JNCIA-SEC Practice Question: Configuring a security zone and need to apply a SCREEN option to protect against IP…
You are configuring a security zone and need to apply a SCREEN option to protect against IP spoofing attacks. Under which hierarchy level must you associate the SCREEN option profile in Junos OS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
[edit security zones security-zone <zone-name> screen <profile-name>]
SCREEN options are applied under the security zones hierarchy to protect interfaces assigned to that zone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
[edit security policies from-zone <zone> to-zone <zone> screen]
Why it's wrong here
Security policies match traffic between zones by addresses, applications and users, and decide whether to permit, deny or reject it; they have no screen setting. Screens act earlier, on traffic entering a zone, before policy lookup. The profile is defined under [edit security screen ids-option <name>] and attached to the ingress zone under [edit security zones security-zone <zone-name>].
- ✗
[edit interfaces <interface-name> screen <profile-name>]
Why it's wrong here
Junos does not attach screen profiles to individual interfaces; the zone is the unit of protection, and every interface in the zone inherits the zone's screen profile. The interfaces hierarchy configures physical and logical properties such as units, address families and addresses. To protect an interface with screens, put it in a zone and attach the profile to that zone.
- ✗
[edit security screen id spoofing]
Why it's wrong here
Screen profiles are defined under [edit security screen ids-option <name>], with checks such as 'ip spoofing' inside the profile; there is no 'screen id spoofing' hierarchy. Defining the profile is only half the job, and it has no effect until a zone references it with 'set security zones security-zone <zone> screen <profile-name>'. Mixing up definition and association makes this option tempting.
- ✓
[edit security zones security-zone <zone-name> screen <profile-name>]
Why this is correct
Screens are attached to security zones: after defining a profile, for example 'set security screen ids-option untrust-screen ip spoofing', you apply it with 'set security zones security-zone untrust screen untrust-screen'. Every interface in that zone is then protected for traffic arriving on it. The spoofing check drops packets whose source address routes back through a different zone, similar to a uRPF check.
About these practice questions
One of 393 original JNCIA-SEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar JNCIA-SEC questions
- Which statement is true regarding Junos OS predefined applications?
- Which Junos OS feature allows an administrator to define a collection of applications that should be treated as a single…
- Which TWO objects can be referenced inside a Junos OS security policy? (Choose two)
- Which THREE components can be grouped within a Junos OS address set? (Choose three)
- You are troubleshooting an issue where TFTP file transfers are failing across an SRX device. Traffic is permitted by sec…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIA-SEC practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIA-SEC exam.