JNCIA-SEC Junos OS Security Objects Practice Test 2 — 15 Questions

Question 1

You are troubleshooting an issue where an ALG is altering port numbers during FTP sessions, causing authentication failures with an application-layer proxy. Which command shows active ALG sessions and their port translations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show security alg sessions. The 'show security alg sessions' command displays active sessions managed by ALGs.

Answer

show alg status translations

Answer

show system alg translation-table

Answer

show security flow session alg

Question 2

Which Junos OS command displays the configuration of all security zones?

Accepted Answer

show configuration security zones. The 'show configuration security zones' command displays the zone configuration.

Answer

show system security-zones

Answer

show configuration firewall zones

Answer

show security zones configuration

Question 3

You need to configure a custom application that matches UDP traffic on a range of destination ports from 5000 to 5010. How should you specify this range in the application configuration?

Accepted Answer

set applications application CUSTOM-UDP protocol udp destination-port 5000-5010. Custom application port ranges are configured using destination-port with a hyphenated range.

Answer

set firewall filter CUSTOM term 1 then port-range 5000-5010

Answer

set applications application CUSTOM-UDP udp port range 5000 to 5010

Answer

set security applications CUSTOM-UDP proto udp ports 5000-5010

Question 4

Which command is used to display the currently configured global address books in Junos OS?

Accepted Answer

show configuration security address-book. 'show configuration security address-book' displays the address book configuration from the candidate configuration, which is where global address books are defined in Junos. It shows the configured entries, not operational state.

Answer

show security address-book operational

Answer

show security flow address-books

Answer

show system address-books

Question 5

You are troubleshooting an issue where an ALG is altering port numbers during FTP sessions, causing authentication failures with an application-layer proxy. Which command shows active ALG sessions and their port translations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

[edit security flow tcp-session timeout <seconds>]. Global flow timeouts for protocols like TCP and UDP are configured under [edit security flow].

Answer

[edit security zones security-zone timeout]

Answer

[edit security flow timeout tcp intelligence]

Answer

[edit applications flow-timeout]

Question 6

Which TWO functional zones are built-in and available by default in Junos OS? (Choose two)

Accepted Answer

junos-host. Built-in functional zones include junos-host and junos-mgmt.

Answer

junos-guest-wireless

Answer

junos-dmz-zone

Answer

junos-untrusted-default

Question 7

Which TWO statements are accurate regarding the evaluation order of address books in Junos OS? (Choose two)

Accepted Answer

When evaluating a security policy, Junos checks zone-specific address books associated with the source zone before checking the global address book.. Option A is correct because Junos OS resolves address book entries by first consulting the zone-specific address book of the source zone, then the destination zone's book, and finally the global address book, so zone-specific entries take precedence during policy evaluation. Option E is correct because a name defined only in the global address book is globally scoped and can be referenced by security policies in any zone, since it is not overridden by a same-named zone-specific entry. Option B is wrong because Junos evaluates address books by inherent precedence (source zone, destination zone, global) without requiring manual priority numbering. Option C is wrong because both zone-specific and global address books can hold IPv4 and IPv6 addresses. Option D is wrong because global address books are consulted last, not first, so they do not override zone-specific entries.

Answer

Address book evaluation order requires manual priority numbering in the CLI.

Answer

Zone-specific address books can only contain IPv4 addresses, while global address books contain IPv6 addresses.

Answer

Global address books always override zone-specific address books regardless of traffic direction.

Question 8

Which TWO traffic types are typically handled by functional zones in Junos OS? (Choose two)

Accepted Answer

Traffic destined for or originating from the local routing engine (junos-host). Functional zones handle device self-traffic (junos-host) and out-of-band management traffic (junos-mgmt).

Answer

Layer 2 bridge domain broadcast traffic

Answer

IPsec VPN tunnel transit traffic

Answer

Transit traffic flowing between two customer VLANs

Question 9

You are configuring an SRX Series device with two security zones: trust and untrust. You want to verify that the ge-0/0/1 interface has been correctly assigned to the untrust zone. Which command should you use?

Accepted Answer

show configuration security zones. To verify interface-to-zone assignments, you must view the security zones configuration. The command 'show configuration security zones' displays the full zone configuration, including interface bindings. The other commands show operational status, policies, or interface statistics, but none provide the interface-to-zone mapping needed here.

Answer

show security policies

Answer

show security zones

Answer

show interfaces ge-0/0/1 terse

Question 10

A security administrator needs to configure a new security zone on an SRX Series device that will host a web server accessible from the Internet. The web server must be reachable on TCP port 80 and 443 from any external source, but all other traffic to the server must be blocked. The administrator wants to use the most specific Junos OS security object to match these traffic flows. Which configuration element should be used to define the permitted traffic?

Accepted Answer

A custom application-set that includes the predefined applications junos-http and junos-https.. An application-set is a Junos OS security object that groups multiple applications, allowing a security policy to reference them collectively. By including the predefined junos-http and junos-https applications, the administrator permits only TCP ports 80 and 443, which precisely matches the requirement. This approach is more specific and easier to manage than a port range or multiple separate policies, and it leverages built-in application definitions rather than stateless filters.

