I85PREP
⌘ K
JNCIE-SEC study materials
JNCIE-SEC study resources

JNCIE-SEC practice questions

One question at a time. Build your JNCIE-SEC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Platform and Architecture

In a Junos security platform design, which component is responsible for maintaining session state and applying security policy to transit traffic?

  1. The switching fabric, which enforces zone-based policy in hardware
  2. The Packet Forwarding Engine, which performs route lookups on every packet
  3. The Routing Engine, which inspects each packet against the policy before forwarding
  4. The Services Processing Unit, which handles flow-based inspection and policy enforcement Correct answer.

Explanation

On SRX platforms the Services Processing Unit (SPU) performs flow-based session setup, policy lookup, and inspection of transit traffic, while the Routing Engine handles control-plane protocols. The Packet Forwarding Engine forwards packets but does not own session state or policy enforcement.

Question 2Security Platform and Architecture

Which statement best describes the purpose of security zones on an SRX Series device?

  1. They define the logical grouping of interfaces that share a common security policy boundary Correct answer.
  2. They determine which routing protocol runs on each interface
  3. They assign a MAC address to each logical unit for forwarding
  4. They map each physical interface to a unique VLAN identifier for Layer 2 separation

Explanation

A security zone groups one or more interfaces into a logical boundary, and policies are written between zones rather than per interface. Zones also carry host-inbound traffic settings and screen options that apply to all member interfaces.

Question 3Security Platform and Architecture

An engineer needs transit traffic between two zones to be permitted. What is the default policy behavior between zones on an SRX device before any explicit policy is configured?

  1. Only TCP traffic is permitted by default
  2. Only traffic matching the junos-host zone is permitted
  3. All inter-zone traffic is permitted by default
  4. All inter-zone traffic is denied by default Correct answer.

Explanation

Junos security policy has an implicit default deny for inter-zone traffic, so any permitted flow requires an explicit policy. Intra-zone traffic is permitted by default, which is a separate behavior from inter-zone transit.

Question 4Security Platform and Architecture

Which two elements are required when configuring a stateful firewall policy on an SRX Series device?

  1. A NAT pool and a destination address
  2. A source zone and a destination zone Correct answer.
  3. A routing instance and a policy statement
  4. A screen profile and an application firewall rule

Explanation

Every Junos security policy is defined from a source zone to a destination zone, and the match conditions then reference addresses and applications. NAT pools, routing instances, and screen profiles are optional features rather than mandatory policy components.

Question 5Security Platform and Architecture

What is the primary function of the junos-host zone on an SRX Series device?

  1. It controls traffic destined to or originating from the device itself Correct answer.
  2. It provides a default zone for all unassigned interfaces
  3. It handles only management traffic on the fxp0 interface
  4. It carries transit traffic between two untrust zones

Explanation

The junos-host zone applies policies to traffic whose destination or source is the device itself, such as management access or control-plane protocols. It does not carry transit traffic and is not a catch-all for unassigned interfaces.

Question 6Security Platform and Architecture

Which statement accurately describes how an SRX device handles the first packet of a new TCP session when a matching permit policy exists?

  1. It performs a route lookup and creates a session entry after policy evaluation Correct answer.
  2. It sends the packet to the Routing Engine for inspection
  3. It forwards the packet immediately without creating a session entry
  4. It drops the packet and waits for a retransmission before creating a session

Explanation

For the first packet, the SRX performs a route lookup to select the egress zone, evaluates policy, and on a permit creates a session entry in the flow table. Subsequent packets match the session and are forwarded without repeating full policy evaluation.

Question 7Security Platform and Architecture

An engineer wants to confirm which SPU is processing a specific flow on a high-end SRX chassis cluster. Which command displays the session with its SPU information?

  1. show security flow session extensive Correct answer.
  2. show security zones
  3. show route forwarding-table
  4. show chassis cluster status

Explanation

The extensive form of show security flow session includes details such as the SPU or session token handling the flow, along with NAT and policy references. The other commands show cluster status, zone configuration, or forwarding entries without per-session SPU detail.

Question 8Security Platform and Architecture

Which address book entry type allows a single policy to reference a group of addresses that can be updated centrally without editing the policy?

