I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC practice questions

One question at a time. Build your JNCIP-SEC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Troubleshooting Security Policies and Security Zones

A Junos security device receives a session whose ingress and egress interfaces are both assigned to the trust zone. No intra-zone policy has been configured. How is the session handled?

  1. It is redirected to the global zone for policy evaluation.
  2. It is dropped by the default intra-zone policy. Correct answer.
  3. It is permitted because interfaces in the same zone are implicitly trusted.
  4. It is permitted only when the session uses a Junos default application.

Explanation

Junos applies an implicit default security policy to intra-zone traffic, and that default action is deny. An explicit intra-zone policy must be configured to permit sessions between interfaces that share a zone. Assigning interfaces to the same zone does not create an implicit trust relationship for transit traffic.

Question 2Troubleshooting Security Policies and Security Zones

You assign ge-0/0/5.0 to the trust zone and want to manage the device with SSH through that interface. The interface and zone are otherwise correctly configured. Which additional configuration is required on the device?

  1. A global policy that permits SSH from the trust zone.
  2. The ssh system service under the trust zone's host-inbound-traffic. Correct answer.
  3. The ssh protocol under the interface's host-inbound-traffic.
  4. A trust-to-trust security policy that permits junos-ssh.

Explanation

Traffic that terminates on the device itself is controlled by the zone's host-inbound-traffic configuration, not by a transit security policy. To allow SSH management through an interface in the trust zone, enable the ssh system service under that zone's host-inbound-traffic. The interface must also be assigned to the zone, which the scenario already states.

Question 3Troubleshooting Security Policies and Security Zones

A security policy must block a prohibited TCP session and immediately notify the client that the connection was refused. Which policy action accomplishes this?

  1. reject Correct answer.
  2. permit
  3. discard
  4. deny

Explanation

The reject action blocks the session and sends a notification to the client, using a TCP RST for TCP sessions and an ICMP unreachable for other protocols. The deny action drops the packet silently. Neither permit nor discard provides the requested notification.

Question 4Troubleshooting Security Policies and Security Zones

A global security policy permits HTTP from any zone to any zone. A from-zone trust to-zone untrust policy denies HTTP. A user in trust accesses an HTTP server in untrust. What is the result?

  1. The HTTP session is permitted because the global policy is evaluated first. Correct answer.
  2. The HTTP session is denied because zone-pair policies are evaluated first.
  3. The HTTP session is permitted only after both policies are logged.
  4. The HTTP session is denied because the more specific policy always wins.

Explanation

Junos evaluates global security policies before zone-pair policies, and the first matching policy determines the action. Because the global permit policy is evaluated first, the later trust-to-untrust deny policy is never reached for this HTTP session. Policy specificity does not override evaluation order.

Question 5Troubleshooting Security Policies and Security Zones

A session from trust to untrust matches both a destination NAT rule and a source NAT rule. At which point in the packet processing path does the security policy lookup occur?

  1. Before either NAT rule is applied.
  2. After destination NAT and before source NAT. Correct answer.
  3. Before destination NAT and after source NAT.
  4. After both destination NAT and source NAT.

Explanation

Junos performs destination NAT before security policy lookup and source NAT after policy lookup. Therefore the policy sees the translated destination address but the original source address. This ordering is important when policies reference NAT addresses.

Question 6Troubleshooting Security Policies and Security Zones

An administrator wants to determine which security policy would match a hypothetical session from 10.1.1.10 to 203.0.113.20 on TCP port 443 between the trust and untrust zones. Which operational command is designed for this?

  1. show security zones
  2. show security policies
  3. show security flow session
  4. show security match-policies Correct answer.

Explanation

The show security match-policies command simulates policy lookup for supplied zone, address, port, and protocol values without requiring live traffic. show security policies displays configuration, show security flow session displays installed sessions, and show security zones displays zone membership and host-inbound settings.

Question 7Troubleshooting Security Policies and Security Zones

A security policy in the trust-to-untrust zone pair references an application-set named WEB-APPS that contains junos-http and junos-https. A client opens a TCP session to port 443. How does the policy treat the session?

  1. The policy does not match because application sets cannot contain Junos default applications.
  2. The policy matches only if the destination port is also listed in a service.
  3. The policy does not match because only the first application in the set is evaluated.
  4. The policy matches because any member application in the set can satisfy the match. Correct answer.

