JNCIA-SEC Practice Test 3 — 10 Questions

Question 1

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

Accepted Answer

Custom applications can include inactivity timeout settings.. Custom applications allow specifying protocol, source ports, and destination ports for policy matching.

Answer

Custom applications automatically generate Application Layer Gateways for proprietary protocols without manual configuration.

Answer

Custom applications are restricted to global policies only and cannot be used in zone-to-zone policies.

Answer

Custom applications can overwrite built-in predefined Junos applications if named identically.

Question 2

An administrator needs to quickly check the number of active sessions currently residing on an SRX Series device to troubleshoot potential memory exhaustion. Which command should be used?

Accepted Answer

show security flow session summary. The command 'show security flow session summary' provides a concise, high-level count of active sessions on an SRX Series device, including total sessions, and often a breakdown by protocol or type. This directly addresses the administrator's need to quickly assess session volume, which is critical when troubleshooting potential memory exhaustion because each session consumes memory resources. Unlike more verbose commands, the summary output is immediate and does not require parsing detailed session lists.

Answer

show system connections

Answer

show security flow statistics

Answer

show security monitoring statistics

Question 3

An administrator needs to create a unified security policy that permits traffic from the trust zone to the untrust zone. Using Junos J-Web, which primary menu path should the administrator navigate to configure this security policy?

Accepted Answer

Configure > Security Services > Security Policies. In Junos J-Web, security policies are configured under the 'Configure > Security Services > Security Policies' menu path. This is the primary location where administrators create, edit, and manage zone-based security policies. From this menu, you can define policies between zones, specify source and destination addresses, applications, and actions.

Answer

Monitor > Security > Policy Overview

Answer

Security Services > NAT > Rules

Answer

Configure > Network > Zones and Interfaces

Question 4

An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?

Accepted Answer

It detects and blocks ICMP timestamp request packets that could be used for reconnaissance or flooding.. The icmp timestamp SCREEN option protects against ICMP timestamp flood or manipulation attacks by monitoring or blocking ICMP timestamp request and reply packets.

Answer

It timestamps every transit packet passing through the security zone for latency analysis.

Answer

It drops all ICMP packets that have invalid timestamp header fields.

Answer

It synchronizes the SRX system clock using ICMP timestamp replies from trusted gateways.

Question 5

Which Junos configuration mode command is used to enter the NAT configuration hierarchy?

Accepted Answer

edit security nat. The correct command to enter the NAT configuration hierarchy on a Junos SRX is 'edit security nat'. This places the user in [edit security nat] where source, destination, and static NAT rules are configured. NAT is a security feature on SRX, so it resides under the 'security' hierarchy, not under system, routing-options, or firewall.

Answer

edit system nat-configuration

Answer

edit routing-options nat

Answer

edit firewall nat

Question 6

An administrator is configuring a chassis cluster on two SRX Series devices. Which THREE requirements must be met to ensure proper cluster formation and stability? (Choose three)

Accepted Answer

Both devices must be the exact same SRX hardware model and run the same Junos OS version.. Option B is correct because a chassis cluster requires identical SRX hardware models and matching Junos OS versions so that the control and fabric links, redundancy groups, and failover logic operate consistently between the two nodes. Option C is correct because each node must have a unique node ID (Node 0 and Node 1) assigned, which is essential for the cluster to identify members, form redundancy groups, and manage failover correctly. Option D is correct because dedicated fabric and control links (fab0/fab1) must be physically connected between the nodes to carry cluster control traffic, heartbeats, and fabric forwarding, which are required for proper cluster formation and stability. Option A is not required because cluster control ports are internal links between the two SRX devices, not connections to an external public internet switch. Option E is incorrect because running different Junos OS major versions is unsupported and would prevent stable cluster formation, not prevent split-brain.

Answer

Cluster control ports must connect to an external public internet switch.

Answer

Both devices must have different Junos OS major versions to prevent split-brain.

Question 7

Which command displays the current active security policies applied on an SRX Series device?

Accepted Answer

show security policies. The command 'show security policies' displays the current active security policies configured on an SRX Series device, including zone context, source/destination addresses, applications, and actions. It is the standard operational command for verifying policy configuration and hit counts. Variants like 'show security policies hit-count' or 'show security policies detail' extend the output.

Answer

show security zone policies

Answer

show route security-policy

Answer

show firewall security-rules

Question 8

Which TWO tasks are primarily handled by the Routing Engine (RE) on a dual-RE physical SRX Series device? (Choose two)

Accepted Answer

Executing the routing protocol daemon (rpd) to exchange routing information. The Routing Engine manages control plane tasks, such as running the routing protocol daemon (rpd) and managing device access and configuration. Data plane tasks like session creation and packet forwarding are handled by the PFE/SPU.

Answer

Executing physical layer framing on physical interface transceivers

Answer

Processing high-speed security sessions and firewall policy enforcement

Answer

Performing hardware-accelerated NAT translations in the data plane

Question 9

An administrator configures Interface-based Source NAT. When checking operational status, the administrator wants to verify which interface IP is being used for translation and confirm traffic flow. Which command provides detailed flow session information including the translated interface IP?

Accepted Answer

show security flow session. The 'show security flow session' command on Junos SRX displays detailed session information including the source and destination addresses before and after NAT translation, the translated interface IP, and the session state. This makes it the correct tool for verifying which interface IP is being used for source NAT translation while confirming active traffic flow. It provides both the pre-NAT and post-NAT tuples, which is exactly what the administrator needs.

Answer

show nat interface statistics

Answer

show security interface nat-status

Answer

show system services interface translation

Question 10

An SRX Series device is operating in flow-based mode. An administrator needs to verify how many concurrent sessions are currently active in the security session table and check resource utilization. Which operational command should be used?

Accepted Answer

show security flow session summary. The show security flow session summary command provides statistical counts of active sessions, TCP/UDP protocols, and memory utilization by the session table.

Answer

show system sessions count

Answer

show route forwarding-table summary

Answer

show chassis routing-engine