JNCIA-SEC Practice Exam 4 — 20 Questions

Question 1

Which Junos configuration mode command is used to delete an existing configuration statement?

Accepted Answer

delete. In Junos configuration mode, the 'delete' command is used to remove an existing configuration statement. For example, 'delete security policies from-zone trust to-zone untrust policy my-policy' removes that specific policy. The 'delete' command can also be used with wildcards to remove multiple statements. This is a fundamental Junos CLI operation that every administrator must know for managing configurations.

Answer

clear

Answer

remove

Answer

no

Question 2

You have configured a new security policy on an SRX device, but traffic matching the policy is still being dropped. You check the security logs and see 'POLICY_VIOLATION' or session drop messages. Which command enables real-time packet tracing for security flow debugging?

Accepted Answer

set security flow traceoptions. Flow tracing is enabled using 'set security flow traceoptions file <filename>' and 'set security flow traceoptions flag all' to debug flow mechanics.

Answer

debug security engine

Answer

set firewall filter trace

Answer

monitor traffic interface <name>

Question 3

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). When configuring a DNSBL server profile for antispam inspection on a Juniper SRX, option A (Server type such as rbl or svbl) is required because the profile must specify which kind of blacklist lookup is being performed, e.g., an RBL for real-time blackhole lists or an SVBL for sender-verify blacklists. Option B (Server domain name or IP address) is required because the SRX must know which DNSBL server to query, such as a hostname or IP address of the blacklist provider. Option D (Expected DNS reply code or threshold IP indicating spam) is required because the device must interpret the DNSBL response, for example a 127.0.0.x reply or a configured threshold that identifies the sender as spam. Options C and E are not part of the DNSBL profile configuration: SMTP encryption certificates and private keys are used for TLS-related mail security settings, while POP3/IMAP proxy ports are irrelevant because DNSBL antispam inspection operates on SMTP and DNS lookups, not POP3 or IMAP proxy services.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 4

Which TWO statements are true regarding Junos OS configuration hierarchies? (Choose two)

Accepted Answer

Configuration is structured hierarchically using curly braces and indentation.. Option A is correct because Junos OS stores its configuration as a hierarchical tree of statements, and the CLI represents that hierarchy with curly braces and indentation to show parent/child relationships (for example, interfaces { ge-0/0/0 { unit 0 { family inet { address ... } } } }). Option D is correct because Junos supports multiple users editing the shared candidate configuration, and each user's changes remain in the candidate until a commit is issued; users can also use private candidate configurations so their edits are isolated from others. Option B is wrong because configuration-mode edits only modify the candidate configuration and do not take effect until you run the commit command. Option C is wrong because Junos configuration syntax uses normal alphanumeric keywords and values, not lowercase hexadecimal. Option E is wrong because the CLI can display configuration in set format using commands such as show configuration | display set.

Answer

Changes made in configuration mode take effect immediately without a commit.

Answer

Configuration commands must be typed entirely in lowercase hexadecimal.

Answer

The CLI cannot display configuration in set format.

Question 5

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies.. Junos evaluates zone-based policies first, followed by global policies if no zone-based policy matches.

Answer

All policies, both global and zone-based, are evaluated in a single combined sequence based strictly on rule naming alphabetically.

Answer

Policies are evaluated based on IP prefix length regardless of whether they are global or zone-based.

Answer

Global policies are evaluated first, followed by zone-based policies.

Question 6

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. In Junos security policies, logging is enabled by adding the 'log' or 'log session-close' keyword within the 'then' statement of a policy rule. This ensures that when the policy action (permit/deny) is taken, the event is logged. The 'then' statement defines the action and any additional actions like logging, counting, or session termination. Placing logging elsewhere, such as in the match statement or zone configuration, is syntactically incorrect or does not achieve policy-specific logging.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 7

Which TWO actions occur during the initial packet flow processing on an SRX Series device when a new session is established? (Choose two)

Accepted Answer

Route lookup (destination routing table check). When a new session is established, the SRX performs a route lookup and evaluates security policies to determine whether to permit or deny the flow.

Answer

Immediate CPU kernel panic generation

Answer

Automatic conversion of IPv4 to IPv6

Answer

Immediate flooding of the packet to all zone interfaces

Question 8

You are troubleshooting an issue where an SRX firewall fails to update its UTM antivirus signatures automatically. The firewall has internet access, but updates consistently fail with a signature download error. Which troubleshooting step or CLI command can verify whether the SRX can reach the Juniper update servers?

Accepted Answer

ping update.juniper.net (or the configured update server hostname) to verify DNS and reachability.. Testing connectivity and DNS resolution to the update servers via ping or checking update server status helps diagnose update failures.

Answer

Reboot the Routing Engine into single-user recovery mode.

Answer

Run 'request system software delete antivirus' to reset the update daemon.

Answer

Modify the security policy to allow all traffic without inspection.

Question 9

Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?

Accepted Answer

Antispam. Antispam is the specific UTM feature designed to detect and block spam over SMTP protocols.

Answer

Web filtering

Answer

Antivirus

Answer

Content filtering

Question 10

Which statement is true regarding address book configuration scope in Junos OS security policies?

Accepted Answer

An address book entry defined at the zone level can be referenced by security policies involving that specific zone.. In Junos OS, address books can be defined at the global level or attached to a specific zone. When an address book entry is defined at the zone level, it is scoped to that zone and can only be referenced by security policies that involve that zone (either as source or destination). This zone-specific scoping allows administrators to reuse the same address name in different zones without conflict, and policies referencing that zone automatically have access to its address book entries.

Answer

Address books cannot contain address sets; they can only contain single IP addresses.

Answer

Zone-based address books override global address books if names overlap.

Answer

Address book entries must be globally unique across the entire device, even across different zones.

