You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?
An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?
You want to configure an address book entry that matches all IP addresses within the 192.168.10.0/24 subnet except for 192.168.10.50. How can this be accomplished in Junos OS address configuration?
You have configured a custom application object named 'CUSTOM-APP' matching TCP port 9090. When you attempt to commit the configuration, Junos returns an error stating that the application conflicts with a predefined Junos application. How should you resolve this?
You need to define an address book entry that references a range of IP addresses from 10.1.1.100 to 10.1.1.200. What is the correct configuration syntax under the security address-book hierarchy?
You need to inspect traffic matching a proprietary application that uses dynamic TCP ports. You have written a custom application. What additional Junos security feature can be combined with custom applications to inspect deep packet content for non-standard ports?
An administrator creates a security zone and defines both a zone-specific address book and a global address book. The same address name exists in both address books with conflicting subnets. When a security policy references this address name from a different security zone, which address definition is selected?
You want to configure a security zone to automatically reject new TCP connections with a TCP RST packet when the zone's transit sessions exceed capacity or policies deny them. Where is this behavior configured?
An administrator configures an address set that includes another address set as a member (nested address sets). What is the maximum nesting depth supported for address sets in Junos OS?
An administrator configures a security zone and enables traceoptions for zone management. What is the correct configuration hierarchy to enable traceoptions for security zones?
You want to create a security zone and explicitly block all traffic between interfaces assigned to that same zone (intra-zone traffic). Which configuration statement accomplishes this?
You are troubleshooting an issue where an ALG is altering port numbers during FTP sessions, causing authentication failures with an application-layer proxy. Which command shows active ALG sessions and their port translations?
You need to configure a custom application that matches UDP traffic on a range of destination ports from 5000 to 5010. How should you specify this range in the application configuration?
You are troubleshooting an issue where an application defined with a specific timeout is timing out prematurely during periods of inactivity. Where would you verify or adjust the flow session timeout globally in Junos OS?
You are configuring an SRX Series device with two security zones: trust and untrust. You want to verify that the ge-0/0/1 interface has been correctly assigned to the untrust zone. Which command should you use?
A security administrator needs to configure a new security zone on an SRX Series device that will host a web server accessible from the Internet. The web server must be reachable on TCP port 80 and 443 from any external source, but all other traffic to the server must be blocked. The administrator wants to use the most specific Junos OS security object to match these traffic flows. Which configuration element should be used to define the permitted traffic?
An administrator is configuring a security zone on an SRX Series device and needs to apply a SCREEN profile that will protect against TCP SYN flood attacks. The administrator wants the device to monitor the rate of SYN packets and take action when the threshold is exceeded. Which SCREEN option should be included in the profile to accomplish this?
An administrator is configuring an SRX Series device and needs to create a custom application that matches DNS traffic on TCP port 53, but only when the client initiates the connection to the server. The application must be referenced in a security policy. Which Junos OS configuration element is required to accomplish this task?
An administrator is troubleshooting a new security policy on an SRX Series device. The policy is intended to permit HTTP traffic from the TRUST zone to the UNTRUST zone for a specific server at 10.1.1.100. The address book entry for the server is defined in the global address book as SERVER-1 with IP 10.1.1.100/32. The policy is configured with source-address any and destination-address SERVER-1. However, traffic is being denied. Which action should the administrator take to resolve the issue?
An administrator is configuring a new SRX Series device and wants to create a security zone that will be used for a DMZ network. The zone must be able to host both IPv4 and IPv6 addresses and must be able to apply different screen options than the trust zone. Which configuration step is required?
A security administrator is troubleshooting why a custom application object that matches UDP port 500 is not being matched by a security policy. The application is defined as 'application my-ike { protocol udp; destination-port 500; }'. The security policy is configured with source-address any, destination-address any, application my-ike, and action permit. However, traffic to UDP port 500 is being denied. Which configuration change is most likely to resolve the issue?
You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?
An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?
You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?
An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?
When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?
An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?
You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?
Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?
An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?
You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?
An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?
An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?
An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?
You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?
You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?
An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?
An administrator configures a security zone and enables traceoptions for security flow. Where are these traceoptions configured in the Junos OS hierarchy?
Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?
You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?
You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?
You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?
You are configuring an SRX Series device and want to ensure that all traffic entering the untrusted zone is checked for LAND attacks. Which configuration steps are required?
An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?
An administrator configures an address book containing an IPv6 address prefix. How does Junos OS handle IPv6 addresses in security policies compared to IPv4?
An administrator configures a security zone and applies a SCREEN profile that includes 'limit-session source-ip'. What is the function of this specific SCREEN option?
An administrator configures a security zone and enables the 'udp-flood' SCREEN option with a specified threshold. How does Junos measure UDP flood attacks for this option?
An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?
You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?
An administrator needs to create a new security zone named 'dmz' on an SRX Series device and assign the interface ge-0/0/2 to it. Which configuration mode command accomplishes this?
You are configuring a custom application named 'my-app' on an SRX Series device. You need to define it to match TCP traffic destined for port 8080 and also match UDP traffic on port 53. Which configuration correctly defines this application?
An administrator wants to create an address book entry for a subnet 192.168.1.0/24 and another for a single host 192.168.1.10. Both should be available globally across all zones. Which configuration achieves this?
An administrator needs to create a custom application in Junos OS that matches TCP traffic destined for port 8443 and terminates the session when the server sends a TCP RST. The application should not attempt to match any payload content. Which configuration statement set completes this custom application definition?
A network administrator is configuring a new security zone on an SRX Series device and wants to assign a logical interface to it. The interface is already configured with an IP address and is currently unassigned to any zone. Which configuration statement correctly assigns the interface ge-0/0/1.0 to the zone named TRUST?
A network engineer is configuring a custom application on an SRX Series device to match a proprietary protocol that uses UDP port 5000 and requires a timeout of 300 seconds. The engineer also needs to ensure that the application can be used in a security policy. Which configuration statement is required to define this custom application?
An administrator is configuring an address book entry in a security zone on an SRX Series device. The administrator needs to create an address book entry that represents a specific host with IP address 192.168.1.100 and a network with prefix 10.0.0.0/24. Which TWO address book object types can be used to accomplish this? (Choose two.)
An administrator wants to verify which security zones are currently configured on an SRX Series device and which interfaces are assigned to each zone. Which operational mode command provides this information in a concise, tabular format?
An administrator is defining a custom application in Junos OS to match a proprietary protocol that uses both TCP and UDP on different ports. The application must be referenced in a security policy. Which TWO statements are true about custom application definitions in Junos OS? (Choose two.)
A network engineer is configuring an SRX Series device with multiple security zones. The engineer wants to ensure that traffic from the trust zone to the untrust zone is inspected by a specific application firewall rule that matches HTTP traffic on port 8080. However, the engineer notices that the traffic is not being inspected. Which action should be taken to resolve this issue?
An administrator is configuring a custom application set on an SRX Series device to group multiple applications for use in a security policy. The application set will include both predefined and custom applications. Which two statements are true about application sets in Junos OS? (Choose two.)