JNCIA-SEC Practice Test 28 — 15 Questions

Question 1

An administrator needs to create a security policy on a Junos device that permits traffic from the trust zone to the untrust zone. Which configuration hierarchy is used to define this security policy?

Accepted Answer

[edit security policies]. Security policies in Junos OS are configured under the [edit security policies] hierarchy.

Answer

[edit firewall]

Answer

[edit security screen]

Answer

[edit interfaces security-zones]

Question 2

Which THREE configuration elements are required to successfully implement Integrated Web Filtering on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

A valid Integrated Web Filtering license installed on the SRX. Option A is correct because Integrated Web Filtering (IWF) on SRX relies on a valid subscription license that enables the Juniper-provided cloud category database and local cache; without the license, the firewall cannot query or update the URL category feed. Option B is correct because a web filtering feature profile is where you define the category actions (permit, block, log, quarantine, user-block) and configure the fallback/block settings that the UTM engine enforces. Option D is correct because the web filtering profile must be referenced inside a UTM policy profile, and that UTM policy must then be attached to a security policy so traffic matching the policy is actually inspected. Option C is not required because IWF uses HTTP/HTTPS to reach Juniper's cloud rating infrastructure, not an SMTP relay, which is only relevant to e-mail (anti-spam) UTM features. Option E is not required because the SRX communicates with the Juniper cloud rating service over standard IP/HTTPS connectivity and does not need a BGP peering session with the rating provider.

Answer

An SMTP mail server relay configuration

Answer

An active BGP peering session with the cloud rating provider

Question 3

Which TWO actions should an administrator take when configuring security policy traceoptions to effectively debug a suspected policy drop issue? (Choose two)

Accepted Answer

Configure a target file name under traceoptions using the file statement.. Option C is correct because security policy traceoptions require a destination for the trace output, and the file statement under traceoptions specifies the target filename (e.g., set security policies traceoptions file policy-trace) where the debug log is written for later inspection. Option E is correct because traceoptions only generate output for the events you explicitly enable, so you must turn on the relevant debug flags with the flag statement, such as flag policy or flag all, to capture policy lookup and drop decisions. Option A is wrong because traceoptions take effect immediately once committed; restarting the Routing Engine is unnecessary and disruptive. Option B is wrong because stateless firewall filters are a separate filtering mechanism and are not required to debug security policy drops. Option D is wrong because disabling security zones would remove the very policy enforcement context being traced and would not help diagnose the drop.

Answer

Restart the Routing Engine to apply traceoptions.

Answer

Enable stateless firewall filters on all transit interfaces.

Answer

Disable all security zones during tracing.

Question 4

Which TWO statements describe characteristics of security zones on Juniper SRX Series devices? (Choose two)

Accepted Answer

Screen options for protecting against denial-of-service attacks can be applied directly at the security zone level.. Security zones on SRX devices are used to group interfaces, apply security policies, and enforce traffic control. Every interface must belong to a zone to pass transit traffic.

Answer

A single physical interface can be assigned to multiple security zones simultaneously.

Answer

Security zones are strictly required for management traffic destined directly to the Routing Engine control plane.

Answer

By default, traffic between different security zones is permitted unless explicitly blocked by a policy.

Question 5

Which command is used to save the active configuration changes permanently on an SRX Series gateway running Junos OS?

Accepted Answer

commit. The 'commit' command saves and activates the candidate configuration on Junos devices.

Answer

save configuration

Answer

apply config

Answer

write memory

Question 6

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Accepted Answer

LAND attacks. Junos OS SCREEN options are a set of stateless and stateful security filters applied at the zone or interface level to detect and drop malformed or abusive packets before they reach protected hosts. Option B (LAND attacks) is correct because SCREEN includes the land attack defense, which drops packets where the source and destination IP addresses (and ports) are identical, a classic spoofed-packet loop condition. Option C (TCP SYN flood attacks) is correct because SCREEN provides syn-flood protection, using SYN cookie and related thresholds (e.g., alarm-threshold, attack-threshold, source-threshold, destination-threshold) to limit half-open TCP connections. Option D (IP spoofing attacks) is correct because SCREEN offers ip-spoofing and related checks (such as source-route-option and ip-source-route) that drop packets whose source addresses are inconsistent with the expected ingress path or that carry forbidden IP options. Options A (XSS browser exploits) and E (SQL injection web application attacks) are not mitigated by SCREEN, since these are application-layer web attacks that require an application-aware security service such as Junos UTM/IDP or a WAF, not packet-level SCREEN filters.

Answer

Cross-site scripting (XSS) browser exploits

Answer

SQL injection web application attacks

Question 7

An administrator wants to verify which security zones are currently configured on an SRX Series device and which interfaces are assigned to each zone. Which operational mode command provides this information in a concise, tabular format?

Accepted Answer

show security zones. The operational mode command 'show security zones' provides a concise, tabular display of all security zones and the interfaces assigned to each. It is the quickest way to verify zone-to-interface mappings on an SRX Series device. Configuration mode commands show the raw configuration, and interface or policy commands do not directly answer the question.

Answer

show security policies

Answer

show configuration security zones

Answer

show interfaces terse

Question 8

An administrator is configuring a chassis cluster on two SRX Series devices. They need to verify that the cluster is operating correctly. Which TWO commands or outputs are essential to confirm the cluster status and redundancy? (Choose two.)

