JNCIP-SEC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Global policy order

In Junos security policy evaluation, global policies are checked before inter-zone policies, and inter-zone policies before intra-zone policies; the first matching policy is applied.

Default security policy

If no configured policy matches a flow, Junos applies the default deny-all policy; the session is dropped and, by default, the denial is not logged.

match-policies command

The show security match-policies operational command simulates policy lookup for specified from-zone, to-zone, source IP, destination IP, protocol, and ports without sending traffic.

Host-inbound traffic

Zone host-inbound-traffic settings permit specified system services and protocols, such as SSH, ping, or OSPF, to terminate on the SRX itself; missing entries block them.

Logical system

A logical system partitions a Junos device into an independent security and routing context with its own zones, policies, address books, routing tables, and administrators.

Tenant system

A tenant system is a logical system nested inside another logical system, giving a tenant its own security policy and zone namespace within a shared device.

Logical system interface

An interface is assigned to a logical system or tenant system with configuration hierarchy commands; it cannot be shared by two logical systems at the same time.

Logical system CLI

The set cli logical-system name command enters a logical system context, so subsequent show and configuration commands apply only to that logical system.

Transparent mode

SRX transparent mode forwards Layer 2 frames between interfaces in the same bridge domain while still applying security policies and Layer 2 inspection to the traffic.

DHCP snooping

DHCP snooping classifies ports as trusted or untrusted and builds a binding table of client MAC, IP, VLAN, and port; untrusted DHCP server messages are dropped.

Dynamic ARP inspection

DAI uses DHCP snooping bindings to validate ARP packets, dropping ARP replies that claim an IP-to-MAC mapping not present in the trusted binding table.

Storm control

Storm control monitors broadcast, multicast, or unknown unicast traffic on an interface and drops or disables the port when a configured threshold is exceeded.

Destination NAT order

Junos applies destination NAT before security policy lookup on ingress, so the policy sees the translated private destination address and port.

Source NAT order

Junos applies source NAT after security policy lookup on egress, so the policy sees the original source address before translation to a public address.

Persistent NAT

Persistent NAT keeps a source NAT binding after the session closes, allowing external hosts to reach the internal host through the same mapped address and port.

Proxy ARP for NAT

When a destination NAT address is not on the ingress interface subnet, configure proxy ARP on that interface so the SRX answers ARP for the public address.

IKE Phase 1

IKE Phase 1 negotiates the ISAKMP security association using encryption, hash, authentication, and Diffie-Hellman proposals; mismatched proposals prevent tunnel establishment.

IPsec Phase 2

Phase 2 negotiates the IPsec security association using IPsec proposals and optional perfect forward secrecy; both peers must agree on the traffic selectors.

st0 interface

A route-based IPsec VPN binds to an st0 tunnel interface; the st0 interface must be assigned to a security zone and permitted by policy.

Dead peer detection

DPD sends periodic probes to detect an unreachable IPsec peer; after the configured threshold, the SRX tears down the SA and can trigger failover.

APBR

Advanced policy-based routing selects a next-hop or routing instance based on application, user, source, destination, or URL category instead of destination IP alone.

APBR and AppID

APBR depends on application identification; before AppID recognizes the application, initial packets may follow the normal route and not the APBR rule.

APBR policy attachment

An APBR profile is attached to a security policy action; the flow must first be permitted by policy before APBR can override its routing.

APBR verification

Use show security advance-policy-based-routing statistics to check rule hits and show security flow session to see the selected next-hop or routing instance.

Multinode HA

Multinode high availability extends a Junos chassis cluster beyond two nodes, using control and fabric links to synchronize sessions and coordinate redundancy-group failover.

Redundancy group

A redundancy group is a failover unit in a chassis cluster; RG0 handles control plane and RG1 and higher handle data-plane security services.

Chassis cluster failover

The request chassis cluster failover redundancy-group number node number command manually moves a redundancy group to another node; reset restores normal priority.

Interface monitoring

Chassis cluster interface monitoring assigns weights to links; when the weight of failed monitored interfaces exceeds the redundancy-group threshold, the group fails over.

Security Intelligence feeds

SecIntel feeds download dynamic address entries for command-and-control, malware, GeoIP, and DNS categories; security policies match these dynamic addresses to block traffic.

Infected host detection

Infected host detection identifies internal hosts that contact known malicious destinations and can apply a quarantine or block action through automated threat mitigation policy.

Dynamic address groups

Dynamic address groups are policy address-book entries populated by security intelligence feeds, not manually configured; their contents update automatically as feeds change.

ATM feed licensing

Automated threat mitigation feed updates require a valid license and connectivity to Juniper cloud services; without updates, dynamic address entries become stale.