JNCIA-SEC Monitoring And Troubleshooting Practice Test 6 — 15 Questions

Question 1

An engineer wants to view active security associations (SAs) for an IPsec VPN tunnel to troubleshoot connectivity. Which command should be used?

Accepted Answer

show security ipsec security-associations. 'show security ipsec security-associations' displays the active IPsec SAs for VPN tunnels, including SPI values, encryption/authentication algorithms, and byte counters. This is the correct command to verify Phase 2 SA state for troubleshooting tunnel connectivity.

Answer

show vpn status

Answer

show securityvpn tunnels

Answer

show security ike security-associations

Question 2

An administrator suspects that a security policy is not applying logs because the log configuration syntax was entered incorrectly. Where should the logging keyword be attached within a security policy?

Accepted Answer

Within the then statement of the policy rule. In Junos security policies, logging is enabled by adding the 'log' or 'log session-close' keyword within the 'then' statement of a policy rule. This ensures that when the policy action (permit/deny) is taken, the event is logged. The 'then' statement defines the action and any additional actions like logging, counting, or session termination. Placing logging elsewhere, such as in the match statement or zone configuration, is syntactically incorrect or does not achieve policy-specific logging.

Answer

Inside the zone configuration

Answer

At the global [edit security log] hierarchy only

Answer

Within the match statement of the policy rule

Question 3

An engineer is debugging an IPsec VPN tunnel that fails to establish. They want to enable tracing for IKE negotiations to inspect packet exchanges. Where should IKE traceoptions be configured?

Accepted Answer

[edit security ike traceoptions]. IKE tracing is configured under the [edit security ike traceoptions] hierarchy.

Answer

[edit security ipsec traceoptions]

Answer

[edit protocols ike traceoptions]

Answer

[edit system services ike traceoptions]

Question 4

While reviewing security flow traceoptions output, you see a packet dropped with the reason "Session table full". What is the immediate consequence of this event on incoming new traffic?

Accepted Answer

New traffic attempting to create a session is dropped until session table space becomes available.. When the security session table reaches its maximum capacity, new session creation requests are dropped until sessions expire or are cleared.

Answer

The SRX automatically reboots to clear memory.

Answer

Existing established sessions are immediately terminated to make room for new traffic.

Answer

Traffic is switched to stateless forwarding mode bypassing the security engine.

Question 5

An administrator needs to verify whether ALG (Application Layer Gateway) for FTP is currently enabled and active on an SRX device. Which command should be used?

Accepted Answer

show security alg status. The command 'show security alg status' displays the status (enabled or disabled) of all ALGs, including FTP, on the SRX device. This directly answers whether the FTP ALG is currently active.

Answer

show security alg ftp statistics

Answer

show system alg

Answer

show security flow alg

Question 6

Which command allows an administrator to view configured security policies on an SRX Series device?

Accepted Answer

show security policies. The 'show security policies' command is the standard Junos operational command that lists all configured security policies on an SRX, including zone context, source/destination addresses, applications, and actions. It is the direct way to view the policy set applied to traffic traversing the device.

Answer

show firewall policies

Answer

show policy security

Answer

show security flow policies

Question 7

You need to inspect the live packet flow for a specific source IP address traversing the SRX device. Which utility can you use from the Junos CLI to capture packets on a specific interface with filtering options?

Accepted Answer

monitor traffic interface <interface-name>. The monitor traffic interface command uses tcpdump-like syntax to capture and inspect live packets passing through a specified interface.

Answer

traceoptions packet-capture

Answer

show security flow packet-capture

Answer

ping diagnostic capture

Question 8

You are troubleshooting a high CPU condition on the Routing Engine and suspect that intensive logging might be the cause. Where would you check the configuration for security log rates or stream settings?

Accepted Answer

[edit security log]. Security log rates and stream settings are configured under the [edit security log] hierarchy. This includes parameters such as the maximum number of logs per second, the log mode (stream, event, etc.), and the format. The [edit system syslog] hierarchy handles system-wide syslog configuration, not security-specific log rates. The other options are either invalid or unrelated to security log rate limiting.

Answer

[edit system syslog]

Answer

[edit chassis forwarding-options log]

Answer

[edit security policies log]

Question 9

When analyzing security policy behavior and troubleshooting traffic drops, which TWO commands are most helpful for verifying policy matches and active sessions? (Choose two)

Accepted Answer

show security flow session. Option A, `show security flow session`, is correct because it displays the active session table, including source/destination addresses, ports, protocol, and the policy that permitted each flow, which is essential for confirming whether traffic is actually being matched and forwarded or dropped. Option C, `show security policy match`, is correct because it lets you test a specific source, destination, and service tuple against the policy set to see exactly which policy would match (or that no policy matches), directly verifying policy-match behavior during troubleshooting. Option B, `show security ike`, only shows IKE phase 1/2 security associations and is relevant to VPN negotiation, not general policy matching or session verification. Option D, `show system alarms`, reports chassis/system alarm conditions and does not reveal policy matches or session state. Option E, `show firewall filter`, displays stateless firewall filter (ACL) configuration/counters, which is unrelated to stateful policy match and session lookup on a Juniper SRX-style device.

Answer

show security ike

Answer

show system alarms

Answer

show firewall filter

Question 10

Which TWO actions should an administrator take when configuring security policy traceoptions to effectively debug a suspected policy drop issue? (Choose two)

Accepted Answer

Configure a target file name under traceoptions using the file statement.. Option C is correct because security policy traceoptions require a destination for the trace output, and the file statement under traceoptions specifies the target filename (e.g., set security policies traceoptions file policy-trace) where the debug log is written for later inspection. Option E is correct because traceoptions only generate output for the events you explicitly enable, so you must turn on the relevant debug flags with the flag statement, such as flag policy or flag all, to capture policy lookup and drop decisions. Option A is wrong because traceoptions take effect immediately once committed; restarting the Routing Engine is unnecessary and disruptive. Option B is wrong because stateless firewall filters are a separate filtering mechanism and are not required to debug security policy drops. Option D is wrong because disabling security zones would remove the very policy enforcement context being traced and would not help diagnose the drop.

Answer

Restart the Routing Engine to apply traceoptions.

Answer

Enable stateless firewall filters on all transit interfaces.

Answer

Disable all security zones during tracing.

Question 11

While investigating an issue where an IPsec VPN tunnel fails to pass data traffic, which THREE commands should you execute to verify Phase 1, Phase 2, and security associations? (Choose three)

Accepted Answer

show security ipsec security-associations. Option C, show security ipsec security-associations, is correct because it displays Phase 2 IPsec security associations, including the SA index, SPI, tunnel interface, and encryption/authentication algorithms, which directly verifies whether Phase 2 came up and is passing traffic. Option D, show security ike security-associations, is correct because it verifies Phase 1 by listing IKE SAs with peer addresses, role, state, and lifetime, confirming the IKE negotiation succeeded. Option E, show security ipsec statistics, is correct because it shows per-SA packet counters (ESP encrypt/decrypt, authentication failures, and replay errors), which reveals whether data traffic is actually traversing the tunnel or being dropped. Option A, show security alg status, is not relevant because ALGs handle application-layer NAT traversal (e.g., FTP, SIP) and do not verify IPsec Phase 1, Phase 2, or SAs. Option B, show security flow session summary, is not appropriate because it only gives aggregate session counts and does not show IKE/IPsec SA details or per-tunnel statistics.

Answer

show security alg status

Answer

show security flow session summary

Question 12

Which TWO methods or tools are available in Junos OS for monitoring active security sessions in real time? (Choose two)

Accepted Answer

show security flow session. Option B, 'show security flow session', is correct because it is the primary Junos OS operational command that displays the current active flow/session table in real time, showing source and destination addresses, ports, protocol, session state, and timeout for each active session. Option E, 'show security flow session summary', is correct because it is a variant of the same command that provides a real-time summarized count of active sessions (e.g., total sessions, sessions by protocol or service), which is useful for quick monitoring of session activity. Option A, 'show chassis routing-engine', is not correct because it reports Routing Engine hardware status such as CPU, memory, and temperature, not security sessions. Option C, 'show system processes', is not correct because it lists running system processes and their resource usage, not active security flows. Option D, 'show security zone statistics', is not correct because it displays per-zone packet counters and statistics rather than the active session table itself.