Accepted Answer

show chassis cluster status. To verify chassis cluster operation on SRX Series devices, the essential commands are 'show chassis cluster status' and 'show chassis cluster interfaces'. The first confirms the redundancy group states and node roles, while the second verifies that the control and fabric links are up and properly connected. Together, they provide a comprehensive view of cluster health.

Answer

show configuration chassis cluster

Answer

show chassis cluster statistics

Answer

show security flow session

Question 9

You are configuring a Juniper SRX Series device for a new web server farm that must be reachable from the Internet on port 443. The servers sit behind the device on the 10.10.10.0/24 subnet, and the public address is 203.0.113.50. You want to translate only incoming HTTPS traffic to the internal server at 10.10.10.20 while leaving other inbound traffic unaffected. Which type of NAT should you configure?

Accepted Answer

Destination NAT with a rule matching destination address 203.0.113.50 and destination port 443, translating to 10.10.10.20.. Publishing an internal server to the Internet on a specific port requires destination NAT, which rewrites the destination address and port of inbound sessions. The rule matches the public address and the service port, then translates to the internal server address. Source and static NAT do not provide the same selective, port-based inbound translation behavior.

Answer

Static NAT mapping 203.0.113.50 to 10.10.10.20, without any port restriction.

Answer

Persistent NAT with a pool containing 203.0.113.50 and a port range of 443.

Answer

Source NAT with a pool containing 10.10.10.20, applied to the untrust zone.

Question 10

You are configuring a custom application named 'my-app' on an SRX Series device. You need to define it to match TCP traffic destined for port 8080 and also match UDP traffic on port 53. Which configuration correctly defines this application?

Accepted Answer

set applications application my-app term tcp protocol tcp destination-port 8080; set applications application my-app term udp protocol udp destination-port 53. Custom applications in Junos OS can include multiple terms, each specifying a protocol and port. To match both TCP 8080 and UDP 53, you must define separate terms within the application. The configuration with 'term tcp' and 'term udp' achieves this. The other options either define only one protocol or incorrectly attempt to set multiple protocols without terms.

Answer

set applications application my-app protocol tcp destination-port 8080

Answer

set applications application my-app protocol udp destination-port 53

Answer

set applications application my-app protocol tcp destination-port 8080; set applications application my-app protocol udp destination-port 53

Question 11

An administrator has created a security policy on an SRX Series device that permits HTTP traffic from the trust zone to the untrust zone. The administrator now wants to verify that this specific policy is matching traffic without examining the entire session table. Which operational command should be used?

Accepted Answer

show security policies hit-count. The show security policies hit-count command is specifically designed to display how many times each security policy has been matched. It gives a per-policy counter, which directly answers whether the HTTP permit policy is being evaluated and matched. Other commands either show sessions without policy attribution or only display configuration, so they do not provide the needed runtime match information.

Answer

show security zones

Answer

show configuration security policies

Answer

show security flow session

Question 12

An administrator suspects that an SRX Series device is dropping packets because of a resource limitation rather than a policy deny. Which command should the administrator use to review flow-related resource usage and drop counters?

Accepted Answer

show security flow statistics. Flow statistics counters expose session creation and deletion activity along with drops that can be tied to resource limits such as a full session table. Reviewing these counters lets the administrator distinguish resource-driven drops from policy denies, which is the core question in this scenario.

Answer

show security policies

Answer

show interfaces extensive

Answer

show security zones

Question 13

A network administrator is troubleshooting an SRX Series device and needs to confirm whether a specific security policy is being evaluated for traffic between two zones. The administrator wants to see the order in which policies are evaluated and identify which policy a given session matches. Which command should the administrator use?

Accepted Answer

show security match-policies. To determine which security policy applies to specific traffic and to understand evaluation order, the administrator should use the match-policies command, which takes match criteria and reports the resulting policy decision. Configuration display and session summary commands provide related but insufficient information, and hit counts only show how often policies have matched historically rather than mapping a specific flow to its policy.

Answer

show security policies hit-count

Answer

show configuration security policies

Answer

show security flow session summary

Question 14

An SRX Series device is configured with a screen option to protect against TCP SYN floods. Users report intermittent connectivity failures to a protected server. You suspect the screen is dropping legitimate traffic. Which two actions allow you to confirm whether the screen is actively dropping packets and identify the source addresses involved? (Choose two.)

Accepted Answer

Run show security screen statistics zone <zone-name> to view per-screen drop counters.. To confirm that a screen is dropping packets, you need visibility into screen counters and, ideally, the individual drop events. The show security screen statistics command provides per-screen drop counters for a zone, while security flow traceoptions with the screen flag logs screen-related drops, including source addresses. Together they confirm the screen is active and identify the offending sources.

Answer

Run show log messages and look for screen drop notifications.

Answer

Run show security flow session to list active sessions and their source addresses.

Answer

Run show security alarms to check for screen-related alarms.

Question 15

An administrator needs to create a new security zone named 'dmz' on an SRX Series device and assign the interface ge-0/0/2 to it. Which configuration mode command accomplishes this?

Accepted Answer

set security zones security-zone dmz interfaces ge-0/0/2. The correct Junos OS command to create a security zone and assign an interface is 'set security zones security-zone interfaces '. This places the interface under the zone. The other options contain syntax errors or use the wrong hierarchy, so they will not achieve the desired configuration.

Answer

set security zones dmz interfaces ge-0/0/2

Answer

set interfaces ge-0/0/2 zone dmz

Answer

set security zone dmz interface ge-0/0/2