JNCIA-SEC Srx Series Service Gateways Practice Test 3 — 15 Questions

Question 1

Which Junos command displays active alarms on an SRX Series device, helping you quickly identify hardware faults or system errors?

Accepted Answer

show system alarms. The 'show chassis alarms' and 'show system alarms' commands display current hardware and system alarms.

Answer

show fault status

Answer

show active warnings

Answer

show error logs

Question 2

An administrator configures NAT on an SRX Series gateway and encounters an issue where overlapping IP spaces require destination NAT and source NAT (twice NAT) simultaneously. In what order are NAT rules evaluated in the SRX packet flow?

Accepted Answer

Destination NAT is evaluated before routing and security policy lookup, while Source NAT is evaluated later in the flow pipeline. Destination NAT is evaluated first on incoming packets before routing lookup, while source NAT is evaluated later in the packet flow outbound.

Answer

Both NAT types are evaluated simultaneously in a single processing step.

Answer

NAT rules are only evaluated after session termination.

Answer

Source NAT is evaluated before Destination NAT

Question 3

An administrator sets up a virtual router routing instance on an SRX Series device to isolate customer traffic. How do security policies interact with traffic passing between different routing instances or security zones within virtual routers?

Accepted Answer

Security policies continue to be enforced based on security zone membership, and inter-zone traffic requires explicit policy rules regardless of virtual router boundaries.. Security policies on SRX devices are bound to security zones, and zones can span virtual routers or be assigned per routing instance depending on configuration, requiring explicit inter-zone policies.

Answer

Security policies automatically permit all traffic between virtual routers.

Answer

Virtual routers replace security zones entirely.

Answer

Security policies are bypassed when virtual routers are used.

Question 4

What is the purpose of the 'commit confirmed' command in Junos OS on an SRX Series device?

Accepted Answer

It tests the configuration and applies it temporarily, automatically reverting if not confirmed within a timeout period.. 'commit confirmed' automatically rolls back the configuration if a confirmation command is not issued within a specified time limit, preventing lockout.

Answer

It permanently saves the configuration without any rollback capability.

Answer

It confirms that the hardware is operating correctly.

Answer

It sends an email confirmation of the commit to the admin.

Question 5

You are configuring secure remote access to an SRX Series device via SSH. Which configuration hierarchy is used to restrict administrative access to specific trusted source IP addresses?

Accepted Answer

set system services ssh allow-access source-address <ip>. Administrative access services (such as SSH) and trusted source addresses are configured under 'set system services ssh'.

Answer

set security policies

Answer

set management security-zone trusted-hosts

Answer

set firewall filter management-filter

Question 6

You need to back up the current configuration of an SRX Series device to an external SCP server. Which operational mode command correctly transfers the active configuration file?

Accepted Answer

file copy /config/juniper.conf.gz scp://user@server:/path/. The 'save' or file transfer commands in operational mode can copy configuration files, or 'file copy' can transfer files via SCP.

Answer

transfer config scp

Answer

copy configuration to scp://...

Answer

backup system configuration remote

Question 7

An administrator notices high memory utilization on an SRX Series device. Upon inspection, they find that the security flow session table is nearing its maximum capacity. Which command adjusts the maximum session table limits or monitors session resource usage?

Accepted Answer

set security max-sessions <number>. Session scaling and system resource allocation for flows are configured under 'set security max-sessions' or viewed via flow statistics.

Answer

set system max-sessions

Answer

set chassis flow memory-limit

Answer

set forwarding-options session-limit

Question 8

Which interface type on an SRX Series device is typically used to connect internal local area networks (LANs) to the security gateway?

Accepted Answer

Gigabit Ethernet (ge- / xe-) interfaces. Gigabit Ethernet (ge-) or similar physical and logical interfaces are used to connect local networks.

Answer

fab0 and fab1

Answer

lc-0/0/0

Answer

fxp0

Question 9

What is the primary role of the Routing Engine (RE) in an enterprise SRX Series gateway?

Accepted Answer

Executing control plane functions, running Junos OS, managing routing protocols, and processing device configuration. The Routing Engine executes the control plane functions, including routing protocols, system management, and configuration.

Answer

Encrypting IPsec VPN traffic using specialized cryptographic hardware chips

Answer

Processing stateful packet inspection and fast-path data forwarding

Answer

Providing physical Ethernet port switching

Question 10

Which Junos configuration mode command is used to delete an existing configuration statement?

Accepted Answer

delete. The 'delete' command removes configuration statements in Junos edit mode.

Answer

clear

Answer

remove

Answer

no

Question 11

You are configuring a branch SRX Series device and need to verify the software version and installed packages currently running. Which command should you execute?

Accepted Answer

show version. The command 'show version' displays the running Junos OS version and installed software packages.

Answer

show os release

Answer

show chassis firmware

Answer

show system software status

Question 12

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool runs out of available ports or IP addresses, new session creation fails and packets are dropped.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 13

What is the primary function of the Junos OS 'commit check' command?

Accepted Answer

It validates the syntax and semantic correctness of the candidate configuration without activating it.. 'commit check' verifies the syntax and semantic validity of the candidate configuration without applying it.

Answer

It checks the hardware temperature and fan speeds.

Answer

It verifies user password strength.

Answer

It checks for available software updates on the Juniper cloud.

Question 14

Which command is used to display the current system uptime and date on an SRX Series device?

Accepted Answer

show system information. The 'show system information' command displays system uptime, version, and host details.

Answer

show clock uptime

Answer

show system uptime

Answer

show device status

Question 15

An enterprise network uses an SRX Series gateway configured with multiple security zones. An administrator notices asymmetric routing occurring across two different firewall interfaces. How does the SRX handle asymmetric routing by default?

Accepted Answer

Asymmetric traffic is dropped by default due to strict stateful inspection unless flow-based session options or flow bypass / asymmetric routing features are configured.. By default, strict stateful inspection requires packets of a session to traverse the same SRX device and path; asymmetric routing without proper stream-detection or flow configuration can cause session drops.

Answer

Asymmetric routing automatically triggers an HA failover.

Answer

Asymmetric routing is automatically accepted and optimized without any configuration changes.

Answer

The SRX forwards asymmetric packets to the Routing Engine for software bridging.