JNCIA-SEC Multiple Select — 40 Questions

Question 1

Which THREE parameters can be configured within a UTM policy profile on a Juniper SRX Series firewall? (Choose three.)

Accepted Answer

Antispam profile reference. A UTM policy profile on a Juniper SRX is essentially a container that binds together the various content-security profiles applied to traffic, so option B (Antispam profile reference) is correct because the UTM policy specifies which antispam profile to use for matching traffic. Option D (Antivirus profile reference) is correct because the UTM policy likewise references an antivirus profile to scan sessions for malware. Option E (Web-filtering profile reference) is correct because the UTM policy also references a web-filtering (URL filtering) profile to categorize and block or permit web content. Options A and C are incorrect: IPsec VPN IKE gateway settings are configured under the VPN/IKE hierarchy, not inside a UTM policy, and BGP routing protocol parameters belong to routing-options/protocols configuration, which is unrelated to UTM content security.

Answer

IPsec VPNike gateway settings

Answer

BGP routing protocol parameters

Question 2

Which THREE types of logging modifiers are available when configuring logging in a Junos security policy? (Choose three.)

Accepted Answer

session-init. In Junos security policy configuration, the log option accepts three logging modifiers: session-init, session-close, and periodic. Option B (session-init) is correct because it generates a log entry when a session is first established, capturing the initial session setup details. Option D (session-close) is correct because it logs when a session is torn down, recording session termination information such as bytes transferred. Option E (periodic) is correct because it produces log entries at regular intervals during the lifetime of a long-lived session, providing ongoing session statistics. Options A (packet-drop-immediate) and C (state-change-alert) are not valid Junos logging modifiers for security policies; they do not exist as configurable log options in the Junos security policy syntax.

Answer

packet-drop-immediate

Answer

state-change-alert

Question 3

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

Accepted Answer

Security zones. Security zones, address books, and screen options are all configured under [edit security].

Answer

VLAN bridge domain definitions

Answer

BGP routing protocol peering parameters

Question 4

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

Accepted Answer

Custom applications can include inactivity timeout settings.. Custom applications allow specifying protocol, source ports, and destination ports for policy matching.

Answer

Custom applications automatically generate Application Layer Gateways for proprietary protocols without manual configuration.

Answer

Custom applications are restricted to global policies only and cannot be used in zone-to-zone policies.

Answer

Custom applications can overwrite built-in predefined Junos applications if named identically.

Question 5

An administrator is configuring a chassis cluster on two SRX Series devices. Which THREE requirements must be met to ensure proper cluster formation and stability? (Choose three)

Accepted Answer

Both devices must be the exact same SRX hardware model and run the same Junos OS version.. Option B is correct because a chassis cluster requires identical SRX hardware models and matching Junos OS versions so that the control and fabric links, redundancy groups, and failover logic operate consistently between the two nodes. Option C is correct because each node must have a unique node ID (Node 0 and Node 1) assigned, which is essential for the cluster to identify members, form redundancy groups, and manage failover correctly. Option D is correct because dedicated fabric and control links (fab0/fab1) must be physically connected between the nodes to carry cluster control traffic, heartbeats, and fabric forwarding, which are required for proper cluster formation and stability. Option A is not required because cluster control ports are internal links between the two SRX devices, not connections to an external public internet switch. Option E is incorrect because running different Junos OS major versions is unsupported and would prevent stable cluster formation, not prevent split-brain.

Answer

Cluster control ports must connect to an external public internet switch.

Answer

Both devices must have different Junos OS major versions to prevent split-brain.

Question 6

Which TWO tasks are primarily handled by the Routing Engine (RE) on a dual-RE physical SRX Series device? (Choose two)

Accepted Answer

Executing the routing protocol daemon (rpd) to exchange routing information. The Routing Engine manages control plane tasks, such as running the routing protocol daemon (rpd) and managing device access and configuration. Data plane tasks like session creation and packet forwarding are handled by the PFE/SPU.

Answer

Executing physical layer framing on physical interface transceivers

Answer

Processing high-speed security sessions and firewall policy enforcement

Answer

Performing hardware-accelerated NAT translations in the data plane

Question 7

When configuring physical and logical interfaces on an SRX Series device, which TWO parameters are required to properly define a logical unit for IP routing? (Choose two)

Accepted Answer

Family inet IP address assignment. Option D is correct because a logical unit must be assigned an IP address under a protocol family, and for IP routing this is done with the family inet address statement (e.g., set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/24), which gives the interface its routable Layer 3 identity. Option E is correct because every logical interface is identified by a unit number, such as unit 0, and this unit number is what binds the configuration stanza (family inet address, VLAN tagging, etc.) to a specific logical interface on the physical port. Option A is not required because BGP is a routing protocol that is configured separately under protocols bgp with an autonomous system number; it is not part of defining a logical unit for IP routing. Option B is not required because a redundancy group ID is only used in chassis cluster configurations to control failover, not to define a logical interface. Option C is not required because MAC address override is an optional Layer 2 setting used in specific scenarios such as certain HA or switching designs, not a mandatory parameter for a logical unit carrying IP routing.

Answer

BGP autonomous system number

Answer

Chassis cluster redundancy group ID

Answer

MAC address override

Question 8

Which TWO troubleshooting steps should an administrator take when a Source NAT pool reports port exhaustion? (Choose two)

Accepted Answer

Configure port-sharing or review persistent-nat settings to optimize port distribution across pool addresses.. Option B is correct because Source NAT port exhaustion occurs when the available source ports on the pool's IP addresses are consumed; enabling port-sharing (allowing multiple sessions to share translated ports via different source addresses/ports) or reviewing persistent NAT settings (which can pin mappings and reduce reusable ports) directly optimizes how ports are distributed across the pool addresses. Option D is correct because the fundamental capacity limit is (number of pool IPs × available ports per IP), so adding more public IP addresses to the source NAT pool increases the total port capacity and relieves exhaustion. Option A is wrong because clearing the routing forwarding table does not free NAT port allocations and would disrupt traffic without addressing the port shortage. Option C is wrong because converting Source NAT to Destination NAT changes the traffic direction/purpose entirely and does not solve outbound translation port exhaustion. Option E is wrong because disabling security flow processing on the trust zone would break stateful inspection and NAT processing rather than resolve the port exhaustion.

Answer

Clear the routing forwarding table.

Answer

Convert all Source NAT rules into Destination NAT rules.

Answer

Disable security flow processing on the trust zone.

Question 9

Which THREE statements are true regarding Junos security policy configuration hierarchy and syntax? (Choose three.)

Accepted Answer

Policies are evaluated top-down within their specific zone pair context.. Option A is correct because Junos security policies are evaluated in a top-down, first-match order within the specific zone-pair context (from-zone X to-zone Y), so the first matching policy's action is applied and subsequent policies are not evaluated. Option B is correct because the configuration hierarchy organizes policies under the zone-pair structure, i.e., security policies are defined under 'from-zone to-zone ' stanzas, which is the fundamental organizational model in Junos. Option D is correct because a single security policy can contain multiple match terms (source-address, destination-address, application, etc.), and all terms within a policy must match for the policy's action to be applied. Option C is incorrect because Junos uses a candidate configuration model; policy changes must be committed with the 'commit' command before they take effect. Option E is incorrect because security policies can be configured via the CLI (set security policies from-zone ... to-zone ...) as well as J-Web, so they are not limited to J-Web.

Answer

Policy configuration changes take effect immediately without requiring a commit command.

Answer

Policies can only be configured via J-Web and are unsupported on the CLI.

Question 10

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

Accepted Answer

SIP (Session Initiation Protocol). SIP (B) is correct because SIP signaling embeds IP addresses and port numbers in its message bodies (SDP payloads), so a Junos ALG must inspect and rewrite those fields to open the correct pinholes for the RTP media streams. TFTP (C) is correct because it negotiates a dynamic secondary UDP port during the initial exchange, and the Junos TFTP ALG opens that data-channel pinhole automatically. FTP (D) is correct because FTP uses a separate data connection whose port is signaled in the control channel (PORT/PASV), requiring the Junos FTP ALG to inspect and permit that dynamic flow. HTTP (A) is not marked correct because it is a single-connection protocol that does not embed dynamic addressing requiring ALG pinhole creation, and SSH (E) is not marked correct because it runs over a single TCP port 22 without negotiated secondary data channels.

Answer

HTTP (Hypertext Transfer Protocol)

Answer

SSH (Secure Shell)

Question 11

Which TWO protocols are supported for Antivirus scanning within Juniper SRX UTM profiles? (Choose two.)

