JNCIA-SEC Hard Questions — 25 Difficult Questions

Question 1

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool is exhausted, the SRX cannot allocate a new source port for a new session. Since NAT is a mandatory step in the first path packet processing for that policy, the session creation fails and the packet is dropped. The 'show security nat source pool' command would show the pool's utilization at 100%, confirming resource exhaustion.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 2

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

Accepted Answer

Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.. In Juniper SRX source NAT, rules within a rule-set are evaluated top-down and the first match wins, so a broad or restrictive rule placed above a more specific rule will shadow it. The fix is to order rules from most specific to least specific, or to split rules into separate rule-sets per zone so that Zone A's restrictive rules cannot interfere with Zone B's traffic. This restores correct pool selection and prevents the session drops Zone B is experiencing.

Answer

Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

Answer

Enable global zone-bypass mode for all source NAT pools.

Answer

Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

Question 3

An administrator is troubleshooting a vSRX deployment where packet forwarding performance is severely degraded. They suspect that the virtual interfaces are not utilizing direct memory access or optimized packet processing drivers. Which virtualization technology integration is critical for optimal vSRX performance?

Accepted Answer

SR-IOV or DPDK integration. SRIOV (Single Root I/O Virtualization) or DPDK (Data Plane Development Kit) is essential for high-performance virtual packet processing in vSRX deployments.

Answer

Virtual machine snapshot scheduling

Answer

SNMP v3 trap forwarding

Answer

RADIUS accounting synchronization

Question 4

An administrator configures a security policy with source address set 'Internal-Subnets', destination address 'Any', and application 'junos-ftp'. During testing, active FTP data connections (PASV mode) are failing. What security policy consideration is most relevant to fixing this issue?

Accepted Answer

The FTP Application Layer Gateway (ALG) must be enabled to dynamically open security sessions for data channels.. FTP uses dynamically negotiated data ports, requiring the Junos ALG (Application Layer Gateway) for FTP to be active so security policies dynamically permit the data channel.

Answer

The security policy action must be changed from 'permit' to 'allow-pasv'.

Answer

FTP must be replaced with SFTP because security policies cannot support stateful FTP parsing.

Answer

A separate security policy must be created allowing traffic from untrust back to trust for port 20.

Question 5

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.

Question 6

Which THREE parameters can be configured within a UTM policy profile on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

Antispam profile reference. A UTM policy profile on a Juniper SRX is essentially a container that binds together the various content-security profiles applied to traffic, so option B (Antispam profile reference) is correct because the UTM policy specifies which antispam profile to use for matching traffic. Option D (Antivirus profile reference) is correct because the UTM policy likewise references an antivirus profile to scan sessions for malware. Option E (Web-filtering profile reference) is correct because the UTM policy also references a web-filtering (URL filtering) profile to categorize and block or permit web content. Options A and C are incorrect: IPsec VPN IKE gateway settings are configured under the VPN/IKE hierarchy, not inside a UTM policy, and BGP routing protocol parameters belong to routing-options/protocols configuration, which is unrelated to UTM content security.

Answer

IPsec VPNike gateway settings

Answer

BGP routing protocol parameters

Question 7

An administrator needs to troubleshoot an intermittent application failure across an SRX Series firewall. They decide to use security flow traceoptions with a specific match condition for the client and server IP addresses. Where are the resulting trace files saved by default on the SRX Series device?

Accepted Answer

/var/log/. By default, Junos trace files are stored in the /var/log/ directory.

Answer

/var/tmp/trace/

Answer

/var/db/security/logs/

Answer

/config/logging/

Question 8

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

Accepted Answer

Custom applications can include inactivity timeout settings.. Custom applications allow specifying protocol, source ports, and destination ports for policy matching.

Answer

Custom applications automatically generate Application Layer Gateways for proprietary protocols without manual configuration.

Answer

Custom applications are restricted to global policies only and cannot be used in zone-to-zone policies.

