I85PREP
⌘ K
JNCDS-SEC study materials
JNCDS-SEC study resources

JNCDS-SEC practice questions

One question at a time. Build your JNCDS-SEC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Customer Network Design Requirements

A customer wants to enforce least-privilege access for its Juniper Mist administrators and asks which capability should be used to scope each administrator to a single site. Which Mist feature addresses this requirement?

  1. Two-factor authentication enforced for all administrator logins
  2. Session recording of administrator configuration changes
  3. Role-based access control with role assignments scoped to specific sites Correct answer.
  4. Single sign-on integration with the customer identity provider

Explanation

Mist supports role-based access control where an administrator account is bound to a role, and that role can be limited to specific sites or the whole organization. Scoping the role to one site is the mechanism that restricts visibility and change rights to that site. MFA, SSO, and audit logging strengthen authentication and accountability but do not by themselves limit an administrator to one site.

Question 2Customer Network Design Requirements

During a requirements workshop the customer states that its branch offices must keep forwarding traffic between local VLANs even when the WAN link to the data center is down. Which design requirement is the customer expressing?

  1. End-to-end path symmetry for stateful inspection
  2. WAN link load balancing across providers
  3. Centralized policy enforcement at the data center
  4. Local survivability of intra-branch switching and routing Correct answer.

Explanation

Requiring local VLAN-to-VLAN forwarding to continue during WAN loss is a survivability requirement: the branch device must hold the gateway and switching intelligence locally. Centralized enforcement, path symmetry, and load balancing are separate concerns that do not describe continued local forwarding. Capturing this explicitly drives the choice of branch gateway placement and local routing.

Question 3Customer Network Design Requirements

A retail customer requires that guest Wi-Fi users be isolated from the corporate network while still reaching the internet, and that guest traffic be identifiable in firewall logs. Which design element is the most direct way to satisfy both parts of this requirement?

  1. Port isolation enabled on all access switch ports used by employees
  2. A dedicated guest VLAN with its own subnet and a policy that permits only internet-bound traffic Correct answer.
  3. A captive portal that collects an email address before access is granted
  4. A single corporate VLAN with a firewall rule that blocks RFC 1918 destinations

Explanation

A separate guest VLAN and subnet gives guest traffic a distinct, loggable identity and lets policy permit only internet destinations while denying corporate subnets. This satisfies both isolation and log identification with one design decision. Port isolation and captive portals address other concerns and do not by themselves create a distinguishable, policy-scoped guest segment.

Question 4Customer Network Design Requirements

The customer asks how Juniper Mist WAN Assurance obtains the telemetry it uses to score WAN link health and application experience. Which statement describes the required design element?

  1. NetFlow export is enabled on the core switch and forwarded to an on-premises collector
  2. SNMP polling is configured from the Mist cloud to each WAN edge device
  3. A standalone probe appliance is installed at each site to run synthetic tests only
  4. SRX or Session Smart Router devices are onboarded to Mist and send telemetry to the Mist cloud Correct answer.

Explanation

WAN Assurance relies on Juniper WAN edge devices, such as SRX or Session Smart Router, being onboarded to the Mist cloud so they can stream telemetry. The cloud correlates that telemetry into link and application health scores. NetFlow collectors, SNMP polling, and dedicated probes are not the mechanism Mist uses for this scoring.

Question 5Customer Network Design Requirements

A customer with a single data center and 40 branch sites wants a design principle that keeps branch policy consistent while allowing local internet breakout. Which approach best matches that requirement?

  1. Apply policy only at the data center edge and leave branch devices unmanaged
  2. Backhaul all branch internet traffic to the data center and remove local breakout
  3. Configure each branch independently so local administrators can tune policy as needed
  4. Define a standard branch template with common security policy and allow site-specific breakout rules Correct answer.

Explanation

A templated branch design keeps security policy consistent across sites while permitting controlled, documented local exceptions such as internet breakout. Independent per-site configuration invites drift and inconsistent enforcement. Backhauling everything defeats the stated breakout goal, and leaving branch devices unmanaged removes the policy baseline entirely.

Question 6Customer Network Design Requirements

Which customer requirement most directly justifies deploying a stateful firewall cluster in high availability rather than a single device at the data center edge?

