JNCIA-SEC Practice Test 29 — 15 Questions

Question 1

An administrator is configuring a security policy on an SRX Series device that must allow traffic from the trust zone to the untrust zone, but only for users who have authenticated via the device's captive portal. Which policy match condition should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

source-identity. The source-identity match condition is used to enforce policies based on authenticated user or group. When a captive portal is used, users authenticate and their identity is associated with their traffic. The policy can then match on source-identity to allow only authenticated users, providing granular access control.

Answer

source-zone

Answer

source-address

Answer

application

Question 2

An administrator is troubleshooting an SRX Series device and notices that the 'show security flow session' command output shows a session in the 'Invalid' state. What is the most likely cause of this session state?

Accepted Answer

The session failed to be created due to a policy or resource issue.. The 'Invalid' state in 'show security flow session' output indicates that the session failed to be created properly, often due to policy denial or resource constraints. This state is a clear indicator of a session setup failure, not a normal operational state. Other options describe normal session states or processes that do not match the 'Invalid' state.

Answer

The session is waiting for the first packet from the initiator.

Answer

The session is a temporary session that will be replaced by a valid one.

Answer

The session is being aged out due to timeout.

Question 3

An administrator notices that the SRX's antispam feature is not quarantining messages even though the SBL server is reachable and the policy references an antispam profile. The mail server is on the DMZ, and traffic is SMTP over port 25. Which action should the administrator verify first?

Accepted Answer

Confirm that the antispam profile is attached to the correct UTM policy and that the UTM policy is referenced in the security policy rule permitting the SMTP session.. Antispam enforcement requires the profile to be referenced through a UTM policy that is attached to the security policy rule permitting the mail flow. Even with a reachable SBL server, if the profile is not bound to the policy, no spam action including quarantine occurs. The administrator should trace the configuration chain from security policy to UTM policy to antispam profile before investigating other factors.

Answer

Check whether the SMTP ALG is disabled on the security policy, because antispam requires the ALG to be disabled.

Answer

Ensure the antispam profile's spam action is set to 'tag' instead of 'block', since only tagging causes quarantine.

Answer

Verify that the SBL server's DNS name resolves and that the device can ping it.

Question 4

An administrator is investigating why a specific session is not being created on an SRX Series device. The administrator suspects that the session might be denied by a policy or dropped due to a flow issue, and wants to capture detailed flow processing information for the affected traffic without disrupting other sessions. Which action should the administrator take?

Accepted Answer

Configure security flow traceoptions with a filter matching the source and destination addresses, then review the trace log.. Flow traceoptions with specific filters are the appropriate tool for diagnosing why a particular session is not being created, because they expose internal flow processing steps such as policy lookup and drop decisions for the targeted traffic. Broad packet capture, session table polling, and session close logging either lack the needed internal detail or only apply after a session exists, so they cannot efficiently answer the question in this scenario.

Answer

Enable packet capture on all interfaces simultaneously and analyze the resulting capture files.

Answer

Run 'show security flow session' repeatedly and compare the outputs over time.

Answer

Set the security policy to log at session close and then inspect the traffic log.

Question 5

An administrator configures destination NAT to publish an internal application server. External users report that connections to the public address fail, but the NAT rule and security policy appear correct. While troubleshooting, the administrator notices that the return traffic from the server is being routed through a different interface than the one on which the original request arrived. What is the most likely cause of the failure?

Accepted Answer

Asymmetric routing causes return traffic to bypass the SRX, so the session is not matched and the connection fails.. The SRX is a stateful firewall and must see both directions of a flow to maintain the session. If return traffic is routed around the device, the session cannot be matched and the connection fails. The described symptom of return traffic using a different interface is a classic sign of asymmetric routing, which must be corrected by ensuring symmetric path selection.

Answer

The destination NAT pool has run out of addresses, so new sessions cannot be created.

Answer

The destination NAT rule is missing a port translation, so return traffic cannot be matched to the session.

Answer

The security policy is applied after destination NAT, so the policy is evaluating the wrong destination address.