Explanation

An application set matches when the traffic matches any member application in the set; order within the set does not restrict evaluation to the first entry. Because junos-https matches TCP port 443, the policy referencing WEB-APPS is a match. Application sets may contain Junos default applications and custom applications.

Question 8Troubleshooting Security Policies and Security Zones

A policy is configured from-zone trust to-zone untrust and permits any application. A host connected to an interface in the DMZ zone sends traffic to a server behind an interface in the untrust zone. No other policies exist. What happens?

  1. The traffic is permitted because the destination zone matches the policy's to-zone.
  2. The traffic is dropped because the source zone does not match the policy's from-zone. Correct answer.
  3. The traffic is permitted because the policy uses the any application.
  4. The traffic is dropped only if the source host fails its address book match.

Explanation

A zone-pair policy is a match only when both the from-zone and to-zone of the session equal the policy's configured zone pair. Traffic from DMZ to untrust does not match a trust-to-untrust policy, even when the policy uses the any application. With no other matching policy, the default deny action applies.

Question 9Troubleshooting Security Policies and Security Zones

A destination NAT rule translates 203.0.113.10 to 10.0.0.10 for traffic entering the untrust zone. A security policy from untrust to trust permits destination address 10.0.0.10. A client connects to 203.0.113.10:443. Which statement explains why the policy matches?

  1. The policy is evaluated before destination NAT, so it sees the original address 203.0.113.10.
  2. The policy matches only if a source NAT rule also translates the client address.
  3. The policy matches because destination NAT bypasses the security policy lookup.
  4. The policy is evaluated after destination NAT, so it sees the translated address 10.0.0.10. Correct answer.

Explanation

Destination NAT is applied before the security policy lookup, so the policy evaluates the translated destination address rather than the public VIP. A policy that permits 10.0.0.10 therefore matches sessions sent to 203.0.113.10 when the NAT rule translates to that address. The client's source address is not relevant to this destination match.

Question 10Troubleshooting Security Policies and Security Zones

A trust-to-trust policy is configured with action deny and matches all applications. SSH is enabled in the trust zone's host-inbound-traffic, and an administrator connects to the device's trust interface. What is the result?

  1. SSH succeeds only if a second policy explicitly permits junos-ssh.
  2. SSH is denied because the deny policy matches before host-inbound traffic is checked.
  3. SSH is denied because trust-to-trust policies override host-inbound services.
  4. SSH succeeds because host-inbound traffic is evaluated separately from security policy. Correct answer.

Explanation

Traffic destined to the device itself, such as SSH to a management interface, is governed by the zone's host-inbound-traffic settings and is not blocked by transit security policies. Once SSH is enabled as a host-inbound system service, the trust-to-trust deny policy does not affect the administrator's connection. A separate policy for junos-ssh is not required for device management.

Question 11Troubleshooting Security Policies and Security Zones

An administrator suspects that interface ge-0/0/7.0 was placed in the wrong security zone. Which operational command displays the zone-to-interface mapping on a Junos security device?

  1. show route
  2. show security policies
  3. show security zones Correct answer.
  4. show interfaces ge-0/0/7.0

Explanation

The show security zones command lists each security zone and the interfaces bound to it, so it directly verifies zone membership. The show interfaces command reports link and protocol state but not the zone; the other commands display policies or routes, not zone membership.

Question 12Troubleshooting Security Policies and Security Zones

A Junos security device has ge-0/0/2.0 in the trust zone and must form an OSPF adjacency over that interface. The interface and OSPF configurations are correct, but no OSPF hellos are received. What should be verified in the trust zone configuration?

  1. That the zone has a screen profile applied
  2. That host-inbound-traffic protocols ospf is enabled Correct answer.
  3. That the interface is configured as a Layer 3 interface
  4. That a security policy permits OSPF from trust to trust

Explanation

Host-inbound traffic controls traffic destined to the device itself, including routing protocol hellos; OSPF must be allowed as a host-inbound protocol in the zone. Screen profiles protect against floods but do not allow routing protocols, and a trust-to-trust policy is not needed for host-inbound OSPF.

Question 13Troubleshooting Security Policies and Security Zones

After adding a new security policy, an administrator wants to confirm whether the policy has matched any traffic. Which command displays the hit count for configured security policies?

  1. show security zones
  2. show security flow session
  3. show security policies hit-count Correct answer.
  4. show configuration security policies

Explanation

The hit-count option shows how many times each policy has been matched, which confirms whether traffic is reaching the policy. Flow session output shows active sessions but not per-policy counters, and configuration output shows only the configured policy text.

