JNCIA-SEC Monitoring And Troubleshooting Practice Test 3 — 15 Questions

Question 1

You are troubleshooting a branch SRX300 Series device that intermittently drops IKE negotiations from a remote peer. You need to confirm whether IKE Phase 1 packets are reaching the device and being processed, and whether the device is generating responses. Which command provides the most direct, real-time diagnostic output for IKE packet processing on the SRX?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

set security ike traceoptions file iked.log; set security ike traceoptions flag all. IKE negotiations are handled by the key management process on SRX Series devices, and Junos OS exposes their activity through security ike traceoptions. Configuring the traceoptions file and enabling the all flag causes detailed IKE event and packet information to be recorded, which is exactly what is needed to verify whether Phase 1 packets arrive and whether responses are sent. Other traceoptions scopes target data-plane or system events and cannot decode IKE exchanges.

Answer

set security flow traceoptions file flow.log; set security flow traceoptions flag basic-datapath

Answer

set traceoptions file iked.log; set traceoptions flag ike

Answer

set system traceoptions file sys.log; set system traceoptions flag configuration

Question 2

A security administrator notices that a large number of sessions are being denied by a security policy on an SRX Series device. The administrator wants to identify which source addresses are generating the denied traffic and how frequently, in order to tune the policy. Which command should the administrator use?

Accepted Answer

show security policies hit-count. To determine how frequently a deny policy is being triggered, the administrator should use the hit-count command, which reports match counts per policy. This reveals the scale of denials associated with a specific policy. Commands that display configuration or existing sessions do not capture denied traffic that never creates a session, so they cannot provide the frequency data required for policy tuning in this scenario.

Answer

show security flow session source-prefix

Answer

show security flow session application

Answer

show security policies detail

Question 3

An administrator needs to monitor real-time security events on an SRX Series device, including policy denies and screen drops, without overwhelming the device. Which two methods are appropriate? (Choose two.)

Accepted Answer

Enable traceoptions for security flow and view the log file.. Streaming security logs to a syslog server and enabling traceoptions for security flow are both effective methods for real-time monitoring of security events. They allow targeted capture of policy denies and screen drops without overwhelming the device. The other options involve invalid commands or inefficient practices that do not meet the requirements.

Answer

Use the 'monitor security flow' command to view all flow events in real time.

Answer

Use the 'show security flow session' command repeatedly in a loop.

Answer

Run 'debug security flow all' to capture every packet in real time.

Question 4

An administrator troubleshooting a suspected policy deny on an SRX Series device wants to gather evidence that a specific session was denied by security policy rather than dropped for another reason. Which TWO actions help confirm a policy-based deny? (Choose two.)

Accepted Answer

Run show security flow session to look for a session in the deny state.. Confirming a policy-based deny requires evidence tied to policy evaluation. Enabling policy logging and reviewing deny entries in the security log provides that direct evidence, while inspecting flow sessions for a denied state shows the runtime result of the policy decision. Together they distinguish a policy deny from interface, routing, or NAT-related drops.

Answer

Check interface error counters for input discards.

Answer

Verify the routing table for a missing route to the destination.

Answer

Inspect NAT rule configuration for translation mismatches.

Question 5

An administrator needs to view active sessions matching a specific destination port on an SRX Series device. Which command syntax is correct?

Accepted Answer

show security flow session destination-port 443. The correct command is 'show security flow session destination-port 443', which filters the active session table by destination port 443. This command is part of the SRX flow session operational toolkit and directly answers the requirement to view sessions matching a specific destination port.

Answer

show security policy match-port 443

Answer

show route protocol bgp port 443

Answer

show firewall filter port 443

Question 6

You are troubleshooting a packet drop issue on an SRX Series device and need to trace packets for a specific source IP address. Which feature should you configure to capture detailed packet flow logs?

Accepted Answer

set security flow traceoptions file flow-debug. To trace packets for a specific source IP on an SRX, you configure flow traceoptions under [edit security flow traceoptions]. This allows you to capture detailed packet flow logs, including session creation, policy lookups, and NAT translations. The command 'set security flow traceoptions file flow-debug' specifies the trace file, and additional parameters like 'set security flow traceoptions packet-filter' can filter by source IP. The other options are either for system logging, application firewall logs, or firewall filter counters, none of which provide detailed flow tracing.

