JNCIA-SEC Practice Test 27 — 15 Questions

Question 1

An administrator wants to verify that the antivirus signature database on an SRX firewall is up to date. Which operational command should be used?

Accepted Answer

show security utm antivirus status. The command 'show security utm antivirus status' provides details regarding the antivirus engine status and signature database version.

Answer

show security license antivirus detail

Answer

show system software status antivirus

Answer

request security utm antivirus update-check

Question 2

Which TWO protocols are inspected by Integrated Web Filtering on Juniper SRX Series firewalls? (Choose two.)

Accepted Answer

HTTP. Integrated Web Filtering (IWF) on Juniper SRX Series firewalls is a UTM feature that inspects web traffic, so option B (HTTP) is correct because plaintext HTTP requests are parsed to extract the URL, host, and category for policy enforcement. Option D (HTTPS) is also correct because IWF supports SSL forward proxy inspection, decrypting HTTPS sessions so the embedded HTTP request can be classified and filtered. Options A (SNMP), C (ICMP), and E (SMTP) are not web-browsing protocols and are not inspected by IWF; SNMP and ICMP are network management/diagnostic protocols, and SMTP is handled by other UTM modules such as antispam rather than web filtering.

Answer

SNMP

Answer

ICMP

Answer

SMTP

Question 3

Which THREE parameters can be adjusted under the [edit security flow timeout] hierarchy to manage session table aging? (Choose three)

Accepted Answer

tcp-established. Under the Junos [edit security flow timeout] hierarchy, session aging is controlled by per-protocol timeout values, and the valid adjustable parameters include tcp-established, icmp, and udp. Option A, tcp-established, is correct because it sets the timeout for TCP sessions that have reached the ESTABLISHED state, allowing administrators to age out long-lived TCP flows. Option B, icmp, is correct because it defines how long ICMP session entries remain in the session table before being removed. Option E, udp, is correct because it controls the aging timeout for UDP sessions, which is important since UDP is connectionless and relies on timers rather than session teardown. Options C and D are not part of the flow timeout hierarchy: bgp-hold-time is a BGP protocol timer configured under routing-options/protocols bgp, and ike-lifetime is an IPsec/IKE Phase 1 or Phase 2 parameter configured under security ike or security ipsec, not under security flow timeout.

Answer

bgp-hold-time

Answer

ike-lifetime

Question 4

You are troubleshooting an interface on an SRX Series device that is dropping frames due to cyclic redundancy check (CRC) errors. Which operational command helps identify physical layer framing issues?

Accepted Answer

show interfaces extensive. The command 'show interfaces extensive' provides deep operational statistics, including error counters such as framing errors, drops, and CRC errors.

Answer

show system statistics

Answer

show chassis alarms

Answer

show security monitoring status

Question 5

When configuring a zone-based security policy in Junos, what is the default action applied to any traffic that does not match any explicitly defined security policy rules?

Accepted Answer

Deny (Drop). Junos zone-based security policies have an implicit default deny at the end of every zone-pair policy set. If no explicit policy matches a session's first packet, the SRX drops the traffic and, by default, does not log it unless a `then log` action or a default-deny logging policy is configured. This is the foundational 'implicit deny' behavior that makes SRX a default-deny firewall.

Answer

Reject

Answer

Permit

Answer

Log only

Question 6

Which TWO actions should an administrator take before performing a major Junos OS software upgrade on an SRX Series gateway? (Choose two)

Accepted Answer

Back up the current working configuration.. Before upgrading software, administrators should back up the current working configuration and verify system storage space.

Answer

Format the primary hard drive using MS-DOS FAT32.

Answer

Delete all security policies permanently.

Answer

Physically disconnect all power cables during normal operation.

Question 7

What is the primary role of Unified Threat Management (UTM) on Juniper SRX Series firewalls?

Accepted Answer

To combine multiple security features (antivirus, web filtering, antispam, content filtering) into a single firewall platform.. UTM on SRX firewalls consolidates multiple security services — antivirus, antispam, web filtering, and content filtering — into a single platform, providing layered threat protection without separate appliances. It is a licensing-enabled feature set that inspects traffic flows and applies these services inline. This unified approach simplifies management and reduces the number of point products needed at the network edge.

Answer

To provide high-availability failover between routing engines.

Answer

To optimize BGP routing path selections.

Answer

To manage IPsec VPN tunnel key exchanges.

Question 8

Which TWO methods can be used to define IP addresses in Junos OS address books? (Choose two)

Accepted Answer

IP address ranges (e.g., 10.1.1.1-10.1.1.50). Address books support individual IP subnets/prefixes and IP ranges.