Question 6

You are deploying UTM content filtering on an SRX Series firewall to block downloads of files with specific extensions. A user reports that they can still download a file with the extension '.exe' even though the content filtering profile is configured to block it. Which step should you verify first?

Accepted Answer

Confirm that the content filtering profile is referenced in a UTM policy and that the UTM policy is applied to the security policy matching the user's traffic.. The most likely reason for content filtering not blocking a file is that the UTM policy containing the content filtering profile is not applied to the security policy that matches the user's traffic. Even if the profile is correctly configured, it has no effect unless it is referenced in a UTM policy and that policy is attached to a security policy. Therefore, verifying the UTM policy application is the correct first step.

Answer

Verify that the SRX has a valid content filtering license and that the signature database is up to date.

Answer

Check that the content filtering profile includes the '.exe' extension in the block list and that the action is set to block.

Answer

Ensure that the user's traffic is being decrypted if it is HTTPS, as content filtering cannot inspect encrypted traffic.

Question 7

An administrator is troubleshooting why an internal host cannot reach an external server after a source NAT configuration change. The host's traffic is being translated, but the return traffic is not being forwarded back to the host. Which component should the administrator verify first to ensure return traffic is handled correctly?

Accepted Answer

The session table, to confirm that a session exists and that the reverse translation is installed.. When outbound traffic is translated but return traffic fails, the most direct check is the session table. It reveals whether the session was created and whether the reverse NAT translation is correctly installed. Without the reverse mapping, the device cannot rewrite the destination address back to the internal host, and return packets are dropped or misrouted.

Answer

The NAT pool address range, to verify that it overlaps with the internal subnet.

Answer

The security policy that permits the outbound session, to confirm that it also allows return traffic.

Answer

The proxy ARP configuration on the internal interface, to ensure the host can resolve the gateway.

Question 8

An administrator is deploying UTM antivirus on an SRX Series firewall. The security team requires that files larger than a specified size be bypassed by the antivirus engine to avoid excessive resource consumption. The administrator configures the UTM policy profile with the appropriate maximum file size. Which configuration parameter must be set within the UTM policy to enforce this limit?

Accepted Answer

max-file-size. The max-file-size parameter in a UTM policy profile defines the maximum file size that the antivirus engine will scan. Files larger than this value are not scanned, which helps conserve resources on the SRX device. This is the standard Junos OS method for controlling antivirus scanning based on file size.

Answer

size-exceed-action

Answer

scan-limit

Answer

file-threshold

Question 9

An administrator needs to create a security policy that allows users in the trust zone to access a web server in the DMZ zone, but only during business hours (09:00 to 17:00, Monday through Friday). Outside these hours, the traffic should be denied and logged. Which configuration approach should be used?

Accepted Answer

Create a permit policy with a scheduler for business hours, and place a subsequent deny policy for the same zones with logging enabled.. The correct approach is to use a permit policy with a scheduler that activates only during business hours. When the scheduler is inactive, the permit policy does not match, and a subsequent deny policy for the same zones will deny and log the traffic. This combination enforces the time-based access control.

Answer

Create a single deny policy with a scheduler for outside business hours and set the action to deny with log.

Answer

Create a scheduler with the desired time range, apply it to the policy, and set the action to permit with log session-init and log session-close.

Answer

Create a scheduler with the desired time range, apply it to a deny policy placed above a permit policy, and set the action to deny with log.

Question 10

An administrator is configuring a custom application set on an SRX Series device to group multiple applications for use in a security policy. The application set will include both predefined and custom applications. Which two statements are true about application sets in Junos OS? (Choose two.)

Accepted Answer

An application set can be referenced in a security policy as the match application.. Application sets in Junos OS can include both predefined and custom applications, and they can be referenced in security policies to match traffic. They cannot be nested, they do not require a custom application, and they are not used in screen profiles. These two statements accurately describe the capabilities and usage of application sets.

Answer

An application set can be nested within another application set.