  1. The customer wants to reduce the number of public IP addresses in use
  2. The business cannot tolerate a firewall outage that interrupts internet-facing services Correct answer.
  3. The customer wants detailed application visibility in traffic reports
  4. The customer needs to inspect encrypted traffic from remote users

Explanation

High availability addresses availability of the security function itself, which is the requirement described: no single firewall outage should interrupt services. Visibility, decryption, and public address conservation are valid goals but are met by features other than HA pairing. Matching the stated business impact to the HA design keeps the requirement traceable.

Question 7Customer Network Design Requirements

A healthcare customer requires that only managed corporate endpoints be allowed onto the internal wireless network, with posture checked before access. Which Juniper solution element should the design specify?

  1. Mist Access Assurance using 802.1X with a RADIUS and posture integration Correct answer.
  2. A pre-shared key rotated monthly and distributed to staff
  3. MAC authentication bypass for all wireless clients
  4. An open SSID with a captive portal that displays an acceptable-use notice

Explanation

Access Assurance provides network access control in Mist, using 802.1X identity plus endpoint posture checks through RADIUS integration to admit only compliant managed devices. Shared keys and MAC bypass authenticate the connection but do not verify device posture. An open SSID with a portal does not establish that endpoints are managed or compliant.

Question 8Customer Network Design Requirements

The customer's security policy states that all traffic between the engineering and finance segments must be inspected by a firewall, even when both segments are in the same building. Which design decision follows from that requirement?

  1. Apply an ACL on the access switch and remove the firewall from the path
  2. Route inter-segment traffic through a firewall enforcement point rather than switching it locally Correct answer.
  3. Place both segments in the same VLAN so no inspection is needed
  4. Use a single flat subnet for both departments and rely on endpoint firewalls

Explanation

If policy requires firewall inspection between two segments, the traffic path must traverse a firewall, which means the segments cannot be bridged locally without an enforcement point. Collapsing them into one VLAN or relying on switch ACLs bypasses the required inspection. The design must therefore route inter-segment flows to the firewall.

Question 9Customer Network Design Requirements

A customer with 200 sites wants to minimize configuration drift and speed new-site deployment. Which Mist design approach best meets this requirement?

  1. A single site containing all 200 locations under one configuration
  2. Manual per-site configuration with a documented checklist
  3. Separate organizations for each region with independent settings
  4. Site templates and org-level WLAN and policy definitions applied consistently to sites Correct answer.

Explanation

Mist site templates plus organization-level WLANs and policies let common settings be defined once and inherited, reducing drift and simplifying onboarding of new sites. Manual checklists and independent regional organizations increase divergence. A single site for all locations removes meaningful per-site scoping and complicates operations.

Question 10Customer Network Design Requirements

The customer requires that branch users reach SaaS applications directly over the local internet link while corporate applications continue through the data center. Which design element enables this?

  1. A single WAN link per branch with no local internet circuit
  2. Application-aware policy on the branch edge that steers traffic by destination or application Correct answer.
  3. A default route from every branch to the data center with no exceptions
  4. Policy-based routing that sends all internet traffic to the data center

Explanation

Selective breakout requires the branch edge to classify traffic and steer SaaS-bound flows to the local internet while sending corporate flows over the WAN. A blanket default route or sending all internet traffic to the data center defeats the breakout goal. Without a local internet circuit, local breakout is not physically possible.

Question 11Customer Network Design Requirements

A customer wants to know which requirement drives the need for a dedicated out-of-band management network for security devices. Which answer is most accurate?

  1. Management access must remain available and isolated even when the production data plane is under attack or misconfigured Correct answer.
  2. Out-of-band management removes the need for administrator authentication
  3. Out-of-band management increases data plane throughput on the firewall
  4. Out-of-band management allows the firewall to inspect more protocols

Explanation

An out-of-band management network keeps administrative access reachable and separated from production traffic, so a data plane outage or attack does not lock administrators out. It has no effect on throughput or protocol inspection depth, and authentication is still required. The requirement is about resilient, isolated administrative reachability.

Question 12Customer Network Design Requirements

During discovery, the customer reports that its security team needs to correlate threats seen at branch firewalls with events seen at the data center. Which design consideration should be captured?

  1. Disabling logging at the branch to reduce WAN utilization
  2. Centralized logging and event correlation that ingests telemetry from all enforcement points Correct answer.
  3. Relying on each site team to review its own logs independently
  4. Increasing the log buffer size on each branch firewall only

Explanation

Correlating events across branch and data center enforcement points requires a central collection and correlation capability fed by all devices. Local buffer increases and independent per-site review cannot produce cross-site correlation. Reducing branch logging removes the very data the security team needs.

