JNCIA-SEC Security Policies — 25 Questions

Question 1

An administrator configures a security policy with a custom application definition that matches TCP port 8080. When testing the policy, traffic on port 8080 is matched, but the application identification engine flags the traffic as 'junos-http'. What is the reason for this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Junos AppID uses deep packet inspection and overrides custom port definitions with recognized protocol signatures.. Built-in AppID signatures take precedence over custom port-based application definitions if the protocol signature matches standard traffic patterns.

Answer

The default policy evaluation order places global policies above custom application rules.

Answer

Custom applications are disabled by default when security policies are compiled.

Answer

The security policy must be changed from zone-based to global to support custom applications.

Question 2

Which Junos feature allows you to bundle multiple security policies into a single logical container for easier management and application across multiple zones?

Accepted Answer

Configuring security policies grouped by source-zone and destination-zone pairs.. In Junos zone-based security policies, policies are organized by source-zone and destination-zone pairs (e.g., trust-to-untrust), which acts as the logical container grouping related policy rules for that zone context. This structure simplifies management because all rules governing traffic between a given pair of zones are grouped together and evaluated in order within that context.

Answer

Using global policy sets exclusively.

Answer

Creating zone-less logical tunnels.

Answer

Applying firewall filter term bundles.

Question 3

You want to ensure that any traffic matching a specific policy is directed to a logical tunnel interface for service chaining. Which policy action element supports this requirement?

Accepted Answer

Using unified policies with advanced services integration.. Advanced policy actions such as redirect or source NAT can be applied, but routing-instance or tunnel options are handled via Junos services. Wait, Junos security policies support application of advanced features like UTM, IDP, and forwarding to logical interfaces using policy-based routing or Junos AppSecure features. Let's check policy action parameters. Junos policies support 'then { permit; ... }'. For redirection, services are used. Let's frame the question around policy-based routing or structured actions.

Answer

Using the 'then { redirect-to-interface; }' action.

Answer

Defining a routing-instance hop inside the policy match criteria.

Answer

Setting the policy action to 'forward-stateless'.

Question 4

An administrator configures a security policy with a custom application definition that matches TCP port 8080. When testing the policy, traffic on port 8080 is matched, but the application identification engine flags the traffic as 'junos-http'. What is the reason for this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Running the 'test security flow' operational command with source IP, destination IP, and protocol parameters.. The 'security flow' test command allows administrators to simulate packet matching against security policies.

Answer

Reviewing the output of 'show route table inet.0 policy-match'.

Answer

Executing 'show security policy-hit-count --simulate'.

Answer

Using 'traceroute' with the security-check flag enabled.

Question 5

An administrator notices that security policy hit counts are not incrementing for a specific policy even though traffic is passing through the device. What is the most likely cause of this behavior?

Accepted Answer

The 'count' option was omitted from the policy action clause.. Policy hit counters must be explicitly enabled using the 'count' option in the policy action clause, or they may be disabled by default depending on Junos version and platform settings.

Answer

Hit counts only update when sessions are closed, and no sessions have timed out yet.

Answer

The policy is shadowed by a global policy.

Answer

The policy is configured with the 'reject' action instead of 'permit'.

Question 6

Which Junos configuration statement is used to insert a new security policy directly above an existing policy within the same zone pair?

Accepted Answer

insert security policies from trust to untrust policy new-policy before policy old-policy. The 'insert' command is used in Junos configuration mode to position policies relative to each other.

Answer

set security policies from trust to untrust policy new-policy priority top

Answer

move security policies from trust to untrust policy new-policy position 1

Answer

edit security policies from trust to untrust policy new-policy sequence 1

Question 7

You want to limit a security policy so that it only applies during non-business hours. After creating a scheduler object, where do you attach it to enforce this restriction?

Accepted Answer

Within the specific security policy configuration under the policy terms.. In Junos security policies, a scheduler object is attached within the specific security policy configuration under the policy terms. This allows the policy to be active only during the defined time ranges. The scheduler is referenced in the policy's 'then' or 'from' clause, depending on the Junos version, but it is always part of the policy definition itself. This is the correct place to enforce time-based restrictions on a per-policy basis.

Answer

Inside the system time-zone configuration menu.

Answer

Under the security zone configuration hierarchy.

Answer

Within the global address book configuration.

Question 8

Which TWO statements describe the behavior and characteristics of global security policies in Junos OS? (Choose two.)

Accepted Answer

Global policies do not require source and destination zones to be specified in their definition.. Option D is correct because a global policy in Junos OS is defined without a from-zone or to-zone context, so it applies across all zones and does not require source and destination zones to be specified. Option E is correct because global policies support the same match conditions as zone-based policies, including application and address-book match criteria, allowing them to filter traffic based on applications and address objects. Option A is incorrect because global policies still pass through the stateful flow-based security processing and do not bypass stateful inspection. Option B is incorrect because global policies apply to both IPv4 and IPv6 traffic, not IPv6 only. Option C is incorrect because zone-based policies are evaluated first, and global policies are evaluated only if no zone-based policy matches the traffic.