Question 14Troubleshooting Security Policies and Security Zones

A policy is configured from-zone trust to-zone untrust with source-address SERVER-A and destination-address any. SERVER-A is defined only in the untrust zone's address book. The commit fails. What is the cause?

  1. Address book entries must be defined in both the source and destination zones.
  2. The destination address any is not allowed in a policy; a specific address is required.
  3. The policy must use an application-set instead of an application when a named address is referenced.
  4. The source address in a policy is resolved in the source zone's address book, so SERVER-A must be defined in the trust zone or global address book. Correct answer.

Explanation

Junos resolves a policy's source-address in the source zone's address book and in the global address book, so an entry defined only in the untrust zone is not visible to a trust-to-untrust policy's source match. The destination value any is valid, entries do not need to be duplicated in both zones, and application-set usage has no bearing on address resolution.

Question 15Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy permits HTTP from any to any. A client in trust opens an HTTP session to a server in untrust. Which statement explains why the server's reply packets are allowed back to the client without a from-zone untrust to-zone trust policy?

  1. Junos automatically creates a mirror policy in the reverse zone pair for every permit policy.
  2. HTTP is a bidirectional application, so the policy applies in both directions.
  3. The Junos flow module permits return traffic for an established session that was permitted by the initial policy. Correct answer.
  4. The untrust zone's host-inbound-traffic configuration allows the reply packets.

Explanation

Security policies are evaluated when the session is created; once the session is permitted, the session table allows return traffic for that session without a reverse policy. Junos does not auto-create mirror policies, applications are not policy-direction-agnostic, and host-inbound traffic applies to traffic destined to the device itself.

Question 16Troubleshooting Security Policies and Security Zones

A security policy from trust to untrust is configured with a scheduler that permits traffic only between 08:00 and 17:00. At 20:00, a user reports that HTTP traffic is denied. The policy is enabled and the address and application matches are correct. What is the expected behavior?

  1. The policy is inactive outside the scheduled time, so the session is evaluated against later policies or the default deny. Correct answer.
  2. The scheduler changes the policy's application match to any outside the scheduled time.
  3. The policy remains active but logs the traffic as out-of-schedule.
  4. The scheduler causes the policy to match but with a reject action.

Explanation

A policy schedule determines when the policy is active; outside the configured time, the policy is skipped and evaluation continues with later policies or the default deny. A schedule does not keep the policy active with logging only, does not change the action to reject, and does not modify the application match.

Question 17Troubleshooting Security Policies and Security Zones

An administrator attempts to add ge-0/0/9.0 to the untrust zone, but the commit fails with a message that the interface is already assigned. Which condition explains this failure?

  1. The interface is already used by a NAT rule, which prevents zone assignment.
  2. The interface is already a member of another security zone, and an interface can belong to only one zone. Correct answer.
  3. The interface is configured as a trunk port and cannot be used in a security zone.
  4. The interface has no IP address configured, so it cannot be assigned to a zone.

Explanation

In Junos, a logical interface can be assigned to only one security zone; the commit error indicates that ge-0/0/9.0 already belongs to a different zone. Trunk operation and NAT rule usage do not reserve an interface against zone assignment.

Question 18Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy includes source-identity USER-GROUP and permits HTTP. A user who has not authenticated to the Junos device attempts HTTP and is denied, even though the user's IP address matches the policy's source-address. What is the most likely reason?

  1. The user's traffic is denied because HTTP is not a supported identity application.
  2. Source-identity policies are evaluated only after the default deny policy.
  3. The policy's application must be set to any for identity-based policies to match.
  4. The identity-based policy requires a recognized user identity, and an unauthenticated user does not match source-identity. Correct answer.

Explanation

When source-identity is configured, the policy matches only traffic associated with a recognized user; if the user has not authenticated and no identity is known, the policy does not match and evaluation continues. Identity policies are not evaluated after the default deny, application any is not required, and HTTP is supported for identity-based policy matching.

Question 19Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy initially permits HTTP. The administrator changes the policy action to deny, but users with existing HTTP sessions continue to browse successfully. What explains this behavior and what action enforces the new policy immediately?

  1. The policy change requires a commit full to affect existing sessions; a normal commit is insufficient.
  2. Existing sessions are not re-evaluated after a policy action change; clearing the matching sessions forces new sessions to be evaluated against the deny policy. Correct answer.
  3. The policy change is ignored until the device is rebooted because security policies are loaded only at boot.
  4. The deny action applies only to new sessions after the session idle timeout, so no action can enforce it sooner.

