I85PREP
⌘ K
JNCDS-WAN study materials
JNCDS-WAN study resources

JNCDS-WAN practice questions

One question at a time. Build your JNCDS-WAN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Customer Network Design Requirements

An enterprise is beginning a WAN redesign and has not yet documented its business drivers or existing traffic flows. Which activity should the design team perform first?

  1. Select a routing protocol and configure it on every existing WAN router before gathering requirements
  2. Deploy QoS policies for real-time applications across all sites before assessing current traffic
  3. Elicit business drivers, constraints, and current traffic flows from stakeholders Correct answer.
  4. Issue a request for proposal to multiple WAN transport providers before understanding business needs

Explanation

WAN design starts with requirements discovery: business drivers, technical constraints, existing traffic flows, and success criteria. Transport, routing, and QoS decisions are made only after those inputs are understood, so selecting tools first would be premature.

Question 2Customer Network Design Requirements

A customer states that if any single WAN circuit fails, branch voice calls must continue without interruption. Which category of design requirement does this statement define?

  1. Scalability requirement
  2. Security requirement
  3. Operational support requirement
  4. Availability requirement Correct answer.

Explanation

Availability requirements define how long a service can be down and how failures are tolerated. A statement that voice calls must survive any single circuit failure is a resiliency or availability objective, not a scalability or security goal.

Question 3Customer Network Design Requirements

Which document defines the measurable service levels-such as availability, latency, and restoration time-that a WAN provider commits to for a customer?

  1. Non-disclosure agreement (NDA)
  2. Service level agreement (SLA) Correct answer.
  3. Statement of work (SOW)
  4. Method of procedure (MOP)

Explanation

An SLA is the contractual vehicle for measurable service commitments such as availability, latency, jitter, and restoration time. A SOW describes work to be performed, an NDA protects confidential information, and a MOP describes operational steps.

Question 4Customer Network Design Requirements

A branch site currently peaks at 30 Mbps during the business day, and the customer forecasts 50 percent traffic growth per year for the next three years. Which input is most appropriate for sizing the branch WAN circuit?

  1. The lowest observed utilization to minimize recurring cost
  2. The provider's maximum circuit size, regardless of measured demand
  3. The current average utilization, because peak traffic is transient
  4. The current peak plus headroom for three years of forecast growth Correct answer.

Explanation

Capacity planning should size links from observed peak demand plus an allowance for forecast growth, not from averages or minimums. Using averages risks congestion during busy hours, while choosing the largest circuit ignores cost and actual need.

Question 5Customer Network Design Requirements

A customer plans to introduce SD-WAN at 100 branches while retaining MPLS for latency-sensitive voice during a two-year transition. Which requirement should be documented before selecting the SD-WAN architecture?

  1. The final decommission date for every legacy router at all branch sites
  2. The desktop operating system version used by branch employees
  3. The number of wireless access points installed at headquarters
  4. Coexistence and phased migration between MPLS and SD-WAN Correct answer.

Explanation

During a hybrid migration, the design must support both transport environments, define which traffic uses each path, and sequence the transition without disrupting voice. Coexistence, policy, and migration phasing are therefore core requirements before architecture selection.

Question 6Customer Network Design Requirements

During requirements workshops, the security team insists that all internet-bound branch traffic be backhauled to headquarters, while the application team wants direct internet access for cloud SaaS. What should the designer do next?

  1. Deploy both designs at randomly selected sites and let end users decide which traffic path to use in production
  2. Select centralized backhaul immediately because the security team's requirement always overrides application performance concerns
  3. Select direct internet access immediately because SaaS performance is always the most important business requirement
  4. Document both requirements and quantify security, performance, and business trade-offs Correct answer.

Explanation

Conflicting stakeholder requirements must be made explicit and evaluated against business, security, and performance criteria. Documenting both positions and quantifying trade-offs lets the customer make an informed decision rather than letting one team impose an unvalidated design.

Question 7Customer Network Design Requirements

A payment processor must keep cardholder data off public internet links and isolate it from general business traffic. Which WAN design requirement does this primarily impose?

  1. Multicast routing support for real-time market data feeds across all branch sites
  2. IPv6 address planning for guest wireless users
  3. Higher DNS zone transfer frequency between branches
  4. Segmentation and compliant transport for sensitive traffic Correct answer.

