Content Security practice questions

To query external DNSBL servers and apply local overrides for known good or bad senders.

The block/permit list defines local sender overrides that take precedence over DNSBL query results, allowing administrators to whitelist trusted senders or blacklist known offenders. This satisfies the SBL scenario by combining external DNSBL lookups with locally enforced exceptions.

Under the [edit security policies from-zone <zone> to-zone <zone> policy <name> then] hierarchy.

UTM policies only take effect when attached as a UTM profile under the then clause of a security policy at [edit security policies from-zone <zone> to-zone <zone> policy <name> then], which binds antivirus, web filtering and antispam to matching traffic.

set security utm feature-profile antivirus profile default http-profile maximum-file-size <size>

The http-profile maximum-file-size setting raises the byte limit above which the Express antivirus engine stops inspecting and drops the transfer. This satisfies the stem's constraint by allowing large downloads to complete instead of timing out during scanning.

set security utm feature-profile web-filtering profile <name> no-log

The `no-log` parameter suppresses logging of matched URLs in both the local SRX logs and the cloud rating server submissions, directly satisfying the privacy regulation requiring sensitive URLs to remain unlogged. Unlike `block` or `permit`, which only control access, `no-log` addresses the logging constraint itself, ensuring no audit trail exposes the specified sensitive destinations.

Configure a custom URL category and assign a permit action within the UTM policy profile.

A custom URL category lets you single out the educational site and attach a permit action inside the UTM policy profile, bypassing the Finance category verdict. This satisfies the requirement to override the block without altering the global category assignment.

Content Filtering

Content Filtering inspects HTTP traffic and can block file downloads by extension, satisfying the requirement to stop .exe and .msi files regardless of website category. Its file-extension blocking operates independently of URL categorisation, so executables are denied even on otherwise permitted sites, unlike category-based web filtering.

show security utm web-filtering status

`show security utm web-filtering status` reports whether the SRX has successfully connected to the cloud rating server, displaying the server's reachability and licence state. It directly satisfies the stem's requirement to troubleshoot connectivity to that server, confirming whether the failure lies in reachability rather than in policy configuration.

File extension block list

The file extension block list matches filenames by suffix, such as .exe or .zip, letting the profile drop transfers of those types. This directly satisfies the requirement to restrict file transfers based on file type.

MIME type block list

Blocking by MIME type inspects the declared content type of a transfer, letting the profile deny specific file formats such as executables or archives. This directly satisfies the stem's requirement to restrict file transfers, since MIME type is one of the three definable parameters alongside file extension and protocol command.

Custom block text strings

Custom block text strings let the profile inspect transferred content for administrator-defined patterns and block matching files, satisfying the requirement to restrict file transfers by content. Unlike MIME-type or extension matching, this mechanism targets the payload itself, so it catches sensitive strings regardless of filename or protocol, making it a valid parameter within the Content Filtering profile.

HTTP

HTTP is inspected because content filtering examines web request and response payloads, extracting URLs and MIME types to permit or block categories. This satisfies the protocol requirement, as HTTP carries the browsable content that filtering profiles evaluate.

FTP

FTP inspection lets the SRX parse PORT and PASV commands, extracting the dynamically negotiated data-channel port so the content filter can scan transferred files. This satisfies the stem's requirement for protocols typically inspected, since FTP carries cleartext payloads that the filtering engine examines for prohibited content.

set security utm feature-profile web-filtering profile <name> default-action permit

The `default-action` parameter governs the fallback verdict applied when the web-filtering engine cannot match a URL against any category, including uncategorised sites. Setting it to `permit` overrides the profile's default block behaviour, directly satisfying the stem's requirement to allow uncategorised traffic rather than dropping it.

Under [edit security utm custom-objects antispam block-list] and [edit security utm custom-objects antispam permit-list]

The permit-list custom object defines sender addresses or domains exempt from antispam scanning, so partner-domain mail bypasses DNSBL checks entirely. Configuring it alongside the block-list under security utm custom-objects antispam satisfies the requirement that partner emails are never flagged, regardless of DNSBL results.

show security utm antivirus statistics

The `show security utm antivirus statistics` command displays real-time counters for antivirus scans and blocks, directly satisfying the stem's requirement for live UTM antivirus statistics on an SRX Series firewall. It reports cumulative scan and detection counts, unlike configuration or policy commands that reveal no runtime data.

