JNCIA-SEC Timed Practice Test 2 — 10 Questions

Question 1

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).. Accessing a local server via its public IP address from the internal network requires 'twice NAT' or configuring source NAT alongside destination NAT (often referred to as DNS re-writing or hairpin/NAT loopback configuration) so the server replies back to the SRX rather than directly to the internal client.

Answer

Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.

Answer

Enable proxy ARP on the internal interface for the public destination IP address.

Answer

Configure a static route on the internal hosts pointing directly to the internal server IP.

Question 2

You are troubleshooting a complex Static NAT setup where an internal mail server (10.10.10.5) is mapped to a public IP (198.51.100.5). External inbound connections work, but outbound connections initiated from the mail server show that the source IP is being translated by a general interface-based Source NAT rule rather than the Static NAT mapping. How do you ensure outbound connections from the mail server use its Static NAT public IP?

Accepted Answer

Ensure that conflicting Source NAT rules are placed lower in evaluation order or exclude the mail server IP from the Source NAT rule-set match criteria.. In Junos OS, static NAT automatically provides bidirectional translation (both inbound destination and outbound source translation). However, if a more specific Source NAT rule matches the traffic first (due to rule ordering or overlapping source rules), the Source NAT rule takes precedence over the implicit static NAT source translation. The administrator must adjust rule ordering or ensure source NAT rules do not override the static NAT host.

Answer

Explicitly configure a Source NAT rule that maps the mail server IP to its own public IP address.

Answer

Disable interface-based source NAT globally and migrate all internal subnets to pool-based NAT.

Answer

Change the static NAT rule to operate as a destination-only NAT pool.

Question 3

An administrator configures a Source NAT pool and notices that multiple internal clients sharing the same public IP address are experiencing session disruptions with certain web applications that require consistent source ports. Which Junos feature should be enabled on the source NAT pool to ensure that a specific internal IP address always maps to the same translated public IP and port combination?

Accepted Answer

persistent-nat. Persistent NAT ensures that a given internal source IP and port always map to the same translated public IP and port for all outbound connections, which is required for certain stateful applications.

Answer

session-stable translation

Answer

source-nat deterministic-pat

Answer

port-mapping static

Question 4

You are troubleshooting a scenario where an SRX device is performing Static NAT for a web server. External users experience intermittent packet drops when loading large web pages. Flow traceoptions show TCP fragmentation issues and ICMP 'Fragmentation Needed' messages being dropped by the security device. Which feature should be checked or configured to resolve this Path MTU Discovery (PMTUD) issue?

Accepted Answer

Configure TCP MSS (Maximum Segment Size) adjustment on the security policies or zones to prevent packets from exceeding the path MTU.. When NAT and security devices alter packets or when MTU bottlenecks exist, ICMP Destination Unreachable / Fragmentation Needed messages must be allowed and processed correctly. Furthermore, ensuring TCP MSS clamping is correctly configured on security policies or interfaces prevents packets from exceeding the path MTU.

Answer

Disable the security ALG for TCP streams to allow raw fragmentation forwarding.

Answer

Configure a Destination NAT pool specifically for ICMP fragmentation packets.

Answer

Enable proxy-arp for all fragmented packet ranges on the static NAT interface.

Question 5

You configure a Static NAT mapping for a server. External users report that they can connect to the server, but internal users on the trust zone trying to reach the server via the same static NAT public IP experience connection timeouts. You have already verified that interface routing is correct. What specific Junos feature can be enabled to solve this internal reachability issue without changing internal DNS records?

Accepted Answer

Configure a Source NAT rule for traffic originating from the internal zone destined to the internal zone matching the static NAT IP.. Enabling source NAT for local traffic (Hairpin NAT / NAT loopback) allows internal clients to connect to internal servers using public IPs by translating the internal source IP so the server replies through the SRX.

Answer

Configure a Static NAT rule with the 'off-path' option enabled.

Answer

Change the security policy action to 'permit' with 'nat source interface' embedded.

Answer

Enable 'proxy-arp' on the internal interface facing the trusted network hosts.

Question 6

You are troubleshooting a complex network where Destination NAT forwards traffic to a server farm. Due to high availability requirements, the destination NAT pool contains multiple internal server IP addresses. How does Junos OS distribute incoming destination NAT connections across multiple pool IP addresses?

Accepted Answer

Junos distributes sessions across multiple pool IP addresses using round-robin or hash-based load distribution.. When a destination NAT pool contains multiple IP addresses, Junos distributes incoming sessions across the pool addresses using round-robin or hashing algorithms to achieve load balancing.

Answer

Destination NAT pools only support a single IP address; multiple IPs are reserved exclusively for Source NAT pools.

Answer

Junos always forwards 100% of traffic to the first IP in the pool until that server fails, acting as an active-passive pair.

Answer

Junos requires an external SLB (Server Load Balancer) hardware module to distribute traffic across a destination NAT pool.

Question 7

You are auditing a Junos security device configuration. You observe multiple Static NAT rules configured across different rule sets. One of the rules uses the 'off-path' or similar specialized handling? Wait, you recall Junos Static NAT rule configuration details. Which statement correctly describes how Junos Static NAT handles bi-directional traffic flow without requiring separate source NAT rules?

Accepted Answer

Static NAT automatically provides bidirectional translation, handling both inbound destination translation and outbound source translation implicitly.. Static NAT in Junos OS is inherently bidirectional. When you configure a static NAT rule mapping a public IP to a private IP, the SRX automatically creates both the destination NAT translation for inbound traffic and the source NAT translation for outbound traffic initiated by the internal host.

Answer

Static NAT rules must be bound to a security ALG to function bidirectionally.

Answer

Static NAT requires proxy ARP for inbound traffic and static routing tables for outbound traffic translation.

Answer

Static NAT only handles inbound traffic; outbound traffic from the internal host must always be matched by a separate Source NAT pool rule.

Question 8

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

Accepted Answer

Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.. Organizing NAT rule-sets cleanly with specific rules evaluated before generic rules, or separating rule-sets per source zone, prevents unintended rule matching and session drops.

Answer

Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

Answer

Enable global zone-bypass mode for all source NAT pools.

Answer

Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

Question 9

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

10 minute time limit — choose an answer to begin.

Accepted Answer

Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.. Destination NAT rules that specify port translation or specific application ports translate TCP/UDP flows, but ICMP packets do not contain ports. Unless explicit ICMP or static/destination NAT rules match ICMP protocol without port dependencies, ping requests to destination NAT virtual IPs may not translate or respond unless specifically handled.

Answer

ICMP ping requests are dropped by the Junos control plane as a security hardening default.

Answer

Destination NAT automatically translates and responds to all ICMP echo requests by default.

Answer

Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.

Question 10

You are troubleshooting a scenario where an SRX device is performing Static NAT. An internal server initiates outbound connections to the internet. When external recipients examine the packets, they see the correct static NAT public IP as the source. However, when the external recipients reply, the packets are dropped by the SRX. Traceoptions reveal 'No session found for packet'. What is the cause of this session lookup failure?

Accepted Answer

The return traffic security policy or session state lookup failed because the incoming return packet did not match the expected session parameters or was blocked by a policy.. When an internal server initiates an outbound connection under static NAT, the SRX creates a session table entry. If return traffic arrives with destination IP matching the static public IP, but the source port or IP does not match the expected state (or if security policies drop it), the session lookup fails.

Answer

The routing table lacks a default route for static NAT reply packets.

Answer

Static NAT requires explicit source NAT pool definitions for all outbound connections.

Answer

Proxy ARP is not enabled for the internal server's private IP address.