JNCIA-SEC Junos OS Security Objects Practice Test 7 — 15 Questions

Question 1

Which THREE parameters can be configured within a custom application definition in Junos OS? (Choose three)

Accepted Answer

IP protocol (e.g., tcp, udp). In a Junos OS custom application definition (set applications application ...), the configurable match parameters include the IP protocol via 'protocol tcp|udp|icmp|...' (option C), the destination port via 'destination-port ' (option D), and the source port via 'source-port ' (option E); these three fields define the traffic signature the application matches. Option A is incorrect because SCREEN profiles are applied at the zone level (set security zones security-zone screen ), not inside an application definition. Option B is incorrect because security zone binding is a zone/interface configuration, not a parameter of an application object.

Answer

SCREEN option profile assignment

Answer

Security zone binding

Question 2

Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)

Accepted Answer

TCP SYN flood rate limiting. SCREEN option profiles contain Layer 3/4 attack protections such as IP spoofing and SYN flood limits.

Answer

Deep packet URL filtering and virus signature inspection

Answer

NAT pool port exhaustion mitigation

Answer

Dynamic routing protocol authentication keys

Question 3

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

Accepted Answer

ALGs interact with the security flow module to create temporary session table entries for data connections.. Option A is correct because Junos ALGs work with the security flow module to open temporary pinholes in the session table for the dynamically negotiated data connections, such as FTP data channels or SIP media streams, so return traffic is permitted without a separate policy. Option E is correct because ALGs parse the control channel packets (for example, FTP PORT/PASV commands or SIP/SDP INVITE messages) to learn the IP addresses and ports that will be used for the subsequent data sessions, then track those sessions. Option B is wrong because ALGs are software processes in the Junos flow daemon, not dedicated encryption ASICs. Option C is wrong because ALGs supplement, not replace, security policies; policies still govern whether the control and data traffic is allowed. Option D is wrong because ALGs are built into Junos OS for supported protocols and are not compiled from source per application.

Answer

ALGs are hardware-accelerated ASICs dedicated exclusively to packet encryption.

Answer

ALGs replace security policies entirely for all complex application traffic.

Answer

ALGs must be manually compiled from source code for each custom application.

Question 4

Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)

Accepted Answer

Security policies reference address book objects to specify traffic match criteria.. Option D is correct because Junos security policies use address-book entries (named address objects such as 'trust-zone' or 'server1') as match criteria in the from/to fields to identify source and destination addresses for traffic classification. Option E is correct because address books let administrators define named objects that group one or more IP prefixes or ranges, so policies can reference the object name instead of hard-coded addresses, greatly simplifying updates and management. Option A is incorrect because address books are configured under the [edit security address-book] hierarchy (with global and zone-specific books), not under [edit firewall], which is used for firewall filters. Option B is incorrect because address books are only relevant to security policy and NAT matching on SRX devices; they are not required for routing operations. Option C is incorrect because Junos security policies can reference the global address book as well as zone-specific address books, not only zone-specific ones.

Answer

Address books are configured under the [edit firewall] hierarchy.

Answer

Address books are mandatory for all Junos routing operations.

Answer

Security policies cannot reference global address books, only zone-specific address books.

Question 5

Which THREE settings can be configured under a security zone in Junos OS? (Choose three)

Accepted Answer

Host-inbound traffic permissions. Security zones can contain host-inbound-traffic, screen profile references, and interface assignments.

Answer

Dynamic routing protocol metric weights

Answer

IPsec VPN tunnel encryption algorithms

Question 6

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

Accepted Answer

Security zones. Security zones, address books, and screen options are all configured under [edit security].

Answer

VLAN bridge domain definitions

Answer

BGP routing protocol peering parameters

Question 7

Which TWO statements are true regarding Junos OS address sets and their usage in security policies? (Choose two)

Accepted Answer

Address sets can be used in security policies anywhere individual address objects are accepted.. Address sets group multiple address objects and can be referenced in policies as source or destination match criteria.

Answer

Address sets require an AppSecure license to function in security policies.

Answer

Address sets automatically translate IPv4 addresses into IPv6 equivalents.

Answer

Address sets are restricted to destination matching only and cannot be used as source match criteria.

Question 8

An administrator needs to create a new security zone named 'dmz' on an SRX Series device and assign the interface ge-0/0/2 to it. Which configuration mode command accomplishes this?

Accepted Answer

set security zones security-zone dmz interfaces ge-0/0/2. The correct Junos OS command to create a security zone and assign an interface is 'set security zones security-zone interfaces '. This places the interface under the zone. The other options contain syntax errors or use the wrong hierarchy, so they will not achieve the desired configuration.

Answer

set security zones dmz interfaces ge-0/0/2

Answer

set interfaces ge-0/0/2 zone dmz

Answer

set security zone dmz interface ge-0/0/2

Question 9

You are configuring a custom application named 'my-app' on an SRX Series device. You need to define it to match TCP traffic destined for port 8080 and also match UDP traffic on port 53. Which configuration correctly defines this application?

Accepted Answer

set applications application my-app term tcp protocol tcp destination-port 8080; set applications application my-app term udp protocol udp destination-port 53. Custom applications in Junos OS can include multiple terms, each specifying a protocol and port. To match both TCP 8080 and UDP 53, you must define separate terms within the application. The configuration with 'term tcp' and 'term udp' achieves this. The other options either define only one protocol or incorrectly attempt to set multiple protocols without terms.