Answer

Custom applications can overwrite built-in predefined Junos applications if named identically.

Question 9

An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?

Accepted Answer

It detects and blocks ICMP timestamp request packets that could be used for reconnaissance or flooding.. The icmp timestamp SCREEN option protects against ICMP timestamp flood or manipulation attacks by monitoring or blocking ICMP timestamp request and reply packets.

Answer

It timestamps every transit packet passing through the security zone for latency analysis.

Answer

It drops all ICMP packets that have invalid timestamp header fields.

Answer

It synchronizes the SRX system clock using ICMP timestamp replies from trusted gateways.

Question 10

An administrator is configuring a chassis cluster on two SRX Series devices. Which THREE requirements must be met to ensure proper cluster formation and stability? (Choose three)

Accepted Answer

Both devices must be the exact same SRX hardware model and run the same Junos OS version.. Option B is correct because a chassis cluster requires identical SRX hardware models and matching Junos OS versions so that the control and fabric links, redundancy groups, and failover logic operate consistently between the two nodes. Option C is correct because each node must have a unique node ID (Node 0 and Node 1) assigned, which is essential for the cluster to identify members, form redundancy groups, and manage failover correctly. Option D is correct because dedicated fabric and control links (fab0/fab1) must be physically connected between the nodes to carry cluster control traffic, heartbeats, and fabric forwarding, which are required for proper cluster formation and stability. Option A is not required because cluster control ports are internal links between the two SRX devices, not connections to an external public internet switch. Option E is incorrect because running different Junos OS major versions is unsupported and would prevent stable cluster formation, not prevent split-brain.

Answer

Cluster control ports must connect to an external public internet switch.

Answer

Both devices must have different Junos OS major versions to prevent split-brain.

Question 11

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Accepted Answer

Existing active sessions remain open until they naturally expire or idle out, but new sessions are blocked.. Schedulers in Junos security policies control session creation; existing active sessions are not automatically terminated when the schedule expires unless specifically configured or aged out.

Answer

The device reboots to clear the session table and re-evaluate all rules.

Answer

Existing sessions are immediately converted to 'reject' action state and send ICMP unreachable messages.

Answer

Existing active sessions are immediately terminated the moment the schedule window closes.

Question 12

Which TWO factors must be considered when designing security policies that incorporate AppID (Application Identification)? (Choose two.)

Accepted Answer

If AppID cannot identify an application, it falls back to the underlying port-based protocol definition if configured.. Option B is correct because AppID performs deep packet inspection to identify applications, but when it cannot positively identify the application, it falls back to the underlying port-based protocol definition (for example, TCP/80 or TCP/443) if one is configured, so policy design must account for this fallback behavior. Option C is correct because AppID classification is not always instantaneous; some applications require multiple packets or a full session handshake before the signature matches, meaning the first few packets may be classified as unknown or as the underlying protocol until identification completes. Option A is incorrect because AppID profiles are configured under the [edit security application] or application-related security hierarchies, not under [edit security utm], which is used for UTM features such as antivirus, antispam, and web filtering. Option D is incorrect because AppID can be referenced in both global and zone-based security policies, not exclusively in global policies. Option E is incorrect because AppID does not bypass stateful inspection for encrypted payloads; encrypted traffic that cannot be decrypted is typically identified by other means (such as server name indication or port), and stateful inspection still applies.

Answer

AppID profiles must be configured under the [edit security utm] hierarchy.

Answer

AppID is exclusively available for global security policies and cannot be used in zone-based policies.

Answer

AppID policies automatically bypass stateful inspection for encrypted payloads.

Question 13

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

Accepted Answer

The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.. If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Answer

The source zone does not have host-inbound-traffic enabled for UDP.

Answer

UDP traffic cannot be matched by security policies and requires stateless filters.

Answer

Global policies always block custom applications by default.

