JNCIA-SEC Content Security Practice Test 3 — 15 Questions

Question 1

An administrator configures Web Filtering to log all requests, but security logs show that requests to permitted sites are not generating log entries. What is the most likely cause?

Accepted Answer

The 'log-permitted' option is not enabled within the web-filtering profile.. Web filtering profiles often default to logging only blocked or violation events unless explicitly configured to log permitted traffic using the 'log-permitted' parameter.

Answer

Permitted traffic bypasses UTM inspection entirely.

Answer

Security logging is globally disabled across the SRX device.

Answer

The web filtering license does not support logging allowed traffic.

Question 2

Which TWO methods can be used to check the operational health and status of the UTM engines on a Juniper SRX Series device? (Choose two.)

Accepted Answer

The 'show security utm web-filtering status' command.. Option D, the 'show security utm status' command, is correct because it directly reports the operational state of the UTM engine itself, showing whether UTM processing is enabled and running on the SRX. Option C, the 'show security utm web-filtering status' command, is correct because it verifies the health and status of a specific UTM feature (web filtering), confirming whether that UTM module is active and functioning. Option A, 'show chassis cluster status', only reports chassis cluster failover and redundancy states, not UTM engine health. Option B, 'show interfaces terse', merely lists interface up/down and addressing information, which is unrelated to UTM. Option E, 'show system routing-table', displays routing entries and has nothing to do with UTM operational status.

Answer

The 'show chassis cluster status' command.

Answer

The 'show interfaces terse' command.

Answer

The 'show system routing-table' command.

Question 3

When configuring an SRX firewall with Content Filtering, you want to ensure that any HTTP response containing a specific sensitive keyword is blocked. Which CLI configuration path and command accomplish this?

Accepted Answer

[edit security utm custom-objects content-filtering custom-string <name>] and reference it in the content-filtering profile.. Content filtering profiles allow defining custom string patterns to block traffic containing specific text strings.

Answer

[edit security policies content-string-filter <text>]

Answer

[edit firewall filter custom-string action block]

Answer

[edit security utm feature-profile content-filtering profile block-string ]

Question 4

An administrator configures Web Filtering and wants to ensure that users attempting to access a blocked gambling site see a specific notification page. Which configuration statement enables this?

Accepted Answer

set security utm feature-profile web-filtering profile <name> custom-block-message "Access to gambling sites is prohibited.". Configuring a custom block message under the web filtering profile allows displaying specific text when a site is blocked.

Answer

set system services web-management block-message <text>

Answer

set security policies custom-message <text>

Answer

set security utm web-filtering message-page <text>

Question 5

Which THREE parameters can be configured when setting up a custom URL category in Junos OS UTM? (Choose three.)

Accepted Answer

Matching type (such as exact, prefix, or suffix). When creating a custom URL category in Junos OS UTM (under security utm custom-objects url-pattern), you must define the category name, so option D (Custom category name) is correct because the name identifies the custom object referenced later in UTM URL-filtering profiles. Option A (Matching type such as exact, prefix, or suffix) is correct because each URL pattern entry is configured with a match type—exact, prefix, or suffix—that determines how the pattern is compared against the requested URL. Option E (URL pattern strings or regular expressions) is correct because the custom category is populated with the actual URL patterns/regex values that define which URLs belong to the category. Option B (DNSBL server IP addresses) is incorrect because DNSBL configuration belongs to UTM anti-spam, not URL categorization. Option C (Antivirus signature database version) is incorrect because signature database versioning is part of UTM antivirus configuration, not custom URL category setup.

Answer

DNSBL server IP addresses

Answer

Antivirus signature database version

Question 6

You are configuring Antivirus inspection on an SRX Series firewall and want to ensure that files larger than 20 MB are not scanned, in order to prevent CPU and memory exhaustion on the processing cards. Which CLI command configures this maximum file size limit for HTTP streams?

