JNCIA-SEC Security Policies Practice Test 2 — 15 Questions

Question 1

An administrator implements a security policy allowing HTTP traffic from the trust zone to the untrust zone. After committing the changes, web traffic fails because return traffic from the server is being dropped. What is the most likely cause of this behavior on a stateful SRX device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing is causing return packets to arrive on a different interface/zone without matching the session table.. Because SRX devices are stateful, return traffic is normally permitted automatically if the forward path creates a session. If a separate stateless firewall or routing rule blocks return paths, or if ALG/NAT misconfigurations occur, sessions fail. However, a common beginner mistake in security policy design is failing to configure a bidirectional policy when stateful inspection is bypassed or when asymmetric routing occurs. Alternatively, if screen options or reverse path forwarding (RPF) checks fail, return traffic drops. Let's look at the options.

Answer

The HTTP application ALG is intercepting and dropping port 80 traffic.

Answer

Junos requires explicit matching policies in both directions for TCP traffic.

Answer

Stateful session tracking is disabled globally on the SRX device.

Question 2

You need to configure a security policy that matches any source IP address, any destination IP address, but a specific destination port (TCP 443). What is the correct Junos CLI syntax for specifying 'any' source address?

Accepted Answer

set security policies from-zone trust to-zone untrust policy web match source-address any. In Junos security policies, the keyword 'any' is used to match any source address. The correct syntax is 'set security policies from-zone trust to-zone untrust policy web match source-address any'. This is a predefined address that matches all IPv4 and IPv6 addresses.

Answer

set security policies from-zone trust to-zone untrust policy web match source-address 0.0.0.0/0

Answer

set security policies from-zone trust to-zone untrust policy web match source-address all

Answer

set security policies from-zone trust to-zone untrust policy web match source-address wildcard

Question 3

An administrator wants to ensure that when a security policy denies a packet, a log entry is generated immediately. Which policy action keyword should be appended or configured within the policy?

Accepted Answer

then { deny; log; }. In Junos security policies, logging options such as 'log { session-init; session-close; }' or the 'then log' modifier are attached to record policy events.

Answer

then { permit; trace; }

Answer

then { reject; syslog-immediate; }

Answer

then { drop; audit-trail; }

Question 4

Which TWO statements are correct regarding Junos security zones and policy creation? (Choose two.)

Accepted Answer

A security zone must contain at least one interface before a policy can reference it.. Option D is correct because in Junos, a security zone must have at least one interface bound to it (for example, via 'set security zones security-zone trust interfaces ge-0/0/0.0') before it can be used as a source or destination in a security policy; a zone with no interfaces cannot pass or match traffic, so policies referencing it are meaningless. Option E is correct because Junos security policies are defined by a from-zone and to-zone pair, and the same zone can appear as both source and destination, which is exactly how intra-zone policies are written (for example, 'from-zone trust to-zone trust'). Option A is wrong because Junos does not default to permitting intra-zone traffic; intra-zone traffic is denied by default unless an explicit intra-zone policy permits it. Option B is wrong because global policies are an additional policy construct applied across zones and do not remove the requirement to configure security zones for interface and policy context. Option C is wrong because a security zone is not limited to a single policy; many policies can reference the same zone as source or destination.

Answer

Security policies default to permitting intra-zone traffic without explicit rules.

Answer

Global policies eliminate the need to ever configure security zones.

Answer

A security zone can only be assigned to a single security policy at a time.

Question 5

Which TWO actions are available when configuring the 'then' statement in a Junos security policy? (Choose two.)

Accepted Answer

reject. In a Junos security policy, the 'then' statement defines the action taken when traffic matches the policy, and the two valid terminating actions among the choices are reject (C) and permit (D). 'Permit' (D) allows the matching traffic to pass through the device, while 'reject' (C) blocks the traffic and sends a TCP RST or ICMP unreachable message back to the source, both being standard Junos policy actions. The other options are not valid 'then' actions in a security policy: 'redirect' (A) is not a Junos security policy action, 'inspect-only' (B) is not a Junos security policy action (inspection is handled via application services/UTM), and 'translate' (E) is not a security policy action (NAT is configured separately under NAT rules).

Answer

redirect

Answer

inspect-only

Answer

translate

Question 6

When troubleshooting a unified security policy involving AppID and UTM services, which THREE elements must be correctly configured for the security policy to successfully apply content inspection? (Choose three.)

