Security Policies practice questions

Junos AppID uses deep packet inspection and overrides custom port definitions with recognized protocol signatures.

Junos AppID performs deep packet inspection, so it identifies HTTP by its protocol signature regardless of the configured TCP port 8080. Because signature-based recognition takes precedence over custom port definitions, the engine labels the traffic junos-http, satisfying the stem's requirement that port matching succeeds while application identification overrides it.

Configuring security policies grouped by source-zone and destination-zone pairs.

Grouping policies by source-zone and destination-zone pairs is the mechanism behind Junos security policy grouping, which bundles multiple policies into one logical container. This directly satisfies the stem's requirement for easier management and application across multiple zones, since the zone-pair context lets a single group apply consistently wherever those zones interact.

Using unified policies with advanced services integration.

Unified policies integrate advanced security services, letting a single policy redirect matching traffic to a logical tunnel interface for service chaining. This satisfies the requirement by binding the tunnel action to the policy's advanced services element rather than a basic permit or deny.

Running the 'test security flow' operational command with source IP, destination IP, and protocol parameters.

The 'test security flow' command simulates a packet through the policy lookup, specifying source IP, destination IP and protocol, and reports the matching policy. This resolves which rule wins when overlapping policies exist, without generating live traffic.

The 'count' option was omitted from the policy action clause.

Junos increments policy hit counters only when the action clause includes the count option. Without it, traffic still matches and is permitted or denied, but no counter increments, so the policy appears unused despite passing traffic.

insert security policies from trust to untrust policy new-policy before policy old-policy

The insert statement reorders an existing policy by placing new-policy before old-policy within the same zone pair, using the from-zone trust to-zone untrust context. This directly satisfies the requirement to position a policy above an existing one rather than appending it.

Within the specific security policy configuration under the policy terms.

Scheduler objects bind directly to a security policy's terms, so attaching it there restricts rule matching to the defined non-business-hours window. Junos evaluates the scheduler as a match condition alongside source, destination and application, meaning traffic outside those times bypasses the policy entirely.

Global policies do not require source and destination zones to be specified in their definition.

Global policies are evaluated before inter-zone and intra-zone policies, and their match criteria omit zone context entirely, so no source or destination zone needs specifying. This satisfies the stem's requirement for a characteristic unique to global policies, distinguishing them from zone-based security policies in Junos OS.

Global policies can include match criteria for applications and address books.

Global policies accept application and address-book match criteria, letting one ruleset govern traffic across all zones without duplication. This satisfies the stem's requirement for behaviour and characteristics, since Junos OS evaluates these global entries before zone-specific policies, applying consistent application-aware filtering enterprise-wide.

show security policies hit-count

The operational command show security policies hit-count displays each policy's hit counter, letting administrators confirm which policies are matching traffic. It directly satisfies the stem's requirement to view policy hit counts and operational status on a Junos device.

show security policies detail

The command show security policies detail lists every policy with its full configuration, including match criteria, actions and counters, giving operational status. It satisfies the stem's requirement to view policy hit counts and operational status on a Junos device.

If AppID cannot identify an application, it falls back to the underlying port-based protocol definition if configured.

When AppID cannot positively identify an application, Junos falls back to the port-based protocol definition if one is configured, so policy design must account for this behaviour. Otherwise unidentified traffic may match unintended rules based solely on port.

Traffic classification may require multiple packets before AppID can definitively identify the application.

AppID inspects payload signatures across several packets, so a session's first packet often carries no definitive classification. Policies relying on application match must therefore tolerate this initial ambiguity, since the constraint is that identification is not instantaneous.

The packet is dropped.

Reject discards the offending packet outright, satisfying the policy's requirement to terminate the session without delivering traffic. Unlike deny, which silently drops, reject also sends a TCP RST or ICMP unreachable message back to the source, immediately notifying the sender of the failure.

An ICMP unreachable message is transmitted back to the packet source.

Reject terminates the session and returns an ICMP unreachable message to the source, satisfying the requirement that the sender be notified of the drop. Unlike deny, which silently discards packets, reject actively signals the source, so the matching packet triggers this ICMP response alongside session teardown.

Management traffic to the routing engine is blocked unless explicitly permitted by host-inbound-traffic settings.

Correct (though host-inbound-traffic is configured under zones, it governs control plane access). Let's verify standard phrasing. Wait, host-inbound-traffic controls control plane access. But let's check another option. Let's see: Option A and B are the core zone behaviors.

Traffic between different security zones is blocked by default.

Correct. Default interzone traffic is denied.

Traffic between interfaces in the same security zone is permitted by default.

Correct. Intrazone traffic is allowed by default.

The transit interfaces involved are assigned to different security zones than those specified in the policy's source and destination zone pair.

Correct. Zone mismatch prevents policy matching.

A broader policy placed earlier in the evaluation order matches and captures the traffic first.

Correct. Policy shadowing prevents the new rule from being reached.

The address book entries referenced in the policy use IPv6 addresses while the transit traffic is IPv4.

Correct. Address family mismatch prevents matching.

show | compare

Correct. 'show | compare' displays uncommitted configuration changes.

commit check

commit check parses the candidate configuration and reports syntax or semantic errors without activating it, so invalid security policy statements are caught before commit. This directly satisfies the requirement to verify configuration validity before committing.

set security policies from trust to untrust policy pol-new insert before policy pol-1

The insert before keyword places the new policy immediately above pol-1 in the ordered policy list, satisfying the requirement to position pol-new directly before the existing policy. Junos evaluates policies top-down, so ordering commands like insert before are needed to control precedence.

Asymmetric routing is causing return packets to arrive on a different interface/zone without matching the session table.

Stateful SRX devices require return traffic to match an existing session. Asymmetric routing delivers return packets on a different interface or zone, so no session entry matches and the default deny drops them, breaking the established HTTP flow.

set security policies from-zone trust to-zone untrust policy web match source-address any

Using the reserved keyword `any` in the source-address match condition satisfies the requirement to match all source IP addresses while still constraining traffic to TCP port 443. Junos accepts `any` directly in the from-zone policy match, so no address book entry or wildcard prefix is needed.

then { deny; log; }

Appending log to the deny action generates a session log entry at the moment the packet is dropped, satisfying the immediate-logging requirement. Without the log keyword, denied traffic is discarded silently and no record reaches the log server.

A security zone must contain at least one interface before a policy can reference it.

Zones must be bound to at least one interface before policies referencing them take effect, since zone membership derives from interface assignment. An empty zone has no traffic to evaluate, so the policy cannot match anything until an interface is added.

Security policies can be created between the same source and destination zone (intra-zone traffic).

Junos permits policies between identical source and destination zones, so intra-zone traffic can be explicitly permitted or denied rather than relying on implicit defaults. This satisfies the stem's requirement that the statement be correct: the same-zone pair is a valid match condition, unlike inter-zone-only assumptions.

reject

A security policy 'then' clause supports permit, deny, reject and log actions. Reject terminates the session and returns an ICMP unreachable or TCP reset to the source, unlike deny, which silently discards the packet. This satisfies the question's requirement for a valid terminating action.

permit

Permit is one of the terminating actions selectable in a Junos security policy's then statement, allowing matching traffic to pass. It satisfies the stem's requirement for an available action, alongside deny, reject, log and count.