JNCIA-SEC Practice Test 4 — 25 Questions

Question 1

When troubleshooting a high CPU condition caused by security processing, which command helps identify which traffic flows or features are consuming resources?

Accepted Answer

show security flow statistics. The show security flow statistics and show security monitoring commands help understand flow processing loads.

Answer

show system cpu-accounting

Answer

show firewall filter cpu-usage

Answer

show security packet-processing load

Question 2

Which THREE parameters are typically included in security flow traceoptions output when troubleshooting dropped packets? (Choose three)

Accepted Answer

Packet reception and interface context. Flow traceoptions capture packet reception, policy lookup results, session allocation, and drop reasons.

Answer

Chassis power supply voltage levels

Answer

BGP AS path recomputation steps

Question 3

You need to perform packet capture on an SRX Series device to analyze suspicious traffic hitting an interface. Which built-in Junos utility should you use?

Accepted Answer

monitor traffic interface ge-0/0/0. Junos provides packet capture capabilities using the monitor traffic command.

Answer

show security packet-capture interface

Answer

request diagnostic capture start

Answer

start shell tcpdump -i ge-0/0/0

Question 4

An administrator needs to verify whether IDP (Intrusion Detection and Prevention) is actively inspecting traffic. Which operational command should be used?

Accepted Answer

show security idp status. The show security idp status command displays IDP engine status, policy loading, and packet inspection statistics.

Answer

show idp policy active

Answer

show security flow idp-stats

Answer

show firewall idp-inspection

Question 5

Which TWO factors are important when analyzing session table exhaustion issues on an SRX Series firewall? (Choose two)

Accepted Answer

Identifying top sources or application types generating high session volumes. Session table exhaustion troubleshooting involves examining max-sessions limits and identifying top session creators/attack sources.

Answer

Checking interface cable physical integrity

Answer

Verifying BGP route convergence timers

Answer

Inspecting NTP time synchronization accuracy

Question 6

An administrator wants to clear all inactive sessions from the security session table to free up resources. Which command achieves this?

Accepted Answer

clear security flow session all. The clear security flow session command allows flushing sessions based on filters or clearing all sessions.

Answer

request security flow flush

Answer

delete security flow session inactive

Answer

reset security session-table

Question 7

You suspect that Network Address Translation (NAT) is misconfigured for a server pool. Which command should you use to examine active NAT translation entries?

Accepted Answer

show security nat translation. The show security nat source rule-all or show security flow session with NAT details provides insight into active translations, but show security nat translation is the dedicated command for viewing current NAT mappings.

Answer

show route forwarding-table destination-nat

Answer

show security alg status

Answer

show security flow active-nat

Question 8

While debugging NAT, you notice that session creation fails due to port block allocation failure. Which command helps inspect dynamic IP and port (DIPP) NAT usage?

Accepted Answer

show security nat source pool detail. DIPP NAT usage and port block allocations can be inspected using show security nat source pool detail or DIPP-specific monitoring commands.

Answer

show route forwarding-table dipp

Answer

show security flow dipp-status

Answer

show security translation port-blocks

Question 9

Which TWO methods can an administrator use to monitor real-time traffic passing through a specific firewall interface? (Choose two)

Accepted Answer

show interfaces ge-0/0/1 statistics. Real-time traffic monitoring can be achieved using monitor traffic and interface statistics commands.

Answer

request security monitoring interface ge-0/0/1

Answer

show firewall filter interface ge-0/0/1

Answer

show security flow session interface ge-0/0/1

Question 10

Which THREE methods can be used to examine Junos system log files for security events? (Choose three)

Accepted Answer

Using 'monitor start <filename>' to watch log entries in real time. Log files can be viewed with show log, monitored in real-time with monitor start, or inspected via operational log viewers.

Answer

Running 'edit system syslog' in configuration mode

Answer

Executing 'clear system log' to view file contents

Question 11

An engineer notices that specific traffic is being dropped silently by the SRX Series device. To capture detailed log messages about security policy evaluations, where should traceoptions be configured?

