JNCIA-SEC Content Security — 20 Questions

Question 1

When configuring Antispam on an SRX Series device using the SBL (Spam Black List) feature, what is the primary function of the block/permit action list?

Accepted Answer

To query external DNSBL servers and apply local overrides for known good or bad senders.. Antispam on Juniper SRX devices uses DNS-based Blackhole Lists (DNSBL) and local allow/block lists to determine if an email sender should be flagged as spam.

Answer

To inspect the payload of HTTPS encrypted webmail traffic for spam keywords.

Answer

To rewrite the headers of outgoing spam messages before they reach the mail server.

Answer

To quarantine infected executable attachments found inside incoming emails.

Question 2

You are configuring a UTM policy on a Juniper SRX firewall that includes antivirus, web filtering, and antispam profiles. To apply these UTM services to traffic, where must the UTM policy profile be explicitly attached in the Junos configuration?

Accepted Answer

Under the [edit security policies from-zone to-zone policy then] hierarchy.. UTM policies in Junos OS are bound directly to security policies using the 'utm-policy ' statement within the security policy rule.

Answer

Under the [edit security zones security-zone <zone> utm-profile] hierarchy.

Answer

Under the [edit security policies from-zone to-zone policy match] hierarchy.

Answer

Under the [edit interfaces unit <0> family inet utm] hierarchy.

Question 3

An administrator configures Unified Threat Management (UTM) antivirus inspection on an SRX device using the Junos Express antivirus engine. During high-traffic periods, users report that large file downloads are failing or timing out. Which CLI command or configuration adjustment is most appropriate to resolve this issue by increasing the maximum file size limit inspected by the antivirus engine?

Accepted Answer

set security utm feature-profile antivirus profile default http-profile maximum-file-size <size>. The antivirus engine on SRX devices has configurable size limits for stream inspection. Modifying the maximum file size under the UTM antivirus profile prevents timeouts or drops on large files.

Answer

set security utm default-profile antivirus max-buffer-size <size>

Answer

set security flow tcp-mss <size>

Answer

set security utm engine stream-scanning max-object-size <size>

Question 4

An enterprise network uses Juniper SRX Series devices running Junos OS with Integrated Web Filtering. Due to privacy regulations, the administrator needs to ensure that specific sensitive URLs are not logged by the cloud rating server or the local SRX log. Which CLI parameter should be adjusted within the web-filtering profile?

Accepted Answer

set security utm feature-profile web-filtering profile <name> no-log. Web filtering profiles allow configuring logging options, including disabling URL logging to maintain user privacy.

Answer

set security log mode stream-disable

Answer

set security utm feature-profile web-filtering profile custom-block-message

Answer

set security utm feature-profile web-filtering profile <name> disable-cloud-logging

Question 5

You are troubleshooting a web filtering policy on an SRX Series firewall configured for Integrated Web Filtering. Users report that a specific educational website is being blocked under the 'Finance' category. Where should you configure a custom exemption or local override to permit access to this specific URL without changing the global category assignment?

Accepted Answer

Configure a custom URL category and assign a permit action within the UTM policy profile.. Custom local overrides for web filtering URLs on SRX devices are configured under the [edit security UTM custom-objects url-pattern] and referenced in the custom-url-category.

Answer

Modify the Junos global bypass list under [edit system services web-management].

Answer

Add the URL to the application firewall (AppID) custom application definition.

Answer

Configure a security policy source NAT rule to bypass the UTM profile for that specific IP.

Question 6

An administrator needs to block all users from downloading executable files (.exe and .msi) via HTTP, regardless of the website category. Which UTM feature should be utilized to achieve this efficiently?

Accepted Answer

Content Filtering. Content filtering allows blocking specific file extensions or MIME types across HTTP/FTP sessions.

Answer

AppSecure AppID

Answer

Antivirus

Answer

Integrated Web Filtering

Question 7

An administrator notices that web filtering queries are failing because the SRX device cannot reach the cloud rating server over the internet. Which command can be used to troubleshoot connectivity to the cloud rating server from the Junos CLI?

Accepted Answer

show security utm web-filtering status. The 'show security utm web-filtering statistics' or connection debugging commands help verify cloud reachability, while ping/traceroute commands test basic network paths.

Answer

traceroute utm-rating-engine

Answer

ping security utm cloud-server

Answer

test utm cloud-connectivity

Question 8

Which THREE parameters can be defined within a Content Filtering profile on a Juniper SRX device to restrict file transfers? (Choose three.)