Question 13Customer Network Design Requirements

A customer requires that remote workers access internal applications without exposing those applications directly to the internet. Which design pattern best fits?

  1. A client-based VPN or zero-trust access service that brokers connections to internal applications Correct answer.
  2. Placing the applications in a DMZ with direct internet exposure
  3. Allowing split tunneling to internal subnets without authentication
  4. Publishing each internal application with a public IP and host-based firewall

Explanation

Brokering remote access through a VPN or zero-trust service keeps internal applications unreachable directly from the internet while still allowing authorized users in. Publishing applications with public addresses or placing them in an exposed DMZ contradicts the requirement. Unauthenticated split tunneling to internal subnets is a security gap, not a design.

Question 14Customer Network Design Requirements

A customer's compliance team requires evidence that firewall rule changes are reviewed and approved before taking effect. Which design element supports this requirement?

  1. A change-management workflow with role separation between rule authors and approvers Correct answer.
  2. Relying on post-incident review of logs after a rule change causes an outage
  3. Backing up device configurations nightly without review
  4. Granting all administrators full read-write access to simplify operations

Explanation

Pre-approval evidence comes from a workflow that separates who can propose a rule change from who can approve and deploy it. Broad read-write access removes that separation, and after-the-fact log review or backups do not demonstrate prior review. The requirement is about process controls reflected in the design.

Question 15Customer Network Design Requirements

A customer plans to adopt Mist for wireless and wired assurance but wants to keep authentication on its existing on-premises RADIUS servers. Which statement reflects a valid design consideration?

  1. Mist requires the RADIUS servers to be replaced by a local captive portal
  2. Mist cannot provide assurance for wired clients authenticated by an external RADIUS server
  3. Mist requires all authentication to be performed by Mist Access Assurance in the cloud
  4. Mist can integrate with external RADIUS infrastructure for authentication while still providing cloud management and assurance Correct answer.

Explanation

Mist can use the customer's existing RADIUS infrastructure for 802.1X authentication while still delivering cloud management, visibility, and assurance. It does not force a wholesale replacement of authentication servers, and assurance data is collected independently of which RADIUS server validates the client. Preserving existing identity investment is a common customer requirement.

Question 16Customer Network Design Requirements

A customer states that its security policy forbids direct communication between the IoT device VLAN and the building management VLAN, but both must reach a shared logging server. Which policy design satisfies this?

  1. Deny all traffic from both VLANs, including to the logging server
  2. Deny IoT-to-building-management traffic while permitting each segment to reach only the logging server Correct answer.
  3. Permit all traffic between the two VLANs and rely on device hardening
  4. Merge the two VLANs and use host firewalls to block peer traffic

Explanation

The policy needs a default deny between the two segments plus explicit permits to the shared logging destination from each. Permitting all inter-VLAN traffic violates the prohibition, and denying everything blocks the required logging. Merging the VLANs removes the segmentation boundary the policy depends on.

Question 17Customer Network Design Requirements

A customer wants to verify that its design meets a requirement for encrypted management of network devices. Which design element should be specified?

  1. SSH or HTTPS with strong cipher suites for all device management sessions Correct answer.
  2. SNMPv1 read-write community strings for monitoring
  3. Telnet enabled only on the management VLAN
  4. HTTP access limited to administrators on the management subnet

Explanation

Encrypted management requires protocols such as SSH and HTTPS with modern cipher suites for administrative sessions. Telnet and HTTP carry credentials in cleartext, and SNMPv1 community strings are also unencrypted. Specifying the protocol and cipher baseline is what makes the requirement verifiable.

Question 18Customer Network Design Requirements

A customer with seasonal spikes wants a design that scales inspection capacity without replacing the existing firewall platform. Which requirement should be documented to guide the design?

  1. Consolidation of all traffic onto a single high-capacity interface
  2. Headroom and licensing for adding cluster members or virtual instances during peak periods Correct answer.
  3. A fixed capacity plan sized to the lowest observed traffic level
  4. Removal of logging during peak periods to free resources

Explanation

Scalability requirements should capture how capacity can be added within the existing platform, such as additional cluster members or virtual instances and the licensing needed. Sizing to the lowest level leaves the customer unable to handle peaks, and disabling logging or consolidating interfaces does not add inspection capacity.

