JNCIA-SEC Practice Test 2 — 25 Questions

Question 1

An administrator is configuring a chassis cluster on two SRX Series devices. Which THREE requirements must be met to ensure proper cluster formation and stability? (Choose three)

Accepted Answer

Both devices must be the exact same SRX hardware model and run the same Junos OS version.. Option B is correct because a chassis cluster requires identical SRX hardware models and matching Junos OS versions so that the control and fabric links, redundancy groups, and failover logic operate consistently between the two nodes. Option C is correct because each node must have a unique node ID (Node 0 and Node 1) assigned, which is essential for the cluster to identify members, form redundancy groups, and manage failover correctly. Option D is correct because dedicated fabric and control links (fab0/fab1) must be physically connected between the nodes to carry cluster control traffic, heartbeats, and fabric forwarding, which are required for proper cluster formation and stability. Option A is not required because cluster control ports are internal links between the two SRX devices, not connections to an external public internet switch. Option E is incorrect because running different Junos OS major versions is unsupported and would prevent stable cluster formation, not prevent split-brain.

Answer

Cluster control ports must connect to an external public internet switch.

Answer

Both devices must have different Junos OS major versions to prevent split-brain.

Question 2

Which command displays the current active security policies applied on an SRX Series device?

Accepted Answer

show security policies. The command 'show security policies' displays the current active security policies configured on an SRX Series device, including zone context, source/destination addresses, applications, and actions. It is the standard operational command for verifying policy configuration and hit counts. Variants like 'show security policies hit-count' or 'show security policies detail' extend the output.

Answer

show security zone policies

Answer

show route security-policy

Answer

show firewall security-rules

Question 3

Which TWO tasks are primarily handled by the Routing Engine (RE) on a dual-RE physical SRX Series device? (Choose two)

Accepted Answer

Executing the routing protocol daemon (rpd) to exchange routing information. The Routing Engine manages control plane tasks, such as running the routing protocol daemon (rpd) and managing device access and configuration. Data plane tasks like session creation and packet forwarding are handled by the PFE/SPU.

Answer

Executing physical layer framing on physical interface transceivers

Answer

Processing high-speed security sessions and firewall policy enforcement

Answer

Performing hardware-accelerated NAT translations in the data plane

Question 4

An administrator configures Interface-based Source NAT. When checking operational status, the administrator wants to verify which interface IP is being used for translation and confirm traffic flow. Which command provides detailed flow session information including the translated interface IP?

Accepted Answer

show security flow session. The 'show security flow session' command on Junos SRX displays detailed session information including the source and destination addresses before and after NAT translation, the translated interface IP, and the session state. This makes it the correct tool for verifying which interface IP is being used for source NAT translation while confirming active traffic flow. It provides both the pre-NAT and post-NAT tuples, which is exactly what the administrator needs.

Answer

show nat interface statistics

Answer

show security interface nat-status

Answer

show system services interface translation

Question 5

An SRX Series device is operating in flow-based mode. An administrator needs to verify how many concurrent sessions are currently active in the security session table and check resource utilization. Which operational command should be used?

Accepted Answer

show security flow session summary. The show security flow session summary command provides statistical counts of active sessions, TCP/UDP protocols, and memory utilization by the session table.

Answer

show system sessions count

Answer

show route forwarding-table summary

Answer

show chassis routing-engine

Question 6

When configuring physical and logical interfaces on an SRX Series device, which TWO parameters are required to properly define a logical unit for IP routing? (Choose two)

Accepted Answer

Family inet IP address assignment. Option D is correct because a logical unit must be assigned an IP address under a protocol family, and for IP routing this is done with the family inet address statement (e.g., set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/24), which gives the interface its routable Layer 3 identity. Option E is correct because every logical interface is identified by a unit number, such as unit 0, and this unit number is what binds the configuration stanza (family inet address, VLAN tagging, etc.) to a specific logical interface on the physical port. Option A is not required because BGP is a routing protocol that is configured separately under protocols bgp with an autonomous system number; it is not part of defining a logical unit for IP routing. Option B is not required because a redundancy group ID is only used in chassis cluster configurations to control failover, not to define a logical interface. Option C is not required because MAC address override is an optional Layer 2 setting used in specific scenarios such as certain HA or switching designs, not a mandatory parameter for a logical unit carrying IP routing.