Explanation

Regulatory or contractual data-handling rules translate into segmentation, encryption, and transport-selection requirements. Cardholder data must be separated from general traffic and kept off public links unless the compliance scope explicitly permits otherwise.

Question 8Customer Network Design Requirements

A customer says the new WAN must be 'highly available' but provides no numeric target. Which action best converts this into a design requirement?

  1. Exclude availability from the design because it cannot be guaranteed
  2. Order two circuits from the same service provider for every branch site and assume the availability requirement is satisfied
  3. Assume 99.999 percent availability because it is the industry maximum
  4. Define measurable availability, outage tolerance, and recovery objectives per site class with the customer Correct answer.

Explanation

Vague terms like 'highly available' are not designable until they are expressed as measurable objectives, such as availability percentage, maximum outage duration, and recovery time by site class. The designer should facilitate that definition rather than assume a target or declare the requirement unachievable.

Question 9Customer Network Design Requirements

A media company wants real-time video collaboration among 30 sites and centralized call control. The business requires no more than 150 ms one-way latency between any two participating sites. Which design input most directly determines the viable WAN topology and transport choices?

  1. The count of printers attached to each branch LAN
  2. The preferred color scheme for the network operations dashboard
  3. The latency budget and any-to-any traffic matrix among the 30 sites Correct answer.
  4. The number of email users at each site

Explanation

A strict end-to-end latency target constrains transport distance, topology, and path selection, especially when every site may communicate with every other site. The any-to-any traffic matrix shows which flows need direct paths and which can remain centralized.

Question 10Customer Network Design Requirements

An enterprise is adding a second WAN provider to its existing OSPF-based MPLS network and will use BGP at the provider edge. Which requirement area must be analyzed to prevent asymmetric routing and inconsistent path selection?

  1. The choice of SNMP community strings
  2. Routing interoperability, policy, and path-selection requirements between the two providers Correct answer.
  3. Physical cabling standards for the data center
  4. The power budget of the branch UPS systems

Explanation

Mixing OSPF and BGP across two providers introduces policy, redistribution, and path-selection interactions that can cause asymmetric routing. The design requirements must define route preference, failover behavior, and administrative boundaries before the providers are interconnected.

Question 11Customer Network Design Requirements

A customer's WAN design brief states: "The new WAN must deliver no more than 150 ms round-trip latency between any branch and the data center for SAP GUI sessions." How should this statement be classified in the requirements document?

  1. A business constraint that limits the project budget
  2. An assumption about carrier performance
  3. A non-functional performance requirement Correct answer.
  4. A functional requirement for SAP licensing

Explanation

A latency ceiling is a measurable service-performance target, so it belongs in the non-functional requirements. It constrains how the WAN must perform rather than describing a budget limit or an assumption about a carrier.

Question 12Customer Network Design Requirements

Which statement is a design constraint rather than a design requirement?

  1. All WAN traffic must be encrypted with IPsec.
  2. Only one fiber provider serves the branch site. Correct answer.
  3. Voice calls must continue during a single WAN link failure.
  4. The branch must support 300 Mbps of business traffic at peak.

Explanation

A constraint is an external limitation the design cannot change, such as a single available fiber provider. The other statements describe capabilities the customer wants the WAN to deliver.

Question 13Customer Network Design Requirements

Why is an application inventory a core input to a WAN design?

  1. It maps applications to their performance and availability needs. Correct answer.
  2. It records the hardware serial numbers of every WAN edge router and circuit.
  3. It defines the routing protocol that providers must use between autonomous systems.
  4. It replaces the need for a site profile.

Explanation

The application inventory links each business application to its traffic profile, latency sensitivity, and availability needs. That mapping drives QoS, circuit sizing, and redundancy decisions.

Question 14Customer Network Design Requirements

A retail customer supplies only average monthly bandwidth per store and asks the designer to size WAN circuits. Which follow-up request best closes the capacity requirement gap?

  1. Provide the carrier contract term for each store.
  2. Provide the router model installed at each store.
  3. Provide busy-hour and 95th-percentile utilization per store. Correct answer.
  4. Provide the number of wireless access points and controllers installed at each store.

Explanation

Monthly averages hide busy-hour peaks that determine circuit sizing and QoS. The designer should request peak and 95th-percentile utilization so the requirement reflects actual load.

