JNCIA-SEC Srx Series Service Gateways Practice Test 2 — 15 Questions

Question 1

An administrator is troubleshooting a high-availability (HA) cluster on SRX Series devices. Which THREE states or conditions are valid operational statuses for redundancy groups in a chassis cluster? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Primary. Chassis cluster redundancy groups maintain operational states such as Primary, Secondary, and Ineligible.

Answer

Disabled

Answer

Suspended

Question 2

An administrator is troubleshooting high CPU utilization on the Routing Engine of an enterprise SRX Series device. They suspect a runaway routing protocol or management process. Which command displays the top processes consuming CPU resources on the Routing Engine?

Accepted Answer

show system processes summary (or 'show system processes extensive'). The command 'show system processes extensive' or similar shell commands display CPU consumption by individual system processes.

Answer

show security spc processes

Answer

show kernel cpu-usage

Answer

show chassis cpu-processes

Question 3

Which TWO characteristics describe security zones on an SRX Series gateway? (Choose two)

Accepted Answer

Traffic between interfaces in the same security zone is permitted by default (intra-zone traffic).. Option C is correct because on Juniper SRX Series gateways, interfaces bound to the same security zone form an intra-zone context, and the default behavior permits traffic between them without requiring an explicit inter-zone policy (intra-zone traffic is allowed by default, though it can be restricted with host-inbound or intra-zone policies). Option E is correct because an interface must be assigned to a security zone before zone-based security policies can be evaluated; unassigned interfaces cannot have policies applied and traffic traversing them is not processed by the policy engine. Option A is wrong because security zones work alongside, not instead of, the routing table—the SRX still uses IP routing to forward packets between zones. Option B is wrong because security zones are used for all transit and host traffic (trust, untrust, DMZ, etc.), not just out-of-band management. Option D is wrong because a security zone can contain multiple physical interfaces, as well as logical units, VLANs, and reth interfaces.

Answer

Security zones eliminate the need for IP routing tables.

Answer

Security zones are only used for out-of-band management.

Answer

Security zones can only contain a single physical interface.

Question 4

Which TWO files or configurations are associated with saving and restoring Junos configurations? (Choose two)

Accepted Answer

Candidate configuration (juniper.conf.gz.cpp or active edit buffer). Junos configuration management utilizes candidate configurations, active running configurations, and rollback history files.

Answer

Linux kernel swap partition

Answer

BIOS CMOS battery configuration

Answer

Windows Registry hive file

Question 5

An administrator is deploying a vSRX Virtual Firewall. Which THREE hypervisor platforms are officially supported for vSRX deployments by Juniper Networks? (Choose three)

Accepted Answer

Amazon Web Services (AWS) EC2. Option A (Amazon Web Services EC2) is correct because Juniper officially supports vSRX on AWS as a cloud-deployed virtual firewall instance. Option B (KVM) is correct because vSRX is officially supported on Kernel-based Virtual Machine, a common Linux-based hypervisor for NFV deployments. Option C (VMware ESXi) is correct because vSRX is officially supported on VMware ESXi, a widely used enterprise hypervisor. Option D (Apple iOS) is incorrect because iOS is a mobile operating system, not a hypervisor platform for vSRX. Option E (Microsoft Windows Notepad) is incorrect because Notepad is a text editor application, not a hypervisor or virtualization platform.

Answer

Apple iOS mobile operating system

Answer

Microsoft Windows Notepad application

Question 6

Which TWO features are provided by Junos 'Screens' on an SRX Series gateway? (Choose two)

Accepted Answer

Real-time cloud database backup scheduling. Security screens protect against IP spoofing, SYN floods, and other protocol anomaly attacks.

Question 7

An administrator is configuring static NAT on an SRX Series gateway to map a public IP address to an internal web server. Which THREE components are required to successfully implement Static NAT? (Choose three)

Accepted Answer

A NAT rule set specifying the appropriate direction (e.g., from zone to zone). Static NAT on an SRX Series gateway requires a rule set that defines the direction of traffic, such as from an untrust zone to a trust zone, so option A is correct because the rule set determines where the NAT rule is evaluated. Option D is correct because a NAT rule must contain match criteria, such as destination address or destination port, to identify the traffic that should be translated. Option E is correct because static NAT specifically requires a static translation statement that maps the internal private IP address to the external public IP address, creating a fixed one-to-one mapping. Option B is incorrect because IPv6 multicast listener discovery is unrelated to static NAT configuration. Option C is incorrect because a BGP AS path override statement is a routing policy feature and is not required for static NAT.

