Courseiva

Juniper Networks Security, Associate (JNCIA-SEC, JN0-232) (JNCIA-SEC) (JNCIA-SEC) — Questions 376–393

393 questions total · 6 pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 6

376
MCQeasy

What is the default action of Junos OS when an administrator exits configuration mode without committing changes?

A.The changes are saved to a temporary backup file only.
B.The changes are automatically saved and committed.
C.The device reboots to clear the memory.
D.The candidate configuration changes are discarded.
AnswerD

Junos OS maintains a separate candidate configuration; changes take effect only on commit. Exiting configuration mode without committing discards those uncommitted edits, leaving the active configuration unchanged, which is exactly the default behaviour described in the stem.

Why this answer

In Junos OS, configuration changes are made to a candidate configuration and only become active when committed. If an administrator exits configuration mode without running 'commit,' the candidate configuration changes are discarded, and the device reverts to the last committed configuration.

Exam trap

JNCIA-SEC often tests the candidate configuration model — candidates familiar with Cisco IOS assume changes are applied immediately, but Junos requires an explicit commit and discards uncommitted changes on exit.

How to eliminate wrong answers

Option A is wrong because Junos does not automatically save uncommitted changes to a temporary backup file on exit; the candidate is simply discarded unless explicitly saved with 'save' or committed. Option B is wrong because Junos never auto-commits changes — commit is a deliberate action, which is a core design principle for change control. Option C is wrong because exiting configuration mode does not reboot the device; it simply leaves the CLI configuration context.

Full explanation →
377
MCQhard

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

A.The source zone does not have host-inbound-traffic enabled for UDP.
B.UDP traffic cannot be matched by security policies and requires stateless filters.
C.Global policies always block custom applications by default.
D.The custom application definition lacks the correct port mapping or signature definition required for AppID to correlate the traffic.
AnswerD

AppID matches traffic against application signatures and port mappings, not merely the policy's stated port. Because the custom application lacks the signature or mapping AppID needs, traffic is classified as unknown-udp and never correlates to the policy, so it is dropped.

Why this answer

If AppID classifies traffic as 'unknown-udp' and the policy specifies a specific custom application instead of a generic port service, the match fails. Alternatively, custom applications require proper signature or port mapping.

Full explanation →
378
MCQhard

An administrator is configuring static NAT on an SRX Series device to map a public IP address 203.0.113.100 to an internal server at 10.20.30.40. The internal server hosts both HTTP and HTTPS services. The administrator wants to ensure that traffic destined to 203.0.113.100 on any port is translated to 10.20.30.40, preserving the original destination port. Which configuration statement correctly achieves this?

A.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 80
B.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32
C.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 443
D.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 0
AnswerB

This statement matches all traffic destined to the public address 203.0.113.100 without restricting the port. When combined with a then static-nat prefix mapping to 10.20.30.40, it translates the destination address while preserving the original destination port. This satisfies the requirement to translate any port to the internal server while keeping the port unchanged.

Why this answer

To translate all traffic regardless of port, the static NAT rule should match only the destination address. Omitting the destination-port condition allows the rule to match any port, and the static NAT translation will preserve the original port. Specifying a particular port would limit the rule to that service only, which does not meet the requirement.

Exam trap

The trap here is adding a destination-port match when the requirement is to translate all ports, which inadvertently restricts the rule.

Full explanation →
379
MCQhard

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

A.It blocks ICMP echo requests while allowing ICMP destination unreachable messages.
B.It inspects ICMP payloads for encapsulated malicious shellcode.
C.It monitors and limits the aggregate rate of all ICMP packet types combined.
D.It drops all ICMP packets unconditionally without exception.
AnswerC

The icmp all SCREEN option applies a single aggregate threshold across every ICMP packet type combined, rather than per-type policing. It therefore satisfies the stem's requirement by monitoring and limiting the total ICMP rate, catching floods that individually stay under per-type limits.

Why this answer

The 'icmp all' SCREEN option applies flood protection and threshold monitoring across all ICMP types collectively.

Full explanation →
380
MCQmedium

An administrator configures Source NAT for an internal subnet. After committing the changes, users report that they can access external websites via IP addresses, but domain name resolution (DNS) is failing. Investigation shows DNS UDP port 53 traffic is being blocked or failing NAT translation. What is the most likely reason?

