JNCIA-SEC study plan

Explain the Junos control plane versus data plane split and identify which daemons (mgd, rpd, pfem, dcd) handle configuration, routing, and forwarding.

Navigate operational mode and configuration mode fluently: locate candidate versus active configuration, commit with rollback, and use show | compare.

Identify the SRX platform components (RE, PFE, SPU/flow module) and describe how traffic is processed through the flow pipeline.

Configure basic interface addressing, hostname, and static routes on a vSRX or lab device and verify with show interfaces and show route.

Define security zones and assign interfaces, then explain the default trust/untrust behavior and intra-zone versus inter-zone traffic.

Write a stateful security policy with source/destination addresses, applications, and actions, and place it correctly in policy order.

Explain how Junos appends an implicit deny and how to read policy hit counters during verification.

Differentiate address books, address sets, applications, and application sets and reuse them across policies.

Configure source NAT (interface and pool-based) and verify translations using show security flow session.

Configure destination NAT and static NAT, and distinguish their use cases for inbound service exposure.

Explain NAT proxy ARP behavior and when it is required for destination NAT.

Troubleshoot a NAT failure by tracing the flow order: policy lookup, NAT, session creation, and return traffic.

Describe IKE phase 1 and phase 2 negotiation, including proposals, policies, and pre-shared key authentication.

Configure a policy-based site-to-site IPsec VPN between two SRX devices, including IKE gateway, IPsec policy, and VPN binding.

Verify tunnel establishment with show security ike sa and show security ipsec sa, and interpret common failure states.

Identify the traffic selectors and proxy-IDs that must match on both peers for phase 2 to succeed.

Configure a route-based VPN using st0 interfaces and explain when route-based is preferred over policy-based.

Add dead peer detection and describe how it detects and recovers from tunnel failure.

Troubleshoot a phase 1 mismatch (proposal, PSK, peer address) and a phase 2 mismatch (proxy-ID, proposal) using traceoptions.

Compare main mode versus aggressive mode and explain why aggressive mode weakens PSK security.

Explain the AppSecure components (AppID, AppTrack, AppFW, AppQoS) and how application identification feeds policy decisions.

Enable application identification and write a policy that permits or denies traffic based on a detected application rather than port.

Configure UTM profiles for antivirus, web filtering, and content filtering, and attach them to a security policy.

Describe how IPS signatures are selected, tuned, and applied, and explain the difference between signature-based and anomaly detection.

Configure syslog streaming to an external collector and set log modes (session, policy, and event) appropriately.

Use show security flow session, show security policies hit-count, and clear commands to diagnose a blocked connection.

Read traceoptions output for flow and IKE debugging without overwhelming the device, and disable tracing afterward.

Interpret a session close reason and map it back to the policy or service that caused the drop.

Re-run a timed practice set weighted toward policies/NAT, IPsec, and AppSecure, and score each domain separately.

Reconfigure from scratch, without notes, a policy-plus-NAT scenario and a site-to-site VPN to confirm retention.

Review every missed item from earlier weeks and close knowledge gaps in the two weakest domains.

Confirm lab reset and cleanup steps so a fresh scenario can be built quickly under exam-like time pressure.