JNCIA-SEC Junos OS Security Objects — 20 Questions

Question 1

You want to configure an address book entry that matches all IP addresses within the 192.168.10.0/24 subnet except for 192.168.10.50. How can this be accomplished in Junos OS address configuration?

Accepted Answer

Use the 'exclude' statement within the address book configuration for that specific prefix.. Junos address book entries support excluding specific IP addresses using the 'exclude' statement within an address configuration.

Answer

Create an address set containing 192.168.10.0/24 and negate 192.168.10.50 using policy match negation.

Answer

Exclusions are not supported in Junos address books; you must use separate address objects.

Answer

Create two separate subnets: 192.168.10.0/25 and 192.168.10.128/25.

Question 2

You need to define an address book entry that references a range of IP addresses from 10.1.1.100 to 10.1.1.200. What is the correct configuration syntax under the security address-book hierarchy?

Accepted Answer

address range-1 10.1.1.100-10.1.1.200;. Junos address book syntax for an IP range uses the 'range-address' statement.

Answer

address range-name 10.1.1.100 to 10.1.1.200;

Answer

address range-pool 10.1.1.100-10.1.1.200;

Answer

address range-1 10.1.1.100 to 10.1.1.200;

Question 3

Which statement accurately describes a security zone in Junos OS?

Accepted Answer

A security zone is a logical grouping of interfaces used to define trust boundaries.. Security zones are logical groupings of interfaces that share similar security requirements and policies.

Answer

Interfaces belonging to different security zones can communicate without a security policy if they are on the same VLAN.

Answer

A security zone is required to contain at least one interface before policies can reference it.

Answer

Interfaces can belong to multiple security zones simultaneously.

Question 4

Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?

Accepted Answer

show security alg status. The 'show security alg status' command displays the operational status of all ALGs running on the Junos device.

Answer

show security flow status

Answer

show security zones functional-zone

Answer

show system applications

Question 5

You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?

Accepted Answer

Address set. An address set allows grouping multiple individual addresses and ranges into a single logical object.

Answer

Security group

Answer

Address book

Answer

Prefix list

Question 6

You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?

Accepted Answer

tcp syn-flood alarm-threshold <value>. SYN flood protection is managed using the 'tcp syn-flood' parameter inside a SCREEN option profile.

Answer

icmp flood limit <value>

Answer

ip spoofing check

Answer

tcp-syn-flood attack-threshold

Question 7

An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?

Accepted Answer

The zone-specific address book entry takes precedence.. Zone-specific address books take precedence over global address books when resolving address names for policies originating from that specific zone.

Answer

The global address book entry takes precedence.

Answer

Both entries are merged into a combined IP range.

Answer

Junos generates a compilation error due to duplicate names.

Question 8

An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?

Accepted Answer

[edit security alg ftp disable]. ALGs are controlled under the [edit security alg] hierarchy where specific protocol helpers can be disabled or modified.

Answer

[edit security flow alg ftp mode transparent]

Answer

[edit security zones security-zone untrust alg ftp]

Answer

[edit applications application junos-ftp alg none]

Question 9

You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?

Accepted Answer

[edit security zones security-zone screen ]. SCREEN options are applied under the security zones hierarchy to protect interfaces assigned to that zone.

Answer

[edit security policies from-zone to-zone screen]

Answer

[edit interfaces screen ]

Answer

[edit security screen id spoofing]

Question 10

An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?

Accepted Answer

Functional zone. A functional zone, specifically the management zone, is used for traffic destined for the routing engine via the management interface.

Answer

Untrusted zone

Answer

Transit zone

Answer

Security zone

Question 11

Which statement is true regarding Junos OS address books?

Accepted Answer

Address books can be defined globally or per security zone.. Address books can be defined globally at the configuration root or locally within a specific security zone.

Answer

An address book must contain at least one address set.

Answer

Address books are mandatory for defining security policies even if IP prefixes are used directly.

Answer

Address books can only be defined globally.

Question 12

When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?

Accepted Answer

It matches TCP traffic destined to port 8080 with a source port falling within 1024-65535.. Custom applications define matching criteria based on IP protocol, source port, and destination port ranges.

Answer

It is automatically converted to a predefined junos-http application by the SRX device.

Answer

It requires inspection via an ALG because custom ports are used for HTTP traffic.

Answer

It matches any packet destined to port 8080 regardless of source port.

Question 13

An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?

Accepted Answer

source-route. The source route option in SCREEN profiles detects and blocks packets containing IP source routing headers.

Answer

ip spoofing

Answer

land attack

Answer

tear-drop

Question 14

Which command allows you to view the configured security zones and their assigned interfaces in Junos OS?

Accepted Answer

show security zones. The 'show security zones' operational command displays all security zones and their associated interfaces.

Answer

show security policies zones

Answer

show configuration security zones

Answer

show interfaces security

Question 15

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.

Question 16

An administrator configures a security zone and enables the 'tcp-rst' SCREEN option. What is the primary purpose of this SCREEN option?

Accepted Answer

It protects against TCP reset flood attacks by setting threshold limits on incoming RST packets.. The tcp-rst option protects against forged TCP RST packets that could prematurely terminate active connections.

Answer

It forces the SRX to send TCP resets for all blocked session attempts instead of dropping silently.

Answer

It inspects the sequence number of TCP RST packets to ensure they fall within the valid window.

Answer

It drops all TCP packets with the RST flag set to prevent unauthorized connection teardowns.

Question 17

Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?

Accepted Answer

junos-host. The Junos 'junos-host' functional zone handles traffic destined for or originated by the routing engine.

Answer

junos-global

Answer

junos-mgmt

Answer

junos-internal

Question 18

You have configured a custom application object named 'CUSTOM-APP' matching TCP port 9090. When you attempt to commit the configuration, Junos returns an error stating that the application conflicts with a predefined Junos application. How should you resolve this?

Accepted Answer

Rename your custom application to avoid naming conflicts with reserved Junos system applications.. Predefined Junos applications (prefixed with junos-) cannot be overwritten, but custom applications should be given unique names that do not conflict. Alternatively, modifying the existing custom application name resolves the conflict.

Answer

Change the protocol type from TCP to UDP to bypass the name collision check.

Answer

Delete the system application using the 'delete applications junos-custom' command.

Answer

Use the 'override' keyword in the application definition.

Question 19

An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?

Accepted Answer

show security screen statistics. The 'show security screen statistics' command displays hit counts and drop counters for active screen options.

Answer

show security flow drop

Answer

show security zones statistics

Answer

show system screen violations

Question 20

Which statement best describes an Application Layer Gateway (ALG) in Junos OS?

Accepted Answer

An ALG inspects application traffic and dynamically opens data sessions for protocols that use multiple ports.. ALGs inspect application payloads, handle dynamic port negotiation, and assist the security flow module in tracking complex protocols.

Answer

An ALG is a functional zone used for isolating guest wireless traffic.

Answer

An ALG replaces the need for security policies on transit traffic.

Answer

An ALG is a hardware-based chip on SRX platforms used exclusively for IPsec encryption acceleration.