How should I use these Junos OS Security Objects practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Junos OS Security Objects questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Junos OS Security Objects domain.

JNCIA-SEC · topic practice

Junos OS Security Objects practice questions

This domain covers the Junos OS security objects you configure under the [edit security] hierarchy on SRX Series devices: zones, screen profiles, address books, applications, and policy objects. Questions test where objects are bound, how screen options map to specific attacks, and how services like TFTP behave when traffic is permitted but still fails.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Junos OS Security Objects

Practice 10 questions Browse domain →

What the exam tests

What to know about Junos OS Security Objects

Be able to configure and bind security objects under [edit security], especially zones and screen profiles, and match each screen option to the attack it detects. The single most important thing is knowing that screen profiles attach to zones, not globally, and that permitted traffic can still fail without proper ALG handling.

Screen options such as IP spoofing, land, ping-of-death, and SYN flood protections

Zone configuration and binding screen profiles to zones under [edit security zones]

Address books, applications, and security policy objects under [edit security]

Session handling for protocols like TFTP and the need for ALG or persistent NAT

Watch out for

Common Junos OS Security Objects exam traps

▸Assuming a screen profile is applied globally rather than bound to a specific security zone.
▸Confusing which screen option handles a given attack, such as IP spoofing versus land attacks.
▸Forgetting that TFTP uses UDP and may require an ALG or service-specific handling to pass.

Practice set

Junos OS Security Objects questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Junos OS Security Objects explanation →

You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?

Trap 1: icmp flood limit <value>

ICMP flood is for ICMP packets, not TCP SYN packets.

Trap 2: ip spoofing check

IP spoofing is designed to check source IP validity, not TCP handshake floods.

Trap 3: tcp-syn-flood attack-threshold

The correct parameter syntax uses 'tcp syn-flood' with threshold and alarm options.

Study all Junos OS Security Objects common traps →

A
tcp syn-flood alarm-threshold <value>
The tcp syn-flood alarm-threshold parameter sets the connection-rate ceiling that triggers SYN flood detection within the SCREEN profile, directly satisfying the requirement to detect and block SYN floods on the interface. Lowering this value increases sensitivity, causing the device to activate SYN cookie protection once the threshold is exceeded.
B
icmp flood limit <value>
Why it fails: ICMP flood is for ICMP packets, not TCP SYN packets.
C
ip spoofing check
Why it fails: IP spoofing is designed to check source IP validity, not TCP handshake floods.
D
tcp-syn-flood attack-threshold
Why it fails: The correct parameter syntax uses 'tcp syn-flood' with threshold and alarm options.

Junos OS Security Objects practice questions

What to know about Junos OS Security Objects

Common Junos OS Security Objects exam traps

Junos OS Security Objects questions

You want to configure SCREEN options to detect and block SYN flood attacks on an interface. Which specific SCREEN option parameter should you adjust within the screen profile?

An administrator notices that FTP traffic is failing inspection when traversing the SRX device. Upon investigation, it is found that the default ALG for FTP is interfering with non-standard control ports. Where would you modify or disable the FTP ALG in Junos OS?

Which command allows you to view the configured security zones and their assigned interfaces in Junos OS?

You want to configure an address book entry that matches all IP addresses within the 192.168.10.0/24 subnet except for 192.168.10.50. How can this be accomplished in Junos OS address configuration?

An administrator configures a security zone and enables the 'tcp-rst' SCREEN option. What is the primary purpose of this SCREEN option?

You have configured a custom application object named 'CUSTOM-APP' matching TCP port 9090. When you attempt to commit the configuration, Junos returns an error stating that the application conflicts with a predefined Junos application. How should you resolve this?

You need to define an address book entry that references a range of IP addresses from 10.1.1.100 to 10.1.1.200. What is the correct configuration syntax under the security address-book hierarchy?

You need to inspect traffic matching a proprietary application that uses dynamic TCP ports. You have written a custom application. What additional Junos security feature can be combined with custom applications to inspect deep packet content for non-standard ports?

You want to configure a security zone to automatically reject new TCP connections with a TCP RST packet when the zone's transit sessions exceed capacity or policies deny them. Where is this behavior configured?

Which command is used to view the list of all predefined Junos OS application objects?

An administrator configures an address set that includes another address set as a member (nested address sets). What is the maximum nesting depth supported for address sets in Junos OS?

Which command displays the configured functional zones in Junos OS?

An administrator configures a security zone and enables traceoptions for zone management. What is the correct configuration hierarchy to enable traceoptions for security zones?

You want to create a security zone and explicitly block all traffic between interfaces assigned to that same zone (intra-zone traffic). Which configuration statement accomplishes this?

You are troubleshooting an issue where an ALG is altering port numbers during FTP sessions, causing authentication failures with an application-layer proxy. Which command shows active ALG sessions and their port translations?

Which Junos OS command displays the configuration of all security zones?

You need to configure a custom application that matches UDP traffic on a range of destination ports from 5000 to 5010. How should you specify this range in the application configuration?

Which command is used to display the currently configured global address books in Junos OS?

You are troubleshooting an issue where an application defined with a specific timeout is timing out prematurely during periods of inactivity. Where would you verify or adjust the flow session timeout globally in Junos OS?

Track your progress over time

Start a Junos OS Security Objects only practice session

Related JNCIA-SEC topic practice pages

Network Address Translation practice questions

Srx Series Service Gateways practice questions

Monitoring And Troubleshooting practice questions

Security Policies practice questions

Junos OS Security Objects practice questions

Content Security practice questions

JNCIA-SEC fundamentals practice questions

JNCIA-SEC scenario practice questions

JNCIA-SEC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid