75 of 88 questions · Page 1/2 · Junos OS Security Objects · Answers revealed
Which type of Junos OS address book entry is available to all security zones on the device without needing to be redefined?
Global address books provide definitions available across all security zones.
Why this answer
A global address book entry is accessible by security policies across all zones on the SRX device.
Which statement correctly identifies the purpose of Junos OS functional zones?
Functional zones include junos-host and junos-mgmt for internal device traffic.
Why this answer
Functional zones are pre-defined system zones that handle specialized traffic such as management or device-originated traffic.
Which statement is true regarding the default security zone behavior in Junos OS?
Explicit security policies are required to allow transit traffic between zones.
Why this answer
By default, traffic between two different security zones is denied unless explicitly permitted by a security policy.
An administrator configures a security zone and applies a SCREEN profile. Under load, legitimate traffic starts getting dropped due to SCREEN option thresholds being exceeded. Which CLI command should the administrator use to view real-time statistics and counters for triggered SCREEN attacks?
This command shows operational counters for screen option triggers.
Why this answer
The 'show security screen statistics' command displays hit counts and drop counters for active screen options.
Which command allows you to view the configured security zones and their assigned interfaces in Junos OS?
This command lists all zones and bound interfaces.
Why this answer
The 'show security zones' operational command displays all security zones and their associated interfaces.
Which TWO statements are correct regarding Junos OS security zones? (Choose two)
Zones group interfaces sharing trust boundaries and policies.
Why this answer
Security zones group interfaces and enforce security policies. Every transit interface must belong to a zone.
An administrator configures a security zone and enables the 'udp-flood' SCREEN option with a specified threshold. How does Junos measure UDP flood attacks for this option?
UDP flood detection evaluates packet arrival rates against configured thresholds.
Why this answer
The UDP flood SCREEN option monitors the rate of incoming UDP packets per second destined for the zone and triggers when the rate exceeds the configured threshold.
You need to inspect traffic matching a proprietary application that uses dynamic TCP ports. You have written a custom application. What additional Junos security feature can be combined with custom applications to inspect deep packet content for non-standard ports?
AppID and custom signatures inspect traffic payload regardless of static port assignments.
Why this answer
Custom applications combined with Junos AppSecure (such as AppID) or custom ALG mappings allow deeper inspection, though basic custom apps define port/protocols. For dynamic ports, AppID signatures are used.
Which TWO statements are true regarding Junos OS security policies and address books? (Choose two)
Policies use address book entries for source and destination matching.
Why this answer
Security policies use address book objects to define match criteria for source and destination traffic.
You are configuring an SRX Series device and want to ensure that all traffic entering the untrusted zone is checked for LAND attacks. Which configuration steps are required?
Screen profiles are created under [edit security screen] and applied under security zones.
Why this answer
To enable LAND attack protection, you must create a screen profile with 'land' enabled and apply that profile to the untrusted security zone.
You want to apply a SCREEN option to protect against ICMP ping floods across all interfaces in a specific security zone. How should you structure this in the CLI?
Profiles are defined globally under screen and referenced under zones.
Why this answer
ICMP flood protection is configured inside a screen profile under [edit security screen], and that profile is then applied to the security zone.
Which TWO statements are true regarding Junos OS global address books versus zone-specific address books? (Choose two)
Local zone address books override global address books when evaluated from that zone context.
Why this answer
Global address books apply across all zones, while zone-specific books apply primarily to their owning zone.
You need to modify the default session timeout for a specific custom application in Junos OS. Where is application timeout configured?
Custom application timeout values are configured directly within the application definition stanza.
Why this answer
Application timeouts can be configured under the applications hierarchy or custom application definition by specifying inactivity timeout values.
Which statement is true regarding Junos OS security zone interfaces?
Transit traffic requires interfaces to be bound to security zones and governed by security policies.
Why this answer
An interface can belong to one security zone at a time.
An enterprise network uses multiple virtual routers. Can security zones span across different virtual routers on the same SRX Series device?
Each virtual router maintains its own routing and security zone namespace context.
Why this answer
Security zones are bound to interfaces, and interfaces belong to specific routing instances (virtual routers). Therefore, a single security zone cannot span across multiple virtual routers.
An administrator configures an address book containing an IPv6 address prefix. How does Junos OS handle IPv6 addresses in security policies compared to IPv4?
