JNCIA-SEC Srx Series Service Gateways Practice Test 3 — 15 Questions

Question 1

An administrator has just finished configuring security zones on a new SRX Series device. They want to confirm which interfaces are currently bound to each zone and see the default policies that apply. Which operational mode command provides this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show security zones. The show security zones command is the correct operational-mode command to verify which interfaces are assigned to each security zone and to view the default policy action for each zone. It provides a concise summary of zone configuration and operational status without needing to parse the entire configuration.

Answer

show security policies

Answer

show interfaces terse

Answer

show configuration security zones

Question 2

An administrator is deploying an SRX Series gateway in a small branch office and needs to configure the device so that it can be managed remotely over the untrusted Internet. The administrator wants to restrict management access to SSH only, from a specific host subnet, and ensure that the management interface is in the correct zone. Which configuration sequence accomplishes this?

Accepted Answer

Configure the fxp0 interface with an IP address, assign it to the management zone, enable SSH under [edit system services], and configure host-inbound-traffic to allow SSH from the specific subnet under the management zone.. The fxp0 interface is the dedicated management interface on SRX Series devices. Placing it in the management zone and enabling SSH under system services provides remote access. Host-inbound-traffic under the management zone restricts access to specific protocols and source addresses, fulfilling the requirement to allow SSH only from a specific host subnet. This approach is secure and follows Juniper best practices.

Answer

Configure the ge-0/0/0 interface with an IP address, assign it to the untrust zone, then enable SSH under [edit system services] and apply a firewall filter to restrict access to the management subnet.

Answer

Configure the fxp0 interface with an IP address, assign it to the untrust zone, enable SSH under [edit system services], and configure a security policy to allow SSH from any source to the fxp0 interface.

Answer

Configure the ge-0/0/1 interface with an IP address, assign it to the trust zone, enable Telnet under [edit system services], and use a firewall filter to allow only SSH traffic.

Question 3

An administrator is configuring an SRX Series device to provide Internet access for internal users. The internal network is in the trust zone, and the Internet-facing interface is in the untrust zone. The administrator wants to ensure that internal users can access the Internet but external users cannot initiate connections to internal hosts. Which security policy configuration achieves this?

Accepted Answer

Create a policy from trust to untrust that permits all traffic, and a policy from untrust to trust that denies all traffic.. To allow internal users to access the Internet while blocking external users from initiating connections to internal hosts, the security policy must permit traffic from the trust zone to the untrust zone and deny traffic from the untrust zone to the trust zone. This is a fundamental stateful firewall configuration on SRX Series devices.

Answer

Create a policy from untrust to trust that permits all traffic, and a policy from trust to untrust that denies all traffic.

Answer

Create a policy from trust to untrust that permits only HTTP and HTTPS, and a policy from untrust to trust that permits only HTTP and HTTPS.

Answer

Create a policy from trust to untrust that permits all traffic, and rely on the default policy from untrust to trust, which is deny all.

Question 4

An administrator is deploying an SRX Series device in a small branch office. The device has two ISP uplinks. The administrator wants the SRX to automatically select the best path for outbound traffic based on probe responses and to fail over when the primary link degrades. Which feature should be configured?

Accepted Answer

IP monitoring with route failover. IP monitoring on SRX Series devices uses ICMP probes to track reachability of a target IP address through a specific interface. When probes fail, the associated route is removed and a backup route becomes active. This provides automatic failover based on actual path health, which is exactly what the branch office requires for its two ISP uplinks.

Answer

Link Aggregation Group (LAG)

Answer

Bidirectional Forwarding Detection (BFD)

Answer

Real-Time Performance Monitoring (RPM)

Question 5

You are configuring physical interfaces on an SRX Series gateway. Which command structure is used to assign an interface to a specific security zone in Junos?

Accepted Answer

set security zones security-zone interfaces . In Junos, security zones are configured under the [security zones] hierarchy. The correct syntax is 'set security zones security-zone interfaces ', which binds a physical or logical interface to a named zone. This is the standard Junos CLI structure used on SRX devices for zone assignment.

Answer

set firewall zone-mapping interface zone

Answer

set interfaces security-zone

Answer

set routing-options zones interface

Question 6

A network engineer is setting up a vSRX Virtual Firewall in a cloud environment. Which component acts as the control plane equivalent to a physical Routing Engine?

Accepted Answer

Virtual Routing Engine (vRE). In a vSRX deployment, the control plane functionality is handled by the virtual Routing Engine (vRE), running as a virtual machine instance.

Answer

Virtual Interface Card (VIC)

Answer

Virtual Forwarding Plane (vFP)

Answer

Virtual Security Processor (vSP)

Question 7

An administrator configures a high availability (HA) cluster on two SRX550 devices. During failover testing, they observe that stateful sessions are abruptly dropped. Which feature must be properly synchronized between the primary and secondary nodes to prevent session drop during failover?