Accepted Answer

set security utm feature-profile antivirus profile default http-profile maximum-file-size 20. The correct syntax to set the maximum file size for HTTP scanning in an antivirus profile is 'set security utm feature-profile antivirus profile http-profile maximum-file-size '. This configures the HTTP sub-profile within the AV profile to skip scanning files larger than the specified size, protecting CPU and memory on the SRX.

Answer

set security utm antivirus max-size 20mb

Answer

set security flow max-file-size 20

Answer

set security utm stream-scanning file-limit 20

Question 7

You are configuring an SRX Series firewall with Antivirus inspection. You want to ensure that if the cloud rating or antivirus update service becomes unreachable, the firewall fails open and does not disrupt user web browsing. Which CLI parameter configures the fail-open behavior?

Accepted Answer

set security utm feature-profile antivirus profile fallback-action permit. On SRX UTM, the antivirus profile supports a 'fallback-action' (also called fallback settings) that determines what happens when the scanning engine cannot reach the cloud rating or update service. Setting 'fallback-action permit' makes the firewall fail open, allowing the session to proceed unscanned rather than dropping it. This is configured under 'set security utm feature-profile antivirus profile fallback-action permit'.

Answer

set security flow utm-fail-open

Answer

set security utm error-action allow

Answer

set security utm feature-profile antivirus profile <name> un-scannable permit

Question 8

An SRX Series firewall is configured with an extensive UTM policy containing antivirus, web filtering, and content filtering. During peak hours, CPU utilization spikes, causing packet drops. Which feature option should the administrator adjust within the UTM policy to optimize performance without disabling security entirely?

Accepted Answer

Configure the antivirus profile to use express-mode or stream-based scanning options if supported by the platform. When Juniper SRX devices experience high CPU due to UTM inspection, offloading scanning or utilizing stream-based inspection modes instead of proxy-based inspection (or tuning cache timeouts and fallback actions) helps maintain performance. Specifically, configuring the fallback action or optimizing local cache settings reduces cloud query latency and overhead.

Answer

Disable content filtering and rely solely on AppID rules in security policies

Answer

Set the UTM web-filtering fallback profile action to log-and-permit or block when the cloud server is unreachable

Answer

Switch the antispam engine from cloud-based lookup to local pattern matching

Question 9

An administrator implements Web filtering on an SRX Series firewall using SurfControl as the cloud provider. Users report that access to a newly launched educational website is unexpectedly blocked. Where should the administrator check first to determine why the URL was blocked and override the categorization if necessary?

Accepted Answer

Run the show security utm web-filtering statistics command to verify cache hits and category query responses. The Juniper security intelligence and Web filtering features allow administrators to query the cloud rating server or view local logs via security logs and operational commands like 'show security utm web-filtering statistics' or 'show security utm web-filtering status' to check category matches and override incorrect ratings.

Answer

Verify the content filtering profile blocks using show security utm content-filtering statistics

Answer

Review the antispam blocklist statistics using show security utm antispam statistics

Answer

Examine the dynamic application signatures database version using show security alg status

Question 10

A company requires that employees be blocked from accessing social networking sites during work hours, but allowed to access them during a specific lunch window. How should the administrator achieve this using Juniper Web filtering features?

Accepted Answer

Attach a custom scheduler object to the security policy that toggles between two different Web filtering profiles containing opposing category actions. Web filtering profiles can be associated with custom schedules or applied conditionally, but standard operational practice involves creating multiple Web filtering profiles or leveraging custom URL categories combined with scheduler objects referenced in security policies.

Answer

Use the antispam scheduler hierarchy to override web filtering category rules during lunch hours

Answer

Define a content filtering rule with an active time range for MIME type dropping

Answer

Configure a time-based exception directly inside the SurfControl cloud portal settings

Question 11

An administrator is configuring a Web filtering profile on a Juniper SRX Series device using local database caching. Which TWO parameters can be adjusted to optimize cache performance and behavior? (Choose two.)