IPv6 addresses are fully supported inside standard address books for security policies.
Why this answer
Junos security policies evaluate IPv6 addresses in address books similarly to IPv4, matching them against family inet6 traffic flows.
Which functional zone in Junos OS is automatically used for traffic that is generated by the SRX device itself, such as routing protocol updates or syslog messages?
The junos-host functional zone represents the local routing engine of the SRX device.
Why this answer
The Junos 'junos-host' functional zone handles traffic destined for or originated by the routing engine.
Which Junos command displays the operational status of all SCREEN options and their associated counters across security zones?
This command provides the counters and status for configured screen profiles.
Why this answer
The 'show security screen statistics' command shows hit and drop counters for SCREEN options.
Which command displays the configured functional zones in Junos OS?
This command lists all built-in functional zones.
Why this answer
The 'show security zones functional-zone' command displays the status and configuration of functional zones.
Which Junos OS feature is responsible for translating port numbers for protocols like FTP during transit across security zones?
ALGs parse application data and handle dynamic port mappings.
Why this answer
ALGs handle port translation and protocol parsing for complex applications.
An administrator creates a global address book and a security zone-specific address book. A host address is defined with the same name in both address books, but with different IP subnets. When a packet originates from that security zone, which address book entry takes precedence?
Local zone-specific address books are evaluated first before the global address book.
Why this answer
Zone-specific address books take precedence over global address books when resolving address names for policies originating from that specific zone.
You need to configure a custom application that matches UDP traffic on a range of destination ports from 5000 to 5010. How should you specify this range in the application configuration?
Junos application configuration accepts hyphenated port ranges for destination ports.
Why this answer
Custom application port ranges are configured using destination-port with a hyphenated range.
You need to group multiple IPv4 subnets and range combinations into a single object for use in security policies. Which configuration object should you create?
Address sets allow grouping multiple address objects.
Why this answer
An address set allows grouping multiple individual addresses and ranges into a single logical object.
Which statement is true regarding Junos OS address books?
Junos supports both global and zone-specific address books.
Why this answer
Address books can be defined globally at the configuration root or locally within a specific security zone.
Which Junos OS CLI command is used to display currently active Application Layer Gateways (ALGs) and their status?
This command lists all supported ALGs and shows whether they are enabled or disabled.
Why this answer
The 'show security alg status' command displays the operational status of all ALGs running on the Junos device.
An administrator configures a security zone and adds the 'tcp-drop-synfin-set' SCREEN option. What specific packet characteristic does this option target?
This option specifically targets anomalous packets with both SYN and FIN bits enabled.
Why this answer
The tcp-drop-synfin-set SCREEN option drops TCP packets that have both the SYN and FIN flags set simultaneously, which is an invalid state often used in scanning.
An administrator creates a security zone and assigns multiple interfaces to it. One of the interfaces is configured with host-inbound-traffic allowed services for SSH. What happens to SSH access to the other interfaces in the same security zone?
Host-inbound services can be specified per-interface or per-zone; interface-specific configuration applies only to that interface.
Why this answer
Host-inbound-traffic settings can be configured globally for the zone or overridden per interface. Allowing SSH on one interface does not automatically enable it on other interfaces unless configured at the zone level or explicitly enabled on those interfaces.
When defining a custom application in Junos OS, you specify the protocol as TCP and set a source port range of 1024-65535 and a destination port of 8080. How does Junos evaluate this application in security policies?
Both source and destination port constraints defined in the application object are enforced during matching.
Why this answer
Custom applications define matching criteria based on IP protocol, source port, and destination port ranges.
Which THREE services can be enabled under host-inbound-traffic system-services in Junos OS security zones? (Choose three)
Ping is a standard system service for host inbound traffic.
Why this answer
System services for host-inbound traffic include ping, ssh, https, snmp, etc.
Which TWO functional zones are built-in and available by default in Junos OS? (Choose two)
junos-host is a built-in functional zone for device-originated/destined traffic.
Why this answer
Built-in functional zones include junos-host and junos-mgmt.
An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?
The global ALG configuration allows disabling specific protocol helpers like FTP under [edit security alg].
Why this answer
ALGs are controlled under the [edit security alg] hierarchy where specific protocol helpers can be disabled or modified.
An administrator needs to configure a security zone in Junos OS that will contain the management interface for out-of-band access. Which zone type is appropriate for this requirement?
