I85PREP
⌘ K
JNCIA-SEC study materials
JNCIA-SEC study resources

JNCIA-SEC practice questions

One question at a time. Build your JNCIA-SEC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security fundamentals and SRX platform basics

On a Juniper SRX, which component is responsible for the actual packet forwarding and security policy enforcement?

  1. The management daemon
  2. The Packet Forwarding Engine Correct answer.
  3. The control plane
  4. The Routing Engine

Explanation

The SRX separates control-plane and data-plane functions. The Routing Engine handles control-plane tasks such as routing protocol processing and management, while the Packet Forwarding Engine performs forwarding and applies security processing to transit traffic.

Question 2Security fundamentals and SRX platform basics

Which zone type is preconfigured on an SRX and is used for traffic that the device itself originates or terminates, such as management access?

  1. The functional zone Correct answer.
  2. The custom zone
  3. The security zone
  4. The tunnel zone

Explanation

SRX zones fall into three categories: security zones for transit traffic, functional zones for the device's own traffic (for example the junos-host zone), and tunnel zones for tunnel interfaces. Functional zones are tied to device-originated and device-terminated traffic rather than transit traffic.

Question 3Security fundamentals and SRX platform basics

A security policy on an SRX matches traffic from zone trust to zone untrust. What does the policy action determine?

  1. Which NTP server the device synchronizes with
  2. Which routing protocol advertises the route
  3. Which interface becomes the active member of the aggregate bundle
  4. Whether the session is permitted, denied, or rejected Correct answer.

Explanation

Security policy actions such as permit, deny, and reject govern whether a matched flow is allowed to create a session. Routing, link aggregation, and NTP are unrelated to security policy actions.

Question 4Security fundamentals and SRX platform basics

In the default policy order on an SRX, what happens to traffic that matches no user-defined security policy?

  1. It is dropped by the default deny behavior Correct answer.
  2. It is redirected to the junos-host zone
  3. It is logged and then forwarded
  4. It is permitted by an implicit permit rule

Explanation

When no user-defined policy matches, the SRX applies the default action, which is to drop the traffic. Administrators must create explicit policies to permit desired flows between zones.

Question 5Security fundamentals and SRX platform basics

What is the purpose of the junos-host zone on an SRX?

  1. It governs traffic destined to or sourced from the device itself Correct answer.
  2. It carries transit traffic between two security zones
  3. It hosts the loopback interface used for routing protocols
  4. It provides a default tunnel endpoint for IPsec

Explanation

The junos-host zone is a functional zone that applies security policy to traffic addressed to the device itself, such as SSH or management sessions. Transit traffic between security zones is handled by user-defined security zones instead.

Question 6Security fundamentals and SRX platform basics

Which statement accurately distinguishes a stateless firewall filter from stateful security policy on an SRX?

  1. Both maintain session state and differ only in logging behavior
  2. Both evaluate each packet independently and ignore session state
  3. Firewall filters track session state, while security policies evaluate each packet independently
  4. Firewall filters evaluate packets individually, while security policies use session state to permit return traffic Correct answer.

Explanation

Stateless firewall filters match on packet header fields and do not maintain flow state, so return traffic must be explicitly allowed. Stateful security policies create sessions, so reply traffic for an established session is permitted automatically.

Question 7Security fundamentals and SRX platform basics

On an SRX, which zone must an interface be assigned to before it can participate in security policy evaluation?

  1. A virtual router
  2. A security zone Correct answer.
  3. The null zone
  4. A routing instance

Explanation

Interfaces that handle transit traffic must be bound to a security zone so that policy can be applied between zones. Routing instances and virtual routers define routing context, not security policy membership.

Question 8Security fundamentals and SRX platform basics

Which address book entry type is used when a policy must reference a range of contiguous IP addresses on an SRX?