Answer

An application set can be used in a screen profile to define which applications to monitor.

Answer

An application set must contain at least one custom application.

Question 11

An administrator is configuring an address book entry in a security zone on an SRX Series device. The administrator needs to create an address book entry that represents a specific host with IP address 192.168.1.100 and a network with prefix 10.0.0.0/24. Which TWO address book object types can be used to accomplish this? (Choose two.)

Accepted Answer

address 192.168.1.100/32. In Junos OS security zones, address book entries can be defined as address objects, which can represent a host (using a /32 prefix) or a network (using a prefix length such as /24). The entries 192.168.1.100/32 and 10.0.0.0/24 directly define the required host and network. Address-sets are used to group multiple address objects and are not the primary object type for representing a single host or network. DNS hosts are used for dynamic resolution and are not applicable when specific IP addresses are provided.

Answer

address-set 10.0.0.0/24

Answer

address-set 192.168.1.100/32

Answer

dns-host www.example.com

Question 12

An administrator needs to verify that a specific security policy is matching traffic between two zones on an SRX Series device. Which command shows whether the policy is being evaluated and how many times it has matched?

Accepted Answer

show security policies hit-count. The hit-count command is purpose-built to show policy evaluation and match counts. It lets an administrator confirm that a specific policy between two zones is being evaluated and see how many times it has matched, which directly answers the question of whether the policy is active and effective.

Answer

show configuration security policies

Answer

show security flow session

Answer

show security zones

Question 13

An administrator wants to block access to a specific list of URLs on an SRX Series firewall. The administrator decides to use custom URL categories instead of a predefined category. Which statement describes how custom URL categories are used in content filtering?

Accepted Answer

Custom URL categories are defined locally on the SRX and can be referenced in a content filtering profile to block or permit traffic.. Custom URL categories are locally defined lists of URLs or domains that can be referenced in a content filtering profile. They allow administrators to block or permit access based on specific organizational requirements. Unlike predefined categories that are updated by the vendor, custom categories are managed by the administrator and do not require cloud synchronization. They can include domain names, URL patterns, and IP addresses, and can be used to enforce policies with actions like block or permit.

Answer

Custom URL categories must be synchronized with a cloud-based service and cannot be created locally.

Answer

Custom URL categories are only used for logging and cannot be used to block traffic.

Answer

Custom URL categories can only contain IP addresses, not domain names.

Question 14

A network engineer is configuring a source NAT pool on an SRX Series device. The pool contains two IP addresses: 198.51.100.1 and 198.51.100.2. The engineer wants to ensure that a single internal host always uses the same public IP address for the duration of its session, but different hosts can use different public IPs. Which allocation method should be used?

Accepted Answer

address-persistent. The address-persistent allocation method ensures that a specific internal host consistently uses the same public IP address from the pool for its sessions. This provides the desired per-host consistency while still allowing multiple hosts to share the pool. Round-robin would distribute sessions randomly, and paired is for static mappings. Therefore, address-persistent is the correct choice.

Answer

no-translation

Answer

paired

Answer

round-robin

Question 15

An administrator is configuring antispam on an SRX Series firewall. The administrator wants to use both a local list and a remote server for spam filtering. Which two statements are correct about antispam configuration on the SRX? (Choose two.)

Accepted Answer

The SRX can use a remote antispam server, such as a cloud-based service, to check email for spam.. Antispam on the SRX supports both local custom lists and remote servers. Custom lists allow administrators to define specific email addresses or domains to always permit or block, providing granular control. Remote servers, such as cloud-based services, can be used to offload spam detection and provide more comprehensive and up-to-date spam signatures. These two features can be used together to enhance spam filtering. Antispam does not require SSL decryption and can be applied to both inbound and outbound SMTP traffic.

Answer

The SRX only supports antispam for POP3 and IMAP, not SMTP.

Answer

Antispam profiles can only be applied to outbound email, not inbound.

Answer

Antispam inspection on the SRX requires the email to be decrypted using SSL forward proxy.