JNCIA-SEC Content Security Practice Test 2 — 15 Questions

Question 1

Which THREE parameters are typically required when defining a custom URL pattern object for use in web filtering overrides? (Choose three.)

Accepted Answer

Matching type (such as exact, prefix, or suffix). Option A (Matching type such as exact, prefix, or suffix) is correct because a custom URL pattern object must specify how the pattern is compared to the requested URL, e.g., exact match, prefix match, or suffix/domain match, so the filter knows the comparison logic. Option C (URL pattern string or regular expression) is correct because the object needs the actual literal string or regex that defines which URLs are matched. Option D (Action such as permit or block) is correct because the override must define what happens when the pattern matches, typically allowing or denying the request. Option B (SSL private key password) is not part of URL pattern definition; it relates to certificate/private-key handling for SSL inspection, not to matching URL patterns. Option E (DNSBL server IP address) is not part of a URL pattern object; DNSBLs are external reputation/blocklist services queried separately, not parameters of a URL match pattern.

Answer

SSL private key password

Answer

DNSBL server IP address

Question 2

You notice that CPU utilization on the SRX Routing Engine spikes significantly whenever large archives are downloaded through the UTM antivirus inspection engine. Which architectural adjustment or feature configuration helps mitigate control plane impact during stream scanning?

Accepted Answer

Offloading stream scanning buffers and ensuring fast-path processing on Security Processing Cards (SPCs).. Stream scanning on SRX devices leverages specialized hardware (such as SPCs / Flow Processing Cards) where applicable, but tuning stream buffer sizes or utilizing hardware acceleration helps manage resource utilization.

Answer

Disabling stateful inspection across all zones.

Answer

Moving all UTM antivirus processing to the Routing Engine CPU.

Answer

Configuring static routing for all HTTP traffic.

Question 3

Which TWO methods can be used to manually trigger a signature update for UTM services on an SRX Series firewall? (Choose two.)

Accepted Answer

Using Juniper Security Director or Junos Space centralized management.. Option A is correct because Juniper Security Director and Junos Space provide centralized management that can push or schedule UTM signature updates to managed SRX devices, effectively triggering the update remotely. Option E is correct because the Junos CLI command 'request security utm antivirus update' explicitly initiates a manual UTM antivirus signature update on the SRX device. Option B is incorrect because 'request system reboot' only restarts the Routing Engine and does not fetch new UTM signatures. Option C is incorrect because a factory default reset erases configuration and does not perform a signature update. Option D is incorrect because 'commit check' only validates configuration syntax and does not update UTM signature databases.

Answer

Rebooting the Routing Engine via the 'request system reboot' command.

Answer

Executing a factory default reset on the SRX device.

Answer

Running a manual commit check on the configuration file.

Question 4

Which UTM feature should an administrator configure to prevent employees from accessing gambling and adult content websites?

Accepted Answer

Web Filtering. Web Filtering is the UTM feature specifically designed to block access to categories of websites such as gambling and adult content. It uses a URL categorization database to classify sites and applies policies that permit or deny access based on category, making it the correct choice for this requirement.

Answer

Antivirus

Answer

Antispam

Answer

Content Filtering

Question 5

When configuring an Integrated Web Filtering profile, an administrator wants to block access to social networking sites during working hours. Which profile parameter is used to specify this category-based block?

Accepted Answer

set security utm feature-profile web-filtering profile category action block. Categories in Web Filtering are assigned actions (permit, block, or log) within the web filtering profile.

Answer

set security policies policy-profile category-block social-networking

Answer

set security utm feature-profile web-filtering profile <name> block-category social-networking

Answer

set security utm web-filtering category social-networking drop

Question 6

An administrator configures Content Filtering to block all files with the '.scr' extension. A user renames an executable screensaver file from 'malware.scr' to 'malware.jpg' and uploads it via HTTP. What will the SRX content filtering engine do by default?

Accepted Answer

The file will be blocked if MIME-type inspection is enabled, because the MIME type in the HTTP header identifies the true payload format.. Advanced content filtering or MIME inspection checks actual file signatures (magic numbers) rather than relying solely on file extensions. However, standard extension-based content filtering checks the extension in the filename, while deep inspection checks MIME headers.

Answer

The file will always pass because content filtering cannot inspect files with modified extensions.

Answer

The file will cause a crash of the SRX content filtering daemon.

Answer

The file will be automatically renamed back to '.scr' by the firewall.

Question 7

Which command is used to display the active UTM license status on an SRX Series firewall?

Accepted Answer

show system licenses. License management commands under 'show system licenses' verify installed features like UTM, IDP, and Antivirus.

Answer

show license utm-status

Answer

show security utm license-status

Answer

show security license utm detail

Question 8

You are troubleshooting an issue where Integrated Web Filtering traffic is intermittently failing with a 'server connection timeout' error to the cloud rating service. Which troubleshooting command allows you to test DNS resolution for the cloud rating server directly from the SRX CLI?

Accepted Answer

ping <cloud-rating-server-hostname>. The standard Junos operational ping command with domain names tests DNS resolution and reachability.

