JNCIA-SEC Practice Questions

Question 1

You need to apply a screen profile that detects IP address spoofing where the source IP address belongs to the local subnet of the ingress interface. Which screen option addresses this?

Accepted Answer

ip spoofing. IP spoofing detection in SCREEN options checks if incoming packets have source addresses matching the local router interfaces or martian networks.

Answer

icmp ping-sweep block

Answer

tcp syn-fraud detection

Answer

land attack prevention

Question 2

Which operational command should you use to view active stateful firewall sessions currently passing through an SRX Series device?

Accepted Answer

show security flow session. `show security flow session` is the operational command that displays the stateful session table on an SRX, including source/destination IPs, ports, protocol, policy name, and session state (e.g., 'Forward', 'Drop'). It is the primary tool for verifying that traffic is being permitted and tracked by the flow daemon.

Answer

show security policies active

Answer

show route active-sessions

Answer

show interfaces extensive session

Question 3

An administrator configures NAT and security policies on an SRX Series gateway. Traffic is hitting the security policy, but translation is failing. They run 'show security nat source pool' to check pool utilization. What does an exhausted NAT pool cause in the SRX packet flow?

Accepted Answer

New session creation fails and packets are dropped due to NAT resource exhaustion.. When a source NAT pool is exhausted, the SRX cannot allocate a new source port for a new session. Since NAT is a mandatory step in the first path packet processing for that policy, the session creation fails and the packet is dropped. The 'show security nat source pool' command would show the pool's utilization at 100%, confirming resource exhaustion.

Answer

Traffic is automatically forwarded without NAT translation.

Answer

The SRX reboots automatically to clear port tables.

Answer

Traffic is diverted to the backup routing instance.

Question 4

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

Accepted Answer

Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.. In Juniper SRX source NAT, rules within a rule-set are evaluated top-down and the first match wins, so a broad or restrictive rule placed above a more specific rule will shadow it. The fix is to order rules from most specific to least specific, or to split rules into separate rule-sets per zone so that Zone A's restrictive rules cannot interfere with Zone B's traffic. This restores correct pool selection and prevents the session drops Zone B is experiencing.

Answer

Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

Answer

Enable global zone-bypass mode for all source NAT pools.

Answer

Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

Question 5

What is the primary role of the Routing Engine (RE) in an enterprise SRX Series gateway?

Accepted Answer

Executing control plane functions, running Junos OS, managing routing protocols, and processing device configuration. The Routing Engine (RE) in an SRX Series gateway is responsible for control plane functions: it runs Junos OS, manages routing protocols, processes configuration, and handles management tasks. It does not forward data traffic; that is the role of the Packet Forwarding Engine (PFE).

Answer

Encrypting IPsec VPN traffic using specialized cryptographic hardware chips

Answer

Processing stateful packet inspection and fast-path data forwarding

Answer

Providing physical Ethernet port switching

Question 6

An administrator is troubleshooting a vSRX deployment where packet forwarding performance is severely degraded. They suspect that the virtual interfaces are not utilizing direct memory access or optimized packet processing drivers. Which virtualization technology integration is critical for optimal vSRX performance?

Accepted Answer

SR-IOV or DPDK integration. SRIOV (Single Root I/O Virtualization) or DPDK (Data Plane Development Kit) is essential for high-performance virtual packet processing in vSRX deployments.

Answer

Virtual machine snapshot scheduling

Answer

SNMP v3 trap forwarding

Answer

RADIUS accounting synchronization

Question 7

You need to inspect the live packet flow for a specific source IP address traversing the SRX device. Which utility can you use from the Junos CLI to capture packets on a specific interface with filtering options?

Accepted Answer

monitor traffic interface <interface-name>. The monitor traffic interface command uses tcpdump-like syntax to capture and inspect live packets passing through a specified interface.

Answer

traceoptions packet-capture

Answer

show security flow packet-capture

Answer

ping diagnostic capture

Question 8

An administrator configures a Source NAT rule-set with 'from zone trust' and 'to zone untrust'. Internal users can successfully browse the internet. Later, a new interface and zone (DMZ) are added, and hosts in the DMZ also need Source NAT to the untrust zone using the same pool. What is the most efficient way to achieve this?

Accepted Answer

Modify the existing rule-set to include the DMZ zone in the 'from zone' statement, or create an additional rule-set for the DMZ zone.. The most efficient approach is to either modify the existing rule-set's 'from zone' statement to include the DMZ zone (if the same pool and translation are desired) or create an additional rule-set for the DMZ zone. This reuses the existing NAT pool and configuration without global changes, preserving the trust zone rule-set's specificity.

Answer

Enable global NAT mode under the system hierarchy to automatically apply NAT across all zones.

Answer

Delete the trust zone rule-set and recreate it globally without specifying any source zone.

