JNCIA-SEC Practice Exam 4 — 20 Questions

Question 1

When troubleshooting performance degradation on an SRX Series device, which THREE operational commands help identify resource bottlenecks in the forwarding and control planes? (Choose three)

Accepted Answer

show chassis routing-engine. Checking system resources, forwarding plane CPU/memory, and session summary helps isolate resource bottlenecks.

Answer

show security alg status

Answer

show security policies summary

Question 2

An administrator is analyzing session table output using 'show security flow session' and notices a session in the 'NSRC' (NAT Source) state. What does this specific state indicate about the session?

Accepted Answer

The session is waiting for source NAT translation allocation to be completed.. Session states in the SRX flow table indicate the progress of session establishment and NAT processing. NSRC refers to source NAT processing stages.

Answer

The session has failed security screening checks and is dropped.

Answer

The session has been closed and is waiting for the TCP TIME-WAIT purge timer.

Answer

The packet is destined for the routing engine control plane.

Question 3

Which THREE Junos CLI configuration commands or hierarchies are correctly associated with defining Source, Destination, or Static NAT rule-sets? (Choose three)

Accepted Answer

set security nat source rule-set from zone . Correct hierarchies include source, destination, and static NAT rule-sets under security nat.

Answer

set security nat interface-rule-set <name>

Answer

set security nat global rule-set <name>

Question 4

An administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?

Accepted Answer

show security flow session destination-port 443. The show security flow session destination-port command allows filtering sessions based on destination port numbers.

Answer

show security policy match-port 443

Answer

show route protocol bgp port 443

Answer

show firewall filter port 443

Question 5

An administrator needs to verify whether source NAT pool addresses are being exhausted. Which command should they execute?

Accepted Answer

show security nat source pool. The show security nat source pool command displays pool utilization statistics and active allocation counts.

Answer

show route pool-address

Answer

show security translation pool-exhaustion

Answer

show security flow pool-status

Question 6

Which command confirms whether the Security Intelligence (SecIntel) feeds or threat feeds are actively updating on an SRX device?

Accepted Answer

show security intelligence status. Security intelligence status is checked using show security intelligence status.

Answer

show firewall intelligence-status

Answer

show system threat-feeds

Answer

show security threat-feed active

Question 7

Which command displays the hardware temperature and environmental status of an SRX Series chassis?

Accepted Answer

show chassis environment. The show chassis environment command displays temperatures, power supplies, and fan status.

Answer

show system environment

Answer

show hardware status

Answer

show security environmental-status

Question 8

Which TWO commands provide system-level resource utilization data on an SRX Series device? (Choose two)

Accepted Answer

show chassis environment. System resource utilization is checked via system processes and chassis environment/hardware commands.

Answer

show route summary

Answer

show security flow session summary

Answer

show security policies summary

Question 9

An engineer wants to view active security associations (SAs) for an IPsec VPN tunnel to troubleshoot connectivity. Which command should be used?

Accepted Answer

show security ipsec security-associations. IPsec security associations are managed by Internet Key Exchange (IKE) and IPsec security services. The show security ipsec security-associations command lists active IPsec SAs.

Answer

show vpn status

Answer

show securityvpn tunnels

Answer

show security ike security-associations

Question 10

An administrator suspects that a specific security policy is not being hit because traffic is being silently dropped by an earlier policy. Which feature should be enabled under security policies to generate a log entry whenever a session is created matching that policy?

Accepted Answer

configure security policies ... then { ... log { session-init; } }. To log when a session is created or closed, administrators configure session logging options within the security policy configuration.

Answer

configure security flow packet-log enable

Answer

configure security policies ... then { ... syslog alert; }

Answer

configure system syslog facility security packet-log

Question 11

You need to verify whether application identification (AppID) is successfully classifying traffic within security policies. Which command displays AppID session details?

Accepted Answer

show security flow session extensive. The show security alg status or show security flow session extensive commands show application details associated with active sessions.

Answer

show application-firewall status

Answer

show security policies app-id-hits

Answer

show security app-tracking summary

Question 12

Which command allows an administrator to view system log files directly from the Junos CLI?

Accepted Answer

show log messages. The file show command or reviewing logs via log file viewing commands is standard. Specifically, 'show log <filename>' is used.

Answer

view log file

Answer

read log system

Answer

display system log

Question 13

Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)

Accepted Answer

Security policies reference address book objects to specify traffic match criteria.. Security policies use address book objects to define match criteria for source and destination traffic.

Answer

Address books are configured under the [edit firewall] hierarchy.

Answer

Address books are mandatory for all Junos routing operations.

Answer

Security policies cannot reference global address books, only zone-specific address books.

Question 14

Which THREE parameters can be used to filter output when executing the 'show security flow session' command? (Choose three)

Accepted Answer

destination-prefix. Session display can be filtered by source prefix, destination prefix, and destination port.

Answer

chassis-slot

Answer

routing-engine-core

Question 15

An administrator configures traceoptions for security policies. Where can they find the resulting log output file?

Accepted Answer

/var/log/. Security policy traceoptions log files are written by default to /var/log/ directory on the Routing Engine.

Answer

/config/trace/

Answer

/tmp/

Answer

/var/db/

Question 16

When troubleshooting a high CPU condition caused by security processing, which command helps identify which traffic flows or features are consuming resources?

Accepted Answer

show security flow statistics. The show security flow statistics and show security monitoring commands help understand flow processing loads.

Answer

show system cpu-accounting

Answer

show firewall filter cpu-usage

Answer

show security packet-processing load

Question 17

Which THREE parameters are typically included in security flow traceoptions output when troubleshooting dropped packets? (Choose three)

Accepted Answer

Packet reception and interface context. Flow traceoptions capture packet reception, policy lookup results, session allocation, and drop reasons.

Answer

Chassis power supply voltage levels

Answer

BGP AS path recomputation steps

Question 18

You need to perform packet capture on an SRX Series device to analyze suspicious traffic hitting an interface. Which built-in Junos utility should you use?

Accepted Answer

monitor traffic interface ge-0/0/0. Junos provides packet capture capabilities using the monitor traffic command.

Answer

show security packet-capture interface

Answer

request diagnostic capture start

Answer

start shell tcpdump -i ge-0/0/0

Question 19

An administrator needs to verify whether IDP (Intrusion Detection and Prevention) is actively inspecting traffic. Which operational command should be used?

Accepted Answer

show security idp status. The show security idp status command displays IDP engine status, policy loading, and packet inspection statistics.

Answer

show idp policy active

Answer

show security flow idp-stats

Answer

show firewall idp-inspection

Question 20

Which TWO factors are important when analyzing session table exhaustion issues on an SRX Series firewall? (Choose two)

Accepted Answer

Identifying top sources or application types generating high session volumes. Session table exhaustion troubleshooting involves examining max-sessions limits and identifying top session creators/attack sources.

Answer

Checking interface cable physical integrity

Answer

Verifying BGP route convergence timers

Answer

Inspecting NTP time synchronization accuracy