Explanation

Security policy is checked at session setup, so established sessions remain in the session table with their original action even after the policy is changed. Clearing the relevant sessions removes them so subsequent packets create new sessions and match the updated deny policy.

Question 20Troubleshooting Security Policies and Security Zones

A site-to-site IPsec VPN connects a local trust subnet 10.1.1.0/24 to a remote subnet 10.2.2.0/24. The policy from-zone trust to-zone untrust permits 10.1.1.0/24 to 10.2.2.0/24 with action permit tunnel ipsec-vpn. Local users can initiate connections, but remote users cannot initiate connections to local servers. What is the most likely policy-related cause?

  1. The remote subnet must be added to the untrust zone's address book as an interface address.
  2. The trust-to-untrust policy must use action deny tunnel ipsec-vpn to allow return traffic.
  3. A policy from-zone untrust to-zone trust permitting 10.2.2.0/24 to 10.1.1.0/24 has not been configured. Correct answer.
  4. The IPsec tunnel requires a global policy instead of a zone-based policy for remote-initiated traffic.

Explanation

Security policies are unidirectional for session initiation; the trust-to-untrust policy allows local-initiated flows, but remote-initiated flows require a policy in the untrust-to-trust direction that permits the remote subnet to the local subnet. A deny action would not allow return traffic, global policy is not required, and an address book entry alone does not create a permit policy.

Question 21Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy set contains POLICY-ALL (source any, destination any, application any, action permit) as the first policy and POLICY-DENY (source any, destination 203.0.113.10, application junos-http, action deny) as the second policy. HTTP traffic to 203.0.113.10 is still permitted. What explains this behavior?

  1. junos-http cannot be referenced by a second policy in the same policy set.
  2. The deny action requires a companion reject policy to take effect.
  3. The untrust zone is missing a host-inbound-traffic exception for HTTP.
  4. Policies are evaluated top-down, and POLICY-ALL matches first. Correct answer.

Explanation

SRX security policies are evaluated from the first policy to the last, and the first policy whose match conditions are all satisfied is applied. A broad permit placed above a more specific deny shadows the deny, so the later policy is never examined. Move POLICY-DENY above POLICY-ALL, or narrow POLICY-ALL so it does not match the traffic that should be denied.

Question 22Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy permits application junos-http from any source to any destination. A user at 10.1.1.10 opens a TCP session to 198.51.100.20 on destination port 8080, and the session is denied. Which statement explains the result?

  1. junos-http matches any TCP port above 1024.
  2. junos-http requires HTTPS on TCP port 443.
  3. TCP port 8080 is blocked by the default deny-all policy.
  4. junos-http matches only TCP destination port 80. Correct answer.

Explanation

The predefined junos-http application represents TCP destination port 80, so a session to port 8080 does not satisfy the policy's application match condition. To permit that traffic, reference a custom application for TCP/8080 or include an application that matches the actual port. The default deny-all policy is not what blocked this session; the session simply did not match the permit policy.

Question 23Troubleshooting Security Policies and Security Zones

An administrator configured an IP address on lo0.0 and enabled SSH under that interface's host-inbound-traffic. SSH sessions to the loopback address still fail, although SSH to a trust-zone physical interface works. What is the most likely cause?

  1. lo0.0 is not assigned to a security zone. Correct answer.
  2. SSH must be enabled under the global system services stanza only.
  3. A security policy from trust to trust must permit SSH.
  4. The loopback interface cannot terminate SSH sessions.

Explanation

On a Junos security device, the loopback interface must be bound to a security zone before host-inbound services can be applied to it. Host-inbound-traffic is configured per zone, so an unassigned lo0.0 has no zone context and traffic to the loopback address is dropped. Assign lo0.0 to an appropriate zone and enable SSH as a host-inbound system service in that zone.

Question 24Troubleshooting Security Policies and Security Zones

A policy from-zone trust to-zone untrust references source-address APP-SERVER and destination-address any. APP-SERVER is defined only in the untrust zone's address book. The commit fails with an address book entry not found error. What is the correct fix?

  1. Define APP-SERVER in both zones with different IP addresses.
  2. Move the policy to from-zone untrust to-zone trust.
  3. Define APP-SERVER in the trust zone or global address book. Correct answer.
  4. Change destination-address any to the untrust zone's any address.