Functional zones such as management are built-in zones for specific traffic types.
Why this answer
A functional zone, specifically the management zone, is used for traffic destined for the routing engine via the management interface.
You need to create a custom application in Junos OS that matches HTTP traffic running on non-standard port 8080. How should you define this application?
This syntax correctly defines a custom TCP application on port 8080.
Why this answer
Custom applications define protocol and destination port under [edit applications application].
You want to create an address set that combines two address sets and one individual IP address object. Is this supported in Junos OS?
Junos address sets support mixing address objects and nested address sets.
Why this answer
Address sets can contain both individual address objects and other address sets.
An administrator configures an address set named 'DMZ-SERVERS' containing three individual IP addresses. Later, one of those IP addresses is removed from the base address book. What happens to the 'DMZ-SERVERS' address set configuration?
Junos validates address sets against existing address book entries at commit time.
Why this answer
If an address object referenced within an address set is deleted from the address book, Junos retains the reference in the candidate configuration but will fail validation upon commit if dangling references are left unresolved, depending on the object type. Actually, Junos generates a commit error if an address set references a non-existent address object.
You want to create a security zone that permits all host-inbound traffic for system services and protocols without manually listing every service. Is there a wildcard or all-inclusive keyword for host-inbound-traffic in Junos OS?
Junos supports the 'all' keyword for system-services and protocols in host-inbound traffic.
Why this answer
Junos host-inbound-traffic allows specifying 'all' under system-services or protocols to permit everything, though it is discouraged for security reasons.
You have configured a custom application object named 'CUSTOM-APP' matching TCP port 9090. When you attempt to commit the configuration, Junos returns an error stating that the application conflicts with a predefined Junos application. How should you resolve this?
Custom applications cannot use names reserved by the system or duplicate existing application names.
Why this answer
Predefined Junos applications (prefixed with junos-) cannot be overwritten, but custom applications should be given unique names that do not conflict. Alternatively, modifying the existing custom application name resolves the conflict.
Which TWO actions occur when an Application Layer Gateway (ALG) inspects traffic in Junos OS? (Choose two)
ALGs inspect control headers to discover secondary ports.
Why this answer
ALGs inspect application control channels and dynamically open data sessions for complex protocols.
Which command displays the configured security policies in Junos OS?
This command lists all configured security policies between zones.
Why this answer
The operational command 'show security policies' displays the currently active security policies.
You are troubleshooting an issue where an application defined with a specific timeout is timing out prematurely during periods of inactivity. Where would you verify or adjust the flow session timeout globally in Junos OS?
Global flow session timeouts for TCP are configured under [edit security flow].
Why this answer
Global flow timeouts for protocols like TCP and UDP are configured under [edit security flow].
An administrator configures an application set in Junos OS. What is the primary function of an application set?
Application sets group applications similarly to how address sets group addresses.
Why this answer
An application set allows grouping multiple individual application objects or other application sets into a single logical object for use in security policies.
An administrator configures a security zone and enables traceoptions for security flow. Where are these traceoptions configured in the Junos OS hierarchy?
Flow traceoptions are configured globally under the security flow hierarchy.
Why this answer
Flow traceoptions are configured under the [edit security flow traceoptions] hierarchy to troubleshoot session and flow processing.
Which Junos OS command displays the configuration of all security zones?
This displays the security zones stanza in configuration mode.
Why this answer
The 'show configuration security zones' command displays the zone configuration.
Which TWO statements are accurate regarding the evaluation order of address books in Junos OS? (Choose two)
Local zone address books have precedence for matching traffic from that zone.
Why this answer
Zone-specific address books are evaluated first for traffic associated with that zone, falling back to global address books.
Which statement best describes an Application Layer Gateway (ALG) in Junos OS?
Protocols like FTP and SIP negotiate secondary data ports dynamically, which ALGs track.
Why this answer
ALGs inspect application payloads, handle dynamic port negotiation, and assist the security flow module in tracking complex protocols.
An administrator configures an address set that includes another address set as a member (nested address sets). What is the maximum nesting depth supported for address sets in Junos OS?
Junos allows nested address sets and explicitly checks for and rejects circular dependencies at commit time.
Why this answer
Junos OS supports nesting address sets within address sets up to a specific depth limit (typically up to foundation limits, but let's recall Junos specifications: address sets can be nested, but infinite nesting is prevented. Specifically, Junos supports nesting up to 1 level or multiple levels depending on the version, but generally nesting is supported up to a certain depth. Wait, let's verify standard Junos documentation: Junos supports address sets containing address sets, but circular dependencies are blocked.