Answer

BGP autonomous system number

Answer

Chassis cluster redundancy group ID

Answer

MAC address override

Question 7

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Accepted Answer

Existing active sessions remain open until they naturally expire or idle out, but new sessions are blocked.. Schedulers in Junos security policies control session creation; existing active sessions are not automatically terminated when the schedule expires unless specifically configured or aged out.

Answer

The device reboots to clear the session table and re-evaluate all rules.

Answer

Existing sessions are immediately converted to 'reject' action state and send ICMP unreachable messages.

Answer

Existing active sessions are immediately terminated the moment the schedule window closes.

Question 8

An engineer is debugging an IPsec VPN tunnel that fails to establish. They want to enable tracing for IKE negotiations to inspect packet exchanges. Where should IKE traceoptions be configured?

Accepted Answer

[edit security ike traceoptions]. IKE tracing is configured under the [edit security ike traceoptions] hierarchy.

Answer

[edit security ipsec traceoptions]

Answer

[edit protocols ike traceoptions]

Answer

[edit system services ike traceoptions]

Question 9

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

Accepted Answer

The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.. If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Answer

The source zone does not have host-inbound-traffic enabled for UDP.

Answer

UDP traffic cannot be matched by security policies and requires stateless filters.

Answer

Global policies always block custom applications by default.

Question 10

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. To trace packets for a specific source IP on an SRX, you configure flow traceoptions under [edit security flow traceoptions]. This allows you to capture detailed packet flow logs, including session creation, policy lookups, and NAT translations. The command 'set security flow traceoptions file flow-debug' specifies the trace file, and additional parameters like 'set security flow traceoptions packet-filter' can filter by source IP. The other options are either for system logging, application firewall logs, or firewall filter counters, none of which provide detailed flow tracing.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 11

You are deploying a vSRX in an AWS or Azure cloud environment and need to configure security zones. How do security zones on a vSRX behave compared to a physical SRX Series gateway?

Accepted Answer

vSRX security zones function identically to physical SRX devices, binding virtual interfaces to zones for policy enforcement.. Security zones on vSRX function identically to physical SRX devices. You bind virtual interfaces to zones, and security policies are enforced based on zone context. The underlying Junos OS security features are the same, ensuring consistent policy enforcement in cloud environments.

Answer

vSRX does not support security zones; it only uses firewall filters.

Answer

vSRX only supports a single default security zone.

Answer

vSRX security zones are managed exclusively through AWS/Azure native security groups.

Question 12

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

Accepted Answer

Configure NTP on the SRX device to synchronize time with a reliable time server.. The recommended best practice for ensuring security policy schedules work correctly is to configure NTP on the SRX device so its clock is synchronized with a reliable time source. Accurate, synchronized time is essential because schedule-based policies rely on the device's local clock, and drift or time zone mismatches can cause schedules to activate at the wrong times.

Answer

Manually restart the flow processing daemon (flowd) after every time zone change.

Answer

Convert all schedule parameters in the policy configuration to use absolute epoch timestamps.

Answer

Disable stateful inspection so that schedule checks occur on every individual packet.

Question 13

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Accepted Answer

No, security zones are tied to interfaces, and interfaces belong to a single routing instance.. Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.

Answer

Yes, provided the virtual routers are interconnected by internal tunnels.

Answer

No, unless logical systems (Logical Systems) are configured on the SRX device.

Answer

Yes, by defining the security zone at the global routing instance level.

Question 14

Which statement accurately describes zone-based security policies in Junos OS?

Accepted Answer

Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.. Zone-based security policies require traffic to be explicitly permitted between security zones, as the default behavior is deny-all.

Answer

Security policies are always applied globally and do not require zone definitions.

Answer

Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.

Answer

Policies defined under the global context take precedence over all zone-based policies.

Question 15

You suspect that session timeouts are too aggressive for a specific long-lived TCP application. Which command allows you to check current TCP timeout configurations on an SRX?

