JNCIA-SEC Junos OS Security Objects — Timed 15 Questions

Question 1

You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?

Accepted Answer

tcp syn-flood alarm-threshold <value>. SYN flood protection is managed using the 'tcp syn-flood' parameter inside a SCREEN option profile.

Answer

icmp flood limit <value>

Answer

ip spoofing check

Answer

tcp-syn-flood attack-threshold

Question 2

An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?

Accepted Answer

[edit security alg ftp disable]. ALGs are controlled under the [edit security alg] hierarchy where specific protocol helpers can be disabled or modified.

Answer

[edit security flow alg ftp mode transparent]

Answer

[edit security zones security-zone untrust alg ftp]

Answer

[edit applications application junos-ftp alg none]

Question 3

Which command allows you to view the configured security zones and their assigned interfaces in Junos OS?

Accepted Answer

show security zones. The 'show security zones' operational command displays all security zones and their associated interfaces.

Answer

show security policies zones

Answer

show configuration security zones

Answer

show interfaces security

Question 4

You want to configure an address book entry that matches all IP addresses within the 192.168.10.0/24 subnet except for 192.168.10.50. How can this be accomplished in Junos OS address configuration?

Accepted Answer

Use the 'exclude' statement within the address book configuration for that specific prefix.. Junos address book entries support excluding specific IP addresses using the 'exclude' statement within an address configuration.

Answer

Create an address set containing 192.168.10.0/24 and negate 192.168.10.50 using policy match negation.

Answer

Exclusions are not supported in Junos address books; you must use separate address objects.

Answer

Create two separate subnets: 192.168.10.0/25 and 192.168.10.128/25.

Question 5

An administrator configures a security zone and enables the 'tcp-rst' SCREEN option. What is the primary purpose of this SCREEN option?

Accepted Answer

It protects against TCP reset flood attacks by setting threshold limits on incoming RST packets.. The tcp-rst option protects against forged TCP RST packets that could prematurely terminate active connections.

Answer

It forces the SRX to send TCP resets for all blocked session attempts instead of dropping silently.

Answer

It inspects the sequence number of TCP RST packets to ensure they fall within the valid window.

Answer

It drops all TCP packets with the RST flag set to prevent unauthorized connection teardowns.

Question 6

You have configured a custom application object named 'CUSTOM-APP' matching TCP port 9090. When you attempt to commit the configuration, Junos returns an error stating that the application conflicts with a predefined Junos application. How should you resolve this?

Accepted Answer

Rename your custom application to avoid naming conflicts with reserved Junos system applications.. Predefined Junos applications (prefixed with junos-) cannot be overwritten, but custom applications should be given unique names that do not conflict. Alternatively, modifying the existing custom application name resolves the conflict.

Answer

Change the protocol type from TCP to UDP to bypass the name collision check.

Answer

Delete the system application using the 'delete applications junos-custom' command.

Answer

Use the 'override' keyword in the application definition.

Question 7

You need to define an address book entry that references a range of IP addresses from 10.1.1.100 to 10.1.1.200. What is the correct configuration syntax under the security address-book hierarchy?

Accepted Answer

address range-1 10.1.1.100-10.1.1.200;. Junos address book syntax for an IP range uses the 'range-address' statement.

Answer

address range-name 10.1.1.100 to 10.1.1.200;

Answer

address range-pool 10.1.1.100-10.1.1.200;

Answer

address range-1 10.1.1.100 to 10.1.1.200;

Question 8

You need to inspect traffic matching a proprietary application that uses dynamic TCP ports. You have written a custom application. What additional Junos security feature can be combined with custom applications to inspect deep packet content for non-standard ports?

Accepted Answer

Application Identification (AppID) / Custom signatures. Custom applications combined with Junos AppSecure (such as AppID) or custom ALG mappings allow deeper inspection, though basic custom apps define port/protocols. For dynamic ports, AppID signatures are used.

Answer

Global address sets

Answer

Host-inbound traffic protocols

Answer

Screen options profile

Question 9

An administrator creates a security zone and defines both a zone-specific address book and a global address book. The same address name exists in both address books with conflicting subnets. When a security policy references this address name from a different security zone, which address definition is selected?

