JNCIA-SEC Security Policies Practice Test 6 — 15 Questions

Question 1

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure NTP on the SRX device to synchronize time with a reliable time server.. The recommended best practice for ensuring security policy schedules work correctly is to configure NTP on the SRX device so its clock is synchronized with a reliable time source. Accurate, synchronized time is essential because schedule-based policies rely on the device's local clock, and drift or time zone mismatches can cause schedules to activate at the wrong times.

Answer

Manually restart the flow processing daemon (flowd) after every time zone change.

Answer

Convert all schedule parameters in the policy configuration to use absolute epoch timestamps.

Answer

Disable stateful inspection so that schedule checks occur on every individual packet.

Question 2

When reviewing security policies, you notice multiple rules defined within the same source-zone and destination-zone context. Which Junos feature allows you to group these related policies together for easier management and readability?

Accepted Answer

Policy sets. Junos policy terms can be organized and grouped using policy sets, allowing administrators to apply administrative containers to multiple security policies.

Answer

Virtual security domains

Answer

Zone clusters

Answer

Security profiles

Question 3

You are configuring security policies on an SRX Series device that uses destination NAT. In what order does Junos evaluate security policies relative to destination NAT processing?

Accepted Answer

Destination NAT is evaluated first; security policies are then evaluated using the post-NAT destination addresses.. On Junos SRX, destination NAT is evaluated before security policy lookup, and the security policy is then matched against the post-NAT destination address. This means the policy must reference the translated (inside) address, not the original public address. The order is: packet arrives, destination NAT is applied, then the security policy is evaluated using the translated destination IP.

Answer

Destination NAT and security policies are evaluated simultaneously in parallel.

Answer

Security policies are evaluated before destination NAT, using pre-NAT IP addresses.

Answer

Security policies are evaluated twice: once pre-NAT and once post-NAT.

Question 4

Which TWO factors contribute to policy shadowing in Junos security policy evaluation? (Choose two.)

Accepted Answer

Incorrect policy ordering within the policy list.. Option D is correct because Junos evaluates security policies top-down within a policy list and stops at the first match, so incorrect policy ordering (placing a more specific rule after a more general one) causes the later rule to be shadowed and never evaluated. Option E is correct because when an earlier policy uses broader match criteria such as 'any' source or destination, it encompasses the traffic that a later, more specific policy was intended to match, so that later policy is effectively shadowed and never hit. Option A is incorrect because global policies are simply evaluated in a separate global policy list before zone-based policies; using them does not by itself cause shadowing within a policy list. Option B is incorrect because assigning multiple IP addresses to a single zone interface is a valid configuration and does not affect policy evaluation order or cause shadowing. Option C is incorrect because stateful inspection timeout values affect session aging and teardown behavior, not the top-down matching logic that produces policy shadowing.

Answer

Using global policies instead of zone-based policies.

Answer

Assigning multiple IP addresses to a single security zone interface.

Answer

Enabling stateful inspection timeout values.

Question 5

Which THREE components are mandatory when defining a standard zone-based security policy rule in Junos OS? (Choose three.)

Accepted Answer

Source zone. In Junos OS zone-based security policies, every rule must specify a from-zone (source zone) and a to-zone (destination zone) because the policy is evaluated within the context of a zone pair — this makes options A (Source zone) and B (Destination zone) mandatory. The third required element is the policy action, such as permit, deny, reject, or count, since a rule without an action cannot determine traffic handling — this makes option D (Policy action) mandatory. A predefined security screen profile (option C) is not required in a policy rule; screens are applied separately under the zone's screen configuration to protect against floods and malformed packets. Static NAT rule binding (option E) is also not part of a standard security policy rule; NAT is configured separately and referenced via NAT rules, not as a mandatory policy component.

Answer

A predefined security screen profile

Answer

Static NAT rule binding

Question 6

Which THREE statements are true regarding global security policies in Junos OS? (Choose three.)