Answer

Routing protocol metric values

Answer

Interface speed descriptors

Answer

Mac address binding tables

Question 9

An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?

Accepted Answer

Active FTP requires the FTP ALG to parse the PORT command and open a dynamic pinhole for the incoming data channel.. Active FTP requires the server to initiate a connection back to the client, which requires port negotiation via the FTP ALG and proper security policy traversal for the back-connection.

Answer

Active FTP is blocked entirely by Junos OS because it violates modern security best practices.

Answer

Screen options are misidentifying the active FTP data port as a port-scan attack.

Answer

The global address book lacks definitions for active FTP ports.

Question 10

Which TWO tasks are performed using Junos operational mode commands? (Choose two)

Accepted Answer

Viewing interface status and traffic counters. Option A is correct because viewing interface status and traffic counters is done with operational mode commands such as 'show interfaces' and 'show interfaces extensive', which display real-time operational data without changing the configuration. Option D is correct because rebooting the routing engine is performed with the operational mode command 'request system reboot', which is an operational (not configuration) task. Options B, C, and E are incorrect because creating security policies, editing candidate configurations, defining security zones, and configuring static routes are all configuration tasks performed in configuration mode (e.g., via 'edit', 'set', or 'commit'), not operational mode.

Answer

Creating new security policies and editing candidate configurations

Answer

Defining security zones

Answer

Configuring static routes

Question 11

You are configuring a branch SRX Series device and need to verify the operational state of the integrated interface modules. Which CLI command should you use to check the physical and link status of all network ports on a compact SRX device?

Accepted Answer

show interfaces terse. The command 'show interfaces terse' or 'show interfaces' provides detailed operational status of physical and logical interfaces, including link states.

Answer

show security policies

Answer

show route summary

Answer

show chassis hardware

Question 12

Which command is used to clear active NAT sessions on an SRX Series device during troubleshooting?

Accepted Answer

clear security flow session. On Juniper SRX Series devices, active NAT sessions are stored in the flow session table, and the correct command to clear them is 'clear security flow session'. This command removes the session entries, forcing traffic to re-establish sessions and re-evaluate NAT and security policies. It is the standard troubleshooting step when stale NAT translations cause connectivity issues.

Answer

reset security nat sessions

Answer

clear route forwarding-table nat

Answer

clear security nat translation cache

Question 13

Which TWO actions can be configured when a URL is matched against a blocked category in an Integrated Web Filtering profile on an SRX Series device? (Choose two.)

Accepted Answer

Block the connection and display a custom HTML block page message.. Option B is correct because an Integrated Web Filtering (IWF) profile on SRX Series devices can be configured with a block action that terminates the connection and returns a custom HTML block page to the client, informing the user that the requested URL falls into a blocked category. Option C is correct because the profile also supports a redirect action that sends the user's browser to a predefined warning URL instead of simply blocking, allowing administrators to present their own notification or policy page. These two actions are the standard configurable responses for a matched blocked category in the IWF profile. Option A is incorrect because rebooting the control plane is not a web filtering action and SNMP traps are logging/alerting features, not block responses. Option D is incorrect because IWF does not rewrite HTTP headers to inject authentication tokens. Option E is incorrect because silently dropping the packet is not the defined IWF block behavior; the block action generates a notification page rather than a silent drop.

Answer

Send an SNMP trap and instantly reboot the device control plane.

Answer

Automatically rewrite the HTTP request header to inject user authentication tokens.

Answer

Drop the packet silently without sending any notification to the client.

Question 14

An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?

Accepted Answer

The source NAT rule is missing the 'then source-nat interface' action statement.. Interface-based Source NAT on a Juniper SRX requires the explicit action statement 'then source-nat interface' within the NAT rule. Without this action, the NAT rule matches traffic but performs no translation, so packets egress with their original private source IP, causing return traffic to fail. The security flow session showing the internal IP confirms the NAT action is missing.

Answer

The security policy is evaluating the post-translation source IP instead of the pre-translation IP.

Answer

Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.

Answer

Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.

Question 15

What is the primary purpose of a UTM policy profile on a Juniper SRX firewall?

Accepted Answer

To bundle multiple individual UTM feature profiles into a single assignable policy object.. A UTM policy profile acts as a container that bundles various UTM feature profiles (antivirus, web-filtering, antispam, content-filtering) together for application in security policies.

Answer

To configure stateful inspection timeouts for high-speed interfaces.

Answer

To define routing metrics for secure VPN tunnels.

Answer

To enforce user authentication mechanisms before granting network access.