Explanation

A policy source address is resolved against the address book of the from-zone, while a destination address is resolved against the to-zone's address book. Because APP-SERVER is used as a source in a trust-to-untrust policy, it must exist in the trust zone's address book or in the global address book. Defining it in the untrust zone does not satisfy the source lookup.

Question 25Troubleshooting Security Policies and Security Zones

A from-zone trust to-zone untrust policy permits source-address 10.1.1.0/24 and application any. A source NAT rule translates 10.1.1.0/24 to 203.0.113.5 for the same traffic. Which source address does the security policy evaluate when deciding whether to permit the session?

  1. The translated 203.0.113.5 address, because source NAT precedes policy lookup.
  2. The egress interface address, because interface NAT rewrites the source.
  3. Both addresses, because the policy must match the original and translated source.
  4. The original 10.1.1.0/24 address, because source NAT follows policy lookup. Correct answer.

Explanation

In the SRX flow sequence, security policy is evaluated before source NAT is applied, so the policy matches the original pre-NAT source address. Source NAT rewrites the source only after the policy decision has been made. A policy that permits 10.1.1.0/24 therefore matches the traffic even though the packet leaves with 203.0.113.5 as its source.

Question 26Logical Systems and Tenant Systems

Which statement describes a Junos logical system on an SRX Series device?

  1. A separate physical device that is managed through the same Junos CLI session.
  2. A software partition with its own routing table, security zones, policies, and administrators. Correct answer.
  3. A backup Routing Engine that takes over when the primary Routing Engine fails.
  4. A routing instance that supports only static routes and cannot contain security policies.

Explanation

A logical system partitions one physical SRX into independent routing and security contexts. Each logical system maintains its own interfaces, zones, policies, NAT rules, routing table, and delegated administrators. It is not a separate physical device, and it is not a redundant Routing Engine.

Question 27Logical Systems and Tenant Systems

You need to place interface ge-0/0/5 unit 0 into logical system tenantA. Which configuration command accomplishes this?

  1. set interfaces ge-0/0/5 unit 0 logical-system tenantA
  2. set security zones tenantA interfaces ge-0/0/5.0
  3. set logical-systems tenantA interfaces ge-0/0/5 unit 0 Correct answer.
  4. set routing-instances tenantA interface ge-0/0/5.0

Explanation

Interfaces are assigned to a logical system under the [edit logical-systems tenantA interfaces] hierarchy. After that assignment, the interface unit is owned by the logical system and is configured within that partition. Zone membership alone does not transfer ownership of an interface.

Question 28Logical Systems and Tenant Systems

Which predefined login class gives a user full configuration rights inside an assigned logical system but not on the rest of the device?

  1. operator
  2. read-only
  3. logical-system-superuser Correct answer.
  4. super-user

Explanation

Junos provides logical-system-specific login classes, including logical-system-superuser. A user with this class is bound to a logical system through the logical-system statement and can configure only that partition. The super-user class grants device-wide configuration rights.

Question 29Logical Systems and Tenant Systems

Two logical systems must exchange routed traffic through an lt-0/0/0 interface. Which configuration is required on each logical unit of the lt interface?

  1. A redundant-interface statement that pairs the two logical systems.
  2. A tunnel destination address that points to the remote physical interface.
  3. An encapsulation gre statement on both units.
  4. A peer-unit statement that references the other logical unit. Correct answer.

Explanation

Logical tunnel interfaces use paired units, and each unit's peer-unit statement identifies the unit at the other end of the tunnel. The two units can then be assigned to different logical systems and given IP addresses in the same subnet. Local lt peering does not use a remote tunnel destination or GRE encapsulation.

Question 30Logical Systems and Tenant Systems

A service provider assigns logical system tenantB to a customer administrator. The administrator attempts to view security policies in logical system tenantC. What is the result?

  1. The administrator can view tenantC policies only after entering configuration mode.
  2. The administrator can view tenantC policies because all logical systems share one policy database.
  3. The administrator is denied because the login class scope is limited to tenantB. Correct answer.
  4. The administrator is prompted to authenticate as the master administrator.

Explanation

A logical-system administrator's permissions are scoped to the assigned logical system. The administrator cannot read or modify another tenant's zones, policies, NAT rules, or routing configuration. Only the master administrator or a device-wide super-user can manage all logical systems.

