JNCIA-SEC Security Policies Practice Question
An administrator configures a security policy with source address 'any', destination address 'any', application 'junos-ssh', and action 'permit' between the trust and untrust zones. Another policy above it permits all traffic from a specific administrator IP to any destination for all applications. What tool can you use on the Junos CLI to verify which policy a specific SSH packet from the administrator IP will match?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Running the 'test security flow' operational command with source IP, destination IP, and protocol parameters.
The 'security flow' test command allows administrators to simulate packet matching against security policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reviewing the output of 'show route table inet.0 policy-match'.
Why it's wrong here
Incorrect. Routing tables evaluate paths, not security policies.
- ✗
Executing 'show security policy-hit-count --simulate'.
Why it's wrong here
Incorrect. This command does not exist.
- ✓
Running the 'test security flow' operational command with source IP, destination IP, and protocol parameters.
Why this is correct
Correct. 'test security flow' simulates policy matching and session creation for given packet parameters.
- ✗
Using 'traceroute' with the security-check flag enabled.
Why it's wrong here
Incorrect. Traceroute tests network paths, not policy matching logic.
About these practice questions
One of 513 original JNCIA-SEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIA-SEC practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIA-SEC exam.