Answer

Global policies bypass stateful inspection and operate statelessly.

Answer

Global policies are restricted to IPv6 traffic only.

Answer

Global policies are evaluated before zone-based policies in the security evaluation pipeline.

Question 9

Which TWO methods can be used to view security policy hit counts and operational status on a Junos device? (Choose two.)

Accepted Answer

show security policies hit-count. Option C, 'show security policies hit-count', is correct because this operational-mode command on Junos SRX devices displays the per-policy hit counters along with the policy's state (enabled/disabled), directly satisfying the requirement to view both hit counts and operational status. Option E, 'show security policies detail', is also correct because the detail variant of the security policy command outputs each policy's configuration plus its operational status and statistics, including hit counts, giving the same required visibility. Option A, 'show firewall filter detail', is incorrect because it only shows stateless firewall filter counters and does not report security policy hit counts or policy status. Option B, 'show route table inet.0 statistics', is incorrect because it reports routing table statistics, which are unrelated to security policy counters. Option D, 'show system services status', is incorrect because it displays status of system services (such as daemons), not security policy hit counts or policy operational state.

Answer

show firewall filter detail

Answer

show route table inet.0 statistics

Answer

show system services status

Question 10

Which TWO factors must be considered when designing security policies that incorporate AppID (Application Identification)? (Choose two.)

Accepted Answer

If AppID cannot identify an application, it falls back to the underlying port-based protocol definition if configured.. Option B is correct because AppID performs deep packet inspection to identify applications, but when it cannot positively identify the application, it falls back to the underlying port-based protocol definition (for example, TCP/80 or TCP/443) if one is configured, so policy design must account for this fallback behavior. Option C is correct because AppID classification is not always instantaneous; some applications require multiple packets or a full session handshake before the signature matches, meaning the first few packets may be classified as unknown or as the underlying protocol until identification completes. Option A is incorrect because AppID profiles are configured under the [edit security application] or application-related security hierarchies, not under [edit security utm], which is used for UTM features such as antivirus, antispam, and web filtering. Option D is incorrect because AppID can be referenced in both global and zone-based security policies, not exclusively in global policies. Option E is incorrect because AppID does not bypass stateful inspection for encrypted payloads; encrypted traffic that cannot be decrypted is typically identified by other means (such as server name indication or port), and stateful inspection still applies.

Answer

AppID profiles must be configured under the [edit security utm] hierarchy.

Answer

AppID is exclusively available for global security policies and cannot be used in zone-based policies.

Answer

AppID policies automatically bypass stateful inspection for encrypted payloads.

Question 11

Which TWO actions occur when a packet matches a security policy configured with the 'reject' action? (Choose two.)

Accepted Answer

The packet is dropped.. Option A is correct because the 'reject' action in a security policy (for example, on a Palo Alto Networks firewall) first drops the offending packet, just like a 'deny' action would, so the traffic never reaches its destination. Option D is correct because, in addition to dropping the packet, 'reject' sends an ICMP unreachable message (such as ICMP type 3, destination unreachable) back to the packet's source, actively notifying the sender that the connection was refused. The remaining options do not belong: B is wrong because 'reject' does not create a stateful session entry to track the rejection (no session is established for blocked traffic), C is wrong because placing a session in a quarantine VLAN is not part of the reject action, and E is wrong because reject does not forward the packet to a backup gateway via policy-based routing.

Answer

A stateful session is created in the session table to track the rejection.

Answer

The session is placed into a persistent 'quarantine' VLAN.

Answer

The packet is forwarded to a secondary backup gateway using policy-based routing.

Question 12

Which TWO statements describe the default behavior of security zones in Junos OS prior to policy creation? (Choose two.)

Accepted Answer

Management traffic to the routing engine is blocked unless explicitly permitted by host-inbound-traffic settings.. Before policies are created, traffic between different zones is blocked, while traffic within the same zone is permitted.

Answer

Global policies automatically permit all interzone traffic upon zone creation.

Answer

All traffic entering any security zone requires explicit policy configuration, including intrazone traffic.

Question 13

Which TWO situations will cause a newly committed security policy to fail to match expected transit traffic? (Choose two.)

Accepted Answer

The transit interfaces involved are assigned to different security zones than those specified in the policy's source and destination zone pair.. Traffic will fail to match if interfaces are in incorrect zones or if the policy is shadowed by an earlier broad rule.

Answer

The Junos routing engine is configured in packet mode instead of flow mode.

Answer

The policy hit count counter is disabled in the action clause.

Question 14

Which TWO tools or operational commands are most useful for verifying security policy configuration syntax and validity before committing? (Choose two.)

Accepted Answer

show | compare. Option B, `show | compare`, is correct because it displays the candidate configuration diff against the running configuration, letting you review exactly what security policy changes will be committed and catch syntax or structural errors before they take effect. Option E, `commit check`, is correct because it validates the candidate configuration's syntax and semantic correctness without actually committing it, so policy errors are surfaced safely beforehand. Option A, `show security monitoring status`, only reports runtime monitoring/health state and does not validate configuration syntax. Option C, `test security flow`, performs a live path/traffic simulation against existing policies rather than checking configuration validity. Option D, `ping security-policies`, is not a valid operational command for verifying policy configuration syntax.