Accepted Answer

[edit security policies traceoptions]. Security policy evaluation logging and traceoptions are configured under the [edit security policies] hierarchy.

Answer

[edit security flow traceoptions]

Answer

[edit system services traceoptions]

Answer

[edit security zone traceoptions]

Question 12

Which Junos configuration mode command is used to enter the NAT configuration hierarchy?

Accepted Answer

edit security nat. To configure NAT features in Junos configuration mode, you enter 'edit security nat'.

Answer

edit system nat-configuration

Answer

edit routing-options nat

Answer

edit firewall nat

Question 13

What information does the 'show security flow session summary' command provide?

Accepted Answer

Total active session counts, resource usage, and protocol breakdown. The summary command provides aggregate counts of active sessions, TCP/UDP breakdowns, and session table capacity.

Answer

Detailed packet contents for every active session

Answer

The complete list of source and destination IP addresses

Answer

Configured security policies

Question 14

Which THREE metrics are displayed when monitoring security screening statistics? (Choose three)

Accepted Answer

IP spoofing drop counts. Security screen statistics report SYN floods, IP spoofing attempts, and ICMP flood violations.

Answer

BGP prefix withdrawal rates

Answer

IPsec re-key failure counts

Question 15

You are troubleshooting a performance issue on an SRX device performing heavy NAT operations. You suspect that NAT translation table entries are consuming excessive system resources. Which command displays overall system-wide NAT translation summary information and resource allocation?

Accepted Answer

show security flow statistics. To view overall resource usage, session counts, and NAT translation summary statistics, the command 'show security flow statistics' or specific NAT summary operational commands are used.

Answer

show route forwarding-table nat-summary

Answer

show system resources nat-table

Answer

show security nat memory-allocation

Question 16

An engineer needs to determine why IPsec Phase 1 negotiations are failing with a remote peer. Which traceoptions flag should be enabled under security ike?

Accepted Answer

set security ike traceoptions flag all. IKE traceoptions flags such as 'all' or specific flags like 'basic', 'state', and 'packet' help diagnose IKE failures.

Answer

set security ipsec traceoptions flag phase1

Answer

set system syslog facility local4

Answer

set security flow traceoptions flag ike

Question 17

You are troubleshooting an issue where an application timeout occurs intermittently. You suspect that session timeouts might be too short for this specific application. Where can you adjust TCP session timeout values globally on an SRX Series device?

Accepted Answer

[edit security flow timeout]. TCP session timeouts, such as the default 30-minute timeout, can be modified under the [edit security flow timeout] hierarchy.

Answer

[edit security policies timeout]

Answer

[edit applications session-timeout]

Answer

[edit system services timeout]

Question 18

You are troubleshooting an issue where security logging is failing to reach the remote syslog server. Which command allows you to test syslog connectivity and queue status?

Accepted Answer

show system logging status. The show system syslog command or checking system processes / messages helps, but show system logging status or checking syslog error counters via operational commands provides diagnostic visibility.

Answer

show security log statistics

Answer

show network syslog connection

Answer

show syslog remote-status

Question 19

An administrator needs to quickly check the number of active sessions currently residing on an SRX Series device to troubleshoot potential memory exhaustion. Which command should be used?

Accepted Answer

show security flow session summary. The show security flow session summary command displays aggregate statistics about active sessions, helping administrators quickly identify traffic load and session table utilization.

Answer

show system connections

Answer

show security flow statistics

Answer

show security monitoring statistics

Question 20

You have configured security syslog messages, but no logs are appearing on your external syslog server. Which operational command can you use to verify that the SRX is actively generating and sending syslog messages?

Accepted Answer

show system logging. The show log command displays local log files, but to check syslog transmission status and drop counts, show log messages or checking system logging statistics is used. Alternatively, show system logging displays the status.

Answer

show syslog statistics

Answer

show log messages | match syslog

Answer

show security syslog status