Accepted Answer

maximum-entries. Option D (maximum-entries) is correct because it sets the maximum number of entries the local Web-filtering cache can hold, directly controlling cache size and memory usage on the SRX. Option E (timeout) is correct because it defines how long cached entries remain valid before expiring, which governs cache freshness and hit behavior. Together these two parameters tune the local database caching performance and behavior. Option A (fallback-profile) is incorrect because it specifies the profile used when the Web-filtering server is unreachable, not a cache tuning parameter. Option B (block-message) is incorrect because it only customizes the message shown to users when a site is blocked. Option C (server-timeout) is incorrect because it controls how long the SRX waits for the external Web-filtering server response, not local cache behavior.

Answer

fallback-profile

Answer

block-message

Answer

server-timeout

Question 12

When configuring Juniper UTM Content Filtering, an administrator can define matching criteria to take specific actions (block, permit, or log). Which THREE criteria types are supported by the content filtering feature? (Choose three.)

Accepted Answer

MIME types. Option A (MIME types) is correct because Juniper UTM Content Filtering lets you match traffic by MIME type (e.g., application/pdf, image/jpeg) so you can block, permit, or log content based on the declared or detected media type. Option B (Custom pattern strings) is correct because content filtering supports user-defined regular-expression or string patterns that are matched against the payload to identify and act on specific content. Option D (File extensions) is correct because the feature can match on file extensions (e.g., .exe, .zip) to enforce policies on files by their extension. Option C (Email sender IP addresses) is not part of content filtering matching criteria; sender-IP-based controls belong to anti-spam/email security features rather than UTM content filtering. Option E (URL category ratings) is not a content filtering criterion; URL category-based matching and actions are handled by the UTM Web Filtering feature, not Content Filtering.

Answer

Email sender IP addresses

Answer

URL category ratings

Question 13

A network administrator is configuring UTM content filtering on an SRX Series firewall to block access to known malicious websites. The administrator wants to use a custom blocklist that is hosted on an external HTTP server. Which configuration statement is required to reference this external blocklist?

Accepted Answer

set security utm custom-objects custom-url-category blocklist value http://server/blocklist.txt. To use an external blocklist for UTM content filtering, you must create a custom URL category and specify the URL where the list is hosted. The command 'set security utm custom-objects custom-url-category blocklist value http://server/blocklist.txt' accomplishes this by defining the category and its external source.

Answer

set security utm custom-objects custom-url-category blocklist

Answer

set security utm custom-objects url-pattern blocklist

Answer

set security utm custom-objects url-pattern blocklist value http://server/blocklist.txt

Question 14

An administrator is configuring UTM antivirus on an SRX Series firewall to scan email traffic. The administrator wants to ensure that the antivirus engine scans both inbound and outbound email. Which two protocols must be included in the UTM policy to inspect email traffic? (Choose two.)

Accepted Answer

SMTP. To scan email traffic for viruses, the UTM policy must include SMTP for sending and POP3 for retrieving email. These protocols cover the typical email flow and allow the antivirus engine to inspect messages and attachments for malicious content.

Answer

IMAP

Answer

FTP

Answer

HTTP

Question 15

An administrator on an SRX340 running Junos OS 21.4R3 wants UTM antivirus to scan only traffic that matches a specific application, while leaving all other sessions uninspected. The antivirus profile 'av-corp' already exists. Which configuration step accomplishes this?

Accepted Answer

Apply the antivirus profile directly under the [edit security policies from-zone trust to-zone untrust policy permit-web] hierarchy using the then permit application-services antivirus-profile av-corp statement.. UTM profiles such as antivirus become effective only when referenced in a security policy rule action via application-services. Binding av-corp to the specific permit-web rule ensures the target application's sessions are inspected while other traffic on the device remains untouched. Global or zone-level application of antivirus profiles is not supported in Junos OS, so scoping the reference to one policy is the correct method.

Answer

Commit the antivirus profile and rely on the default behavior that all existing profiles are automatically active on every inter-zone policy.

Answer

Configure set security utm utm-policy av-policy antivirus http-profile av-corp and apply it globally with set security utm utm-policy av-policy apply-global.

Answer

Enable inspection at the zone level with set security zones security-zone trust application-services antivirus-profile av-corp.