Question 15Customer Network Design Requirements

A European manufacturer requires that personal data from EU branches never leave the EU while in transit. Which WAN design requirement should be documented?

  1. An SNMP polling interval for branch routers.
  2. A BGP community scheme for route summarization and path selection across providers.
  3. A data-residency constraint on which countries may carry or host the traffic. Correct answer.
  4. A QoS marking standard for voice traffic.

Explanation

Data-residency rules restrict where regulated data may be carried or stored, which can eliminate some carriers or cloud gateways. QoS, BGP, and SNMP settings do not address legal location limits.

Question 16Customer Network Design Requirements

A customer states that order-entry transactions must be restored within 15 minutes of a WAN outage and that no more than 5 minutes of transactions may be lost. Which requirements are being specified?

  1. A 15-minute RTO and a 5-minute RPO. Correct answer.
  2. A 15-minute latency budget and a 5-minute jitter budget.
  3. A 15-minute RPO and a 5-minute RTO.
  4. A 15-minute MTTR and a 5-minute SLA.

Explanation

Recovery time objective (RTO) is the maximum acceptable outage duration, here 15 minutes. Recovery point objective (RPO) is the maximum acceptable data loss, here 5 minutes.

Question 17Customer Network Design Requirements

When creating site profiles for 80 branches, which attribute most directly affects whether the design should include redundant WAN edge routers at a site?

  1. Independent power feeds and rack space for redundant CPE. Correct answer.
  2. The carrier's billing cycle for the existing circuit.
  3. The number of printers and scanners in use at the site.
  4. The number of SSIDs configured on the branch wireless LAN and guest network.

Explanation

Redundant WAN edge routers require independent power and physical space; without them, a second router adds little resilience. Printer counts, SSIDs, and billing cycles do not determine CPE redundancy.

Question 18Customer Network Design Requirements

The business asks for the lowest-cost WAN, security requires dedicated encryption hardware at every site, and finance has capped capital spending. Which action is the best first step for the WAN designer?

  1. Document the conflict and present costed options to stakeholders. Correct answer.
  2. Remove the encryption requirement because finance owns the budget.
  3. Select the lowest-cost carrier and defer the encryption requirement.
  4. Buy the encryption hardware and exceed the capital cap.

Explanation

The requirements conflict, so the designer should not silently drop security or exceed the budget. Documenting the conflict and presenting costed options lets accountable stakeholders choose and approve trade-offs.

Question 19Customer Network Design Requirements

A design requirement states that branch guest Wi-Fi must not degrade business traffic. Which acceptance criterion makes this requirement testable?

  1. Guest Wi-Fi must have a password that changes every 90 days.
  2. Under busy-hour load, guest traffic must be shaped so business application latency meets its SLA. Correct answer.
  3. Guest Wi-Fi must use a separate SSID from business Wi-Fi.
  4. Guest traffic must be placed in a dedicated VLAN at each branch, with no routing to business subnets.

Explanation

A testable acceptance criterion must define a measurable condition and a pass threshold. Rate-limiting guest traffic under busy-hour load and verifying business latency within SLA proves the requirement; the other options are design choices.

Question 20Customer Network Design Requirements

An enterprise is issuing an RFP for managed WAN services across 60 countries. Which requirement should be specified so that provider bids can be compared consistently?

  1. Per-site service levels, reporting granularity, and restoration commitments. Correct answer.
  2. The CLI version used on the provider's core routers.
  3. The names of the provider's account executives.
  4. The provider's internal ticket tool brand names.

Explanation

Comparable bids require the same measurable service commitments, reporting detail, and restoration terms from every provider. Internal tool names, CLI versions, and personnel names do not affect the service being priced.

Question 21Customer Network Design Requirements

Which statement is a non-functional WAN requirement?

  1. The WAN must use dual routers at each regional hub.
  2. The WAN must provide 99.95% monthly availability. Correct answer.
  3. The WAN must support OSPFv3 between provider and customer edge routers.
  4. The WAN must connect 40 retail stores to headquarters.

Explanation

Non-functional requirements describe quality attributes and constraints, such as availability, latency, throughput, and security, rather than specific connectivity or protocol functions. A 99.95% monthly availability target is a measurable service-quality requirement that can be tested against an SLA.