Accepted Answer

Session synchronization. To prevent stateful session drops during SRX HA failover, session synchronization must be enabled and properly synchronized between the primary and secondary nodes. Session synchronization replicates session state (flow tables, NAT translations, and related state) so the backup node can take over without dropping established sessions. Without it, the secondary has no knowledge of existing flows and drops them upon failover.

Answer

NAT pool reservation sync

Answer

IDP signature database sync

Answer

Routing table synchronization

Question 8

An enterprise network uses a vSRX deployed on a hypervisor. The administrator needs to allocate additional vCPUs to improve throughput. Which component's performance is primarily enhanced by increasing vCPUs on a vSRX?

Accepted Answer

Virtual Forwarding Plane (vFP) data path processing. In a vSRX, the Virtual Forwarding Plane (vFP) utilizes the allocated vCPUs for packet processing and security forwarding performance.

Answer

CLI responsiveness and SSH login speed

Answer

Junos Space management communication

Answer

Virtual Routing Engine (vRE) control plane convergence

Question 9

You are configuring a branch SRX Series device and need to verify the operational state of the integrated interface modules. Which CLI command should you use to check the physical and link status of all network ports on a compact SRX device?

Accepted Answer

show interfaces terse. The command 'show interfaces terse' or 'show interfaces' provides detailed operational status of physical and logical interfaces, including link states.

Answer

show security policies

Answer

show route summary

Answer

show chassis hardware

Question 10

Which hardware architecture distinction is characteristic of enterprise-grade SRX Series gateways (such as SRX4100 or SRX4600) compared to entry-level branch SRX models?

Accepted Answer

Enterprise SRX models feature separation of control plane (RE) and data/security plane (SPC) hardware architecture. Enterprise-grade SRX models (SRX4100/4600/5400) use a hardware architecture that separates the control plane (Routing Engine) from the data/security plane (Services Processing Card/SPU), allowing independent scaling and higher throughput. Branch SRX models (300/320/380) typically integrate control and data plane functions into a single CPU/ASIC.

Answer

Enterprise SRX devices run ScreenOS instead of Junos OS

Answer

Branch SRX devices do not support security policies

Answer

Branch SRX models use modular SPCs while enterprise models use fixed ports

Question 11

You are troubleshooting an interface on an SRX Series device that is dropping frames due to cyclic redundancy check (CRC) errors. Which operational command helps identify physical layer framing issues?

Accepted Answer

show interfaces extensive. The command 'show interfaces extensive' provides deep operational statistics, including error counters such as framing errors, drops, and CRC errors.

Answer

show system statistics

Answer

show chassis alarms

Answer

show security monitoring status

Question 12

An administrator configures Source NAT on an SRX device. During verification, traffic from the internal zone to the external zone is failing. They run 'show security flow session' and see sessions in 'N/A' state with zero return traffic. Which mechanism in the SRX packet flow is responsible for translating the source IP address?

Accepted Answer

After the security policy permits the new session, during session creation. Source NAT translation is executed during the session establishment phase right after the security policy lookup permits the new session.

Answer

Within the Routing Engine control plane process

Answer

Before initial session lookup

Answer

After the packet leaves the egress interface

Question 13

When configuring security zones on an SRX Series device, what is the default behavior for traffic moving between two different security zones if no security policy is explicitly defined?

Accepted Answer

Traffic is dropped by default (implicit deny). By default, the SRX enforces a deny-all policy between different security zones unless an explicit security policy permits the traffic.

Answer

Traffic is redirected to the management port

Answer

Traffic is flooded to all interfaces

Answer

Traffic is permitted by default

Question 14

An administrator notices that traffic matching a specific security policy is being dropped, and the log shows 'RTR_UNREACHABLE'. Where in the SRX packet flow sequence does this drop typically occur?

Accepted Answer

During the route lookup stage following session creation or policy evaluation. When the SRX attempts to forward a packet and finds no valid route in the forwarding table, a routing lookup failure occurs after the policy check.

Answer

During initial screen option validation

Answer

During application identification (AppID) inspection

Answer

During NAT pool allocation

Question 15

An administrator is troubleshooting a vSRX deployment where packet forwarding performance is severely degraded. They suspect that the virtual interfaces are not utilizing direct memory access or optimized packet processing drivers. Which virtualization technology integration is critical for optimal vSRX performance?

Accepted Answer

SR-IOV or DPDK integration. SRIOV (Single Root I/O Virtualization) or DPDK (Data Plane Development Kit) is essential for high-performance virtual packet processing in vSRX deployments.

Answer

Virtual machine snapshot scheduling

Answer

SNMP v3 trap forwarding

Answer

RADIUS accounting synchronization