JNCIA-SEC Practice Questions 1 — 50 Questions

Question 1

You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?

Accepted Answer

ip spoofing. IP spoofing detection in SCREEN options checks if incoming packets have source addresses matching the local router interfaces or martian networks.

Answer

icmp ping-sweep block

Answer

tcp syn-fraud detection

Answer

land attack prevention

Question 2

Which operational command should you use to view active stateful firewall sessions currently passing through an SRX Series device?

Accepted Answer

show security flow session. `show security flow session` is the operational command that displays the stateful session table on an SRX, including source/destination IPs, ports, protocol, policy name, and session state (e.g., 'Forward', 'Drop'). It is the primary tool for verifying that traffic is being permitted and tracked by the flow daemon.

Answer

show security policies active

Answer

show route active-sessions

Answer

show interfaces extensive session

Question 3

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool is exhausted, the SRX cannot allocate a new source port for a new session. Since NAT is a mandatory step in the first path packet processing for that policy, the session creation fails and the packet is dropped. The 'show security nat source pool' command would show the pool's utilization at 100%, confirming resource exhaustion.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 4

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

Accepted Answer

Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.. In Juniper SRX source NAT, rules within a rule-set are evaluated top-down and the first match wins, so a broad or restrictive rule placed above a more specific rule will shadow it. The fix is to order rules from most specific to least specific, or to split rules into separate rule-sets per zone so that Zone A's restrictive rules cannot interfere with Zone B's traffic. This restores correct pool selection and prevents the session drops Zone B is experiencing.

Answer

Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

Answer

Enable global zone-bypass mode for all source NAT pools.

Answer

Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

Question 5

What is the primary role of the Routing Engine (RE) in an enterprise SRX Series gateway?

Accepted Answer

Executing control plane functions, running Junos OS, managing routing protocols, and processing device configuration. The Routing Engine (RE) in an SRX Series gateway is responsible for control plane functions: it runs Junos OS, manages routing protocols, processes configuration, and handles management tasks. It does not forward data traffic; that is the role of the Packet Forwarding Engine (PFE).

Answer

Encrypting IPsec VPN traffic using specialized cryptographic hardware chips

Answer

Processing stateful packet inspection and fast-path data forwarding

Answer

Providing physical Ethernet port switching

Question 6

An administrator is troubleshooting a vSRX deployment where packet forwarding performance is severely degraded. They suspect that the virtual interfaces are not utilizing direct memory access or optimized packet processing drivers. Which virtualization technology integration is critical for optimal vSRX performance?

Accepted Answer

SR-IOV or DPDK integration. SRIOV (Single Root I/O Virtualization) or DPDK (Data Plane Development Kit) is essential for high-performance virtual packet processing in vSRX deployments.

Answer

Virtual machine snapshot scheduling

Answer

SNMP v3 trap forwarding

Answer

RADIUS accounting synchronization

Question 7

You need to inspect the live packet flow for a specific source IP address traversing the SRX device. Which utility can you use from the Junos CLI to capture packets on a specific interface with filtering options?

Accepted Answer

monitor traffic interface <interface-name>. The monitor traffic interface command uses tcpdump-like syntax to capture and inspect live packets passing through a specified interface.

Answer

traceoptions packet-capture

Answer

show security flow packet-capture

Answer

ping diagnostic capture

Question 8

An administrator configures a Source NAT rule-set with 'from zone trust' and 'to zone untrust'. Internal users can successfully browse the internet. Later, a new interface and zone (DMZ) are added, and hosts in the DMZ also need Source NAT to the untrust zone using the same pool. What is the most efficient way to achieve this?

Accepted Answer

Modify the existing rule-set to include the DMZ zone in the 'from zone' statement, or create an additional rule-set for the DMZ zone.. The most efficient approach is to either modify the existing rule-set's 'from zone' statement to include the DMZ zone (if the same pool and translation are desired) or create an additional rule-set for the DMZ zone. This reuses the existing NAT pool and configuration without global changes, preserving the trust zone rule-set's specificity.

Answer

Enable global NAT mode under the system hierarchy to automatically apply NAT across all zones.

Answer

Delete the trust zone rule-set and recreate it globally without specifying any source zone.

Answer

Configure static routes from the DMZ zone directly to the untrust zone to bypass NAT requirements.

Question 9

An administrator configures a security policy with source address set 'Internal-Subnets', destination address 'Any', and application 'junos-ftp'. During testing, active FTP data connections (PASV mode) are failing. What security policy consideration is most relevant to fixing this issue?

Accepted Answer

The FTP Application Layer Gateway (ALG) must be enabled to dynamically open security sessions for data channels.. FTP uses dynamically negotiated data ports, requiring the Junos ALG (Application Layer Gateway) for FTP to be active so security policies dynamically permit the data channel.

Answer

The security policy action must be changed from 'permit' to 'allow-pasv'.

Answer

FTP must be replaced with SFTP because security policies cannot support stateful FTP parsing.

Answer

A separate security policy must be created allowing traffic from untrust back to trust for port 20.

Question 10

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.

Question 11

Where are system log messages related to security policies typically directed when default logging configurations are used?

Accepted Answer

To the local log file configured under system syslog, such as interactive-commands or security-log. Security policy logs are sent via security daemon (secd) and flow module to the local syslog utility, usually directed to a file or remote collector.

