JNCIA-SEC Content Security Practice Test 4 — 15 Questions

Question 1

An administrator configures an antivirus profile on an SRX Series firewall to scan HTTP and SMTP traffic. Users report that large file downloads over HTTP are timing out. The administrator suspects that the antivirus scanning is causing the issue. Which action should the administrator take to resolve this problem while maintaining virus protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the antivirus profile to skip scanning for files larger than a specified size.. Antivirus scanning can introduce latency, especially for large files, potentially causing session timeouts. To mitigate this while maintaining protection, the administrator can configure the antivirus profile to skip scanning for files exceeding a certain size. This allows large downloads to proceed without inspection, reducing the chance of timeouts, while still scanning smaller files. This approach balances security and performance. Increasing file size limits or session timeouts does not directly address the scanning delay, and disabling scanning entirely is not recommended.

Answer

Increase the session timeout value for HTTP traffic in the security flow configuration.

Answer

Increase the maximum file size limit in the antivirus profile to accommodate larger files.

Answer

Disable antivirus scanning for HTTP traffic entirely and rely on SMTP scanning only.

Question 2

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). When configuring a DNSBL server profile for antispam inspection on a Juniper SRX, option A (Server type such as rbl or svbl) is required because the profile must specify which kind of blacklist lookup is being performed, e.g., an RBL for real-time blackhole lists or an SVBL for sender-verify blacklists. Option B (Server domain name or IP address) is required because the SRX must know which DNSBL server to query, such as a hostname or IP address of the blacklist provider. Option D (Expected DNS reply code or threshold IP indicating spam) is required because the device must interpret the DNSBL response, for example a 127.0.0.x reply or a configured threshold that identifies the sender as spam. Options C and E are not part of the DNSBL profile configuration: SMTP encryption certificates and private keys are used for TLS-related mail security settings, while POP3/IMAP proxy ports are irrelevant because DNSBL antispam inspection operates on SMTP and DNS lookups, not POP3 or IMAP proxy services.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 3

Which TWO actions can be configured when a URL is matched against a blocked category in an Integrated Web Filtering profile on an SRX Series device? (Choose two.)

Accepted Answer

Block the connection and display a custom HTML block page message.. Option B is correct because an Integrated Web Filtering (IWF) profile on SRX Series devices can be configured with a block action that terminates the connection and returns a custom HTML block page to the client, informing the user that the requested URL falls into a blocked category. Option C is correct because the profile also supports a redirect action that sends the user's browser to a predefined warning URL instead of simply blocking, allowing administrators to present their own notification or policy page. These two actions are the standard configurable responses for a matched blocked category in the IWF profile. Option A is incorrect because rebooting the control plane is not a web filtering action and SNMP traps are logging/alerting features, not block responses. Option D is incorrect because IWF does not rewrite HTTP headers to inject authentication tokens. Option E is incorrect because silently dropping the packet is not the defined IWF block behavior; the block action generates a notification page rather than a silent drop.

Answer

Send an SNMP trap and instantly reboot the device control plane.

Answer

Automatically rewrite the HTTP request header to inject user authentication tokens.

Answer

Drop the packet silently without sending any notification to the client.

Question 4

An administrator needs to configure basic web filtering on a Juniper SRX Series device using the Integrated Web Filtering feature. Which license is strictly required on the SRX Series device to enable communication with the cloud-based web filtering rating server?

Accepted Answer

An Integrated Web Filtering license. Integrated Web Filtering on Juniper SRX devices relies on cloud-based categorization servers, which requires a valid Sophos or Webroot web filtering license installed on the device.

Answer

An IDP (Intrusion Detection and Prevention) license

Answer

An AppSecure license

Answer

An Anti-Virus license

Question 5

What is the default action taken by a Juniper SRX UTM Antivirus profile when an infected file is detected within an HTTP stream using the Express antivirus engine?

Accepted Answer

Block the file transfer and terminate the session.. The default action for Juniper UTM antivirus when malware is detected in transit is to block the file transfer and drop the stream.

Answer

Strip the infected payload and deliver the sanitized file to the client.

Answer

Quarantine the file into an internal flash memory directory for manual review.

Answer

Permit the file and generate an alarm log.

Question 6

When configuring Kaspersky-based Antivirus on an SRX Series device, which operational mode reduces resource consumption by only scanning files matching specific high-risk protocol extensions?

Accepted Answer

Extension-based or type-based scanning filtering. Kaspersky antivirus on SRX supports extension-based filtering to optimize performance by skipping non-risk file types.

Answer

Passive monitor mode

Answer

Stateless AV filtering

Answer

Fast-track scanning mode

Question 7

Which UTM feature on Juniper SRX Series firewalls is responsible for inspecting incoming Simple Mail Transfer Protocol (SMTP) traffic for unsolicited bulk commercial email?

Accepted Answer

Antispam. Antispam is the specific UTM feature designed to detect and block spam over SMTP protocols.

