JNCIA-SEC Practice Test 8 — 10 Questions

Question 1

An administrator configures source NAT with port address translation (PAT) on an SRX device. They notice that internal hosts are exhausting available source ports rapidly. Which CLI command or setting allows the administrator to monitor PAT pool port utilization and allocation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show security nat source pool statistics. The command 'show security nat source pool statistics' displays per-pool statistics including the number of allocated ports, the port range, and utilization, which is exactly what is needed to monitor PAT pool port exhaustion. It is the operational command for inspecting source NAT pool port allocation on SRX.

Answer

show chassis nat utilization

Answer

show system port-allocation

Answer

show flow nat sessions

Question 2

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Accepted Answer

IP address range objects. Address sets can contain individual IPv4 addresses, IPv6 addresses, IP ranges, DNS FQDN objects, or other address sets.

Answer

Application Layer Gateway profiles

Answer

Security zone interface names

Question 3

What is the primary function of Content Filtering in Juniper SRX Unified Threat Management?

Accepted Answer

To block specific file types, MIME types, and text strings within traffic streams.. Content filtering inspects traffic streams to enforce organizational policies regarding file types, extensions, and MIME formats.

Answer

To inspect encrypted SSL/TLS handshake certificates.

Answer

To prevent buffer overflow attacks using protocol anomaly detection.

Answer

To scan incoming emails for spam sender addresses.

Question 4

Which hardware architecture distinction is characteristic of enterprise-grade SRX Series gateways (such as SRX4100 or SRX4600) compared to entry-level branch SRX models?

Accepted Answer

Enterprise SRX models feature separation of control plane (RE) and data/security plane (SPC) hardware architecture. Enterprise-grade SRX models (SRX4100/4600/5400) use a hardware architecture that separates the control plane (Routing Engine) from the data/security plane (Services Processing Card/SPU), allowing independent scaling and higher throughput. Branch SRX models (300/320/380) typically integrate control and data plane functions into a single CPU/ASIC.

Answer

Enterprise SRX devices run ScreenOS instead of Junos OS

Answer

Branch SRX devices do not support security policies

Answer

Branch SRX models use modular SPCs while enterprise models use fixed ports

Question 5

You are troubleshooting an antispam deployment where legitimate emails from a trusted customer domain are intermittently marked as spam by the DNSBL provider. To permanently prevent this without disabling antispam for other traffic, what should you configure?

Accepted Answer

Create a local antispam permit object containing the customer's sender domain or IP address.. Local permit lists (whitelists) under antispam custom objects allow overriding DNSBL spam detections for trusted sender domains.

Answer

Disable DNSBL server queries globally across the SRX device.

Answer

Add the customer domain to the web-filtering custom override list.

Answer

Modify the security policy action from 'permit' to 'deny' for that specific source.

Question 6

An administrator implements Source NAT using a pool of IP addresses. To verify the operational status of the source NAT pool and see how many addresses and ports are currently in use, which operational command should be executed?

Accepted Answer

show security nat pool. The operational command 'show security nat pool' displays the status of all configured NAT pools, including the pool name, address range, and current utilization statistics such as the number of addresses and ports in use. This is the correct command to verify Source NAT pool operational status and utilization.

Answer

show system nat pool-utilization

Answer

show security flow pool-status

Answer

show route forwarding-table nat-pool

Question 7

An administrator suspects that a specific security policy is not being hit because traffic is being silently dropped by an earlier policy. Which feature should be enabled under security policies to generate a log entry whenever a session is created matching that policy?

Accepted Answer

configure security policies ... then { ... log { session-init; } }. Configuring 'log { session-init; }' under a security policy enables logging when a new session is created that matches that policy. This allows the administrator to confirm whether the policy is being hit and to detect silent drops by earlier policies.

Answer

configure security flow packet-log enable

Answer

configure security policies ... then { ... syslog alert; }

Answer

configure system syslog facility security packet-log

Question 8

What information does the 'show security flow session summary' command provide?

Accepted Answer

Total active session counts, resource usage, and protocol breakdown. 'show security flow session summary' provides a high-level overview of the session table, including the total number of active sessions, the number of sessions per protocol (TCP, UDP, ICMP), and resource usage statistics such as session table utilization. It does not list individual sessions or packet contents; that is done with 'show security flow session' without the 'summary' keyword.

Answer

Detailed packet contents for every active session

Answer

The complete list of source and destination IP addresses

Answer

Configured security policies

Question 9

An engineer needs to determine why IPsec Phase 1 negotiations are failing with a remote peer. Which traceoptions flag should be enabled under security ike?

Accepted Answer

set security ike traceoptions flag all. The correct command to enable traceoptions for IPsec Phase 1 (IKE) negotiations is `set security ike traceoptions flag all` under the `[edit security ike]` hierarchy. This flag captures all IKE-related events, including Phase 1 exchanges, proposals, and errors, which is essential for diagnosing why negotiations are failing. The other options either target the wrong hierarchy (IPsec or flow) or are not traceoptions commands at all.

Answer

set security ipsec traceoptions flag phase1

Answer

set system syslog facility local4

Answer

set security flow traceoptions flag ike

Question 10

What is the primary architectural advantage of dual-plane architecture found on enterprise-grade SRX Series Services Gateways?

Accepted Answer

It separates the Routing Engine (control plane) from the Security Processing Units (data plane) to ensure management stability.. Enterprise SRX gateways separate the Control Plane (RE) from the Data Plane (SPU), ensuring routing protocol stability and management access even under heavy traffic loads.

Answer

It provides redundant power supplies and hot-swappable fan trays for high availability.

Answer

It enables simultaneous execution of Junos OS and Linux kernel hypervisors.

Answer

It allows the device to act as both a layer 2 switch and layer 3 router simultaneously without licensing.