JNCIA-SEC Practice Test 25 — 15 Questions

Question 1

Which TWO components are fundamental parts of the SRX Series architecture in enterprise-class hardware models? (Choose two)

Accepted Answer

Routing Engine (RE). The Routing Engine (RE) (A) is a fundamental component of the SRX Series architecture in enterprise-class hardware models, as it runs Junos OS, handles control-plane functions such as routing protocols, management, and system configuration, and is separate from the data plane. The Security Processing Card (SPC) / IOC (B) is also fundamental because it provides the data-plane processing for security services like firewall inspection, IPsec, NAT, and other flow-based features in enterprise SRX chassis-based platforms. Options C, D, and E are not part of the SRX enterprise hardware architecture: an integrated ADSL modem chip is a WAN access component found in some branch/residential gateways, not a core SRX enterprise architecture element; a floppy disk drive controller is obsolete and unrelated to SRX design; and a Token Ring interface controller is a legacy LAN technology that SRX platforms do not use.

Answer

Integrated ADSL modem chip

Answer

Floppy disk drive controller

Answer

Token Ring interface controller

Question 2

An administrator configures application-based security policies (AppID) on an SRX device. During traffic analysis, they notice that the initial packets of a session are matched against standard port-based policies before AppID determines the specific application. What mechanism explains this behavior?

Accepted Answer

AppID inspects traffic mid-stream after initial session establishment and classification, potentially triggering a policy action change.. AppID on SRX uses a two-phase classification model: the first packet(s) of a session are matched against the initial policy (often port/protocol-based), and once AppID identifies the application via signature inspection, the session may be re-evaluated and the policy action can change. This is why admins see initial packets hit port-based policies before AppID takes over.

Answer

AppID drops all packets until the full file transfer is complete.

Answer

AppID operates entirely in the Routing Engine and bypasses the forwarding plane.

Answer

AppID requires manual application signature compilation via CLI commit.

Question 3

You want to create an address set that combines two address sets and one individual IP address object. Is this supported in Junos OS?

Accepted Answer

Yes, address sets can contain a mix of individual address objects and other address sets.. Address sets can contain both individual address objects and other address sets.

Answer

No, an address set can contain either address objects or address sets, but never both.

Answer

Yes, but only if defined within the global address book, not zone-specific address books.

Answer

No, nested address sets are mutually exclusive with individual address objects.

Question 4

Which command displays the configured security policies in Junos OS?

Accepted Answer

show security policies. The operational command 'show security policies' displays the currently active security policies.

Answer

show security zones policies

Answer

show firewall policies

Answer

show configuration policies

Question 5

Which Junos configuration hierarchy is used to define Destination NAT rule-sets?

Accepted Answer

set security nat destination rule-set. Destination NAT rule-sets are defined under the 'security nat destination' hierarchy. The correct syntax is 'set security nat destination rule-set <name>'. This hierarchy allows configuration of rules that translate the destination IP address and/or port of incoming packets.

Answer

set security policies destination-nat

Answer

set security nat rule-set destination

Answer

set security nat-policy destination

Question 6

A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?

Accepted Answer

Port exhaustion has occurred because all available source ports for the single translation IP are in use.. With pool-based Source NAT using PAT, all sessions from the trust zone are translated to the single public IP in the pool, and each session consumes a unique source port from that IP. When concurrent sessions exceed the available port range (approximately 64,000 minus reserved ports), new sessions cannot be allocated a translation port, causing intermittent failures and sessions stuck in a closing state as they age out.

Answer

The security policy action is set to permit instead of translating, causing port reuse collisions.

Answer

The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.

Answer

Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.

Question 7

An administrator configures Web Filtering with a custom block message. When users visit a blocked site, they do not see the custom message; instead, they receive a generic browser connection error. What is the most likely cause of this behavior?

Accepted Answer

SSL proxy (HTTPS decryption) is not configured to inspect and inject the block page for HTTPS traffic.. When browsing via HTTPS, if the firewall attempts to inject a block page without SSL proxy (SSL initiation/decryption) enabled, the browser rejects the invalid certificate or connection reset, causing a generic browser error.

Answer

The browser cache needs to be cleared.

Answer

The web filtering license has expired.

Answer

The default action must be set to 'log' instead of 'block'.

Question 8

An administrator notices that traffic matching a specific security policy is being dropped, and the log shows 'RTR_UNREACHABLE'. Where in the SRX packet flow sequence does this drop typically occur?

Accepted Answer

During the route lookup stage following session creation or policy evaluation. When the SRX attempts to forward a packet and finds no valid route in the forwarding table, a routing lookup failure occurs after the policy check.

Answer

During initial screen option validation

Answer

During application identification (AppID) inspection

Answer

During NAT pool allocation

Question 9

Which TWO methods can be used to back up or export the running configuration of an SRX Series device? (Choose two)

Accepted Answer

Using 'file copy' to transfer configuration files via SCP to a remote server.. Option A is correct because the 'file copy' command on Junos OS can transfer files such as configuration backups to a remote server using SCP, which securely copies the running configuration file (e.g., /config/juniper.conf.gz) over SSH. Option B is correct because 'show | display set' renders the entire configuration as a series of 'set' commands that can be selected and copied as text, providing a portable, human-readable export of the running configuration. The remaining options are not valid backup methods: C describes a parallel printer connection that SRX devices do not use for configuration export, D is a nonsensical shipping procedure rather than a technical backup method, and E involves physically desoldering or removing the internal flash/CPU chip, which is destructive and not a supported or practical way to back up a configuration.