  1. A global address book prefix list
  2. A NAT address pool
  3. A dynamic VPN address assignment
  4. An address-set that contains multiple address entries Correct answer.

Explanation

An address-set groups multiple address entries so a policy can reference the set and remain unchanged when members are added or removed. Address books may be zone-based or global depending on configuration, but the grouping construct is the address-set.

Question 9Security Platform and Architecture

An engineer configures an application firewall rule that must inspect HTTP traffic for a specific pattern. Which SRX feature must be enabled on the policy for the rule to take effect?

  1. Unified threat management inspection with application firewall enabled Correct answer.
  2. MPLS label switching
  3. Stateful SYN cookie protection
  4. Class of service scheduling

Explanation

Application firewall rules are applied when the policy enables the appropriate UTM or application firewall inspection profile. SYN cookie protection, CoS, and MPLS are unrelated features that do not trigger application firewall rule evaluation.

Question 10Security Platform and Architecture

Which statement describes the role of screens in an SRX security design?

  1. They define the encryption algorithms used for IPsec tunnels
  2. They determine which interfaces belong to which zone
  3. They provide address translation for outbound traffic
  4. They detect and mitigate anomalies such as floods and malformed packets before policy evaluation Correct answer.

Explanation

Screen options provide stateless and stateful attack detection, such as SYN flood and IP spoofing protection, applied at the zone level before session policy processing. They do not handle encryption, zone membership, or NAT.

Question 11Security Platform and Architecture

In an SRX chassis cluster, which component is shared between the two nodes to allow session state to survive a failover?

  1. The session synchronization channel between the control links Correct answer.
  2. The forwarding table on each PFE
  3. The NAT pool allocation
  4. The Routing Engine configuration

Explanation

Chassis cluster nodes synchronize session state over the control link fabric so that established sessions can continue after a failover. Routing Engine configuration, forwarding tables, and NAT pools are separate per-node constructs that are not the synchronization mechanism.

Question 12Security Platform and Architecture

Which redundancy group in an SRX chassis cluster typically owns the data-plane processing for a given redundancy group ID?

  1. The redundancy group that is primary for that group ID Correct answer.
  2. The redundancy group assigned to the fabric link
  3. The redundancy group assigned to the fxp0 interface
  4. The redundancy group that is secondary for that group ID

Explanation

Each redundancy group has a primary and secondary node, and the primary node owns the data-plane processing for that group. The secondary node is ready to take over if a failover occurs.

Question 13Security Platform and Architecture

An engineer needs to ensure that management traffic to the device is permitted while transit traffic remains denied. Which configuration element controls access to the device itself?

  1. A security policy from the junos-host zone Correct answer.
  2. A security policy between two transit zones
  3. A screen profile on the untrust zone
  4. A NAT source rule

Explanation

Policies involving the junos-host zone govern traffic destined to or sourced from the device, including management access. Transit policies, NAT rules, and screens do not directly authorize host-bound management traffic.

Question 14Security Platform and Architecture

Which statement correctly describes the relationship between a global address book and a zone address book on SRX Series devices?

  1. A global address book can be referenced by policies across multiple zones Correct answer.
  2. A global address book is used only for NAT and not for policies
  3. A zone address book is automatically copied into the global address book
  4. A zone address book can be referenced only by policies in other zones

Explanation

Global address book entries are available to policies regardless of zone, which simplifies designs with many zones. Zone address books are scoped to their zone and are not automatically merged into the global book.

Question 15Security Platform and Architecture

A policy references an application-set containing multiple applications. What is the effect of this configuration?

  1. The policy matches only traffic that uses all applications simultaneously
  2. The policy matches traffic for any application in the set Correct answer.
  3. The policy matches traffic only if the application set is empty
  4. The policy matches traffic based on source port only

Explanation

An application-set is a logical OR of its members, so a policy referencing the set matches traffic for any application contained in it. It does not require simultaneous use of every member, and it still evaluates the configured match criteria.

Question 16Security Platform and Architecture

Which SRX feature allows inspection of encrypted traffic by terminating and re-originating the TLS session?

