JNCIA-SEC Monitoring And Troubleshooting Practice Test 4 — 15 Questions

Question 1

An administrator enables traceoptions for IKE to troubleshoot a failing VPN negotiation. Where are these trace files stored by default on the SRX Series device?

Accepted Answer

/var/log/. By default, Junos traceoptions files are stored in the /var/log/ directory on the SRX Series device. When you configure traceoptions without specifying a file path, the trace file is created under /var/log with the specified filename. This is the standard location for all trace and log files.

Answer

/var/tmp/traces/

Answer

/etc/log/ike/

Answer

/config/sec/

Question 2

Which command displays the current active security policies applied on an SRX Series device?

Accepted Answer

show security policies. The command 'show security policies' displays the current active security policies configured on an SRX Series device, including zone context, source/destination addresses, applications, and actions. It is the standard operational command for verifying policy configuration and hit counts. Variants like 'show security policies hit-count' or 'show security policies detail' extend the output.

Answer

show security zone policies

Answer

show route security-policy

Answer

show firewall security-rules

Question 3

What is the purpose of the 'show security zones' command?

Accepted Answer

To display configured security zones and their associated interfaces and properties. The 'show security zones' command displays all configured security zones along with their associated interfaces, assigned screen profiles, and zone properties such as host-inbound-traffic settings. It is the primary command for verifying zone configuration and interface-to-zone binding on an SRX firewall.

Answer

To show routing table partitions

Answer

To list all active IPsec VPN tunnels

Answer

To monitor firewall CPU load per zone

Question 4

An engineer needs to determine why IPsec Phase 1 negotiations are failing with a remote peer. Which traceoptions flag should be enabled under security ike?

Accepted Answer

set security ike traceoptions flag all. The correct command to enable traceoptions for IPsec Phase 1 (IKE) negotiations is `set security ike traceoptions flag all` under the `[edit security ike]` hierarchy. This flag captures all IKE-related events, including Phase 1 exchanges, proposals, and errors, which is essential for diagnosing why negotiations are failing. The other options either target the wrong hierarchy (IPsec or flow) or are not traceoptions commands at all.

Answer

set security ipsec traceoptions flag phase1

Answer

set system syslog facility local4

Answer

set security flow traceoptions flag ike

Question 5

An administrator needs to verify whether source NAT pool addresses are being exhausted. Which command should they execute?

Accepted Answer

show security nat source pool. The command 'show security nat source pool' displays the configured source NAT pools along with their address ranges and current port/address utilization, allowing the administrator to see whether pool addresses are being exhausted. It is the Junos-specific operational command for inspecting source NAT pool state on SRX devices.

Answer

show route pool-address

Answer

show security translation pool-exhaustion

Answer

show security flow pool-status

Question 6

You need to perform packet capture on an SRX Series device to analyze suspicious traffic hitting an interface. Which built-in Junos utility should you use?

Accepted Answer

monitor traffic interface ge-0/0/0. The 'monitor traffic interface ge-0/0/0' command is the built-in Junos utility for capturing packets on a specific interface. It is essentially a wrapper around tcpdump that runs in the CLI operational mode, displaying packet headers (and optionally full payloads with 'detail' or 'extensive') in real time. It requires no shell access and is the standard first-line packet capture tool on SRX.

Answer

show security packet-capture interface

Answer

request diagnostic capture start

Answer

start shell tcpdump -i ge-0/0/0

Question 7

Which command allows an administrator to view system log files directly from the Junos CLI?

Accepted Answer

show log messages. The 'show log messages' command is the standard Junos CLI operational command for viewing the contents of the system log file (typically /var/log/messages). Junos stores logs in /var/log/ and the 'show log <filename>' syntax reads them directly without needing shell access. 'show log messages' specifically displays the main system log containing general system events, security events, and daemon messages.

Answer

view log file

Answer

read log system

Answer

display system log

Question 8

An engineer is troubleshooting a potential Denial of Service (DoS) attack. Where can they check real-time attack log entries generated by security screens?

Accepted Answer

The security log file or system log configured for screen events. Security screen (DoS protection) events are logged to the configured system log or security log file, so checking that log is where real-time attack entries appear. Screens such as SYN flood, ICMP flood, and session-limit screens generate log messages that administrators can review to confirm an active DoS condition.

Answer

The routing protocol trace file

Answer

The kernel crash dump directory

Answer

The chassis hardware alarm log

Question 9

You suspect that session timeouts are too aggressive for a specific long-lived TCP application. Which command allows you to check current TCP timeout configurations on an SRX?

Accepted Answer

show security flow timeout. 'show security flow timeout' displays the current timeout values for TCP, UDP, ICMP, and other session types on the SRX. It is the direct command to verify whether TCP timeouts are too aggressive for a long-lived application.