Question 22Customer Network Design Requirements

Which availability metric is defined as the average time between failures of a repairable system?

  1. RTO
  2. MTBF Correct answer.
  3. RPO
  4. MTTR

Explanation

MTBF is the average operating time between failures for a repairable system and is used to express reliability. MTTR measures repair time, while RTO and RPO are recovery objectives.

Question 23Customer Network Design Requirements

A WAN SLA offers 99.95% availability. Using a 30-day month, what is the maximum allowed downtime?

  1. About 43.2 minutes
  2. About 2.2 minutes
  3. About 21.6 minutes Correct answer.
  4. About 4.3 minutes

Explanation

A 30-day month contains 43,200 minutes. At 99.95% availability, the unavailable portion is 0.05%, which equals about 21.6 minutes.

Question 24Customer Network Design Requirements

A traffic matrix shows that 85% of branch-to-branch traffic is destined for applications hosted in the headquarters data center. Which WAN topology requirement does this most directly support?

  1. An internet-only direct branch peering topology
  2. A hub-and-spoke topology centered on the headquarters data center Correct answer.
  3. A partial-mesh topology between selected branch pairs
  4. A full-mesh topology connecting every branch directly to every other branch

Explanation

A traffic matrix that shows most branch-to-branch traffic going to the headquarters data center supports a hub-and-spoke topology. Full or partial mesh adds circuit cost and complexity for flows that are not actually peer-to-peer.

Question 25Customer Network Design Requirements

Which customer requirement most directly justifies evaluating WAN optimization or compression in the design?

  1. Large CAD files are transferred between design centers several times daily. Correct answer.
  2. Guest Wi-Fi traffic must be separated from business traffic at every branch.
  3. Branch voice calls must be placed in a strict priority queue across the WAN.
  4. Every branch must maintain a single IPsec tunnel to the headquarters firewall.

Explanation

WAN optimization, compression, and deduplication are most valuable when the same large files or repetitive data cross the WAN repeatedly. Real-time voice, guest segmentation, and tunnel count are handled by QoS, segmentation, and encryption designs instead.

Question 26Customer Network Design Requirements

A security policy states that no branch traffic may cross a public network without confidentiality protection. Which design requirement should be captured?

  1. All branch traffic must be backhauled to headquarters before reaching the internet.
  2. All WAN traffic must be encrypted with IPsec or an equivalent tunnel. Correct answer.
  3. All branch traffic must be rate-limited at the WAN edge.
  4. All branch traffic must be routed with BGP to the nearest provider.

Explanation

Confidentiality over public networks is a security requirement that must be written as a testable design statement. Requiring IPsec or an equivalent encrypted tunnel directly addresses that policy.

Question 27Customer Network Design Requirements

A customer asks for 99.99% availability from a single MPLS circuit at a branch. Which statement best explains why this cannot be accepted as a design requirement without qualification?

  1. 99.99% availability applies only to internet circuits, not MPLS.
  2. Four-nines availability can only be achieved by running BGP at the branch.
  3. A single circuit and provider handoff create a single point of failure. Correct answer.
  4. MPLS providers do not offer availability service-level agreements.

Explanation

End-to-end availability includes the customer edge router, local loop, provider handoff, and provider network. A single circuit lacks path redundancy, so a four-nines target cannot be guaranteed even if the provider's core SLA is high.

Question 28Customer Network Design Requirements

A voice requirement specifies no more than 0.1% packet loss in any five-minute window. Which design element is most directly justified by this requirement?

  1. A larger BGP community policy on the WAN edge
  2. A strict priority queue for voice with admission control Correct answer.
  3. A full-mesh IPsec topology between all branches
  4. A longer DHCP lease time for voice handsets

Explanation

Real-time voice is sensitive to packet loss and delay, so the design needs QoS with a strict priority queue and admission control to prevent congestion. BGP policy, IPsec mesh, and DHCP lease timers do not directly control voice packet loss.

Question 29Customer Network Design Requirements

Which site-profile attribute best indicates a location's tolerance for a WAN outage?

  1. The site's VLAN numbering scheme
  2. The site's physical street address
  3. The number of access switches at the site
  4. The site's business criticality tier Correct answer.

Explanation

Business criticality tiers capture how much downtime a site can tolerate and therefore drive redundancy, circuit diversity, and failover design. Physical and VLAN attributes are inventory details, not availability drivers.