  1. An address range entry Correct answer.
  2. A DNS host-name entry
  3. A wildcard address entry
  4. A multicast address entry

Explanation

SRX address books support several entry types, including host addresses, subnets, ranges, and wildcards. A range entry specifies a start and end address, which is appropriate for contiguous address blocks.

Question 9Security fundamentals and SRX platform basics

An administrator wants a policy to match only TCP traffic destined for port 443 on a web server. Which policy component should be configured?

  1. A source NAT rule
  2. A CoS classifier
  3. An application or application-set match condition Correct answer.
  4. A routing policy term

Explanation

Application and application-set match conditions let a policy match on protocol and port, such as TCP/443 for HTTPS. NAT, routing policy, and CoS serve different purposes and do not define which traffic a security policy matches.

Question 10Security fundamentals and SRX platform basics

What is the effect of configuring a security policy with the reject action rather than deny?

  1. The packet is forwarded to the junos-host zone
  2. The packet is silently dropped with no response
  3. The packet is dropped and a TCP reset or ICMP unreachable is sent Correct answer.
  4. The packet is permitted and logged

Explanation

The deny action silently discards traffic, while reject discards it and notifies the source with a TCP reset or ICMP unreachable message. This distinction affects how quickly clients detect that a flow is blocked.

Question 11Security fundamentals and SRX platform basics

Which statement best describes the SRX default security policy behavior for traffic between two security zones when no policy is configured?

  1. Traffic is permitted only for established sessions
  2. All traffic is permitted until a deny policy is added
  3. Traffic is permitted only for TCP
  4. All traffic is denied until a permit policy is added Correct answer.

Explanation

The SRX default policy denies inter-zone traffic, so administrators must explicitly permit desired flows. This default-deny posture is a core security fundamental on the platform.

Question 12Security fundamentals and SRX platform basics

Which zone is used to logically separate traffic that should not be evaluated by security policy, such as certain internal interfaces on some SRX configurations?

  1. The security zone
  2. The functional zone Correct answer.
  3. The untrust zone
  4. The tunnel zone

Explanation

Functional zones exist for specific purposes such as device-directed traffic and are distinct from security zones that carry transit traffic subject to policy. Untrust is a user-named security zone, not a separate category.

Question 13Security fundamentals and SRX platform basics

A policy references an application-set named web-apps that contains HTTP and HTTPS. What does the policy match?

  1. Traffic that matches both HTTP and HTTPS simultaneously
  2. Either HTTP or HTTPS traffic Correct answer.
  3. Only HTTP traffic
  4. Only HTTPS traffic

Explanation

An application-set is a logical grouping of applications, and a policy referencing the set matches traffic for any member application. A single flow cannot simultaneously be both HTTP and HTTPS, so the set acts as a logical OR.

Question 14Security fundamentals and SRX platform basics

What is the primary function of a screen on an SRX?

  1. To provide address translation for outbound sessions
  2. To classify traffic into forwarding classes
  3. To detect and block network attacks such as SYN floods and port scans Correct answer.
  4. To authenticate users against a directory server

Explanation

Screens are a set of security features that detect and mitigate network attacks, including floods, scans, and malformed packets. NAT, CoS, and user authentication are handled by separate features.

Question 15Security fundamentals and SRX platform basics

Which screen option would an administrator enable to protect against a flood of TCP SYN packets that exhaust session resources?

  1. IP spoofing protection
  2. Ping of death protection
  3. Land attack protection
  4. SYN flood protection Correct answer.

Explanation

SYN flood protection in the screen profile detects and limits excessive half-open TCP connection attempts. IP spoofing, land attack, and ping of death protections address different attack signatures.

Question 16Security fundamentals and SRX platform basics

On an SRX, what does a source NAT rule with interface translation accomplish?

  1. It performs no translation and only logs traffic
  2. It translates the source address to the egress interface address Correct answer.
  3. It translates the destination address to a server behind the device
  4. It translates both source and destination addresses

Explanation

Interface-based source NAT translates the source address of outbound traffic to the address of the egress interface, allowing internal hosts to share that public address. Destination translation is handled by destination NAT rules.

