JNCIA-SEC Practice Test 3 — 25 Questions

Question 1

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Accepted Answer

SIP (Session Initiation Protocol). FTP, SIP, and TFTP are classic examples of protocols requiring ALGs due to dynamic port negotiation.

Answer

HTTP (Hypertext Transfer Protocol)

Answer

SSH (Secure Shell)

Question 2

An administrator wants to monitor security screening checks such as SYN flood protection counters. Which operational command should be used?

Accepted Answer

show security screen statistics. Screen options protect against attacks, and their statistics are viewed using show security screen statistics.

Answer

show system screening-counters

Answer

show security attack-mitigation status

Answer

show security flow flood-protection

Question 3

Which command allows an administrator to view real-time interface throughput and error statistics on an SRX Series firewall?

Accepted Answer

show interfaces statistics. The show interfaces command displays interface traffic rates, drops, and error statistics.

Answer

show system interface status

Answer

show chassis hardware

Answer

show security flow statistics

Question 4

What is the purpose of the 'show security zones' command?

Accepted Answer

To display configured security zones and their associated interfaces and properties. The show security zones command displays security zones, associated interfaces, and zone-level screen/policy settings.

Answer

To show routing table partitions

Answer

To list all active IPsec VPN tunnels

Answer

To monitor firewall CPU load per zone

Question 5

An engineer is troubleshooting a potential Denial of Service (DoS) attack. They want to check if screen options have dropped any packets on a specific security zone. Which command should be used?

Accepted Answer

show security screen statistics zone <zone-name>. Screen statistics and drop counters are tracked per zone and can be displayed using the show security screen statistics zone command.

Answer

show security attack statistics

Answer

show firewall log

Answer

show security flow screen-drops

Question 6

When configuring NAT rule sets on a Junos OS device, in what order are different types of NAT evaluated?

Accepted Answer

Destination NAT is evaluated first, followed by Source NAT, and then Static NAT.. Junos OS evaluates NAT rule sets in a specific order: Destination NAT is evaluated first, followed by Source NAT, and finally Static NAT.

Answer

All NAT types are evaluated simultaneously using parallel hardware lookups.

Answer

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Answer

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Question 7

An administrator wants to view active security sessions on an SRX Series device that match a specific source IP address of 192.168.10.50. Which CLI command provides this specific filtered output?

Accepted Answer

show security flow session source-prefix 192.168.10.50. The show security flow session command provides session table details, and filtering can be applied using match criteria.

Answer

show security alg session 192.168.10.50

Answer

show firewall filter session source-ip 192.168.10.50

Answer

show system connections 192.168.10.50

Question 8

Which command is used to display the currently configured global address books in Junos OS?

Accepted Answer

show configuration security address-book. The 'show configuration security address-book' command displays address books.

Answer

show security address-book operational

Answer

show security flow address-books

Answer

show system address-books

Question 9

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Accepted Answer

Address book entries / Address sets. Security policies reference source/destination addresses (from address books) and applications.

Answer

Functional zone names directly as match criteria for payload inspection

Answer

SCREEN option profiles

Answer

Hardware crypto processor allocation maps

Question 10

When analyzing security policy behavior and troubleshooting traffic drops, which TWO commands are most helpful for verifying policy matches and active sessions? (Choose two)

Accepted Answer

show security flow session. To troubleshoot traffic drops and policy matches, administrators use show security policy match to test policy evaluation and show security flow session to check active sessions.

Answer

show security ike

Answer

show system alarms

Answer

show firewall filter

Question 11

When troubleshooting performance degradation on an SRX Series device, which THREE operational commands help identify resource bottlenecks in the forwarding and control planes? (Choose three)

Accepted Answer

show chassis routing-engine. Checking system resources, forwarding plane CPU/memory, and session summary helps isolate resource bottlenecks.

Answer

show security alg status

Answer

show security policies summary

Question 12

An administrator is analyzing session table output using 'show security flow session' and notices a session in the 'NSRC' (NAT Source) state. What does this specific state indicate about the session?

Accepted Answer

The session is waiting for source NAT translation allocation to be completed.. Session states in the SRX flow table indicate the progress of session establishment and NAT processing. NSRC refers to source NAT processing stages.

Answer

The session has failed security screening checks and is dropped.

Answer

The session has been closed and is waiting for the TCP TIME-WAIT purge timer.

Answer

The packet is destined for the routing engine control plane.

Question 13

Which THREE Junos CLI configuration commands or hierarchies are correctly associated with defining Source, Destination, or Static NAT rule-sets? (Choose three)

Accepted Answer

set security nat source rule-set from zone . Correct hierarchies include source, destination, and static NAT rule-sets under security nat.

Answer

set security nat interface-rule-set <name>

Answer

set security nat global rule-set <name>

Question 14

An administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?

Accepted Answer

show security flow session destination-port 443. The show security flow session destination-port command allows filtering sessions based on destination port numbers.

Answer

show security policy match-port 443

Answer

show route protocol bgp port 443

Answer

show firewall filter port 443

Question 15

An administrator needs to verify whether source NAT pool addresses are being exhausted. Which command should they execute?

Accepted Answer

show security nat source pool. The show security nat source pool command displays pool utilization statistics and active allocation counts.

Answer

show route pool-address

Answer

show security translation pool-exhaustion

Answer

show security flow pool-status

Question 16

Which command confirms whether the Security Intelligence (SecIntel) feeds or threat feeds are actively updating on an SRX device?

Accepted Answer

show security intelligence status. Security intelligence status is checked using show security intelligence status.

Answer

show firewall intelligence-status

Answer

show system threat-feeds

Answer

show security threat-feed active

Question 17

Which command displays the hardware temperature and environmental status of an SRX Series chassis?

Accepted Answer

show chassis environment. The show chassis environment command displays temperatures, power supplies, and fan status.

Answer

show system environment

Answer

show hardware status

Answer

show security environmental-status

Question 18

Which TWO commands provide system-level resource utilization data on an SRX Series device? (Choose two)

Accepted Answer

show chassis environment. System resource utilization is checked via system processes and chassis environment/hardware commands.

Answer

show route summary

Answer

show security flow session summary

Answer

show security policies summary

Question 19

An engineer wants to view active security associations (SAs) for an IPsec VPN tunnel to troubleshoot connectivity. Which command should be used?

Accepted Answer

show security ipsec security-associations. IPsec security associations are managed by Internet Key Exchange (IKE) and IPsec security services. The show security ipsec security-associations command lists active IPsec SAs.

Answer

show vpn status

Answer

show securityvpn tunnels

Answer

show security ike security-associations

Question 20

An administrator suspects that a specific security policy is not being hit because traffic is being silently dropped by an earlier policy. Which feature should be enabled under security policies to generate a log entry whenever a session is created matching that policy?

Accepted Answer

configure security policies ... then { ... log { session-init; } }. To log when a session is created or closed, administrators configure session logging options within the security policy configuration.

Answer

configure security flow packet-log enable

Answer

configure security policies ... then { ... syslog alert; }

Answer

configure system syslog facility security packet-log