Question 30Customer Network Design Requirements

Why should a designer maintain a requirements traceability matrix throughout a WAN project?

  1. To assign IP addresses to branch devices
  2. To document router command syntax for operations
  3. To map design decisions and tests back to agreed requirements Correct answer.
  4. To replace the need for a bill of materials

Explanation

A requirements traceability matrix links each requirement to its source stakeholder, design element, and acceptance test. It prevents scope drift and shows that the design and test plan cover every agreed requirement.

Question 31Customer Network Design Requirements

A customer states that the new WAN must be "fast and reliable." Which action best turns that statement into a usable design requirement?

  1. Select the carrier that advertises the lowest latency in the region.
  2. Add a second circuit at every branch to improve reliability.
  3. Elicit measurable latency, loss, and availability targets per application class. Correct answer.
  4. Deploy WAN optimization appliances at all larger sites.

Explanation

Fast and reliable are subjective adjectives, so no design or acceptance test can prove them. A designer must elicit measurable targets such as maximum latency, packet loss, jitter, and availability for each application class or site tier. Technology and carrier choices should follow those agreed targets, not precede them.

Question 32Customer Network Design Requirements

Which statement is written as a testable WAN requirement?

  1. The WAN must minimize outages and restore service quickly.
  2. The WAN must be at least as reliable as the current MPLS network during normal business operations.
  3. Each branch must meet 99.95% monthly availability at the CPE LAN interface. Correct answer.
  4. The WAN should be highly available and resilient during business hours.

Explanation

A testable requirement states a metric, the measurement point, and the time window. "99.95% monthly availability at each branch, measured at the CPE LAN interface" gives all three, so acceptance can be verified objectively. The other statements use comparative or subjective language that cannot be measured consistently.

Question 33Customer Network Design Requirements

A retailer requires that branch stores continue processing card payments even if the headquarters data center loses all WAN connectivity. Which design requirement most directly follows?

  1. Increase the bandwidth of the headquarters MPLS circuits to handle peak payment volumes.
  2. Add a second headquarters firewall in an active-standby pair to remove a single point of failure.
  3. Provide a local survivable path for payment traffic at each branch. Correct answer.
  4. Apply QoS marking to payment traffic across the headquarters WAN.

Explanation

If the branch payment path depends on the headquarters data center, a headquarters WAN loss stops payments. The requirement therefore calls for a local survivable path, such as local internet breakout to the payment provider, so the branch can continue operating during a headquarters outage. Additional headquarters capacity or QoS does not remove that dependency.

Question 34Customer Network Design Requirements

A customer requires that all branch internet traffic be inspected by a firewall in the headquarters data center, but also requires low-latency direct access to Microsoft 365. Which analysis best describes the design tension?

  1. The tension is resolved by adding more bandwidth to the headquarters internet circuit and applying QoS to Microsoft 365 traffic.
  2. Central inspection hairpins SaaS traffic through headquarters, conflicting with local direct-access latency; evaluate a cloud security broker or local egress. Correct answer.
  3. The two requirements are compatible because Microsoft 365 traffic can be prioritized with QoS on the headquarters WAN, which preserves the low-latency experience for users.
  4. The direct-access requirement should be rejected because security inspection always takes precedence over latency for branch internet traffic.

Explanation

Backhauling all branch internet traffic to a headquarters firewall creates hairpinning, which adds latency and backhaul load for SaaS traffic. A direct-access requirement conflicts with that path unless inspection is moved closer to the branch, for example with a cloud security broker or local egress and centralized policy. QoS or extra bandwidth does not remove the physical detour through headquarters.

Question 35Securing the Network

In a Juniper SRX IPsec VPN design, which security association pair is negotiated by IKE Phase 1 and IKE Phase 2, respectively?

  1. The IPsec SA in Phase 1 and the IKE SA in Phase 2
  2. The IKE SA in Phase 1 and the IPsec SA in Phase 2 Correct answer.
  3. The routing adjacency in Phase 1 and the IKE SA in Phase 2
  4. The NAT session in Phase 1 and the IPsec SA in Phase 2

Explanation

IKE Phase 1 creates a bidirectional IKE SA that protects the key-exchange messages between the peers. Phase 2, often called Quick Mode, negotiates one or more unidirectional IPsec SAs that protect user data. The two phases serve different purposes, so the IKE SA is not the data-encryption SA.

