JNCIA-SEC Practice Test 23 — 15 Questions

Question 1

Which TWO statements are correct regarding Junos OS security zones? (Choose two)

Accepted Answer

Security zones are logical groupings of interfaces that share security policies.. Security zones group interfaces and enforce security policies. Every transit interface must belong to a zone.

Answer

Functional zones require manual IP address assignment before they can function.

Answer

Security zones are optional when configuring basic IP routing and firewall filters.

Answer

A physical interface can belong to multiple security zones simultaneously.

Question 2

Which UTM feature on Juniper SRX Series firewalls is designed to prevent malware and viruses from entering the network via HTTP or SMTP streams?

Accepted Answer

Antivirus. Antivirus is the UTM feature designed to detect and block malware and viruses.

Answer

Antispam

Answer

Web Filtering

Answer

Content Filtering

Question 3

Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)

Accepted Answer

Security policies reference address book objects to specify traffic match criteria.. Option D is correct because Junos security policies use address-book entries (named address objects such as 'trust-zone' or 'server1') as match criteria in the from/to fields to identify source and destination addresses for traffic classification. Option E is correct because address books let administrators define named objects that group one or more IP prefixes or ranges, so policies can reference the object name instead of hard-coded addresses, greatly simplifying updates and management. Option A is incorrect because address books are configured under the [edit security address-book] hierarchy (with global and zone-specific books), not under [edit firewall], which is used for firewall filters. Option B is incorrect because address books are only relevant to security policy and NAT matching on SRX devices; they are not required for routing operations. Option C is incorrect because Junos security policies can reference the global address book as well as zone-specific address books, not only zone-specific ones.

Answer

Address books are configured under the [edit firewall] hierarchy.

Answer

Address books are mandatory for all Junos routing operations.

Answer

Security policies cannot reference global address books, only zone-specific address books.

Question 4

You are troubleshooting a Destination NAT rule where traffic matching the rule is dropped. You run 'Traceoptions' for security flow and notice that the packet hits the destination NAT rule, translates successfully, but then fails. Examining the trace output reveals: 'No route found: 10.1.1.50 -> 0.0.0.0'. What is the underlying cause?

Accepted Answer

The routing table lacks a valid route to the post-translation internal IP address.. The trace message 'No route found: 10.1.1.50 -> 0.0.0.0' indicates that after destination NAT translated the packet to internal IP 10.1.1.50, the SRX could not find a route to forward the packet toward that address. This means the routing table lacks a valid route to the post-translation destination subnet, so the packet is dropped after successful NAT translation.

Answer

Proxy ARP is not enabled on the internal server interface.

Answer

The security policy is missing the pre-translation public IP address in the destination field.

Answer

The destination NAT pool port translation is misaligned with the server listening port.

Question 5

Which command displays the hardware temperature and environmental status of an SRX Series chassis?

Accepted Answer

show chassis environment. 'show chassis environment' is the standard Junos command that reports chassis environmental data including temperature, fan status, and power supply status on SRX Series devices. It directly answers the requirement to view hardware temperature and environmental status.

Answer

show system environment

Answer

show hardware status

Answer

show security environmental-status

Question 6

Which TWO statements are true regarding Junos OS global address books versus zone-specific address books? (Choose two)

Accepted Answer

Zone-specific address books take precedence over global address books for traffic originating from that zone.. Global address books apply across all zones, while zone-specific books apply primarily to their owning zone.

Answer

Zone-specific address books cannot contain address sets.

Answer

Zone-specific address books are mandatory; global address books are optional.

Answer

Global address books override zone-specific address books in all scenarios.

Question 7

You are configuring global security policies in Junos OS on an SRX Series device. Which statement is accurate regarding the evaluation order between zone-based policies and global policies?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies if no zone-based match occurs.. Junos OS evaluates zone-based policies before global security policies. If a zone-based policy matches, global policies are bypassed for that traffic flow.

Answer

Global policies are always evaluated before zone-based policies.

Answer

Global policies replace zone-based policies entirely when unified policies are enabled.

Answer

Global policies and zone-based policies are evaluated simultaneously in parallel.

Question 8

While troubleshooting a traffic drop between two security zones, an engineer wants to verify which security policy is matching a specific packet flow. Which command provides this troubleshooting capability?

