JNCIA-SEC Practice Test 22 — 15 Questions

Question 1

An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enabling AppID match criteria by specifying applications within the security policy.. AppID requires application identification to be integrated into the security policy match criteria, which can be accomplished by referencing specific applications or application sets.

Answer

Attaching a security screen profile to the DMZ zone.

Answer

Enabling stateless firewall filters on the egress interface.

Answer

Configuring global policies with an idle-timeout parameter.

Question 2

Which statement is true regarding Junos OS predefined applications?

Accepted Answer

Predefined applications simplify security policy creation by grouping port and protocol definitions for common services.. Junos comes with many built-in application definitions (prefixed with junos-) that identify standard protocols and ports.

Answer

Predefined applications can be edited to change their port mappings.

Answer

Predefined applications override user-defined custom applications if names collide.

Answer

Predefined applications require manual updates via separate software downloads every week.

Question 3

You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?

Accepted Answer

An application set containing both HTTP and HTTPS.. An application set allows grouping multiple applications for simplified policy administration.

Answer

An address book entry containing the web server IP addresses.

Answer

A global policy with a service term.

Answer

A security zone profile containing the protocols.

Question 4

You are configuring a branch SRX Series device and need to verify the software version and installed packages currently running. Which command should you execute?

Accepted Answer

show version. On Junos, the 'show version' command displays the software version, including the Junos OS release, the model, and the installed package suite. It is the standard command to verify the currently running software version and packages. This command provides a concise summary of the system's software state.

Answer

show os release

Answer

show chassis firmware

Answer

show system software status

Question 5

An administrator is troubleshooting a high-availability cluster issue where the secondary node unexpectedly transitions to 'Ineligible' state. Which command should the administrator run to check the cluster's redundancy group states and interface monitoring status?

Accepted Answer

show chassis cluster status. The command 'show chassis cluster status' provides real-time information on redundancy group states, node prioritization, and monitored interfaces.

Answer

show device-ha state

Answer

show redundancy group details

Answer

show security ha status

Question 6

An engineer is analyzing traffic flow mechanics on an SRX Series gateway. A TCP packet arrives that does not match any existing session in the session table. What is the immediate default action taken by the SRX flow module for this first packet?

Accepted Answer

A session is created in the session table, and the packet is processed against security policies.. When the first packet of a new session arrives, the SRX performs a route lookup, evaluates security policies, and if permitted, allocates a session entry in the session table before forwarding the packet.

Answer

The packet is immediately dropped by the screen check mechanism until a reverse flow is established.

Answer

The packet is forwarded transparently through the data plane, and the session table is updated only upon session termination.

Answer

The packet is punted to the Routing Engine for static route validation and ARP resolution before session creation.

Question 7

Which type of Junos OS address book entry is available to all security zones on the device without needing to be redefined?

Accepted Answer

Global address book. A global address book entry is accessible by security policies across all zones on the SRX device.

Answer

Zone-specific address book

Answer

Functional address book

Answer

Interface address book

Question 8

Which statement correctly identifies the purpose of Junos OS functional zones?

Accepted Answer

Functional zones are built-in system zones used to handle specific traffic types like management or host-bound traffic.. Functional zones in Junos OS are predefined, built-in system zones that handle specific traffic types such as management traffic (e.g., the 'junos-host' zone) and host-bound traffic. They are not user-created and serve a distinct purpose from security zones, which administrators define for network segmentation. The correct option accurately reflects that functional zones are system-defined and used for particular traffic categories, not for replacing policies or grouping servers.

Answer

Functional zones replace security policies for inter-VLAN routing.

Answer

Functional zones are created by administrators to group high-priority servers.

Answer

Functional zones allow unauthenticated guest access without security policies.

Question 9

Which statement is true regarding the default security zone behavior in Junos OS?

Accepted Answer

Traffic between different security zones is blocked by default.. By default, traffic between two different security zones is denied unless explicitly permitted by a security policy.