Let's check if there's a strict depth limit or if circular references are what's tested). Actually, circular references are strictly prohibited and checked at commit time.
You are troubleshooting a connectivity issue where SIP VoIP calls are establishing control sessions, but audio streams (RTP) are failing. Which Junos security feature must be properly configured or enabled to resolve this?
The SIP ALG parses SIP signaling to dynamically open pinholes for RTP media streams.
Why this answer
SIP uses dynamic ports for RTP streams, requiring the SIP ALG to be active and operational.
An administrator configures a security zone and enables traceoptions for zone management. What is the correct configuration hierarchy to enable traceoptions for security zones?
Security zone traceoptions are located directly under the security zones hierarchy.
Why this answer
Zone traceoptions are configured under [edit security zones traceoptions].
An administrator creates a security zone and defines both a zone-specific address book and a global address book. The same address name exists in both address books with conflicting subnets. When a security policy references this address name from a different security zone, which address definition is selected?
Global entries serve as the fallback/default when evaluating zones that do not own the local address book.
Why this answer
When traffic originates from a zone other than the zone where the zone-specific address book resides, the global address book entry is used because the zone-specific book only applies to traffic originating from or associated with its specific zone context.
You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?
The alarm threshold or threshold parameter under 'tcp syn-flood' handles SYN flood detection settings.
Why this answer
SYN flood protection is managed using the 'tcp syn-flood' parameter inside a SCREEN option profile.
Which TWO methods can be used to define IP addresses in Junos OS address books? (Choose two)
IP ranges are supported in address books.
Why this answer
Address books support individual IP subnets/prefixes and IP ranges.
An administrator notices that FTP data connections are failing when clients behind an SRX device connect to external servers using active FTP mode. Passive FTP works correctly. What is the most likely root cause?
Active FTP relies on the server connecting back to the client; the ALG must intercept this to permit the return flow.
Why this answer
Active FTP requires the server to initiate a connection back to the client, which requires port negotiation via the FTP ALG and proper security policy traversal for the back-connection.
Which TWO statements are true regarding Junos OS address sets and their usage in security policies? (Choose two)
Address sets can be used interchangeably with address objects in policy source/destination fields.
Why this answer
Address sets group multiple address objects and can be referenced in policies as source or destination match criteria.
An administrator configures a security zone and enables the 'icmp timestamp' SCREEN option. What is the purpose of this option?
This option defends against ICMP timestamp-based attacks and information gathering.
Why this answer
The icmp timestamp SCREEN option protects against ICMP timestamp flood or manipulation attacks by monitoring or blocking ICMP timestamp request and reply packets.
You want to configure a security zone to automatically reject new TCP connections with a TCP RST packet when the zone's transit sessions exceed capacity or policies deny them. Where is this behavior configured?
Using 'reject' as a security policy action causes the SRX to send a TCP RST for TCP traffic or an ICMP unreachable for UDP traffic when blocked.
Why this answer
Session drop behavior, such as sending TCP resets on rejection, is configured under security options or policy actions, but default session limits and rejection behaviors are managed within security options. Wait, session rejection action ('reject' vs 'deny') is specified directly within the security policy. Let's check session table limits: session limits can be set under [edit security max-sessions].
Which command is used to display active security sessions currently tracked by the Junos OS flow module?
This command lists all active session table entries.
Why this answer
The 'show security flow session' command displays active sessions currently flowing through the SRX device.
An administrator configures a security zone and enables the 'tcp-rst' SCREEN option. What is the primary purpose of this SCREEN option?
The tcp-rst screen option sets thresholds to detect and mitigate excessive RST packets.
Why this answer
The tcp-rst option protects against forged TCP RST packets that could prematurely terminate active connections.
Which TWO features or options are associated with Junos OS SCREEN option profiles? (Choose two)
SYN flood options are configured within SCREEN profiles.
Why this answer
SCREEN option profiles contain Layer 3/4 attack protections such as IP spoofing and SYN flood limits.
Which THREE types of attacks are mitigated by Junos OS SCREEN options? (Choose three)
LAND attacks are mitigated by SCREEN options.