  1. Class of service
  2. IPsec tunnel mode
  3. Stateful SYN cookie protection
  4. SSL forward proxy Correct answer.

Explanation

SSL forward proxy terminates the client TLS session, inspects the plaintext, and re-originates a session to the server, enabling inspection of encrypted traffic. IPsec protects tunnels, while SYN cookies and CoS do not decrypt TLS.

Question 17Security Platform and Architecture

An engineer deploys two SRX devices in an active/active chassis cluster and wants traffic for different redundancy groups to be processed on different nodes. Which configuration is required?

  1. Assign the same redundancy group ID to all reth interfaces
  2. Configure both nodes as primary for the same redundancy group
  3. Assign different redundancy group IDs to different interface reth pairs Correct answer.
  4. Disable session synchronization between nodes

Explanation

Active/active behavior is achieved by placing different reth interfaces in different redundancy groups so that each node is primary for some groups. Using a single group or making both nodes primary for the same group does not distribute processing.

Question 18Security Platform and Architecture

Which statement best explains why session affinity matters when designing an SRX chassis cluster with active/active redundancy groups?

  1. It disables session synchronization to reduce overhead
  2. It forces all sessions to be re-evaluated on every packet
  3. It guarantees that all traffic uses the primary node regardless of group ownership
  4. It ensures return traffic for a flow is processed by the same node that handled the forward direction Correct answer.

Explanation

Session affinity keeps both directions of a flow on the same node so stateful inspection remains consistent and return traffic is not dropped. It is not about forcing all traffic to one node and does not disable synchronization.

Question 19Security Platform and Architecture

Which statement describes the function of the control link in an SRX chassis cluster?

  1. It carries all transit data traffic between nodes
  2. It encrypts all inter-zone traffic
  3. It carries session synchronization and cluster control traffic between nodes Correct answer.
  4. It provides power redundancy to both nodes

Explanation

The control link (and its fabric counterpart) carries control messages and session synchronization between cluster nodes. Transit data traffic uses the fabric data path, and the control link does not provide power or encryption services.

Question 20Security Platform and Architecture

A security architect wants to reduce the attack surface on an SRX device by limiting which protocols can reach the device on an untrust interface. Which configuration achieves this?

  1. Enable all system services on the untrust zone
  2. Apply a NAT destination rule to the untrust interface
  3. Disable the junos-host zone
  4. Configure host-inbound-traffic to permit only the required system services on the untrust zone Correct answer.

Explanation

Host-inbound-traffic settings on a zone control which protocols are accepted by the device on that zone's interfaces, so restricting them to required services reduces exposure. NAT rules and enabling all services do not limit the attack surface, and the junos-host zone cannot simply be disabled.

Question 21Security Platform and Architecture

Which statement accurately describes how a screen profile is applied in an SRX security design?

  1. It is applied to a policy and inspects only permitted sessions
  2. It is applied to a routing instance and inspects control-plane traffic
  3. It is applied to a NAT pool and inspects translated traffic
  4. It is applied to a zone and inspects traffic entering that zone Correct answer.

Explanation

Screen profiles are attached to zones and evaluate traffic as it enters the zone, allowing anomalies to be dropped before session policy processing. They are not attached to policies, NAT pools, or routing instances for this purpose.

Question 22Security Platform and Architecture

An engineer observes that a newly configured policy is not matching traffic. Which factor is most likely to prevent the policy from being evaluated?

  1. The policy is in the same zone pair as the traffic
  2. The policy is placed below a broader policy that already matches the traffic Correct answer.
  3. The policy references an address-set with one member
  4. The policy uses a predefined application

Explanation

Junos evaluates policies in order within a zone pair and stops at the first match, so a broader earlier policy can shadow a later specific one. Address-sets, predefined applications, and correct zone pairing do not by themselves prevent evaluation.

Question 23Security Platform and Architecture

Which statement best describes the purpose of a security intelligence or dynamic address feed in an SRX design?

  1. It assigns IP addresses to VPN clients
  2. It updates policy match data from external threat feeds without manual edits Correct answer.
  3. It provides encryption for management sessions
  4. It replaces the need for security zones

Explanation

Dynamic address feeds let the device consume external threat intelligence and use it in policy matching, so malicious sources can be blocked without manually editing policies. They do not replace zones, provide encryption, or allocate VPN addresses.

Question 24Security Platform and Architecture

An architect must choose between flow-based and packet-based processing for a specific deployment. Which statement correctly characterizes flow-based processing on SRX?

  1. Policy is evaluated only on the Routing Engine
  2. The first packet creates a session and subsequent packets are forwarded by session lookup Correct answer.
  3. Every packet is independently inspected against the full policy
  4. Sessions are created only after the TCP handshake completes

Explanation

Flow-based processing creates a session on the first permitted packet and forwards later packets by session lookup, which improves performance. It does not inspect every packet against the full policy, nor does it defer session creation until the handshake completes.

Question 25Security Platform and Architecture

Which statement accurately describes how NAT interacts with security policy evaluation on an SRX device?

  1. Policy is always evaluated after all NAT translations are applied
  2. Policy is evaluated using pre-NAT source and post-NAT destination addresses depending on direction Correct answer.
  3. Policy is evaluated only on translated addresses in both directions
  4. NAT is applied only after a session is closed

Explanation

Junos security policy evaluation uses the pre-NAT source address and the post-NAT destination address for the initial direction, which is why NAT rule order and policy address books must be designed together. It is not a simple post-NAT or translated-only evaluation, and NAT is not deferred until session close.

Question 26Security Platform and Architecture

An architect is designing a new SRX deployment and wants to ensure that the device can inspect traffic for threats while maintaining high throughput. Which two components are primarily responsible for packet forwarding and security processing in an SRX Series device?

  1. Flow Daemon and Session Manager
  2. Routing Engine and Packet Forwarding Engine
  3. Security Processing Unit and Network Processing Unit Correct answer.
  4. Control Plane and Data Plane

Explanation

SRX Series devices use dedicated Security Processing Units (SPUs) for security inspection and Network Processing Units (NPUs) for forwarding, enabling high throughput. The Routing Engine handles control plane functions, and the Packet Forwarding Engine encompasses NPUs and SPUs, but the specific components for security and forwarding are SPU and NPU. Flow daemon and session manager are software modules, not hardware components.

Question 27Security Platform and Architecture

A network engineer is deploying an SRX chassis cluster and needs to ensure that management traffic to the cluster remains accessible even if the primary node fails. Which statement correctly describes the recommended management interface configuration for a chassis cluster?

  1. Configure a reth interface for management and assign it to redundancy group 0.
  2. Configure a single management interface on the primary node only and use a backup interface on the secondary node.
  3. Configure management interfaces on both nodes and assign them to the same redundancy group as the data plane.
  4. Configure a dedicated management interface on each node and use a separate management network for out-of-band access. Correct answer.

Explanation

In a chassis cluster, each node should have its own management interface connected to a separate management network to ensure out-of-band access regardless of failover state. Management interfaces are not typically part of redundancy groups because they are used for out-of-band management. Using a reth interface for management is not supported because reth interfaces are for data plane traffic.

Question 28Security Platform and Architecture

An engineer is troubleshooting why a new security policy is not being evaluated for certain traffic. The policy is placed at the bottom of the policy list. What is the most likely reason that the policy is not matching?

  1. The policy is disabled by default.
  2. A more specific policy above it is matching the traffic first. Correct answer.
  3. The policy is applied to the wrong zone.
  4. The policy does not have a logging action configured.

Explanation

SRX security policies are evaluated in order from top to bottom, and the first matching policy is applied. If a more specific policy above the new policy matches the traffic, the new policy will not be evaluated. Policies are not disabled by default, logging does not affect matching, and zone misconfiguration would cause the policy not to match at all, but the question implies the policy is not matching because of its position.

Question 29Security Platform and Architecture

A security architect is designing a solution that requires inspection of traffic between two internal zones. The traffic must be inspected by the SRX, but the architect wants to avoid asymmetric routing issues. Which deployment mode should be used?

  1. Tap mode
  2. NAT mode
  3. Route mode Correct answer.
  4. Transparent mode

Explanation

In route mode, the SRX acts as a router and inspects traffic between zones, ensuring symmetric routing by design because it is the default gateway for the zones. Transparent mode (also known as bump-in-the-wire) can introduce asymmetric routing if not carefully designed. NAT mode is not a deployment mode but a feature. Tap mode is for monitoring only and does not inspect in-line.