Answer

Printing configuration via a dot-matrix parallel printer cable.

Answer

Mailing the device chassis to Juniper support for backup.

Answer

Physical removal of the internal CPU chip to read flash memory.

Question 10

When configuring an Integrated Web Filtering profile, you want to ensure that URLs categorized as 'Malware' or 'Phishing' are blocked immediately, while URLs categorized as 'Streaming Media' generate a log entry but are permitted. How should you configure this in Junos?

Accepted Answer

Assign 'block' action to Malware and Phishing categories, and 'permit' with logging enabled to Streaming Media.. Integrated Web Filtering (IWF) on Junos SRX uses the Juniper ATP Cloud (Sky ATP) category-based URL database, and each category can be assigned its own action (block, permit, log-and-permit, quarantine, user-block). To block Malware and Phishing while allowing Streaming Media with visibility, you set the action to 'block' for the two threat categories and 'permit' with logging enabled for Streaming Media. This is done inside the UTM feature-profile web-filtering profile, not via AppSecure or content filtering.

Answer

Configure AppSecure to block malware and allow streaming media.

Answer

Assign a global block action and create bypass exceptions for streaming media.

Answer

Use content filtering to block malware URLs and web filtering for streaming media.

Question 11

You are auditing a Junos security deployment where multiple NAT types (Destination, Source, Static) and security policies are configured. Which THREE troubleshooting actions or tools should be used to isolate NAT translation failures? (Choose three)

Accepted Answer

Enable security flow traceoptions to log detailed packet matching and NAT translation execution steps.. Option C is correct because security flow traceoptions (configured under [edit security flow traceoptions] with flags such as basic-datapath, packet-drops, and nat) log the detailed packet-matching and NAT translation steps, which is the most granular way to see exactly where a NAT lookup or rule match fails. Option D is correct because 'show security nat rule-set' displays each rule-set and rule with hit counters, letting you confirm whether the traffic is actually matching the intended destination, source, or static NAT rule rather than falling through to another rule or no rule. Option E is correct because 'show security flow session' reveals the pre-NAT and post-NAT addresses and ports (and the NAT translation type) for established sessions, which quickly shows whether translation occurred and how it was applied. Option A is not appropriate because 'request system factory-default' resets the entire device to factory configuration, destroying the NAT and policy configuration instead of diagnosing it. Option B is not appropriate because 'clear route table inet.0' flushes the IPv4 forwarding table, which disrupts traffic and does not address NAT rule matching or translation logic.

Answer

Use 'request system factory-default' to clear NAT errors.

Answer

Use 'clear route table inet.0' to reset all IP forwarding paths during NAT lookup failures.

Question 12

Which command is used to display the currently active security policies on a Junos device?

Accepted Answer

show security policies. The command 'show security policies' displays the currently active security policies on a Junos device, including their order, match conditions, and actions. This is the primary command for viewing policy configuration and status.

Answer

show security zones

Answer

show firewall filter

Answer

show system security status

Question 13

You suspect that asymmetrical routing is causing packets to be dropped by the Junos security session handler. Which command allows you to view detailed session information, including the expected and received packet direction and interface?

Accepted Answer

show security flow session detail. The command 'show security flow session detail' provides in-depth session information, including the expected and received packet direction and interface. This is crucial for diagnosing asymmetrical routing, as it shows if packets are arriving on the wrong interface or in the wrong direction. The detail option includes fields like 'Incoming interface' and 'Outgoing interface' for both directions, allowing you to verify session symmetry.

Answer

show security flow session summary

Answer

show security flow node 0 session

Answer

show security flow session interface

Question 14

Which TWO actions can be taken when an email message is identified as spam by an Antispam profile on an SRX Series firewall? (Choose two.)

Accepted Answer

Block the message. On an SRX Series firewall, when an Antispam profile detects a message as spam, the firewall can take the action of blocking the message (option B), which drops or rejects the offending email so it is not delivered to the recipient. It can also log the event (option D), generating a log entry that records the spam detection for monitoring, auditing, and troubleshooting via the configured logging or syslog facilities. These two actions are the standard configurable responses within the Antispam profile's action settings. Option A (rebooting the mail server via SNMP) is not an SRX Antispam action and would be an inappropriate, disruptive network management operation. Option C (automatically encrypting the email payload) is not a spam-handling action and is unrelated to Antispam profile behavior. Option E (deleting the user mailbox on the mail server) is a mail-server administrative task, not an action the SRX firewall performs when classifying a message as spam.

Answer

Reboot the mail server via SNMP

Answer

Automatically encrypt the email payload

Answer

Delete the user mailbox on the mail server

Question 15

Which TWO actions can be specified in the 'then' statement of a Junos security policy? (Choose two.)

Accepted Answer

reject. In a Junos security policy, the 'then' statement defines the action taken when traffic matches the policy's 'from' criteria, and the valid terminating actions include permit (option C) and reject (option B). 'Permit' allows the matching traffic to pass through the device and is the standard accept action, while 'reject' blocks the traffic and sends a TCP RST or ICMP unreachable message back to the source, making both correct for the 'then' clause. The other options are not valid security policy actions: 'bridge' and 'switched-vlan' are Layer 2 forwarding constructs used in bridging or VLAN contexts, not security policy 'then' actions, and 'route-via' is not a Junos security policy action (routing decisions are handled by the routing table and forwarding options, not by a security policy 'then' statement).

Answer

bridge

Answer

switched-vlan

Answer

route-via