JNCIA-SEC Monitoring And Troubleshooting Practice Test 2 — 15 Questions

Question 1

Which TWO commands help verify security zone configurations and interface memberships? (Choose two)

Accepted Answer

show security zones security-zone trust. Option A, `show security zones security-zone trust`, is correct because it displays the detailed configuration of the named security zone, including its assigned interfaces, so you can verify that the correct interfaces are bound to the trust zone. Option B, `show security zones`, is correct because it lists all configured security zones along with their interface memberships, giving a complete overview of zone-to-interface binding. Option C, `show route security-zones`, is not a valid Junos operational command for zone verification; it does not exist for this purpose. Option D, `show interfaces security-status`, is not a valid command for checking zone membership. Option E, `show firewall zone-membership`, is not a valid Junos command for verifying security zone configuration or interface membership.

Answer

show route security-zones

Answer

show interfaces security-status

Answer

show firewall zone-membership

Question 2

Which THREE metrics are displayed when monitoring security screening statistics? (Choose three)

Accepted Answer

IP spoofing drop counts. Security screening statistics focus on traffic anomalies and attack signatures handled by the screening/anti-DDoS function, so IP spoofing drop counts (B) are correct because spoofed-source packets are dropped and counted as a screening metric. SYN flood attack detection counts (D) are correct because SYN flood detection is a core screening statistic reported by the security screening module. ICMP flood violation counters (E) are also correct since ICMP flood violations are tracked as part of the same flood-protection screening statistics. BGP prefix withdrawal rates (A) belong to routing/BGP monitoring, not security screening, and IPsec re-key failure counts (C) belong to IPsec VPN/IKE monitoring rather than screening statistics.

Answer

BGP prefix withdrawal rates

Answer

IPsec re-key failure counts

Question 3

An engineer notices that specific traffic is being dropped silently by the SRX Series device. To capture detailed log messages about security policy evaluations, where should traceoptions be configured?

Accepted Answer

[edit security policies traceoptions]. Security policy evaluation logging and traceoptions are configured under the [edit security policies] hierarchy.

Answer

[edit security flow traceoptions]

Answer

[edit system services traceoptions]

Answer

[edit security zone traceoptions]

Question 4

You need to monitor dropped packets in real-time on an SRX Series device without disrupting production traffic. Which tool is best suited for identifying drop counters across security features?

Accepted Answer

show security flow statistics. The show security flow statistics command displays various internal drop counters such as policy drops, session drops, and screen drops.

Answer

monitor traffic interface ge-0/0/0

Answer

show security alg statistics

Answer

show system alarms

Question 5

An administrator wants to view log messages generated by security policies. Which syslog facility is typically used by Junos security policies for logging event messages?

Accepted Answer

local0 through local7. Security policies log events to the user facility or daemon facility depending on configuration, but security-specific log messages are typically directed to security-related facilities like RT_FLOW.

Answer

kernel

Answer

auth

Answer

security

Question 6

You have configured security syslog messages, but no logs are appearing on your external syslog server. Which operational command can you use to verify that the SRX is actively generating and sending syslog messages?

Accepted Answer

show system logging. The 'show system logging' command displays the syslog configuration and, critically, the status of configured log destinations including whether the SRX is actively sending messages to the external syslog host. It confirms the logging facility is enabled and the remote host is reachable/being targeted, which directly answers whether the SRX is generating and sending syslog messages.

Answer

show syslog statistics

Answer

show log messages | match syslog

Answer

show security syslog status

Question 7

You are troubleshooting a performance issue on an SRX Series device and notice high memory consumption attributed to the security session table. Which configuration statement can help mitigate this by reducing the TCP close-wait timeout?

Accepted Answer

set security flow timeout tcp-time-wait 30. Session table memory can be managed by lowering specific timeout values, such as the tcp-established or tcp-time-wait timers under flow timeout.

Answer

set security flow max-sessions-per-ip 1000

Answer

set system resources session-limit low

Answer

set security flow timeout tcp-established 300

Question 8

Which Junos command allows an administrator to view the status of IPsec VPN tunnels, including Phase 1 (IKE) negotiation state?

Accepted Answer

show security ike security-associations. Internet Key Exchange (IKE) negotiation status and Phase 1 security associations are viewed using show security ike security-associations.

Answer

show security ipsec active-tunnels

Answer

show vpn ike-status

Answer

show security flow ike-status

Question 9

When troubleshooting screen options (DoS/attack protection) dropping legitimate traffic, which TWO commands or configurations should you inspect? (Choose three) Wait, the prompt says HALF use Which THREE. This is a Which THREE question. Which THREE commands or configurations should you inspect? (Choose three)

Accepted Answer

show log messages or check syslog for screen drop entries. Screen options drop counters, zone screen configuration, and system logs provide insight into screen drops.