Accepted Answer

HTTP. Options A (HTTP) and D (SMTP) are correct because Juniper SRX UTM antivirus profiles support scanning of the HTTP, SMTP, POP3, IMAP, FTP, and SMB protocols, so HTTP and SMTP are both valid protocol types for antivirus scanning. HTTP scanning inspects web traffic for malicious content, while SMTP scanning inspects email traffic for virus attachments. The remaining options do not belong: BGP is a routing protocol, SNMP is used for network management, and NTP is used for time synchronization, none of which carry user file content that UTM antivirus would scan.

Answer

BGP

Answer

SNMP

Answer

NTP

Question 12

While investigating an issue where an IPsec VPN tunnel fails to pass data traffic, which THREE commands should you execute to verify Phase 1, Phase 2, and security associations? (Choose three)

Accepted Answer

show security ipsec security-associations. Option C, show security ipsec security-associations, is correct because it displays Phase 2 IPsec security associations, including the SA index, SPI, tunnel interface, and encryption/authentication algorithms, which directly verifies whether Phase 2 came up and is passing traffic. Option D, show security ike security-associations, is correct because it verifies Phase 1 by listing IKE SAs with peer addresses, role, state, and lifetime, confirming the IKE negotiation succeeded. Option E, show security ipsec statistics, is correct because it shows per-SA packet counters (ESP encrypt/decrypt, authentication failures, and replay errors), which reveals whether data traffic is actually traversing the tunnel or being dropped. Option A, show security alg status, is not relevant because ALGs handle application-layer NAT traversal (e.g., FTP, SIP) and do not verify IPsec Phase 1, Phase 2, or SAs. Option B, show security flow session summary, is not appropriate because it only gives aggregate session counts and does not show IKE/IPsec SA details or per-tunnel statistics.

Answer

show security alg status

Answer

show security flow session summary

Question 13

Which TWO methods or tools are available in Junos OS for monitoring active security sessions in real time? (Choose two)

Accepted Answer

show security flow session. Option B, 'show security flow session', is correct because it is the primary Junos OS operational command that displays the current active flow/session table in real time, showing source and destination addresses, ports, protocol, session state, and timeout for each active session. Option E, 'show security flow session summary', is correct because it is a variant of the same command that provides a real-time summarized count of active sessions (e.g., total sessions, sessions by protocol or service), which is useful for quick monitoring of session activity. Option A, 'show chassis routing-engine', is not correct because it reports Routing Engine hardware status such as CPU, memory, and temperature, not security sessions. Option C, 'show system processes', is not correct because it lists running system processes and their resource usage, not active security flows. Option D, 'show security zone statistics', is not correct because it displays per-zone packet counters and statistics rather than the active session table itself.

Answer

show chassis routing-engine

Answer

show system processes

Answer

show security zone statistics

Question 14

An administrator is troubleshooting a policy drop issue using security flow traceoptions. Which THREE configuration elements are required to successfully generate trace output? (Choose three)

Accepted Answer

Configure match criteria (such as source-ip or destination-ip) to isolate specific traffic.. To generate security flow traceoptions output, you must first define match criteria such as source-ip or destination-ip (option A) so the trace only captures the specific traffic being troubleshot rather than flooding the file with all flows. You must also configure the flag parameter (option B), which selects the specific events or packet types (for example basic-datapath, flow, or packet) that the trace will record. Finally, you must define a trace file name with optional size and count parameters (option E), because traceoptions write their results to a configured file and without a filename no output is produced. Option C is incorrect because the policy action (permit, deny, or reject) is irrelevant to whether trace output is generated; traceoptions can capture traffic regardless of the action taken. Option D is incorrect because security flow traceoptions is a Junos CLI feature and does not require kernel-level debugging through the FreeBSD shell.

Answer

Set the security policy action to 'reject' for the targeted traffic.

Answer

Enable kernel-level debugging via the FreeBSD shell.

Question 15

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Accepted Answer

Address book entries / Address sets. In Junos OS security policies, match criteria are built from address book entries and address sets (option B), which define the source and destination IP objects the policy evaluates, and from applications and application sets (option D), which define the Layer 4/7 services (e.g., junos-http, junos-ssh) permitted or denied. Both are standard configurable objects referenced under 'match source-address/destination-address' and 'match application' in a security policy. Functional zone names (option A) are used for interface classification and host-inbound traffic, not as payload-inspection match criteria, so they are not policy objects. SCREEN option profiles (option C) are referenced in zone configurations for IDS/attack detection, not inside security policies. Hardware crypto processor allocation maps (option E) are used for IPsec/flow crypto resource assignment, not as security policy match objects.