Sophos

Sophos is one of the two providers natively integrated into SRX Integrated Web Filtering, alongside Websense. The feature queries the provider's cloud categorisation service directly, so no external server or ICAP configuration is needed — satisfying the stem's "natively supported" constraint.

Webroot

Webroot is one of the two providers natively integrated into SRX Integrated Web Filtering, alongside Juniper's own local database. The cloud-based Webroot service supplies URL category ratings directly to the SRX, satisfying the question's requirement for natively supported providers without extra configuration.

Block the email

Blocking the email is a valid Antispam profile action on SRX Series devices, satisfying the stem's requirement for configurable actions. The device drops or rejects the message outright once spam is detected, rather than tagging or quarantining it, which is the distinct enforcement behaviour this option represents.

Log the event

Logging is a valid action within an Antispam profile, letting the device record matching events without altering traffic flow. It satisfies the stem's requirement for configurable actions alongside blocking and tagging, and is commonly combined with other actions to provide audit visibility of spam detection on the SRX.

Custom message insertion

Custom message insertion is a valid Antispam profile action, letting you prepend a defined text banner to flagged messages rather than dropping or quarantining them. This satisfies the stem's requirement for configurable actions on the SRX Series, alongside tagging and blocking, giving granular control over how spam is handled.

Enable antivirus under ftp-profile and disable or omit it under http-profile.

Antivirus inspection is applied per protocol profile, so enabling it under ftp-profile scans FTP transfers while omitting it from http-profile leaves HTTP uninspected. This satisfies the stem's constraint of scanning FTP but bypassing HTTP antivirus for performance.

Matching type (such as exact, prefix, or suffix)

A custom URL pattern object requires a matching type specifying how the pattern is evaluated, such as exact, prefix, or suffix. This satisfies the stem's requirement for one of three parameters in web filtering overrides.

URL pattern string or regular expression

A custom URL pattern object must contain the actual URL pattern string or regular expression that defines which destinations the override matches. Without this matching criterion, the object cannot identify traffic, so it fails the stem's requirement for defining a custom URL pattern object for web filtering overrides.

Action (such as permit or block)

Action defines what the device does with traffic matching the custom URL pattern, satisfying the override's enforcement requirement. Without it, the object only classifies traffic and cannot permit or block it, so the firewall would have no instruction to apply during web filtering.

Offloading stream scanning buffers and ensuring fast-path processing on Security Processing Cards (SPCs).

SPCs handle UTM stream scanning in hardware, so buffers are offloaded from the Routing Engine and inspected packets stay on the fast path. This directly addresses the stem's constraint: CPU spikes on the control plane during large archive downloads.

Using Juniper Security Director or Junos Space centralized management.

Centralised management through Juniper Security Director or Junos Space pushes signature packages to managed SRX devices, satisfying the requirement for a manual trigger independent of the device's own scheduled download. The administrator initiates the update from the management platform, which then distributes it, rather than relying on automatic in-band retrieval.

Using the Junos CLI 'request security utm antivirus update' command.

The CLI command `request security utm antivirus update` directly triggers a manual signature download for the antivirus UTM service, satisfying the stem's requirement for a manual trigger method. It operates independently of scheduled automatic updates, giving administrators immediate control over signature refresh on the SRX Series firewall.

Web Filtering

Web Filtering classifies URLs and domains against categories such as gambling and adult content, then blocks matching requests. It directly enforces the access restriction the scenario requires, unlike content filtering, which inspects payloads rather than site categories.

set security utm feature-profile web-filtering profile <name> category <category-name> action block

The category parameter maps URL categories to actions, so specifying the social networking category with action block enforces the working-hours restriction. Junos integrated web filtering classifies traffic by category rather than by individual URL, satisfying the requirement to block an entire site category through the UTM profile configuration.