Question 19Customer Network Design Requirements

A customer requires that wireless guest traffic and corporate wireless traffic use separate security policies but share the same access points. Which Mist design element supports this?

  1. Separate physical access points for each user group at every location
  2. Multiple WLANs mapped to separate VLANs and policy scopes on the same access points Correct answer.
  3. A single WLAN with one VLAN shared by guests and employees
  4. A single WLAN with a firewall rule that blocks all guest destinations

Explanation

Mist supports multiple WLANs per access point, each mapped to a different VLAN and policy scope, so guest and corporate traffic can share radios while being treated differently. A single shared WLAN cannot apply distinct policy, and separate physical access points are unnecessary. Blocking all guest destinations would break guest internet access.

Question 20Customer Network Design Requirements

A customer's risk assessment identifies that a compromised branch device could be used to pivot into the data center. Which design requirement most directly limits that risk?

  1. Increasing the branch WAN bandwidth to reduce congestion
  2. Enabling jumbo frames on the branch-to-data-center path
  3. Adding a second ISP at each branch for redundancy
  4. Least-privilege inter-zone policy that permits only required branch-to-data-center flows Correct answer.

Explanation

Limiting lateral movement requires enforcing least-privilege policy between zones so a compromised branch device can reach only the specific data center services it needs. Bandwidth, jumbo frames, and ISP redundancy address performance and availability, not containment. The requirement should be written as an enforceable inter-zone policy.

Question 21Customer Network Design Requirements

A customer wants a single policy model applied to both on-premises SRX enforcement and cloud-delivered security for remote users. Which design consideration is most important when documenting this requirement?

  1. Whether the cloud service supports the same MTU as the on-premises links
  2. Whether the remote users have the same ISP as the branch offices
  3. Whether the branch switches support the same spanning-tree mode as the data center
  4. Whether a common policy framework and centralized management can express equivalent intent across both enforcement points Correct answer.

Explanation

Unified policy across on-premises and cloud enforcement depends on a common policy framework and centralized management that can express equivalent intent at each point. ISP, MTU, and spanning-tree details matter for connectivity but do not determine whether one policy model can be applied consistently. The requirement should be validated against the management tooling's capabilities.

Question 22Customer Network Design Requirements

A customer requires that security events from branch sites be retained for one year and be searchable during an investigation. Which design decision best satisfies this without overloading branch devices?

  1. Reduce event generation by disabling logging of denied traffic at the branch
  2. Increase local storage on each branch device to hold a full year of events
  3. Store events only on removable media collected during audits
  4. Stream events to a central retention and search platform sized for one year of data Correct answer.

Explanation

Long retention plus searchability is best met by streaming events to a central platform sized for the retention period, keeping branch devices focused on forwarding. Local storage on each device is costly and hard to search across sites, and disabling denied-traffic logging removes valuable investigation data. Removable media does not provide timely search.

Question 23Customer Network Design Requirements

A customer wants to adopt zero-trust principles for internal application access. Which requirement statement is most consistent with that goal?

  1. Devices are trusted permanently once they pass a one-time onboarding check
  2. Users on the corporate VLAN are trusted to reach all internal applications
  3. Access is granted based on the source IP subnet of the request
  4. Access to each application is granted per user and device after continuous verification, regardless of network location Correct answer.

Explanation

Zero trust grants access per application based on verified user and device identity and posture, evaluated continuously rather than from network location. Trusting a VLAN, a source subnet, or a one-time check reintroduces implicit trust. The requirement should be phrased so it can be tested against the access design.

Question 24Customer Network Design Requirements

A customer with strict data-residency rules asks where security telemetry will be processed. Which design consideration should be documented before selecting a cloud-delivered security service?

  1. The vendor's market share in the customer's industry
  2. The regions in which the service stores and processes telemetry and whether they meet the residency policy Correct answer.
  3. The color scheme of the management dashboard
  4. The number of branch sites that will forward telemetry

Explanation

Data-residency requirements are met only if the service's storage and processing regions align with policy, so those regions must be confirmed and documented. Site count, vendor market share, and interface appearance do not address where data resides. This is a gating requirement that can eliminate otherwise suitable services.

