JNCIA-SEC Practice Test 21 — 15 Questions

Question 1

You are configuring UTM antivirus on an SRX Series firewall. The security team wants the device to scan SMTP traffic for malicious attachments while allowing POP3 downloads to bypass scanning for performance reasons. Which configuration step is required to apply the antivirus profile only to SMTP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the antivirus profile under the [edit security utm] hierarchy and then reference it in a UTM policy that is applied to a security policy matching only SMTP traffic.. Antivirus profiles on SRX Series devices are defined under the security utm hierarchy and must be associated with a UTM policy. The UTM policy is then applied to a security policy that matches the desired traffic. To scan only SMTP, the security policy must match SMTP applications or ports, ensuring POP3 is not inspected. This modular approach allows granular control over which traffic receives content security inspection.

Answer

Create a custom application signature for SMTP and bind the antivirus profile to that signature.

Answer

Enable antivirus scanning globally under [edit security utm global-options] and exclude POP3 by adding a destination-port exception.

Answer

Configure the antivirus profile directly on the SMTP server's interface as an input filter.

Question 2

Which statement correctly describes the order in which Junos security policies are evaluated on an SRX Series device?

Accepted Answer

Policies are evaluated from the top to the bottom of the policy list, and the first match is applied.. Junos security policies are evaluated from top to bottom, and the first policy that matches all criteria is applied. This first-match behavior means that policy order determines which policy takes effect, so more specific policies should be placed above general ones.

Answer

Policies are evaluated based on the specificity of the source and destination addresses, with more specific policies taking precedence.

Answer

Policies are evaluated in random order, and the action of the first matching policy is applied.

Answer

Policies are evaluated from the bottom to the top of the policy list, and the first match is applied.

Question 3

A security administrator wants to view the current status of all security zones on an SRX Series device, including which interfaces are bound to each zone and whether the zones are active. Which command should the administrator use?

Accepted Answer

show security zones. The operational command 'show security zones' is designed to present security zones together with their assigned interfaces and current status. Configuration-focused commands show what was configured but not the live state, and interface or flow status commands lack the zone-centric perspective. For a quick verification of zone membership and activity, the security zones operational command is the appropriate choice.

Answer

show security flow status

Answer

show configuration security zones

Answer

show interfaces terse

Question 4

You are investigating why a specific security policy is not matching traffic from a trusted source to a web server. You suspect the policy order or zone context is incorrect. Which command displays the effective policy lookup for a given source and destination, including the policy that ultimately matches or denies the flow?

Accepted Answer

show security match-policies. The show security match-policies command is designed to simulate the policy lookup for a given set of flow parameters. By specifying source and destination addresses, ports, and protocol, you can see exactly which security policy would be applied or if the traffic would be denied. This directly addresses the need to diagnose why a policy is not matching, as it reveals the effective policy decision without requiring live traffic.

Answer

show security policies hit-count

Answer

show security flow session

Answer

show security policies detail

Question 5

Which UTM feature on an SRX Series firewall is designed to inspect and block malicious attachments in email traffic?

Accepted Answer

Antivirus. Antivirus is the UTM feature specifically designed to scan for and block malware, including viruses and malicious attachments in email traffic. It uses a signature database to detect known threats and can be applied to email protocols such as SMTP, POP3, and IMAP. Antispam, content filtering, and web filtering serve different purposes and do not provide malware scanning.

Answer

Content Filtering

Answer

Antispam

Answer

Web Filtering

Question 6

An administrator needs to verify that the SRX Series device is receiving and processing traffic on a specific interface. Which command provides real-time interface statistics, including input and output packet counts and errors?

Accepted Answer

show interfaces <interface-name> extensive. The show interfaces extensive command is the correct choice because it provides comprehensive operational and statistical information for a specific interface, including packet and byte counts, error counters, and queue statistics. This allows the administrator to confirm that the interface is receiving and processing traffic and to identify any errors. The other commands either show session information, configuration, or zone assignments, none of which provide the required real-time interface statistics.

Answer

show security zones

Answer

show configuration interfaces <interface-name>

Answer

show security flow session interface <interface-name>

Question 7

A security administrator is troubleshooting a UTM content filtering issue where legitimate business websites are being blocked. The administrator suspects that a custom URL pattern list is incorrectly matching these sites. Which command should be used to view the currently loaded custom URL pattern lists and their entries?

Accepted Answer

show security utm custom-objects. The 'show security utm custom-objects' command is used to display all UTM custom objects, including custom URL pattern lists and their entries. This allows the administrator to review the patterns and identify any that might be incorrectly blocking legitimate websites.

Answer

show security utm profile

Answer

show security utm content-filtering statistics

Answer

show security utm url-filtering

Question 8

An administrator wants to create an address book entry for a subnet 192.168.1.0/24 and another for a single host 192.168.1.10. Both should be available globally across all zones. Which configuration achieves this?

Accepted Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10/32. Global address books are configured under [edit security address-book global] and are accessible from all zones. Each address must include a prefix length; for a single host, use /32. The correct configuration creates both entries in the global address book with proper syntax. Zone-specific address books would not be global.

