JNCIA-SEC Security Policies — 20 Questions

Question 1

Which TWO statements describe the default behavior of security zones in Junos OS prior to policy creation? (Choose two.)

Accepted Answer

Management traffic to the routing engine is blocked unless explicitly permitted by host-inbound-traffic settings.. Before policies are created, traffic between different zones is blocked, while traffic within the same zone is permitted.

Answer

Global policies automatically permit all interzone traffic upon zone creation.

Answer

All traffic entering any security zone requires explicit policy configuration, including intrazone traffic.

Question 2

Which TWO situations will cause a newly committed security policy to fail to match expected transit traffic? (Choose two.)

Accepted Answer

The transit interfaces involved are assigned to different security zones than those specified in the policy's source and destination zone pair.. Traffic will fail to match if interfaces are in incorrect zones or if the policy is shadowed by an earlier broad rule.

Answer

The Junos routing engine is configured in packet mode instead of flow mode.

Answer

The policy hit count counter is disabled in the action clause.

Question 3

When configuring a zone-based security policy on an SRX Series device, which three components are strictly required to define the match criteria of the policy rule?

Accepted Answer

Source zone, destination zone, and applications. A standard zone-based security policy in Junos OS requires a source zone, destination zone, and source/destination addresses or applications to evaluate traffic.

Answer

Source IP, destination MAC address, and routing instance

Answer

Global address book, security profile, and zone pair

Answer

Source interface, destination interface, and VLAN ID

Question 4

An administrator notices that traffic between the internal trust zone and the untrust zone is being dropped by the SRX Series device, despite a custom security policy allowing the traffic. Upon checking the security policies, the administrator sees that an earlier policy matching a broader set of criteria is catching and dropping the traffic before it reaches the custom policy. Which Juniper CLI command should the administrator use to trace and verify which security policy is processing a specific packet in real-time?

Accepted Answer

request security flow traceoptions file policy_trace. The correct command for real-time packet tracing of security policy evaluation on Junos OS is 'set security flow traceoptions'. This allows administrators to debug flow processing and see which policy action is applied.

Answer

monitor security flow policy-lookup

Answer

show security policies matching-packet

Answer

test security policy evaluate source-ip

Question 5

Where are address books defined when configuring zone-based security policies in Junos OS?

Accepted Answer

At the global security hierarchy or within individual security zones.. Address books can be defined globally or per security zone, but they are typically associated with security zones or the global configuration hierarchy.

Answer

Only under the system services configuration menu.

Answer

Inside the interface configuration stanza for each physical port.

Answer

Exclusively within the routing-options hierarchy.

Question 6

An administrator configures a security policy with a custom application definition that matches TCP port 8080. When testing the policy, traffic on port 8080 is matched, but the application identification engine flags the traffic as 'junos-http'. What is the reason for this behavior?

Accepted Answer

Junos AppID uses deep packet inspection and overrides custom port definitions with recognized protocol signatures.. Built-in AppID signatures take precedence over custom port-based application definitions if the protocol signature matches standard traffic patterns.

Answer

The default policy evaluation order places global policies above custom application rules.

Answer

Custom applications are disabled by default when security policies are compiled.

Answer

The security policy must be changed from zone-based to global to support custom applications.

Question 7

Which statement accurately describes zone-based security policies in Junos OS?

Accepted Answer

Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.. Zone-based security policies require traffic to be explicitly permitted between security zones, as the default behavior is deny-all.

Answer

Security policies are always applied globally and do not require zone definitions.

Answer

Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.

Answer

Policies defined under the global context take precedence over all zone-based policies.

Question 8

An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?

Accepted Answer

Enabling AppID match criteria by specifying applications within the security policy.. AppID requires application identification to be integrated into the security policy match criteria, which can be accomplished by referencing specific applications or application sets.

Answer

Attaching a security screen profile to the DMZ zone.

Answer

Enabling stateless firewall filters on the egress interface.

Answer

Configuring global policies with an idle-timeout parameter.

Question 9

You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?

Accepted Answer

An application set containing both HTTP and HTTPS.. An application set allows grouping multiple applications for simplified policy administration.

Answer

An address book entry containing the web server IP addresses.

Answer

A global policy with a service term.

Answer

A security zone profile containing the protocols.

Question 10

You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?

Accepted Answer

Configuring security flow traceoptions to log packet processing details.. Security flow traceoptions allow administrators to trace packet processing through the security engine to see why a packet is dropped or which policy it matched.

Answer

Using 'ping' with the 'do-not-fragment' bit set.

Answer

Checking the system log file for routing protocol errors.

Answer

Running 'show firewall' to inspect interface filter counters.

Question 11

You have multiple security policies configured within the context of a specific source and destination zone. A new requirement dictates that a specific subset of users must be denied access while everyone else in the same zone remains permitted. How should you order your security policies to achieve this without disrupting existing traffic?

