JNCIA-SEC Timed Practice Test 1 — 10 Questions

Question 1

An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The source NAT rule is missing the 'then source-nat interface' action statement.. Interface-based Source NAT requires the configuration under the security nat source rule-set to reference the correct 'from zone' and 'to zone', and the rule must contain 'then source-nat interface'. If the rule is missing or not applied to the traffic flow direction, translation will not occur.

Answer

The security policy is evaluating the post-translation source IP instead of the pre-translation IP.

Answer

Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.

Answer

Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.

Question 2

You are troubleshooting a Junos security deployment where Source NAT is configured with a pool. You observe that certain internal applications fail because the external receiving server expects the source port to remain identical to the internal client's ephemeral port (Port Preservation). Which feature or configuration setting should be applied to the source NAT pool to maintain source port numbers whenever possible?

Accepted Answer

Configure port preservation or persistent-nat on the source NAT pool to attempt retaining the original source port.. When port preservation is required so that the translated source port matches the original source port (if available), Junos supports port preservation options or persistent NAT settings on the source NAT pool.

Answer

Disable PAT globally so that source NAT operates exclusively as 1:1 without port translation.

Answer

Set the security policy action to 'port-preserve trust'.

Answer

Configure Static NAT instead of Source NAT for all clients requiring port preservation.

Question 3

An administrator deploys Static NAT on a Junos OS device to provide a one-to-one mapping between a public IP address (198.51.100.10) and an internal server IP address (10.1.1.10). When external clients attempt to ping the public IP address, the SRX does not respond. Other services work correctly. What must be configured to allow the SRX to respond to ICMP requests for the Static NAT IP?

Accepted Answer

Configure Proxy ARP on the external egress interface for the static NAT public IP address.. Static NAT on Junos OS requires Proxy ARP to be enabled on the external interface so that the SRX answers ARP requests for the static NAT public IP address originating from the upstream router.

Answer

Configure a Source NAT rule matching the ICMP traffic from the internal server.

Answer

Add an explicit static route for the internal server pointing to the Null0 interface.

Answer

Enable ICMP inspection within the security ALG configuration under security algorithms.

Question 4

An administrator has configured multiple rules within a single Source NAT rule-set. When traffic traverses the SRX device, how does Junos OS determine which specific rule within the rule-set is applied?

Accepted Answer

Rules are evaluated top-down; the first rule matching the packet's criteria is applied.. Rules within a Junos NAT rule-set are evaluated in top-down order (the order in which they were created or inserted). The first rule whose match criteria (source address, destination address, applications, etc.) match the packet is applied.

Answer

Rules are evaluated based on specificity; the most specific match is always applied regardless of configuration order.

Answer

Rules are evaluated using hashing algorithms to distribute translation loads evenly across rules.

Answer

All matching rules are combined, and translations are applied concurrently.

Question 5

You manage an SRX device where multiple internal subnets require Source NAT out to the internet using a shared pool of public IP addresses. However, specific internal servers must always map to a dedicated, unique public IP address to maintain whitelisting on external partner firewalls. How should you configure this requirement?

Accepted Answer

Configure a specific source NAT rule matching the server's IP address placed above the general rule in the rule-set evaluation order.. To ensure specific hosts map to a dedicated public IP while general traffic uses a pool, you can create a specific Source NAT rule with a higher match priority (higher in rule order) specifying the server's IP, translating to a dedicated pool or address, followed by a general rule for all other traffic.

Answer

Use interface-based NAT for the servers and pool-based NAT for the remaining internal subnets.

Answer

Configure Static NAT for the entire subnet and override individual host entries using Source NAT pools.

Answer

Enable persistent-nat on the general source NAT pool and bind the server's MAC address to the public IP.

Question 6

An administrator configures Static NAT for an internal server. After committing the configuration, the administrator notices that when external clients initiate connections, the session is created, but outbound traffic from the internal server fails to egress with the static NAT IP. Upon checking rule ordering, a broad Source NAT rule for the entire internal subnet is positioned above the static NAT evaluation stage. How does Junos NAT rule ordering resolve this?

Accepted Answer

Because Source NAT is evaluated before Static NAT, the broad Source NAT rule overrides the static NAT translation for outbound traffic.. Source NAT is evaluated before Static NAT in the Junos NAT processing order. If a Source NAT rule matches the internal host's outbound traffic, the Source NAT translation takes precedence over the static NAT source translation, resulting in incorrect IP translation.

Answer

Static NAT rule-sets take precedence only if they reside in the same zone as the destination interface.

Answer

Static NAT is evaluated before Source NAT, so static NAT always takes precedence.

Answer

Source NAT and Static NAT execute in parallel, and Junos randomly selects which translation wins.

Question 7

You are troubleshooting a Destination NAT rule where traffic matching the rule is dropped. You run 'Traceoptions' for security flow and notice that the packet hits the destination NAT rule, translates successfully, but then fails. Examining the trace output reveals: 'No route found: 10.1.1.50 -> 0.0.0.0'. What is the underlying cause?

Accepted Answer

The routing table lacks a valid route to the post-translation internal IP address.. After Destination NAT translates the destination IP address to an internal private IP, the SRX performs a route lookup on the post-translation destination IP address to determine the egress interface and next hop. If no route exists for the translated IP, the packet is dropped.

Answer

Proxy ARP is not enabled on the internal server interface.

Answer

The security policy is missing the pre-translation public IP address in the destination field.

Answer

The destination NAT pool port translation is misaligned with the server listening port.

Question 8

An administrator configures Destination NAT so that traffic to public IP 198.51.100.10 is translated to internal server 10.1.1.10. However, when the administrator checks the security logs, they notice that the source IP addresses of incoming connections are being logged as the SRX internal interface IP instead of the actual external client IP addresses. What configuration error caused this?

Accepted Answer

A Source NAT rule is inadvertently matching inbound traffic from the untrust zone and translating the client's source IP.. If source NAT is mistakenly applied to incoming destination NAT traffic (e.g., source NAT translates the external client IP to the SRX interface IP), the client IP is masked. This usually happens if a conflicting source NAT rule matches inbound traffic.

Answer

Destination NAT inherently replaces the client source IP with the local interface IP by design.

Answer

The security policy action was set to 'log session-init' without specifying 'source-nat off'.

Answer

Proxy ARP on the external interface causes source IP reflection.

Question 9

You are reviewing a Junos configuration containing both Destination NAT and Static NAT. An incoming packet matches both a Destination NAT rule and a Static NAT rule. Based on Junos OS NAT processing architecture, how is this conflict handled?

Accepted Answer

Destination NAT is evaluated first; if a match occurs, the packet is translated by Destination NAT and subsequent NAT stages are skipped for that transformation stage.. Junos OS evaluates Destination NAT first and Static NAT last. However, within distinct processing pipelines, a packet is evaluated against rule sets in order. Destination NAT rule-sets are evaluated before Static NAT rule-sets. If a packet matches a Destination NAT rule, that NAT is applied and evaluation for that stage finishes.

Answer

The SRX device generates a syntax error upon commit if overlapping Destination and Static NAT rules exist.

Answer

Both translations are applied simultaneously, resulting in double destination translation.

Answer

Static NAT takes precedence over Destination NAT because it provides a bidirectional mapping.

Question 10

Which command is used to clear active NAT sessions on an SRX Series device during troubleshooting?

Accepted Answer

clear security flow session. To clear active security sessions (which flushes active NAT state translations), the 'clear security flow session' command is utilized.

Answer

reset security nat sessions

Answer

clear route forwarding-table nat

Answer

clear security nat translation cache