Answer

set applications application my-app protocol tcp destination-port 8080

Answer

set applications application my-app protocol udp destination-port 53

Answer

set applications application my-app protocol tcp destination-port 8080; set applications application my-app protocol udp destination-port 53

Question 10

An administrator wants to create an address book entry for a subnet 192.168.1.0/24 and another for a single host 192.168.1.10. Both should be available globally across all zones. Which configuration achieves this?

Accepted Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10/32. Global address books are configured under [edit security address-book global] and are accessible from all zones. Each address must include a prefix length; for a single host, use /32. The correct configuration creates both entries in the global address book with proper syntax. Zone-specific address books would not be global.

Answer

set security zones security-zone trust address-book address subnet1 192.168.1.0/24; set security zones security-zone trust address-book address host1 192.168.1.10/32

Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10/24

Answer

set security address-book global address subnet1 192.168.1.0/24; set security address-book global address host1 192.168.1.10

Question 11

An administrator needs to create a custom application in Junos OS that matches TCP traffic destined for port 8443 and terminates the session when the server sends a TCP RST. The application should not attempt to match any payload content. Which configuration statement set completes this custom application definition?

Accepted Answer

set applications application MY-APP protocol tcp destination-port 8443. A custom application in Junos OS is defined under the applications hierarchy with a protocol and at least one port match. Specifying TCP and destination-port 8443 matches the intended traffic without invoking any ALG or payload inspection. The session ends when a TCP RST is received, as with any standard TCP session. Adding an application-protocol or using the wrong protocol or port would not meet the requirement.

Answer

set applications application MY-APP protocol tcp source-port 8443

Answer

set applications application MY-APP protocol udp destination-port 8443

Answer

set applications application MY-APP protocol tcp destination-port 8443 application-protocol ssl

Question 12

A network administrator is configuring a new security zone on an SRX Series device and wants to assign a logical interface to it. The interface is already configured with an IP address and is currently unassigned to any zone. Which configuration statement correctly assigns the interface ge-0/0/1.0 to the zone named TRUST?

Accepted Answer

set security zones security-zone TRUST interfaces ge-0/0/1.0. To assign an interface to a security zone in Junos OS, the correct hierarchy is [edit security zones security-zone <name>] and the statement is 'set security zones security-zone TRUST interfaces ge-0/0/1.0'. The interface must be a logical unit and must not already belong to another zone. This binding enables the zone to apply security policies, screen options, and other zone-specific configurations.

Answer

set security zones security-zone TRUST interfaces ge-0/0/1

Answer

set security zone TRUST interface ge-0/0/1.0

Answer

set interfaces ge-0/0/1.0 zone TRUST

Question 13

A network engineer is configuring a custom application on an SRX Series device to match a proprietary protocol that uses UDP port 5000 and requires a timeout of 300 seconds. The engineer also needs to ensure that the application can be used in a security policy. Which configuration statement is required to define this custom application?

Accepted Answer

set applications application my-app protocol udp destination-port 5000 inactivity-timeout 300. A custom application in Junos OS is defined under the applications hierarchy and must specify the protocol, destination port, and optionally an inactivity timeout. The command using protocol udp, destination-port 5000, and inactivity-timeout 300 correctly matches the proprietary protocol's characteristics. The inactivity-timeout controls how long the session remains open when no traffic is sent, which is crucial for UDP-based applications that lack session state. The other options contain incorrect keywords or wrong protocol/port parameters.

Answer

set applications application my-app protocol udp source-port 5000 timeout 300

Answer

set applications application my-app protocol udp destination-port 5000 session-timeout 300

Answer

set applications application my-app protocol tcp destination-port 5000 inactivity-timeout 300

Question 14

An administrator is configuring an address book entry in a security zone on an SRX Series device. The administrator needs to create an address book entry that represents a specific host with IP address 192.168.1.100 and a network with prefix 10.0.0.0/24. Which TWO address book object types can be used to accomplish this? (Choose two.)

Accepted Answer

address 192.168.1.100/32. In Junos OS security zones, address book entries can be defined as address objects, which can represent a host (using a /32 prefix) or a network (using a prefix length such as /24). The entries 192.168.1.100/32 and 10.0.0.0/24 directly define the required host and network. Address-sets are used to group multiple address objects and are not the primary object type for representing a single host or network. DNS hosts are used for dynamic resolution and are not applicable when specific IP addresses are provided.

Answer

address-set 10.0.0.0/24

Answer

address-set 192.168.1.100/32

Answer

dns-host www.example.com

Question 15

An administrator wants to verify which security zones are currently configured on an SRX Series device and which interfaces are assigned to each zone. Which operational mode command provides this information in a concise, tabular format?

Accepted Answer

show security zones. The operational mode command 'show security zones' provides a concise, tabular display of all security zones and the interfaces assigned to each. It is the quickest way to verify zone-to-interface mappings on an SRX Series device. Configuration mode commands show the raw configuration, and interface or policy commands do not directly answer the question.

Answer

show security policies

Answer

show configuration security zones

Answer

show interfaces terse