JNCIA-SEC Srx Series Service Gateways Practice Test 5 — 15 Questions

Question 1

You are configuring a branch SRX Series device and need to verify the software version and installed packages currently running. Which command should you execute?

Accepted Answer

show version. On Junos, the 'show version' command displays the software version, including the Junos OS release, the model, and the installed package suite. It is the standard command to verify the currently running software version and packages. This command provides a concise summary of the system's software state.

Answer

show os release

Answer

show chassis firmware

Answer

show system software status

Question 2

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool is exhausted, the SRX cannot allocate a new source port for a new session. Since NAT is a mandatory step in the first path packet processing for that policy, the session creation fails and the packet is dropped. The 'show security nat source pool' command would show the pool's utilization at 100%, confirming resource exhaustion.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 3

What is the primary function of the Junos OS 'commit check' command?

Accepted Answer

It validates the syntax and semantic correctness of the candidate configuration without activating it.. 'commit check' verifies the syntax and semantic validity of the candidate configuration without applying it.

Answer

It checks the hardware temperature and fan speeds.

Answer

It verifies user password strength.

Answer

It checks for available software updates on the Juniper cloud.

Question 4

You are configuring a vSRX Virtual Firewall in a private cloud. Which virtual interface type is typically used for management traffic in a vSRX deployment?

Accepted Answer

fxp0. In a vSRX deployment, the fxp0 interface is the out-of-band management interface, used for management traffic such as SSH, SNMP, and Junos OS upgrades. It is separate from data plane interfaces.

Answer

st0

Answer

lo0

Answer

reth0

Question 5

An administrator configures security policies using logical systems (LSYS) on an enterprise SRX Series device. What is the primary benefit of deploying logical systems on an SRX gateway?

Accepted Answer

Logical systems partition a single physical SRX device into multiple virtual firewall instances with independent administrative domains, routing tables, and policies.. Logical systems (LSYS) on an SRX Series device partition a single physical firewall into multiple independent virtual firewall instances. Each logical system has its own administrative domain, routing table, security policies, zones, and interfaces, allowing service providers or large enterprises to isolate tenants or departments on shared hardware. This provides multi-tenancy without deploying separate physical devices, reducing cost and management overhead.

Answer

Logical systems increase physical interface bandwidth by aggregating ports.

Answer

Logical systems accelerate IPsec encryption throughput.

Answer

Logical systems replace the need for high-availability clustering.

Question 6

An administrator configures source NAT with port address translation (PAT) on an SRX device. They notice that internal hosts are exhausting available source ports rapidly. Which CLI command or setting allows the administrator to monitor PAT pool port utilization and allocation?

Accepted Answer

show security nat source pool statistics. The command 'show security nat source pool statistics' displays per-pool statistics including the number of allocated ports, the port range, and utilization, which is exactly what is needed to monitor PAT pool port exhaustion. It is the operational command for inspecting source NAT pool port allocation on SRX.

Answer

show chassis nat utilization

Answer

show system port-allocation

Answer

show flow nat sessions

Question 7

You are troubleshooting an IPsec VPN tunnel between two SRX Series gateways. Phase 2 negotiations are failing. Which operational command should you use to check Phase 2 IPsec security association statuses and traffic counters?

Accepted Answer

show security ipsec security-associations. The command 'show security ipsec security-associations' displays Phase 2 IPsec security association status, including SPI, encryption/authentication algorithms, and traffic counters (bytes/packets). This is the correct operational command to verify whether Phase 2 SAs are up and passing traffic on an SRX.

Answer

show security ike security-associations

Answer

show vpn tunnels active

Answer

show crypto ipsec sa

Question 8

You are configuring a branch SRX Series device and need to verify the software version and installed packages currently running. Which command should you execute?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show security zones. The command 'show security zones' displays security zones and their assigned interfaces.

Answer

show zones interface-mapping

Answer

show interfaces security-zone

Answer

show firewall zones

Question 9

What is the default action of Junos OS when an administrator exits configuration mode without committing changes?

Accepted Answer

The candidate configuration changes are discarded.. In Junos OS, configuration changes are made to a candidate configuration and only become active when committed. If an administrator exits configuration mode without running 'commit,' the candidate configuration changes are discarded, and the device reverts to the last committed configuration.

Answer

The changes are saved to a temporary backup file only.

Answer

The changes are automatically saved and committed.

Answer

The device reboots to clear the memory.

Question 10

When configuring physical and logical interfaces on an SRX Series device, which TWO parameters are required to properly define a logical unit for IP routing? (Choose two)

Accepted Answer

Family inet IP address assignment. Option D is correct because a logical unit must be assigned an IP address under a protocol family, and for IP routing this is done with the family inet address statement (e.g., set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/24), which gives the interface its routable Layer 3 identity. Option E is correct because every logical interface is identified by a unit number, such as unit 0, and this unit number is what binds the configuration stanza (family inet address, VLAN tagging, etc.) to a specific logical interface on the physical port. Option A is not required because BGP is a routing protocol that is configured separately under protocols bgp with an autonomous system number; it is not part of defining a logical unit for IP routing. Option B is not required because a redundancy group ID is only used in chassis cluster configurations to control failover, not to define a logical interface. Option C is not required because MAC address override is an optional Layer 2 setting used in specific scenarios such as certain HA or switching designs, not a mandatory parameter for a logical unit carrying IP routing.