Answer

Directly to the active user terminal screen by default

Answer

To the kernel crash dump utility

Answer

To the boot-time NVRAM partition

Question 12

An administrator configures Destination NAT to forward incoming traffic on port 80 to an internal server. After committing, the administrator notices that ping tests to the destination NAT public IP address fail. What is the standard behavior of Destination NAT regarding ICMP ping requests?

Accepted Answer

Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.. Destination NAT rules that match specific TCP/UDP ports (like port 80) do not translate ICMP traffic because ICMP does not use ports. Therefore, ping requests to the public IP are not forwarded to the internal server, resulting in failed pings unless an ICMP-specific Destination NAT rule is configured. This is standard Junos behavior.

Answer

ICMP ping requests are dropped by the Junos control plane as a security hardening default.

Answer

Destination NAT automatically translates and responds to all ICMP echo requests by default.

Answer

Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.

Question 13

Which Junos configuration hierarchy is used to define a UTM Web Filtering profile?

Accepted Answer

[edit security utm feature-profile web-filtering profile <name>]. UTM feature profiles are configured under the [edit security utm feature-profile web-filtering] hierarchy.

Answer

[edit firewall utm-policy web-filter]

Answer

[edit security web-filter profile <name>]

Answer

[edit applications utm web-filtering]

Question 14

You are configuring a security policy and need to reference a group of IP addresses that frequently changes. You decide to use an address set. How do you add individual address entries into this address set?

Accepted Answer

By referencing the individual address entries within the address-set definition statement.. An address set in Junos is a named container that groups multiple address book entries. To add individual address entries into the set, you reference them within the address-set definition using the 'address' statement (e.g., 'set security address-book global address-set MySet address Server1'). This creates a logical group that can be referenced in policies.

Answer

By applying firewall filter terms to the address set container.

Answer

By assigning the address set to an interface unit.

Answer

By listing raw IP subnet masks directly inside the security policy match statement.

Question 15

Which statement correctly describes a Junos security zone requirement before you can apply a security policy referencing that zone?

Accepted Answer

The zone must have at least one active interface assigned to it.. Before a security policy can reference a zone, that zone must have at least one active interface assigned to it. Junos requires zones to be bound to physical or logical interfaces so the device knows which ingress and egress points the zone represents; a zone with no interfaces cannot participate in policy evaluation.

Answer

The zone must be assigned to a virtual router routing instance.

Answer

The zone must have screen options enabled for DoS protection.

Answer

The zone must have an IPv4 address assigned directly to the zone context.

Question 16

Which THREE parameters can be configured within a UTM policy profile on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

Antispam profile reference. A UTM policy profile on a Juniper SRX is essentially a container that binds together the various content-security profiles applied to traffic, so option B (Antispam profile reference) is correct because the UTM policy specifies which antispam profile to use for matching traffic. Option D (Antivirus profile reference) is correct because the UTM policy likewise references an antivirus profile to scan sessions for malware. Option E (Web-filtering profile reference) is correct because the UTM policy also references a web-filtering (URL filtering) profile to categorize and block or permit web content. Options A and C are incorrect: IPsec VPN IKE gateway settings are configured under the VPN/IKE hierarchy, not inside a UTM policy, and BGP routing protocol parameters belong to routing-options/protocols configuration, which is unrelated to UTM content security.

Answer

IPsec VPNike gateway settings

Answer

BGP routing protocol parameters

Question 17

Which THREE types of logging modifiers are available when configuring logging in a Junos security policy? (Choose three.)

Accepted Answer

session-init. In Junos security policy configuration, the log option accepts three logging modifiers: session-init, session-close, and periodic. Option B (session-init) is correct because it generates a log entry when a session is first established, capturing the initial session setup details. Option D (session-close) is correct because it logs when a session is torn down, recording session termination information such as bytes transferred. Option E (periodic) is correct because it produces log entries at regular intervals during the lifetime of a long-lived session, providing ongoing session statistics. Options A (packet-drop-immediate) and C (state-change-alert) are not valid Junos logging modifiers for security policies; they do not exist as configurable log options in the Junos security policy syntax.

Answer

packet-drop-immediate

Answer

state-change-alert

Question 18

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

Accepted Answer

Security zones. Security zones, address books, and screen options are all configured under [edit security].

Answer

VLAN bridge domain definitions

Answer

BGP routing protocol peering parameters

Question 19

An administrator needs to troubleshoot an intermittent application failure across an SRX Series firewall. They decide to use security flow traceoptions with a specific match condition for the client and server IP addresses. Where are the resulting trace files saved by default on the SRX Series device?

Accepted Answer

/var/log/. By default, Junos trace files are stored in the /var/log/ directory.

Answer

/var/tmp/trace/

Answer

/var/db/security/logs/

Answer

/config/logging/

Question 20

An administrator configures Content Filtering to block executable files (.exe). Users report that they can still download archives containing executable files inside them (.zip). What is the recommended way to prevent users from bypassing file extension blocks using compressed archives?

Accepted Answer

Add archive file extensions (such as .zip and .rar) to the content filtering block list.. To prevent users from bypassing file extension blocks using archives, content filtering or antivirus profiles should be configured to block archive types (.zip, .rar) or block password-protected/unscannable archives.

Answer

Convert the security policy from stateless to stateful inspection.

Answer

Enable BGP routing route-reflection for HTTP traffic.

Answer

Disable HTTP proxy caching on the client browsers.