Accepted Answer

show security policy match (source-ip) (destination-ip) (application). 'show security policy match' accepts source-ip, destination-ip, and application parameters and returns which security policy would match that specific flow. This is the purpose-built troubleshooting command for verifying policy selection without generating live traffic.

Answer

show firewall filter match

Answer

show security monitoring policy-match

Answer

test security policy evaluate

Question 9

You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?

Accepted Answer

Configuring security flow traceoptions to log packet processing details.. Security flow traceoptions allow administrators to trace packet processing through the security engine to see why a packet is dropped or which policy it matched.

Answer

Using 'ping' with the 'do-not-fragment' bit set.

Answer

Checking the system log file for routing protocol errors.

Answer

Running 'show firewall' to inspect interface filter counters.

Question 10

Which THREE components are mandatory when defining a standard zone-based security policy rule in Junos OS? (Choose three.)

Accepted Answer

Source zone. In Junos OS zone-based security policies, every rule must specify a from-zone (source zone) and a to-zone (destination zone) because the policy is evaluated within the context of a zone pair — this makes options A (Source zone) and B (Destination zone) mandatory. The third required element is the policy action, such as permit, deny, reject, or count, since a rule without an action cannot determine traffic handling — this makes option D (Policy action) mandatory. A predefined security screen profile (option C) is not required in a policy rule; screens are applied separately under the zone's screen configuration to protect against floods and malformed packets. Static NAT rule binding (option E) is also not part of a standard security policy rule; NAT is configured separately and referenced via NAT rules, not as a mandatory policy component.

Answer

A predefined security screen profile

Answer

Static NAT rule binding

Question 11

An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?

Accepted Answer

The zone-specific address book entry takes precedence.. Zone-specific address books take precedence over global address books when resolving address names for policies originating from that specific zone.

Answer

The global address book entry takes precedence.

Answer

Both entries are merged into a combined IP range.

Answer

Junos generates a compilation error due to duplicate names.

Question 12

During packet flow troubleshooting on an SRX Series device, an administrator uses security flow traceoptions with the flag 'packet'. What potential impact should the administrator be aware of before enabling this on a high-throughput production device?

Accepted Answer

It can cause high CPU utilization and rapidly fill up log storage due to massive logging volume.. Enabling security flow traceoptions with the 'packet' flag causes the device to log detailed information about every packet that matches the trace filter. On a high-throughput production device, this can generate an enormous volume of logs, leading to high CPU utilization and rapidly filling up log storage, potentially impacting device performance and causing loss of other logs.

Answer

It drops all transit traffic matching the trace filter.

Answer

It forces the device to reboot into single-user recovery mode.

Answer

It automatically disables all active security policies on the device.

Question 13

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

Accepted Answer

Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).. Hairpin NAT (also called NAT loopback or U-turn NAT) is required when internal hosts need to access an internal server via its public IP address. Without it, the destination NAT rule translates the public IP to the internal server IP, but the server's reply goes directly to the internal host's private IP, bypassing the SRX and causing the connection to fail because the source IP does not match the expected public IP. Hairpin NAT ensures that traffic from internal to internal via the public IP is also source-NATed so that return traffic flows back through the SRX.

Answer

Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.

Answer

Enable proxy ARP on the internal interface for the public destination IP address.

Answer

Configure a static route on the internal hosts pointing directly to the internal server IP.

Question 14

You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?

Accepted Answer

Address set. An address set allows grouping multiple individual addresses and ranges into a single logical object.

Answer

Security group

Answer

Address book

Answer

Prefix list

Question 15

You have multiple security policies configured within the context of a specific source and destination zone. A new requirement dictates that a specific subset of users must be denied access while everyone else in the same zone remains permitted. How should you order your security policies to achieve this without disrupting existing traffic?

Accepted Answer

Place the explicit deny policy for the specific subset of users above the general permit policy.. Junos security policies are evaluated top-down, first-match wins. To deny a specific subset while permitting everyone else in the same zone pair, the explicit deny policy for that subset must be placed above the general permit policy. This ensures the deny matches first for those users, while all other traffic falls through to the permit. Ordering is the key mechanism — no automatic sorting occurs.

Answer

Place the general permit policy above the deny policy and set the deny policy action to 'reject'.

Answer

Convert the policies to global policies and place them at the bottom of the evaluation list.

Answer

Use an address set to combine the users and rely on automatic policy sorting by IP prefix length.