JNCIA-SEC Practice Test 7 — 10 Questions

Question 1

Which Junos configuration mode command is used to delete an existing configuration statement?

Accepted Answer

delete. In Junos configuration mode, the 'delete' command is used to remove an existing configuration statement. For example, 'delete security policies from-zone trust to-zone untrust policy my-policy' removes that specific policy. The 'delete' command can also be used with wildcards to remove multiple statements. This is a fundamental Junos CLI operation that every administrator must know for managing configurations.

Answer

clear

Answer

remove

Answer

no

Question 2

You have configured a new security policy on an SRX device, but traffic matching the policy is still being dropped. You check the security logs and see 'POLICY_VIOLATION' or session drop messages. Which command enables real-time packet tracing for security flow debugging?

Accepted Answer

set security flow traceoptions. Flow tracing is enabled using 'set security flow traceoptions file <filename>' and 'set security flow traceoptions flag all' to debug flow mechanics.

Answer

debug security engine

Answer

set firewall filter trace

Answer

monitor traffic interface <name>

Question 3

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). When configuring a DNSBL server profile for antispam inspection on a Juniper SRX, option A (Server type such as rbl or svbl) is required because the profile must specify which kind of blacklist lookup is being performed, e.g., an RBL for real-time blackhole lists or an SVBL for sender-verify blacklists. Option B (Server domain name or IP address) is required because the SRX must know which DNSBL server to query, such as a hostname or IP address of the blacklist provider. Option D (Expected DNS reply code or threshold IP indicating spam) is required because the device must interpret the DNSBL response, for example a 127.0.0.x reply or a configured threshold that identifies the sender as spam. Options C and E are not part of the DNSBL profile configuration: SMTP encryption certificates and private keys are used for TLS-related mail security settings, while POP3/IMAP proxy ports are irrelevant because DNSBL antispam inspection operates on SMTP and DNS lookups, not POP3 or IMAP proxy services.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 4

Which TWO statements are true regarding Junos OS configuration hierarchies? (Choose two)

Accepted Answer

Configuration is structured hierarchically using curly braces and indentation.. Option A is correct because Junos OS stores its configuration as a hierarchical tree of statements, and the CLI represents that hierarchy with curly braces and indentation to show parent/child relationships (for example, interfaces { ge-0/0/0 { unit 0 { family inet { address ... } } } }). Option D is correct because Junos supports multiple users editing the shared candidate configuration, and each user's changes remain in the candidate until a commit is issued; users can also use private candidate configurations so their edits are isolated from others. Option B is wrong because configuration-mode edits only modify the candidate configuration and do not take effect until you run the commit command. Option C is wrong because Junos configuration syntax uses normal alphanumeric keywords and values, not lowercase hexadecimal. Option E is wrong because the CLI can display configuration in set format using commands such as show configuration | display set.

Answer

Changes made in configuration mode take effect immediately without a commit.

Answer

Configuration commands must be typed entirely in lowercase hexadecimal.

Answer

The CLI cannot display configuration in set format.

Question 5

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies.. Junos evaluates zone-based policies first, followed by global policies if no zone-based policy matches.

Answer

All policies, both global and zone-based, are evaluated in a single combined sequence based strictly on rule naming alphabetically.

Answer

Policies are evaluated based on IP prefix length regardless of whether they are global or zone-based.

Answer

Global policies are evaluated first, followed by zone-based policies.

Question 6

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. In Junos security policies, logging is enabled by adding the 'log' or 'log session-close' keyword within the 'then' statement of a policy rule. This ensures that when the policy action (permit/deny) is taken, the event is logged. The 'then' statement defines the action and any additional actions like logging, counting, or session termination. Placing logging elsewhere, such as in the match statement or zone configuration, is syntactically incorrect or does not achieve policy-specific logging.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 7

Which TWO actions occur during the initial packet flow processing on an SRX Series device when a new session is established? (Choose two)

Accepted Answer

Route lookup (destination routing table check). When a new session is established, the SRX performs a route lookup and evaluates security policies to determine whether to permit or deny the flow.

Answer

Immediate CPU kernel panic generation

Answer

Automatic conversion of IPv4 to IPv6

Answer

Immediate flooding of the packet to all zone interfaces

Question 8

You are troubleshooting an issue where an SRX firewall fails to update its UTM antivirus signatures automatically. The firewall has internet access, but updates consistently fail with a signature download error. Which troubleshooting step or CLI command can verify whether the SRX can reach the Juniper update servers?

Accepted Answer

ping update.juniper.net (or the configured update server hostname) to verify DNS and reachability.. Testing connectivity and DNS resolution to the update servers via ping or checking update server status helps diagnose update failures.

Answer

Reboot the Routing Engine into single-user recovery mode.

Answer

Run 'request system software delete antivirus' to reset the update daemon.

Answer

Modify the security policy to allow all traffic without inspection.

Question 9

Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?

Accepted Answer

Antispam. Antispam is the specific UTM feature designed to detect and block spam over SMTP protocols.

Answer

Web filtering

Answer

Antivirus

Answer

Content filtering

Question 10

Which statement is true regarding address book configuration scope in Junos OS security policies?

Accepted Answer

An address book entry defined at the zone level can be referenced by security policies involving that specific zone.. In Junos OS, address books can be defined at the global level or attached to a specific zone. When an address book entry is defined at the zone level, it is scoped to that zone and can only be referenced by security policies that involve that zone (either as source or destination). This zone-specific scoping allows administrators to reuse the same address name in different zones without conflict, and policies referencing that zone automatically have access to its address book entries.

Answer

Address books cannot contain address sets; they can only contain single IP addresses.

Answer

Zone-based address books override global address books if names overlap.

Answer

Address book entries must be globally unique across the entire device, even across different zones.