Security Policies

What is the purpose of the 'then { permit; }' statement in a Junos security policy?

Which TWO statements are correct regarding Junos security policies and their evaluation behavior? (Choose two.)

An administrator is configuring a security policy on an SRX Series device that must allow traffic from the trust zone to the untrust zone, but only for users who have authenticated via the device's captive portal. Which policy match condition should be used?

An auditor points out that a security policy configured on your SRX device is completely shadowed by an earlier policy in the same zone pair. What does policy shadowing mean in this context?

You need to log every time a specific security policy is hit by traffic, including when a session is closed. Which action modifier should you configure within the security policy?

An administrator notices that a security policy configured with a custom schedule is not enforcing time-based access control as expected. Upon checking the system time on the SRX device, it is discovered that the clock is set to UTC while the schedule was configured in local time without NTP synchronization. What is the recommended best practice to ensure security policy schedules operate correctly?

You are configuring global security policies in Junos OS on an SRX Series device. Which statement is accurate regarding the evaluation order between zone-based policies and global policies?

You are troubleshooting a connection failure where traffic passing from zone A to zone B is being blocked. You check the security policies and notice an explicit permit rule exists, but traffic is still dropped. Upon reviewing session details using the operational command 'show security flow session', you see no session is created. Which feature or tool would best help you verify if the security policy match is failing due to zone mismatches or incorrect match criteria?

Which THREE components are mandatory when defining a standard zone-based security policy rule in Junos OS? (Choose three.)

You want to create a security policy that applies to traffic originating from a specific address book entry named 'HQ-Net' in the 'trust' zone destined for 'Branch-Net' in the 'untrust' zone. Where must the 'HQ-Net' address be defined?

You have multiple security policies configured within the context of a specific source and destination zone. A new requirement dictates that a specific subset of users must be denied access while everyone else in the same zone remains permitted. How should you order your security policies to achieve this without disrupting existing traffic?

Which THREE methods can be used to modify the order of existing security policies in Junos OS? (Choose three.)

An administrator configures a security policy on a SRX Series device with the action set to 'count'. What is the primary function of this action in Junos security policies?

What is the primary difference between a zone-based security policy and a global security policy in Junos OS?

You are configuring a security policy that needs to match multiple specific applications (HTTP, HTTPS, and SSH) within a single rule. How should you specify these applications in the Junos CLI?

An administrator configures a unified security policy with a custom application signature. However, traffic matching the expected port is failing because the application identification engine (AppID) has not yet recognized the session payload. What mechanism does Junos use to handle initial packets while AppID inspects the traffic?

Where are address books defined when configuring zone-based security policies in Junos OS?

An enterprise network has multiple virtual routers configured within separate routing instances. How do security policies interact with traffic passing between two different routing instances on the same SRX device?

Which TWO factors contribute to policy shadowing in Junos security policy evaluation? (Choose two.)

You are troubleshooting a session-based firewall configuration on an SRX Series device. An application establishes a control connection on one port, but dynamically negotiates a secondary data port for file transfers. Without configuring an explicit policy for the secondary dynamic port, what Junos feature enables the security policy to dynamically permit this secondary data flow?

Which Junos CLI command allows an administrator to verify the active hit count and packet match statistics for a specific security policy?

Which command is used to display the currently active security policies on a Junos device?

Which THREE types of logging modifiers are available when configuring logging in a Junos security policy? (Choose three.)

Which TWO actions can be specified in the 'then' statement of a Junos security policy? (Choose two.)

An administrator configures a security policy with a scheduler-name attribute to restrict access during specific hours. What occurs outside of the scheduled time window for an existing active session that was created during the allowed window?

An administrator needs to create a security policy that allows users in the trust zone to access a web server in the DMZ zone, but only during business hours (09:00 to 17:00, Monday through Friday). Outside these hours, the traffic should be denied and logged. Which configuration approach should be used?

Which TWO conditions can cause a security policy to be considered shadowed in a Junos configuration? (Choose two.)

When configuring a zone-based security policy in Junos, what is the default action applied to any traffic that does not match any explicitly defined security policy rules?

Which THREE components are required when defining a standard zone-based security policy in Junos OS? (Choose three.)

You need to configure a security policy that inspects traffic for computer viruses and malware as part of the unified security policy framework. Which security feature must be referenced within the policy action?

An administrator needs to create a security policy on a Junos device that permits traffic from the trust zone to the untrust zone. Which configuration hierarchy is used to define this security policy?

An administrator is reviewing policy shadowing and rule optimization on an SRX Series device. Which THREE conditions must be met for one security policy to completely shadow (make redundant) a subsequent security policy?