Accepted Answer

Global policies support matching on applications, source addresses, and destination addresses.. Option A is correct because global policies in Junos OS support the same match criteria as zone-based policies, including applications, source addresses, and destination addresses, allowing flexible traffic identification. Option C is correct because the Junos security policy evaluation order processes zone-based policies first and then global policies, so global policies act as a fallback for traffic not matched by zone-specific rules. Option D is correct because global policies are defined without a from-zone/to-zone context, so a single rule can apply across multiple zones without declaring individual source-to-destination zone pairs. Option B is incorrect because global policies are configured under the global policy hierarchy and do not require an explicit zone pair declaration. Option E is incorrect because global policies are evaluated after, not before, zone-based policies, so they do not take precedence over them.

Answer

Global policies require an explicit zone pair declaration in the configuration hierarchy.

Answer

Global policies take precedence over any configured zone-based security policies.

Question 7

You are troubleshooting a session-based firewall configuration on an SRX Series device. An application establishes a control connection on one port, but dynamically negotiates a secondary data port for file transfers. Without configuring an explicit policy for the secondary dynamic port, what Junos feature enables the security policy to dynamically permit this secondary data flow?

Accepted Answer

Application Layer Gateways (ALGs). Application Layer Gateways (ALGs) are the Junos feature that enables security policies to dynamically permit secondary data flows for protocols that negotiate additional ports, such as FTP, SIP, and H.323. The ALG inspects the control connection, extracts the dynamically negotiated port information from the payload, and automatically opens a pinhole for the data connection without requiring an explicit policy for that secondary port. This is essential for protocols where the data port is not known in advance.

Answer

Unified Security Policy Framework

Answer

Advanced Policy-Based Routing (APBR)

Answer

Global Policy Fallback

Question 8

By default, what action does an SRX Series device take when traffic does not match any configured security policy between two zones?

Accepted Answer

Drop the traffic silently via the implicit deny policy.. By default, an SRX Series device enforces an implicit deny-all policy for any traffic that does not match an explicitly configured security policy between zones. This default behavior drops the traffic silently without sending any notification to the source, which is a fundamental security posture of the Junos zone-based firewall.

Answer

Forward the traffic to the default gateway for inspection.

Answer

Permit the traffic and generate an informational system log.

Answer

Prompt the user with a captive portal redirect.

Question 9

An administrator implements AppID within the unified security policy framework on an SRX Series device to identify and control specific cloud-based applications. The initial policy uses a broad match for 'junos-ssl' at the transport layer, while a subsequent policy specifies 'junos-facebook' using AppID. How does the SRX policy engine evaluate and re-evaluate traffic when application identification takes multiple packets to determine?

Accepted Answer

The SRX evaluates the initial packets against transport-layer criteria, and once AppID identifies the specific application, it re-evaluates the session against application-specific policies.. When AppID is used, the SRX first evaluates initial packets against transport-layer criteria (e.g., junos-ssl), and once enough packets are inspected to identify the specific application (e.g., junos-facebook), it re-evaluates the session against application-specific policies. This allows a broad transport rule to permit the initial handshake while a more specific AppID rule can then apply. The session is not terminated just because AppID is not immediate.

Answer

The session is terminated immediately upon initial packet inspection because the AppID cannot be determined instantly.

Answer

AppID policies are evaluated before any transport layer policies, regardless of rule ordering.

Answer

Application identification only occurs for the return traffic stream.

Question 10

An administrator is reviewing policy shadowing and rule optimization on an SRX Series device. Which THREE conditions must be met for one security policy to completely shadow (make redundant) a subsequent security policy?

Accepted Answer

Both policies must belong to the exact same zone pair or be global policies.. For a security policy to completely shadow a subsequent policy on an SRX, the two policies must be evaluated in the same context, so option A is correct: they must belong to the exact same zone pair (for example, trust-to-untrust) or both be global policies, since policies in different zone pairs or contexts are not compared against each other. Option D is correct because SRX security policies are evaluated top-down in first-match order, so the shadowing policy must appear higher in the policy list than the policy it makes redundant. Option E is correct because the preceding policy must match at least everything the subsequent policy matches — its source, destination, and application criteria must be broader than or identical to the subsequent policy's criteria — so the later policy can never be reached. Option B is incorrect because shadowing is about match scope and evaluation order, not about requiring a deny action before a permit action; a broader permit policy can shadow a narrower permit policy just as well. Option C is incorrect because dynamic application identification versus static ports is not a requirement for shadowing; the relevant issue is whether the match criteria of the earlier policy encompass those of the later policy.

