CCNA Security Policies Questions

The permit action authorises matching traffic to establish a session and be forwarded through the device. Without it, the policy's match criteria are evaluated but traffic is dropped, so permit is what actually allows passage.

Junos evaluates security policies sequentially, top to bottom, within each zone pair, stopping at the first match. This satisfies the stem's evaluation-behaviour constraint: policy order determines which rule applies, so a broader permit placed above a specific deny shadows it entirely.

The source-identity match condition allows a policy to match traffic based on the authenticated user or group identity. When integrated with a captive portal or user firewall authentication, the source-identity field can enforce that only authenticated users matching specific roles or groups are permitted.

Shadowing occurs because the earlier policy's match criteria are broader than or identical to the later one's, so every packet the subsequent policy would match is already claimed by the preceding policy. The later policy therefore never receives traffic, making it effectively unreachable within that zone pair.

The 'log' action modifier with both 'session-init' and 'session-close' generates log entries when the session starts and when it terminates. This satisfies the stem's requirement to record every policy hit, including session closure, using the permit action.

NTP synchronises the SRX clock with a reliable time source, ensuring schedule definitions align with actual time. Without synchronisation, the UTC-versus-local-time mismatch causes schedules to trigger at wrong intervals, so NTP is the recommended best practice for accurate time-based policy enforcement.

The SRX evaluates zone-based policies before global policies. If no zone-pair policy matches the traffic, evaluation falls through to global policies, which apply across all zones. This ordering satisfies the stem's requirement for the accurate evaluation sequence between the two policy types.

Security flow traceoptions log each packet's path through the flow module, exposing exactly which policy lookup occurs and why no session forms. This directly verifies zone mismatches or failed match criteria, since the trace shows the ingress and egress zone evaluation that the absent session cannot reveal.

A standard zone-based policy rule requires a source zone to identify where traffic originates, satisfying the mandatory from-zone match criterion. Junos OS pairs it with a destination zone and a permit, deny, or reject action; without a source zone, the rule cannot be committed.

Address book entries are scoped either to a zone's address-book or to the global address-book. Defining HQ-Net in the trust zone's address-book, or globally, makes it resolvable when the policy matches source traffic from the trust zone.

Junos evaluates security policies top-down, first match wins. Placing the explicit deny for the specific user subset above the general permit ensures those users are blocked before the broader rule is evaluated, while everyone else falls through to the permit, preserving existing traffic flows.

The 'insert ... before' command repositions an existing policy relative to another named policy, directly altering evaluation order without deleting it. Junos applies policies top-down, so placing a policy before another changes which rule matches first, satisfying the reordering requirement.

The 'count' action in Junos security policies permits matching traffic and increments packet and byte counters, but it does not log or deny. It satisfies the stem's requirement by combining permit behaviour with traffic accounting, unlike 'log' or 'deny' actions, which serve separate purposes.

Zone-based policies require an explicit from-zone and to-zone pair, so they are evaluated only for that specific zone context. Global policies omit zone pairs and are evaluated across all zones, which is the defining structural difference between the two policy types in Junos OS.

Listing multiple applications inside square brackets assigns the whole set to the rule's single match condition, so HTTP, HTTPS and SSH are matched by one policy. Junos expects predefined names such as junos-http, junos-https and junos-ssh, satisfying the requirement to combine several specific applications in a single rule.

Junos applies preliminary port-based match criteria to the first packets, allowing the session to proceed while AppID performs payload inspection. This satisfies the requirement that traffic on the expected port is not dropped before application identification completes, after which the session is re-evaluated against the custom signature.

Address books can be defined at the global `[edit security address-book]` hierarchy or bound to a specific zone under `[edit security zones security-zone <name> address-book]`. This satisfies the stem's requirement by allowing both global and per-zone scope, so policies reference the appropriate book depending on where the object is declared.

Traffic crossing between routing instances is treated as inter-zone traffic, so Microsoft Entra ID-independent SRX policy evaluation occurs whenever the ingress and egress interfaces sit in different security zones. The stem's constraint—separate routing instances on one device—does not bypass zone-based policy; it simply changes route lookup, not policy enforcement.

Policy shadowing occurs when a preceding policy matches all traffic a later policy would match, so the later rule is never evaluated. Incorrect ordering places the broader rule first, rendering subsequent specific policies unreachable in the top-down evaluation.

ALGs inspect the control connection and dynamically open pinholes for negotiated secondary data ports, so the security policy permits the data flow without an explicit rule for that dynamic port. This satisfies the requirement for session-based firewalls handling protocols like FTP.

This operational command displays per-policy packet and byte counters, showing which security policies traffic has matched. It satisfies the requirement to verify active hit counts and match statistics for a specific policy on the SRX device.