Answer

test dns resolution <hostname>

Answer

traceroute utm-cloud

Answer

show security utm dns-cache

Question 9

Which THREE actions can be configured within a Content Filtering profile when a matched file type or MIME type violation occurs? (Choose three.)

Accepted Answer

Display a custom block message. In a Content Filtering profile, when a matched file type or MIME type violation occurs, the profile can be configured to display a custom block message (option C), which informs the user why the transfer was stopped; to block the transfer (option D), which prevents the file from being delivered; and to log the event (option E), which records the violation for auditing and monitoring. These three actions are standard response actions available in content filtering configurations for handling policy violations. Option A is incorrect because automatic quarantine to local flash storage is not a configurable action within a Content Filtering profile for file type or MIME type violations. Option B is incorrect because automatic file sanitization with macro removal is a separate feature, such as WildFire inline ML or file sanitization, and is not one of the three actions available in the Content Filtering profile for this scenario.

Answer

Automatic quarantine to local flash storage

Answer

Automatic file sanitization (macro removal)

Question 10

Which TWO components are required for Integrated Web Filtering to function properly on an SRX Series firewall? (Choose two.)

Accepted Answer

An active Integrated Web Filtering license. Integrated Web Filtering requires an active cloud rating license and functional internet reachability to query categorization servers.

Answer

A local database containing all 10 million global URLs

Answer

An SMTP mail server relay

Question 11

When configuring an Antispam profile, you want to specify that emails detected as spam should be tagged in the subject line rather than completely dropped. Which parameter within the antispam profile configuration enables this?

Accepted Answer

set security utm feature-profile antispam profile <name> smtp-action tag-subject. Junos antispam profiles allow customizing the action, including tagging the subject line of suspected spam emails.

Answer

set security utm feature-profile antispam profile <name> modify-header subject-tag

Answer

set security utm antispam-profile <name> subject-rewrite

Answer

set security utm feature-profile antispam profile <name> spam-action rewrite-subject

Question 12

An administrator needs to ensure that when a web filtering block occurs, a specific redirect URL is presented to the user. Where is the redirect URL configured within the web filtering profile?

Accepted Answer

set security utm feature-profile web-filtering profile block-message-type redirect-url . Web filtering profile settings allow configuring custom block actions, including specifying a redirect URL.

Answer

set security policies policy-profile redirect-url <url>

Answer

set security utm web-filtering redirect-action url <url>

Answer

set security utm feature-profile web-filtering profile redirect

Question 13

Which THREE parameters can be configured under a Content Filtering profile to inspect incoming HTTP payloads? (Choose three.)

Accepted Answer

File extension block list. In a Content Filtering profile, the File extension block list (A) is configurable because the firewall inspects the HTTP payload for file names/extensions and can block or allow them based on that list. The MIME type block list (C) is also valid since the engine examines the Content-Type header and payload to identify MIME types and enforce blocking. Custom string pattern matching (E) is correct because the content filter can scan HTTP payloads for user-defined strings or regular expressions and take action when matched. DNSBL blacklist server configuration (B) is not a payload inspection parameter; it checks the source IP against DNS blacklists at connection time. URL category rating database (D) is used for URL filtering based on the requested site's category, not for inspecting the HTTP payload content.

Answer

DNSBL blacklist server configuration

Answer

URL category rating database

Question 14

When configuring Antivirus inspection on an SRX device using Kaspersky, you want to ensure that password-protected archive files (such as .zip or .rar files containing passwords) are blocked because they cannot be scanned for malware. Which profile parameter achieves this?

Accepted Answer

set security utm feature-profile antivirus profile <name> http-profile archive password-protected block. Antivirus profiles allow configuring actions for un-scannable files, such as password-protected archives, to maintain security posture.

Answer

set security utm feature-profile antivirus profile <name> drop-encrypted-streams

Answer

set security content-filtering password-archives block

Answer

set security utm antivirus encrypted-files drop

Question 15

Which TWO elements are mandatory when attaching a UTM policy to a security policy in Junos OS? (Choose two.)

Accepted Answer

The 'utm-policy ' statement inside the security policy 'then' block. Option C is correct because attaching a UTM policy to a security policy in Junos OS is done by referencing it in the security policy's action, specifically with the 'utm-policy ' statement inside the 'then' block, which binds the UTM profile to matching traffic. Option E is correct because that referenced UTM policy must already exist as a valid policy name defined under [edit security utm policy-profile]; otherwise the commit fails since the security policy cannot reference a nonexistent UTM policy. The other options are not mandatory: a stateless firewall filter on the loopback (A) is unrelated to UTM attachment, an IPv6 address family on the egress interface (B) is only needed for IPv6 traffic and not for UTM policy binding, and an active BGP neighbor (D) is a routing requirement that has nothing to do with applying UTM to a security policy.

Answer

A stateless firewall filter attached to the loopback interface

Answer

An IPv6 address family on the egress interface

Answer

An active BGP routing neighbor in the routing table