JNCIA-SEC Practice Test 2 — 30 Questions

Question 1

When configuring physical and logical interfaces on an SRX Series device, which TWO parameters are required to properly define a logical unit for IP routing? (Choose two)

Accepted Answer

Family inet IP address assignment. Option D is correct because a logical unit must be assigned an IP address under a protocol family, and for IP routing this is done with the family inet address statement (e.g., set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/24), which gives the interface its routable Layer 3 identity. Option E is correct because every logical interface is identified by a unit number, such as unit 0, and this unit number is what binds the configuration stanza (family inet address, VLAN tagging, etc.) to a specific logical interface on the physical port. Option A is not required because BGP is a routing protocol that is configured separately under protocols bgp with an autonomous system number; it is not part of defining a logical unit for IP routing. Option B is not required because a redundancy group ID is only used in chassis cluster configurations to control failover, not to define a logical interface. Option C is not required because MAC address override is an optional Layer 2 setting used in specific scenarios such as certain HA or switching designs, not a mandatory parameter for a logical unit carrying IP routing.

Answer

BGP autonomous system number

Answer

Chassis cluster redundancy group ID

Answer

MAC address override

Question 2

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Accepted Answer

Existing active sessions remain open until they naturally expire or idle out, but new sessions are blocked.. Schedulers in Junos security policies control session creation; existing active sessions are not automatically terminated when the schedule expires unless specifically configured or aged out.

Answer

The device reboots to clear the session table and re-evaluate all rules.

Answer

Existing sessions are immediately converted to 'reject' action state and send ICMP unreachable messages.

Answer

Existing active sessions are immediately terminated the moment the schedule window closes.

Question 3

An engineer is debugging an IPsec VPN tunnel that fails to establish. They want to enable tracing for IKE negotiations to inspect packet exchanges. Where should IKE traceoptions be configured?

Accepted Answer

[edit security ike traceoptions]. IKE tracing is configured under the [edit security ike traceoptions] hierarchy.

Answer

[edit security ipsec traceoptions]

Answer

[edit protocols ike traceoptions]

Answer

[edit system services ike traceoptions]

Question 4

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

Accepted Answer

The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.. If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Answer

The source zone does not have host-inbound-traffic enabled for UDP.

Answer

UDP traffic cannot be matched by security policies and requires stateless filters.

Answer

Global policies always block custom applications by default.

Question 5

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. To trace packets for a specific source IP on an SRX, you configure flow traceoptions under [edit security flow traceoptions]. This allows you to capture detailed packet flow logs, including session creation, policy lookups, and NAT translations. The command 'set security flow traceoptions file flow-debug' specifies the trace file, and additional parameters like 'set security flow traceoptions packet-filter' can filter by source IP. The other options are either for system logging, application firewall logs, or firewall filter counters, none of which provide detailed flow tracing.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 6

You are deploying a vSRX in an AWS or Azure cloud environment and need to configure security zones. How do security zones on a vSRX behave compared to a physical SRX Series gateway?

Accepted Answer

vSRX security zones function identically to physical SRX devices, binding virtual interfaces to zones for policy enforcement.. Security zones on vSRX function identically to physical SRX devices. You bind virtual interfaces to zones, and security policies are enforced based on zone context. The underlying Junos OS security features are the same, ensuring consistent policy enforcement in cloud environments.

Answer

vSRX does not support security zones; it only uses firewall filters.

Answer

vSRX only supports a single default security zone.

Answer

vSRX security zones are managed exclusively through AWS/Azure native security groups.

Question 7

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

Accepted Answer

Configure NTP on the SRX device to synchronize time with a reliable time server.. The recommended best practice for ensuring security policy schedules work correctly is to configure NTP on the SRX device so its clock is synchronized with a reliable time source. Accurate, synchronized time is essential because schedule-based policies rely on the device's local clock, and drift or time zone mismatches can cause schedules to activate at the wrong times.

Answer

Manually restart the flow processing daemon (flowd) after every time zone change.

Answer

Convert all schedule parameters in the policy configuration to use absolute epoch timestamps.

Answer

Disable stateful inspection so that schedule checks occur on every individual packet.

Question 8

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Accepted Answer

No, security zones are tied to interfaces, and interfaces belong to a single routing instance.. Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.

Answer

Yes, provided the virtual routers are interconnected by internal tunnels.