Question 11

An administrator configures source NAT with port address translation (PAT) on an SRX device. They notice that internal hosts are exhausting available source ports rapidly. Which CLI command or setting allows the administrator to monitor PAT pool port utilization and allocation?

Accepted Answer

show security nat source pool statistics. The command 'show security nat source pool statistics' displays per-pool statistics including the number of allocated ports, the port range, and utilization, which is exactly what is needed to monitor PAT pool port exhaustion. It is the operational command for inspecting source NAT pool port allocation on SRX.

Answer

show chassis nat utilization

Answer

show system port-allocation

Answer

show flow nat sessions

Question 12

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Accepted Answer

IP address range objects. Address sets can contain individual IPv4 addresses, IPv6 addresses, IP ranges, DNS FQDN objects, or other address sets.

Answer

Application Layer Gateway profiles

Answer

Security zone interface names

Question 13

What is the primary function of Content Filtering in Juniper SRX Unified Threat Management?

Accepted Answer

To block specific file types, MIME types, and text strings within traffic streams.. Content filtering inspects traffic streams to enforce organizational policies regarding file types, extensions, and MIME formats.

Answer

To inspect encrypted SSL/TLS handshake certificates.

Answer

To prevent buffer overflow attacks using protocol anomaly detection.

Answer

To scan incoming emails for spam sender addresses.

Question 14

Which hardware architecture distinction is characteristic of enterprise-grade SRX Series gateways (such as SRX4100 or SRX4600) compared to entry-level branch SRX models?

Accepted Answer

Enterprise SRX models feature separation of control plane (RE) and data/security plane (SPC) hardware architecture. Enterprise-grade SRX models (SRX4100/4600/5400) use a hardware architecture that separates the control plane (Routing Engine) from the data/security plane (Services Processing Card/SPU), allowing independent scaling and higher throughput. Branch SRX models (300/320/380) typically integrate control and data plane functions into a single CPU/ASIC.

Answer

Enterprise SRX devices run ScreenOS instead of Junos OS

Answer

Branch SRX devices do not support security policies

Answer

Branch SRX models use modular SPCs while enterprise models use fixed ports

Question 15

You are troubleshooting an antispam deployment where legitimate emails from a trusted customer domain are intermittently marked as spam by the DNSBL provider. To permanently prevent this without disabling antispam for other traffic, what should you configure?

Accepted Answer

Create a local antispam permit object containing the customer's sender domain or IP address.. Local permit lists (whitelists) under antispam custom objects allow overriding DNSBL spam detections for trusted sender domains.

Answer

Disable DNSBL server queries globally across the SRX device.

Answer

Add the customer domain to the web-filtering custom override list.

Answer

Modify the security policy action from 'permit' to 'deny' for that specific source.

Question 16

An administrator implements Source NAT using a pool of IP addresses. To verify the operational status of the source NAT pool and see how many addresses and ports are currently in use, which operational command should be executed?

Accepted Answer

show security nat pool. The operational command 'show security nat pool' displays the status of all configured NAT pools, including the pool name, address range, and current utilization statistics such as the number of addresses and ports in use. This is the correct command to verify Source NAT pool operational status and utilization.

Answer

show system nat pool-utilization

Answer

show security flow pool-status

Answer

show route forwarding-table nat-pool

Question 17

An administrator suspects that a specific security policy is not being hit because traffic is being silently dropped by an earlier policy. Which feature should be enabled under security policies to generate a log entry whenever a session is created matching that policy?

Accepted Answer

configure security policies ... then { ... log { session-init; } }. Configuring 'log { session-init; }' under a security policy enables logging when a new session is created that matches that policy. This allows the administrator to confirm whether the policy is being hit and to detect silent drops by earlier policies.

Answer

configure security flow packet-log enable

Answer

configure security policies ... then { ... syslog alert; }

Answer

configure system syslog facility security packet-log

Question 18

What information does the 'show security flow session summary' command provide?

Accepted Answer

Total active session counts, resource usage, and protocol breakdown. 'show security flow session summary' provides a high-level overview of the session table, including the total number of active sessions, the number of sessions per protocol (TCP, UDP, ICMP), and resource usage statistics such as session table utilization. It does not list individual sessions or packet contents; that is done with 'show security flow session' without the 'summary' keyword.

Answer

Detailed packet contents for every active session

Answer

The complete list of source and destination IP addresses

Answer

Configured security policies

Question 19

An engineer needs to determine why IPsec Phase 1 negotiations are failing with a remote peer. Which traceoptions flag should be enabled under security ike?

Accepted Answer

set security ike traceoptions flag all. The correct command to enable traceoptions for IPsec Phase 1 (IKE) negotiations is `set security ike traceoptions flag all` under the `[edit security ike]` hierarchy. This flag captures all IKE-related events, including Phase 1 exchanges, proposals, and errors, which is essential for diagnosing why negotiations are failing. The other options either target the wrong hierarchy (IPsec or flow) or are not traceoptions commands at all.

Answer

set security ipsec traceoptions flag phase1

Answer

set system syslog facility local4

Answer

set security flow traceoptions flag ike

Question 20

What is the primary architectural advantage of dual-plane architecture found on enterprise-grade SRX Series Services Gateways?

Accepted Answer

It separates the Routing Engine (control plane) from the Security Processing Units (data plane) to ensure management stability.. Enterprise SRX gateways separate the Control Plane (RE) from the Data Plane (SPU), ensuring routing protocol stability and management access even under heavy traffic loads.

Answer

It provides redundant power supplies and hot-swappable fan trays for high availability.

Answer

It enables simultaneous execution of Junos OS and Linux kernel hypervisors.

Answer

It allows the device to act as both a layer 2 switch and layer 3 router simultaneously without licensing.