JNCIA-SEC Junos OS Security Objects Practice Test 4 — 15 Questions

Question 1

You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SIP Application Layer Gateway (ALG). SIP uses dynamic ports for RTP streams, requiring the SIP ALG to be active and operational.

Answer

SCREEN options with UDP flood protection

Answer

Global address book entry for RTP ports

Answer

TCP proxy enabled on the security zone

Question 2

An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?

Accepted Answer

Packets with both SYN and FIN flags set. The tcp-drop-synfin-set SCREEN option drops TCP packets that have both the SYN and FIN flags set simultaneously, which is an invalid state often used in scanning.

Answer

Packets where the SYN flag is set and the sequence number is zero

Answer

TCP packets with zero window size and FIN set

Answer

Packets with SYN and ACK flags set without an initial SYN

Question 3

Which statement is true regarding Junos OS predefined applications?

Accepted Answer

Predefined applications simplify security policy creation by grouping port and protocol definitions for common services.. Junos comes with many built-in application definitions (prefixed with junos-) that identify standard protocols and ports.

Answer

Predefined applications can be edited to change their port mappings.

Answer

Predefined applications override user-defined custom applications if names collide.

Answer

Predefined applications require manual updates via separate software downloads every week.

Question 4

Which command displays the configured security policies in Junos OS?

Accepted Answer

show security policies. The operational command 'show security policies' displays the currently active security policies.

Answer

show security zones policies

Answer

show firewall policies

Answer

show configuration policies

Question 5

An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?

Accepted Answer

SSH access is restricted only to the specific interface where the service was explicitly enabled, unless enabled at the zone level.. Host-inbound-traffic settings can be configured globally for the zone or overridden per interface. Allowing SSH on one interface does not automatically enable it on other interfaces unless configured at the zone level or explicitly enabled on those interfaces.

Answer

SSH traffic is dropped by security policies because host-inbound traffic bypasses security policies entirely.

Answer

SSH access is automatically permitted on all interfaces within that security zone.

Answer

SSH access is blocked on all interfaces because host-inbound traffic must be defined under the global zone level.

Question 6

Which type of Junos OS address book entry is available to all security zones on the device without needing to be redefined?

Accepted Answer

Global address book. A global address book entry is accessible by security policies across all zones on the SRX device.

Answer

Zone-specific address book

Answer

Functional address book

Answer

Interface address book

Question 7

An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?

Accepted Answer

Active FTP requires the FTP ALG to parse the PORT command and open a dynamic pinhole for the incoming data channel.. Active FTP requires the server to initiate a connection back to the client, which requires port negotiation via the FTP ALG and proper security policy traversal for the back-connection.

Answer

Active FTP is blocked entirely by Junos OS because it violates modern security best practices.

Answer

Screen options are misidentifying the active FTP data port as a port-scan attack.

Answer

The global address book lacks definitions for active FTP ports.

Question 8

You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?

Accepted Answer

Create a screen profile with ICMP flood parameters and apply that profile under the security zone configuration.. ICMP flood protection is configured inside a screen profile under [edit security screen], and that profile is then applied to the security zone.

Answer

Set [edit security zones security-zone trust screen icmp-flood threshold 1000] directly.

Answer

Enable ICMP inspection inside the junos-icmp application definition.

Answer

Apply ICMP flood options directly under the [edit security policies] hierarchy.

Question 9

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

Accepted Answer

Under the security zone host-inbound-traffic system-services icmp configuration.. ICMP echo request must be enabled under the host-inbound-traffic configuration for the specific security zone or interface.

Answer

Inside the junos-icmp application object definition.

Answer

Inside the global SCREEN option profile under ICMP flood settings.

Answer

Under the security policies between the untrust and trust zones.

Question 10

An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?

Accepted Answer

The configuration fails to commit because the address set contains a reference to a non-existent address object.. If an address object referenced within an address set is deleted from the address book, Junos retains the reference in the candidate configuration but will fail validation upon commit if dangling references are left unresolved, depending on the object type. Actually, Junos generates a commit error if an address set references a non-existent address object.

Answer

The address set automatically deletes the reference and commits successfully.

Answer

The SRX device ignores the missing address object and continues operating with the remaining two addresses.

Answer

The entire address book is automatically purged by the parser.

Question 11

An administrator configures a security zone and enables traceoptions for security flow. Where are these traceoptions configured in the Junos OS hierarchy?

Accepted Answer

[edit security flow traceoptions]. Flow traceoptions are configured under the [edit security flow traceoptions] hierarchy to troubleshoot session and flow processing.

Answer

[edit security zones security-zone trust traceoptions]

Answer

[edit firewall traceoptions]

Answer

[edit system traceoptions security-flow]

Question 12

Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?

Accepted Answer

SCREEN options. SCREEN options provide attack detection and mitigation for layer 3 and layer 4 DoS attacks.

Answer

Firewall filter policers

Answer

IPsec VPN tunnels

Answer

Application Layer Gateways (ALGs)

Question 13

You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?

Accepted Answer

set applications application MY-HTTP protocol tcp destination-port 8080. Custom applications define protocol and destination port under [edit applications application].

Answer

set security zones application-override MY-HTTP port 8080

Answer

set firewall family inet filter MY-FILTER term 1 then port 8080

Answer

set security applications MY-HTTP tcp port 8080

Question 14

You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?

Accepted Answer

snmp. SNMP is a system service in Junos host-inbound-traffic configuration.

Answer

management-service snmp

Answer

protocols snmp-server

Answer

routing-protocols snmp

Question 15

Which command is used to display active security sessions currently tracked by the Junos OS flow module?

Accepted Answer

show security flow session. The 'show security flow session' command displays active sessions currently flowing through the SRX device.

Answer

show interfaces flow-sessions

Answer

show system sessions active

Answer

show security sessions summary