Question 30Security Platform and Architecture

An engineer needs to configure an SRX device to allow HTTP traffic from the untrust zone to a web server in the DMZ zone, but only to the specific server IP address. Which two elements must be configured in the security policy to achieve this?

  1. Source zone untrust, destination zone DMZ, source address any, destination address any, application HTTP
  2. Source zone untrust, destination zone DMZ, source address any, destination address web server IP, application any
  3. Source zone untrust, destination zone DMZ, source address any, destination address web server IP, application HTTP Correct answer.
  4. Source zone DMZ, destination zone untrust, source address web server IP, destination address any, application HTTP

Explanation

A security policy must specify the source zone, destination zone, source address, destination address, and application. To allow HTTP only to the specific web server, the destination address must be the web server IP, and the application must be HTTP. The source address can be any. The other options either allow too much traffic or have incorrect zones.

Question 31Security Platform and Architecture

An engineer is configuring a chassis cluster and wants to ensure that the control link failure does not cause a split-brain scenario. Which feature should be enabled?

  1. Split brain detection Correct answer.
  2. Control link recovery
  3. Heartbeat monitoring
  4. Redundancy group failover

Explanation

Split brain detection is a feature that prevents both nodes from becoming primary when the control link fails. It uses a backup method, such as a fabric link or a separate heartbeat, to determine which node should remain primary. Control link recovery is not a standard feature name, heartbeat monitoring is part of detection but not the feature itself, and redundancy group failover is the result of failover, not prevention of split brain.

Question 32Security Platform and Architecture

A security administrator is configuring an SRX device to perform source NAT for traffic originating from the trust zone and going to the untrust zone. The administrator wants to ensure that the source IP address is translated to the egress interface IP address. Which NAT configuration should be used?

  1. Static NAT with interface address
  2. Destination NAT with pool address
  3. Source NAT with pool address
  4. Source NAT with interface address Correct answer.

Explanation

Source NAT with interface address translates the source IP to the IP address of the egress interface. This is commonly used for hide NAT. Source NAT with a pool uses a configured address pool, destination NAT translates the destination IP, and static NAT maps one-to-one addresses.

Question 33Security Platform and Architecture

An engineer is designing a security policy for an SRX device and wants to ensure that traffic is logged at session close. Which action should be configured in the policy?

  1. log session-close Correct answer.
  2. count
  3. session-close
  4. log

Explanation

The 'log session-close' action in a security policy logs traffic when the session is closed. The 'log' action logs at session start, 'count' counts packets but does not log, and 'session-close' alone is not a valid action.

Question 34Security Platform and Architecture

An architect is evaluating the use of application firewall features on an SRX device. Which statement correctly describes the function of the application firewall?

  1. It enforces security policies based on application-layer attributes. Correct answer.
  2. It performs IPsec VPN termination.
  3. It provides antivirus scanning for email attachments.
  4. It routes traffic between zones based on destination IP.

Explanation

The application firewall on SRX enables enforcement of security policies based on application-layer attributes, such as HTTP URLs, headers, and content. Antivirus scanning is a separate UTM feature, IPsec VPN termination is a different function, and routing is handled by the routing engine.

Question 35Security Platform and Architecture

A network engineer is configuring a chassis cluster and needs to ensure that the control link is redundant. Which statement correctly describes a recommended practice for control link redundancy?

  1. Use a single control link with high bandwidth.
  2. Configure two control links on different physical interfaces. Correct answer.
  3. Use a control link that is shared with the fabric link.
  4. Configure the control link as a reth interface.

Explanation

For redundancy, it is recommended to configure two control links on separate physical interfaces to avoid a single point of failure. A single control link, even with high bandwidth, is not redundant. Sharing with the fabric link is not recommended because it can cause contention. Control links cannot be reth interfaces because they are not data plane interfaces.

Question 36Security Platform and Architecture

An engineer is troubleshooting a chassis cluster and notices that the secondary node is not receiving session synchronization updates. Which component is responsible for synchronizing sessions between nodes?

  1. Management interface
  2. Fabric link
  3. Data link
  4. Control link Correct answer.

Explanation

Session synchronization in a chassis cluster occurs over the control link, which is a dedicated link between the nodes. The fabric link carries data traffic between SPUs, the management interface is for out-of-band management, and data links carry user traffic.