A.Source NAT automatically disables DNS Application Layer Gateways (ALGs), causing DNS packets to be dropped.
B.Security policies do not permit UDP port 53 (DNS) traffic between the source and destination zones.
C.Source NAT pools strip UDP port headers, preventing DNS responses from matching.
D.DNS traffic requires Static NAT and cannot traverse Source NAT pools.
AnswerB

Source NAT rewrites addresses but does not bypass policy. DNS uses UDP port 53, which the zone-pair security policy must explicitly permit; HTTP on TCP 80/443 is allowed, so browsing works while name resolution fails. The missing permit for UDP 53 is the cause.

Why this answer

The most likely reason DNS is failing while IP-based access works is that the security policy does not permit UDP port 53 traffic between the relevant zones. Source NAT translates addresses but does not bypass security policy evaluation; if the policy does not allow DNS, the traffic is dropped. This is a common oversight when configuring NAT without corresponding security policies.

Exam trap

JNCIA-SEC often tests the interaction between NAT and security policies, and candidates mistakenly believe that NAT automatically permits traffic or that DNS requires special NAT handling, when the real issue is usually a missing policy.

How to eliminate wrong answers

Option A is wrong because Source NAT does not automatically disable DNS ALGs — ALGs are separate features and are not disabled by NAT configuration. Option C is wrong because Source NAT pools do not strip UDP port headers; NAT translation preserves transport-layer information and rewrites only IP addresses and optionally ports. Option D is wrong because DNS traffic can traverse Source NAT pools without issue — DNS does not require Static NAT; Source NAT with port translation handles UDP 53 correctly as long as policies permit it.

Full explanation →
381
MCQmedium

You are configuring a security policy that needs to reference an address prefix that includes both IPv4 and IPv6 addresses. How should you handle this in Junos OS security address books?

A.Combine IPv4 and IPv6 addresses into a single address entry string separated by a comma.
B.Define separate address book entries for IPv4 and IPv6, as address entries are specific to an IP version.
C.Configure the address book under the [edit security inet6] hierarchy only.
D.Use dual-stack address translation objects.
AnswerB

Junos address book entries bind to a single IP version, so an entry cannot hold both IPv4 and IPv6 prefixes. Defining separate entries per version satisfies the requirement to reference both address families within the security policy.

Why this answer

In Junos security address books, address entries are IP-version specific — an IPv4 prefix and an IPv6 prefix cannot be combined into one entry. You must define separate address book entries (and typically separate address books under the inet and inet6 hierarchies) for IPv4 and IPv6.

Exam trap

The trap is assuming Junos can store mixed IPv4/IPv6 in one address entry or that a single hierarchy covers both families, when address entries are strictly family-specific.

How to eliminate wrong answers

Option A is wrong because Junos does not support comma-separated mixed IPv4/IPv6 strings in a single address entry; each entry is a single prefix of one family. Option C is wrong because configuring only under [edit security inet6] would omit IPv4 entirely, and the question requires both families. Option D is wrong because 'dual-stack address translation objects' is not a real Junos construct — NAT objects do not merge address families.

Full explanation →
382
MCQhard

An administrator configures a security policy with the action set to 'reject'. Another policy uses the action 'deny'. What is the functional difference between these two actions when a packet matches the policy?

A.'reject' drops the packet silently, whereas 'deny' sends an ICMP unreachable message.
B.'reject' sends an ICMP unreachable message back to the packet source, whereas 'deny' silently drops the packet.
C.'reject' logs the event to the system log, whereas 'deny' suppresses all logging.
D.'reject' requires stateful session tracking, whereas 'deny' is applied statelessly.
AnswerB

Reject actively notifies the source by returning an ICMP unreachable message, so the sender learns delivery failed. Deny drops the packet silently with no response, leaving the source to time out. This difference matters when troubleshooting or when applications must fail fast rather than hang.

Why this answer

The 'reject' action sends an ICMP unreachable message back to the source, whereas 'deny' (drop) silently discards the packet.

Full explanation →
383
Multi-Selecthard

An administrator is analyzing the active session table using the 'show security flow session' command to diagnose asymmetric routing. Which TWO pieces of information are displayed in the session table output that help identify this issue? (Choose two)

Select 2 answers
A.The exact CPU core processing the session flow.
B.Packet and byte counters incrementing for both the client-to-server and server-to-client directions.
C.The complete BGP path attribute list for the session route.
D.Incoming and outgoing interface names for both forward and reverse traffic directions.
E.The administrative distance of the route used to establish the session.
AnswersB, D

Counters incrementing in both directions indicate return traffic traversing a different path or device than the forward flow, the signature of asymmetric routing. Seeing both client-to-server and server-to-client counters confirms traffic passes through this firewall in both directions.