Answer

set system syslog file packet-log

Answer

request security app-firewall log clear

Answer

set firewall filter debug term 1 then count

Question 7

While inspecting the security session table using 'show security flow session', you notice a session in the 'P' state. What does this state indicate?

Accepted Answer

The session is pending and waiting for a TCP synchronization or return packet to be fully established.. In Junos OS SRX session management, the 'P' flag indicates a pending session waiting for a return packet or complete three-way handshake before becoming active.

Answer

The session is prioritized for quality of service (QoS).

Answer

The session is operating in passive FTP mode.

Answer

The session is permanently blocked due to a security policy violation.

Question 8

Where are system log messages related to security policies typically directed when default logging configurations are used?

Accepted Answer

To the local log file configured under system syslog, such as interactive-commands or security-log. Security policy logs are sent via security daemon (secd) and flow module to the local syslog utility, usually directed to a file or remote collector.

Answer

Directly to the active user terminal screen by default

Answer

To the kernel crash dump utility

Answer

To the boot-time NVRAM partition

Question 9

An administrator notices that traffic between two trusted security zones is being dropped unexpectedly. Which command should be used first to verify if the security policy is matching the traffic?

Accepted Answer

show security policies hit-count. The show security policies hit-count command displays the number of times a specific security policy has matched traffic, confirming if the policy evaluation is occurring as expected.

Answer

show system alarms

Answer

show security flow session

Answer

show route

Question 10

How can an administrator check the active Junos OS version running on an SRX Series device?

Accepted Answer

show version. The show version command displays the active software version and hardware model details.

Answer

show system software-status

Answer

show chassis version

Answer

show system package installed

Question 11

During session troubleshooting, you notice sessions entering the 'CLOSE-WAIT' state and lingering. What does this indicate in the Junos session table?

Accepted Answer

The local application has not yet issued a close command after receiving a FIN from the remote peer.. The 'CLOSE-WAIT' state in the Junos session table indicates that the local application has received a FIN from the remote peer but has not yet issued its own close command. This means the local side is waiting for the application to close the connection. It is a normal part of the TCP connection termination process, but lingering sessions may indicate an application not properly closing sockets.

Answer

The SRX security policy is actively dropping packets for this session.

Answer

IPsec Phase 2 re-keying is in progress.

Answer

The session is awaiting NAT port reallocation.

Question 12

Which command allows an administrator to view real-time interface throughput and error statistics on an SRX Series firewall?

Accepted Answer

show interfaces statistics. The command 'show interfaces statistics' displays real-time interface throughput, packet counts, error counters, and other per-interface statistics on an SRX Series firewall. It is the standard operational command for viewing interface-level performance and error data.

Answer

show system interface status

Answer

show chassis hardware

Answer

show security flow statistics

Question 13

An administrator wants to monitor security screening checks such as SYN flood protection counters. Which operational command should be used?

Accepted Answer

show security screen statistics. The correct command to monitor security screening checks such as SYN flood protection counters is 'show security screen statistics', which displays per-zone screen option counters including SYN flood, ICMP flood, UDP flood, and other screen attack statistics. This command directly surfaces the screening check counters the administrator needs.

Answer

show system screening-counters

Answer

show security attack-mitigation status

Answer

show security flow flood-protection

Question 14

An administrator configures traceoptions for security policies. Where can they find the resulting log output file?

Accepted Answer

/var/log/. Traceoptions output files are written to /var/log/ by default on Junos devices. When you configure traceoptions under [edit security policies traceoptions], the 'file' statement specifies a filename that is created in /var/log/, and the resulting trace data is written there. Administrators retrieve it with 'show log <filename>' from the CLI.

Answer

/config/trace/

Answer

/tmp/

Answer

/var/db/

Question 15

You need to verify whether application identification (AppID) is successfully classifying traffic within security policies. Which command displays AppID session details?

Accepted Answer

show security flow session extensive. 'show security flow session extensive' displays detailed session information including the application identified by AppID, nested applications, and classification details. It is the correct command to verify whether AppID is successfully classifying traffic.

Answer

show application-firewall status

Answer

show security policies app-id-hits

Answer

show security app-tracking summary