Answer

BGP autonomous system number

Answer

Chassis cluster redundancy group ID

Answer

MAC address override

Question 11

Which TWO actions occur during the initial packet flow processing on an SRX Series device when a new session is established? (Choose two)

Accepted Answer

Route lookup (destination routing table check). When a new session is established, the SRX performs a route lookup and evaluates security policies to determine whether to permit or deny the flow.

Answer

Immediate CPU kernel panic generation

Answer

Automatic conversion of IPv4 to IPv6

Answer

Immediate flooding of the packet to all zone interfaces

Question 12

Which TWO components are fundamental parts of the SRX Series architecture in enterprise-class hardware models? (Choose two)

Accepted Answer

Routing Engine (RE). The Routing Engine (RE) (A) is a fundamental component of the SRX Series architecture in enterprise-class hardware models, as it runs Junos OS, handles control-plane functions such as routing protocols, management, and system configuration, and is separate from the data plane. The Security Processing Card (SPC) / IOC (B) is also fundamental because it provides the data-plane processing for security services like firewall inspection, IPsec, NAT, and other flow-based features in enterprise SRX chassis-based platforms. Options C, D, and E are not part of the SRX enterprise hardware architecture: an integrated ADSL modem chip is a WAN access component found in some branch/residential gateways, not a core SRX enterprise architecture element; a floppy disk drive controller is obsolete and unrelated to SRX design; and a Token Ring interface controller is a legacy LAN technology that SRX platforms do not use.

Answer

Integrated ADSL modem chip

Answer

Floppy disk drive controller

Answer

Token Ring interface controller

Question 13

Which TWO methods can be used to access the Junos CLI on an SRX Series device during initial setup or routine administration? (Choose two)

Accepted Answer

Local console serial connection. Option A (Local console serial connection) is correct because the SRX Series provides an RJ-45 or mini-USB console port that gives out-of-band CLI access using settings such as 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control, which is the standard method for initial setup when no network is configured. Option E (Secure Shell (SSH) over network interfaces) is correct because once an interface has an IP address and the device is reachable, Junos supports SSH (TCP port 22) for encrypted remote CLI administration, which is the recommended in-band management method. Option B is incorrect because SRX devices do not offer a Bluetooth pairing app for CLI access. Option C is incorrect because Telnet is not enabled by default on Junos and is disabled for security reasons; it must be explicitly configured under the [system services telnet] hierarchy. Option D is incorrect because the SPC (Services Processing Card) does not expose a VGA and USB keyboard interface for direct CLI access.

Answer

Bluetooth pairing app

Answer

Unencrypted Telnet by default

Answer

VGA monitor and USB keyboard directly plugged into SPC

Question 14

An administrator is configuring Source NAT on an SRX Series device. Which THREE match criteria can be used within a Source NAT rule set or rule to identify traffic for translation? (Choose three)

Accepted Answer

Application or protocol / port. In Junos security NAT on SRX Series devices, a source NAT rule set is matched using a from clause that can reference source-address (D), destination-address (C), and application or application-set, which defines protocol/port criteria (B); these are the standard traffic-identification match conditions for source NAT. Option D is correct because the source address/prefix is the primary match that selects which internal hosts are translated. Option C is correct because destination address/prefix can be used to restrict translation to traffic destined for specific external networks. Option B is correct because application or protocol/port match criteria allow the rule to translate only specific services such as HTTP or DNS. Option A is incorrect because CPU utilization threshold is not a NAT match criterion; it is a system resource metric, not part of a source NAT rule. Option E is incorrect because chassis cluster node serial number is not a match condition in a source NAT rule set or rule.

Answer

CPU utilization threshold

Answer

Chassis cluster node serial number

Question 15

Which TWO tasks are performed using Junos operational mode commands? (Choose two)

Accepted Answer

Viewing interface status and traffic counters. Option A is correct because viewing interface status and traffic counters is done with operational mode commands such as 'show interfaces' and 'show interfaces extensive', which display real-time operational data without changing the configuration. Option D is correct because rebooting the routing engine is performed with the operational mode command 'request system reboot', which is an operational (not configuration) task. Options B, C, and E are incorrect because creating security policies, editing candidate configurations, defining security zones, and configuring static routes are all configuration tasks performed in configuration mode (e.g., via 'edit', 'set', or 'commit'), not operational mode.

Answer

Creating new security policies and editing candidate configurations

Answer

Defining security zones

Answer

Configuring static routes