Question 25Customer Network Design Requirements

A customer requires that a compromised IoT device be unable to reach the internet except to a vendor update service, while still allowing local device management from an approved subnet. Which policy design meets this requirement?

  1. Permit all traffic from the IoT segment and rely on the devices' own firewalls
  2. Permit all internet access from the IoT segment and block the management subnet
  3. Deny all traffic from the IoT segment, including the vendor update service
  4. Default deny from the IoT segment, with permits only to the vendor update service and from the management subnet Correct answer.

Explanation

The requirement is satisfied by a default-deny posture on the IoT segment with narrow permits: outbound to the vendor update service and inbound from the approved management subnet. Permitting all internet access or all traffic violates the containment goal, while denying everything also blocks the required update and management flows.

Question 26Customer Network Design Requirements

A retail customer states that its 300 stores currently use a single flat internal VLAN for point-of-sale terminals, staff laptops, and guest Wi-Fi, and that PCI auditors have flagged this. Which requirement statement should the designer capture to drive segmentation of the branch network?

  1. The branch firewall must log all traffic for a minimum of 30 days for audit purposes
  2. Cardholder-data systems must be isolated from other branch traffic by policy-enforced segments with no direct path between them Correct answer.
  3. Guest Wi-Fi must be delivered from the same SSID as staff connectivity to simplify onboarding
  4. All branch traffic must be encrypted with IPsec between the access switch and the distribution switch

Explanation

PCI DSS scoping requires that systems that store, process, or transmit cardholder data sit in a segmented zone, with controls restricting traffic into and out of that zone. The requirement statement must therefore express enforced separation, not just logging or encryption of transport. Logging and transport encryption are supporting controls but do not satisfy the segmentation obligation on their own.

Question 27Customer Network Design Requirements

During requirements gathering a customer says its security operations team is overwhelmed by alerts and cannot tell which ones matter. Which requirement statement best translates this into a design input?

  1. The customer must purchase additional analyst headcount before the design is signed off
  2. The network must block all inbound traffic from the internet at every branch firewall
  3. Every firewall session must generate a syslog message sent to the operations team's email distribution list
  4. Security events must be correlated and risk-ranked so that the team receives prioritized incidents rather than raw alerts Correct answer.

Explanation

The stated pain is alert volume without prioritization, so the design input should be a requirement for correlation and risk-based ranking that reduces noise into actionable incidents. That is a capability the architecture must deliver. The other options either increase noise or address unrelated concerns.

Question 28Customer Network Design Requirements

A customer asks the designer to document which regulatory obligation most directly requires protecting the confidentiality of personal data moving between its campus and data center. Which requirement should be recorded?

  1. Wireless access points must broadcast at the maximum permitted transmit power
  2. The data center must run the same Junos version as the campus core
  3. The campus network must use redundant power supplies in all wiring closets
  4. Traffic carrying personal data between campus and data center must be encrypted in transit with strong ciphers Correct answer.

Explanation

Confidentiality of personal data in transit is addressed by encryption of the traffic between sites, which is the requirement a designer records and later maps to IPsec or equivalent. The other items describe availability, operational consistency, or RF coverage, none of which protect data confidentiality.

Question 29Customer Network Design Requirements

A hospital customer states that clinical staff must reach patient records from any campus building, but that contractors on the same wireless infrastructure must never reach those records. Which requirement statement captures this correctly?

  1. Contractors must be issued laptops that are physically unable to join the corporate wireless network
  2. The patient-records application must be reachable only from the building where the server is installed
  3. Each building must have its own separate patient-records server so contractors cannot find the address
  4. Access to the patient-records application must be granted per user identity and role, independent of which building or SSID the user connects from Correct answer.

Explanation

The customer needs location-independent access for staff while denying contractors, which is an identity- and role-based authorization requirement rather than a network-location restriction. Expressing it as per-user policy allows the design to use 802.1X, group mapping, and firewall policy consistently across buildings. Location-based or device-based workarounds do not express the actual business intent.

Question 30Customer Network Design Requirements

A customer's legal team requires that security logs for its European sites remain within the European Union. Which requirement should the designer document before selecting logging and analytics components?