Question 36Securing the Network

On an SRX, traffic attempts to pass from the trust zone to the untrust zone. No security policy matches the flow. What is the default action?

  1. Deny the flow Correct answer.
  2. Forward the flow to the default route
  3. Reject the flow with an ICMP unreachable
  4. Permit the flow and log it

Explanation

Junos security policies are evaluated top-down, and inter-zone traffic must be permitted by an explicit policy. When no policy matches, the implicit default action is deny, so the packet is dropped. A reject action would require an explicit policy.

Question 37Securing the Network

Which condition makes IPsec NAT traversal necessary between two SRX peers?

  1. The peers use route-based VPNs instead of policy-based VPNs
  2. The peers are in different administrative domains
  3. The peers use certificates instead of pre-shared keys
  4. A NAT device translates the IKE or ESP addresses Correct answer.

Explanation

NAT-T encapsulates IKE and ESP in UDP so the packets can pass through NAT and the peers can detect translated addresses. Certificates, administrative boundaries, and route-based versus policy-based design do not by themselves require NAT-T. Without NAT-T, ESP often fails because NAT cannot translate it correctly.

Question 38Securing the Network

A branch SRX must hide the private source addresses of LAN users when they access the Internet through the WAN. Which NAT design accomplishes this?

  1. Destination NAT applied on the outbound WAN interface
  2. Static NAT with one public address for every LAN host
  3. Source NAT with an address pool Correct answer.
  4. A route-based IPsec VPN from branch to hub

Explanation

Source NAT rewrites the private source address to a public address, which hides internal addressing from Internet destinations. Destination NAT and static NAT are normally used to publish internal services, not to hide outbound clients. A VPN may encrypt traffic to a hub, but it does not hide Internet source addresses by itself.

Question 39Securing the Network

Which Junos configuration object specifies the remote IPsec peer address and authentication method before an IPsec policy is referenced?

  1. A security policy
  2. An IPsec VPN
  3. An IPsec policy
  4. An IKE gateway Correct answer.

Explanation

The IKE gateway defines the remote peer, local and remote identity, and authentication such as a pre-shared key or certificate. The IPsec policy defines Phase 2 proposals, and the IPsec VPN binds gateway, policy, and traffic selectors. A security policy permits the traffic but does not define peer authentication.

Question 40Securing the Network

A designer places a broad policy permitting trust-to-untrust traffic above a new policy that should restrict a specific server to one external host. What will SRX policy evaluation do?

  1. Evaluate the specific policy first because it is more specific
  2. Reject both policies because they overlap
  3. Match the broad policy first and permit the server traffic Correct answer.
  4. Evaluate both policies and apply the most restrictive action

Explanation

Junos evaluates security policies in the order configured and stops at the first match; specificity does not override order. Therefore the broad permit will match the server flow before the restrictive policy is examined. The design must reorder the specific policy above the broad one, or use a more targeted match.

Question 41Securing the Network

Which design element is central to a route-based IPsec VPN on SRX?

  1. A secure tunnel interface bound to the IPsec VPN and routes pointing to it Correct answer.
  2. A security policy that references the remote subnet as a policy-based proxy ID
  3. A loopback interface that carries encrypted traffic
  4. A destination NAT rule that redirects traffic to the remote gateway

Explanation

Route-based VPNs use a tunnel interface, typically st0, that is bound to the IPsec VPN. Routing sends interesting traffic to that tunnel interface, and the VPN encrypts it. Policy-based VPNs rely on traffic selectors instead of a tunnel route.

Question 42Securing the Network

Phase 1 completes but Phase 2 fails repeatedly between two SRX peers configured for a route-based VPN. Which design issue is the most likely cause?

  1. An incorrect pre-shared key on the two peers
  2. A missing security policy that permits IKE
  3. Mismatched traffic selectors or IPsec proposals Correct answer.
  4. A routing loop between the public interfaces

Explanation

Phase 1 failure would point to IKE negotiation, such as a pre-shared key or identity mismatch, but Phase 1 is already up. Phase 2 negotiates the IPsec SA using traffic selectors and IPsec proposals, so a mismatch in either prevents the data SA. Routing loops or a missing IKE policy would affect earlier stages or overall reachability.

