JNCIA-SEC Practice Test 24 — 15 Questions

Question 1

An administrator configures Antispam inspection, but wants to ensure that emails from internal trusted hosts bypass antispam scanning. How should this be handled?

Accepted Answer

Add the trusted internal hosts or sender domains to the antispam custom permit list.. Antispam policies and custom objects allow defining local permit lists for trusted hosts or domains.

Answer

Disable security policies for internal traffic.

Answer

Attach the antispam profile to the egress interface instead of the ingress policy.

Answer

Configure source NAT to hide internal host IP addresses.

Question 2

An administrator needs to verify whether ALG (Application Layer Gateway) for FTP is currently enabled and active on an SRX device. Which command should be used?

Accepted Answer

show security alg status. The command 'show security alg status' displays the status (enabled or disabled) of all ALGs, including FTP, on the SRX device. This directly answers whether the FTP ALG is currently active.

Answer

show security alg ftp statistics

Answer

show system alg

Answer

show security flow alg

Question 3

An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?

Accepted Answer

Packets with both SYN and FIN flags set. The tcp-drop-synfin-set SCREEN option drops TCP packets that have both the SYN and FIN flags set simultaneously, which is an invalid state often used in scanning.

Answer

Packets where the SYN flag is set and the sequence number is zero

Answer

TCP packets with zero window size and FIN set

Answer

Packets with SYN and ACK flags set without an initial SYN

Question 4

Which THREE services can be enabled under host-inbound-traffic system-services in Junos OS security zones? (Choose three)

Accepted Answer

ping. System services for host-inbound traffic include ping, ssh, https, snmp, etc.

Answer

ospf

Answer

bgp

Question 5

You are configuring a vSRX Virtual Firewall in a private cloud. Which virtual interface type is typically used for management traffic in a vSRX deployment?

Accepted Answer

fxp0. In a vSRX deployment, the fxp0 interface is the out-of-band management interface, used for management traffic such as SSH, SNMP, and Junos OS upgrades. It is separate from data plane interfaces.

Answer

st0

Answer

lo0

Answer

reth0

Question 6

You need to verify whether application identification (AppID) is successfully classifying traffic within security policies. Which command displays AppID session details?

Accepted Answer

show security flow session extensive. 'show security flow session extensive' displays detailed session information including the application identified by AppID, nested applications, and classification details. It is the correct command to verify whether AppID is successfully classifying traffic.

Answer

show application-firewall status

Answer

show security policies app-id-hits

Answer

show security app-tracking summary

Question 7

Where are address books defined when configuring zone-based security policies in Junos OS?

Accepted Answer

At the global security hierarchy or within individual security zones.. Address books in Junos security policies can be defined at two levels: globally under the [edit security address-book] hierarchy, or within individual security zones under [edit security zones security-zone <zone-name> address-book]. This allows for both centralized and zone-specific address management. Global address books are available to all zones, while zone-specific address books are only usable within policies involving that zone.

Answer

Only under the system services configuration menu.

Answer

Inside the interface configuration stanza for each physical port.

Answer

Exclusively within the routing-options hierarchy.

Question 8

An enterprise network has multiple virtual routers configured within separate routing instances. How do security policies interact with traffic passing between two different routing instances on the same SRX device?

Accepted Answer

Security zones and policies are evaluated when traffic crosses between routing instances if the interfaces belong to different security zones.. Traffic between different routing instances must traverse security zones and policies, and interfaces in each instance must be assigned to appropriate zones.

Answer

Routing instances handle all security enforcement natively without policy intervention.

Answer

Security policies are completely bypassed for traffic within the same physical device regardless of routing instances.

Answer

Only global policies apply to multi-instance routing environments.

Question 9

An enterprise network uses a vSRX deployed on a hypervisor. The administrator needs to allocate additional vCPUs to improve throughput. Which component's performance is primarily enhanced by increasing vCPUs on a vSRX?

Accepted Answer

Virtual Forwarding Plane (vFP) data path processing. In a vSRX, the Virtual Forwarding Plane (vFP) utilizes the allocated vCPUs for packet processing and security forwarding performance.