  1. Security logs must be deleted within 24 hours of being generated in every region
  2. Security telemetry generated in EU sites must be stored and processed only in EU-based infrastructure Correct answer.
  3. Security logs must be written to the local firewall flash and never exported
  4. All security telemetry from every region must be consolidated in the vendor's global cloud

Explanation

A data-residency obligation becomes a requirement that telemetry be stored and processed in an approved geography, which then constrains where collectors, managers, and cloud services may be hosted. Consolidating globally or deleting logs quickly conflicts with the legal instruction. The requirement must be captured before product selection so residency can actually be met.

Question 31Customer Network Design Requirements

A logistics customer wants to know how much inspection throughput each branch firewall must provide. Which customer input is most directly needed to size that requirement?

  1. The number of rack units available in each branch wiring closet
  2. The brand of access switches already deployed at the branches
  3. The projected peak concurrent session count and expected inspected throughput per branch Correct answer.
  4. The number of wireless access points planned per branch

Explanation

Firewall sizing is driven by throughput and session capacity under peak load, including the performance penalty of enabling inspection features. Rack space, switch brand, and access point counts affect physical and LAN design but do not determine inspection capacity. Capturing peak sessions and inspected throughput turns a vague wish into a measurable requirement.

Question 32Customer Network Design Requirements

A customer says that if its primary data center loses power, the security controls protecting the secondary site must continue to enforce the same policy without manual intervention. Which requirement statement is most precise?

  1. The secondary site must contain a spare firewall that can be configured by an engineer after a failure occurs
  2. The secondary site must be able to run without any security enforcement during a failover window
  3. The primary and secondary sites must use firewalls from the same hardware model family
  4. Security policy enforcement must remain active at the secondary site with the same rule set during a primary-site outage, without operator action Correct answer.

Explanation

The requirement combines three testable elements: continued enforcement, policy consistency, and no manual intervention during the outage. That phrasing lets the designer choose a configuration-synchronized HA or centrally managed policy model and later verify it. The alternatives weaken one of those elements, such as requiring manual configuration or dropping enforcement.

Question 33Customer Network Design Requirements

A customer with a small IT team states that it cannot investigate every alert and wants the design to reduce the number of decisions its staff must make. Which requirement pair should the designer capture to guide the choice between manual policy tuning and automated policy recommendation?

  1. The design must automatically apply every recommended policy change without any review step
  2. The design must forward every raw log to staff and require them to build detection rules from scratch
  3. The design must eliminate all logging so that staff have nothing to review
  4. The design must surface only high-confidence actionable events and must let staff approve or reject recommended policy changes Correct answer.

Explanation

A team with limited capacity needs both noise reduction and a human decision point, so the requirement should pair actionable-event surfacing with an approval workflow. This preserves accountability while reducing workload. Removing logging or auto-applying changes without review would create either blindness or uncontrolled risk.

Question 34Customer Network Design Requirements

A customer's security policy requires that users on the corporate wireless LAN reach internal applications through an identity-aware proxy, while users on the same WLAN must reach the public internet directly. Which requirement statement should be recorded for the design?

  1. The corporate WLAN must be split into two SSIDs, one for applications and one for internet access
  2. All wireless users must be forced through the data center for every flow, including public internet browsing
  3. Application access must be brokered per user identity regardless of network location, while general internet browsing follows the local egress path Correct answer.
  4. Internal applications must be published directly to the internet so users can reach them without a proxy

Explanation

The customer's intent is identity-based brokering for internal applications while allowing direct internet egress, so the requirement must distinguish application access from general browsing. That separation lets the designer place the proxy for application traffic without backhauling all internet flows. The alternatives either over-centralize traffic or expose applications in a way the policy forbids.

Question 35Securing the Network

Which Juniper security feature enforces security policy on traffic that stays inside the same VLAN and never crosses a routing boundary?

  1. IPsec tunnel policy applied to the tunnel interface
  2. Stateful zone-based firewall policy on the SRX
  3. NAT source translation applied to the ingress interface
  4. Microsegmentation with a Juniper Connected Security policy on the switch Correct answer.

Explanation

Intra-VLAN traffic is switched locally and never reaches a routing device, so zone-based SRX policies cannot see it. Juniper Connected Security extends policy enforcement to the switch port level so east-west traffic between hosts in one subnet can be filtered.

Question 36Securing the Network

In an SRX zone configuration, which statement correctly describes the default behavior of traffic between two different security zones?