Accepted Answer

The policy action must be set to 'permit'.. Option A is correct because a unified security policy must have its action set to 'permit' for traffic to be allowed through and for attached content-inspection engines such as AppID and UTM (AV, IPS, web filter, etc.) to actually process the session; a deny/reject action drops the packet before inspection. Option B is correct because content inspection only occurs when a security service or UTM profile (antivirus, IPS, application control, web filtering, etc.) is bound to the policy rule; without an attached profile the firewall performs only basic forwarding. Option D is correct because the policy match criteria must identify the traffic to inspect, typically by defining applications via AppID or by specifying services/ports, so the rule can match the session and hand it to the inspection engines. Option C is not required: a 'transit-free zone' is not a standard FortiGate zone type or configuration requirement for content inspection, and source zones are simply the interfaces/VLANs from which traffic originates. Option E is incorrect because the 'reject' action actively refuses the connection and prevents deep packet inspection; inspection requires the 'permit' (accept) action, not reject.

Answer

The source zone must be configured as a transit-free zone.

Answer

The policy must use the 'reject' action to force deep packet inspection.

Question 7

Which TWO methods can be used to monitor or troubleshoot security policy drops in Junos OS? (Choose two.)

Accepted Answer

Configuring security flow traceoptions to trace packet flow processing.. Option A is correct because security flow traceoptions allow you to trace packet flow processing in Junos OS, including the specific policy lookup and drop decisions made by the flow module, which is the primary tool for troubleshooting why a packet is being denied by a security policy. Option C is correct because enabling session-init and session-close logging under the security flow traceoptions or via security log configuration generates security event logs that record session creation and teardown, including policy deny events, giving visibility into which traffic is being dropped by policy. Option B is incorrect because 'show system memory packet' is not a valid Junos operational command for inspecting dropped packet buffers. Option D is incorrect because 'show firewall filter drop-counters' is not a valid Junos command; firewall filter counters are viewed with 'show firewall' and security policy drops are not tracked by stateless filter counters. Option E is incorrect because the routing table does not maintain an 'active-drops' metric; routing tables hold routes and next-hop information, not security policy drop statistics.

Answer

Using the 'show system memory packet' command to inspect dropped packet buffers.

Answer

Running the 'show firewall filter drop-counters' operational command.

Answer

Checking the routing table active-drops metric.

Question 8

When configuring Junos security policies, which TWO conditions can cause a newly added policy rule to be bypassed entirely? (Choose two.)

Accepted Answer

Existing active sessions matching the traffic pattern already exist in the stateful session table.. Option A is correct because Junos security policies are evaluated only for the first packet of a new session; if an existing active session in the stateful session table already matches the traffic pattern, subsequent packets are handled by the session lookup and the newly added policy rule is never consulted. Option C is correct because Junos evaluates policies in a first-match, top-down order within a policy set, so an earlier rule with broader match criteria that matches the same flow will be applied and the later, newly added rule will be bypassed. Option B is not correct because screen options are a zone-level anti-flood/IDS feature applied to sessions and do not cause a policy rule to be skipped. Option D is not correct because there is no Junos policy-set attribute called 'traffic disabled'; policy sets are enabled or disabled as a whole, but that is not the described bypass condition. Option E is not correct because an ALG bound to port 80 affects application-layer processing of HTTP traffic, not whether a policy rule is evaluated.

Answer

The destination zone has screen options enabled.

Answer

The policy is placed within a policy set that has traffic disabled.

Answer

The application ALG is bound to port 80.

Question 9

When configuring a zone-based security policy on an SRX Series device, which three components are strictly required to define the match criteria of the policy rule?

Accepted Answer

Source zone, destination zone, and applications. A standard zone-based security policy in Junos OS requires a source zone, destination zone, and source/destination addresses or applications to evaluate traffic.

Answer

Source IP, destination MAC address, and routing instance

Answer

Global address book, security profile, and zone pair

Answer

Source interface, destination interface, and VLAN ID

Question 10

An administrator notices that traffic between the internal trust zone and the untrust zone is being dropped by the SRX Series device, despite a custom security policy allowing the traffic. Upon checking the security policies, the administrator sees that an earlier policy matching a broader set of criteria is catching and dropping the traffic before it reaches the custom policy. Which Juniper CLI command should the administrator use to trace and verify which security policy is processing a specific packet in real-time?

Accepted Answer

request security flow traceoptions file policy_trace. The correct command for real-time packet tracing of security policy evaluation on Junos OS is 'set security flow traceoptions'. This allows administrators to debug flow processing and see which policy action is applied.