When reviewing security policies, you see the term 'junos-any' used in the application match field. What does this represent?

Which statement correctly describes the order in which Junos security policies are evaluated on an SRX Series device?

Which THREE statements are true regarding global security policies in Junos OS? (Choose three.)

An administrator has created a security policy on an SRX Series device that permits HTTP traffic from the trust zone to the untrust zone. The administrator now wants to verify that this specific policy is matching traffic without examining the entire session table. Which operational command should be used?

When reviewing security policies, you notice multiple rules defined within the same source-zone and destination-zone context. Which Junos feature allows you to group these related policies together for easier management and readability?

By default, what action does an SRX Series device take when traffic does not match any configured security policy between two zones?

When configuring the unified security policy framework on Junos OS, which TWO elements are key components that extend traditional layer 4 firewall policies into layer 7 application and threat visibility?

You are configuring security policies on an SRX Series device that uses destination NAT. In what order does Junos evaluate security policies relative to destination NAT processing?

An administrator configures a security policy with source address set 'Internal-Subnets', destination address 'Any', and application 'junos-ftp'. During testing, active FTP data connections (PASV mode) are failing. What security policy consideration is most relevant to fixing this issue?

You are troubleshooting a connectivity issue where traffic between two custom zones is being blocked despite a policy permitting it. Upon reviewing the security policies using the CLI command 'show security policies', you notice that an earlier policy with broader match criteria is catching the traffic and applying a deny action. What security policy concept is causing this behavior?

You are configuring a security policy and need to reference a group of IP addresses that frequently changes. You decide to use an address set. How do you add individual address entries into this address set?

Which statement correctly describes a Junos security zone requirement before you can apply a security policy referencing that zone?

An administrator implements AppID within the unified security policy framework on an SRX Series device to identify and control specific cloud-based applications. The initial policy uses a broad match for 'junos-ssl' at the transport layer, while a subsequent policy specifies 'junos-facebook' using AppID. How does the SRX policy engine evaluate and re-evaluate traffic when application identification takes multiple packets to determine?

An administrator needs to create a unified security policy that permits traffic from the trust zone to the untrust zone. Using Junos J-Web, which primary menu path should the administrator navigate to configure this security policy?

What happens to return traffic for an established session that was originally permitted by a security policy?

Which TWO items are valid options when specifying source addresses in a security policy match statement? (Choose two.)

You are configuring a security policy on an SRX Series device that must allow DNS queries from clients in the trust zone to a DNS server in the DMZ zone. You want to limit the policy to UDP port 53 and also log session creation and closure. Which two configuration elements are required in the policy to achieve this? (Choose two.)

Which operational command should you use to view active stateful firewall sessions currently passing through an SRX Series device?

Which THREE statements are true regarding Junos security policy configuration hierarchy and syntax? (Choose three.)

What is the default action taken by Junos OS when traffic does not match any configured security policy between two zones?

An enterprise security policy requires that any traffic traversing from the DMZ zone to the Internal zone must first be inspected by an application-identification engine before the policy action is enforced. Which feature must be enabled within the security policy to achieve this behavior?

You are configuring a security policy on an SRX Series device that must match traffic from the trust zone to the untrust zone, but only for applications HTTP and HTTPS. You want to ensure that the policy is evaluated only after a more specific policy that permits SSH. What should you do?

During policy review, you notice that multiple global policies and zone-based policies are configured. In what order does the Junos security engine evaluate these policies when a packet arrives?

You need to configure a security policy that permits HTTP and HTTPS traffic from the 'users' zone to the 'internet' zone. You want to maintain clean configuration practices by grouping these applications together. Which Junos construct should you create first?

Which statement is true regarding address book configuration scope in Junos OS security policies?

Which statement accurately describes zone-based security policies in Junos OS?

An administrator implements a security policy that references a custom application matching UDP port 5000. When reviewing active traffic, packets on UDP port 5000 are being dropped even though a policy permits the custom application. Upon further inspection, you find that Junos AppID has classified the traffic as 'unknown-udp'. Why is the policy not matching?

You are configuring a security policy that needs to reference an address prefix that includes both IPv4 and IPv6 addresses. How should you handle this in Junos OS security address books?

An administrator configures a security policy with the action set to 'reject'. Another policy uses the action 'deny'. What is the functional difference between these two actions when a packet matches the policy?

You need to modify an existing security policy to add a new IP address to an existing address set used in the policy match criteria. Which configuration hierarchy should you access to update the address set?

Which THREE parameters can be used as match criteria within a Junos security policy? (Choose three.)