Why this answer
SCREEN options protect against IP spoofing, SYN floods, and LAND attacks among other Layer 3/4 threats.
Which Junos OS feature inspects packet headers for layer 3 and layer 4 denial-of-service (DoS) attacks such as SYN floods, IP spoofing, and LAND attacks?
SCREEN options are designed specifically for attack detection and prevention.
Why this answer
SCREEN options provide attack detection and mitigation for layer 3 and layer 4 DoS attacks.
Which THREE parameters can be configured within a custom application definition in Junos OS? (Choose three)
Protocol specification is mandatory for custom applications.
Why this answer
Custom applications can specify protocols, source ports, destination ports, and timers.
Which command is used to verify the configuration of address books in Junos OS?
This displays the address book stanza from the candidate or active configuration.
Why this answer
The 'show configuration security address-book' command displays the configured address books in configuration mode.
Which THREE settings can be configured under a security zone in Junos OS? (Choose three)
Host-inbound services are configured per zone or interface.
Why this answer
Security zones can contain host-inbound-traffic, screen profile references, and interface assignments.
Which TWO commands are valid operational mode commands in Junos OS for security objects? (Choose two)
Displays active flow sessions.
Why this answer
Valid operational commands include showing security zones and security flow sessions.
An administrator needs to ensure that packets with source routing options enabled are dropped before they enter the network through the untrusted zone. Which SCREEN option handles this?
The 'source-route' option drops packets that utilize IP source routing.
Why this answer
The source route option in SCREEN profiles detects and blocks packets containing IP source routing headers.
Which THREE security features are configured under the [edit security] hierarchy in Junos OS? (Choose three)
Security zones are configured under [edit security zones].
Why this answer
Security zones, address books, and screen options are all configured under [edit security].
Which TWO characteristics apply to custom applications created in Junos OS? (Choose two)
Custom applications support configuring custom session inactivity timeouts.
Why this answer
Custom applications allow specifying protocol, source ports, and destination ports for policy matching.
You want to create a security zone and explicitly block all traffic between interfaces assigned to that same zone (intra-zone traffic). Which configuration statement accomplishes this?
The 'intra-zone-blocking' statement prevents communication between interfaces within the same security zone.
Why this answer
Intra-zone traffic can be blocked in Junos security zones by configuring the 'block-inbound-traffic' or 'tcp-rst' options, or specifically 'screen' or zone-level intra-zone blocking. Wait, the exact Junos command to block intra-zone traffic is 'set security zones security-zone <name> screen' or using screen options, or 'set security zones security-zone <name> intra-zone-blocking'. Let's verify: Junos security zones support 'intra-zone-blocking'.
Which TWO traffic types are typically handled by functional zones in Junos OS? (Choose two)
junos-host handles self-traffic for the routing engine.
Why this answer
Functional zones handle device self-traffic (junos-host) and out-of-band management traffic (junos-mgmt).
You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?
The 'ip spoofing' screen option checks for forged source addresses.
Why this answer
IP spoofing detection in SCREEN options checks if incoming packets have source addresses matching the local router interfaces or martian networks.
You are configuring host-inbound traffic for a security zone and want to allow SNMP polling from a monitoring server. Which option under host-inbound-traffic system-services should you enable?
Enabling 'snmp' under system-services allows SNMP polling traffic to reach the routing engine.
Why this answer
SNMP is a system service in Junos host-inbound-traffic configuration.
An administrator configures a security zone and enables traceoptions for SCREEN option processing. Where are SCREEN traceoptions configured?
Screen traceoptions reside directly under the security screen hierarchy.
Why this answer
Screen traceoptions are configured under the [edit security screen traceoptions] hierarchy.
Which statement accurately describes a security zone in Junos OS?
Security zones establish boundaries for enforcing security policies.
Why this answer
Security zones are logical groupings of interfaces that share similar security requirements and policies.
Which THREE protocols typically require Application Layer Gateways (ALGs) in Junos OS to function correctly across security policies? (Choose three)
SIP requires an ALG to handle RTP media stream port negotiation.
Why this answer
FTP, SIP, and TFTP are classic examples of protocols requiring ALGs due to dynamic port negotiation.
You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?
Screen profiles are applied directly under the specific security zone configuration.
Why this answer
SCREEN options are applied under the security zones hierarchy to protect interfaces assigned to that zone.
Ready to test yourself?
Try a timed practice session using only Junos OS Security Objects questions.