JNCIA-SEC Practice Question: When configuring a zone-based security policy in Junos, what is the default action…
When configuring a zone-based security policy in Junos, what is the default action applied to any traffic that does not match any explicitly defined security policy rules?
⚠ Common exam trap
Many exam-takers confuse 'deny' with 'reject' — candidates who think the SRX sends a reset by default pick 'Reject' instead of the silent 'Deny (Drop)'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny (Drop)
Junos zone-based security policies have an implicit default deny at the end of every zone-pair policy set. If no explicit policy matches a session's first packet, the SRX drops the traffic and, by default, does not log it unless a `then log` action or a default-deny logging policy is configured. This is the foundational 'implicit deny' behavior that makes SRX a default-deny firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reject
Why it's wrong here
Junos drops unmatched traffic silently via the implicit deny, without returning a TCP reset or ICMP unreachable, so Reject misstates the mechanism. Reject is chosen deliberately when you want the sender notified immediately, for example during troubleshooting or to fail fast.
- ✗
Permit
Why it's wrong here
Junos applies an implicit deny to traffic matching no policy, so unmatched packets are dropped rather than permitted. An explicit permit is required for every allowed flow; permitting unmatched traffic is the behaviour of a stateless filter with no terminating term, not a zone policy.
- ✗
Log only
Why it's wrong here
Junos zone-based policies implicitly deny unmatched traffic; logging alone neither permits nor drops it, so it cannot be the default action. Log-only behaviour is configured deliberately as a session-init or session-close log option on a rule you have already written.
- ✓
Deny (Drop)
Why this is correct
Junos zone-based security policies end with an implicit deny-all, so unmatched traffic is dropped without any log or ICMP response. This default-deny posture satisfies the stem's constraint by ensuring no traffic passes unless an explicit permit rule allows it.
About these practice questions
One of 393 original JNCIA-SEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar JNCIA-SEC questions
- Which THREE components are required when defining a standard zone-based security policy in Junos OS? (Choose three.)
- You need to configure a security policy that inspects traffic for computer viruses and malware as part of the unified se…
- An administrator needs to create a security policy on a Junos device that permits traffic from the trust zone to the unt…
- An administrator is reviewing policy shadowing and rule optimization on an SRX Series device. Which THREE conditions mus…
- When reviewing security policies, you see the term 'junos-any' used in the application match field. What does this repre…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Juniper Networks exam blueprint
This JNCIA-SEC practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIA-SEC exam.