Answer

CLI responsiveness and SSH login speed

Answer

Junos Space management communication

Answer

Virtual Routing Engine (vRE) control plane convergence

Question 10

An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?

Accepted Answer

Functional zone. A functional zone, specifically the management zone, is used for traffic destined for the routing engine via the management interface.

Answer

Untrusted zone

Answer

Transit zone

Answer

Security zone

Question 11

Which TWO factors contribute to policy shadowing in Junos security policy evaluation? (Choose two.)

Accepted Answer

Incorrect policy ordering within the policy list.. Option D is correct because Junos evaluates security policies top-down within a policy list and stops at the first match, so incorrect policy ordering (placing a more specific rule after a more general one) causes the later rule to be shadowed and never evaluated. Option E is correct because when an earlier policy uses broader match criteria such as 'any' source or destination, it encompasses the traffic that a later, more specific policy was intended to match, so that later policy is effectively shadowed and never hit. Option A is incorrect because global policies are simply evaluated in a separate global policy list before zone-based policies; using them does not by itself cause shadowing within a policy list. Option B is incorrect because assigning multiple IP addresses to a single zone interface is a valid configuration and does not affect policy evaluation order or cause shadowing. Option C is incorrect because stateful inspection timeout values affect session aging and teardown behavior, not the top-down matching logic that produces policy shadowing.

Answer

Using global policies instead of zone-based policies.

Answer

Assigning multiple IP addresses to a single security zone interface.

Answer

Enabling stateful inspection timeout values.

Question 12

You are troubleshooting a session-based firewall configuration on an SRX Series device. An application establishes a control connection on one port, but dynamically negotiates a secondary data port for file transfers. Without configuring an explicit policy for the secondary dynamic port, what Junos feature enables the security policy to dynamically permit this secondary data flow?

Accepted Answer

Application Layer Gateways (ALGs). Application Layer Gateways (ALGs) are the Junos feature that enables security policies to dynamically permit secondary data flows for protocols that negotiate additional ports, such as FTP, SIP, and H.323. The ALG inspects the control connection, extracts the dynamically negotiated port information from the payload, and automatically opens a pinhole for the data connection without requiring an explicit policy for that secondary port. This is essential for protocols where the data port is not known in advance.

Answer

Unified Security Policy Framework

Answer

Advanced Policy-Based Routing (APBR)

Answer

Global Policy Fallback

Question 13

When analyzing security policy behavior and troubleshooting traffic drops, which TWO commands are most helpful for verifying policy matches and active sessions? (Choose two)

Accepted Answer

show security flow session. Option A, `show security flow session`, is correct because it displays the active session table, including source/destination addresses, ports, protocol, and the policy that permitted each flow, which is essential for confirming whether traffic is actually being matched and forwarded or dropped. Option C, `show security policy match`, is correct because it lets you test a specific source, destination, and service tuple against the policy set to see exactly which policy would match (or that no policy matches), directly verifying policy-match behavior during troubleshooting. Option B, `show security ike`, only shows IKE phase 1/2 security associations and is relevant to VPN negotiation, not general policy matching or session verification. Option D, `show system alarms`, reports chassis/system alarm conditions and does not reveal policy matches or session state. Option E, `show firewall filter`, displays stateless firewall filter (ACL) configuration/counters, which is unrelated to stateful policy match and session lookup on a Juniper SRX-style device.

Answer

show security ike

Answer

show system alarms

Answer

show firewall filter

Question 14

Which Junos CLI command allows an administrator to verify the active hit count and packet match statistics for a specific security policy?

Accepted Answer

show security policies hit-count. 'show security policies hit-count' displays the per-policy hit counters, showing how many packets/sessions matched each security policy. This directly answers the need to verify active hit count and match statistics for a specific policy.

Answer

show firewall filter statistics

Answer

show security flow session statistics

Answer

show security monitoring policies

Question 15

What is the primary function of the Integrated Web Filtering feature on Juniper SRX Series firewalls?

Accepted Answer

To categorize URLs and enforce access control based on website categories.. Integrated Web Filtering categorizes websites and allows administrators to enforce access policies.

Answer

To scan email attachments for virus payloads.

Answer

To inspect DNS queries for cache poisoning attacks.

Answer

To enforce user authentication passwords.