Answer

Web filtering

Answer

Antivirus

Answer

Content filtering

Question 8

What is the primary purpose of a UTM policy profile on a Juniper SRX firewall?

Accepted Answer

To bundle multiple individual UTM feature profiles into a single assignable policy object.. A UTM policy profile acts as a container that bundles various UTM feature profiles (antivirus, web-filtering, antispam, content-filtering) together for application in security policies.

Answer

To configure stateful inspection timeouts for high-speed interfaces.

Answer

To define routing metrics for secure VPN tunnels.

Answer

To enforce user authentication mechanisms before granting network access.

Question 9

An administrator configures Web Filtering with a custom block message. When users visit a blocked site, they do not see the custom message; instead, they receive a generic browser connection error. What is the most likely cause of this behavior?

Accepted Answer

SSL proxy (HTTPS decryption) is not configured to inspect and inject the block page for HTTPS traffic.. When browsing via HTTPS, if the firewall attempts to inject a block page without SSL proxy (SSL initiation/decryption) enabled, the browser rejects the invalid certificate or connection reset, causing a generic browser error.

Answer

The browser cache needs to be cleared.

Answer

The web filtering license has expired.

Answer

The default action must be set to 'log' instead of 'block'.

Question 10

Which Junos configuration hierarchy is used to define a UTM Web Filtering profile?

Accepted Answer

[edit security utm feature-profile web-filtering profile <name>]. UTM feature profiles are configured under the [edit security utm feature-profile web-filtering] hierarchy.

Answer

[edit firewall utm-policy web-filter]

Answer

[edit security web-filter profile <name>]

Answer

[edit applications utm web-filtering]

Question 11

An administrator wants to verify that the antivirus signature database on an SRX firewall is up to date. Which operational command should be used?

Accepted Answer

show security utm antivirus status. The command 'show security utm antivirus status' provides details regarding the antivirus engine status and signature database version.

Answer

show security license antivirus detail

Answer

show system software status antivirus

Answer

request security utm antivirus update-check

Question 12

What is the primary function of the Junos Express Antivirus engine on SRX Series firewalls?

Accepted Answer

To detect and block malware within network traffic streams.. The Junos Express Antivirus engine on SRX Series firewalls is designed to detect and block malware within network traffic streams. It inspects files and content passing through the firewall, using signatures and heuristics to identify malicious code, and can block or quarantine infected files in real time.

Answer

To inspect Layer 7 application handshakes for AppID classification.

Answer

To filter out unsolicited bulk email messages over SMTP.

Answer

To categorize URLs into security and productivity groups.

Question 13

An administrator needs to ensure that Antispam inspection is applied only to inbound mail destined for the corporate mail server. How should this be achieved in the security policy configuration?

Accepted Answer

Attach an antispam-enabled UTM policy exclusively to the security policy permitting SMTP traffic from the untrusted zone to the mail server.. Antispam is bound to a UTM policy, which in turn is attached to a specific security policy governing the mail server traffic flow.

Answer

Configure a global antispam filter under the [edit security utm] hierarchy.

Answer

Apply the antispam profile directly to the egress interface facing the mail server.

Answer

Enable antispam globally within the system services configuration.

Question 14

Which TWO protocols are supported for Antivirus scanning within Juniper SRX UTM profiles? (Choose two.)

Accepted Answer

HTTP. Options A (HTTP) and D (SMTP) are correct because Juniper SRX UTM antivirus profiles support scanning of the HTTP, SMTP, POP3, IMAP, FTP, and SMB protocols, so HTTP and SMTP are both valid protocol types for antivirus scanning. HTTP scanning inspects web traffic for malicious content, while SMTP scanning inspects email traffic for virus attachments. The remaining options do not belong: BGP is a routing protocol, SNMP is used for network management, and NTP is used for time synchronization, none of which carry user file content that UTM antivirus would scan.

Answer

BGP

Answer

SNMP

Answer

NTP

Question 15

Which THREE parameters can be configured when tuning an Antivirus profile in Junos OS UTM? (Choose three.)

Accepted Answer

Action upon virus detection (e.g., block or permit). Option A is correct because a Junos OS UTM antivirus profile lets you set the action taken when a virus is detected, such as block (drop), permit, or log-and-permit, configured via the 'then' action under the antivirus profile. Option B is correct because the antivirus profile is organized into protocol-specific sub-profiles for HTTP, FTP, SMTP, POP3, and IMAP, each of which can be individually enabled and tuned. Option C is correct because the antivirus profile includes a maximum content/file size setting (e.g., 'max-content-size') that limits how large a file will be scanned, after which it is passed or handled per policy. Option D is not part of antivirus tuning; URL rating server timeout belongs to the Web filtering (URL filtering) configuration, not the antivirus profile. Option E is also unrelated to antivirus; DNSBL blacklist server domain is configured under the antispam (E-mail filtering) UTM feature, not the antivirus profile.

Answer

URL rating server timeout threshold

Answer

DNSBL blacklist server domain