filtering profile, you want to ensure that URLs categorized as 'Malware' or 'Phishing' are blocked immediately, while URLs categorized as 'Streaming Media' generate a log entry but are permitted. How should you configure this in Junos?

Accepted Answer

Assign 'block' action to Malware and Phishing categories, and 'permit' with logging enabled to Streaming Media.. Web filtering profiles allow assigning different actions (block, permit, log) to individual categories independently.

Answer

Configure AppSecure to block malware and allow streaming media.

Answer

Assign a global block action and create bypass exceptions for streaming media.

Answer

Use content filtering to block malware URLs and web filtering for streaming media.

Question 8

You are configuring an SRX Series firewall with Antivirus inspection. You want to ensure that if the cloud rating or antivirus update service becomes unreachable, the firewall fails open and does not disrupt user web browsing. Which CLI parameter configures the fail-open behavior?

Accepted Answer

set security utm feature-profile antivirus profile <name> fallback-action permit. UTM profiles on SRX allow configuring fail-open or fail-closed behavior when the inspection engine or cloud service encounters errors.

Answer

set security flow utm-fail-open

Answer

set security utm error-action allow

Answer

set security utm feature-profile antivirus profile <name> un-scannable permit

Question 9

What is the primary function of the Junos Express Antivirus engine on SRX Series firewalls?

Accepted Answer

To detect and block malware within network traffic streams.. The Express antivirus engine provides high-performance, stream-based malware detection on Juniper SRX devices.

Answer

To inspect Layer 7 application handshakes for AppID classification.

Answer

To filter out unsolicited bulk email messages over SMTP.

Answer

To categorize URLs into security and productivity groups.

Question 10

An administrator configures Antispam with a DNSBL server. After committing the changes, logs show that no antispam queries are being performed. What is the most common reason for this when configuring DNSBL?

Accepted Answer

The system DNS name servers are not configured on the SRX device.. Antispam requires DNS name resolution (DNS servers configured on the SRX) to query external DNSBL servers. Without DNS configured, blacklist queries fail.

Answer

The antispam license must be activated using a hardware token.

Answer

The SRX security policy lacks an application ALG for SMTP.

Answer

The antispam profile must be attached to an interface rather than a UTM policy.

Question 11

Which TWO protocols are supported for Antivirus scanning within Juniper SRX UTM profiles? (Choose two.)

Accepted Answer

HTTP. Junos UTM antivirus supports multiple protocols, including HTTP and SMTP for file and email attachment scanning.

Answer

BGP

Answer

SNMP

Answer

NTP

Question 12

Which Junos configuration hierarchy is used to create a UTM Policy Profile that bundles multiple security features?

Accepted Answer

[edit security utm policy-profile <name>]. UTM policy profiles are configured under the [edit security utm policy-profile] hierarchy.

Answer

[edit security policies utm-profile <name>]

Answer

[edit utm profile-policy <name>]

Answer

[edit security firewall utm-policy <name>]

Question 13

Which command displays the current active security policies applied on an SRX Series device?

Accepted Answer

show security policies. The show security policies command displays configured security policies and their rules.

Answer

show security zone policies

Answer

show route security-policy

Answer

show firewall security-rules

Question 14

Which TWO components are typically analyzed when troubleshooting an IPsec VPN Phase 1 negotiation failure using traceoptions? (Choose two)

Accepted Answer

IKE proposal matching (encryption, authentication, Diffie-Hellman group). Phase 1 troubleshooting examines IKE proposal matching, pre-shared keys or certificates, and exchange states.

Answer

BGP AS path attributes

Answer

IPsec Security Association lifetime and Phase 2 selectors

Answer

OSPF neighbor adjacency timers

Question 15

Which TWO actions should an administrator take when configuring security policy traceoptions to effectively debug a suspected policy drop issue? (Choose two)

Accepted Answer

Configure a target file name under traceoptions using the file statement.. When configuring traceoptions, specifying a file name and enabling specific flags (like policy or all) are mandatory steps to generate meaningful debug output.

Answer

Restart the Routing Engine to apply traceoptions.

Answer

Enable stateless firewall filters on all transit interfaces.

Answer

Disable all security zones during tracing.

Question 16

Which UTM feature should an administrator configure to prevent employees from accessing gambling and adult content websites?

Accepted Answer

Web Filtering. Web filtering categorizes websites into various groups, including gambling and adult content, allowing administrators to block them.

Answer

Antivirus

Answer

Antispam

Answer

Content Filtering

Question 17

Which TWO commands help verify security zone configurations and interface memberships? (Choose two)

Accepted Answer

show security zones security-zone trust. Security zone status and interface membership are inspected via show security zones commands.

Answer

show route security-zones

Answer

show interfaces security-status

Answer

show firewall zone-membership

Question 18

An administrator enables traceoptions for IKE to troubleshoot a failing VPN negotiation. Where are these trace files stored by default on the SRX Series device?

Accepted Answer

/var/log/. Traceoptions files are stored in the /var/log/ directory by default on Junos OS devices.

Answer

/var/tmp/traces/

Answer

/etc/log/ike/

Answer

/config/sec/

Question 19

An administrator configures Content Filtering to block all .exe files, but users report that they can still download .exe files over encrypted HTTPS connections. What is the most likely reason for this?

Accepted Answer

HTTPS decryption (SSL proxy) is not configured, so the firewall cannot inspect the encrypted payload for file extensions.. Content filtering inspects cleartext HTTP streams; encrypted HTTPS streams cannot be inspected for file extensions unless SSL Proxy (HTTPS decryption) is enabled.

Answer

Content filtering only supports FTP traffic.

Answer

The content filtering license has expired.

Answer

The SRX control plane lacks memory.

Question 20

During session troubleshooting, you notice sessions entering the 'CLOSE-WAIT' state and lingering. What does this indicate in the Junos session table?

Accepted Answer

The local application has not yet issued a close command after receiving a FIN from the remote peer.. CLOSE-WAIT is a standard TCP state indicating that the local endpoint has received a connection termination request (FIN) from the remote side and is waiting for the local application to close.

Answer

The SRX security policy is actively dropping packets for this session.

Answer

IPsec Phase 2 re-keying is in progress.

Answer

The session is awaiting NAT port reallocation.