Answer

Configure static routes from the DMZ zone directly to the untrust zone to bypass NAT requirements.

Question 9

An administrator configures a security policy with source address set 'Internal-Subnets', destination address 'Any', and application 'junos-ftp'. During testing, active FTP data connections (PASV mode) are failing. What security policy consideration is most relevant to fixing this issue?

Accepted Answer

The FTP Application Layer Gateway (ALG) must be enabled to dynamically open security sessions for data channels.. FTP uses dynamically negotiated data ports, requiring the Junos ALG (Application Layer Gateway) for FTP to be active so security policies dynamically permit the data channel.

Answer

The security policy action must be changed from 'permit' to 'allow-pasv'.

Answer

FTP must be replaced with SFTP because security policies cannot support stateful FTP parsing.

Answer

A separate security policy must be created allowing traffic from untrust back to trust for port 20.

Question 10

You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by security policies. What is the most likely cause of this behavior?

Accepted Answer

The TFTP ALG is disabled or missing, preventing dynamic data port opening.. TFTP relies on UDP port 69 for initial control, but dynamically negotiates a new port for data transfer. The TFTP ALG must be active to handle this port translation.

Answer

The TCP proxy is disabled in the security zone.

Answer

Address books are blocking high-numbered UDP ephemeral ports.

Answer

Screen options are misinterpreting TFTP data packets as a UDP flood attack.

Question 11

Where are system log messages related to security policies typically directed when default logging configurations are used?

Accepted Answer

To the local log file configured under system syslog, such as interactive-commands or security-log. Security policy logs are sent via security daemon (secd) and flow module to the local syslog utility, usually directed to a file or remote collector.

Answer

Directly to the active user terminal screen by default

Answer

To the kernel crash dump utility

Answer

To the boot-time NVRAM partition

Question 12

An administrator configures Destination NAT to forward incoming traffic on port 80 to an internal server. After committing, the administrator notices that ping tests to the destination NAT public IP address fail. What is the standard behavior of Destination NAT regarding ICMP ping requests?

Accepted Answer

Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.. Destination NAT rules that match specific TCP/UDP ports (like port 80) do not translate ICMP traffic because ICMP does not use ports. Therefore, ping requests to the public IP are not forwarded to the internal server, resulting in failed pings unless an ICMP-specific Destination NAT rule is configured. This is standard Junos behavior.

Answer

ICMP ping requests are dropped by the Junos control plane as a security hardening default.

Answer

Destination NAT automatically translates and responds to all ICMP echo requests by default.

Answer

Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.

Question 13

Which Junos configuration hierarchy is used to define a UTM Web Filtering profile?

Accepted Answer

[edit security utm feature-profile web-filtering profile <name>]. UTM feature profiles are configured under the [edit security utm feature-profile web-filtering] hierarchy.

Answer

[edit firewall utm-policy web-filter]

Answer

[edit security web-filter profile <name>]

Answer

[edit applications utm web-filtering]

Question 14

You are configuring a security policy and need to reference a group of IP addresses that frequently changes. You decide to use an address set. How do you add individual address entries into this address set?

Accepted Answer

By referencing the individual address entries within the address-set definition statement.. An address set in Junos is a named container that groups multiple address book entries. To add individual address entries into the set, you reference them within the address-set definition using the 'address' statement (e.g., 'set security address-book global address-set MySet address Server1'). This creates a logical group that can be referenced in policies.

Answer

By applying firewall filter terms to the address set container.

Answer

By assigning the address set to an interface unit.

Answer

By listing raw IP subnet masks directly inside the security policy match statement.

Question 15

Which statement correctly describes a Junos security zone requirement before you can apply a security policy referencing that zone?

Accepted Answer

The zone must have at least one active interface assigned to it.. Before a security policy can reference a zone, that zone must have at least one active interface assigned to it. Junos requires zones to be bound to physical or logical interfaces so the device knows which ingress and egress points the zone represents; a zone with no interfaces cannot participate in policy evaluation.

Answer

The zone must be assigned to a virtual router routing instance.

Answer

The zone must have screen options enabled for DoS protection.

Answer

The zone must have an IPv4 address assigned directly to the zone context.

Juniper Networks Security, Associate (JNCIA-SEC, JN0-232) JNCIA-SEC practice test

Three ways to study

Study JNCIA-SEC by domain

Study JNCIA-SEC by topic

Network Address Translation practice questions

Srx Series Service Gateways practice questions

Monitoring And Troubleshooting practice questions

Security Policies practice questions

Junos OS Security Objects practice questions

Content Security practice questions

JNCIA-SEC fundamentals practice questions

JNCIA-SEC scenario practice questions

JNCIA-SEC troubleshooting practice questions

Juniper Networks Security, Associate (JNCIA-SEC, JN0-232) (JNCIA-SEC) practice questions