JNCIP-SEC study plan

Configure a source NAT pool with PAT and address-persistent so two internal hosts reuse translated addresses, then verify bindings with show security nat source summary.

Create a destination NAT rule mapping one public IP and port to an internal web server and confirm with show security flow session that return traffic is translated back.

Add static NAT with proxy ARP for an internal SMTP server and prove inbound and outbound sessions coexist on the same public address.

Configure persistent NAT in interface and target-host modes, then document which mode keeps a binding alive for a session that is initiated from outside.

Reproduce five deliberate NAT faults, including an overlapping pool and a rule-set bound to the wrong zone, and record the exact symptom each produces.

Build a route-based site-to-site VPN with IKEv2 and explicit traffic selectors, bringing Phase 1 and Phase 2 up before any policy references the tunnel.

Add a policy-based VPN alongside it and compare the troubleshooting paths using show security ike security-associations detail and show security ipsec sa detail.

Configure dead peer detection and vpn-monitor against a reachable target, then break the peer path and confirm the tunnel tears down as designed.

Enable next-hop tunnel binding across two gateways and verify with show security ipsec next-hop-tunnels that traffic follows the active tunnel after a failure.

Induce three faults - mismatched proxy IDs, wrong pre-shared key, and blocked NAT-T - and log the counter or event that identified each one.

Build a two-node chassis cluster with dual control links and fabric links, assign redundancy groups 0 and 1, and confirm show chassis cluster status matches the intended primary and secondary roles.

Configure reth interfaces over redundant Ethernet LAGs and validate that a single member link failure does not move the redundancy group.

Tune failover behaviour with priorities, preempt, heartbeat interval, and threshold, then trigger a controlled failover using request chassis cluster failover.

Implement IP monitoring on a reth interface so an upstream outage moves the redundancy group, and prove it with show chassis cluster ip-monitoring.

Capture control-plane and data-plane statistics before and after a failover and state which counters prove session synchronization actually worked.

Enable application identification and APBR, then write a profile and rule that sends one SaaS application out ISP-A and all remaining traffic out ISP-B.

Confirm rule matching with show services apbr statistics and show security flow session application, then reorder rules to observe first-match behaviour.

Bind APBR rules to a routing instance with dynamic tunnels and verify next-hop reachability before and after an ISP link failure.

Attach an APBR rule that matches a custom application signature and explain why the signature must be resolved before the rule can ever match.

Trace a session that failed to match any APBR rule and identify whether application identification, rule order, or next-hop resolution caused the miss.

Enrol the firewall with the cloud threat-intelligence service and confirm connectivity and enrolment state from the CLI before configuring any inspection.

Configure Advanced Anti-Malware with a verdict threshold and maximum file size, then attach it to a security policy that permits web traffic.

Add SecIntel category feeds, verify downloads with show security dynamic-address summary, and enforce a blocked category inside a security policy.

Configure SSL proxy with a forward-proxy profile so encrypted sessions receive inspection, and verify from the CLI that the proxy profile is being used.

Push an industry-standard antivirus test file through the policy and trace the verdict path from detection through logging to the automated block.

Trace a denied session from ingress zone to policy evaluation using show security match-policies, test policy, and flow traceoptions.

Build a policy set where a broad permit shadows a narrower deny, then fix the ordering without disabling logging on either rule.

Diagnose a zone misconfiguration in which an interface is bound to two zones, and state the commit error text and its resolution.

Use session counts and policy hit counters to prove a rule is dead, then remove it and confirm no traffic changes on the device.

Write a decision tree that narrows a policy or zone drop to addressing, application, ordering, or zone binding in four commands or fewer.

Build two logical systems with independent zones, address books, and routing instances, then pass traffic between them across an lt- interface.

Migrate that design to tenant systems under a security profile and list two Junos features that are unavailable to tenants.

Diagnose inter-logical-system forwarding failures caused by a missing route, a zone not bound to the lt- interface, and a policy placed in the wrong logical system.

Configure DHCP snooping, dynamic ARP inspection, and MAC limiting on access ports, then test a spoofed ARP packet and a MAC flooding attempt.

Enable storm control and BPDU blocking, and verify that a rogue BPDU or loop is contained without dropping legitimate user traffic.

Re-run the NAT lab cold and timed to 45 minutes, then score the result against the week 1 deliverable and note every command you had to look up.

Re-run the IPsec lab cold, including next-hop tunnel binding failover, without referencing notes or prior configuration files.

Take a full-length timed practice set across all eight domains and record accuracy per domain rather than a single total score.

Rebuild from scratch the two configurations tied to your lowest-scoring domains until both commit cleanly on the first attempt.