Question 31Logical Systems and Tenant Systems

Interface ge-0/0/7 unit 0 currently has an IP address in the master logical system. You want to assign it to logical system tenantD. What must you do first?

  1. Reboot the SRX into multi-tenant mode.
  2. Convert the interface to an lt interface.
  3. Create a VLAN tag on the interface.
  4. Delete the interface configuration from the master logical system. Correct answer.

Explanation

An interface unit can belong to only one logical system, so any existing configuration for that unit in the master logical system must be removed before it is assigned to tenantD. After removal, the interface is configured under [edit logical-systems tenantD interfaces]. Rebooting or changing the interface type is not required.

Question 32Logical Systems and Tenant Systems

Which statement about security zones in an SRX logical system is correct?

  1. A security zone can be shared by multiple logical systems if the interfaces use different VLANs.
  2. A single interface can belong to zones in two logical systems as long as the zone names differ.
  3. Security zones are defined only in the master logical system and are inherited by all tenants.
  4. Each logical system maintains its own security zones, and an interface in a zone must belong to that same logical system. Correct answer.

Explanation

Security zones are scoped to a logical system. When an interface unit is assigned to a logical system, that interface can be placed only in zones that exist within the same logical system. Zones cannot span logical systems, and the master logical system does not automatically share its zones with tenants.

Question 33Logical Systems and Tenant Systems

Traffic is routed between logical system LS1 and logical system LS2 through a logical tunnel interface. How is security policy enforced for this traffic?

  1. Only the master logical system applies policy because it owns the lt interface.
  2. Each logical system applies its own security policy to traffic entering or leaving its zones. Correct answer.
  3. A single shared policy is automatically copied to both logical systems.
  4. No policy is applied because inter-logical-system traffic bypasses security processing.

Explanation

Each logical system is an independent security context with its own zones and policies. Traffic arriving in LS1 from the logical tunnel interface is evaluated by LS1's policies, and traffic arriving in LS2 is evaluated by LS2's policies. The master logical system does not automatically govern tenant traffic.

Question 34Logical Systems and Tenant Systems

Which configuration task is restricted to the master logical system on an SRX Series device?

  1. Configuring security policies for a tenant logical system.
  2. Configuring chassis cluster parameters. Correct answer.
  3. Configuring NAT rules for a tenant logical system.
  4. Configuring security zones for a tenant logical system.

Explanation

Chassis cluster configuration is a system-level function and is performed in the master logical system. Tenant logical system administrators can configure policies, NAT rules, and zones within their own logical systems. They cannot change device-wide clustering parameters.

Question 35Logical Systems and Tenant Systems

What is the purpose of a security profile applied to a logical system on an SRX Series device?

  1. To assign physical interfaces to that logical system.
  2. To limit the resources, such as sessions or policies, that the logical system can consume. Correct answer.
  3. To authenticate administrators who log in to that logical system.
  4. To define the IPsec proposals used by that logical system.

Explanation

A logical system security profile sets resource ceilings for a tenant partition, such as the maximum number of sessions, policies, zones, or address books. It prevents one tenant from exhausting device resources needed by other tenants. It does not define IPsec parameters, authenticate users, or assign interfaces.

Question 36Logical Systems and Tenant Systems

Logical system LS1 contains security policy P1, which references zone trust and address book entry web-servers. Which resources can P1 actually use when it is evaluated?

  1. Only zones and address book entries that are defined inside LS1 Correct answer.
  2. Zones from LS1 combined with address book entries inherited from the master logical system
  3. The master logical system's address book, because address books are device-wide objects
  4. Any zone defined in the master logical system, provided the zone name matches exactly

Explanation

A logical system is a private security and routing context, so its policies, zones, addresses, and applications are resolved only inside that logical system. The master logical system's objects are not visible to a tenant policy, even when the names are identical.

Question 37Logical Systems and Tenant Systems

An administrator is logged in to the master logical system of an SRX Series device and wants to review only the configuration that belongs to logical system tenantA. Which command displays that configuration?

  1. show system configuration tenantA
  2. show logical-systems tenantA configuration
  3. show configuration logical-system tenantA
  4. show configuration logical-systems tenantA Correct answer.

Explanation

Logical system configuration is stored under the logical-systems hierarchy, so the master administrator displays that specific hierarchy. The singular form and the other orderings do not match the Junos configuration tree.

Question 38Logical Systems and Tenant Systems

Logical systems LS1 and LS2 each run OSPF and static routing on the same SRX Series device. How does the device handle their routing information?

