JNCIA-SEC Junos OS Security Objects Practice Test 3 — 15 Questions

Question 1

Which statement accurately describes a security zone in Junos OS?

Accepted Answer

A security zone is a logical grouping of interfaces used to define trust boundaries.. Security zones are logical groupings of interfaces that share similar security requirements and policies.

Answer

Interfaces belonging to different security zones can communicate without a security policy if they are on the same VLAN.

Answer

A security zone is required to contain at least one interface before policies can reference it.

Answer

Interfaces can belong to multiple security zones simultaneously.

Question 2

Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?

Accepted Answer

show security alg status. The 'show security alg status' command displays the operational status of all ALGs running on the Junos device.

Answer

show security flow status

Answer

show security zones functional-zone

Answer

show system applications

Question 3

You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?

Accepted Answer

Address set. An address set allows grouping multiple individual addresses and ranges into a single logical object.

Answer

Security group

Answer

Address book

Answer

Prefix list

Question 4

An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?

Accepted Answer

The zone-specific address book entry takes precedence.. Zone-specific address books take precedence over global address books when resolving address names for policies originating from that specific zone.

Answer

The global address book entry takes precedence.

Answer

Both entries are merged into a combined IP range.

Answer

Junos generates a compilation error due to duplicate names.

Question 5

You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?

Accepted Answer

[edit security zones security-zone screen ]. SCREEN options are applied under the security zones hierarchy to protect interfaces assigned to that zone.

Answer

[edit security policies from-zone to-zone screen]

Answer

[edit interfaces screen ]

Answer

[edit security screen id spoofing]

Question 6

An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?

Accepted Answer

Functional zone. A functional zone, specifically the management zone, is used for traffic destined for the routing engine via the management interface.

Answer

Untrusted zone

Answer

Transit zone

Answer

Security zone

Question 7

Which statement is true regarding Junos OS address books?

Accepted Answer

Address books can be defined globally or per security zone.. Address books can be defined globally at the configuration root or locally within a specific security zone.

Answer

An address book must contain at least one address set.

Answer

Address books are mandatory for defining security policies even if IP prefixes are used directly.

Answer

Address books can only be defined globally.

Question 8

When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?

Accepted Answer

It matches TCP traffic destined to port 8080 with a source port falling within 1024-65535.. Custom applications define matching criteria based on IP protocol, source port, and destination port ranges.

Answer

It is automatically converted to a predefined junos-http application by the SRX device.

Answer

It requires inspection via an ALG because custom ports are used for HTTP traffic.

Answer

It matches any packet destined to port 8080 regardless of source port.

Question 9

An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?

Accepted Answer

source-route. The source route option in SCREEN profiles detects and blocks packets containing IP source routing headers.

Answer

ip spoofing

Answer

land attack

Answer

tear-drop

Question 10

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.

Question 11

Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?

Accepted Answer

junos-host. The Junos 'junos-host' functional zone handles traffic destined for or originated by the routing engine.

Answer

junos-global

Answer

junos-mgmt

Answer

junos-internal

Question 12

An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?

Accepted Answer

show security screen statistics. The 'show security screen statistics' command displays hit counts and drop counters for active screen options.

Answer

show security flow drop

Answer

show security zones statistics

Answer

show system screen violations

Question 13

Which statement best describes an Application Layer Gateway (ALG) in Junos OS?

Accepted Answer

An ALG inspects application traffic and dynamically opens data sessions for protocols that use multiple ports.. ALGs inspect application payloads, handle dynamic port negotiation, and assist the security flow module in tracking complex protocols.

Answer

An ALG is a functional zone used for isolating guest wireless traffic.

Answer

An ALG replaces the need for security policies on transit traffic.

Answer

An ALG is a hardware-based chip on SRX platforms used exclusively for IPsec encryption acceleration.

Question 14

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

Accepted Answer

No, security zones are tied to interfaces, and interfaces belong to a single routing instance.. Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.

Answer

Yes, provided the virtual routers are interconnected by internal tunnels.

Answer

No, unless logical systems (Logical Systems) are configured on the SRX device.

Answer

Yes, by defining the security zone at the global routing instance level.

Question 15

Which command is used to verify the configuration of address books in Junos OS?

Accepted Answer

show configuration security address-book. The 'show configuration security address-book' command displays the configured address books in configuration mode.

Answer

show system address-books

Answer

show security address-book operational

Answer

show security flow address-book