Question 17Security fundamentals and SRX platform basics

Which security fundamental describes the SRX behavior of allowing return traffic for a session that was permitted in the forward direction?

  1. Policy-based routing
  2. Stateful inspection Correct answer.
  3. Route-based forwarding
  4. Stateless filtering

Explanation

Stateful inspection tracks sessions so that reply packets for an established, permitted session are allowed without a separate policy. Stateless filtering would require an explicit rule for each direction.

Question 18Security fundamentals and SRX platform basics

What happens to an existing session when its matching security policy is modified and committed on an SRX?

  1. Existing sessions are re-evaluated and always dropped
  2. All existing sessions are immediately torn down
  3. Existing sessions are converted to stateless filtering
  4. Existing sessions generally continue under the previous policy until they close or time out Correct answer.

Explanation

By default, policy changes do not retroactively terminate established sessions; those sessions typically persist until they close or time out. New sessions are evaluated against the updated policy.

Question 19Security fundamentals and SRX platform basics

Which statement about zone-based policy evaluation on an SRX is correct?

  1. Policies are evaluated based on the routing table in use
  2. Policies are evaluated based on the ingress and egress zones of the session Correct answer.
  3. Policies are evaluated based on the physical interface name only
  4. Policies are evaluated based on the CoS forwarding class

Explanation

Security policies are defined between a from-zone and a to-zone, and the SRX evaluates a flow against policies for the zone pair it traverses. Physical interface names, routing tables, and CoS classes are not the basis for policy selection.

Question 20Security fundamentals and SRX platform basics

Which feature allows an SRX to identify and control applications regardless of port, such as detecting peer-to-peer traffic on nonstandard ports?

  1. Source NAT
  2. Static routing
  3. Link aggregation
  4. Application identification (AppID) Correct answer.

Explanation

Application identification inspects traffic to recognize applications even when they use nonstandard ports, enabling more accurate policy enforcement. NAT, routing, and aggregation do not perform application-layer recognition.

Question 21Security fundamentals and SRX platform basics

An administrator needs to log which sessions a permit policy allows. Which policy configuration supports this requirement?

  1. Enable CoS logging on the interface
  2. Configure a routing policy with a log action
  3. Configure a static NAT rule with logging
  4. Enable the log option on the policy Correct answer.

Explanation

The log option on a security policy causes the device to record session information for traffic matched by that policy. Routing policy, CoS, and NAT logging do not provide per-policy session logging.

Question 22Security fundamentals and SRX platform basics

Which type of zone must a tunnel interface be associated with for IPsec VPN traffic on an SRX?

  1. A functional zone
  2. The junos-host zone
  3. A security zone
  4. A tunnel zone Correct answer.

Explanation

Tunnel interfaces used for VPN traffic are placed in tunnel zones, which are a distinct zone category on the SRX. Security zones host physical or logical interfaces carrying transit traffic, and functional zones handle device traffic.

Question 23Security fundamentals and SRX platform basics

What is the role of the from-zone and to-zone in a security policy definition?

  1. They define the routing instances used for the session
  2. They define the NAT pool used for translation
  3. They define the CoS scheduler map applied to the session
  4. They define the direction of traffic the policy applies to Correct answer.

Explanation

A security policy is scoped by the from-zone (ingress) and to-zone (egress), which together define the direction of traffic the policy governs. Routing instances, NAT pools, and scheduler maps are configured separately.

Question 24Security fundamentals and SRX platform basics

An SRX receives a packet on an interface in the trust zone destined for a host in the DMZ zone. Which policy must permit the flow?

  1. A policy from zone DMZ to zone trust
  2. A policy from zone trust to zone DMZ Correct answer.
  3. A policy from zone trust to zone trust
  4. A policy from zone DMZ to zone DMZ

Explanation

Policy direction follows the session's ingress and egress zones, so traffic entering trust and leaving toward DMZ requires a trust-to-DMZ policy. The reverse direction is handled by the session for return traffic.

