JNCIA-SEC Content Security — 20 Questions

Question 1

Which TWO components are required for Integrated Web Filtering to function properly on an SRX Series firewall? (Choose two.)

Accepted Answer

An active Integrated Web Filtering license. Integrated Web Filtering requires an active cloud rating license and functional internet reachability to query categorization servers.

Answer

A local database containing all 10 million global URLs

Answer

An SMTP mail server relay

Question 2

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). Antispam DNSBL configuration on Junos requires specifying the server domain, server type, and reply codes that indicate spam.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 3

When configuring Antispam on an SRX Series device using the SBL (Spam Black List) feature, what is the primary function of the block/permit action list?

Accepted Answer

To query external DNSBL servers and apply local overrides for known good or bad senders.. Antispam on Juniper SRX devices uses DNS-based Blackhole Lists (DNSBL) and local allow/block lists to determine if an email sender should be flagged as spam.

Answer

To inspect the payload of HTTPS encrypted webmail traffic for spam keywords.

Answer

To rewrite the headers of outgoing spam messages before they reach the mail server.

Answer

To quarantine infected executable attachments found inside incoming emails.

Question 4

You are configuring a UTM policy on a Juniper SRX firewall that includes antivirus, web filtering, and antispam profiles. To apply these UTM services to traffic, where must the UTM policy profile be explicitly attached in the Junos configuration?

Accepted Answer

Under the [edit security policies from-zone to-zone policy then] hierarchy.. UTM policies in Junos OS are bound directly to security policies using the 'utm-policy ' statement within the security policy rule.

Answer

Under the [edit security zones security-zone <zone> utm-profile] hierarchy.

Answer

Under the [edit security policies from-zone to-zone policy match] hierarchy.

Answer

Under the [edit interfaces unit <0> family inet utm] hierarchy.

Question 5

An administrator configures Unified Threat Management (UTM) antivirus inspection on an SRX device using the Junos Express antivirus engine. During high-traffic periods, users report that large file downloads are failing or timing out. Which CLI command or configuration adjustment is most appropriate to resolve this issue by increasing the maximum file size limit inspected by the antivirus engine?

Accepted Answer

set security utm feature-profile antivirus profile default http-profile maximum-file-size <size>. The antivirus engine on SRX devices has configurable size limits for stream inspection. Modifying the maximum file size under the UTM antivirus profile prevents timeouts or drops on large files.

Answer

set security utm default-profile antivirus max-buffer-size <size>

Answer

set security flow tcp-mss <size>

Answer

set security utm engine stream-scanning max-object-size <size>

Question 6

Which TWO actions can be configured when a URL is matched against a blocked category in an Integrated Web Filtering profile on an SRX Series device? (Choose two.)

Accepted Answer

Block the connection and display a custom HTML block page message.. When a URL is blocked by web filtering, Juniper devices can block the connection with a custom message or redirect the user to a specific warning page URL.

Answer

Send an SNMP trap and instantly reboot the device control plane.

Answer

Automatically rewrite the HTTP request header to inject user authentication tokens.

Answer

Drop the packet silently without sending any notification to the client.

Question 7

An enterprise network uses Juniper SRX Series devices running Junos OS with Integrated Web Filtering. Due to privacy regulations, the administrator needs to ensure that specific sensitive URLs are not logged by the cloud rating server or the local SRX log. Which CLI parameter should be adjusted within the web-filtering profile?

Accepted Answer

set security utm feature-profile web-filtering profile <name> no-log. Web filtering profiles allow configuring logging options, including disabling URL logging to maintain user privacy.

Answer

set security log mode stream-disable

Answer

set security utm feature-profile web-filtering profile custom-block-message

Answer

set security utm feature-profile web-filtering profile <name> disable-cloud-logging

Question 8

You are troubleshooting a web filtering policy on an SRX Series firewall configured for Integrated Web Filtering. Users report that a specific educational website is being blocked under the 'Finance' category. Where should you configure a custom exemption or local override to permit access to this specific URL without changing the global category assignment?

Accepted Answer

Configure a custom URL category and assign a permit action within the UTM policy profile.. Custom local overrides for web filtering URLs on SRX devices are configured under the [edit security UTM custom-objects url-pattern] and referenced in the custom-url-category.

Answer

Modify the Junos global bypass list under [edit system services web-management].

Answer

Add the URL to the application firewall (AppID) custom application definition.

Answer

Configure a security policy source NAT rule to bypass the UTM profile for that specific IP.

Question 9

An administrator needs to configure basic web filtering on a Juniper SRX Series device using the Integrated Web Filtering feature. Which license is strictly required on the SRX Series device to enable communication with the cloud-based web filtering rating server?

Accepted Answer

An Integrated Web Filtering license. Integrated Web Filtering on Juniper SRX devices relies on cloud-based categorization servers, which requires a valid Sophos or Webroot web filtering license installed on the device.