Why this answer

Option B is correct because the session table shows separate packet and byte counters for each direction (client-to-server and server-to-client); in asymmetric routing, one direction's counters may increment while the other's do not, or the reverse path may be missing entirely, revealing that return traffic is taking a different path. Option D is correct because the session output lists the incoming and outgoing interfaces (and zones) for both the forward and reverse flows, so if the ingress/egress interfaces for the two directions differ from what symmetric routing would dictate, the administrator can pinpoint the asymmetry. Option A is not part of the session table output—CPU core/SPU assignment is not displayed as a field for identifying asymmetric routing.

Option C is wrong because BGP path attributes are not shown in 'show security flow session' output; they would be viewed via routing table or BGP commands. Option E is also incorrect because administrative distance is a routing-table attribute, not a field in the session table.

Exam trap

JNCIA-SEC often tests session-table fields by mixing in routing-table attributes (BGP path, admin distance) — candidates who do not distinguish session output from route output pick the wrong options.

Full explanation →
384
MCQmedium

An administrator configures a destination NAT rule on an SRX Series device to redirect inbound HTTP traffic destined to 203.0.113.10 port 80 to an internal web server at 10.10.10.5. After committing, users on the internet can reach the web server, but the internal server logs show the source IP address of the original client instead of the SRX's IP address. Which statement explains this behavior?

A.Destination NAT automatically performs source NAT using the egress interface address, which is why the server sees the client IP.
B.Destination NAT translates only the destination IP address; the source IP address is preserved by default unless source NAT is also applied.
C.The SRX is configured in transparent mode, which prevents source NAT from modifying packet headers.
D.The security policy is blocking source NAT translation, so the packet retains the original source address.
AnswerB

Destination NAT on Junos OS modifies only the destination IP address (and optionally port) of matching packets. The source IP address remains unchanged, so the internal server sees the original client's IP. To alter the source address, a separate source NAT rule must be configured, such as interface NAT or a source NAT pool. This scenario correctly reflects that behavior.

Why this answer

Destination NAT changes only the destination IP address of matching packets. The source IP address is left intact unless a separate source NAT rule is applied. In this scenario, the administrator configured only destination NAT, so the internal server observes the original client IP.

Adding a source NAT rule would translate the source address, but that is a distinct configuration step.

Exam trap

The trap here is assuming that destination NAT also translates the source address, when in fact source NAT must be configured separately.

Full explanation →
385
MCQmedium

You need to modify an existing security policy to add a new IP address to an existing address set used in the policy match criteria. Which configuration hierarchy should you access to update the address set?

A.[edit security policies] directly within the policy match criteria.
B.[edit interfaces]
C.[edit routing-options]
D.[edit security address-book] or within the specific zone's address-book configuration.
AnswerD

Address sets are configured under [edit security address-book], either globally or inside a specific zone's address-book hierarchy. Editing the set there updates the object referenced by the policy's match criteria without altering the policy rule itself.

Why this answer

Address sets are configured within address books, either globally or under specific zones.

Full explanation →
386
MCQeasy

A security administrator wants to view the current status of all security zones on an SRX Series device, including which interfaces are bound to each zone and whether the zones are active. Which command should the administrator use?

A.show security flow status
B.show configuration security zones
C.show interfaces terse
D.show security zones
AnswerD

The 'show security zones' command displays the configured security zones along with the interfaces assigned to each zone and their operational state. It provides a concise overview of zone membership and status, which is exactly what the administrator needs to verify zone-to-interface binding and activity. In this scenario, it directly answers the requirement to view all zones and their associated interfaces.

Why this answer

The operational command 'show security zones' is designed to present security zones together with their assigned interfaces and current status. Configuration-focused commands show what was configured but not the live state, and interface or flow status commands lack the zone-centric perspective. For a quick verification of zone membership and activity, the security zones operational command is the appropriate choice.

Exam trap

The trap here is using a configuration display command to check zone status, when configuration output does not reflect the current operational state of zones and their interfaces.

Full explanation →
387
MCQmedium

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

A.Inside the junos-icmp application object definition.
B.Inside the global SCREEN option profile under ICMP flood settings.
C.Under the security zone host-inbound-traffic system-services icmp configuration.
D.Under the security policies between the untrust and trust zones.
AnswerC

Host-inbound-traffic system-services icmp permits ICMP echo requests destined to the device itself, letting the routing engine respond. Interface-based filters alone would drop them, so this zone-level setting satisfies the requirement to allow Ping for troubleshooting.