  1. It is always dropped regardless of policy configuration
  2. It is permitted only when both zones are in the same virtual router
  3. It is permitted only if an explicit policy allows it Correct answer.
  4. It is permitted by default and blocked only by explicit deny policies

Explanation

The SRX is a deny-by-default device: inter-zone traffic requires an explicit permit policy to pass. There is no implicit permit between zones, and a deny policy is only needed to override a broader permit.

Question 37Securing the Network

You must allow only HTTPS from the untrust zone to a specific server in the trust zone while keeping all other untrust-to-trust traffic blocked. What is the minimum correct configuration approach on the SRX?

  1. Create a permit policy from trust to untrust matching destination port 443
  2. Apply a firewall filter to the untrust interface that discards port 443
  3. Create a permit policy from untrust to trust matching the server address and destination port 443 Correct answer.
  4. Disable the implicit deny by setting the zone default policy to permit

Explanation

Security policy is directional and matches on zone pair plus addresses and ports, so the permit must be written from the source zone (untrust) to the destination zone (trust). The implicit deny then blocks everything not explicitly matched.

Question 38Securing the Network

Which Juniper feature lets an SRX consume dynamically published threat intelligence feeds and block traffic to known malicious IP addresses without manual policy edits?

  1. Junos Threat Intelligence with dynamic address groups Correct answer.
  2. Unified Threat Management content security profiles
  3. Class of service schedulers on the untrust interface
  4. Virtual Router Redundancy Protocol failover

Explanation

Junos Threat Intelligence feeds populate dynamic address entries that security policies reference, so newly published bad addresses are blocked automatically. This is distinct from content security profiles, which inspect payloads rather than address reputation.

Question 39Securing the Network

An SRX cluster uses chassis cluster redundancy groups. Which statement best explains how the control plane and data plane roles are separated?

  1. One node is primary for both planes, and the other becomes primary only after failover Correct answer.
  2. Redundancy group 0 typically carries the control plane while other groups carry data plane interfaces
  3. Both nodes actively forward data plane traffic for the same redundancy group simultaneously
  4. The control plane runs on both nodes while the data plane is disabled on the backup

Explanation

In a chassis cluster one node holds the primary role for a redundancy group and forwards traffic, while the peer is backup and does not forward for that group. Redundancy group 0 typically carries the control plane, and separate groups can fail over independently.

Question 40Securing the Network

Which statement accurately describes how IPsec ESP protects traffic between two SRX devices?

  1. ESP encrypts the payload but cannot provide integrity checking
  2. ESP encrypts the payload and can authenticate it, but does not encrypt the outer IP header Correct answer.
  3. ESP provides authentication only and never encrypts the payload
  4. ESP encrypts both the payload and the outer IP header

Explanation

ESP in tunnel mode encrypts and authenticates the inner packet while the outer IP header remains visible for routing. Integrity is provided by the ESP authentication field, so ESP does offer both confidentiality and integrity.

Question 41Securing the Network

A site-to-site VPN uses IKEv2. Which combination correctly identifies the two phases of IKE negotiation?

  1. Phase 1 exchanges routing updates; phase 2 negotiates encryption algorithms
  2. Phase 1 establishes the IPsec SA; phase 2 establishes the IKE SA
  3. Phase 1 establishes the IKE SA; phase 2 establishes the IPsec SA Correct answer.
  4. Phase 1 performs NAT traversal; phase 2 performs dead peer detection

Explanation

IKE phase 1 builds a secure channel (the IKE SA) used to authenticate peers and protect further negotiation. Phase 2 then negotiates the IPsec SAs that protect actual user traffic.

Question 42Securing the Network

Which Juniper feature provides a stateful, host-based security enforcement point that can be managed alongside SRX policies in a centralized model?

  1. Junos Space Security Director managing SRX and vSRX instances Correct answer.
  2. BGP flow specification on the border router
  3. Ethernet switching storm control on an access port
  4. Junos OS firewall filters applied to a loopback interface

Explanation

Security Director provides centralized policy management across SRX and virtual SRX instances, giving consistent stateful enforcement. Firewall filters are stateless, and storm control or flow specification address different problems.

Question 43Securing the Network

You must protect an SRX management interface so that only SSH from a single administrative subnet is accepted. Which mechanism is the most appropriate?

