JNCIA-SEC Content Security Practice Test 6 — 15 Questions

Question 1

An administrator configures Antispam inspection, but wants to ensure that emails from internal trusted hosts bypass antispam scanning. How should this be handled?

Accepted Answer

Add the trusted internal hosts or sender domains to the antispam custom permit list.. Antispam policies and custom objects allow defining local permit lists for trusted hosts or domains.

Answer

Disable security policies for internal traffic.

Answer

Attach the antispam profile to the egress interface instead of the ingress policy.

Answer

Configure source NAT to hide internal host IP addresses.

Question 2

When configuring an Integrated Web Filtering profile, you want to ensure that URLs categorized as 'Malware' or 'Phishing' are blocked immediately, while URLs categorized as 'Streaming Media' generate a log entry but are permitted. How should you configure this in Junos?

Accepted Answer

Assign 'block' action to Malware and Phishing categories, and 'permit' with logging enabled to Streaming Media.. Integrated Web Filtering (IWF) on Junos SRX uses the Juniper ATP Cloud (Sky ATP) category-based URL database, and each category can be assigned its own action (block, permit, log-and-permit, quarantine, user-block). To block Malware and Phishing while allowing Streaming Media with visibility, you set the action to 'block' for the two threat categories and 'permit' with logging enabled for Streaming Media. This is done inside the UTM feature-profile web-filtering profile, not via AppSecure or content filtering.

Answer

Configure AppSecure to block malware and allow streaming media.

Answer

Assign a global block action and create bypass exceptions for streaming media.

Answer

Use content filtering to block malware URLs and web filtering for streaming media.

Question 3

Which Junos CLI command displays the version and status of the Integrated Web Filtering engine?

Accepted Answer

show security utm web-filtering status. Operational commands starting with 'show security utm web-filtering' display status and version details.

Answer

show utm engine status web-filter

Answer

show security license web-filtering detail

Answer

show system software web-filter

Question 4

Which TWO protocols are inspected by Integrated Web Filtering on Juniper SRX Series firewalls? (Choose two.)

Accepted Answer

HTTP. Integrated Web Filtering (IWF) on Juniper SRX Series firewalls is a UTM feature that inspects web traffic, so option B (HTTP) is correct because plaintext HTTP requests are parsed to extract the URL, host, and category for policy enforcement. Option D (HTTPS) is also correct because IWF supports SSL forward proxy inspection, decrypting HTTPS sessions so the embedded HTTP request can be classified and filtered. Options A (SNMP), C (ICMP), and E (SMTP) are not web-browsing protocols and are not inspected by IWF; SNMP and ICMP are network management/diagnostic protocols, and SMTP is handled by other UTM modules such as antispam rather than web filtering.

Answer

SNMP

Answer

ICMP

Answer

SMTP

Question 5

An administrator configures Content Filtering to block executable files (.exe). Users report that they can still download archives containing executable files inside them (.zip). What is the recommended way to prevent users from bypassing file extension blocks using compressed archives?

Accepted Answer

Add archive file extensions (such as .zip and .rar) to the content filtering block list.. To prevent users from bypassing file extension blocks using archives, content filtering or antivirus profiles should be configured to block archive types (.zip, .rar) or block password-protected/unscannable archives.

Answer

Convert the security policy from stateless to stateful inspection.

Answer

Enable BGP routing route-reflection for HTTP traffic.

Answer

Disable HTTP proxy caching on the client browsers.

Question 6

Which TWO actions can be taken when an email message is identified as spam by an Antispam profile on an SRX Series firewall? (Choose two.)

Accepted Answer

Block the message. On an SRX Series firewall, when an Antispam profile detects a message as spam, the firewall can take the action of blocking the message (option B), which drops or rejects the offending email so it is not delivered to the recipient. It can also log the event (option D), generating a log entry that records the spam detection for monitoring, auditing, and troubleshooting via the configured logging or syslog facilities. These two actions are the standard configurable responses within the Antispam profile's action settings. Option A (rebooting the mail server via SNMP) is not an SRX Antispam action and would be an inappropriate, disruptive network management operation. Option C (automatically encrypting the email payload) is not a spam-handling action and is unrelated to Antispam profile behavior. Option E (deleting the user mailbox on the mail server) is a mail-server administrative task, not an action the SRX firewall performs when classifying a message as spam.

Answer

Reboot the mail server via SNMP

Answer

Automatically encrypt the email payload

Answer

Delete the user mailbox on the mail server

Question 7

Which THREE configuration elements are required to successfully implement Integrated Web Filtering on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

A valid Integrated Web Filtering license installed on the SRX. Option A is correct because Integrated Web Filtering (IWF) on SRX relies on a valid subscription license that enables the Juniper-provided cloud category database and local cache; without the license, the firewall cannot query or update the URL category feed. Option B is correct because a web filtering feature profile is where you define the category actions (permit, block, log, quarantine, user-block) and configure the fallback/block settings that the UTM engine enforces. Option D is correct because the web filtering profile must be referenced inside a UTM policy profile, and that UTM policy must then be attached to a security policy so traffic matching the policy is actually inspected. Option C is not required because IWF uses HTTP/HTTPS to reach Juniper's cloud rating infrastructure, not an SMTP relay, which is only relevant to e-mail (anti-spam) UTM features. Option E is not required because the SRX communicates with the Juniper cloud rating service over standard IP/HTTPS connectivity and does not need a BGP peering session with the rating provider.

Answer

An SMTP mail server relay configuration

Answer

An active BGP peering session with the cloud rating provider

Question 8

What is the purpose of a Custom URL Category in Juniper SRX Web Filtering?

Accepted Answer

To define custom URL patterns and group them for specific permit or block actions.. Custom URL categories allow administrators to group specific custom URLs for tailored permit or block policies.