Why this answer

ICMP echo request must be enabled under the host-inbound-traffic configuration for the specific security zone or interface.

Full explanation →
388
MCQhard

While debugging NAT, you notice that session creation fails due to port block allocation failure. Which command helps inspect dynamic IP and port (DIPP) NAT usage?

A.show route forwarding-table dipp
B.show security flow dipp-status
C.show security nat source pool detail
D.show security translation port-blocks
AnswerC

The show security nat source pool detail command displays per-pool DIPP allocation statistics, including used and available ports, exposing why port block allocation fails. This directly targets the dynamic IP and port NAT resource exhaustion seen during session creation.

Why this answer

The command 'show security nat source pool detail' displays detailed information about source NAT pools, including the number of allocated port blocks and usage statistics. This directly helps inspect DIPP (Dynamic IP and Port) NAT usage and diagnose port block allocation failures.

Exam trap

JNCIA-SEC often tests whether candidates can identify the correct command to inspect NAT pool usage, so the trap is choosing a command that sounds like it shows DIPP status but is not valid Junos syntax.

How to eliminate wrong answers

Option A is wrong because 'show route forwarding-table dipp' is not a valid Junos command; the forwarding table does not contain DIPP NAT information. Option B is wrong because 'show security flow dipp-status' is not a valid command; DIPP status is not exposed via a flow command. Option D is wrong because 'show security translation port-blocks' is not valid syntax; port block information is part of the source NAT pool details, not a separate translation command.

Full explanation →
389
Multi-Selectmedium

Which THREE parameters can be used as match criteria within a Junos security policy? (Choose three.)

Select 3 answers
A.Applications or application sets
B.BGP AS path attributes
C.Physical interface MAC addresses
D.User identities via Junos User Firewall integration
E.Source and destination address book entries
AnswersA, D, E

Applications and application sets are valid Junos security policy match criteria, letting you permit or deny traffic by Layer 7 application identity rather than port alone. This satisfies the stem's requirement for match parameters, since Junos evaluates them alongside source and destination addresses within the policy's from clause.

Why this answer

Option A is correct because a Junos security policy can match on applications or application sets, which are defined objects (e.g., junos-http, junos-ssh) that identify the traffic by protocol and port. Option D is correct because Junos User Firewall (integrated user firewall) allows policies to match on user identities sourced from Active Directory or ICAP, enabling role-based enforcement. Option E is correct because security policies match on source-address and destination-address entries drawn from address books (zones' address-book objects).

Option B is not a security policy match criterion; BGP AS path attributes are used in routing policy (policy-statement) for route selection, not in security policy. Option C is also not a match criterion in a standard Junos security policy; MAC addresses are matched in Layer 2 switching/filter contexts (e.g., family ethernet-switching firewall filters), not in security policy match conditions.

Exam trap

JNCIA-SEC often tests the confusion between security policy match criteria and routing policy match criteria; candidates might incorrectly include BGP attributes or MAC addresses as valid security policy matches.

Full explanation →
390
MCQeasy

During the initial physical deployment of an SRX Series gateway, how does an administrator typically connect to the device out-of-band for initial CLI configuration?

A.By connecting a serial console cable to the CONSOLE port and using a terminal emulator.
B.By using SSH over the default management interface fxp0 with DHCP enabled.
C.By connecting an Ethernet cable to any data port and browsing to http://192.168.1.1
D.By inserting a pre-formatted USB drive containing a root password file into the FXP0 port.
AnswerA

The CONSOLE port provides out-of-band access independent of network reachability, letting the administrator attach a serial cable and terminal emulator to reach the CLI before any interface or management address is configured. This satisfies the initial deployment constraint where no in-band path exists.

Why this answer

During initial physical deployment, an SRX Series gateway has no IP configuration, no management reachability, and no credentials set, so the only reliable out-of-band path is the physical CONSOLE port. Administrators attach a serial rollover cable (typically RJ-45 to DB-9/USB) and use a terminal emulator at 9600 baud, 8-N-1, no flow control to reach the Junos CLI login prompt. This works even when the device is in a factory-default or unbootable state, making it the standard first-touch method.

Exam trap

JNCIA-SEC often tests the assumption that a factory-default SRX is reachable over the network — candidates forget that fxp0 has no IP and no DHCP client by default, so only the console works at first boot.