`show security policies` queries the active policy set loaded in the security policy database, listing each rule's source, destination, application and action. It satisfies the stem's requirement to display currently active policies, unlike configuration-oriented commands that merely echo candidate or committed configuration stanzas without confirming runtime policy state.

Session-init logging generates a log entry when a session is first created, capturing the initial packet's header details. Junos security policies support three logging modifiers: session-init, session-close and session-close-without-summary. This satisfies the question's requirement for a valid logging modifier type.

The then statement supports reject, which drops the matching packet and returns an ICMP unreachable or TCP reset to the source. This is a terminating action distinct from permit, deny and discard, and it satisfies the question's requirement for valid Junos security policy actions.

Schedulers govern policy evaluation at session setup only. Once a session is permitted and installed, it persists in the session table and is not torn down when the window closes; only new session attempts are denied. This matches the stem's constraint about existing active sessions.

The permit policy with a scheduler is active only during business hours. Outside those hours, it does not match, so traffic is evaluated by the next policy. A subsequent deny policy for the same zones will then match and deny the traffic, with logging enabled to record the denied sessions. This achieves the required behavior.

Shadowing occurs when an earlier policy's match criteria encompass a later policy's. A preceding 'any/any/any' policy matches all traffic, so the subsequent subnet-specific policy can never be evaluated, rendering it unreachable within the same zone pair.

Junos zone-based security policies end with an implicit deny-all, so unmatched traffic is dropped without any log or ICMP response. This default-deny posture satisfies the stem's constraint by ensuring no traffic passes unless an explicit permit rule allows it.

A standard zone-based policy requires a source zone as one of its match components, paired with a destination zone, to define the traffic direction. Without it, the policy cannot be placed in the zone-pair evaluation order.

A UTM anti-virus profile supplies the virus and malware inspection engine that the unified security policy action references. Without it, the policy permits or denies traffic but performs no content scanning, so the required virus and malware inspection cannot occur.

Security policies on Junos devices are configured under the [edit security policies] hierarchy, where zone-pair contexts such as from-zone trust to-zone untrust are defined. This satisfies the requirement to permit trust-to-untrust traffic by housing the policy statement that matches source, destination, and application.

Shadowing requires both rules to be evaluated in the same policy context, meaning an identical zone pair or both global. A rule in a different zone pair is never reached by the same traffic, so it cannot be shadowed.

The junos-any predefined application matches every application and protocol, effectively applying no application restriction. It is used when a policy should permit or deny all traffic regardless of protocol, relying on other match criteria for granularity.

Junos security policies are evaluated sequentially from the first policy in the list to the last. When a policy matches all criteria (source zone, destination zone, source address, destination address, application, and user if applicable), its action is applied, and no further policies are evaluated. This top-down, first-match behavior is fundamental to policy ordering and priority.

Global policies match on applications, source addresses, and destination addresses, unlike zone-based policies that also require explicit zone context. This five-tuple-plus-application matching capability is what allows global policies to enforce consistent rules regardless of the zones traffic traverses.

This command displays the hit count for each configured security policy, allowing the administrator to confirm whether the specific permit policy is matching traffic. It provides a simple counter per policy without needing to inspect individual sessions, making it ideal for quick verification in this scenario.

Policy sets group multiple security policies sharing the same source-zone and destination-zone context, letting you insert, reorder, and manage them as one unit. This directly satisfies the stem's requirement for easier management and readability of related rules within a single zone pair, rather than editing each policy individually.

The SRX Series applies an implicit deny-all policy at the end of every inter-zone policy set, so unmatched traffic is discarded without notification. This satisfies the default behaviour between two zones: no configured policy permits the session, therefore the packet is silently dropped rather than rejected or logged.

UTM security services profiles supply the layer 7 inspection engines — antivirus, anti-spam, content filtering and IPS — that attach to a policy rule. Without them, the unified policy framework can only match layer 4 tuples, so they are the element that delivers application and threat visibility.

Junos applies destination NAT before policy lookup, so security policies match the translated destination address rather than the original packet header. This satisfies the stem's ordering requirement, ensuring policy terms reference post-NAT addresses when destination NAT is configured.

Active FTP negotiates data channels dynamically, so a static junos-ftp policy alone cannot predict the PASV ports. The FTP ALG inspects the control channel and opens pinholes for the negotiated data sessions, satisfying the requirement to permit those secondary flows.

Policy shadowing occurs when an earlier policy with broader match criteria captures traffic before a later, more specific policy is evaluated. Junos OS evaluates policies top-down, so the broader deny rule matches first and the permitting policy is never reached.