Question 14

An administrator is troubleshooting high CPU utilization on the Routing Engine of an enterprise SRX Series device. They suspect a runaway routing protocol or management process. Which command displays the top processes consuming CPU resources on the Routing Engine?

Accepted Answer

show system processes summary (or 'show system processes extensive'). The command 'show system processes extensive' or similar shell commands display CPU consumption by individual system processes.

Answer

show security spc processes

Answer

show kernel cpu-usage

Answer

show chassis cpu-processes

Question 15

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

Accepted Answer

Configure NTP on the SRX device to synchronize time with a reliable time server.. The recommended best practice for ensuring security policy schedules work correctly is to configure NTP on the SRX device so its clock is synchronized with a reliable time source. Accurate, synchronized time is essential because schedule-based policies rely on the device's local clock, and drift or time zone mismatches can cause schedules to activate at the wrong times.

Answer

Manually restart the flow processing daemon (flowd) after every time zone change.

Answer

Convert all schedule parameters in the policy configuration to use absolute epoch timestamps.

Answer

Disable stateful inspection so that schedule checks occur on every individual packet.

Question 16

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Accepted Answer

No, security zones are tied to interfaces, and interfaces belong to a single routing instance.. Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.

Answer

Yes, provided the virtual routers are interconnected by internal tunnels.

Answer

No, unless logical systems (Logical Systems) are configured on the SRX device.

Answer

Yes, by defining the security zone at the global routing instance level.

Question 17

You suspect that session timeouts are too aggressive for a specific long-lived TCP application. Which command allows you to check current TCP timeout configurations on an SRX?

Accepted Answer

show security flow timeout. 'show security flow timeout' displays the current timeout values for TCP, UDP, ICMP, and other session types on the SRX. It is the direct command to verify whether TCP timeouts are too aggressive for a long-lived application.

Answer

show security session timeout-status

Answer

show firewall timeout-settings

Answer

show system connection-timeout

Question 18

An administrator configures traceoptions for security policies. Where can they find the resulting log output file?

Accepted Answer

/var/log/. Traceoptions output files are written to /var/log/ by default on Junos devices. When you configure traceoptions under [edit security policies traceoptions], the 'file' statement specifies a filename that is created in /var/log/, and the resulting trace data is written there. Administrators retrieve it with 'show log <filename>' from the CLI.

Answer

/config/trace/

Answer

/tmp/

Answer

/var/db/

Question 19

When configuring Proxy ARP for Static NAT or Destination NAT on an SRX Series device, which THREE operational or configuration practices must be considered? (Choose three)

Accepted Answer

Proxy ARP must be enabled on the external interface facing the upstream router.. Option A is correct because proxy ARP must be enabled on the external (untrusted) interface that faces the upstream router, so the SRX can answer ARP requests for the NAT public IP addresses it owns on behalf of those addresses. Option B is correct because the public IPs used in static or destination NAT must fall within the subnet configured on the external interface; otherwise the upstream router would not ARP for them on that link and proxy ARP could not respond. Option D is correct because when the SRX answers ARP for the NAT public addresses, the upstream router can reach those addresses directly over the connected subnet, removing the need for a static route pointing to the SRX for those public IPs. Option C is wrong because proxy ARP operates at Layer 2/ARP and does not perform port address translation or any ICMP PAT function. Option E is wrong because proxy ARP is relevant to external reachability of NAT addresses, not to internal trusted clients accessing local servers, which relies on normal routing and security policies.

Answer

Proxy ARP automatically performs port address translation for ICMP packets.

Answer

Proxy ARP is required for internal trusted interface clients accessing local servers.

Question 20

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

Accepted Answer

[edit security screen traceoptions]. Screen traceoptions are configured under the [edit security screen traceoptions] hierarchy.

Answer

[edit system traceoptions screen]

Answer

[edit security flow traceoptions screen]

Answer

[edit security zones security-zone screen traceoptions]