JNCIA-SEC Junos OS Security Objects Practice Test 6 — 15 Questions

Question 1

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

Accepted Answer

[edit security screen traceoptions]. Screen traceoptions are configured under the [edit security screen traceoptions] hierarchy.

Answer

[edit system traceoptions screen]

Answer

[edit security flow traceoptions screen]

Answer

[edit security zones security-zone screen traceoptions]

Question 2

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

Accepted Answer

It monitors and limits the aggregate rate of all ICMP packet types combined.. The 'icmp all' SCREEN option applies flood protection and threshold monitoring across all ICMP types collectively.

Answer

It blocks ICMP echo requests while allowing ICMP destination unreachable messages.

Answer

It inspects ICMP payloads for encapsulated malicious shellcode.

Answer

It drops all ICMP packets unconditionally without exception.

Question 3

You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?

Accepted Answer

Yes, you can configure 'set security zones security-zone trust host-inbound-traffic system-services all'.. Junos host-inbound-traffic allows specifying 'all' under system-services or protocols to permit everything, though it is discouraged for security reasons.

Answer

No, host-inbound traffic cannot allow wildcard services for security compliance reasons.

Answer

Yes, by using the 'any' keyword instead of 'all'.

Answer

No, every service must be explicitly listed individually.

Question 4

An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?

Accepted Answer

It detects and blocks ICMP timestamp request packets that could be used for reconnaissance or flooding.. The icmp timestamp SCREEN option protects against ICMP timestamp flood or manipulation attacks by monitoring or blocking ICMP timestamp request and reply packets.

Answer

It timestamps every transit packet passing through the security zone for latency analysis.

Answer

It drops all ICMP packets that have invalid timestamp header fields.

Answer

It synchronizes the SRX system clock using ICMP timestamp replies from trusted gateways.

Question 5

Which TWO methods can be used to define IP addresses in Junos OS address books? (Choose two)

Accepted Answer

IP address ranges (e.g., 10.1.1.1-10.1.1.50). Address books support individual IP subnets/prefixes and IP ranges.

Answer

Routing protocol metric values

Answer

Interface speed descriptors

Answer

Mac address binding tables

Question 6

Which TWO statements are correct regarding Junos OS security zones? (Choose two)

Accepted Answer

Security zones are logical groupings of interfaces that share security policies.. Security zones group interfaces and enforce security policies. Every transit interface must belong to a zone.

Answer

Functional zones require manual IP address assignment before they can function.

Answer

Security zones are optional when configuring basic IP routing and firewall filters.

Answer

A physical interface can belong to multiple security zones simultaneously.

Question 7

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Accepted Answer

IP address range objects. Address sets can contain individual IPv4 addresses, IPv6 addresses, IP ranges, DNS FQDN objects, or other address sets.

Answer

Application Layer Gateway profiles

Answer

Security zone interface names

Question 8

Which TWO actions occur when an Application Layer Gateway (ALG) inspects traffic in Junos OS? (Choose two)

Accepted Answer

The ALG parses application-layer control messages to identify dynamic port negotiations.. ALGs inspect application control channels and dynamically open data sessions for complex protocols.

Answer

The ALG converts all UDP traffic into reliable TCP byte streams.

Answer

The ALG replaces the standard IPsec encryption engine for high-throughput VPN tunnels.

Answer

The ALG blocks all encrypted traffic unconditionally.

Question 9

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Accepted Answer

LAND attacks. Junos OS SCREEN options are a set of stateless and stateful security filters applied at the zone or interface level to detect and drop malformed or abusive packets before they reach protected hosts. Option B (LAND attacks) is correct because SCREEN includes the land attack defense, which drops packets where the source and destination IP addresses (and ports) are identical, a classic spoofed-packet loop condition. Option C (TCP SYN flood attacks) is correct because SCREEN provides syn-flood protection, using SYN cookie and related thresholds (e.g., alarm-threshold, attack-threshold, source-threshold, destination-threshold) to limit half-open TCP connections. Option D (IP spoofing attacks) is correct because SCREEN offers ip-spoofing and related checks (such as source-route-option and ip-source-route) that drop packets whose source addresses are inconsistent with the expected ingress path or that carry forbidden IP options. Options A (XSS browser exploits) and E (SQL injection web application attacks) are not mitigated by SCREEN, since these are application-layer web attacks that require an application-aware security service such as Junos UTM/IDP or a WAF, not packet-level SCREEN filters.

Answer

Cross-site scripting (XSS) browser exploits

Answer

SQL injection web application attacks

Question 10

Which TWO statements are true regarding Junos OS global address books versus zone-specific address books? (Choose two)

Accepted Answer

Zone-specific address books take precedence over global address books for traffic originating from that zone.. Global address books apply across all zones, while zone-specific books apply primarily to their owning zone.

Answer

Zone-specific address books cannot contain address sets.

Answer

Zone-specific address books are mandatory; global address books are optional.

Answer

Global address books override zone-specific address books in all scenarios.

Question 11

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Accepted Answer

Address book entries / Address sets. In Junos OS security policies, match criteria are built from address book entries and address sets (option B), which define the source and destination IP objects the policy evaluates, and from applications and application sets (option D), which define the Layer 4/7 services (e.g., junos-http, junos-ssh) permitted or denied. Both are standard configurable objects referenced under 'match source-address/destination-address' and 'match application' in a security policy. Functional zone names (option A) are used for interface classification and host-inbound traffic, not as payload-inspection match criteria, so they are not policy objects. SCREEN option profiles (option C) are referenced in zone configurations for IDS/attack detection, not inside security policies. Hardware crypto processor allocation maps (option E) are used for IPsec/flow crypto resource assignment, not as security policy match objects.

Answer

Functional zone names directly as match criteria for payload inspection

Answer

SCREEN option profiles

Answer

Hardware crypto processor allocation maps

Question 12

Which THREE services can be enabled under host-inbound-traffic system-services in Junos OS security zones? (Choose three)

Accepted Answer

ping. System services for host-inbound traffic include ping, ssh, https, snmp, etc.

Answer

ospf

Answer

bgp

Question 13

Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)

Accepted Answer

show security flow session. Valid operational commands include showing security zones and security flow sessions.

Answer

show system applications builtin

Answer

show security policy ruleset evaluate

Answer

show configuration security address-book

Question 14

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

Accepted Answer

Custom applications can include inactivity timeout settings.. Custom applications allow specifying protocol, source ports, and destination ports for policy matching.

Answer

Custom applications automatically generate Application Layer Gateways for proprietary protocols without manual configuration.

Answer

Custom applications are restricted to global policies only and cannot be used in zone-to-zone policies.

Answer

Custom applications can overwrite built-in predefined Junos applications if named identically.

Question 15

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Accepted Answer

SIP (Session Initiation Protocol). SIP (B) is correct because SIP signaling embeds IP addresses and port numbers in its message bodies (SDP payloads), so a Junos ALG must inspect and rewrite those fields to open the correct pinholes for the RTP media streams. TFTP (C) is correct because it negotiates a dynamic secondary UDP port during the initial exchange, and the Junos TFTP ALG opens that data-channel pinhole automatically. FTP (D) is correct because FTP uses a separate data connection whose port is signaled in the control channel (PORT/PASV), requiring the Junos FTP ALG to inspect and permit that dynamic flow. HTTP (A) is not marked correct because it is a single-connection protocol that does not embed dynamic addressing requiring ALG pinhole creation, and SSH (E) is not marked correct because it runs over a single TCP port 22 without negotiated secondary data channels.

Answer

HTTP (Hypertext Transfer Protocol)

Answer

SSH (Secure Shell)