Answer

No, unless logical systems (Logical Systems) are configured on the SRX device.

Answer

Yes, by defining the security zone at the global routing instance level.

Question 9

Which statement accurately describes zone-based security policies in Junos OS?

Accepted Answer

Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.. Zone-based security policies require traffic to be explicitly permitted between security zones, as the default behavior is deny-all.

Answer

Security policies are always applied globally and do not require zone definitions.

Answer

Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.

Answer

Policies defined under the global context take precedence over all zone-based policies.

Question 10

You suspect that session timeouts are too aggressive for a specific long-lived TCP application. Which command allows you to check current TCP timeout configurations on an SRX?

Accepted Answer

show security flow timeout. 'show security flow timeout' displays the current timeout values for TCP, UDP, ICMP, and other session types on the SRX. It is the direct command to verify whether TCP timeouts are too aggressive for a long-lived application.

Answer

show security session timeout-status

Answer

show firewall timeout-settings

Answer

show system connection-timeout

Question 11

An administrator configures traceoptions for security policies. Where can they find the resulting log output file?

Accepted Answer

/var/log/. Traceoptions output files are written to /var/log/ by default on Junos devices. When you configure traceoptions under [edit security policies traceoptions], the 'file' statement specifies a filename that is created in /var/log/, and the resulting trace data is written there. Administrators retrieve it with 'show log <filename>' from the CLI.

Answer

/config/trace/

Answer

/tmp/

Answer

/var/db/

Question 12

Which TWO troubleshooting steps should an administrator take when a Source NAT pool reports port exhaustion? (Choose two)

Accepted Answer

Configure port-sharing or review persistent-nat settings to optimize port distribution across pool addresses.. Option B is correct because Source NAT port exhaustion occurs when the available source ports on the pool's IP addresses are consumed; enabling port-sharing (allowing multiple sessions to share translated ports via different source addresses/ports) or reviewing persistent NAT settings (which can pin mappings and reduce reusable ports) directly optimizes how ports are distributed across the pool addresses. Option D is correct because the fundamental capacity limit is (number of pool IPs × available ports per IP), so adding more public IP addresses to the source NAT pool increases the total port capacity and relieves exhaustion. Option A is wrong because clearing the routing forwarding table does not free NAT port allocations and would disrupt traffic without addressing the port shortage. Option C is wrong because converting Source NAT to Destination NAT changes the traffic direction/purpose entirely and does not solve outbound translation port exhaustion. Option E is wrong because disabling security flow processing on the trust zone would break stateful inspection and NAT processing rather than resolve the port exhaustion.

Answer

Clear the routing forwarding table.

Answer

Convert all Source NAT rules into Destination NAT rules.

Answer

Disable security flow processing on the trust zone.

Question 13

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

Accepted Answer

[edit security screen traceoptions]. Screen traceoptions are configured under the [edit security screen traceoptions] hierarchy.

Answer

[edit system traceoptions screen]

Answer

[edit security flow traceoptions screen]

Answer

[edit security zones security-zone screen traceoptions]

Question 14

Which THREE statements are true regarding Junos security policy configuration hierarchy and syntax? (Choose three.)

Accepted Answer

Policies are evaluated top-down within their specific zone pair context.. Option A is correct because Junos security policies are evaluated in a top-down, first-match order within the specific zone-pair context (from-zone X to-zone Y), so the first matching policy's action is applied and subsequent policies are not evaluated. Option B is correct because the configuration hierarchy organizes policies under the zone-pair structure, i.e., security policies are defined under 'from-zone to-zone ' stanzas, which is the fundamental organizational model in Junos. Option D is correct because a single security policy can contain multiple match terms (source-address, destination-address, application, etc.), and all terms within a policy must match for the policy's action to be applied. Option C is incorrect because Junos uses a candidate configuration model; policy changes must be committed with the 'commit' command before they take effect. Option E is incorrect because security policies can be configured via the CLI (set security policies from-zone ... to-zone ...) as well as J-Web, so they are not limited to J-Web.

Answer

Policy configuration changes take effect immediately without requiring a commit command.

Answer

Policies can only be configured via J-Web and are unsupported on the CLI.

Question 15

During session table analysis, you notice a session stuck in the 'SynSent' state. What does this state indicate about the traffic flow?