Answer

Traffic between different security zones is permitted by default.

Answer

Traffic destined for the routing engine is blocked unless security policies permit it.

Answer

Traffic between interfaces in the same security zone is blocked by default.

Question 10

What is the purpose of the 'then { permit; }' statement in a Junos security policy?

Accepted Answer

It allows matching traffic to create a session and pass through the security device.. The 'permit' action allows matching traffic to establish a session and pass through the firewall.

Answer

It permits the interface to come up in L3 routing mode.

Answer

It enables dynamic routing protocol updates across the zone boundary.

Answer

It allows administrative SSH access to the Junos routing engine.

Question 11

An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?

Accepted Answer

show security screen statistics. The 'show security screen statistics' command displays hit counts and drop counters for active screen options.

Answer

show security flow drop

Answer

show security zones statistics

Answer

show system screen violations

Question 12

Which TWO types of Network Address Translation (NAT) are supported on SRX Series gateways? (Choose two)

Accepted Answer

Destination NAT (DNAT). Destination NAT (DNAT) is correct because SRX Series gateways support destination NAT, which translates the destination IP address (and optionally port) of incoming packets, typically used for publishing internal servers to external networks. Source NAT (SNAT) is also correct because SRX Series gateways support source NAT, which translates the source IP address (and optionally port) of outbound packets, commonly used for hide NAT or interface NAT to allow internal hosts to access external networks. The other options are not valid NAT types: Quantum entanglement routing NAT, Analog modem frequency NAT, and Gravitational wave packet translation are fictitious and have no basis in Junos OS or SRX NAT configuration.

Answer

Quantum entanglement routing NAT

Answer

Analog modem frequency NAT

Answer

Gravitational wave packet translation

Question 13

You are deploying a vSRX Virtual Firewall on a KVM hypervisor. Which virtual disk image type is typically used to boot the vSRX instance containing the Junos OS software?

Accepted Answer

QCOW2 disk image file. The vSRX deployment package typically includes a qcow2 disk image format which serves as the virtual hard disk containing the Junos OS image.

Answer

VMDK snapshot container

Answer

RAW kernel binary

Answer

ISO image file

Question 14

Which TWO statements are correct regarding Junos security policies and their evaluation behavior? (Choose two.)

Accepted Answer

Security policies are evaluated sequentially from top to bottom within a zone pair.. Option A is correct because Junos security policies within a given zone pair are evaluated in a first-match, top-to-bottom order, so the first policy whose match criteria (source/destination addresses, applications, etc.) are satisfied is applied and subsequent policies are not evaluated. Option E is correct because when a policy permits traffic, Junos SRX creates a stateful session entry in the session table, allowing return traffic and subsequent packets of the same flow to bypass full policy re-evaluation. Option B is incorrect because Junos SRX has an implicit deny-all policy at the end of each zone pair, so unmatched traffic is dropped, not permitted. Option C is incorrect because global policies are evaluated after zone-specific policies, not before them. Option D is incorrect because security policies operate at Layers 3 and 4 (and above with application identification) and are inherently stateful, not Layer 2 only.

Answer

If no policy matches the traffic, it is permitted by default.

Answer

Global policies are evaluated before zone-based policies.

Answer

Security policies operate exclusively at Layer 2 without state tracking.

Question 15

An administrator enables security flow traceoptions to debug a packet drop. The log file shows the drop reason as "No session found; policy check failed". What is the most likely cause of this error?

Accepted Answer

The packet is the first packet of a new flow, and no matching security policy permits the traffic.. When a packet does not match an existing session, the SRX evaluates security policies. If no policy permits the traffic, a drop occurs with an explicit policy check failure message.

Answer

NAT pool exhaustion prevented session creation.

Answer

The session table is full and cannot allocate memory for a new session.

Answer

The packet belongs to an established TCP connection whose sequence number was invalid.