Accepted Answer

The global address book entry is selected because the policy is evaluated outside the local zone context.. When traffic originates from a zone other than the zone where the zone-specific address book resides, the global address book entry is used because the zone-specific book only applies to traffic originating from or associated with its specific zone context.

Answer

Both subnets are logically ORed together.

Answer

The zone-specific address book entry is always selected.

Answer

Junos drops the traffic due to ambiguous address resolution.

Question 10

You want to configure a security zone to automatically reject new TCP connections with a TCP RST packet when the zone's transit sessions exceed capacity or policies deny them. Where is this behavior configured?

Accepted Answer

Under the security policy action keyword 'reject' rather than 'deny'.. Session drop behavior, such as sending TCP resets on rejection, is configured under security options or policy actions, but default session limits and rejection behaviors are managed within security options. Wait, session rejection action ('reject' vs 'deny') is specified directly within the security policy. Let's check session table limits: session limits can be set under [edit security max-sessions].

Answer

Under the security zone options by enabling 'tcp-reset-on-drop'.

Answer

Under the SCREEN options profile by enabling 'tcp-rst-reply'.

Answer

Under the global system services configuration.

Question 11

Which command is used to view the list of all predefined Junos OS application objects?

Accepted Answer

show security applications. The 'show configuration applications junos-' or operational equivalents display built-in applications. In operational mode, 'show security applications' lists available applications.

Answer

show system applications predefined

Answer

show configuration security applications

Answer

show applications junos-defaults

Question 12

An administrator configures an address set that includes another address set as a member (nested address sets). What is the maximum nesting depth supported for address sets in Junos OS?

Accepted Answer

Junos supports nested address sets, and configuration parser validates against circular references during commit.. Junos OS supports nesting address sets within address sets up to a specific depth limit (typically up to foundation limits, but let's recall Junos specifications: address sets can be nested, but infinite nesting is prevented. Specifically, Junos supports nesting up to 1 level or multiple levels depending on the version, but generally nesting is supported up to a certain depth. Wait, let's verify standard Junos documentation: Junos supports address sets containing address sets, but circular dependencies are blocked. Let's check if there's a strict depth limit or if circular references are what's tested). Actually, circular references are strictly prohibited and checked at commit time.

Answer

Infinite nesting is allowed as long as circular references are avoided.

Answer

Nesting address sets is not supported in Junos OS; all address objects must be flat.

Answer

Nested address sets are restricted to global address books only and cannot be used in zone-specific address books.

Question 13

Which command displays the configured functional zones in Junos OS?

Accepted Answer

show security zones functional-zone. The 'show security zones functional-zone' command displays the status and configuration of functional zones.

Answer

show configuration functional-zones

Answer

show security alg functional-zone

Answer

show system functional-zones

Question 14

An administrator configures a security zone and enables traceoptions for zone management. What is the correct configuration hierarchy to enable traceoptions for security zones?

Accepted Answer

[edit security zones traceoptions]. Zone traceoptions are configured under [edit security zones traceoptions].

Answer

[edit security zones security-zone traceoptions]

Answer

[edit security flow traceoptions zones]

Answer

[edit system traceoptions security-zones]

Question 15

You want to create a security zone and explicitly block all traffic between interfaces assigned to that same zone (intra-zone traffic). Which configuration statement accomplishes this?

Accepted Answer

set security zones security-zone trust intra-zone-blocking. Intra-zone traffic can be blocked in Junos security zones by configuring the 'block-inbound-traffic' or 'tcp-rst' options, or specifically 'screen' or zone-level intra-zone blocking. Wait, the exact Junos command to block intra-zone traffic is 'set security zones security-zone screen' or using screen options, or 'set security zones security-zone intra-zone-blocking'. Let's verify: Junos security zones support 'intra-zone-blocking'.

Answer

set security flow intra-zone deny-all

Answer

set security policies from-zone trust to-zone trust deny all

Answer

set interfaces all intra-zone-filter drop