JNCIA-SEC Practice Questions 2 — 50 Questions

Question 1

While investigating an issue where an IPsec VPN tunnel fails to pass data traffic, which THREE commands should you execute to verify Phase 1, Phase 2, and security associations? (Choose three)

Accepted Answer

show security ipsec security-associations. Option C, show security ipsec security-associations, is correct because it displays Phase 2 IPsec security associations, including the SA index, SPI, tunnel interface, and encryption/authentication algorithms, which directly verifies whether Phase 2 came up and is passing traffic. Option D, show security ike security-associations, is correct because it verifies Phase 1 by listing IKE SAs with peer addresses, role, state, and lifetime, confirming the IKE negotiation succeeded. Option E, show security ipsec statistics, is correct because it shows per-SA packet counters (ESP encrypt/decrypt, authentication failures, and replay errors), which reveals whether data traffic is actually traversing the tunnel or being dropped. Option A, show security alg status, is not relevant because ALGs handle application-layer NAT traversal (e.g., FTP, SIP) and do not verify IPsec Phase 1, Phase 2, or SAs. Option B, show security flow session summary, is not appropriate because it only gives aggregate session counts and does not show IKE/IPsec SA details or per-tunnel statistics.

Answer

show security alg status

Answer

show security flow session summary

Question 2

Which TWO methods or tools are available in Junos OS for monitoring active security sessions in real time? (Choose two)

Accepted Answer

show security flow session. Option B, 'show security flow session', is correct because it is the primary Junos OS operational command that displays the current active flow/session table in real time, showing source and destination addresses, ports, protocol, session state, and timeout for each active session. Option E, 'show security flow session summary', is correct because it is a variant of the same command that provides a real-time summarized count of active sessions (e.g., total sessions, sessions by protocol or service), which is useful for quick monitoring of session activity. Option A, 'show chassis routing-engine', is not correct because it reports Routing Engine hardware status such as CPU, memory, and temperature, not security sessions. Option C, 'show system processes', is not correct because it lists running system processes and their resource usage, not active security flows. Option D, 'show security zone statistics', is not correct because it displays per-zone packet counters and statistics rather than the active session table itself.

Answer

show chassis routing-engine

Answer

show system processes

Answer

show security zone statistics

Question 3

An administrator is troubleshooting a policy drop issue using security flow traceoptions. Which THREE configuration elements are required to successfully generate trace output? (Choose three)

Accepted Answer

Configure match criteria (such as source-ip or destination-ip) to isolate specific traffic.. To generate security flow traceoptions output, you must first define match criteria such as source-ip or destination-ip (option A) so the trace only captures the specific traffic being troubleshot rather than flooding the file with all flows. You must also configure the flag parameter (option B), which selects the specific events or packet types (for example basic-datapath, flow, or packet) that the trace will record. Finally, you must define a trace file name with optional size and count parameters (option E), because traceoptions write their results to a configured file and without a filename no output is produced. Option C is incorrect because the policy action (permit, deny, or reject) is irrelevant to whether trace output is generated; traceoptions can capture traffic regardless of the action taken. Option D is incorrect because security flow traceoptions is a Junos CLI feature and does not require kernel-level debugging through the FreeBSD shell.

Answer

Set the security policy action to 'reject' for the targeted traffic.

Answer

Enable kernel-level debugging via the FreeBSD shell.

Question 4

What is the purpose of the 'show security zones' command?

Accepted Answer

To display configured security zones and their associated interfaces and properties. The 'show security zones' command displays all configured security zones along with their associated interfaces, assigned screen profiles, and zone properties such as host-inbound-traffic settings. It is the primary command for verifying zone configuration and interface-to-zone binding on an SRX firewall.

Answer

To show routing table partitions

Answer

To list all active IPsec VPN tunnels

Answer

To monitor firewall CPU load per zone

Question 5

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Accepted Answer

Address book entries / Address sets. In Junos OS security policies, match criteria are built from address book entries and address sets (option B), which define the source and destination IP objects the policy evaluates, and from applications and application sets (option D), which define the Layer 4/7 services (e.g., junos-http, junos-ssh) permitted or denied. Both are standard configurable objects referenced under 'match source-address/destination-address' and 'match application' in a security policy. Functional zone names (option A) are used for interface classification and host-inbound traffic, not as payload-inspection match criteria, so they are not policy objects. SCREEN option profiles (option C) are referenced in zone configurations for IDS/attack detection, not inside security policies. Hardware crypto processor allocation maps (option E) are used for IPsec/flow crypto resource assignment, not as security policy match objects.