Answer

A firewall filter applied to the ingress interface that accepts TCP ports 80 and 443 and discards all other traffic.

Answer

A custom application with a destination-port range of 80-443 and protocol tcp.

Answer

A security policy that references the predefined application junos-http and a separate policy for junos-https.

Question 11

An administrator is configuring a security zone on an SRX Series device and needs to apply a SCREEN profile that will protect against TCP SYN flood attacks. The administrator wants the device to monitor the rate of SYN packets and take action when the threshold is exceeded. Which SCREEN option should be included in the profile to accomplish this?

Accepted Answer

syn-flood with a configured threshold. The syn-flood SCREEN option is specifically designed to detect and mitigate TCP SYN flood attacks by monitoring the rate of SYN packets. When the configured threshold is exceeded, the device can take action, such as dropping packets or activating SYN proxy. This provides the rate-based protection the administrator needs. Other SCREEN options may offer related protections but do not combine rate monitoring with threshold-based action for SYN floods.

Answer

syn-ack-ack-proxy

Answer

syn-flood

Answer

limit-session source-ip-based

Question 12

An administrator is configuring an SRX Series device and needs to create a custom application that matches DNS traffic on TCP port 53, but only when the client initiates the connection to the server. The application must be referenced in a security policy. Which Junos OS configuration element is required to accomplish this task?

Accepted Answer

application with protocol tcp, destination-port 53, and source-port 1024-65535 under the applications hierarchy. To match only client-initiated DNS over TCP, a custom application must specify the TCP protocol, destination port 53, and a source port range that excludes well-known ports. This ensures that only traffic from ephemeral source ports (clients) matches. The application can then be used in a security policy. Other options either lack the client-initiated condition or are unrelated to application definition.

Answer

security policy with a match condition on destination-address and destination-port 53

Answer

screen profile with the tcp-syn-fin option applied to the untrust zone

Answer

application-set that groups the predefined junos-dns-udp and junos-dns-tcp applications

Question 13

An administrator is troubleshooting a new security policy on an SRX Series device. The policy is intended to permit HTTP traffic from the TRUST zone to the UNTRUST zone for a specific server at 10.1.1.100. The address book entry for the server is defined in the global address book as SERVER-1 with IP 10.1.1.100/32. The policy is configured with source-address any and destination-address SERVER-1. However, traffic is being denied. Which action should the administrator take to resolve the issue?

Accepted Answer

Ensure that the security policy is placed in the correct zone context and that the destination-address is correctly referenced as SERVER-1.. Security policies in Junos OS are defined within a from-zone and to-zone context. If the policy is not in the correct zone pair or the address book entry is not correctly referenced, the traffic will not match and will be denied by the default deny action. The administrator should verify that the policy is under from-zone TRUST to-zone UNTRUST, that the destination-address is correctly set to SERVER-1, and that the action is permit. Global address book entries are available to all zones, so no attachment is needed.

Answer

Attach the global address book entry to the TRUST zone by using the attach command.

Answer

Add the server's IP address to the UNTRUST zone's address book and reference that entry in the policy.

Answer

Configure a static NAT rule to translate the server's IP address to a public address.

Question 14

An administrator is configuring a new SRX Series device and wants to create a security zone that will be used for a DMZ network. The zone must be able to host both IPv4 and IPv6 addresses and must be able to apply different screen options than the trust zone. Which configuration step is required?

Accepted Answer

Define the zone with the family inet and family inet6 address families, and assign interfaces with both IPv4 and IPv6 addresses.. A security zone in Junos OS can support both IPv4 and IPv6 if the interfaces assigned to it have both address families configured. The zone itself does not have an address family; it inherits from its interfaces. Therefore, defining interfaces with inet and inet6 addresses and assigning them to the zone is the correct step. Other options relate to management access, screen options, or monitoring, none of which enable dual-stack support.

Answer

Apply a screen profile to the zone that includes the ipv6-extension-header option to filter IPv6 traffic.

Answer

Create a security zone with the host-inbound-traffic system-services all command to allow all traffic.

Answer

Configure the zone with the application-tracking option to monitor both IPv4 and IPv6 applications.

Question 15

A security administrator is troubleshooting why a custom application object that matches UDP port 500 is not being matched by a security policy. The application is defined as 'application my-ike { protocol udp; destination-port 500; }'. The security policy is configured with source-address any, destination-address any, application my-ike, and action permit. However, traffic to UDP port 500 is being denied. Which configuration change is most likely to resolve the issue?

Accepted Answer

Ensure that the application is referenced in the security policy and that no earlier policy denies the traffic.. The custom application correctly matches UDP port 500. The most common reason for traffic being denied despite a permit policy is that an earlier policy in the policy set denies the traffic, or the application is not properly referenced. Security policies are processed top-down, so a deny policy above the permit policy would block the traffic. Ensuring the application is referenced and policy order is correct is the appropriate fix.

Answer

Modify the application to include the source-port 1024-65535 range to match client-initiated traffic.

Answer

Add the source-port 500 to the application definition.

Answer

Change the application to use the predefined junos-ike application instead of the custom application.