JNCIA-SEC Practice Test 5 — 25 Questions

Question 1

When configuring Kaspersky-based Antivirus on an SRX Series device, which operational mode reduces resource consumption by only scanning files matching specific high-risk protocol extensions?

Accepted Answer

Extension-based or type-based scanning filtering. Kaspersky antivirus on SRX supports extension-based filtering to optimize performance by skipping non-risk file types.

Answer

Passive monitor mode

Answer

Stateless AV filtering

Answer

Fast-track scanning mode

Question 2

Which statement is true regarding Junos OS security zone interfaces?

Accepted Answer

An interface must be assigned to a security zone before it can pass transit traffic.. An interface can belong to one security zone at a time.

Answer

An interface can be assigned to multiple security zones simultaneously.

Answer

Loopback interfaces must be assigned to security zones to function.

Answer

Management interfaces (fxp0) must be assigned to security zones for CLI access.

Question 3

Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)

Accepted Answer

show security flow session. Valid operational commands include showing security zones and security flow sessions.

Answer

show system applications builtin

Answer

show security policy ruleset evaluate

Answer

show configuration security address-book

Question 4

Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?

Accepted Answer

SCREEN options. SCREEN options provide attack detection and mitigation for layer 3 and layer 4 DoS attacks.

Answer

Firewall filter policers

Answer

IPsec VPN tunnels

Answer

Application Layer Gateways (ALGs)

Question 5

A network administrator needs to prevent users in the engineering department from uploading company source code to unauthorized cloud file-sharing services via web browsers. Which configuration mechanism within Juniper UTM content filtering accomplishes this task?

Accepted Answer

Enabling content filtering with a profile targeting specific upload MIME types or file extensions. Content filtering inspects HTTP and SMTP traffic to block or permit transfers based on MIME types, file extensions, or file sizes. By specifying blocking rules for specific upload MIME types, the administrator can prevent the unauthorized transmission of files.

Answer

Enabling integrated web filtering with a policy action of block for the File Sharing category

Answer

Configuring a custom URL category with a block action

Answer

Configuring antispam filters to drop outbound HTTP requests containing attachments

Question 6

Which command is used to verify the configuration of address books in Junos OS?

Accepted Answer

show configuration security address-book. The 'show configuration security address-book' command displays the configured address books in configuration mode.

Answer

show system address-books

Answer

show security address-book operational

Answer

show security flow address-book

Question 7

Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single unit in security policies?

Accepted Answer

Application set. An application set groups multiple applications together.

Answer

Application bundle

Answer

Application group

Answer

Application profile

Question 8

Which Junos OS feature is responsible for translating port numbers for protocols like FTP during transit across security zones?

Accepted Answer

Application Layer Gateway (ALG). ALGs handle port translation and protocol parsing for complex applications.

Answer

Host-inbound traffic

Answer

SCREEN options

Answer

NAT (Network Address Translation)

Question 9

Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)

Accepted Answer

TCP SYN flood rate limiting. SCREEN option profiles contain Layer 3/4 attack protections such as IP spoofing and SYN flood limits.

Answer

Deep packet URL filtering and virus signature inspection

Answer

NAT pool port exhaustion mitigation

Answer

Dynamic routing protocol authentication keys

Question 10

You need to modify an existing security policy to add a new IP address to an existing address set used in the policy match criteria. Which configuration hierarchy should you access to update the address set?

Accepted Answer

[edit security address-book] or within the specific zone's address-book configuration.. Address sets are configured within address books, either globally or under specific zones.

Answer

[edit security policies] directly within the policy match criteria.

Answer

[edit interfaces]

Answer

[edit routing-options]

Question 11

You want to create a security policy that applies to traffic originating from a specific address book entry named 'HQ-Net' in the 'trust' zone destined for 'Branch-Net' in the 'untrust' zone. Where must the 'HQ-Net' address be defined?

Accepted Answer

Within the address-book configuration of the 'trust' zone or at the global address-book level.. Address entries can be defined either globally or inside the specific zone configuration.

Answer

Directly within the system login configuration block.

Answer

Inside the routing-options static route definition.

Answer

As an interface unit attribute under the [edit interfaces] hierarchy.

Question 12

Which interface type on an SRX Series device is typically used to connect internal local area networks (LANs) to the security gateway?

Accepted Answer

Gigabit Ethernet (ge- / xe-) interfaces. Gigabit Ethernet (ge-) or similar physical and logical interfaces are used to connect local networks.

Answer

fab0 and fab1

Answer

lc-0/0/0

Answer

fxp0

Question 13

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

Accepted Answer

Under the security zone host-inbound-traffic system-services icmp configuration.. ICMP echo request must be enabled under the host-inbound-traffic configuration for the specific security zone or interface.

Answer

Inside the junos-icmp application object definition.

Answer

Inside the global SCREEN option profile under ICMP flood settings.

Answer

Under the security policies between the untrust and trust zones.

Question 14

You are troubleshooting a Junos security device where a Destination NAT rule is configured. External users reach the virtual IP, but traffic fails to establish a TCP 3-way handshake. Using 'monitor traffic', you observe SYN packets arriving at the external interface and leaving the internal interface towards the server. However, no SYN-ACK packets return from the server. What is the most likely networking or routing reason on the internal network causing this?

Accepted Answer

The internal server's default gateway does not point to the SRX device, causing asymmetric routing where return packets bypass the firewall.. If SYN packets reach the internal server but no SYN-ACK returns, the server is likely sending its response to a different next-hop — typically its default gateway is not the SRX, so return traffic bypasses the firewall and the session never completes. This is classic asymmetric routing: the SRX sees only one direction of the flow, so it cannot establish the session or perform the reverse NAT translation. The fix is to point the server's default gateway to the SRX internal interface.