Accepted Answer

show security flow timeout. 'show security flow timeout' displays the current timeout values for TCP, UDP, ICMP, and other session types on the SRX. It is the direct command to verify whether TCP timeouts are too aggressive for a long-lived application.

Answer

show security session timeout-status

Answer

show firewall timeout-settings

Answer

show system connection-timeout

Question 16

An administrator configures traceoptions for security policies. Where can they find the resulting log output file?

Accepted Answer

/var/log/. Traceoptions output files are written to /var/log/ by default on Junos devices. When you configure traceoptions under [edit security policies traceoptions], the 'file' statement specifies a filename that is created in /var/log/, and the resulting trace data is written there. Administrators retrieve it with 'show log <filename>' from the CLI.

Answer

/config/trace/

Answer

/tmp/

Answer

/var/db/

Question 17

Which TWO troubleshooting steps should an administrator take when a Source NAT pool reports port exhaustion? (Choose two)

Accepted Answer

Configure port-sharing or review persistent-nat settings to optimize port distribution across pool addresses.. Option B is correct because Source NAT port exhaustion occurs when the available source ports on the pool's IP addresses are consumed; enabling port-sharing (allowing multiple sessions to share translated ports via different source addresses/ports) or reviewing persistent NAT settings (which can pin mappings and reduce reusable ports) directly optimizes how ports are distributed across the pool addresses. Option D is correct because the fundamental capacity limit is (number of pool IPs × available ports per IP), so adding more public IP addresses to the source NAT pool increases the total port capacity and relieves exhaustion. Option A is wrong because clearing the routing forwarding table does not free NAT port allocations and would disrupt traffic without addressing the port shortage. Option C is wrong because converting Source NAT to Destination NAT changes the traffic direction/purpose entirely and does not solve outbound translation port exhaustion. Option E is wrong because disabling security flow processing on the trust zone would break stateful inspection and NAT processing rather than resolve the port exhaustion.

Answer

Clear the routing forwarding table.

Answer

Convert all Source NAT rules into Destination NAT rules.

Answer

Disable security flow processing on the trust zone.

Question 18

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

Accepted Answer

[edit security screen traceoptions]. Screen traceoptions are configured under the [edit security screen traceoptions] hierarchy.

Answer

[edit system traceoptions screen]

Answer

[edit security flow traceoptions screen]

Answer

[edit security zones security-zone screen traceoptions]

Question 19

Which THREE statements are true regarding Junos security policy configuration hierarchy and syntax? (Choose three.)

Accepted Answer

Policies are evaluated top-down within their specific zone pair context.. Option A is correct because Junos security policies are evaluated in a top-down, first-match order within the specific zone-pair context (from-zone X to-zone Y), so the first matching policy's action is applied and subsequent policies are not evaluated. Option B is correct because the configuration hierarchy organizes policies under the zone-pair structure, i.e., security policies are defined under 'from-zone to-zone ' stanzas, which is the fundamental organizational model in Junos. Option D is correct because a single security policy can contain multiple match terms (source-address, destination-address, application, etc.), and all terms within a policy must match for the policy's action to be applied. Option C is incorrect because Junos uses a candidate configuration model; policy changes must be committed with the 'commit' command before they take effect. Option E is incorrect because security policies can be configured via the CLI (set security policies from-zone ... to-zone ...) as well as J-Web, so they are not limited to J-Web.

Answer

Policy configuration changes take effect immediately without requiring a commit command.

Answer

Policies can only be configured via J-Web and are unsupported on the CLI.

Question 20

During session table analysis, you notice a session stuck in the 'SynSent' state. What does this state indicate about the traffic flow?

Accepted Answer

The SRX has received a SYN packet from the source, but no SYN-ACK has been returned from the destination.. In Junos security flow, TCP session states track the handshake. SynSent indicates the SRX has seen a TCP SYN packet from the client, but has not yet seen the SYN-ACK from the server.

Answer

The TCP session has timed out and is waiting to be purged from memory.

Answer

The server has reset the connection via a RST packet.

Answer

The three-way handshake has completed successfully and data transfer is underway.