Accepted Answer

Place the explicit deny policy for the specific subset of users above the general permit policy.. Security policies are evaluated sequentially from top to bottom. More specific rules must be placed above broader rules.

Answer

Place the general permit policy above the deny policy and set the deny policy action to 'reject'.

Answer

Convert the policies to global policies and place them at the bottom of the evaluation list.

Answer

Use an address set to combine the users and rely on automatic policy sorting by IP prefix length.

Question 12

An administrator needs to create a security policy on a Junos device that permits traffic from the trust zone to the untrust zone. Which configuration hierarchy is used to define this security policy?

Accepted Answer

[edit security policies]. Security policies in Junos OS are configured under the [edit security policies] hierarchy.

Answer

[edit firewall]

Answer

[edit security screen]

Answer

[edit interfaces security-zones]

Question 13

Which command is used to display the currently active security policies on a Junos device?

Accepted Answer

show security policies. The operational command 'show security policies' displays configured security policies.

Answer

show security zones

Answer

show firewall filter

Answer

show system security status

Question 14

You need to log every time a specific security policy is hit by traffic, including when a session is closed. Which action modifier should you configure within the security policy?

Accepted Answer

Configure 'then { permit; log { session-init; session-close; } }'.. The 'log' option in a security policy can include session-init and session-close logging.

Answer

Configure 'then { permit; syslog source-address; }'.

Answer

Configure 'then { permit; alarm; }'.

Answer

Configure 'then { permit; count; }'.

Question 15

What is the primary difference between a zone-based security policy and a global security policy in Junos OS?

Accepted Answer

Global policies apply across all security zones without requiring explicit source and destination zone pairs in the rule.. Zone-based policies specify source and destination zones explicitly, whereas global policies apply across all zones without specifying zone pairs in the match criteria.

Answer

Global policies bypass stateful inspection, whereas zone-based policies enforce it.

Answer

Zone-based policies are evaluated after global policies.

Answer

Global policies can only be used for IPv6 traffic, while zone-based policies handle IPv4.

Question 16

You want to create a security policy that applies to traffic originating from a specific address book entry named 'HQ-Net' in the 'trust' zone destined for 'Branch-Net' in the 'untrust' zone. Where must the 'HQ-Net' address be defined?

Accepted Answer

Within the address-book configuration of the 'trust' zone or at the global address-book level.. Address entries can be defined either globally or inside the specific zone configuration.

Answer

Directly within the system login configuration block.

Answer

Inside the routing-options static route definition.

Answer

As an interface unit attribute under the [edit interfaces] hierarchy.

Question 17

An administrator configures a security policy with the action set to 'reject'. Another policy uses the action 'deny'. What is the functional difference between these two actions when a packet matches the policy?

Accepted Answer

'reject' sends an ICMP unreachable message back to the packet source, whereas 'deny' silently drops the packet.. The 'reject' action sends an ICMP unreachable message back to the source, whereas 'deny' (drop) silently discards the packet.

Answer

'reject' drops the packet silently, whereas 'deny' sends an ICMP unreachable message.

Answer

'reject' logs the event to the system log, whereas 'deny' suppresses all logging.

Answer

'reject' requires stateful session tracking, whereas 'deny' is applied statelessly.

Question 18

An auditor points out that a security policy configured on your SRX device is completely shadowed by an earlier policy in the same zone pair. What does policy shadowing mean in this context?

Accepted Answer

A preceding policy has broader or identical match criteria that catches all traffic intended for the subsequent policy.. Policy shadowing occurs when a preceding policy completely encompasses the match criteria of a subsequent policy, rendering the later policy unreachable.

Answer

The shadowed policy is missing a valid source zone definition.

Answer

The routing engine has cached an old version of the policy table.

Answer

The shadowed policy is using global scope instead of zone-based scope.

Question 19

What happens to return traffic for an established session that was originally permitted by a security policy?

Accepted Answer

Return traffic is automatically permitted by the stateful inspection engine without requiring a reverse security policy.. Junos is a stateful firewall; return traffic belonging to an established session is automatically permitted without needing a separate return policy.

Answer

Return traffic is dropped unless stateless firewall filters permit it.

Answer

Return traffic is evaluated against global policies only.

Answer

A separate security policy allowing traffic from the destination zone back to the source zone must be explicitly configured.

Question 20

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies.. Junos evaluates zone-based policies first, followed by global policies if no zone-based policy matches.

Answer

All policies, both global and zone-based, are evaluated in a single combined sequence based strictly on rule naming alphabetically.

Answer

Policies are evaluated based on IP prefix length regardless of whether they are global or zone-based.

Answer

Global policies are evaluated first, followed by zone-based policies.