Answer

set security zones security-zone trust address-book address subnet1 192.168.1.0/24; set security zones security-zone trust address-book address host1 192.168.1.10/32

Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10/24

Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10

Question 9

A network administrator is configuring a new security zone on an SRX Series device and wants to assign a logical interface to it. The interface is already configured with an IP address and is currently unassigned to any zone. Which configuration statement correctly assigns the interface ge-0/0/1.0 to the zone named TRUST?

Accepted Answer

set security zones security-zone TRUST interfaces ge-0/0/1.0. To assign an interface to a security zone in Junos OS, the correct hierarchy is [edit security zones security-zone <name>] and the statement is 'set security zones security-zone TRUST interfaces ge-0/0/1.0'. The interface must be a logical unit and must not already belong to another zone. This binding enables the zone to apply security policies, screen options, and other zone-specific configurations.

Answer

set security zones security-zone TRUST interfaces ge-0/0/1

Answer

set security zone TRUST interface ge-0/0/1.0

Answer

set interfaces ge-0/0/1.0 zone TRUST

Question 10

A network engineer is configuring a custom application on an SRX Series device to match a proprietary protocol that uses UDP port 5000 and requires a timeout of 300 seconds. The engineer also needs to ensure that the application can be used in a security policy. Which configuration statement is required to define this custom application?

Accepted Answer

set applications application my-app protocol udp destination-port 5000 inactivity-timeout 300. A custom application in Junos OS is defined under the applications hierarchy and must specify the protocol, destination port, and optionally an inactivity timeout. The command using protocol udp, destination-port 5000, and inactivity-timeout 300 correctly matches the proprietary protocol's characteristics. The inactivity-timeout controls how long the session remains open when no traffic is sent, which is crucial for UDP-based applications that lack session state. The other options contain incorrect keywords or wrong protocol/port parameters.

Answer

set applications application my-app protocol udp source-port 5000 timeout 300

Answer

set applications application my-app protocol udp destination-port 5000 session-timeout 300

Answer

set applications application my-app protocol tcp destination-port 5000 inactivity-timeout 300

Question 11

An administrator wants to ensure that specific text strings (such as credit card numbers or restricted keywords) found in HTTP web traffic are blocked. Which UTM feature should be configured?

Accepted Answer

Content Filtering. Content filtering supports searching for specific text strings within payload streams.

Answer

Integrated Web Filtering

Answer

AppSecure AppID

Answer

Antivirus

Question 12

An administrator is defining a custom application in Junos OS to match a proprietary protocol that uses both TCP and UDP on different ports. The application must be referenced in a security policy. Which TWO statements are true about custom application definitions in Junos OS? (Choose two.)

Accepted Answer

A custom application can specify multiple protocols and port ranges within a single application definition.. Custom applications in Junos OS can include multiple protocols and port ranges, and they can specify a custom session timeout. These features allow for precise matching of complex protocols. They are not required to have an application-protocol statement, and they are scoped to the virtual router in which they are defined. Thus, the two true statements are that multiple protocols and port ranges are allowed, and that a timeout can be configured.

Answer

A custom application can only match on a single destination port, not a port range.

Answer

Custom applications are automatically shared across all virtual routers on the device.

Answer

A custom application must include an application-protocol statement to be valid.

Question 13

An administrator notices that traffic between two trusted security zones is being dropped unexpectedly. Which command should be used first to verify if the security policy is matching the traffic?

Accepted Answer

show security policies hit-count. The show security policies hit-count command displays the number of times a specific security policy has matched traffic, confirming if the policy evaluation is occurring as expected.

Answer

show system alarms

Answer

show security flow session

Answer

show route

Question 14

A network engineer is configuring an SRX Series device with multiple security zones. The engineer wants to ensure that traffic from the trust zone to the untrust zone is inspected by a specific application firewall rule that matches HTTP traffic on port 8080. However, the engineer notices that the traffic is not being inspected. Which action should be taken to resolve this issue?

Accepted Answer

Ensure that the custom application for HTTP on port 8080 is defined and referenced in both the security policy and the application firewall rule.. Application firewall inspection requires that the traffic be permitted by a security policy that references the same custom application that defines the port and protocol. Additionally, the application firewall rule must reference that application or application-set. If either reference is missing, the traffic may pass without inspection. Therefore, ensuring the custom application for port 8080 is defined and referenced in both places is the correct resolution.

Answer

Modify the application firewall rule to match the predefined junos-http application instead of a custom application.

Answer

Apply a screen profile to the untrust zone that includes the tcp-syn-fin option to detect HTTP traffic on port 8080.

Answer

Change the security policy to use the predefined application junos-http and set the destination port to 8080 in the policy match condition.

Question 15

An administrator troubleshooting intermittent traffic drops on an SRX Series device runs show security flow session and notices that a session for a TCP flow shows the timeout value counting down while packets continue to arrive. The administrator wants to confirm whether the session is being torn down because of session timeout handling or because of a policy or resource issue. Which command provides the clearest evidence of session aging behavior?

Accepted Answer

show security flow session extensive. To determine whether a session is being removed by normal timeout aging or by an abnormal condition, the administrator needs per-session detail rather than aggregate counters or policy hit counts. The extensive form of the flow session command surfaces timeout values and session flags for the specific flow, giving the clearest evidence of aging behavior and teardown cause.

Answer

show security policies hit-count

Answer

show security flow statistics

Answer

show security zones