Answer

The security policy is evaluating pre-translation source ports instead of post-translation source ports.

Answer

Proxy ARP is disabled on the internal interface of the SRX.

Answer

The destination NAT rule is missing the port translation statement, causing the server to drop unrecognized ports.

Question 15

You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?

Accepted Answer

Create a screen profile with ICMP flood parameters and apply that profile under the security zone configuration.. ICMP flood protection is configured inside a screen profile under [edit security screen], and that profile is then applied to the security zone.

Answer

Set [edit security zones security-zone trust screen icmp-flood threshold 1000] directly.

Answer

Enable ICMP inspection inside the junos-icmp application definition.

Answer

Apply ICMP flood options directly under the [edit security policies] hierarchy.

Question 16

An administrator configures a Source NAT rule with an address pool. When verifying traffic, the administrator notices that multiple distinct internal subnets are matching the rule. How can the administrator restrict the source NAT rule to apply only to a specific subnet while leaving other subnets un-translated?

Accepted Answer

Specify an exact prefix under the rule's 'match source-address' statement.. The correct way to restrict a source NAT rule to a specific subnet is to specify an exact prefix under the rule's 'match source-address' statement. This directly limits the rule to only match traffic from that subnet, leaving other subnets unmatched and therefore untranslated. This is the standard Junos NAT configuration approach.

Answer

Apply a firewall filter on the ingress interface to drop un-translated subnets.

Answer

Configure static routes for un-translated subnets pointing to the loopback interface.

Answer

Configure the rule-set source zone with individual interface subnets.

Question 17

Which THREE statements are true regarding global security policies in Junos OS? (Choose three.)

Accepted Answer

Global policies support matching on applications, source addresses, and destination addresses.. Option A is correct because global policies in Junos OS support the same match criteria as zone-based policies, including applications, source addresses, and destination addresses, allowing flexible traffic identification. Option C is correct because the Junos security policy evaluation order processes zone-based policies first and then global policies, so global policies act as a fallback for traffic not matched by zone-specific rules. Option D is correct because global policies are defined without a from-zone/to-zone context, so a single rule can apply across multiple zones without declaring individual source-to-destination zone pairs. Option B is incorrect because global policies are configured under the global policy hierarchy and do not require an explicit zone pair declaration. Option E is incorrect because global policies are evaluated after, not before, zone-based policies, so they do not take precedence over them.

Answer

Global policies require an explicit zone pair declaration in the configuration hierarchy.

Answer

Global policies take precedence over any configured zone-based security policies.

Question 18

An administrator is configuring syslog output on an SRX Series device to troubleshoot security events. Which TWO actions must be taken to ensure logs are successfully sent to an external syslog server? (Choose two)

Accepted Answer

Specify the facility and severity level to be logged.. Option C is correct because Junos syslog configuration requires you to define which messages are captured by specifying a facility (such as `security`, `authorization`, or `daemon`) and a severity level (such as `info`, `notice`, or `any`) under `[edit system syslog]`; without this, no log messages are selected for transmission. Option D is correct because you must configure the external syslog server's IP address as a host destination under `[edit system syslog host <ip-address>]` so the device knows where to send the selected log messages. Option A is incorrect because firewall filters on external interfaces do not need to be disabled for syslog traffic to egress; syslog uses UDP/TCP port 514 and is not blocked by the mere presence of filters unless explicitly configured to drop it. Option B is incorrect because the syslog daemon starts automatically and does not require a Routing Engine reboot to initialize after configuration changes. Option E is incorrect because security flow traceoptions are used for debugging packet flow processing and writing trace files, not for sending security logs to an external syslog server.

Answer

Disable all active firewall filters on external interfaces.

Answer

Reboot the Routing Engine to initialize the syslog daemon.

Answer

Enable security flow traceoptions globally.

Question 19

You are troubleshooting a Junos security device where a Static NAT rule is configured for an internal server. Internal users access the server using its public IP address. You notice that traffic from internal clients hitting the static NAT IP creates asymmetric routing or fails because source translation is absent. How does Junos handle internal clients accessing a server via its static NAT public IP without explicit hairpin NAT?

Accepted Answer

Without hairpin source NAT, the internal server responds directly to the internal client, causing the client to drop the packet due to mismatched source/destination IP states.. When an internal client accesses an internal server via its static NAT public IP, the packet is translated to the server's private IP, but the source IP remains the client's private IP. The server responds directly to the client's private IP, bypassing the Junos device. The client, expecting the response from the public IP it originally sent the packet to, sees a response from a different source IP and drops the packet due to mismatched session state. This is why hairpin NAT (source NAT for internal-to-internal traffic) is needed.

Answer

Static NAT automatically applies hairpin source NAT when source and destination zones are identical.

Answer

Proxy ARP automatically intercepts internal static NAT requests and rewrites the source IP.

Answer

Junos automatically converts internal static NAT requests into loopback tunnel traffic.

Question 20

An administrator needs to ensure that Antispam inspection is applied only to inbound mail destined for the corporate mail server. How should this be achieved in the security policy configuration?

Accepted Answer

Attach an antispam-enabled UTM policy exclusively to the security policy permitting SMTP traffic from the untrusted zone to the mail server.. Antispam is bound to a UTM policy, which in turn is attached to a specific security policy governing the mail server traffic flow.

Answer

Configure a global antispam filter under the [edit security utm] hierarchy.

Answer

Apply the antispam profile directly to the egress interface facing the mail server.

Answer

Enable antispam globally within the system services configuration.