Answer

An IPv6 multicast listener discovery protocol daemon

Answer

A BGP Autonomous System path override statement

Question 8

An administrator is troubleshooting session table memory usage on an SRX Series gateway. Which THREE parameters or statistics can be analyzed using operational commands to understand active session distribution? (Choose three)

Accepted Answer

Total active session count and maximum allowed sessions. Session table distribution and memory usage can be analyzed via session summary counts, protocol distributions, and maximum session limits.

Answer

Power supply voltage fluctuation logs

Answer

Chassis cooling fan RPM speeds

Question 9

An administrator configures an SRX Series device to inspect traffic between the untrust and trust zones. After applying a security policy, the administrator notices that asymmetric routing is causing packets to be dropped because the state table lookup fails. Which command should the administrator use to bypass strict session checking for specific traffic flows on the SRX?

Accepted Answer

set security flow tcp-session no-syn-check. Juniper SRX devices allow disabling strict session checking using security flow options to accommodate asymmetric routing scenarios.

Answer

set security zones security-zone trust bypass-firewall

Answer

set security flow asymmetric-routing permit

Answer

set firewall filter NO_SYN term 1 then accept

Question 10

You are troubleshooting a traffic flow issue on an SRX Series gateway and need to trace packets traversing the SPUs to determine where traffic is being dropped. Which CLI command initiates real-time packet tracing on the SRX forwarding plane?

Accepted Answer

monitor security flow traceoptions. The monitor security flow traceoptions command enables real-time logging and debugging of traffic flows passing through the Security Processing Units (SPUs) on an SRX device.

Answer

monitor traffic interface ge-0/0/0

Answer

show security flow session

Answer

traceoptions security packet-log start

Question 11

You are configuring interface-based NAT on an SRX Series device. Packets exiting the external interface must have their source IP addresses translated to the IP address assigned to that egress interface. Which configuration statement achieves this?

Accepted Answer

set security nat source rule-set RS rule R1 match source-address 192.168.1.0/24 then source-nat interface. Interface-based source NAT is configured with the 'source-nat interface' statement, which tells the SRX to translate the source IP of matching packets to the IP address assigned to the egress interface. This is the correct syntax for the requirement described.

Answer

set security nat source rule-set RS rule R1 match source-address 0.0.0.0/0 then source-nat off

Answer

set security nat source rule-set RS rule R1 then pool POOL-1

Answer

set security nat destination rule-set RDS rule RD1 then interface-nat

Question 12

When configuring High Availability (HA) Clustering on SRX Series devices, which THREE components or files are synchronized between the primary and secondary nodes? (Choose three)

Accepted Answer

Active security session state tables for stateful failover. In an SRX chassis cluster, control link synchronization ensures both nodes share state information, including security sessions, configuration, and routing tables.

Answer

Raw packet capture logs stored in local flash memory buffer files

Answer

The complete Junos OS software image version on the flash storage of the backup node automatically upon cluster formation.

Question 13

Which TWO actions occur during packet processing when an SRX Series device operates in packet-based (stateless) mode rather than flow-based (stateful) mode? (Choose two)

Accepted Answer

Firewall filters (ACLs) are evaluated for traffic filtering instead of security policies.. Switching an SRX to packet-based mode disables the security processing engine's stateful inspection, causing the device to act similarly to a traditional router using firewall filters.

Answer

Network Address Translation (NAT) continues to operate normally using security NAT rules.

Answer

Security sessions are created in the session table to track TCP and UDP connections.

Answer

Application-level gateways (ALGs) inspect FTP and SIP traffic streams dynamically.

Question 14

An administrator is configuring a new SRX Series branch device and needs to set up initial management access. Which THREE access methods are available by default or commonly configured for device administration? (Choose three)

Accepted Answer

SSH access via operational interfaces configured with security zones. Administrators can access the SRX Series device via the console port, out-of-band management interface (such as fxp0 or dedicated management ports), or in-band logical interfaces using SSH and HTTPS.

Answer

Automated SNMPv1 read-write community string polling for configuration pushes

Answer

Direct kernel debugging via unencrypted Telnet on all data interfaces

Question 15

When troubleshooting packet flow and session behavior on an SRX Series device, which THREE commands or tools are commonly used by administrators to inspect active sessions and packet paths? (Choose three)

Accepted Answer

monitor security flow. Administrators use commands like 'show security flow session', 'monitor security flow', and traceoptions to analyze active states and debug packet paths through the flow module.

Answer

clear ethernet switching table