Question 25Security fundamentals and SRX platform basics

Which statement about the relationship between zones and interfaces on an SRX is accurate?

  1. An interface does not need a zone to be used in a security policy
  2. An interface must belong to the junos-host zone to pass transit traffic
  3. An interface can belong to multiple security zones simultaneously
  4. An interface belongs to one security zone at a time Correct answer.

Explanation

Each interface is assigned to a single security zone, and that membership determines which policies apply to traffic entering or leaving it. An interface cannot simultaneously belong to multiple security zones.

Question 26Security fundamentals and SRX platform basics

On an SRX Series device, which component is responsible for forwarding transit traffic after the first packet of a session has been processed by the control plane?

  1. The backup Routing Engine, which forwards traffic in active-active mode
  2. The Routing Engine, which forwards every packet in software
  3. The management interface, which proxies all transit flows
  4. The Packet Forwarding Engine, which handles session-based forwarding in hardware or fast path Correct answer.

Explanation

The SRX separates control-plane and data-plane functions. The Routing Engine runs routing protocols and management processes, while the Packet Forwarding Engine performs session-based forwarding of transit traffic once the session is established, using hardware or fast-path processing where available. This separation is why throughput is measured on the data plane rather than the control plane.

Question 27Security fundamentals and SRX platform basics

Which statement describes the default behavior of the SRX host-inbound traffic configuration for a security zone?

  1. Only SSH is permitted inbound by default on untrust interfaces
  2. All management protocols are permitted inbound on every zone interface by default
  3. Host-inbound traffic is controlled solely by security policies between zones
  4. Host-inbound services must be explicitly allowed per zone and interface, otherwise traffic to the device itself is dropped Correct answer.

Explanation

Traffic destined to the SRX itself is governed by host-inbound services configured under the zone and interface. If a service such as SSH, HTTPS, or ping is not explicitly permitted as host-inbound, the device drops that traffic even if a security policy would permit it between zones. Security policy applies to transit traffic, not to traffic terminating on the device.

Question 28Security fundamentals and SRX platform basics

An administrator wants to verify which security policy permitted a specific session on an SRX. Which command displays the policy name associated with an active session?

  1. show chassis cluster status
  2. show security flow session Correct answer.
  3. show configuration security policies
  4. show security zones

Explanation

The show security flow session command lists active sessions and includes the policy name that permitted each session, along with source, destination, NAT information, and timeout values. This makes it the standard tool for confirming which policy matched a flow. Configuration and zone commands do not show per-session policy association.

Question 29Security fundamentals and SRX platform basics

Which security fundamental explains why an SRX permits return traffic for a session that was allowed outbound, even though no policy exists for the reverse direction?

  1. Because return traffic is always permitted by the implicit global policy
  2. Because reverse traffic matches the junos-host zone policy
  3. Because the SRX creates a session entry and treats return traffic as part of the same stateful flow Correct answer.
  4. Because the SRX uses stateless packet filtering for return traffic

Explanation

Stateful inspection means the SRX records each permitted flow in its session table. Return packets matching that session are allowed without a separate reverse-direction policy because they belong to an already-permitted session. This stateful behavior is a core security fundamental distinguishing SRX from stateless filters.

Question 30Security fundamentals and SRX platform basics

Which security zone type is used to logically separate traffic that should not be evaluated by security policy, such as certain internal transit links?

  1. The tunnel zone
  2. The security zone
  3. The junos-host zone
  4. The functional zone Correct answer.

Explanation

Functional zones, such as the default junos-global zone, are used for interfaces that carry traffic the device should not subject to security policy evaluation, typically internal transit or control links. Security zones are for interfaces where policy enforcement is required. Tunnel zones host tunnel interfaces for VPN traffic, and junos-host applies to device-terminated traffic.