Answer

show chassis routing-engine

Answer

show system processes

Answer

show security zone statistics

Question 13

An administrator suspects that asymmetric routing is disrupting traffic flow through an SRX Series device. Which THREE symptoms or diagnostic indicators point toward asymmetric routing? (Choose three)

Accepted Answer

Flow traceoptions show drops with reasons such as "No session found" or reverse path validation failures.. Option B is correct because flow traceoptions (set security flow traceoptions) log packet-processing decisions, and asymmetric routing typically produces drops such as "No session found" (the return packet hits a different SRX that has no matching session) or reverse-path forwarding (RPF) validation failures when the return path differs from the incoming interface. Option D is correct because if the SYN traverses the SRX but the SYN-ACK returns via a different path that bypasses the device, the SRX never sees the completing packet, so the session stays in the 'SynSent' state and the handshake never completes. Option E is correct because asymmetric flows cause packets to arrive on interfaces that do not match the expected zone/interface pairing or session direction, triggering zone-mismatch or pairing errors and failed session creation. Option A is not a symptom of asymmetric routing, since chassis cluster failover is driven by redundancy-group monitoring and heartbeats, not by path asymmetry. Option C is also not indicative, because asymmetric routing causes forwarding/session drops rather than a Routing Engine CPU spike to 100%.

Answer

The chassis cluster fails over immediately.

Answer

CPU utilization on the Routing Engine spikes to 100%.

Question 14

Which TWO logs or log categories can an administrator examine to troubleshoot security policy actions such as permits and denies? (Choose two)

Accepted Answer

RT_FLOW session initiation and close logs (RT_FLOW_SESSION_INIT / RT_FLOW_SESSION_CLOSE). Option C is correct because RT_FLOW session logs, specifically RT_FLOW_SESSION_INIT and RT_FLOW_SESSION_CLOSE, are generated by the flow module and record the security policy action (permit or deny) applied to each session along with source/destination details, making them the primary log category for troubleshooting policy permits and denies. Option D is correct because security policy traceoptions log files capture detailed policy evaluation events, including which policy matched and whether the action was permit or deny, and are specifically designed for in-depth security policy troubleshooting. Option A is incorrect because routing protocol daemon (rpd) logs pertain to routing protocol adjacencies, route updates, and next-hop resolution, not security policy enforcement. Option B is incorrect because chassis environmental logs report hardware conditions such as temperature, fan, and power supply status, which are unrelated to policy actions. Option E is incorrect because system kernel boot logs record kernel initialization and boot-time messages, not per-session security policy decisions.

Answer

Routing protocol daemon (rpd) logs

Answer

Chassis environmental logs

Answer

System kernel boot logs

Question 15

Which THREE parameters can be adjusted under the [edit security flow timeout] hierarchy to manage session table aging? (Choose three)

Accepted Answer

tcp-established. Under the Junos [edit security flow timeout] hierarchy, session aging is controlled by per-protocol timeout values, and the valid adjustable parameters include tcp-established, icmp, and udp. Option A, tcp-established, is correct because it sets the timeout for TCP sessions that have reached the ESTABLISHED state, allowing administrators to age out long-lived TCP flows. Option B, icmp, is correct because it defines how long ICMP session entries remain in the session table before being removed. Option E, udp, is correct because it controls the aging timeout for UDP sessions, which is important since UDP is connectionless and relies on timers rather than session teardown. Options C and D are not part of the flow timeout hierarchy: bgp-hold-time is a BGP protocol timer configured under routing-options/protocols bgp, and ike-lifetime is an IPsec/IKE Phase 1 or Phase 2 parameter configured under security ike or security ipsec, not under security flow timeout.

Answer

bgp-hold-time

Answer

ike-lifetime