Answer

Functional zone names directly as match criteria for payload inspection

Answer

SCREEN option profiles

Answer

Hardware crypto processor allocation maps

Question 16

Which THREE parameters must be configured when setting up a DNSBL (DNS Black List) server profile for Antispam inspection on a Juniper SRX Series device? (Choose three.)

Accepted Answer

Server type (such as rbl or svbl). When configuring a DNSBL server profile for antispam inspection on a Juniper SRX, option A (Server type such as rbl or svbl) is required because the profile must specify which kind of blacklist lookup is being performed, e.g., an RBL for real-time blackhole lists or an SVBL for sender-verify blacklists. Option B (Server domain name or IP address) is required because the SRX must know which DNSBL server to query, such as a hostname or IP address of the blacklist provider. Option D (Expected DNS reply code or threshold IP indicating spam) is required because the device must interpret the DNSBL response, for example a 127.0.0.x reply or a configured threshold that identifies the sender as spam. Options C and E are not part of the DNSBL profile configuration: SMTP encryption certificates and private keys are used for TLS-related mail security settings, while POP3/IMAP proxy ports are irrelevant because DNSBL antispam inspection operates on SMTP and DNS lookups, not POP3 or IMAP proxy services.

Answer

SMTP encryption certificate and private key

Answer

POP3/IMAP proxy port numbers

Question 17

Which TWO statements are true regarding Junos OS configuration hierarchies? (Choose two)

Accepted Answer

Configuration is structured hierarchically using curly braces and indentation.. Option A is correct because Junos OS stores its configuration as a hierarchical tree of statements, and the CLI represents that hierarchy with curly braces and indentation to show parent/child relationships (for example, interfaces { ge-0/0/0 { unit 0 { family inet { address ... } } } }). Option D is correct because Junos supports multiple users editing the shared candidate configuration, and each user's changes remain in the candidate until a commit is issued; users can also use private candidate configurations so their edits are isolated from others. Option B is wrong because configuration-mode edits only modify the candidate configuration and do not take effect until you run the commit command. Option C is wrong because Junos configuration syntax uses normal alphanumeric keywords and values, not lowercase hexadecimal. Option E is wrong because the CLI can display configuration in set format using commands such as show configuration | display set.

Answer

Changes made in configuration mode take effect immediately without a commit.

Answer

Configuration commands must be typed entirely in lowercase hexadecimal.

Answer

The CLI cannot display configuration in set format.

Question 18

Which TWO actions occur during the initial packet flow processing on an SRX Series device when a new session is established? (Choose two)

Accepted Answer

Route lookup (destination routing table check). When a new session is established, the SRX performs a route lookup and evaluates security policies to determine whether to permit or deny the flow.

Answer

Immediate CPU kernel panic generation

Answer

Automatic conversion of IPv4 to IPv6

Answer

Immediate flooding of the packet to all zone interfaces

Question 19

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Accepted Answer

IP address range objects. Address sets can contain individual IPv4 addresses, IPv6 addresses, IP ranges, DNS FQDN objects, or other address sets.

Answer

Application Layer Gateway profiles

Answer

Security zone interface names

Question 20

Which THREE parameters are typically included in security flow traceoptions output when troubleshooting dropped packets? (Choose three)

Accepted Answer

Packet reception and interface context. Option A is correct because security flow traceoptions output begins with the packet's ingress context, showing the receiving interface, source/destination addresses, and ports so you can confirm the packet actually arrived and on which interface. Option D is correct because the trace records the security policy lookup, including the zone context and the policy that was evaluated and matched (or failed to match), which is essential for understanding how the session was handled. Option E is correct because the trace explicitly logs the drop reason when a packet is discarded, such as a policy deny, a screen violation, or a TCP/IP stack rejection, which directly identifies why the packet did not pass. Option B is not relevant because chassis power supply voltage is hardware/environmental monitoring data, not part of flow traceoptions packet processing. Option C is not relevant because BGP AS path recomputation is a routing protocol event and is not included in security flow traceoptions output.

Answer

Chassis power supply voltage levels

Answer

BGP AS path recomputation steps