  1. Routes go into a shared table, but each logical system filters the routes it is allowed to use.
  2. Both logical systems install their routes into the master inet.0 table and therefore share one routing table.
  3. Only the master logical system can run routing protocols; tenants must use the master's routes.
  4. Each logical system keeps its own routing table, separate from master and from other logical systems. Correct answer.

Explanation

A logical system is an independent routing context with its own routing tables and protocol instances. A route learned in LS1 is not installed in the master routing table and is not visible to LS2 unless it is redistributed or advertised explicitly.

Question 39Logical Systems and Tenant Systems

You connect logical system LS1 to logical system LS2 with an lt-0/0/0 interface. How are the logical interfaces on that physical interface organized?

  1. Four logical interfaces are required: two for ingress traffic and two for egress traffic.
  2. One logical interface per lt physical interface, and both logical systems must share it.
  3. A single unit carries all logical systems, and each logical system is identified by a VLAN tag.
  4. Units are paired, so unit 0 and unit 1 form the two endpoints of one tunnel. Correct answer.

Explanation

An lt interface is a virtual tunnel interface whose units are used in pairs, one unit configured in each logical system or routing instance. Traffic injected into one member of the pair emerges from its peer, which is why the units must be provisioned as a matched set.

Question 40Logical Systems and Tenant Systems

LS1 and LS2 both need source NAT for their own users. The administrator wants to name both pools pool1 but give them different address ranges. What is the result?

  1. It fails, because only the master logical system is allowed to define source NAT pools.
  2. It works only if both pools are bound to the same external interface in the master logical system.
  3. It works; source NAT pools are defined per logical system, so the name can be reused. Correct answer.
  4. It fails, because NAT pool names must be unique across the entire device and cannot be repeated in another logical system.

Explanation

NAT is part of the security configuration and is scoped to the logical system in which it is defined. Because each logical system has its own object namespace, the same pool name can exist in LS1 and LS2 with different addresses.

Question 41Logical Systems and Tenant Systems

You assign ge-0/0/5 unit 0 to logical system tenantA. Where are the physical link settings, such as speed and link mode, for ge-0/0/5 configured?

  1. In tenantA, because the entire interface moves when unit 0 is assigned to the logical system
  2. In both, because the settings are inherited from the master and can be overridden in tenantA
  3. In the master logical system, because physical properties stay with the physical interface Correct answer.
  4. In tenantA's routing instance, because link settings are scoped to a routing instance

Explanation

Only the logical unit is owned by the tenant logical system; the physical interface itself remains in the master logical system. Link-level parameters are therefore configured by the master administrator, while the unit's addressing and security settings are configured inside the tenant.

Question 42Logical Systems and Tenant Systems

A local user is configured with the super-user class and the logical-system LS1 statement. The user logs in and enters configuration mode. Which view does the user get?

  1. The LS1 configuration plus master system settings.
  2. Read-only access to LS1, because logical-system users cannot commit changes
  3. Full device configuration, because super-user is a device-wide class
  4. Only the LS1 configuration hierarchy, with commit rights inside that logical system Correct answer.

Explanation

Assigning a logical system to a user restricts the configuration context to that logical system. The login class then determines what the user can do within that context, so a super-user class gives full rights inside LS1 but not on the rest of the device.

Question 43Logical Systems and Tenant Systems

An administrator deletes logical system tenantB from the master logical system. What is the effect on tenantB's security policies and interface assignments?

  1. Policies move to the master's security hierarchy, and interfaces remain assigned to tenantB.
  2. The tenantB configuration is removed and its interface units are released. Correct answer.
  3. Policies are retained in the master as inactive, and interfaces stay with tenantB.
  4. Policies and interfaces are moved to a default logical system named tenant0.

Explanation

Deleting a logical system removes its entire configuration hierarchy, including zones, policies, address books, and interface unit assignments. The released interface units can then be assigned again, for example to another tenant or back to the master.

Question 44Logical Systems and Tenant Systems

The master logical system and logical system LS1 each contain an address book entry named server1, but with different IP addresses. A security policy in LS1 references server1. Which address does the policy match?

  1. Neither entry until the policy is committed from the master logical system
  2. The server1 defined in the master logical system
  3. The server1 defined inside LS1 Correct answer.
  4. Both entries, because address book names are resolved in every logical system

Explanation

Address book lookup happens in the namespace of the logical system that owns the policy. The master's entries are not visible inside a tenant, so the LS1 entry is the one that the LS1 policy resolves and matches.

