JNCIA-SEC Practice Test 4 — 10 Questions

Question 1

When configuring physical and logical interfaces on an SRX Series device, which TWO parameters are required to properly define a logical unit for IP routing? (Choose two)

Accepted Answer

Family inet IP address assignment. Option D is correct because a logical unit must be assigned an IP address under a protocol family, and for IP routing this is done with the family inet address statement (e.g., set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/24), which gives the interface its routable Layer 3 identity. Option E is correct because every logical interface is identified by a unit number, such as unit 0, and this unit number is what binds the configuration stanza (family inet address, VLAN tagging, etc.) to a specific logical interface on the physical port. Option A is not required because BGP is a routing protocol that is configured separately under protocols bgp with an autonomous system number; it is not part of defining a logical unit for IP routing. Option B is not required because a redundancy group ID is only used in chassis cluster configurations to control failover, not to define a logical interface. Option C is not required because MAC address override is an optional Layer 2 setting used in specific scenarios such as certain HA or switching designs, not a mandatory parameter for a logical unit carrying IP routing.

Answer

BGP autonomous system number

Answer

Chassis cluster redundancy group ID

Answer

MAC address override

Question 2

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Accepted Answer

Existing active sessions remain open until they naturally expire or idle out, but new sessions are blocked.. Schedulers in Junos security policies control session creation; existing active sessions are not automatically terminated when the schedule expires unless specifically configured or aged out.

Answer

The device reboots to clear the session table and re-evaluate all rules.

Answer

Existing sessions are immediately converted to 'reject' action state and send ICMP unreachable messages.

Answer

Existing active sessions are immediately terminated the moment the schedule window closes.

Question 3

An engineer is debugging an IPsec VPN tunnel that fails to establish. They want to enable tracing for IKE negotiations to inspect packet exchanges. Where should IKE traceoptions be configured?

Accepted Answer

[edit security ike traceoptions]. IKE tracing is configured under the [edit security ike traceoptions] hierarchy.

Answer

[edit security ipsec traceoptions]

Answer

[edit protocols ike traceoptions]

Answer

[edit system services ike traceoptions]

Question 4

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

Accepted Answer

The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.. If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Answer

The source zone does not have host-inbound-traffic enabled for UDP.

Answer

UDP traffic cannot be matched by security policies and requires stateless filters.

Answer

Global policies always block custom applications by default.

Question 5

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. To trace packets for a specific source IP on an SRX, you configure flow traceoptions under [edit security flow traceoptions]. This allows you to capture detailed packet flow logs, including session creation, policy lookups, and NAT translations. The command 'set security flow traceoptions file flow-debug' specifies the trace file, and additional parameters like 'set security flow traceoptions packet-filter' can filter by source IP. The other options are either for system logging, application firewall logs, or firewall filter counters, none of which provide detailed flow tracing.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 6

You are deploying a vSRX in an AWS or Azure cloud environment and need to configure security zones. How do security zones on a vSRX behave compared to a physical SRX Series gateway?

Accepted Answer

vSRX security zones function identically to physical SRX devices, binding virtual interfaces to zones for policy enforcement.. Security zones on vSRX function identically to physical SRX devices. You bind virtual interfaces to zones, and security policies are enforced based on zone context. The underlying Junos OS security features are the same, ensuring consistent policy enforcement in cloud environments.

Answer

vSRX does not support security zones; it only uses firewall filters.

Answer

vSRX only supports a single default security zone.

Answer

vSRX security zones are managed exclusively through AWS/Azure native security groups.

Question 7

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

Accepted Answer

Configure NTP on the SRX device to synchronize time with a reliable time server.. The recommended best practice for ensuring security policy schedules work correctly is to configure NTP on the SRX device so its clock is synchronized with a reliable time source. Accurate, synchronized time is essential because schedule-based policies rely on the device's local clock, and drift or time zone mismatches can cause schedules to activate at the wrong times.

Answer

Manually restart the flow processing daemon (flowd) after every time zone change.

Answer

Convert all schedule parameters in the policy configuration to use absolute epoch timestamps.

Answer

Disable stateful inspection so that schedule checks occur on every individual packet.

Question 8

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Accepted Answer

No, security zones are tied to interfaces, and interfaces belong to a single routing instance.. Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.

Answer

Yes, provided the virtual routers are interconnected by internal tunnels.

Answer

No, unless logical systems (Logical Systems) are configured on the SRX device.

Answer

Yes, by defining the security zone at the global routing instance level.

Question 9

Which statement accurately describes zone-based security policies in Junos OS?

Accepted Answer

Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.. Zone-based security policies require traffic to be explicitly permitted between security zones, as the default behavior is deny-all.

Answer

Security policies are always applied globally and do not require zone definitions.

Answer

Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.

Answer

Policies defined under the global context take precedence over all zone-based policies.

Question 10

You suspect that session timeouts are too aggressive for a specific long-lived TCP application. Which command allows you to check current TCP timeout configurations on an SRX?

Accepted Answer

show security flow timeout. 'show security flow timeout' displays the current timeout values for TCP, UDP, ICMP, and other session types on the SRX. It is the direct command to verify whether TCP timeouts are too aggressive for a long-lived application.

Answer

show security session timeout-status

Answer

show firewall timeout-settings

Answer

show system connection-timeout