JNCIA-SEC Security Policies Practice Test 4 — 15 Questions

Question 1

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Existing active sessions remain open until they naturally expire or idle out, but new sessions are blocked.. Schedulers in Junos security policies control session creation; existing active sessions are not automatically terminated when the schedule expires unless specifically configured or aged out.

Answer

The device reboots to clear the session table and re-evaluate all rules.

Answer

Existing sessions are immediately converted to 'reject' action state and send ICMP unreachable messages.

Answer

Existing active sessions are immediately terminated the moment the schedule window closes.

Question 2

What is the default action taken by Junos OS when traffic does not match any configured security policy between two zones?

Accepted Answer

The traffic is silently dropped.. By default, Junos OS denies all traffic that does not match any configured security policy between two zones. This default-deny behavior is a fundamental security principle: if no policy explicitly permits the traffic, it is dropped. The drop is silent, meaning no reject message is sent back to the source, which helps prevent information leakage.

Answer

The traffic is redirected to the default gateway routing instance.

Answer

The traffic is queued for administrative review.

Answer

The traffic is permitted and an alert is logged.

Question 3

You are configuring a security policy that needs to reference an address prefix that includes both IPv4 and IPv6 addresses. How should you handle this in Junos OS security address books?

Accepted Answer

Define separate address book entries for IPv4 and IPv6, as address entries are specific to an IP version.. In Junos security address books, address entries are IP-version specific — an IPv4 prefix and an IPv6 prefix cannot be combined into one entry. You must define separate address book entries (and typically separate address books under the inet and inet6 hierarchies) for IPv4 and IPv6.

Answer

Combine IPv4 and IPv6 addresses into a single address entry string separated by a comma.

Answer

Configure the address book under the [edit security inet6] hierarchy only.

Answer

Use dual-stack address translation objects.

Question 4

When reviewing security policies, you see the term 'junos-any' used in the application match field. What does this represent?

Accepted Answer

It matches all applications and protocols.. The term 'junos-any' in the application match field is a predefined application that matches all applications and protocols. It is essentially a wildcard that allows any IP traffic, regardless of protocol or port. This is useful when you want a policy to permit or deny all traffic without specifying individual applications.

Answer

It matches internal management traffic destined for the routing engine.

Answer

It matches only standard web traffic (HTTP and HTTPS).

Answer

It matches only encrypted IPsec sessions.

Question 5

Which statement is true regarding address book configuration scope in Junos OS security policies?

Accepted Answer

An address book entry defined at the zone level can be referenced by security policies involving that specific zone.. In Junos OS, address books can be defined at the global level or attached to a specific zone. When an address book entry is defined at the zone level, it is scoped to that zone and can only be referenced by security policies that involve that zone (either as source or destination). This zone-specific scoping allows administrators to reuse the same address name in different zones without conflict, and policies referencing that zone automatically have access to its address book entries.

Answer

Address books cannot contain address sets; they can only contain single IP addresses.

Answer

Zone-based address books override global address books if names overlap.

Answer

Address book entries must be globally unique across the entire device, even across different zones.

Question 6

You need to configure a security policy that inspects traffic for computer viruses and malware as part of the unified security policy framework. Which security feature must be referenced within the policy action?

Accepted Answer

A UTM anti-virus profile.. Within the Junos unified security policy framework, UTM (Unified Threat Management) features such as anti-virus, anti-spam, content filtering, and web filtering are invoked by referencing a UTM profile in the policy's then action. To inspect traffic for viruses and malware, the policy must reference a UTM anti-virus profile, which defines the scan engine, fallback behavior, and notification options. Without this profile binding, the policy simply permits or denies traffic without deep inspection.

Answer

A Junos screen profile.

Answer

An IPsec VPN gateway proposal.

Answer

A stateless firewall filter action.

Question 7

An enterprise network has multiple virtual routers configured within separate routing instances. How do security policies interact with traffic passing between two different routing instances on the same SRX device?

Accepted Answer

Security zones and policies are evaluated when traffic crosses between routing instances if the interfaces belong to different security zones.. Traffic between different routing instances must traverse security zones and policies, and interfaces in each instance must be assigned to appropriate zones.

Answer

Routing instances handle all security enforcement natively without policy intervention.

Answer

Security policies are completely bypassed for traffic within the same physical device regardless of routing instances.

Answer

Only global policies apply to multi-instance routing environments.

Question 8

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FTP Application Layer Gateway (ALG) must be enabled to dynamically open security sessions for data channels.. FTP uses dynamically negotiated data ports, requiring the Junos ALG (Application Layer Gateway) for FTP to be active so security policies dynamically permit the data channel.

Answer

The security policy action must be changed from 'permit' to 'allow-pasv'.

Answer

FTP must be replaced with SFTP because security policies cannot support stateful FTP parsing.

Answer

A separate security policy must be created allowing traffic from untrust back to trust for port 20.

Question 9

You are configuring a security policy and need to reference a group of IP addresses that frequently changes. You decide to use an address set. How do you add individual address entries into this address set?