Accepted Answer

The SRX has received a SYN packet from the source, but no SYN-ACK has been returned from the destination.. In Junos security flow, TCP session states track the handshake. SynSent indicates the SRX has seen a TCP SYN packet from the client, but has not yet seen the SYN-ACK from the server.

Answer

The TCP session has timed out and is waiting to be purged from memory.

Answer

The server has reset the connection via a RST packet.

Answer

The three-way handshake has completed successfully and data transfer is underway.

Question 16

An administrator needs to monitor CPU and memory utilization of the Routing Engine and Forwarding Plane on an SRX device. Which command provides this hardware health overview?

Accepted Answer

show system resources. The 'show system resources' command displays CPU and memory utilization for both the Routing Engine and the Forwarding Plane (if applicable) on SRX devices. It provides a snapshot of current resource usage, including load averages, memory usage, and process information, making it the correct command for a hardware health overview.

Answer

show chassis hardware

Answer

show security flow status

Answer

show security monitoring resources

Question 17

Which command is used to clear UTM antivirus statistics counters on an SRX Series firewall?

Accepted Answer

clear security utm antivirus statistics. The correct command is `clear security utm antivirus statistics`. On Juniper SRX devices, the `clear` command is used to reset operational counters and statistics. The UTM antivirus module maintains statistics such as scanned files, infected files, and scan errors, and these are cleared using the `clear security utm antivirus statistics` command. This command is part of the standard Junos CLI operational mode and directly targets the antivirus statistics table.

Answer

clear system antivirus counters

Answer

request security utm antivirus clear-stats

Answer

reset security utm antivirus counters

Question 18

An administrator has deployed a vSRX Virtual Firewall in an enterprise private cloud environment. During performance testing, the administrator notices that packet drops are occurring due to vCPU bottlenecks in the virtualized data plane. Which vSRX architecture component is directly responsible for processing the security services and data plane traffic in a vSRX?

Accepted Answer

The virtual Packet Forwarding Engine (vPFE) running data plane vCPUs.. The vSRX architecture splits control plane and data plane functions into separate virtual machines/containers. The virtual Packet Forwarding Engine (vPFE) is the component that runs on dedicated data plane vCPUs and is responsible for all packet forwarding, session setup, NAT, security policy enforcement, and other security services. When performance testing reveals vCPU bottlenecks in the data plane, it is the vPFE's vCPU allocation that must be increased or optimized. The Routing Engine (RE) only handles control plane protocols and management, not the actual traffic processing.

Answer

The Junos Space centralized management microservice.

Answer

The Routing Engine (RE) vCPU handling the Junos kernel daemon (rpd).

Answer

The hypervisor management daemon vSwitch controller.

Question 19

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Accepted Answer

SIP (Session Initiation Protocol). SIP (B) is correct because SIP signaling embeds IP addresses and port numbers in its message bodies (SDP payloads), so a Junos ALG must inspect and rewrite those fields to open the correct pinholes for the RTP media streams. TFTP (C) is correct because it negotiates a dynamic secondary UDP port during the initial exchange, and the Junos TFTP ALG opens that data-channel pinhole automatically. FTP (D) is correct because FTP uses a separate data connection whose port is signaled in the control channel (PORT/PASV), requiring the Junos FTP ALG to inspect and permit that dynamic flow. HTTP (A) is not marked correct because it is a single-connection protocol that does not embed dynamic addressing requiring ALG pinhole creation, and SSH (E) is not marked correct because it runs over a single TCP port 22 without negotiated secondary data channels.

Answer

HTTP (Hypertext Transfer Protocol)

Answer

SSH (Secure Shell)

Question 20

Which TWO protocols are supported for Antivirus scanning within Juniper SRX UTM profiles? (Choose two.)

Accepted Answer

HTTP. Options A (HTTP) and D (SMTP) are correct because Juniper SRX UTM antivirus profiles support scanning of the HTTP, SMTP, POP3, IMAP, FTP, and SMB protocols, so HTTP and SMTP are both valid protocol types for antivirus scanning. HTTP scanning inspects web traffic for malicious content, while SMTP scanning inspects email traffic for virus attachments. The remaining options do not belong: BGP is a routing protocol, SNMP is used for network management, and NTP is used for time synchronization, none of which carry user file content that UTM antivirus would scan.

Answer

BGP

Answer

SNMP

Answer

NTP