Answer

show security flow session detail

Answer

show security ike security-associations

Question 10

Which THREE configuration elements are required to successfully stream security logs to an external syslog server? (Choose three)

Accepted Answer

Assign the appropriate facility and severity levels (e.g., security any info) under system syslog. Option C is correct because Junos requires you to define what to log by specifying a facility (e.g., 'security') and severity (e.g., 'any info') within the system syslog hierarchy, which determines the content and verbosity of the streamed messages. Option D is correct because the external syslog server must be identified by its IP address under [edit system syslog host <ip>], which tells the device where to send the log stream. Option E is correct because security log streaming must be explicitly enabled under [edit security log] (e.g., by configuring 'stream' or the relevant mode) so that security logs are forwarded to the syslog process rather than only stored locally. Option A is not required because BGP peering is a routing protocol configuration and has no role in syslog streaming. Option B is not required because stateless firewall filters on egress interfaces are used for packet filtering, not for enabling or directing syslog traffic.

Answer

Configure BGP peering with the syslog server

Answer

Enable stateless firewall filters on all egress interfaces

Question 11

An administrator wants to view active security sessions on an SRX Series device that match a specific source IP address of 192.168.10.50. Which CLI command provides this specific filtered output?

Accepted Answer

show security flow session source-prefix 192.168.10.50. The command 'show security flow session source-prefix 192.168.10.50' filters the session table by source IP prefix, which is the documented Junos syntax for matching sessions originating from a specific address. It queries the flow session table directly and returns only matching entries.

Answer

show security alg session 192.168.10.50

Answer

show firewall filter session source-ip 192.168.10.50

Answer

show system connections 192.168.10.50

Question 12

An administrator is troubleshooting a security policy drop on an SRX Series device and needs to verify if the initial SYN packet matches the expected security policy. Which command should the administrator use to trace the packet flow in real time?

Accepted Answer

show security flow traceoptions. The show security flow traceoptions command or security flow monitoring helps trace packet flow, but traceoptions specifically allow capturing packet details in the log. For active debugging, flow traceoptions combined with matching traffic is standard.

Answer

show route table inet.0

Answer

monitor traffic interface ge-0/0/0

Answer

show security alg status

Question 13

While reviewing security event logs on an SRX Series device, an administrator notices that logs are not being sent to the configured external syslog server. Which command should the administrator use to verify the operational status and packet counters of the syslog forwarding mechanism?

Accepted Answer

show system logging. Syslog status and statistics can be verified using the system logging operational commands.

Answer

show log messages

Answer

show syslog statistics

Answer

show security monitoring syslog

Question 14

An administrator on an SRX Series device wants to capture detailed information about a specific flow, including session creation, policy evaluation, and packet forwarding decisions. The administrator needs to see this information in real time without committing configuration changes. Which command should be used?

Accepted Answer

debug security flow basic. The administrator requires real-time flow details without configuration changes. The 'debug security flow basic' command provides immediate, operational-mode debugging of flow processing, including session creation and policy evaluation. Other commands either display existing session data or are invalid operational commands. This command is specifically designed for on-demand troubleshooting without persistent configuration.

Answer

show security flow traceoptions

Answer

show security flow session extensive

Answer

monitor security flow traceoptions

Question 15

An administrator on an SRX Series device wants to verify that the DNS Application Layer Gateway is actively processing DNS queries and is not simply allowed by the security policy. The administrator wants to confirm the ALG is enabled and observe the DNS ALG activity in real time while a client performs lookups through the firewall. Which two actions should the administrator perform to accomplish this task? (Choose two.)

Accepted Answer

Enable DNS ALG trace options with 'set security alg dns traceoptions flag all' and then run 'show log dns-alg' to observe DNS ALG activity in real time.. Confirming that the DNS ALG is truly processing queries requires two complementary steps. The operational status command verifies that the DNS ALG is enabled in the effective configuration, which distinguishes ALG processing from a simple policy permit. Enabling DNS ALG trace options and reviewing the resulting log then provides real-time evidence of ALG transactions as clients perform lookups through the SRX Series device.

Answer

Run the operational command 'show security flow session application dns' to list only sessions that have been identified and processed by the DNS ALG.

Answer

Run 'show security flow session application dns-alg' to display sessions created specifically by the DNS ALG.

Answer

Use 'show security alg dns statistics' to display counters that prove DNS ALG processing is occurring.