JNCIA-SEC Content Security — Timed 10 Questions

Question 1

When configuring Antispam on an SRX Series device using the SBL (Spam Black List) feature, what is the primary function of the block/permit action list?

Accepted Answer

To query external DNSBL servers and apply local overrides for known good or bad senders.. Antispam on Juniper SRX devices uses DNS-based Blackhole Lists (DNSBL) and local allow/block lists to determine if an email sender should be flagged as spam.

Answer

To inspect the payload of HTTPS encrypted webmail traffic for spam keywords.

Answer

To rewrite the headers of outgoing spam messages before they reach the mail server.

Answer

To quarantine infected executable attachments found inside incoming emails.

Question 2

You are configuring a UTM policy on a Juniper SRX firewall that includes antivirus, web filtering, and antispam profiles. To apply these UTM services to traffic, where must the UTM policy profile be explicitly attached in the Junos configuration?

Accepted Answer

Under the [edit security policies from-zone to-zone policy then] hierarchy.. UTM policies in Junos OS are bound directly to security policies using the 'utm-policy ' statement within the security policy rule.

Answer

Under the [edit security zones security-zone <zone> utm-profile] hierarchy.

Answer

Under the [edit security policies from-zone to-zone policy match] hierarchy.

Answer

Under the [edit interfaces unit <0> family inet utm] hierarchy.

Question 3

An administrator configures Unified Threat Management (UTM) antivirus inspection on an SRX device using the Junos Express antivirus engine. During high-traffic periods, users report that large file downloads are failing or timing out. Which CLI command or configuration adjustment is most appropriate to resolve this issue by increasing the maximum file size limit inspected by the antivirus engine?

Accepted Answer

set security utm feature-profile antivirus profile default http-profile maximum-file-size <size>. The antivirus engine on SRX devices has configurable size limits for stream inspection. Modifying the maximum file size under the UTM antivirus profile prevents timeouts or drops on large files.

Answer

set security utm default-profile antivirus max-buffer-size <size>

Answer

set security flow tcp-mss <size>

Answer

set security utm engine stream-scanning max-object-size <size>

Question 4

An enterprise network uses Juniper SRX Series devices running Junos OS with Integrated Web Filtering. Due to privacy regulations, the administrator needs to ensure that specific sensitive URLs are not logged by the cloud rating server or the local SRX log. Which CLI parameter should be adjusted within the web-filtering profile?

Accepted Answer

set security utm feature-profile web-filtering profile <name> no-log. Web filtering profiles allow configuring logging options, including disabling URL logging to maintain user privacy.

Answer

set security log mode stream-disable

Answer

set security utm feature-profile web-filtering profile custom-block-message

Answer

set security utm feature-profile web-filtering profile <name> disable-cloud-logging

Question 5

You are troubleshooting a web filtering policy on an SRX Series firewall configured for Integrated Web Filtering. Users report that a specific educational website is being blocked under the 'Finance' category. Where should you configure a custom exemption or local override to permit access to this specific URL without changing the global category assignment?

Accepted Answer

Configure a custom URL category and assign a permit action within the UTM policy profile.. Custom local overrides for web filtering URLs on SRX devices are configured under the [edit security UTM custom-objects url-pattern] and referenced in the custom-url-category.

Answer

Modify the Junos global bypass list under [edit system services web-management].

Answer

Add the URL to the application firewall (AppID) custom application definition.

Answer

Configure a security policy source NAT rule to bypass the UTM profile for that specific IP.

Question 6

An administrator needs to block all users from downloading executable files (.exe and .msi) via HTTP, regardless of the website category. Which UTM feature should be utilized to achieve this efficiently?

Accepted Answer

Content Filtering. Content filtering allows blocking specific file extensions or MIME types across HTTP/FTP sessions.

Answer

AppSecure AppID

Answer

Antivirus

Answer

Integrated Web Filtering

Question 7

An administrator notices that web filtering queries are failing because the SRX device cannot reach the cloud rating server over the internet. Which command can be used to troubleshoot connectivity to the cloud rating server from the Junos CLI?

Accepted Answer

show security utm web-filtering status. The 'show security utm web-filtering statistics' or connection debugging commands help verify cloud reachability, while ping/traceroute commands test basic network paths.

Answer

traceroute utm-rating-engine

Answer

ping security utm cloud-server

Answer

test utm cloud-connectivity

Question 8

Which THREE parameters can be defined within a Content Filtering profile on a Juniper SRX device to restrict file transfers? (Choose three.)

Accepted Answer

File extension block list. On a Juniper SRX Content Filtering profile, the file-transfer restriction parameters are the file extension block list (A), which blocks files by their extension such as .exe or .zip; the MIME type block list (C), which blocks files based on their declared content type such as application/x-msdownload; and custom block text strings (E), which block files containing specified text patterns. These three are the actual configurable elements under the content-filtering profile used to inspect and restrict file transfers. DNSBL server IP addresses (B) belong to antispam/UAC configuration, not content filtering, and URL block patterns (D) are part of URL filtering (Web filtering) profiles, so neither restricts file transfers within a Content Filtering profile.

Answer

DNSBL server IP addresses

Answer

URL block patterns

Question 9

Which TWO protocols are typically inspected by the Content Filtering feature on Juniper SRX Series firewalls? (Choose two.)

Accepted Answer

HTTP. The Content Filtering feature on Juniper SRX Series firewalls is a UTM component that examines application-layer traffic to block or permit access based on categories or URL patterns, and it is designed to inspect HTTP (option A) because web browsing is the primary vector for content-based filtering, using the HTTP protocol's request/response structure to match URLs and content categories. It also inspects FTP (option E), since FTP is a supported application protocol for content filtering in Junos UTM, allowing the firewall to apply filtering to file transfers over FTP sessions. SNMP (option B) is a management protocol used for monitoring and is not inspected by Content Filtering, DNS (option C) is handled by other security features such as DNS filtering or ALGs rather than content filtering, and ICMP (option D) is a network-layer control protocol that carries no application content for the Content Filtering engine to examine.

Answer

SNMP

Answer

DNS

Answer

ICMP

Question 10

An administrator has configured Web Filtering, but users are complaining that uncategorized websites are currently being blocked by default. Which command allows setting the action for uncategorized websites to 'permit' instead of 'block'?

Accepted Answer

set security utm feature-profile web-filtering profile <name> default-action permit. Integrated Web Filtering profiles on SRX allow defining fallback or default actions for URLs that do not exist in the cloud database.

Answer

set security utm feature-profile web-filtering profile <name> fallback-action allow

Answer

set security utm feature-profile web-filtering profile <name> uncategorized permit

Answer

set security utm policy-profile default-action permit