JNCIA-SEC Practice Exam 3 — 20 Questions

Question 1

Which TWO actions can help an administrator troubleshoot why a security policy is not matching expected traffic? (Choose two)

Accepted Answer

Check policy hit counts using 'show security policies hit-count'. Policy matching troubleshooting involves checking policy hit counts and using flow traceoptions.

Answer

Clear the BGP routing table

Answer

Reset physical interface duplex settings

Answer

Restart the routing protocol daemon (rpd)

Question 2

Which statement correctly identifies the purpose of Junos OS functional zones?

Accepted Answer

Functional zones are built-in system zones used to handle specific traffic types like management or host-bound traffic.. Functional zones are pre-defined system zones that handle specialized traffic such as management or device-originated traffic.

Answer

Functional zones replace security policies for inter-VLAN routing.

Answer

Functional zones are created by administrators to group high-priority servers.

Answer

Functional zones allow unauthenticated guest access without security policies.

Question 3

You need to verify the operational status of an IPsec VPN tunnel on an SRX Series device. Which command provides detailed tunnel status including Phase 1 and Phase 2 associations?

Accepted Answer

show security ipsec security-associations. The show security ike security-associations and show security ipsec security-associations commands are used to inspect VPN tunnels.

Answer

show security flow vpn-status

Answer

show security ike sa-detail

Answer

show vpn ipsec active

Question 4

Which THREE types of information are displayed when executing the 'show security flow session extensive' command? (Choose three)

Accepted Answer

NAT translation mapping details. The extensive modifier on session commands reveals AppID details, NAT translations, and packet counters.

Answer

BGP routing table metric attributes

Answer

The physical cable length connected to the interface

Question 5

Which THREE checks should be performed when troubleshooting source NAT translation failures? (Choose three)

Accepted Answer

Verify that the source NAT rule is active and correctly applied to the traffic zone. NAT troubleshooting involves checking translation rules, pool address availability, and security policy permits.

Answer

Check IKE Phase 1 authentication keys

Answer

Verify that static routing table metrics are set to preferred values

Question 6

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. Security policy logging options (such as log { init session-close; }) are specified inside the then statement of a policy rule.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 7

You are troubleshooting a high CPU condition on the Routing Engine and suspect that intensive logging might be the cause. Where would you check the configuration for security log rates or stream settings?

Accepted Answer

[edit security log]. Global security log settings, including stream configuration and rate limiting, are configured under the [edit security log] hierarchy.

Answer

[edit system syslog]

Answer

[edit chassis forwarding-options log]

Answer

[edit security policies log]

Question 8

Which THREE parameters can be adjusted under the [edit security flow timeout] hierarchy to manage session table aging? (Choose three)

Accepted Answer

tcp-established. Flow timeouts can be customized for TCP established/max, UDP, and ICMP sessions.

Answer

bgp-hold-time

Answer

ike-lifetime

Question 9

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. Security flow traceoptions allow administrators to track packet processing steps through the security engine, capturing drop reasons and state changes.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 10

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Accepted Answer

LAND attacks. SCREEN options protect against IP spoofing, SYN floods, and LAND attacks among other Layer 3/4 threats.

Answer

Cross-site scripting (XSS) browser exploits

Answer

SQL injection web application attacks

Question 11

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Accepted Answer

SIP (Session Initiation Protocol). FTP, SIP, and TFTP are classic examples of protocols requiring ALGs due to dynamic port negotiation.

Answer

HTTP (Hypertext Transfer Protocol)

Answer

SSH (Secure Shell)

Question 12

An administrator wants to monitor security screening checks such as SYN flood protection counters. Which operational command should be used?

Accepted Answer

show security screen statistics. Screen options protect against attacks, and their statistics are viewed using show security screen statistics.

Answer

show system screening-counters

Answer

show security attack-mitigation status

Answer

show security flow flood-protection

Question 13

Which command allows an administrator to view real-time interface throughput and error statistics on an SRX Series firewall?

Accepted Answer

show interfaces statistics. The show interfaces command displays interface traffic rates, drops, and error statistics.

Answer

show system interface status

Answer

show chassis hardware

Answer

show security flow statistics

Question 14

What is the purpose of the 'show security zones' command?

Accepted Answer

To display configured security zones and their associated interfaces and properties. The show security zones command displays security zones, associated interfaces, and zone-level screen/policy settings.

Answer

To show routing table partitions

Answer

To list all active IPsec VPN tunnels

Answer

To monitor firewall CPU load per zone

Question 15

An engineer is troubleshooting a potential Denial of Service (DoS) attack. They want to check if screen options have dropped any packets on a specific security zone. Which command should be used?

Accepted Answer

show security screen statistics zone <zone-name>. Screen statistics and drop counters are tracked per zone and can be displayed using the show security screen statistics zone command.

Answer

show security attack statistics

Answer

show firewall log

Answer

show security flow screen-drops

Question 16

When configuring NAT rule sets on a Junos OS device, in what order are different types of NAT evaluated?

Accepted Answer

Destination NAT is evaluated first, followed by Source NAT, and then Static NAT.. Junos OS evaluates NAT rule sets in a specific order: Destination NAT is evaluated first, followed by Source NAT, and finally Static NAT.

Answer

All NAT types are evaluated simultaneously using parallel hardware lookups.

Answer

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Answer

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Question 17

An administrator wants to view active security sessions on an SRX Series device that match a specific source IP address of 192.168.10.50. Which CLI command provides this specific filtered output?

Accepted Answer

show security flow session source-prefix 192.168.10.50. The show security flow session command provides session table details, and filtering can be applied using match criteria.

Answer

show security alg session 192.168.10.50

Answer

show firewall filter session source-ip 192.168.10.50

Answer

show system connections 192.168.10.50

Question 18

Which command is used to display the currently configured global address books in Junos OS?

Accepted Answer

show configuration security address-book. The 'show configuration security address-book' command displays address books.

Answer

show security address-book operational

Answer

show security flow address-books

Answer

show system address-books

Question 19

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Accepted Answer

Address book entries / Address sets. Security policies reference source/destination addresses (from address books) and applications.

Answer

Functional zone names directly as match criteria for payload inspection

Answer

SCREEN option profiles

Answer

Hardware crypto processor allocation maps

Question 20

When analyzing security policy behavior and troubleshooting traffic drops, which TWO commands are most helpful for verifying policy matches and active sessions? (Choose two)

Accepted Answer

show security flow session. To troubleshoot traffic drops and policy matches, administrators use show security policy match to test policy evaluation and show security flow session to check active sessions.

Answer

show security ike

Answer

show system alarms

Answer

show firewall filter