  1. A firewall filter applied to the loopback or management interface permitting only that subnet to port 22 Correct answer.
  2. A security policy from the untrust zone to the trust zone permitting port 22
  3. A NAT rule translating the management address to a public address
  4. A CoS classifier marking SSH traffic as network control

Explanation

Traffic destined to the device itself is handled by host-inbound protection, most commonly a firewall filter on the loopback or management interface. A zone-to-zone policy governs transit traffic, not traffic addressed to the device.

Question 44Securing the Network

What is the primary security purpose of applying a screen configuration on an SRX zone?

  1. To log session summaries for compliance reporting
  2. To detect and mitigate flood, scan, and malformed packet attacks against the device Correct answer.
  3. To translate private addresses to public addresses
  4. To encrypt traffic between zones using IPsec

Explanation

Screens are a set of denial-of-service and anomaly checks, such as SYN flood protection and port scan detection, applied per zone. They protect the device and network from abusive traffic patterns rather than encrypting or translating.

Question 45Securing the Network

An SRX policy uses application services with UTM. Which statement best describes the order of operations for inspected traffic?

  1. Session match and policy lookup occur first, then UTM inspection is applied to permitted sessions Correct answer.
  2. UTM inspection occurs only after NAT translation is disabled
  3. UTM inspection replaces the security policy lookup entirely
  4. UTM inspection occurs before session lookup so all packets are scanned

Explanation

The SRX first creates a session and matches policy; UTM inspection is attached to the permitted session and applied to its traffic. UTM does not bypass or replace policy lookup.

Question 46Securing the Network

Which statement correctly distinguishes a stateless firewall filter from a stateful security policy on the SRX?

  1. Both track session state but only filters support logging
  2. Both evaluate packets independently but only policies support counters
  3. A firewall filter evaluates each packet independently, while a security policy tracks session state Correct answer.
  4. A firewall filter tracks session state, while a security policy evaluates each packet independently

Explanation

Firewall filters are stateless ACLs that match each packet on its own headers, so return traffic needs its own term. Security policies are stateful: the SRX creates a session and automatically permits return traffic for established flows.

Question 47Securing the Network

What does the Juniper Sky ATP cloud service primarily add to SRX enforcement?

  1. Layer 2 loop prevention for switching
  2. Hardware acceleration for IPsec encryption
  3. Dynamic routing convergence for OSPF
  4. Cloud-based malware detection and threat intelligence for files and command-and-control traffic Correct answer.

Explanation

Sky ATP offloads file analysis and reputation lookups to the cloud and feeds verdicts back to the SRX for enforcement. It is a threat detection service, not an encryption, switching, or routing feature.

Question 48Securing the Network

An administrator wants outbound web traffic from the trust zone to be inspected with SSL forward proxy so encrypted sessions can be examined. Which requirement must be met for this to work?

  1. A certificate must be generated on the SRX and its CA certificate distributed to client devices Correct answer.
  2. The untrust zone must be configured as a Layer 2 zone
  3. The SRX must be configured as a transparent bridge with no IP address
  4. All client devices must use a static ARP entry pointing to the SRX

Explanation

SSL forward proxy terminates the client TLS session with an SRX-generated certificate, so clients must trust the SRX CA. Without that trust distribution, clients will see certificate warnings and inspection fails.

Question 49Securing the Network

Which Juniper solution enforces policy at the switch port to block lateral movement between workloads on the same Layer 2 segment?

  1. SRX zone-based policy applied to the IRB interface
  2. MACsec on the uplink between switches
  3. IPsec tunnel between the two workloads
  4. Juniper Connected Security with policy enforcement on EX and QFX switches Correct answer.

Explanation

Juniper Connected Security pushes security policy down to the switching layer so traffic that never leaves the segment can still be filtered. SRX zone policy only sees traffic that is routed, and MACsec provides link encryption rather than host-to-host policy.

Question 50Securing the Network

Which statement about Juniper ATP Cloud and encrypted traffic inspection is accurate?

  1. Encrypted traffic can be inspected when SSL proxy is enabled so that files can be submitted for analysis Correct answer.
  2. ATP Cloud inspection requires disabling all UTM profiles
  3. ATP Cloud decrypts traffic without any certificate configuration on clients
  4. ATP Cloud can only analyze unencrypted HTTP traffic

Explanation

To analyze files inside TLS sessions, the SRX must decrypt them using SSL proxy before submission to the cloud service. ATP Cloud itself does not bypass the need for client trust in the proxy certificate.