Question 45Logical Systems and Tenant Systems

Traffic between LS1 and LS2 is routed over an lt-0/0/0 link. Which statement describes how the packet is handled?

  1. It passes directly between the two logical systems; the master is not a transit hop. Correct answer.
  2. It passes through the master logical system's routing table and security policies on the way.
  3. It bypasses security policies entirely because lt interfaces are internal to the device.
  4. It must be inspected by both the master and the destination logical system because lt is shared.

Explanation

The lt interface provides a direct internal link between the two logical systems, and each endpoint applies its own zone and policy context. The master logical system is not used as an intermediate router, so tenant-to-tenant traffic does not traverse master policy.

Question 46Logical Systems and Tenant Systems

Which configuration statement creates a logical system named tenantA on an SRX Series device?

  1. set logical-systems tenantA Correct answer.
  2. set routing-instances tenantA
  3. set system logical-system tenantA
  4. set tenants tenantA

Explanation

Logical systems are created from the master logical system under the [edit logical-systems] hierarchy, so the statement begins with set logical-systems followed by the name. Only the name is required at creation; interfaces, zones, policies, and routing options are then added inside that logical system node. The resulting object is a separate configuration and routing partition, not a routing instance.

Question 47Logical Systems and Tenant Systems

An SRX Series device is configured with logical systems tenantA and tenantB. Which statement about the master logical system on that device is correct?

  1. It is only reachable through the console port once one or more logical systems have been configured.
  2. It always exists, contains the logical-systems hierarchy, and cannot be removed from the device. Correct answer.
  3. It must be assigned at least one security zone before any logical system is allowed to commit its configuration.
  4. It is created automatically when the first logical system is committed and can be deleted once tenantA exists.

Explanation

The master logical system is the default partition that is present on every SRX Series device; it is not created or deleted through configuration. It owns the [edit logical-systems] hierarchy where tenant logical systems are defined, and the Junos CLI does not offer a way to remove it. Deleting a tenant removes that tenant's objects, but the master remains.

Question 48Logical Systems and Tenant Systems

User admin-a is configured with the super-user class and the logical-system tenantA statement. While working only inside logical system tenantA, admin-a issues the commit command. Which configuration is applied?

  1. Nothing is applied until a master logical system administrator reviews and approves the pending change.
  2. Only tenantA security policies are committed, while interface changes inside tenantA are held until the next commit.
  3. The entire device configuration is applied, including any uncommitted changes that a master administrator has staged.
  4. Only the tenantA configuration is committed; master logical system and other tenant settings are untouched. Correct answer.

Explanation

A user bound to a logical system commits within that logical system only, so the commit applies the tenantA configuration and leaves the master and other tenants as they are. Changes staged by other administrators in other partitions are not carried along by this commit. The platform does not use an approval workflow; commits take effect immediately for the scope the user owns.

Question 49Logical Systems and Tenant Systems

An administrator is logged in to the master logical system of an SRX Series device and must inspect the IPv4 routing table of logical system tenantB without switching CLI context. Which command accomplishes this?

  1. show route instance tenantB table inet.0 all
  2. show route logical-system tenantB table inet.0 Correct answer.
  3. show route table tenantB table inet.0 detail
  4. show logical-systems tenantB route table inet.0

Explanation

Operational commands executed from the master logical system accept the logical-system option, which selects the routing tables of the named tenant. Combining it with table inet.0 shows tenantB's IPv4 routes while the session stays in the master context. This is how a master administrator audits tenant routing without logging in as a tenant user.

Question 50Logical Systems and Tenant Systems

Which statement correctly describes the relationship between logical systems and routing instances on an SRX Series device?

  1. A routing instance can contain one or more logical systems, and each of those logical systems keeps its own security policy.
  2. A logical system can contain multiple routing instances, but a routing instance cannot contain a logical system. Correct answer.
  3. Each logical system maps to exactly one routing instance, and any additional routing instance requires a separate logical system.
  4. A logical system and a routing instance are the same Junos object, differing only in which CLI hierarchy you use to configure them.

Explanation

A logical system is the outer partition; it has its own security zones, policies, address books, and routing tables, and it can hold additional routing instances internally. The containment is strictly one-way, because a routing instance is a routing construct inside a partition and cannot own security policy or another logical system. A logical system also has a default routing instance of its own, so the relationship is not one-to-one.