CCNA Junos OS Security Objects Questions — Page 2 of 2

MCQeasy

Which statement is true regarding Junos OS predefined applications?

A.Predefined applications can be edited to change their port mappings.

B.Predefined applications override user-defined custom applications if names collide.

C.Predefined applications simplify security policy creation by grouping port and protocol definitions for common services.

D.Predefined applications require manual updates via separate software downloads every week.

AnswerC

Built-in applications like junos-http and junos-ssh save administrators from defining common ports manually.

Why this answer

Junos comes with many built-in application definitions (prefixed with junos-) that identify standard protocols and ports.

Practice this question →

MCQeasy

Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single unit in security policies?

A.Application bundle

B.Application set

C.Application group

D.Application profile

AnswerB

Application sets group multiple applications.

Why this answer

An application set groups multiple applications together.

Practice this question →

Multi-Selecteasy

Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)

Select 2 answers

A.Functional zone names directly as match criteria for payload inspection

B.Address book entries / Address sets

C.SCREEN option profiles

D.Application / Application sets

E.Hardware crypto processor allocation maps

AnswersB, D

Policies use address objects for matching source and destination traffic.

Why this answer

Security policies reference source/destination addresses (from address books) and applications.

Practice this question →

Multi-Selectmedium

Which THREE components can be grouped within a Junos OS address set? (Choose three)

Select 3 answers

A.IP address range objects

B.Application Layer Gateway profiles

C.Other address sets (nested address sets)

D.Security zone interface names

E.Individual IP address objects

AnswersA, C, E

IP ranges are valid address book entries that can be placed in address sets.

Why this answer

Address sets can contain individual IPv4 addresses, IPv6 addresses, IP ranges, DNS FQDN objects, or other address sets.

Practice this question →

MCQhard

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

A.The TCP proxy is disabled in the security zone.

B.The TFTP ALG is disabled or missing, preventing dynamic data port opening.

C.Address books are blocking high-numbered UDP ephemeral ports.

D.Screen options are misinterpreting TFTP data packets as a UDP flood attack.

AnswerB

TFTP requires an ALG to open dynamic pinholes for the data transfer phase.

Why this answer

TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Practice this question →

MCQeasy

Which command is used to display the currently configured global address books in Junos OS?

A.show security address-book operational

B.show security flow address-books

C.show system address-books

D.show configuration security address-book

AnswerD

This command shows the address book configuration stanzas.

Why this answer

The 'show configuration security address-book' command displays address books.

Practice this question →

MCQhard

An administrator configures a security zone and applies a SCREEN profile that includes 'limit-session source-ip'. What is the function of this specific SCREEN option?

A.It drops packets originating from source IPs that have invalid subnet masks.

B.It limits the rate of new TCP connections per second from a source IP.

C.It blocks all traffic from a source IP address permanently after it sends a single packet.

D.It restricts the total number of sessions any single source IP address can open through that zone.

AnswerD

This option prevents a single host from consuming all available session table resources.

Why this answer

The 'limit-session source-ip' SCREEN option limits the number of concurrent sessions a single source IP address can establish, protecting against resource exhaustion and flood attacks.

Practice this question →

MCQhard

An administrator configures a security zone and enables the 'icmp all' SCREEN option with threshold parameters. What does the 'icmp all' option encompass?

A.It blocks ICMP echo requests while allowing ICMP destination unreachable messages.

B.It inspects ICMP payloads for encapsulated malicious shellcode.

C.It monitors and limits the aggregate rate of all ICMP packet types combined.

D.It drops all ICMP packets unconditionally without exception.

AnswerC

'icmp all' applies flood detection to all incoming ICMP traffic collectively rather than individual types.

Why this answer

The 'icmp all' SCREEN option applies flood protection and threshold monitoring across all ICMP types collectively.

Practice this question →

MCQmedium

You are configuring security zones and need to allow Ping (ICMP echo request) to be processed by the SRX routing engine for troubleshooting. Where do you configure this?

A.Inside the junos-icmp application object definition.

B.Inside the global SCREEN option profile under ICMP flood settings.

C.Under the security zone host-inbound-traffic system-services icmp configuration.

D.Under the security policies between the untrust and trust zones.

AnswerC

Host-inbound traffic settings permit system services like ping/icmp to reach the routing engine.

Why this answer

ICMP echo request must be enabled under the host-inbound-traffic configuration for the specific security zone or interface.

Practice this question →

Multi-Selecthard

Which TWO statements describe the behavior of Junos OS Application Layer Gateways (ALGs)? (Choose two)

Select 2 answers

A.ALGs interact with the security flow module to create temporary session table entries for data connections.

B.ALGs are hardware-accelerated ASICs dedicated exclusively to packet encryption.

C.ALGs replace security policies entirely for all complex application traffic.

D.ALGs must be manually compiled from source code for each custom application.

E.ALGs inspect control packets to identify dynamically allocated ports for data sessions.

AnswersA, E

Flow tables are updated dynamically by ALGs to permit data streams.

Why this answer

ALGs inspect control traffic and open dynamic pinholes for application data channels.

Practice this question →

MCQhard

An administrator configures an address book with an address object using the DNS name of a remote server instead of an IP address. How does Junos OS handle DNS-based address objects in security policies?

A.Junos rejects DNS names in address books because security policies require static IP subnets.

B.DNS names are only resolved once when the device boots up or when the configuration is committed.

C.DNS-based address objects require AppSecure licenses to function.

D.Junos resolves the FQDN to IP addresses dynamically and updates the policy match criteria accordingly.

AnswerD

FQDN address objects in Junos resolve domain names to IPs dynamically for policy enforcement.

Why this answer

Junos OS supports DNS-based address objects (fqdn) where the SRX periodically resolves the domain name to IP addresses and updates the security policy match table dynamically.

Practice this question →

MCQeasy

Which command is used to view the list of all predefined Junos OS application objects?

A.show system applications predefined

B.show security applications

C.show configuration security applications

D.show applications junos-defaults

AnswerB

This command lists applications including predefined Junos applications.

Why this answer

The 'show configuration applications junos-' or operational equivalents display built-in applications. In operational mode, 'show security applications' lists available applications.

Practice this question →

MCQmedium

You are troubleshooting an issue where an ALG is altering port numbers during FTP sessions, causing authentication failures with an application-layer proxy. Which command shows active ALG sessions and their port translations?

A.show alg status translations

B.show security alg sessions

C.show system alg translation-table

D.show security flow session alg

AnswerB

This command shows active sessions tracked by ALGs.

Why this answer

The 'show security alg sessions' command displays active sessions managed by ALGs.

Practice this question →