JNCIA-SEC Practice Test 9 — 10 Questions

Question 1

Which command is used to display active security sessions currently tracked by the Junos OS flow module?

Accepted Answer

show security flow session. The 'show security flow session' command displays active sessions currently flowing through the SRX device.

Answer

show interfaces flow-sessions

Answer

show system sessions active

Answer

show security sessions summary

Question 2

An administrator configures a high availability (HA) cluster on two SRX550 devices. During failover testing, they observe that stateful sessions are abruptly dropped. Which feature must be properly synchronized between the primary and secondary nodes to prevent session drop during failover?

Accepted Answer

Session synchronization. To prevent stateful session drops during SRX HA failover, session synchronization must be enabled and properly synchronized between the primary and secondary nodes. Session synchronization replicates session state (flow tables, NAT translations, and related state) so the backup node can take over without dropping established sessions. Without it, the secondary has no knowledge of existing flows and drops them upon failover.

Answer

NAT pool reservation sync

Answer

IDP signature database sync

Answer

Routing table synchronization

Question 3

Which statement is true regarding Junos OS address books?

Accepted Answer

Address books can be defined globally or per security zone.. Address books can be defined globally at the configuration root or locally within a specific security zone.

Answer

An address book must contain at least one address set.

Answer

Address books are mandatory for defining security policies even if IP prefixes are used directly.

Answer

Address books can only be defined globally.

Question 4

An administrator configures a security policy with the action set to 'reject'. Another policy uses the action 'deny'. What is the functional difference between these two actions when a packet matches the policy?

Accepted Answer

'reject' sends an ICMP unreachable message back to the packet source, whereas 'deny' silently drops the packet.. The 'reject' action sends an ICMP unreachable message back to the source, whereas 'deny' (drop) silently discards the packet.

Answer

'reject' drops the packet silently, whereas 'deny' sends an ICMP unreachable message.

Answer

'reject' logs the event to the system log, whereas 'deny' suppresses all logging.

Answer

'reject' requires stateful session tracking, whereas 'deny' is applied statelessly.

Question 5

You are configuring a security policy that needs to reference an address prefix that includes both IPv4 and IPv6 addresses. How should you handle this in Junos OS security address books?

Accepted Answer

Define separate address book entries for IPv4 and IPv6, as address entries are specific to an IP version.. In Junos security address books, address entries are IP-version specific — an IPv4 prefix and an IPv6 prefix cannot be combined into one entry. You must define separate address book entries (and typically separate address books under the inet and inet6 hierarchies) for IPv4 and IPv6.

Answer

Combine IPv4 and IPv6 addresses into a single address entry string separated by a comma.

Answer

Configure the address book under the [edit security inet6] hierarchy only.

Answer

Use dual-stack address translation objects.

Question 6

Which THREE parameters are typically included in security flow traceoptions output when troubleshooting dropped packets? (Choose three)

Accepted Answer

Packet reception and interface context. Option A is correct because security flow traceoptions output begins with the packet's ingress context, showing the receiving interface, source/destination addresses, and ports so you can confirm the packet actually arrived and on which interface. Option D is correct because the trace records the security policy lookup, including the zone context and the policy that was evaluated and matched (or failed to match), which is essential for understanding how the session was handled. Option E is correct because the trace explicitly logs the drop reason when a packet is discarded, such as a policy deny, a screen violation, or a TCP/IP stack rejection, which directly identifies why the packet did not pass. Option B is not relevant because chassis power supply voltage is hardware/environmental monitoring data, not part of flow traceoptions packet processing. Option C is not relevant because BGP AS path recomputation is a routing protocol event and is not included in security flow traceoptions output.

Answer

Chassis power supply voltage levels

Answer

BGP AS path recomputation steps

Question 7

An administrator wants to configure antispam protection on an SRX Series firewall to protect an internal mail server. Which protocol inspection engine is used by Juniper antispam to evaluate incoming messages?

Accepted Answer

SMTP, POP3, and IMAP inspection engines. Juniper antispam utilizes the SMTP, POP3, and IMAP protocol inspection engines to evaluate incoming emails, checking headers and bodies against blacklists and heuristics.

Answer

FTP and SFTP file transfer engines

Answer

DNS query inspection engines

Answer

HTTP and HTTPS proxy engines

Question 8

An administrator needs to verify whether source NAT pool addresses are being exhausted. Which command should they execute?

Accepted Answer

show security nat source pool. The command 'show security nat source pool' displays the configured source NAT pools along with their address ranges and current port/address utilization, allowing the administrator to see whether pool addresses are being exhausted. It is the Junos-specific operational command for inspecting source NAT pool state on SRX devices.

Answer

show route pool-address

Answer

show security translation pool-exhaustion

Answer

show security flow pool-status

Question 9

When configuring security zones on an SRX Series device, what is the default behavior for traffic moving between two different security zones if no security policy is explicitly defined?

Accepted Answer

Traffic is dropped by default (implicit deny). By default, the SRX enforces a deny-all policy between different security zones unless an explicit security policy permits the traffic.

Answer

Traffic is redirected to the management port

Answer

Traffic is flooded to all interfaces

Answer

Traffic is permitted by default

Question 10

Which statement accurately describes a security zone in Junos OS?

Accepted Answer

A security zone is a logical grouping of interfaces used to define trust boundaries.. Security zones are logical groupings of interfaces that share similar security requirements and policies.

Answer

Interfaces belonging to different security zones can communicate without a security policy if they are on the same VLAN.

Answer

A security zone is required to contain at least one interface before policies can reference it.

Answer

Interfaces can belong to multiple security zones simultaneously.