Question 43Securing the Network

Which SRX feature limits half-open TCP sessions to mitigate SYN-flood attacks against a protected server?

  1. Source NAT with a persistent address pool
  2. An IPsec policy with perfect forward secrecy
  3. Screen options with SYN flood protection Correct answer.
  4. A security policy with a log action

Explanation

Screen options apply stateless and flood protections at the zone level, including SYN-flood thresholds for half-open sessions. NAT, IPsec PFS, and logging do not rate-limit TCP handshakes. The designer enables the screen profile on the untrust zone.

Question 44Securing the Network

A hub SRX must terminate IPsec tunnels from many branch SRX devices whose public addresses are not known in advance. Which hub-side design supports this with one IKE gateway?

  1. A destination NAT rule for each branch tunnel endpoint
  2. A policy-based VPN with a unique proxy ID per branch
  3. A dynamic IKE gateway that accepts branch initiators Correct answer.
  4. A static IKE gateway for each possible branch public address

Explanation

A dynamic IKE gateway lets the hub act as responder and match peers by identity rather than a fixed remote address, so many spokes can terminate on one gateway. Static gateways require known addresses and do not scale to unknown branches. Per-branch proxy IDs or destination NAT rules are not the mechanism that accepts dynamic peers.

Question 45Securing the Network

An SRX Series device must place interface ge-0/0/5.0 into the trust security zone. Which configuration statement accomplishes this?

  1. set security zones security-zone trust interfaces ge-0/0/5.0 Correct answer.
  2. set security zone trust interface ge-0/0/5.0
  3. set interfaces ge-0/0/5.0 zone trust
  4. set security zones trust interface ge-0/0/5.0

Explanation

Interface membership is configured under security zones security-zone <zone-name> interfaces <interface-name>. The other statements use an invalid hierarchy or place the zone under the interface, which Junos does not accept.

Question 46Securing the Network

Which set of parameters must a Junos security policy specify to match traffic between two zones?

  1. IKE proposal, IPsec proposal, and VPN name
  2. incoming interface, outgoing interface, and route table
  3. source NAT pool, destination NAT pool, and application
  4. from-zone, to-zone, source address, destination address, and application Correct answer.

Explanation

A zone-pair policy matches on the from-zone, to-zone, source address, destination address, and application. NAT pools, routes, and IPsec proposals are referenced elsewhere and are not policy match criteria.

Question 47Securing the Network

An administrator needs to view the current flow sessions on an SRX Series device. Which operational command displays this information?

  1. show security policies
  2. show security zones
  3. show security flow session Correct answer.
  4. show configuration security policies

Explanation

The show security flow session command displays active flow sessions, including source, destination, and NAT information. Policy and zone commands display configuration or counters, not live session state.

Question 48Securing the Network

When zone-specific address books are in use, a designer creates a policy from trust to untrust and enters web-server as the source address. Where must web-server be defined for the policy to reference it?

  1. in the address book of the untrust zone
  2. in the global address book only
  3. in the application set for the untrust zone
  4. in the address book of the trust zone Correct answer.

Explanation

With zone-specific address books, the source address in a policy must belong to the from-zone's address book and the destination address to the to-zone's. Referencing an address from another zone's book causes the policy to fail validation.

Question 49Securing the Network

A DMZ web server with private address 10.1.1.10 must be reachable from the Internet at public address 203.0.113.10. Which NAT type should the designer configure on the SRX?

  1. destination NAT with a static mapping Correct answer.
  2. destination NAT with a dynamic pool
  3. source NAT with a persistent address pool
  4. source NAT with an interface pool

Explanation

Destination NAT translates the public destination address to the server's private address, and a static mapping provides the required one-to-one relationship. Source NAT would translate the server's source address, not publish it.

Question 50Securing the Network

A designer must allow SSH management access to an SRX Series device through an interface assigned to the untrust zone. Which configuration is required on the untrust zone?

  1. host-inbound-traffic system-services ssh Correct answer.
  2. an application firewall rule for TCP port 22
  3. host-inbound-traffic protocols ssh
  4. a security policy from untrust to trust permitting junos-ssh

Explanation

Management traffic destined to the SRX itself is controlled by host-inbound-traffic under the zone. A transit security policy and application firewall rule apply to traffic passing through the device, not to the device's own SSH service.