Question 31Security fundamentals and SRX platform basics

An SRX must permit HTTP and HTTPS to a web server but block all other applications from the same source. Which policy design accomplishes this with the fewest policies?

  1. A deny-any policy followed by a permit policy for the web applications
  2. A single permit policy matching the any application with a URL filter attached
  3. Two separate permit policies, one per application, plus a deny-any policy
  4. A single permit policy matching the junos-http and junos-https applications, relying on the implicit deny for everything else Correct answer.

Explanation

A single permit policy matching the predefined junos-http and junos-https applications allows only those applications, and any other traffic falls through to the implicit default deny. This is the most concise correct design. Adding an explicit deny-any is unnecessary, and placing deny before permit would block the desired traffic.

Question 32Security fundamentals and SRX platform basics

Which statement best describes the function of the junos-host zone on an SRX?

  1. It provides a default zone for unassigned interfaces
  2. It carries IPsec tunnel traffic into the policy engine
  3. It applies security policy to traffic destined to or sourced from the device itself Correct answer.
  4. It applies security policy to traffic transiting between two physical zones

Explanation

The junos-host zone is a special zone used when security policy must be applied to traffic terminating on or originating from the device itself, such as management or self-originated flows. It is distinct from transit zones. Tunnel zones carry VPN traffic, and unassigned interfaces cannot pass traffic in a security context.

Question 33Security fundamentals and SRX platform basics

An administrator configures a source NAT rule with interface translation on an SRX. What is the effect on outbound traffic?

  1. The source port is preserved while the IP is left unchanged
  2. The destination IP is translated to an internal server address
  3. The source IP is translated to the egress interface address Correct answer.
  4. The source IP is translated to the destination interface address

Explanation

Interface source NAT translates the source address of matching traffic to the address of the egress interface, which is commonly the untrusted WAN interface. This allows internal hosts to share the public interface address. Destination translation is a function of destination NAT, not source NAT.

Question 34Security fundamentals and SRX platform basics

Which security feature on an SRX identifies and controls applications regardless of port, such as detecting peer-to-peer traffic on nonstandard ports?

  1. Application identification within AppSecure Correct answer.
  2. Stateless firewall filters
  3. Unified threat management antispam
  4. Screen options for flood protection

Explanation

Application identification, part of AppSecure, inspects traffic to recognize applications even when they use nonstandard ports or dynamic port negotiation. This allows policies to permit or deny by application rather than by port alone. Screens address flood and anomaly protection, and stateless filters match headers only.

Question 35Security fundamentals and SRX platform basics

An administrator enables a screen option that limits the number of concurrent sessions from a single source IP address. Which threat is this configuration primarily intended to mitigate?

  1. Session table exhaustion from a single host Correct answer.
  2. DNS cache poisoning
  3. Route flapping on the control plane
  4. IP fragmentation attacks

Explanation

Source-based session limiting screens cap how many concurrent sessions a single source can create, protecting the session table from being exhausted by one aggressive or compromised host. Fragmentation screens address malformed fragments, and DNS and routing issues are handled elsewhere.

Question 36Security fundamentals and SRX platform basics

Which statement accurately describes how an SRX evaluates a packet when multiple security policies could match?

  1. The policy with the most specific match is chosen regardless of order
  2. All matching policies are applied in sequence to the packet
  3. Policies are evaluated from top to bottom, and the first matching policy is applied Correct answer.
  4. The policy with the lowest sequence number is ignored in favor of the most recent

Explanation

Security policies are evaluated in the order they appear in the configuration, and the first policy whose match conditions are satisfied determines the action. Later policies are not consulted once a match occurs. This is why policy ordering is critical when overlapping conditions exist.

Question 37Security fundamentals and SRX platform basics

A policy permits traffic from the trust zone to the untrust zone with logging enabled. Where does the administrator look to confirm that sessions are being logged?