Accepted Answer

File extension block list. On a Juniper SRX Content Filtering profile, the file-transfer restriction parameters are the file extension block list (A), which blocks files by their extension such as .exe or .zip; the MIME type block list (C), which blocks files based on their declared content type such as application/x-msdownload; and custom block text strings (E), which block files containing specified text patterns. These three are the actual configurable elements under the content-filtering profile used to inspect and restrict file transfers. DNSBL server IP addresses (B) belong to antispam/UAC configuration, not content filtering, and URL block patterns (D) are part of URL filtering (Web filtering) profiles, so neither restricts file transfers within a Content Filtering profile.

Answer

DNSBL server IP addresses

Answer

URL block patterns

Question 9

Which TWO protocols are typically inspected by the Content Filtering feature on Juniper SRX Series firewalls? (Choose two.)

Accepted Answer

HTTP. The Content Filtering feature on Juniper SRX Series firewalls is a UTM component that examines application-layer traffic to block or permit access based on categories or URL patterns, and it is designed to inspect HTTP (option A) because web browsing is the primary vector for content-based filtering, using the HTTP protocol's request/response structure to match URLs and content categories. It also inspects FTP (option E), since FTP is a supported application protocol for content filtering in Junos UTM, allowing the firewall to apply filtering to file transfers over FTP sessions. SNMP (option B) is a management protocol used for monitoring and is not inspected by Content Filtering, DNS (option C) is handled by other security features such as DNS filtering or ALGs rather than content filtering, and ICMP (option D) is a network-layer control protocol that carries no application content for the Content Filtering engine to examine.

Answer

SNMP

Answer

DNS

Answer

ICMP

Question 10

An administrator has configured Web Filtering, but users are complaining that uncategorized websites are currently being blocked by default. Which command allows setting the action for uncategorized websites to 'permit' instead of 'block'?

Accepted Answer

set security utm feature-profile web-filtering profile <name> default-action permit. Integrated Web Filtering profiles on SRX allow defining fallback or default actions for URLs that do not exist in the cloud database.

Answer

set security utm feature-profile web-filtering profile <name> fallback-action allow

Answer

set security utm feature-profile web-filtering profile <name> uncategorized permit

Answer

set security utm policy-profile default-action permit

Question 11

You are configuring Antispam on an SRX device and want to ensure that emails originating from partner domains are never flagged as spam, regardless of DNSBL results. Where should you configure this local white-listing rule?

Accepted Answer

Under [edit security utm custom-objects antispam block-list] and [edit security utm custom-objects antispam permit-list]. Antispam custom objects allow defining local white-lists and black-lists (block/permit lists) which take precedence over external DNSBL queries.

Answer

Under [edit security policies global permit-spam]

Answer

Under [edit security utm custom-objects antispam anti-spam-profile]

Answer

Under [edit security utm feature-profile antispam profile <name> whitelist]

Question 12

Which command is used to view real-time statistics regarding UTM Antivirus blocks and scans on an SRX Series firewall?

Accepted Answer

show security utm antivirus statistics. Operational commands starting with 'show security utm' display runtime statistics for all active UTM engines.

Answer

show utm engine status

Answer

show security flow session utm

Answer

show system antivirus summary

Question 13

Which TWO types of web filtering providers are natively supported by Juniper SRX Series Integrated Web Filtering? (Choose two.)

Accepted Answer

Sophos. Juniper SRX Series Integrated Web Filtering natively supports the Sophos and Webroot providers, so options D and E are correct. Sophos (option D) is supported because Juniper integrated the Sophos Web Appliance/cloud-based URL filtering engine into the SRX UTM feature set, allowing URL category lookups via the Sophos-provided database. Webroot (option E) is also supported because Juniper's Integrated Web Filtering uses the Webroot BrightCloud URL categorization service as its other native provider. Options A, B, and C are incorrect because Trend Micro, Symantec, and McAfee are not the native web filtering providers for SRX Integrated Web Filtering; Trend Micro is associated with other Juniper security features such as antivirus/anti-spam in some contexts, but not as the native web filtering provider here.

Answer

Trend Micro

Answer

Symantec

Answer

McAfee

Question 14

Which THREE actions can be specified when configuring an Antispam profile action on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Block the email. In an SRX Antispam profile, the configurable action for a detected spam message includes Block the email (C), which drops or rejects the offending message so it is not delivered to the recipient. Log the event (D) is also a valid action because the device can generate a log entry for the spam detection, which is essential for monitoring and auditing. Custom message insertion (E) is correct as well, since the SRX can insert a custom notification or tag into the email to alert the recipient that the message was classified as spam. The unmarked options do not belong: Automatic payload encryption (A) is not an Antispam profile action on SRX, and Automatic quarantine to an IMAP mailbox folder (B) is not a supported SRX Antispam action because the SRX does not natively quarantine messages into IMAP folders.