Answer

show security session timeout-status

Answer

show firewall timeout-settings

Answer

show system connection-timeout

Question 10

While debugging NAT, you notice that session creation fails due to port block allocation failure. Which command helps inspect dynamic IP and port (DIPP) NAT usage?

Accepted Answer

show security nat source pool detail. The command 'show security nat source pool detail' displays detailed information about source NAT pools, including the number of allocated port blocks and usage statistics. This directly helps inspect DIPP (Dynamic IP and Port) NAT usage and diagnose port block allocation failures.

Answer

show route forwarding-table dipp

Answer

show security flow dipp-status

Answer

show security translation port-blocks

Question 11

What information does the 'show security flow session summary' command provide?

Accepted Answer

Total active session counts, resource usage, and protocol breakdown. 'show security flow session summary' provides a high-level overview of the session table, including the total number of active sessions, the number of sessions per protocol (TCP, UDP, ICMP), and resource usage statistics such as session table utilization. It does not list individual sessions or packet contents; that is done with 'show security flow session' without the 'summary' keyword.

Answer

Detailed packet contents for every active session

Answer

The complete list of source and destination IP addresses

Answer

Configured security policies

Question 12

Which command displays the hardware temperature and environmental status of an SRX Series chassis?

Accepted Answer

show chassis environment. 'show chassis environment' is the standard Junos command that reports chassis environmental data including temperature, fan status, and power supply status on SRX Series devices. It directly answers the requirement to view hardware temperature and environmental status.

Answer

show system environment

Answer

show hardware status

Answer

show security environmental-status

Question 13

Which THREE types of information are displayed when executing the 'show security flow session extensive' command? (Choose three)

Accepted Answer

NAT translation mapping details. Option A is correct because 'show security flow session extensive' includes NAT translation mapping details, showing the pre- and post-translation source and destination IP addresses and ports for the session. Option B is correct because the extensive output includes AppID classification results, identifying the application recognized for the session (for example, via the application identification engine). Option C is correct because the command displays packet and byte counters for the session in both directions, allowing verification of traffic volume. Option D is incorrect because BGP routing table metric attributes are shown by routing commands such as 'show route detail', not by the flow session extensive output. Option E is incorrect because physical cable length is a Layer 1 property that is not reported by the flow session extensive command.

Answer

BGP routing table metric attributes

Answer

The physical cable length connected to the interface

Question 14

Which TWO actions can help an administrator troubleshoot why a security policy is not matching expected traffic? (Choose two)

Accepted Answer

Check policy hit counts using 'show security policies hit-count'. Option B is correct because 'show security policies hit-count' displays the per-policy match counters, allowing the administrator to verify whether the expected policy is actually being evaluated and matched by the traffic in question. Option D is correct because flow traceoptions (configured under 'security flow traceoptions') capture detailed packet-processing information, including which policy, zone, and rule the security engine evaluates for a given flow, which is the definitive way to see why traffic does or does not match a policy. Option A is incorrect because clearing the BGP routing table only affects route reachability and does not influence security policy matching logic. Option C is incorrect because resetting physical interface duplex settings addresses Layer 1/2 link issues, not policy evaluation. Option E is incorrect because restarting rpd only reloads routing protocol state and has no bearing on how the security engine matches traffic against policies.

Answer

Clear the BGP routing table

Answer

Reset physical interface duplex settings

Answer

Restart the routing protocol daemon (rpd)

Question 15

Which TWO components are typically analyzed when troubleshooting an IPsec VPN Phase 1 negotiation failure using traceoptions? (Choose two)

Accepted Answer

IKE proposal matching (encryption, authentication, Diffie-Hellman group). Phase 1 (IKE SA) negotiation failures are diagnosed by examining the IKE proposal exchange, so option B is correct: traceoptions output shows whether the initiator and responder agree on encryption algorithm, authentication method, and Diffie-Hellman group, and mismatches here cause the negotiation to fail. Option C is also correct because Phase 1 includes peer authentication, and traceoptions reveals whether the pre-shared key or digital certificate validation (e.g., certificate chain, identity, or hash mismatch) fails during the IKE exchange. Option A is wrong because BGP AS path attributes are routing policy data unrelated to IKE Phase 1. Option D is wrong because SA lifetime and Phase 2 selectors belong to Phase 2 (IPsec SA) negotiation, not Phase 1. Option E is wrong because OSPF neighbor timers are a routing protocol concern, not part of IKE negotiation.

Answer

BGP AS path attributes

Answer

IPsec Security Association lifetime and Phase 2 selectors

Answer

OSPF neighbor adjacency timers