JNCIA-SEC Practice Test 2 — 30 Questions

Question 1

Which TWO protocols are supported for Antivirus scanning within Juniper SRX UTM profiles? (Choose two.)

Accepted Answer

HTTP. Junos UTM antivirus supports multiple protocols, including HTTP and SMTP for file and email attachment scanning.

Answer

BGP

Answer

SNMP

Answer

NTP

Question 2

Which Junos configuration hierarchy is used to create a UTM Policy Profile that bundles multiple security features?

Accepted Answer

[edit security utm policy-profile <name>]. UTM policy profiles are configured under the [edit security utm policy-profile] hierarchy.

Answer

[edit security policies utm-profile <name>]

Answer

[edit utm profile-policy <name>]

Answer

[edit security firewall utm-policy <name>]

Question 3

Which command displays the current active security policies applied on an SRX Series device?

Accepted Answer

show security policies. The show security policies command displays configured security policies and their rules.

Answer

show security zone policies

Answer

show route security-policy

Answer

show firewall security-rules

Question 4

Which TWO components are typically analyzed when troubleshooting an IPsec VPN Phase 1 negotiation failure using traceoptions? (Choose two)

Accepted Answer

IKE proposal matching (encryption, authentication, Diffie-Hellman group). Phase 1 troubleshooting examines IKE proposal matching, pre-shared keys or certificates, and exchange states.

Answer

BGP AS path attributes

Answer

IPsec Security Association lifetime and Phase 2 selectors

Answer

OSPF neighbor adjacency timers

Question 5

Which TWO actions should an administrator take when configuring security policy traceoptions to effectively debug a suspected policy drop issue? (Choose two)

Accepted Answer

Configure a target file name under traceoptions using the file statement.. When configuring traceoptions, specifying a file name and enabling specific flags (like policy or all) are mandatory steps to generate meaningful debug output.

Answer

Restart the Routing Engine to apply traceoptions.

Answer

Enable stateless firewall filters on all transit interfaces.

Answer

Disable all security zones during tracing.

Question 6

Which UTM feature should an administrator configure to prevent employees from accessing gambling and adult content websites?

Accepted Answer

Web Filtering. Web filtering categorizes websites into various groups, including gambling and adult content, allowing administrators to block them.

Answer

Antivirus

Answer

Antispam

Answer

Content Filtering

Question 7

Which TWO commands help verify security zone configurations and interface memberships? (Choose two)

Accepted Answer

show security zones security-zone trust. Security zone status and interface membership are inspected via show security zones commands.

Answer

show route security-zones

Answer

show interfaces security-status

Answer

show firewall zone-membership

Question 8

An administrator enables traceoptions for IKE to troubleshoot a failing VPN negotiation. Where are these trace files stored by default on the SRX Series device?

Accepted Answer

/var/log/. Traceoptions files are stored in the /var/log/ directory by default on Junos OS devices.

Answer

/var/tmp/traces/

Answer

/etc/log/ike/

Answer

/config/sec/

Question 9

An administrator configures Content Filtering to block all .exe files, but users report that they can still download .exe files over encrypted HTTPS connections. What is the most likely reason for this?

Accepted Answer

HTTPS decryption (SSL proxy) is not configured, so the firewall cannot inspect the encrypted payload for file extensions.. Content filtering inspects cleartext HTTP streams; encrypted HTTPS streams cannot be inspected for file extensions unless SSL Proxy (HTTPS decryption) is enabled.

Answer

Content filtering only supports FTP traffic.

Answer

The content filtering license has expired.

Answer

The SRX control plane lacks memory.

Question 10

During session troubleshooting, you notice sessions entering the 'CLOSE-WAIT' state and lingering. What does this indicate in the Junos session table?

Accepted Answer

The local application has not yet issued a close command after receiving a FIN from the remote peer.. CLOSE-WAIT is a standard TCP state indicating that the local endpoint has received a connection termination request (FIN) from the remote side and is waiting for the local application to close.

Answer

The SRX security policy is actively dropping packets for this session.

Answer

IPsec Phase 2 re-keying is in progress.

Answer

The session is awaiting NAT port reallocation.

Question 11

Which TWO actions can help an administrator troubleshoot why a security policy is not matching expected traffic? (Choose two)

Accepted Answer

Check policy hit counts using 'show security policies hit-count'. Policy matching troubleshooting involves checking policy hit counts and using flow traceoptions.

Answer

Clear the BGP routing table

Answer

Reset physical interface duplex settings

Answer

Restart the routing protocol daemon (rpd)

Question 12

Which statement correctly identifies the purpose of Junos OS functional zones?

Accepted Answer

Functional zones are built-in system zones used to handle specific traffic types like management or host-bound traffic.. Functional zones are pre-defined system zones that handle specialized traffic such as management or device-originated traffic.

Answer

Functional zones replace security policies for inter-VLAN routing.

Answer

Functional zones are created by administrators to group high-priority servers.

Answer

Functional zones allow unauthenticated guest access without security policies.

Question 13

You need to verify the operational status of an IPsec VPN tunnel on an SRX Series device. Which command provides detailed tunnel status including Phase 1 and Phase 2 associations?

Accepted Answer

show security ipsec security-associations. The show security ike security-associations and show security ipsec security-associations commands are used to inspect VPN tunnels.

Answer

show security flow vpn-status

Answer

show security ike sa-detail

Answer

show vpn ipsec active

Question 14

Which THREE types of information are displayed when executing the 'show security flow session extensive' command? (Choose three)

Accepted Answer

NAT translation mapping details. The extensive modifier on session commands reveals AppID details, NAT translations, and packet counters.

Answer

BGP routing table metric attributes

Answer

The physical cable length connected to the interface

Question 15

Which THREE checks should be performed when troubleshooting source NAT translation failures? (Choose three)

Accepted Answer

Verify that the source NAT rule is active and correctly applied to the traffic zone. NAT troubleshooting involves checking translation rules, pool address availability, and security policy permits.

Answer

Check IKE Phase 1 authentication keys

Answer

Verify that static routing table metrics are set to preferred values

Question 16

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. Security policy logging options (such as log { init session-close; }) are specified inside the then statement of a policy rule.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 17

You are troubleshooting a high CPU condition on the Routing Engine and suspect that intensive logging might be the cause. Where would you check the configuration for security log rates or stream settings?

Accepted Answer

[edit security log]. Global security log settings, including stream configuration and rate limiting, are configured under the [edit security log] hierarchy.

Answer

[edit system syslog]

Answer

[edit chassis forwarding-options log]

Answer

[edit security policies log]

Question 18

Which THREE parameters can be adjusted under the [edit security flow timeout] hierarchy to manage session table aging? (Choose three)

Accepted Answer

tcp-established. Flow timeouts can be customized for TCP established/max, UDP, and ICMP sessions.

Answer

bgp-hold-time

Answer

ike-lifetime

Question 19

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. Security flow traceoptions allow administrators to track packet processing steps through the security engine, capturing drop reasons and state changes.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 20

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Accepted Answer

LAND attacks. SCREEN options protect against IP spoofing, SYN floods, and LAND attacks among other Layer 3/4 threats.

Answer

Cross-site scripting (XSS) browser exploits

Answer

SQL injection web application attacks