Answer

The preceding policy must have a 'deny' action while the subsequent policy has a 'permit' action.

Answer

The subsequent policy must use dynamic application identification while the preceding policy uses static port numbers.

Question 11

When configuring the unified security policy framework on Junos OS, which TWO elements are key components that extend traditional layer 4 firewall policies into layer 7 application and threat visibility?

Accepted Answer

Unified Threat Management (UTM) or security services profiles. Option A is correct because UTM/security services profiles (antivirus, anti-spam, content filtering, IPS, and AppTrack) attach layer 7 inspection and threat prevention to a policy, providing the application and threat visibility that plain L4 rules lack. Option B is correct because Application Identification (AppID) is the Junos engine that detects and classifies applications (including nested/evasive ones) so policies can match on application rather than just port/protocol, which is the foundation for extending L4 policies into layer 7. Option C is not part of the unified security policy framework since static MAC filtering is a layer 2 access control, not application/threat inspection. Option D is incorrect because static port-based service objects are exactly the traditional layer 4 matching construct that the unified policy extends beyond. Option E is incorrect because layer 2 bridging control protocols (e.g., STP, LLDP) are switching functions unrelated to layer 7 application and threat visibility.

Answer

Static MAC-address filtering lists

Answer

Traditional static port-based service objects

Answer

Layer 2 bridging control protocols

Question 12

You are configuring a security policy on an SRX Series device that must match traffic from the trust zone to the untrust zone, but only for applications HTTP and HTTPS. You want to ensure that the policy is evaluated only after a more specific policy that permits SSH. What should you do?

Accepted Answer

Place the HTTP/HTTPS policy below the SSH policy in the policy list.. Security policies on Junos SRX devices are evaluated in the order they appear in the policy list. The first policy that matches the traffic is applied, and no further policies are evaluated. To ensure that SSH traffic is handled by a specific policy before a more general HTTP/HTTPS policy, the SSH policy must appear above the HTTP/HTTPS policy. Placing the HTTP/HTTPS policy below achieves this.

Answer

Use a scheduler to activate the HTTP/HTTPS policy only after the SSH policy is matched.

Answer

Configure the HTTP/HTTPS policy with a higher precedence value than the SSH policy.

Answer

Assign the HTTP/HTTPS policy to a different zone pair than the SSH policy.

Question 13

An administrator has created a security policy on an SRX Series device that permits HTTP traffic from the trust zone to the untrust zone. The administrator now wants to verify that this specific policy is matching traffic without examining the entire session table. Which operational command should be used?

Accepted Answer

show security policies hit-count. The show security policies hit-count command is specifically designed to display how many times each security policy has been matched. It gives a per-policy counter, which directly answers whether the HTTP permit policy is being evaluated and matched. Other commands either show sessions without policy attribution or only display configuration, so they do not provide the needed runtime match information.

Answer

show security zones

Answer

show configuration security policies

Answer

show security flow session

Question 14

An administrator is configuring a security policy on an SRX Series device that must allow traffic from the trust zone to the untrust zone, but only for users who have authenticated via the device's captive portal. Which policy match condition should be used?

Accepted Answer

source-identity. The source-identity match condition is used to enforce policies based on authenticated user or group. When a captive portal is used, users authenticate and their identity is associated with their traffic. The policy can then match on source-identity to allow only authenticated users, providing granular access control.

Answer

source-zone

Answer

source-address

Answer

application

Question 15

You are configuring a security policy on an SRX Series device that must allow DNS queries from clients in the trust zone to a DNS server in the DMZ zone. You want to limit the policy to UDP port 53 and also log session creation and closure. Which two configuration elements are required in the policy to achieve this? (Choose two.)

Accepted Answer

The then log session-init and log session-close options in the policy action.. To allow DNS over UDP port 53, the policy must reference an application or application-set that includes that port. To log session creation and closure, the policy action must include log session-init and log session-close. These two elements together satisfy the matching and logging requirements.

Answer

A NAT rule that translates the DNS server address to a public IP.

Answer

The then count and log options in the policy action.

Answer

A firewall filter applied to the DMZ interface that counts UDP port 53 packets.