Answer

monitor security flow policy-lookup

Answer

show security policies matching-packet

Answer

test security policy evaluate source-ip

Question 11

An enterprise SRX deployment uses global security policies alongside traditional zone-based policies. An administrator configures a global policy to permit HTTP traffic from any zone to any zone. However, a more restrictive zone-based policy exists between the 'HR' zone and the 'Internet' zone that explicitly denies HTTP traffic. How does the SRX Series device process these conflicting policies?

Accepted Answer

Zone-based policies are evaluated before global policies, so the zone-based deny policy takes precedence and drops the traffic.. Junos OS evaluates security policies in a specific order: zone-based policies are evaluated before global policies. Therefore, the zone-based policy denying the traffic takes precedence.

Answer

The SRX device combines both policies, resulting in an implicit permit.

Answer

Global policies are evaluated first, so the HTTP traffic will be permitted.

Answer

The configuration will fail to commit because of overlapping policy domains.

Question 12

Which TWO statements are correct regarding the behavior and configuration of global security policies on Junos OS SRX Series devices?

Accepted Answer

Global security policies are evaluated after all zone-based security policies have been checked.. Option A is correct because global security policies are evaluated only after all zone-based (zone-to-zone) security policies have been checked; they act as a fallback for traffic that does not match any zone-specific policy. Option E is correct because global policies are defined without binding them to specific source/destination zones, so a single policy can apply across any zone combination, and they can reference global address books to simplify administration. Option B is incorrect because global policies can still reference application identification (AppID) and UTM features. Option C is incorrect because global policies deliberately omit explicit source and destination zone definitions, which is what makes them global. Option D is incorrect because zone-specific policies take precedence; global policies are evaluated after them, not before.

Answer

Global security policies cannot be combined with AppID or UTM services.

Answer

Global security policies require explicit source and destination zone definitions within each individual rule statement.

Answer

Global security policies take precedence over any zone-specific security policy configured on the device.

Question 13

An administrator reorganizes security policies on an SRX Series device and needs to move a high-priority policy to the top of the policy list within a specific zone context. Which Junos configuration command accomplishes this task efficiently?

Accepted Answer

insert security policies from-zone trust to-zone untrust policy new-top-policy before policy existing-policy. The `insert` command in Junos is specifically designed to reorder configuration statements, such as security policies, by placing a policy before or after an existing policy. This command is efficient because it directly manipulates the policy order without requiring manual deletion and re-creation. The syntax `insert security policies from-zone trust to-zone untrust policy new-top-policy before policy existing-policy` correctly identifies the zone context and the target policy to be moved, placing it before the specified existing policy, thus achieving the desired top position if the existing policy is currently first.

Answer

set security policies from-zone trust to-zone untrust policy new-top-policy priority 1

Answer

move security policy new-top-policy top of from-zone trust to-zone untrust

Answer

update security policies order index 1 for from-zone trust to-zone untrust

Question 14

An SRX Series device has two security zones: trust and untrust. A security policy from trust to untrust permits HTTP traffic to a web server at 203.0.113.10. Users report that HTTP connections to that server fail, but pings succeed. You run show security flow session destination-prefix 203.0.113.10/32 and see no sessions. Which action should you take to diagnose why the HTTP traffic is not creating a session?

Accepted Answer

Run show security policies from-zone trust to-zone untrust detail and verify the policy matches TCP port 80 and is enabled.. The missing HTTP sessions while ICMP works indicates the policy is not matching TCP port 80, likely because the application or application-set does not include HTTP or the policy is disabled. Viewing the detailed policy configuration reveals the exact match criteria and enabled state, allowing you to correct the application reference or enable the policy.

Answer

Run show security flow session and look for ICMP sessions to confirm that the policy is working for all protocols.

Answer

Run show security zones and confirm that the untrust zone has the correct TCP port configuration.

Answer

Run show configuration security policies and check whether the policy action is set to permit.

Question 15

Where are address books defined when configuring zone-based security policies in Junos OS?

Accepted Answer

At the global security hierarchy or within individual security zones.. Address books in Junos security policies can be defined at two levels: globally under the [edit security address-book] hierarchy, or within individual security zones under [edit security zones security-zone <zone-name> address-book]. This allows for both centralized and zone-specific address management. Global address books are available to all zones, while zone-specific address books are only usable within policies involving that zone.

Answer

Only under the system services configuration menu.

Answer

Inside the interface configuration stanza for each physical port.

Answer

Exclusively within the routing-options hierarchy.