Accepted Answer

By referencing the individual address entries within the address-set definition statement.. An address set in Junos is a named container that groups multiple address book entries. To add individual address entries into the set, you reference them within the address-set definition using the 'address' statement (e.g., 'set security address-book global address-set MySet address Server1'). This creates a logical group that can be referenced in policies.

Answer

By applying firewall filter terms to the address set container.

Answer

By assigning the address set to an interface unit.

Answer

By listing raw IP subnet masks directly inside the security policy match statement.

Question 10

What is the purpose of the 'then { permit; }' statement in a Junos security policy?

Accepted Answer

It allows matching traffic to create a session and pass through the security device.. The 'permit' action allows matching traffic to establish a session and pass through the firewall.

Answer

It permits the interface to come up in L3 routing mode.

Answer

It enables dynamic routing protocol updates across the zone boundary.

Answer

It allows administrative SSH access to the Junos routing engine.

Question 11

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

Accepted Answer

The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.. If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Answer

The source zone does not have host-inbound-traffic enabled for UDP.

Answer

UDP traffic cannot be matched by security policies and requires stateless filters.

Answer

Global policies always block custom applications by default.

Question 12

Which TWO actions can be specified in the 'then' statement of a Junos security policy? (Choose two.)

Accepted Answer

reject. In a Junos security policy, the 'then' statement defines the action taken when traffic matches the policy's 'from' criteria, and the valid terminating actions include permit (option C) and reject (option B). 'Permit' allows the matching traffic to pass through the device and is the standard accept action, while 'reject' blocks the traffic and sends a TCP RST or ICMP unreachable message back to the source, making both correct for the 'then' clause. The other options are not valid security policy actions: 'bridge' and 'switched-vlan' are Layer 2 forwarding constructs used in bridging or VLAN contexts, not security policy 'then' actions, and 'route-via' is not a Junos security policy action (routing decisions are handled by the routing table and forwarding options, not by a security policy 'then' statement).

Answer

bridge

Answer

switched-vlan

Answer

route-via

Question 13

Which THREE components are required when defining a standard zone-based security policy in Junos OS? (Choose three.)

Accepted Answer

Source zone. In Junos OS zone-based security policies, every policy must specify the source zone (option B) and the destination zone (option D) because the policy is applied to traffic flowing between two distinct security zones, and the zone pair defines the context in which the policy is evaluated. Option C is also required: each policy must contain match criteria such as source address, destination address, and application (or application-set) to identify which traffic the policy governs, along with the then action (permit, deny, or reject). Option A is incorrect because a static route in inet.3 is used for MPLS/VPN next-hop resolution and is not a required element of a security policy. Option E is incorrect because an integrated Layer 2 bridging profile relates to transparent-mode/bridging configuration and is not part of a standard zone-based security policy definition.

Answer

A static routing table entry in inet.3

Answer

An integrated Layer 2 bridging profile

Question 14

Which TWO conditions can cause a security policy to be considered shadowed in a Junos configuration? (Choose two.)

Accepted Answer

A preceding policy has 'any' for source, destination, and application, while a subsequent policy specifies a specific subnet.. Option B is correct because when a preceding policy matches 'any' source, destination, and application, it matches all traffic that a subsequent policy specifying a specific subnet would match, so the later policy can never be evaluated and is therefore shadowed. Option C is correct because shadowing occurs whenever an earlier policy in the policy order has identical or broader match criteria than a later policy, causing the later policy to be unreachable in the top-down first-match evaluation used by Junos security policies. Option A is not correct because a policy bound to a non-existent zone is a configuration error, not a shadowing condition, and shadowing specifically concerns overlapping match criteria between ordered policies. Option D is not correct because packet-mode versus flow-mode is a device processing mode and does not by itself cause a policy to be shadowed. Option E is not correct because hit counts are a monitoring feature and have no effect on policy evaluation order or match overlap.

Answer

The shadowed policy is assigned to a non-existent security zone.

Answer

The security device is operating in packet-mode instead of flow-mode.

Answer

The shadowed policy has hit counts enabled while the preceding policy does not.

Question 15

Which TWO statements are correct regarding Junos security policies and their evaluation behavior? (Choose two.)

Accepted Answer

Security policies are evaluated sequentially from top to bottom within a zone pair.. Option A is correct because Junos security policies within a given zone pair are evaluated in a first-match, top-to-bottom order, so the first policy whose match criteria (source/destination addresses, applications, etc.) are satisfied is applied and subsequent policies are not evaluated. Option E is correct because when a policy permits traffic, Junos SRX creates a stateful session entry in the session table, allowing return traffic and subsequent packets of the same flow to bypass full policy re-evaluation. Option B is incorrect because Junos SRX has an implicit deny-all policy at the end of each zone pair, so unmatched traffic is dropped, not permitted. Option C is incorrect because global policies are evaluated after zone-specific policies, not before them. Option D is incorrect because security policies operate at Layers 3 and 4 (and above with application identification) and are inherently stateful, not Layer 2 only.

Answer

If no policy matches the traffic, it is permitted by default.

Answer

Global policies are evaluated before zone-based policies.

Answer

Security policies operate exclusively at Layer 2 without state tracking.