JNCIA-SEC Security Policies Practice Test 5 — 15 Questions

Question 1

Which THREE parameters can be used as match criteria within a Junos security policy? (Choose three.)

Accepted Answer

Applications or application sets. Option A is correct because a Junos security policy can match on applications or application sets, which are defined objects (e.g., junos-http, junos-ssh) that identify the traffic by protocol and port. Option D is correct because Junos User Firewall (integrated user firewall) allows policies to match on user identities sourced from Active Directory or ICAP, enabling role-based enforcement. Option E is correct because security policies match on source-address and destination-address entries drawn from address books (zones' address-book objects). Option B is not a security policy match criterion; BGP AS path attributes are used in routing policy (policy-statement) for route selection, not in security policy. Option C is also not a match criterion in a standard Junos security policy; MAC addresses are matched in Layer 2 switching/filter contexts (e.g., family ethernet-switching firewall filters), not in security policy match conditions.

Answer

BGP AS path attributes

Answer

Physical interface MAC addresses

Question 2

Which THREE types of logging modifiers are available when configuring logging in a Junos security policy? (Choose three.)

Accepted Answer

session-init. In Junos security policy configuration, the log option accepts three logging modifiers: session-init, session-close, and periodic. Option B (session-init) is correct because it generates a log entry when a session is first established, capturing the initial session setup details. Option D (session-close) is correct because it logs when a session is torn down, recording session termination information such as bytes transferred. Option E (periodic) is correct because it produces log entries at regular intervals during the lifetime of a long-lived session, providing ongoing session statistics. Options A (packet-drop-immediate) and C (state-change-alert) are not valid Junos logging modifiers for security policies; they do not exist as configurable log options in the Junos security policy syntax.

Answer

packet-drop-immediate

Answer

state-change-alert

Question 3

Which TWO items are valid options when specifying source addresses in a security policy match statement? (Choose two.)

Accepted Answer

An individual IP address or subnet prefix (e.g., 192.168.1.0/24). In a security policy match statement, source addresses are specified using address objects, so option B is correct because an individual IP address or subnet prefix such as 192.168.1.0/24 can be entered directly as a source address value. Option C is also correct because an address book entry name such as trust-servers is the standard way to reference a predefined address object in the source-address field of a policy rule. Option A is not valid because MAC addresses are layer-2 identifiers and are not used in security policy source-address matching, which operates on layer-3/layer-4 information. Option D is not valid because a physical interface name such as ge-0/0/0.0 is used in zone or interface matching, not as a source address value. Option E is not valid because a BGP autonomous system number is routing metadata and cannot be used as a source address in a security policy match statement.

Answer

A MAC address string (e.g., 00:11:22:33:44:55)

Answer

A physical interface name (e.g., ge-0/0/0.0)

Answer

A BGP autonomous system number (e.g., ASN 65000)

Question 4

Which THREE statements are true regarding Junos security policy configuration hierarchy and syntax? (Choose three.)

Accepted Answer

Policies are evaluated top-down within their specific zone pair context.. Option A is correct because Junos security policies are evaluated in a top-down, first-match order within the specific zone-pair context (from-zone X to-zone Y), so the first matching policy's action is applied and subsequent policies are not evaluated. Option B is correct because the configuration hierarchy organizes policies under the zone-pair structure, i.e., security policies are defined under 'from-zone to-zone ' stanzas, which is the fundamental organizational model in Junos. Option D is correct because a single security policy can contain multiple match terms (source-address, destination-address, application, etc.), and all terms within a policy must match for the policy's action to be applied. Option C is incorrect because Junos uses a candidate configuration model; policy changes must be committed with the 'commit' command before they take effect. Option E is incorrect because security policies can be configured via the CLI (set security policies from-zone ... to-zone ...) as well as J-Web, so they are not limited to J-Web.

Answer

Policy configuration changes take effect immediately without requiring a commit command.

Answer

Policies can only be configured via J-Web and are unsupported on the CLI.

Question 5

Which THREE methods can be used to modify the order of existing security policies in Junos OS? (Choose three.)

Accepted Answer

Using the 'insert ... before' configuration command.. Option A is correct because Junos OS supports the 'insert' configuration command with the 'before' keyword (e.g., 'insert security policies from-zone trust to-zone untrust policy P1 before policy P2') to reposition an existing policy ahead of another. Option C is correct for the same reason: the 'insert ... after' form (e.g., 'insert ... policy P1 after policy P2') reorders an existing policy to follow a specified policy. Option E is correct because deleting a policy and recreating it at the desired point in the policy list effectively changes its evaluation order, since Junos evaluates policies top-down. Option B is not a Junos feature—there is no automated priority metric based on IP prefix length for ordering security policies. Option D is invalid because there is no 'sort security-policies auto' operational command in Junos OS; policy order is controlled through configuration, not an operational sort command.

Answer

Configuring an automated priority metric based on IP prefix length.

Answer

Using the 'sort security-policies auto' operational command.

Question 6

An administrator needs to create a unified security policy that permits traffic from the trust zone to the untrust zone. Using Junos J-Web, which primary menu path should the administrator navigate to configure this security policy?

Accepted Answer

Configure > Security Services > Security Policies. In Junos J-Web, security policies are configured under the 'Configure > Security Services > Security Policies' menu path. This is the primary location where administrators create, edit, and manage zone-based security policies. From this menu, you can define policies between zones, specify source and destination addresses, applications, and actions.