  1. In the routing table for the untrust zone
  2. In the interface statistics counters
  3. In the chassis cluster redundancy group status
  4. In the session log or traffic log configured for the policy Correct answer.

Explanation

When logging is enabled on a permit policy, session log messages are generated and can be reviewed in the configured log destination, such as the traffic log or a syslog server. Interface counters and routing tables do not record per-policy session logging. This confirms which sessions the policy allowed.

Question 38Security fundamentals and SRX platform basics

Which type of zone must a tunnel interface be associated with for IPsec VPN traffic to be processed by security policy on an SRX?

  1. A junos-host zone
  2. A management zone
  3. A functional zone
  4. A tunnel zone Correct answer.

Explanation

Tunnel interfaces used for IPsec VPNs are bound to tunnel zones, which are a type of security zone. Traffic decapsulated from the tunnel is then evaluated by security policy between the tunnel zone and other zones. Functional zones bypass policy, and junos-host applies to device-terminated traffic.

Question 39Security fundamentals and SRX platform basics

An SRX receives a packet on a trust zone interface destined for a host in the DMZ zone. Which policy must permit the traffic?

  1. A policy from the trust zone to the DMZ zone Correct answer.
  2. A policy from the DMZ zone to the trust zone
  3. A policy from the junos-host zone to the trust zone
  4. A policy from the untrust zone to the DMZ zone

Explanation

Security policy direction is defined by the from-zone and to-zone, which correspond to the ingress and egress zones of the traffic. A packet entering the trust zone and leaving toward the DMZ requires a policy with from-zone trust and to-zone DMZ. The reverse-direction policy would govern return traffic as part of the same session.

Question 40Security fundamentals and SRX platform basics

An SRX Series device is placed inline between two internal subnets, and the administrator wants transit traffic between them to be inspected by security policy. Which zone configuration accomplishes this?

  1. Assign both subnets' interfaces to the junos-host zone so policy is applied to transit traffic.
  2. Assign each subnet's interface to a different security zone, such as trust and a second security zone. Correct answer.
  3. Assign both subnets' interfaces to the untrust zone, which inspects all traffic by default.
  4. Assign both subnets' interfaces to the same security zone so intra-zone traffic is inspected.

Explanation

Security policy on an SRX is evaluated between a from-zone and a to-zone, so transit traffic is only inspected when the ingress and egress interfaces belong to two different security zones. Placing both interfaces in the same zone means the traffic is intra-zone and is not matched against inter-zone policy by default. The junos-host zone applies to traffic destined to the device itself, not to transit traffic.

Question 41Firewall policies, zones, and NAT

In a Junos security policy, which action causes the device to drop matching traffic and send a TCP reset to the client?

  1. discard
  2. reject Correct answer.
  3. deny
  4. permit

Explanation

The reject action blocks the session and additionally notifies the source, sending a TCP RST for TCP traffic or an ICMP unreachable message for other protocols. The deny action silently drops the packet without notifying the sender. discard is not a valid Junos policy action; the silent-drop action is deny.

Question 42Firewall policies, zones, and NAT

Traffic arrives at an SRX Series firewall from the trust zone destined for the untrust zone. Which policy must match for the traffic to be permitted?

  1. A policy from trust to trust
  2. A global policy with no zone context
  3. A policy from trust to untrust Correct answer.
  4. A policy from untrust to trust

Explanation

Junos security policies are directional and are evaluated from the source zone to the destination zone. Traffic sourced in trust and destined for untrust is matched against trust-to-untrust policies. The reverse direction and intra-zone policies are separate policy sets.

Question 43Firewall policies, zones, and NAT

Which statement correctly describes the default security policy on an SRX Series device?

  1. It denies all traffic including intrazone traffic
  2. It permits interzone traffic and denies intrazone traffic
  3. It permits all traffic in both directions
  4. It permits intrazone traffic and denies interzone traffic Correct answer.