An address set is populated by listing member addresses inside its definition statement, each referenced by name. Junos OS resolves those references at commit, so the set automatically reflects changes to the individual address entries without editing the policy itself.

Junos requires a zone to contain at least one active (up) interface before a security policy referencing it can be committed; an empty or down zone causes the commit to fail. The active interface binding is the prerequisite the stem asks about.

Initial packets match the broad junos-ssl transport-layer criteria, permitting the session provisionally. Once AppID inspects enough packets to identify junos-facebook, the SRX re-evaluates the existing session against the application-specific policy, applying the correct action without terminating the connection. This satisfies the stem's multi-packet identification constraint.

J-Web groups zone-based policy configuration under Configure > Security Services > Security Policies, where trust-to-untrust rules are created. This satisfies the requirement to build a unified security policy permitting trust-to-untrust traffic through the correct J-Web menu path.

Stateful inspection maintains a session table tracking the flow's five-tuple, so reply packets matching an established entry bypass policy lookup entirely. This satisfies the stem's constraint that no reverse security policy is needed, since the engine recognises the return traffic as part of the original permitted session rather than a new connection.

Junos security policy source-address accepts literal addresses and CIDR prefixes, letting a single term match a host or an entire subnet. The prefix 192.168.1.0/24 is therefore valid, satisfying the stem's requirement for a permissible source-address match specification.

The log session-init and log session-close options in the policy action generate logs when the session is created and terminated. This provides visibility into DNS query sessions. These options are configured under the then clause of the security policy, and they are necessary to meet the logging requirement.

The show security flow session command lists entries in the SRX session table, displaying source, destination, protocol, state and timeout for each active flow. It directly satisfies the requirement to view stateful sessions currently passing through the device.

Junos evaluates policies sequentially from the first configured rule to the last, within the specific zone-pair context, so the first matching policy's action is applied and remaining rules are skipped. This satisfies the stem's hierarchy requirement: ordering determines enforcement, making top-down evaluation within each zone pair accurate.

Junos OS enforces an implicit deny-all at the end of every inter-zone policy set, so unmatched traffic is discarded without logging or notification. This silent drop satisfies the default-action requirement, as no permit policy exists to authorise the session, and no reject message is returned to the source host.

Specifying applications as match criteria activates the AppID engine, which performs application identification before the policy action is evaluated. This satisfies the stem's constraint that DMZ-to-Internal traffic be inspected by an application-identification engine first, since the Junos security policy only invokes AppID when application match criteria are configured.

Security policies are evaluated top-down, and the first matching policy is applied. Placing the HTTP/HTTPS policy after the SSH policy ensures that SSH traffic is matched by the SSH policy first, while HTTP/HTTPS traffic falls through to the subsequent policy. This is the correct approach to achieve the desired evaluation order.

Zone-based policies are evaluated before global policies, so this ordering is right. The Junos security engine checks traffic against the source-zone to destination-zone policy set first; global policies apply only if no zone policy matches, acting as a catch-all across all zones.

An application set groups HTTP and HTTPS into a single named object, satisfying the requirement to bundle both applications cleanly before referencing them in the zone-to-zone policy. Junos matches the set as one unit, so the policy from 'users' to 'internet' stays concise rather than listing each application separately.

Zone-level address books bind entries to a single security zone, so only policies referencing that zone can use them. This satisfies the stem's scope constraint: Junos OS resolves address names within the zone context of the policy, unlike global address books, which any policy can reference regardless of zone.

Inter-zone traffic is denied by default because Junos OS evaluates sessions against security policies applied between zone pairs; no policy means no session, so packets are dropped. This satisfies the stem's requirement that only explicitly permitted traffic crosses zone boundaries, unlike intra-zone traffic, which is permitted by default.

AppID matches traffic against application signatures and port mappings, not merely the policy's stated port. Because the custom application lacks the signature or mapping AppID needs, traffic is classified as unknown-udp and never correlates to the policy, so it is dropped.

Junos address book entries bind to a single IP version, so an entry cannot hold both IPv4 and IPv6 prefixes. Defining separate entries per version satisfies the requirement to reference both address families within the security policy.

Reject actively notifies the source by returning an ICMP unreachable message, so the sender learns delivery failed. Deny drops the packet silently with no response, leaving the source to time out. This difference matters when troubleshooting or when applications must fail fast rather than hang.

Address sets are configured under [edit security address-book], either globally or inside a specific zone's address-book hierarchy. Editing the set there updates the object referenced by the policy's match criteria without altering the policy rule itself.

Applications and application sets are valid Junos security policy match criteria, letting you permit or deny traffic by Layer 7 application identity rather than port alone. This satisfies the stem's requirement for match parameters, since Junos evaluates them alongside source and destination addresses within the policy's from clause.