Answer

Monitor > Security > Policy Overview

Answer

Security Services > NAT > Rules

Answer

Configure > Network > Zones and Interfaces

Question 7

When configuring a zone-based security policy in Junos, what is the default action applied to any traffic that does not match any explicitly defined security policy rules?

Accepted Answer

Deny (Drop). Junos zone-based security policies have an implicit default deny at the end of every zone-pair policy set. If no explicit policy matches a session's first packet, the SRX drops the traffic and, by default, does not log it unless a `then log` action or a default-deny logging policy is configured. This is the foundational 'implicit deny' behavior that makes SRX a default-deny firewall.

Answer

Reject

Answer

Permit

Answer

Log only

Question 8

You are troubleshooting a connectivity issue where traffic between two custom zones is being blocked despite a policy permitting it. Upon reviewing the security policies using the CLI command 'show security policies', you notice that an earlier policy with broader match criteria is catching the traffic and applying a deny action. What security policy concept is causing this behavior?

Accepted Answer

Policy shadowing. Policy ordering is sequential in Junos. The first matching policy is applied, and broader policies placed higher in the list can shadow subsequent specific policies.

Answer

Stateful inspection timeout

Answer

Reverse path forwarding mismatch

Answer

Zone segregation failure

Question 9

An administrator configures a security policy on a SRX Series device with the action set to 'count'. What is the primary function of this action in Junos security policies?

Accepted Answer

It permits the matching traffic while maintaining packet and byte counters.. The 'count' action allows traffic matching the policy to be permitted while incrementing packet and byte counters for traffic monitoring and auditing purposes.

Answer

It mirrors the matching traffic packet headers to a designated analyzer port.

Answer

It drops the packet and logs the event to the local event log.

Answer

It sends a TCP reset to the client and server.

Question 10

You are configuring global security policies in Junos OS on an SRX Series device. Which statement is accurate regarding the evaluation order between zone-based policies and global policies?

Accepted Answer

Zone-based policies are evaluated first, followed by global policies if no zone-based match occurs.. Junos OS evaluates zone-based policies before global security policies. If a zone-based policy matches, global policies are bypassed for that traffic flow.

Answer

Global policies are always evaluated before zone-based policies.

Answer

Global policies replace zone-based policies entirely when unified policies are enabled.

Answer

Global policies and zone-based policies are evaluated simultaneously in parallel.

Question 11

Which statement correctly describes a Junos security zone requirement before you can apply a security policy referencing that zone?

Accepted Answer

The zone must have at least one active interface assigned to it.. Before a security policy can reference a zone, that zone must have at least one active interface assigned to it. Junos requires zones to be bound to physical or logical interfaces so the device knows which ingress and egress points the zone represents; a zone with no interfaces cannot participate in policy evaluation.

Answer

The zone must be assigned to a virtual router routing instance.

Answer

The zone must have screen options enabled for DoS protection.

Answer

The zone must have an IPv4 address assigned directly to the zone context.

Question 12

Which Junos CLI command allows an administrator to verify the active hit count and packet match statistics for a specific security policy?

Accepted Answer

show security policies hit-count. 'show security policies hit-count' displays the per-policy hit counters, showing how many packets/sessions matched each security policy. This directly answers the need to verify active hit count and match statistics for a specific policy.

Answer

show firewall filter statistics

Answer

show security flow session statistics

Answer

show security monitoring policies

Question 13

An administrator configures a unified security policy with a custom application signature. However, traffic matching the expected port is failing because the application identification engine (AppID) has not yet recognized the session payload. What mechanism does Junos use to handle initial packets while AppID inspects the traffic?

Accepted Answer

Traffic is initially evaluated using preliminary port-based match criteria until application identification completes.. When AppID is enabled in a security policy, Junos initially permits or denies packets based on traditional port-based matching until AppID identifies the application, after which the policy action is re-evaluated.

Answer

Traffic is dropped until AppID completes full packet payload decryption.

Answer

Traffic is immediately forwarded to the CPU for software-based deep packet inspection, bypassing the PFE.

Answer

Traffic is rejected with an ICMP redirection message prompting re-transmission.

Question 14

You are configuring a security policy that needs to match multiple specific applications (HTTP, HTTPS, and SSH) within a single rule. How should you specify these applications in the Junos CLI?

Accepted Answer

set security policies from-zone trust to-zone untrust policy p1 match application [ junos-http junos-https junos-ssh ]. In Junos CLI, when matching multiple applications within a single security policy, you must enclose the list of applications in square brackets [ ], which is the standard Junos syntax for specifying a set of values. The correct command uses 'application [ junos-http junos-https junos-ssh ]' to match any of the three applications. This tells the policy to accept traffic if it matches any application in the list.

Answer

set security policies from-zone trust to-zone untrust policy p1 match application junos-http, junos-https, junos-ssh

Answer

set security policies from-zone trust to-zone untrust policy p1 match application-group junos-all-services

Answer

set security policies from-zone trust to-zone untrust policy p1 match application multiple junos-http+junos-https

Question 15

Which operational command should you use to view active stateful firewall sessions currently passing through an SRX Series device?

Accepted Answer

show security flow session. `show security flow session` is the operational command that displays the stateful session table on an SRX, including source/destination IPs, ports, protocol, policy name, and session state (e.g., 'Forward', 'Drop'). It is the primary tool for verifying that traffic is being permitted and tracked by the flow daemon.

Answer

show security policies active

Answer

show route active-sessions

Answer

show interfaces extensive session