Answer

Functional zone names directly as match criteria for payload inspection

Answer

SCREEN option profiles

Answer

Hardware crypto processor allocation maps

Question 6

An administrator enables traceoptions for IKE to troubleshoot a failing VPN negotiation. Where are these trace files stored by default on the SRX Series device?

Accepted Answer

/var/log/. By default, Junos traceoptions files are stored in the /var/log/ directory on the SRX Series device. When you configure traceoptions without specifying a file path, the trace file is created under /var/log with the specified filename. This is the standard location for all trace and log files.

Answer

/var/tmp/traces/

Answer

/etc/log/ike/

Answer

/config/sec/

Question 7

What is the purpose of a Custom URL Category in Juniper SRX Web Filtering?

Accepted Answer

To define custom URL patterns and group them for specific permit or block actions.. Custom URL categories allow administrators to group specific custom URLs for tailored permit or block policies.

Answer

To configure IPsec VPN gateway endpoints.

Answer

To store antivirus malware signatures locally.

Answer

To define email sender white-lists.

Question 8

While analyzing packet flow using security flow traceoptions, you see the message: "ALG: and AlgOpen() failed". What does this indicate?

Accepted Answer

The Application Layer Gateway failed to allocate necessary resources or set up dynamic data channels.. The message 'ALG: and AlgOpen() failed' indicates that the Application Layer Gateway (ALG) failed to allocate resources or set up dynamic data channels. ALGs are responsible for handling protocols that embed IP addresses or ports in the payload (e.g., FTP, SIP) and require dynamic pinholes. This failure means the ALG could not perform its function, often due to resource exhaustion or configuration issues.

Answer

The primary security policy denied the initial control connection.

Answer

The NAT pool was exhausted during source translation.

Answer

The destination host refused the TCP connection via a RST packet.

Question 9

You are troubleshooting an IPsec VPN tunnel between two SRX Series gateways. Phase 2 negotiations are failing. Which operational command should you use to check Phase 2 IPsec security association statuses and traffic counters?

Accepted Answer

show security ipsec security-associations. The command 'show security ipsec security-associations' displays Phase 2 IPsec security association status, including SPI, encryption/authentication algorithms, and traffic counters (bytes/packets). This is the correct operational command to verify whether Phase 2 SAs are up and passing traffic on an SRX.

Answer

show security ike security-associations

Answer

show vpn tunnels active

Answer

show crypto ipsec sa

Question 10

An administrator configures an address book containing an IPv6 address prefix. How does Junos OS handle IPv6 addresses in security policies compared to IPv4?

Accepted Answer

IPv6 addresses are supported within address books and can be used in security policies enforcing family inet6.. Junos security policies evaluate IPv6 addresses in address books similarly to IPv4, matching them against family inet6 traffic flows.

Answer

IPv6 addresses must be placed in a separate IPv6-only address book stanza.

Answer

IPv6 address filtering requires AppSecure licenses because standard SRX flow only supports IPv4 addresses.

Answer

IPv6 addresses do not support address sets; they must be referenced individually in policies.

Question 11

Which Junos configuration mode command is used to delete an existing configuration statement?

Accepted Answer

delete. In Junos configuration mode, the 'delete' command is used to remove an existing configuration statement. For example, 'delete security policies from-zone trust to-zone untrust policy my-policy' removes that specific policy. The 'delete' command can also be used with wildcards to remove multiple statements. This is a fundamental Junos CLI operation that every administrator must know for managing configurations.

Answer

clear

Answer

remove

Answer

no

Question 12

You have configured a new security policy on an SRX device, but traffic matching the policy is still being dropped. You check the security logs and see 'POLICY_VIOLATION' or session drop messages. Which command enables real-time packet tracing for security flow debugging?

Accepted Answer

set security flow traceoptions. Flow tracing is enabled using 'set security flow traceoptions file <filename>' and 'set security flow traceoptions flag all' to debug flow mechanics.

