JNCIA-SEC Network Address Translation Practice Test 5 — 15 Questions

Question 1

Which Junos operational command allows an administrator to verify the configuration syntax and structure of all NAT rules before committing?

Accepted Answer

commit check. Before committing changes in Junos, the 'commit check' command verifies configuration syntax and logical consistency across all stanzas including NAT.

Answer

test security nat syntax

Answer

verify security nat configuration

Answer

check nat rules

Question 2

An administrator configures Source NAT with a pool. To ensure that traffic matching the NAT rule is logged, where should security logging be enabled for NAT sessions in Junos OS?

Accepted Answer

In the security policy permitting the traffic, by adding logging action modifiers.. Session logging, including NAT translation details, is configured within the security policies ('then log session-init' or 'session-close') that permit the traffic, rather than inside the NAT rule hierarchy directly.

Answer

Under the security nat source rule-set hierarchy using the 'log session' statement.

Answer

Within the NAT pool definition using the 'log-allocations' command.

Answer

Globally under the 'system syslog facility security' hierarchy.

Question 3

Which TWO of the following are valid types of Network Address Translation supported on Juniper Networks SRX Series devices running Junos OS? (Choose two)

Accepted Answer

Source NAT. Junos OS supports Source NAT, Destination NAT, and Static NAT as its core NAT architectures.

Answer

Transparent NAT

Answer

Dynamic Layer 2 NAT

Answer

Asymmetric Routing NAT

Question 4

When configuring a Source NAT pool on a Junos OS device, which TWO parameters can be specified within the pool configuration hierarchy? (Choose two)

Accepted Answer

address range. Source NAT pool configurations include defining the address range and port translation parameters (such as port overloading).

Answer

security zone binding

Answer

firewall filter attachment

Answer

routing instance next-hop

Question 5

Which THREE operational commands are valid for troubleshooting NAT and flow sessions on a Junos OS SRX Series device? (Choose three)

Accepted Answer

show security nat pool. Valid troubleshooting commands include checking security flow sessions, NAT rule-sets, and NAT pools.

Answer

show system nat-cache status

Answer

show firewall nat-counters

Question 6

Which TWO configuration components are mandatory when defining a Source NAT rule-set in Junos OS? (Choose two)

Accepted Answer

from zone. Source NAT rule-sets require source zones ('from zone') and destination zones ('to zone') to define scope.

Answer

routing-instance binding

Answer

interface MTU specification

Answer

global ARP timeout

Question 7

Which TWO methods can be used to perform Source NAT on a Junos OS SRX Series device? (Choose two)

Accepted Answer

Interface-based Source NAT. Source NAT can be implemented using interface-based NAT or pool-based NAT.

Answer

Broadcast Source NAT

Answer

Policy-less Source NAT

Answer

Loopback-based Source NAT

Question 8

Which TWO statements are correct regarding the evaluation order and behavior of NAT in Junos OS? (Choose two)

Accepted Answer

Destination NAT is evaluated before Source NAT.. Junos evaluates Destination NAT first and Static NAT last. Rules within rule-sets are evaluated top-down.

Answer

Source NAT rule-sets ignore source zones during packet processing.

Answer

All NAT rules are evaluated simultaneously using longest-prefix matching.

Answer

Static NAT is evaluated before Destination NAT.

Question 9

When configuring Destination NAT and Static NAT on Junos OS, which THREE requirements must be met for inbound traffic to successfully reach an internal server? (Choose three)

Accepted Answer

A security policy must permit traffic from the external zone to the internal zone using the post-translation IP address.. Inbound NAT requires a valid NAT rule, security policies permitting the post-translation traffic, and a valid route to the internal server.

Answer

The security policy must reference the pre-translation public IP address.

Answer

Proxy ARP must be disabled on all internal interfaces.

Question 10

Which TWO features or settings are associated with troubleshooting or optimizing Port Address Translation (PAT) in Junos OS? (Choose two)

Accepted Answer

Persistent NAT configuration for port consistency. PAT optimization and troubleshooting involve monitoring pool utilization and configuring persistent NAT for session consistency.

Answer

Configuring static ARP entries for every PAT port

Answer

Modifying control plane CPU priority for NAT timers

Answer

Disabling flow-based forwarding globally

Question 11

Which THREE conditions or configurations can cause asymmetric routing or session drops when implementing Destination NAT or Static NAT? (Choose three)

Accepted Answer

The internal server's default gateway does not point to the SRX device.. Asymmetric routing and session drops can be caused by internal servers lacking default gateways pointing to the SRX, missing hairpin NAT for local clients, or security policy blocks.

Answer

Configuring top-down sequential rule evaluation.

Answer

Enabling Proxy ARP on the external egress interface.

Question 12

Which TWO statements describe the behavior of Static NAT on Junos OS devices? (Choose two)

Accepted Answer

It provides a one-to-one mapping between a public IP address and a private IP address.. Static NAT provides a 1:1 mapping between public and private IPs and is inherently bidirectional.

Answer

It requires interface-based NAT to function on external ports.

Answer

It requires port overloading (PAT) to share a single public IP among multiple hosts.

Answer

It is evaluated before Destination NAT in the Junos NAT processing order.

Question 13

Which TWO Junos CLI commands are valid configuration shortcuts or roots when managing security NAT? (Choose two)

Accepted Answer

show security nat rule-set. Valid NAT roots include 'edit security nat' and viewing rule-sets via operational commands.

Answer

edit system nat-mode

Answer

edit routing-options nat-pool

Answer

show firewall nat-status

Question 14

Which TWO elements are required within a Junos Destination NAT rule definition? (Choose two)

Accepted Answer

Then destination-nat pool statement. Destination NAT rules require match destination criteria and translation action (pool).

Answer

Global routing instance override

Answer

Interface MTU command

Answer

Source NAT pool binding

Question 15

When configuring Proxy ARP for Static NAT or Destination NAT on an SRX Series device, which THREE operational or configuration practices must be considered? (Choose three)

Accepted Answer

Proxy ARP must be enabled on the external interface facing the upstream router.. Proxy ARP requires proper interface association, matching public IP subnets reachable by the upstream router, and enabling it on the external interface.

Answer

Proxy ARP automatically performs port address translation for ICMP packets.

Answer

Proxy ARP is required for internal trusted interface clients accessing local servers.