Question 37Security Platform and Architecture

A security architect is designing a solution that requires the SRX to inspect traffic between two virtual routers. Which feature should be used to enable communication between the virtual routers while applying security policies?

  1. Inter-VR routing with security policies Correct answer.
  2. Virtual Router Routing Instance
  3. Policy-based routing
  4. Next-hop tunnel

Explanation

To inspect traffic between virtual routers, you configure inter-VR routing and apply security policies to the traffic. Virtual Router Routing Instance is a concept, but the feature that enables communication with policy enforcement is inter-VR routing. Policy-based routing and next-hop tunnels do not inherently provide security policy inspection between VRs.

Question 38Security Platform and Architecture

An engineer is configuring a high-availability cluster and wants to ensure that the backup node can take over quickly if the primary fails. Which factor most affects the failover time?

  1. The number of redundancy groups.
  2. The heartbeat interval and threshold. Correct answer.
  3. The speed of the control link.
  4. The number of sessions synchronized.

Explanation

Failover time is primarily determined by the heartbeat interval and threshold; a shorter interval and lower threshold result in faster detection of failure and quicker failover. The number of sessions, control link speed, and number of redundancy groups can influence but are not the primary factors.

Question 39Security Platform and Architecture

A security administrator is configuring an SRX device to block traffic from a specific country. Which feature should be used?

  1. Intrusion prevention system
  2. Application firewall
  3. Security intelligence feed Correct answer.
  4. URL filtering

Explanation

Security intelligence feeds can be used to block traffic based on geographic location by using a feed that contains IP addresses associated with countries. Application firewall, IPS, and URL filtering do not provide geographic blocking.

Question 40Security Platform and Architecture

An engineer is designing a VPN solution using SRX devices and wants to ensure that traffic is encrypted and authenticated. Which protocol should be used?

  1. SSL
  2. L2TP
  3. GRE
  4. IPsec Correct answer.

Explanation

IPsec provides encryption and authentication for VPN traffic. SSL is used for secure web traffic, GRE is a tunneling protocol without encryption, and L2TP is a tunneling protocol that does not provide encryption by itself.

Question 41Firewall Filters and Security Policies

On a Junos SRX, which statement correctly describes the evaluation of stateless firewall filters versus stateful security policies for transit traffic?

  1. Firewall filters apply only to host-inbound traffic, while security policies handle all transit traffic.
  2. Security policies are evaluated first, and firewall filters apply only to traffic that a policy has already permitted.
  3. Only one of the two mechanisms can be active on a given interface at a time.
  4. A firewall filter is evaluated first and can discard a packet before any security policy lookup occurs. Correct answer.

Explanation

Junos processes stateless filters in the packet-forwarding path before stateful policy inspection, so a filter term with a discard or reject action removes the packet regardless of what the policy would have decided. This ordering lets you drop unwanted traffic cheaply at the interface edge. Security policies operate later on permitted flows and create sessions.

Question 42Firewall Filters and Security Policies

Which configuration element is required before a security policy can reference a custom application in the from-application match?

  1. An address book entry that resolves to the application server.
  2. A predefined application-set that contains the custom application.
  3. A firewall filter term that classifies the traffic into a forwarding class.
  4. An application definition whose protocol and destination port match the traffic. Correct answer.

Explanation

Security policies match applications, and a custom application must exist under applications with its protocol and port (or ICMP type, or ALG) defined so the policy can reference it. Predefined applications are built in, but a custom one is user-defined. The policy then uses from-application with that name.

Question 43Firewall Filters and Security Policies

A policy is configured with match conditions from-zone trust to-zone untrust, source-address any, destination-address any, and application any, with action permit. What is the effect on traffic from trust to untrust?

  1. All traffic from trust to untrust that reaches policy evaluation is permitted. Correct answer.
  2. Only traffic matching predefined applications is permitted.
  3. The policy is invalid because any/any/any matches are not allowed.
  4. Traffic is permitted only if a session already exists.