How to eliminate wrong answers

Option B is wrong because fxp0 has no DHCP client enabled by default on a factory-default SRX, and SSH requires an already-reachable IP plus a configured user — neither exists at first boot. Option C is wrong because data ports are not pre-assigned an IP of 192.168.1.1 and J-Web is not enabled by default on a fresh SRX. Option D is wrong because the FXP0 port is an RJ-45 management Ethernet interface, not a USB slot, and Junos does not load a root password from a USB file in that manner.

Full explanation →
391
Multi-Selecthard

Which THREE parameters are typically included in security flow traceoptions output when troubleshooting dropped packets? (Choose three)

Select 3 answers
A.Packet reception and interface context
B.Chassis power supply voltage levels
C.BGP AS path recomputation steps
D.Security policy lookup and match results
E.Reason for packet drop (if applicable, such as policy deny or screen violation)
AnswersA, D, E

Flow traceoptions output records the ingress interface and packet reception details, satisfying the need to identify where a dropped packet entered the device. This context shows which zone and interface handled the packet before any policy or screen evaluation occurred.

Why this answer

Option A is correct because security flow traceoptions output begins with the packet's ingress context, showing the receiving interface, source/destination addresses, and ports so you can confirm the packet actually arrived and on which interface. Option D is correct because the trace records the security policy lookup, including the zone context and the policy that was evaluated and matched (or failed to match), which is essential for understanding how the session was handled. Option E is correct because the trace explicitly logs the drop reason when a packet is discarded, such as a policy deny, a screen violation, or a TCP/IP stack rejection, which directly identifies why the packet did not pass.

Option B is not relevant because chassis power supply voltage is hardware/environmental monitoring data, not part of flow traceoptions packet processing. Option C is not relevant because BGP AS path recomputation is a routing protocol event and is not included in security flow traceoptions output.

Exam trap

JNCIA-SEC often tests whether candidates confuse security flow traceoptions (packet/policy-level) with routing protocol traceoptions (BGP/OSPF-level), or include unrelated hardware telemetry as if it were part of flow tracing.

Full explanation →
392
Multi-Selecthard

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

Select 2 answers
A.ALGs interact with the security flow module to create temporary session table entries for data connections.
B.ALGs are hardware-accelerated ASICs dedicated exclusively to packet encryption.
C.ALGs replace security policies entirely for all complex application traffic.
D.ALGs must be manually compiled from source code for each custom application.
E.ALGs inspect control packets to identify dynamically allocated ports for data sessions.
AnswersA, E

ALGs signal the security flow module to allocate temporary session table entries (pinholes) for the dynamically negotiated data connections, satisfying the requirement that control and data channels be linked. Without this interaction, the data session would be dropped because no matching policy or session exists.

Why this answer

Option A is correct because Junos ALGs work with the security flow module to open temporary pinholes in the session table for the dynamically negotiated data connections, such as FTP data channels or SIP media streams, so return traffic is permitted without a separate policy. Option E is correct because ALGs parse the control channel packets (for example, FTP PORT/PASV commands or SIP/SDP INVITE messages) to learn the IP addresses and ports that will be used for the subsequent data sessions, then track those sessions. Option B is wrong because ALGs are software processes in the Junos flow daemon, not dedicated encryption ASICs.

Option C is wrong because ALGs supplement, not replace, security policies; policies still govern whether the control and data traffic is allowed. Option D is wrong because ALGs are built into Junos OS for supported protocols and are not compiled from source per application.

Full explanation →
393
MCQhard

An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?

A.Junos rejects DNS names in address books because security policies require static IP subnets.
B.DNS names are only resolved once when the device boots up or when the configuration is committed.
C.DNS-based address objects require AppSecure licenses to function.
D.Junos resolves the FQDN to IP addresses dynamically and updates the policy match criteria accordingly.
AnswerD

Junos stores the FQDN in the address object and performs DNS resolution, refreshing the mapped IP addresses as records change. Policy lookups then match against the current resolved addresses, satisfying the requirement that DNS-based objects track the remote server without manual reconfiguration.

Why this answer

Junos OS supports DNS-based address objects (fqdn) where the SRX periodically resolves the domain name to IP addresses and updates the security policy match table dynamically.

Full explanation →
Page 5

Page 6 of 6

All pages

123456

Practice JNCIA-SEC by domain

Target a specific domain to shore up weak areas.

Network Address TranslationSrx Series Service GatewaysMonitoring And TroubleshootingSecurity PoliciesJunos OS Security ObjectsContent Security
See all domains with question counts →