Answer

show security monitoring status

Answer

test security flow

Answer

ping security-policies

Question 15

You need to modify an existing security policy named 'pol-1' to insert a new rule directly above it in the policy list using the Junos CLI. Which configuration command achieves this?

Accepted Answer

set security policies from trust to untrust policy pol-new insert before policy pol-1. The Junos CLI supports inserting a policy at a specific position using the 'insert before' keyword, which places the new policy directly above the referenced policy in the evaluation order. This is the correct command to achieve the requirement of inserting 'pol-new' above 'pol-1'.

Answer

set security policies from trust to untrust policy pol-new position top

Answer

edit security policies from trust to untrust policy pol-new priority high

Answer

rename security policies from trust to untrust policy pol-1 to pol-new

Question 16

An administrator implements a security policy allowing HTTP traffic from the trust zone to the untrust zone. After committing the changes, web traffic fails because return traffic from the server is being dropped. What is the most likely cause of this behavior on a stateful SRX device?

Accepted Answer

Asymmetric routing is causing return packets to arrive on a different interface/zone without matching the session table.. Because SRX devices are stateful, return traffic is normally permitted automatically if the forward path creates a session. If a separate stateless firewall or routing rule blocks return paths, or if ALG/NAT misconfigurations occur, sessions fail. However, a common beginner mistake in security policy design is failing to configure a bidirectional policy when stateful inspection is bypassed or when asymmetric routing occurs. Alternatively, if screen options or reverse path forwarding (RPF) checks fail, return traffic drops. Let's look at the options.

Answer

The HTTP application ALG is intercepting and dropping port 80 traffic.

Answer

Junos requires explicit matching policies in both directions for TCP traffic.

Answer

Stateful session tracking is disabled globally on the SRX device.

Question 17

You need to configure a security policy that matches any source IP address, any destination IP address, but a specific destination port (TCP 443). What is the correct Junos CLI syntax for specifying 'any' source address?

Accepted Answer

set security policies from-zone trust to-zone untrust policy web match source-address any. In Junos security policies, the keyword 'any' is used to match any source address. The correct syntax is 'set security policies from-zone trust to-zone untrust policy web match source-address any'. This is a predefined address that matches all IPv4 and IPv6 addresses.

Answer

set security policies from-zone trust to-zone untrust policy web match source-address 0.0.0.0/0

Answer

set security policies from-zone trust to-zone untrust policy web match source-address all

Answer

set security policies from-zone trust to-zone untrust policy web match source-address wildcard

Question 18

An administrator wants to ensure that when a security policy denies a packet, a log entry is generated immediately. Which policy action keyword should be appended or configured within the policy?

Accepted Answer

then { deny; log; }. In Junos security policies, logging options such as 'log { session-init; session-close; }' or the 'then log' modifier are attached to record policy events.

Answer

then { permit; trace; }

Answer

then { reject; syslog-immediate; }

Answer

then { drop; audit-trail; }

Question 19

Which TWO statements are correct regarding Junos security zones and policy creation? (Choose two.)

Accepted Answer

A security zone must contain at least one interface before a policy can reference it.. Option D is correct because in Junos, a security zone must have at least one interface bound to it (for example, via 'set security zones security-zone trust interfaces ge-0/0/0.0') before it can be used as a source or destination in a security policy; a zone with no interfaces cannot pass or match traffic, so policies referencing it are meaningless. Option E is correct because Junos security policies are defined by a from-zone and to-zone pair, and the same zone can appear as both source and destination, which is exactly how intra-zone policies are written (for example, 'from-zone trust to-zone trust'). Option A is wrong because Junos does not default to permitting intra-zone traffic; intra-zone traffic is denied by default unless an explicit intra-zone policy permits it. Option B is wrong because global policies are an additional policy construct applied across zones and do not remove the requirement to configure security zones for interface and policy context. Option C is wrong because a security zone is not limited to a single policy; many policies can reference the same zone as source or destination.

Answer

Security policies default to permitting intra-zone traffic without explicit rules.

Answer

Global policies eliminate the need to ever configure security zones.

Answer

A security zone can only be assigned to a single security policy at a time.

Question 20

Which TWO actions are available when configuring the 'then' statement in a Junos security policy? (Choose two.)

Accepted Answer

reject. In a Junos security policy, the 'then' statement defines the action taken when traffic matches the policy, and the two valid terminating actions among the choices are reject (C) and permit (D). 'Permit' (D) allows the matching traffic to pass through the device, while 'reject' (C) blocks the traffic and sends a TCP RST or ICMP unreachable message back to the source, both being standard Junos policy actions. The other options are not valid 'then' actions in a security policy: 'redirect' (A) is not a Junos security policy action, 'inspect-only' (B) is not a Junos security policy action (inspection is handled via application services/UTM), and 'translate' (E) is not a security policy action (NAT is configured separately under NAT rules).

Answer

redirect

Answer

inspect-only

Answer

translate