Junos OS Security Objects

Which type of Junos OS address book entry is available to all security zones on the device without needing to be redefined?

Which statement correctly identifies the purpose of Junos OS functional zones?

Which statement is true regarding the default security zone behavior in Junos OS?

An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?

An administrator needs to create a new security zone named 'dmz' on an SRX Series device and assign the interface ge-0/0/2 to it. Which configuration mode command accomplishes this?

Which TWO statements are correct regarding Junos OS security zones? (Choose two)

An administrator configures a security zone and enables the 'udp-flood' SCREEN option with a specified threshold. How does Junos measure UDP flood attacks for this option?

Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)

You are configuring an SRX Series device and want to ensure that all traffic entering the untrusted zone is checked for LAND attacks. Which configuration steps are required?

You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?

Which TWO statements are true regarding Junos OS global address books versus zone-specific address books? (Choose two)

You need to modify the default session timeout for a specific custom application in Junos OS. Where is application timeout configured?

Which statement is true regarding Junos OS security zone interfaces?

An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?

An administrator configures an address book containing an IPv6 address prefix. How does Junos OS handle IPv6 addresses in security policies compared to IPv4?

Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?

Which Junos command displays the operational status of all SCREEN options and their associated counters across security zones?

An administrator wants to verify which security zones are currently configured on an SRX Series device and which interfaces are assigned to each zone. Which operational mode command provides this information in a concise, tabular format?

Which Junos OS feature is responsible for translating port numbers for protocols like FTP during transit across security zones?

An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?

You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?

Which statement is true regarding Junos OS address books?

Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?

An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?

An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?

When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?

Which THREE services can be enabled under host-inbound-traffic system-services in Junos OS security zones? (Choose three)

An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?

You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?

You want to create an address set that combines two address sets and one individual IP address object. Is this supported in Junos OS?

An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?

You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?

Which TWO actions occur when an Application Layer Gateway (ALG) inspects traffic in Junos OS? (Choose two)

Which command displays the configured security policies in Junos OS?

A network engineer is configuring an SRX Series device with multiple security zones. The engineer wants to ensure that traffic from the trust zone to the untrust zone is inspected by a specific application firewall rule that matches HTTP traffic on port 8080. However, the engineer notices that the traffic is not being inspected. Which action should be taken to resolve this issue?

An administrator configures an application set in Junos OS. What is the primary function of an application set?

An administrator configures a security zone and enables traceoptions for security flow. Where are these traceoptions configured in the Junos OS hierarchy?

Which statement best describes an Application Layer Gateway (ALG) in Junos OS?

An administrator wants to create an address book entry for a subnet 192.168.1.0/24 and another for a single host 192.168.1.10. Both should be available globally across all zones. Which configuration achieves this?

An administrator is configuring a custom application set on an SRX Series device to group multiple applications for use in a security policy. The application set will include both predefined and custom applications. Which two statements are true about application sets in Junos OS? (Choose two.)

An administrator is configuring an address book entry in a security zone on an SRX Series device. The administrator needs to create an address book entry that represents a specific host with IP address 192.168.1.100 and a network with prefix 10.0.0.0/24. Which TWO address book object types can be used to accomplish this? (Choose two.)

You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?

Which TWO methods can be used to define IP addresses in Junos OS address books? (Choose two)

An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?

Which TWO statements are true regarding Junos OS address sets and their usage in security policies? (Choose two)

You are configuring a custom application named 'my-app' on an SRX Series device. You need to define it to match TCP traffic destined for port 8080 and also match UDP traffic on port 53. Which configuration correctly defines this application?

An administrator is defining a custom application in Junos OS to match a proprietary protocol that uses both TCP and UDP on different ports. The application must be referenced in a security policy. Which TWO statements are true about custom application definitions in Junos OS? (Choose two.)

An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?

Which command is used to display active security sessions currently tracked by the Junos OS flow module?

Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)

Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)

Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?

Which THREE parameters can be configured within a custom application definition in Junos OS? (Choose three)

Which command is used to verify the configuration of address books in Junos OS?

Which THREE settings can be configured under a security zone in Junos OS? (Choose three)

Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)

An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?

Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)

An administrator needs to create a custom application in Junos OS that matches TCP traffic destined for port 8443 and terminates the session when the server sends a TCP RST. The application should not attempt to match any payload content. Which configuration statement set completes this custom application definition?

Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)

A network engineer is configuring a custom application on an SRX Series device to match a proprietary protocol that uses UDP port 5000 and requires a timeout of 300 seconds. The engineer also needs to ensure that the application can be used in a security policy. Which configuration statement is required to define this custom application?

You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?

You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?

A network administrator is configuring a new security zone on an SRX Series device and wants to assign a logical interface to it. The interface is already configured with an IP address and is currently unassigned to any zone. Which configuration statement correctly assigns the interface ge-0/0/1.0 to the zone named TRUST?

An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?

Which statement accurately describes a security zone in Junos OS?

Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)

You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?

Which statement is true regarding Junos OS predefined applications?

Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single unit in security policies?

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Which THREE components can be grouped within a Junos OS address set? (Choose three)

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

An administrator configures a security zone and applies a SCREEN profile that includes 'limit-session source-ip'. What is the function of this specific SCREEN option?

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?