Answer

debug security engine

Answer

set firewall filter trace

Answer

monitor traffic interface <name>

Question 13

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). When configuring a DNSBL server profile for antispam inspection on a Juniper SRX, option A (Server type such as rbl or svbl) is required because the profile must specify which kind of blacklist lookup is being performed, e.g., an RBL for real-time blackhole lists or an SVBL for sender-verify blacklists. Option B (Server domain name or IP address) is required because the SRX must know which DNSBL server to query, such as a hostname or IP address of the blacklist provider. Option D (Expected DNS reply code or threshold IP indicating spam) is required because the device must interpret the DNSBL response, for example a 127.0.0.x reply or a configured threshold that identifies the sender as spam. Options C and E are not part of the DNSBL profile configuration: SMTP encryption certificates and private keys are used for TLS-related mail security settings, while POP3/IMAP proxy ports are irrelevant because DNSBL antispam inspection operates on SMTP and DNS lookups, not POP3 or IMAP proxy services.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 14

Which TWO statements are true regarding Junos OS configuration hierarchies? (Choose two)

Accepted Answer

Configuration is structured hierarchically using curly braces and indentation.. Option A is correct because Junos OS stores its configuration as a hierarchical tree of statements, and the CLI represents that hierarchy with curly braces and indentation to show parent/child relationships (for example, interfaces { ge-0/0/0 { unit 0 { family inet { address ... } } } }). Option D is correct because Junos supports multiple users editing the shared candidate configuration, and each user's changes remain in the candidate until a commit is issued; users can also use private candidate configurations so their edits are isolated from others. Option B is wrong because configuration-mode edits only modify the candidate configuration and do not take effect until you run the commit command. Option C is wrong because Junos configuration syntax uses normal alphanumeric keywords and values, not lowercase hexadecimal. Option E is wrong because the CLI can display configuration in set format using commands such as show configuration | display set.

Answer

Changes made in configuration mode take effect immediately without a commit.

Answer

Configuration commands must be typed entirely in lowercase hexadecimal.

Answer

The CLI cannot display configuration in set format.

Question 15

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies.. Junos evaluates zone-based policies first, followed by global policies if no zone-based policy matches.

Answer

All policies, both global and zone-based, are evaluated in a single combined sequence based strictly on rule naming alphabetically.

Answer

Policies are evaluated based on IP prefix length regardless of whether they are global or zone-based.

Answer

Global policies are evaluated first, followed by zone-based policies.

Question 16

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. In Junos security policies, logging is enabled by adding the 'log' or 'log session-close' keyword within the 'then' statement of a policy rule. This ensures that when the policy action (permit/deny) is taken, the event is logged. The 'then' statement defines the action and any additional actions like logging, counting, or session termination. Placing logging elsewhere, such as in the match statement or zone configuration, is syntactically incorrect or does not achieve policy-specific logging.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 17

Which TWO actions occur during the initial packet flow processing on an SRX Series device when a new session is established? (Choose two)

Accepted Answer

Route lookup (destination routing table check). When a new session is established, the SRX performs a route lookup and evaluates security policies to determine whether to permit or deny the flow.

Answer

Immediate CPU kernel panic generation

Answer

Automatic conversion of IPv4 to IPv6

Answer

Immediate flooding of the packet to all zone interfaces

Question 18

You are troubleshooting an issue where an SRX firewall fails to update its UTM antivirus signatures automatically. The firewall has internet access, but updates consistently fail with a signature download error. Which troubleshooting step or CLI command can verify whether the SRX can reach the Juniper update servers?

Accepted Answer

ping update.juniper.net (or the configured update server hostname) to verify DNS and reachability.. Testing connectivity and DNS resolution to the update servers via ping or checking update server status helps diagnose update failures.

Answer

Reboot the Routing Engine into single-user recovery mode.

Answer

Run 'request system software delete antivirus' to reset the update daemon.

Answer

Modify the security policy to allow all traffic without inspection.

Question 19

Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?

Accepted Answer

Antispam. Antispam is the specific UTM feature designed to detect and block spam over SMTP protocols.

Answer

Web filtering

Answer

Antivirus

Answer

Content filtering

Question 20

Which statement is true regarding address book configuration scope in Junos OS security policies?

Accepted Answer

An address book entry defined at the zone level can be referenced by security policies involving that specific zone.. In Junos OS, address books can be defined at the global level or attached to a specific zone. When an address book entry is defined at the zone level, it is scoped to that zone and can only be referenced by security policies that involve that zone (either as source or destination). This zone-specific scoping allows administrators to reuse the same address name in different zones without conflict, and policies referencing that zone automatically have access to its address book entries.

Answer

Address books cannot contain address sets; they can only contain single IP addresses.

Answer

Zone-based address books override global address books if names overlap.

Answer

Address book entries must be globally unique across the entire device, even across different zones.