JNCIA-SEC Quick Quiz — 10 Questions

Question 1

You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?

Accepted Answer

ip spoofing. IP spoofing detection in SCREEN options checks if incoming packets have source addresses matching the local router interfaces or martian networks.

Answer

icmp ping-sweep block

Answer

tcp syn-fraud detection

Answer

land attack prevention

Question 2

Which operational command should you use to view active stateful firewall sessions currently passing through an SRX Series device?

Accepted Answer

show security flow session. `show security flow session` is the operational command that displays the stateful session table on an SRX, including source/destination IPs, ports, protocol, policy name, and session state (e.g., 'Forward', 'Drop'). It is the primary tool for verifying that traffic is being permitted and tracked by the flow daemon.

Answer

show security policies active

Answer

show route active-sessions

Answer

show interfaces extensive session

Question 3

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool is exhausted, the SRX cannot allocate a new source port for a new session. Since NAT is a mandatory step in the first path packet processing for that policy, the session creation fails and the packet is dropped. The 'show security nat source pool' command would show the pool's utilization at 100%, confirming resource exhaustion.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 4

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

Accepted Answer

Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.. In Juniper SRX source NAT, rules within a rule-set are evaluated top-down and the first match wins, so a broad or restrictive rule placed above a more specific rule will shadow it. The fix is to order rules from most specific to least specific, or to split rules into separate rule-sets per zone so that Zone A's restrictive rules cannot interfere with Zone B's traffic. This restores correct pool selection and prevents the session drops Zone B is experiencing.

Answer

Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

Answer

Enable global zone-bypass mode for all source NAT pools.

Answer

Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

Question 5

What is the primary role of the Routing Engine (RE) in an enterprise SRX Series gateway?

Accepted Answer

Executing control plane functions, running Junos OS, managing routing protocols, and processing device configuration. The Routing Engine (RE) in an SRX Series gateway is responsible for control plane functions: it runs Junos OS, manages routing protocols, processes configuration, and handles management tasks. It does not forward data traffic; that is the role of the Packet Forwarding Engine (PFE).

Answer

Encrypting IPsec VPN traffic using specialized cryptographic hardware chips

Answer

Processing stateful packet inspection and fast-path data forwarding

Answer

Providing physical Ethernet port switching

Question 6

An administrator is troubleshooting a vSRX deployment where packet forwarding performance is severely degraded. They suspect that the virtual interfaces are not utilizing direct memory access or optimized packet processing drivers. Which virtualization technology integration is critical for optimal vSRX performance?

Accepted Answer

SR-IOV or DPDK integration. SRIOV (Single Root I/O Virtualization) or DPDK (Data Plane Development Kit) is essential for high-performance virtual packet processing in vSRX deployments.

Answer

Virtual machine snapshot scheduling

Answer

SNMP v3 trap forwarding

Answer

RADIUS accounting synchronization

Question 7

You need to inspect the live packet flow for a specific source IP address traversing the SRX device. Which utility can you use from the Junos CLI to capture packets on a specific interface with filtering options?

Accepted Answer

monitor traffic interface <interface-name>. The monitor traffic interface command uses tcpdump-like syntax to capture and inspect live packets passing through a specified interface.

Answer

traceoptions packet-capture

Answer

show security flow packet-capture

Answer

ping diagnostic capture

Question 8

An administrator configures a Source NAT rule-set with 'from zone trust' and 'to zone untrust'. Internal users can successfully browse the internet. Later, a new interface and zone (DMZ) are added, and hosts in the DMZ also need Source NAT to the untrust zone using the same pool. What is the most efficient way to achieve this?

Accepted Answer

Modify the existing rule-set to include the DMZ zone in the 'from zone' statement, or create an additional rule-set for the DMZ zone.. The most efficient approach is to either modify the existing rule-set's 'from zone' statement to include the DMZ zone (if the same pool and translation are desired) or create an additional rule-set for the DMZ zone. This reuses the existing NAT pool and configuration without global changes, preserving the trust zone rule-set's specificity.

Answer

Enable global NAT mode under the system hierarchy to automatically apply NAT across all zones.

Answer

Delete the trust zone rule-set and recreate it globally without specifying any source zone.

Answer

Configure static routes from the DMZ zone directly to the untrust zone to bypass NAT requirements.

Question 9

An administrator configures a security policy with source address set 'Internal-Subnets', destination address 'Any', and application 'junos-ftp'. During testing, active FTP data connections (PASV mode) are failing. What security policy consideration is most relevant to fixing this issue?

Accepted Answer

The FTP Application Layer Gateway (ALG) must be enabled to dynamically open security sessions for data channels.. FTP uses dynamically negotiated data ports, requiring the Junos ALG (Application Layer Gateway) for FTP to be active so security policies dynamically permit the data channel.

Answer

The security policy action must be changed from 'permit' to 'allow-pasv'.

Answer

FTP must be replaced with SFTP because security policies cannot support stateful FTP parsing.

Answer

A separate security policy must be created allowing traffic from untrust back to trust for port 20.

Question 10

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.