Answer

Automatic payload encryption

Answer

Automatic quarantine to an IMAP mailbox folder

Question 15

You are configuring an SRX Series device with Antivirus inspection. You want to ensure that files transferred over FTP are scanned, but HTTP traffic bypasses antivirus inspection due to performance constraints. How should you configure the antivirus profile?

Accepted Answer

Enable antivirus under ftp-profile and disable or omit it under http-profile.. Antivirus profiles allow enabling or disabling inspection per protocol (such as http, ftp, smtp, pop3, imap).

Answer

Create two separate security policies and attach antivirus only to the FTP security policy.

Answer

Set the HTTP antivirus action to 'permit-without-scanning'.

Answer

Use a custom firewall filter to drop HTTP traffic before UTM processing.

Question 16

Which THREE parameters are typically required when defining a custom URL pattern object for use in web filtering overrides? (Choose three.)

Accepted Answer

Matching type (such as exact, prefix, or suffix). Option A (Matching type such as exact, prefix, or suffix) is correct because a custom URL pattern object must specify how the pattern is compared to the requested URL, e.g., exact match, prefix match, or suffix/domain match, so the filter knows the comparison logic. Option C (URL pattern string or regular expression) is correct because the object needs the actual literal string or regex that defines which URLs are matched. Option D (Action such as permit or block) is correct because the override must define what happens when the pattern matches, typically allowing or denying the request. Option B (SSL private key password) is not part of URL pattern definition; it relates to certificate/private-key handling for SSL inspection, not to matching URL patterns. Option E (DNSBL server IP address) is not part of a URL pattern object; DNSBLs are external reputation/blocklist services queried separately, not parameters of a URL match pattern.

Answer

SSL private key password

Answer

DNSBL server IP address

Question 17

You notice that CPU utilization on the SRX Routing Engine spikes significantly whenever large archives are downloaded through the UTM antivirus inspection engine. Which architectural adjustment or feature configuration helps mitigate control plane impact during stream scanning?

Accepted Answer

Offloading stream scanning buffers and ensuring fast-path processing on Security Processing Cards (SPCs).. Stream scanning on SRX devices leverages specialized hardware (such as SPCs / Flow Processing Cards) where applicable, but tuning stream buffer sizes or utilizing hardware acceleration helps manage resource utilization.

Answer

Disabling stateful inspection across all zones.

Answer

Moving all UTM antivirus processing to the Routing Engine CPU.

Answer

Configuring static routing for all HTTP traffic.

Question 18

Which TWO methods can be used to manually trigger a signature update for UTM services on an SRX Series firewall? (Choose two.)

Accepted Answer

Using Juniper Security Director or Junos Space centralized management.. Option A is correct because Juniper Security Director and Junos Space provide centralized management that can push or schedule UTM signature updates to managed SRX devices, effectively triggering the update remotely. Option E is correct because the Junos CLI command 'request security utm antivirus update' explicitly initiates a manual UTM antivirus signature update on the SRX device. Option B is incorrect because 'request system reboot' only restarts the Routing Engine and does not fetch new UTM signatures. Option C is incorrect because a factory default reset erases configuration and does not perform a signature update. Option D is incorrect because 'commit check' only validates configuration syntax and does not update UTM signature databases.

Answer

Rebooting the Routing Engine via the 'request system reboot' command.

Answer

Executing a factory default reset on the SRX device.

Answer

Running a manual commit check on the configuration file.

Question 19

Which UTM feature should an administrator configure to prevent employees from accessing gambling and adult content websites?

Accepted Answer

Web Filtering. Web Filtering is the UTM feature specifically designed to block access to categories of websites such as gambling and adult content. It uses a URL categorization database to classify sites and applies policies that permit or deny access based on category, making it the correct choice for this requirement.

Answer

Antivirus

Answer

Antispam

Answer

Content Filtering

Question 20

When configuring an Integrated Web Filtering profile, an administrator wants to block access to social networking sites during working hours. Which profile parameter is used to specify this category-based block?

Accepted Answer

set security utm feature-profile web-filtering profile category action block. Categories in Web Filtering are assigned actions (permit, block, or log) within the web filtering profile.

Answer

set security policies policy-profile category-block social-networking

Answer

set security utm feature-profile web-filtering profile <name> block-category social-networking

Answer

set security utm web-filtering category social-networking drop