Answer

To configure IPsec VPN gateway endpoints.

Answer

To store antivirus malware signatures locally.

Answer

To define email sender white-lists.

Question 9

An administrator configures Content Filtering to block all .exe files, but users report that they can still download .exe files over encrypted HTTPS connections. What is the most likely reason for this?

Accepted Answer

HTTPS decryption (SSL proxy) is not configured, so the firewall cannot inspect the encrypted payload for file extensions.. Content filtering on Juniper SRX devices inspects traffic at the application layer, but for HTTPS traffic, the payload is encrypted. Without SSL proxy (HTTPS decryption) configured, the firewall cannot see the file extension inside the encrypted stream, so it cannot block .exe files. Thus, the most likely reason is that HTTPS decryption is not configured.

Answer

Content filtering only supports FTP traffic.

Answer

The content filtering license has expired.

Answer

The SRX control plane lacks memory.

Question 10

An administrator is configuring a Unified Threat Management (UTM) policy on a Juniper SRX Series device to protect internal users from downloading malicious software. Which UTM feature should the administrator enable and configure to scan HTTP and FTP traffic for viruses?

Accepted Answer

Antivirus. The antivirus (AV) feature in Juniper UTM is responsible for scanning traffic protocols such HTTP, FTP, SMTP, and POP3 for malicious payloads. Web filtering specifically controls access to URL categories, antispam processes email, and content filtering blocks files based on MIME types or extensions.

Answer

Content filtering

Answer

Antispam

Answer

Web filtering

Question 11

An administrator notices that the SRX firewall is failing to inspect encrypted HTTPS traffic for web filtering and antivirus violations. The security policy currently permits traffic from the trust zone to the untrust zone with a UTM profile attached. What must be configured to enable content security inspection on this HTTPS traffic?

Accepted Answer

Configure an SSL proxy profile and apply it to the security policy alongside the UTM profile. UTM security features on Juniper SRX devices inspect cleartext protocols by default. To inspect HTTPS (SSL/TLS) traffic, the firewall must perform SSL proxy decryption (Forward Proxy) to decrypt the session, inspect the content using the UTM profile, and re-encrypt it before forwarding.

Answer

Enable SSH inspection within the content filtering profile configuration hierarchy

Answer

Change the security policy action from permit to tunnel for encrypted sessions

Answer

Upgrade the Juniper Secure Connect license to enable TLS deep packet inspection in the UTM profile

Question 12

A network administrator needs to prevent users in the engineering department from uploading company source code to unauthorized cloud file-sharing services via web browsers. Which configuration mechanism within Juniper UTM content filtering accomplishes this task?

Accepted Answer

Enabling content filtering with a profile targeting specific upload MIME types or file extensions. Content filtering inspects HTTP and SMTP traffic to block or permit transfers based on MIME types, file extensions, or file sizes. By specifying blocking rules for specific upload MIME types, the administrator can prevent the unauthorized transmission of files.

Answer

Enabling integrated web filtering with a policy action of block for the File Sharing category

Answer

Configuring a custom URL category with a block action

Answer

Configuring antispam filters to drop outbound HTTP requests containing attachments

Question 13

An administrator wants to configure antispam protection on an SRX Series firewall to protect an internal mail server. Which protocol inspection engine is used by Juniper antispam to evaluate incoming messages?

Accepted Answer

SMTP, POP3, and IMAP inspection engines. Juniper antispam utilizes the SMTP, POP3, and IMAP protocol inspection engines to evaluate incoming emails, checking headers and bodies against blacklists and heuristics.

Answer

FTP and SFTP file transfer engines

Answer

DNS query inspection engines

Answer

HTTP and HTTPS proxy engines

Question 14

An administrator is troubleshooting an antivirus profile on an SRX Series device where certain archive files (.zip) containing test malware are bypassing inspection. Which THREE configuration elements or factors should the administrator verify? (Choose three.)

Accepted Answer

Confirm whether password-protected or encrypted archives are configured to be blocked or bypassed.. Option B is correct because Junos antivirus profiles can be configured to either block or bypass password-protected/encrypted archives; if the action is set to bypass, .zip files containing malware will not be inspected, so the administrator must verify this setting. Option C is correct because the antivirus profile has a max-file-size limit (default 10 MB in many Junos versions); any archive larger than this limit is skipped, allowing malware to pass uninspected. Option D is correct because the archive-depth setting controls how many levels of nested compressed files are decompressed and scanned; if set too low, malware hidden in nested archives inside the .zip will not be inspected. Option A is incorrect because AppID is a separate identification service and does not need to be disabled for antivirus inspection to work; disabling it would not fix the bypass issue. Option E is incorrect because antispam whitelists apply to email sender/IP/MIME filtering for antispam, not to antivirus archive inspection, and whitelisting a MIME type would not cause .zip files to bypass antivirus scanning.

Answer

Ensure the AppID service object is explicitly disabled for all antivirus inspection policies.

Answer

Verify that the antispam whitelist contains the specific MIME type of the .zip file.

Question 15

An administrator is deploying UTM antivirus on an SRX Series firewall. The security team requires that files larger than a specified size be bypassed by the antivirus engine to avoid excessive resource consumption. The administrator configures the UTM policy profile with the appropriate maximum file size. Which configuration parameter must be set within the UTM policy to enforce this limit?

Accepted Answer

max-file-size. The max-file-size parameter in a UTM policy profile defines the maximum file size that the antivirus engine will scan. Files larger than this value are not scanned, which helps conserve resources on the SRX device. This is the standard Junos OS method for controlling antivirus scanning based on file size.

Answer

size-exceed-action

Answer

scan-limit

Answer

file-threshold