Answer

An IDP (Intrusion Detection and Prevention) license

Answer

An AppSecure license

Answer

An Anti-Virus license

Question 10

An administrator needs to block all users from downloading executable files (.exe and .msi) via HTTP, regardless of the website category. Which UTM feature should be utilized to achieve this efficiently?

Accepted Answer

Content Filtering. Content filtering allows blocking specific file extensions or MIME types across HTTP/FTP sessions.

Answer

AppSecure AppID

Answer

Antivirus

Answer

Integrated Web Filtering

Question 11

An administrator notices that web filtering queries are failing because the SRX device cannot reach the cloud rating server over the internet. Which command can be used to troubleshoot connectivity to the cloud rating server from the Junos CLI?

Accepted Answer

show security utm web-filtering status. The 'show security utm web-filtering statistics' or connection debugging commands help verify cloud reachability, while ping/traceroute commands test basic network paths.

Answer

traceroute utm-rating-engine

Answer

ping security utm cloud-server

Answer

test utm cloud-connectivity

Question 12

Which THREE parameters can be defined within a Content Filtering profile on a Juniper SRX device to restrict file transfers? (Choose three.)

Accepted Answer

File extension block list. Content filtering profiles allow defining block rules based on MIME types, file extensions, and blocking text strings within web traffic.

Answer

DNSBL server IP addresses

Answer

URL block patterns

Question 13

What is the default action taken by a Juniper SRX UTM Antivirus profile when an infected file is detected within an HTTP stream using the Express antivirus engine?

Accepted Answer

Block the file transfer and terminate the session.. The default action for Juniper UTM antivirus when malware is detected in transit is to block the file transfer and drop the stream.

Answer

Strip the infected payload and deliver the sanitized file to the client.

Answer

Quarantine the file into an internal flash memory directory for manual review.

Answer

Permit the file and generate an alarm log.

Question 14

Which TWO protocols are typically inspected by the Content Filtering feature on Juniper SRX Series firewalls? (Choose two.)

Accepted Answer

HTTP. Content filtering on Junos inspects application data streams passing through the firewall, primarily focusing on HTTP and FTP traffic.

Answer

SNMP

Answer

DNS

Answer

ICMP

Question 15

When configuring Kaspersky-based Antivirus on an SRX Series device, which operational mode reduces resource consumption by only scanning files matching specific high-risk protocol extensions?

Accepted Answer

Extension-based or type-based scanning filtering. Kaspersky antivirus on SRX supports extension-based filtering to optimize performance by skipping non-risk file types.

Answer

Passive monitor mode

Answer

Stateless AV filtering

Answer

Fast-track scanning mode

Question 16

Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?

Accepted Answer

Antispam. Antispam is the specific UTM feature designed to detect and block spam over SMTP protocols.

Answer

Web filtering

Answer

Antivirus

Answer

Content filtering

Question 17

What is the primary purpose of a UTM policy profile on a Juniper SRX firewall?

Accepted Answer

To bundle multiple individual UTM feature profiles into a single assignable policy object.. A UTM policy profile acts as a container that bundles various UTM feature profiles (antivirus, web-filtering, antispam, content-filtering) together for application in security policies.

Answer

To configure stateful inspection timeouts for high-speed interfaces.

Answer

To define routing metrics for secure VPN tunnels.

Answer

To enforce user authentication mechanisms before granting network access.

Question 18

An administrator has configured Web Filtering, but users are complaining that uncategorized websites are currently being blocked by default. Which command allows setting the action for uncategorized websites to 'permit' instead of 'block'?

Accepted Answer

set security utm feature-profile web-filtering profile <name> default-action permit. Integrated Web Filtering profiles on SRX allow defining fallback or default actions for URLs that do not exist in the cloud database.

Answer

set security utm feature-profile web-filtering profile <name> fallback-action allow

Answer

set security utm feature-profile web-filtering profile <name> uncategorized permit

Answer

set security utm policy-profile default-action permit

Question 19

You are configuring Antispam on an SRX device and want to ensure that emails originating from partner domains are never flagged as spam, regardless of DNSBL results. Where should you configure this local white-listing rule?

Accepted Answer

Under [edit security utm custom-objects antispam block-list] and [edit security utm custom-objects antispam permit-list]. Antispam custom objects allow defining local white-lists and black-lists (block/permit lists) which take precedence over external DNSBL queries.

Answer

Under [edit security policies global permit-spam]

Answer

Under [edit security utm custom-objects antispam anti-spam-profile]

Answer

Under [edit security utm feature-profile antispam profile <name> whitelist]

Question 20

Which command is used to view real-time statistics regarding UTM Antivirus blocks and scans on an SRX Series firewall?

Accepted Answer

show security utm antivirus statistics. Operational commands starting with 'show security utm' display runtime statistics for all active UTM engines.

Answer

show utm engine status

Answer

show security flow session utm

Answer

show system antivirus summary