JNCIA-SEC Security Policies Practice Test 3 — 15 Questions

Question 1

Which statement accurately describes zone-based security policies in Junos OS?

Accepted Answer

Traffic flowing between two different security zones is implicitly denied unless explicitly permitted by a security policy.. Zone-based security policies require traffic to be explicitly permitted between security zones, as the default behavior is deny-all.

Answer

Security policies are always applied globally and do not require zone definitions.

Answer

Traffic flowing between interfaces in the same security zone is blocked by default unless a policy is created.

Answer

Policies defined under the global context take precedence over all zone-based policies.

Question 2

An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?

Accepted Answer

Enabling AppID match criteria by specifying applications within the security policy.. AppID requires application identification to be integrated into the security policy match criteria, which can be accomplished by referencing specific applications or application sets.

Answer

Attaching a security screen profile to the DMZ zone.

Answer

Enabling stateless firewall filters on the egress interface.

Answer

Configuring global policies with an idle-timeout parameter.

Question 3

You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?

Accepted Answer

An application set containing both HTTP and HTTPS.. An application set allows grouping multiple applications for simplified policy administration.

Answer

An address book entry containing the web server IP addresses.

Answer

A global policy with a service term.

Answer

A security zone profile containing the protocols.

Question 4

You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?

Accepted Answer

Configuring security flow traceoptions to log packet processing details.. Security flow traceoptions allow administrators to trace packet processing through the security engine to see why a packet is dropped or which policy it matched.

Answer

Using 'ping' with the 'do-not-fragment' bit set.

Answer

Checking the system log file for routing protocol errors.

Answer

Running 'show firewall' to inspect interface filter counters.

Question 5

You have multiple security policies configured within the context of a specific source and destination zone. A new requirement dictates that a specific subset of users must be denied access while everyone else in the same zone remains permitted. How should you order your security policies to achieve this without disrupting existing traffic?

Accepted Answer

Place the explicit deny policy for the specific subset of users above the general permit policy.. Junos security policies are evaluated top-down, first-match wins. To deny a specific subset while permitting everyone else in the same zone pair, the explicit deny policy for that subset must be placed above the general permit policy. This ensures the deny matches first for those users, while all other traffic falls through to the permit. Ordering is the key mechanism — no automatic sorting occurs.

Answer

Place the general permit policy above the deny policy and set the deny policy action to 'reject'.

Answer

Convert the policies to global policies and place them at the bottom of the evaluation list.

Answer

Use an address set to combine the users and rely on automatic policy sorting by IP prefix length.

Question 6

An administrator needs to create a security policy on a Junos device that permits traffic from the trust zone to the untrust zone. Which configuration hierarchy is used to define this security policy?

Accepted Answer

[edit security policies]. Security policies in Junos OS are configured under the [edit security policies] hierarchy.

Answer

[edit firewall]

Answer

[edit security screen]

Answer

[edit interfaces security-zones]

Question 7

Which command is used to display the currently active security policies on a Junos device?

Accepted Answer

show security policies. The command 'show security policies' displays the currently active security policies on a Junos device, including their order, match conditions, and actions. This is the primary command for viewing policy configuration and status.

Answer

show security zones

Answer

show firewall filter

Answer

show system security status

Question 8

You need to log every time a specific security policy is hit by traffic, including when a session is closed. Which action modifier should you configure within the security policy?

Accepted Answer

Configure 'then { permit; log { session-init; session-close; } }'.. The 'log' option in a security policy can include session-init and session-close logging.

Answer

Configure 'then { permit; syslog source-address; }'.

Answer

Configure 'then { permit; alarm; }'.

Answer

Configure 'then { permit; count; }'.

Question 9

What is the primary difference between a zone-based security policy and a global security policy in Junos OS?

Accepted Answer

Global policies apply across all security zones without requiring explicit source and destination zone pairs in the rule.. Global security policies in Junos OS are applied across all zones and do not require the administrator to specify source-zone and destination-zone pairs, unlike zone-based policies which are bound to a specific zone context (from-zone X to-zone Y). This makes global policies useful for rules that must apply universally, such as blanket deny rules or logging policies. Zone-based policies, by contrast, are evaluated within the context of a specific inter-zone traffic flow.

Answer

Global policies bypass stateful inspection, whereas zone-based policies enforce it.

Answer

Zone-based policies are evaluated after global policies.

Answer

Global policies can only be used for IPv6 traffic, while zone-based policies handle IPv4.

Question 10

You want to create a security policy that applies to traffic originating from a specific address book entry named 'HQ-Net' in the 'trust' zone destined for 'Branch-Net' in the 'untrust' zone. Where must the 'HQ-Net' address be defined?

Accepted Answer

Within the address-book configuration of the 'trust' zone or at the global address-book level.. Address entries can be defined either globally or inside the specific zone configuration.

Answer

Directly within the system login configuration block.

Answer

Inside the routing-options static route definition.

Answer

As an interface unit attribute under the [edit interfaces] hierarchy.

Question 11

An administrator configures a security policy with the action set to 'reject'. Another policy uses the action 'deny'. What is the functional difference between these two actions when a packet matches the policy?

Accepted Answer

'reject' sends an ICMP unreachable message back to the packet source, whereas 'deny' silently drops the packet.. The 'reject' action sends an ICMP unreachable message back to the source, whereas 'deny' (drop) silently discards the packet.

Answer

'reject' drops the packet silently, whereas 'deny' sends an ICMP unreachable message.

Answer

'reject' logs the event to the system log, whereas 'deny' suppresses all logging.

Answer

'reject' requires stateful session tracking, whereas 'deny' is applied statelessly.

Question 12

An auditor points out that a security policy configured on your SRX device is completely shadowed by an earlier policy in the same zone pair. What does policy shadowing mean in this context?

Accepted Answer

A preceding policy has broader or identical match criteria that catches all traffic intended for the subsequent policy.. Policy shadowing occurs when a preceding policy completely encompasses the match criteria of a subsequent policy, rendering the later policy unreachable.

Answer

The shadowed policy is missing a valid source zone definition.

Answer

The routing engine has cached an old version of the policy table.

Answer

The shadowed policy is using global scope instead of zone-based scope.

Question 13

What happens to return traffic for an established session that was originally permitted by a security policy?

Accepted Answer

Return traffic is automatically permitted by the stateful inspection engine without requiring a reverse security policy.. Junos is a stateful firewall; return traffic belonging to an established session is automatically permitted without needing a separate return policy.

Answer

Return traffic is dropped unless stateless firewall filters permit it.

Answer

Return traffic is evaluated against global policies only.

Answer

A separate security policy allowing traffic from the destination zone back to the source zone must be explicitly configured.

Question 14

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies.. Junos evaluates zone-based policies first, followed by global policies if no zone-based policy matches.

Answer

All policies, both global and zone-based, are evaluated in a single combined sequence based strictly on rule naming alphabetically.

Answer

Policies are evaluated based on IP prefix length regardless of whether they are global or zone-based.

Answer

Global policies are evaluated first, followed by zone-based policies.

Question 15

You need to modify an existing security policy to add a new IP address to an existing address set used in the policy match criteria. Which configuration hierarchy should you access to update the address set?

Accepted Answer

[edit security address-book] or within the specific zone's address-book configuration.. Address sets are configured within address books, either globally or under specific zones.

Answer

[edit security policies] directly within the policy match criteria.

Answer

[edit interfaces]

Answer

[edit routing-options]