Explanation

A policy with any for source, destination, and application matches all traffic between the specified zones, so any flow from trust to untrust that reaches evaluation is permitted and a session is created. Junos allows any matches in policies, though best practice is to be more specific. The zone pair still scopes the policy.

Question 44Firewall Filters and Security Policies

Which action in a firewall filter term silently discards a matching packet without sending any ICMP notification to the source?

  1. discard Correct answer.
  2. reject
  3. drop-and-log
  4. deny

Explanation

The discard action drops the packet without notifying the sender, which is useful for hiding the existence of a filter. The reject action drops the packet and returns an ICMP unreachable or TCP reset. The other two are not Junos filter terminating actions.

Question 45Firewall Filters and Security Policies

When a firewall filter is applied to a Junos interface with the input keyword, at what point in packet processing does it act?

  1. After Network Address Translation has been applied to the packet.
  2. Only after a security policy has created a session for the flow.
  3. As the packet arrives on the interface, before route lookup and policy evaluation. Correct answer.
  4. After the packet has been routed and before it is transmitted.

Explanation

An input filter is evaluated as the packet is received, before route lookup and before any stateful inspection or NAT. This is why input filters are commonly used to protect the device and drop unwanted traffic early. Output filters, by contrast, act just before transmission.

Question 46Firewall Filters and Security Policies

Which security policy match condition is used to reference a group of addresses defined once and reused across multiple policies?

  1. dynamic-address
  2. from-zone
  3. from-application
  4. source-address referencing an address book entry or address set Correct answer.

Explanation

Address book entries and address sets let you define addresses once in a zone's address book and reference them by name in policy source-address and destination-address matches. Address sets group multiple entries for reuse. The other options are zone or application matches, or not a policy match at all.

Question 47Firewall Filters and Security Policies

What does the count action in a firewall filter term accomplish?

  1. It terminates filter evaluation and discards the packet.
  2. It logs the packet header to the system log.
  3. It applies a policer to the matching traffic.
  4. It increments a counter for matching packets and continues to the next term. Correct answer.

Explanation

count is a non-terminating action that increments a named counter and lets evaluation continue to subsequent terms. It is useful for profiling traffic without altering its disposition. To also act on the traffic, combine count with a terminating action or place it in a term that does not terminate.

Question 48Firewall Filters and Security Policies

Which statement about the implicit deny at the end of a Junos security policy set is correct?

  1. Traffic not matching any policy is permitted and logged by default.
  2. The implicit deny applies only to inter-zone traffic, not intra-zone traffic.
  3. The implicit deny can be removed by deleting the last policy.
  4. Traffic not matching any policy is dropped because of the default deny-all policy. Correct answer.

Explanation

Junos security policy sets end with an implicit deny-all, so any traffic that does not match an explicit permit policy is dropped and a session is not created. This default-deny behavior is the reason explicit permit policies must be written for desired traffic. Intra-zone traffic is also subject to policy evaluation.

Question 49Firewall Filters and Security Policies

An SRX has two policies from zone trust to zone untrust: policy A matches application junos-http with action permit, and policy B matches application any with action deny. Policy A is above policy B. A user opens an HTTPS session to the internet. What happens?

  1. The session is denied only after policy A is evaluated twice.
  2. The session is permitted because any in policy B permits all traffic.
  3. The session is permitted because policy B is evaluated first.
  4. The session is denied because it does not match policy A and matches policy B. Correct answer.

Explanation

Policies are evaluated top-down and the first matching policy determines the action. HTTPS does not match junos-http, so evaluation continues to policy B, whose application any matches and whose action is deny. The session is therefore dropped.

Question 50Firewall Filters and Security Policies

You want to permit DNS from a specific server to any destination while denying all other traffic from that server's subnet. Which approach reflects correct Junos policy design?

  1. Place a permit policy matching the server address and junos-dns above a deny policy matching the subnet with application any. Correct answer.
  2. Use a single policy matching the subnet with application junos-dns and action permit.
  3. Rely on the implicit deny and add no policies.
  4. Place a deny policy matching the subnet above the permit policy for the server address.

Explanation

Because the first matching policy wins, the more specific permit must appear above the broader deny. The permit matches the server address and DNS application; the deny below matches the subnet with any application. This ordering permits DNS for the server and denies everything else from the subnet.