Explanation

The implicit default policy permits traffic between interfaces in the same zone but denies traffic that crosses from one zone to another. Any interzone traffic you want to allow must be explicitly permitted by a user-defined policy. This default behavior is why zone-pair policies are central to SRX configuration.

Question 44Firewall policies, zones, and NAT

What is the purpose of the source NAT rule-set match condition in a Junos configuration?

  1. To select which original source addresses are translated Correct answer.
  2. To select which zones are permitted to route
  3. To select which destination addresses are translated
  4. To select which applications are inspected

Explanation

A source NAT rule-set uses match conditions on the original source address, and optionally destination address and application, to decide which traffic is translated. The translated address is then defined in the rule-set's then clause. Destination NAT instead matches on the original destination.

Question 45Firewall policies, zones, and NAT

A security policy is configured with the application any and the action permit. What effect does this have on traffic between the two zones?

  1. Only TCP applications are permitted
  2. All applications are permitted without application identification Correct answer.
  3. All applications are denied until identified
  4. Only known applications are permitted

Explanation

Using the predefined application any in a permit policy allows all traffic between the zones without requiring application identification. This is the broadest application match and is often used for initial connectivity testing. More specific applications should be specified for tighter control.

Question 46Firewall policies, zones, and NAT

Which zone type is intended for the interfaces that connect an SRX Series device to the internet?

  1. management
  2. trust
  3. untrust Correct answer.
  4. dmz

Explanation

The untrust zone is conventionally used for interfaces facing untrusted networks such as the internet. The trust zone typically faces internal user networks, and the dmz zone hosts externally accessible servers. The management zone is used for out-of-band device administration.

Question 47Firewall policies, zones, and NAT

Which NAT type translates the source address of outbound sessions so that internal hosts can reach the internet through a single public address?

  1. Double NAT
  2. Static NAT
  3. Destination NAT
  4. Source NAT Correct answer.

Explanation

Source NAT rewrites the source address of outbound packets, typically to a public address, so internal hosts can communicate with external networks. Return traffic is mapped back to the original internal host by the session table. Destination NAT instead changes the address of the server being contacted.

Question 48Firewall policies, zones, and NAT

A policy is configured with logging enabled. Where does the SRX Series device send the policy log entries by default?

  1. To the configured syslog or stream log destination Correct answer.
  2. To the DNS resolver
  3. To the destination server in the log payload
  4. To the client that generated the traffic

Explanation

Policy logging entries are sent to the logging destination configured on the device, such as a syslog server or a stream log host. They are not sent to traffic endpoints. Logging must be enabled on the policy and a log destination configured for entries to be retained.

Question 49Firewall policies, zones, and NAT

An administrator needs inbound internet traffic to reach an internal web server at 10.1.1.50 using public address 203.0.113.10. Which NAT configuration accomplishes this?

  1. A source NAT rule matching 10.1.1.50 and translating to 203.0.113.10
  2. A destination NAT rule matching 203.0.113.10 and translating to 10.1.1.50 Correct answer.
  3. A policy from untrust to trust with the action permit only
  4. A static route pointing 203.0.113.10 to the untrust interface

Explanation

Destination NAT matches the original destination address, here the public address 203.0.113.10, and translates it to the internal server address 10.1.1.50. A matching policy from untrust to trust must also permit the traffic after translation. Source NAT would translate the client's address, not the server's.

Question 50Firewall policies, zones, and NAT

Two policies in the same zone pair match a given session. Policy A is listed first with action deny, and Policy B is listed second with action permit. What happens to the traffic?

  1. It is denied only if logging is enabled on Policy A
  2. It is denied because the first matching policy is applied Correct answer.
  3. It is permitted only if application identification succeeds
  4. It is permitted because a later permit overrides the deny

Explanation

Junos evaluates policies in order and applies the first policy that matches the session. Once a match is found, later policies are not evaluated. Therefore the earlier deny policy blocks the traffic even though a later permit would have matched.