I85PREP
⌘ K
JNCIS-SEC study materials
JNCIS-SEC study resources

JNCIS-SEC practice questions

One question at a time. Build your JNCIS-SEC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SRX Series Firewall fundamentals

On an SRX Series firewall running Junos, which command displays the active security policy that would be evaluated for traffic sourced from the trust zone to the untrust zone?

  1. show security flow session zone trust
  2. show configuration security policies from-zone trust to-zone untrust Correct answer.
  3. show security policies zone-context trust untrust
  4. show security zones trust detail

Explanation

Security policies are configured and displayed within a from-zone/to-zone context, so the from-zone trust to-zone untrust hierarchy is the correct place to inspect the active policy set. The other commands display sessions, zone membership, or nothing relevant to policy evaluation order.

Question 2SRX Series Firewall fundamentals

What is the default behavior of an SRX Series firewall for transit traffic that matches no configured security policy between two zones?

  1. The traffic is silently discarded Correct answer.
  2. The traffic is permitted only if a screen profile is applied
  3. The traffic is redirected to the management interface
  4. The traffic is permitted and logged

Explanation

Junos security processing uses an implicit deny at the end of each zone pair's policy list, so unmatched transit traffic is dropped. Because no policy matches, no session is created and no log entry is generated unless a default deny policy is explicitly configured.

Question 3SRX Series Firewall fundamentals

Which zone type must be assigned to the interface that connects the SRX device to the Internet in a typical perimeter deployment?

  1. A Layer 2 transparent zone
  2. A functional zone such as the management zone
  3. A zone configured with the junos-host hostname
  4. A security zone with host-inbound services enabled Correct answer.

Explanation

Internet-facing interfaces are placed in a security zone so that policies, NAT, and screen options can be applied to transit traffic. Functional zones such as management are reserved for out-of-band control traffic and cannot carry transit security policies.

Question 4SRX Series Firewall fundamentals

A security policy is configured with the action permit and the option log session-close. When is the log entry generated?

  1. Only when the session is denied
  2. When the session is torn down Correct answer.
  3. When the first packet of the session is processed
  4. On every packet in the session

Explanation

The session-close logging option produces a log record when the session terminates, capturing summary information such as bytes and duration. Logging at session initiation requires the session-init option instead.

Question 5SRX Series Firewall fundamentals

Which statement describes the purpose of the junos-host zone on an SRX Series device?

  1. It governs traffic destined to or originated by the device itself Correct answer.
  2. It stores address book entries shared by all zones
  3. It carries transit traffic between two security zones
  4. It replaces the untrust zone in transparent mode

Explanation

The junos-host zone is a special context used to apply security policies to traffic addressed to the device, such as SSH or ICMP to an interface IP. Transit traffic between security zones is handled by normal from-zone/to-zone policies instead.

Question 6SRX Series Firewall fundamentals

Which two components are required before a security policy can reference an address in its source-address field? (Choose the single best answer.)

  1. A defined address book entry and a matching zone binding Correct answer.
  2. An application signature and an IDP policy
  3. A NAT pool and a screen profile
  4. A routing instance and a firewall filter

Explanation

Policy match criteria reference named address book entries, and those entries must exist in the address book of the zone named in the policy. Without the address object and the zone context, the policy cannot be committed.

Question 7SRX Series Firewall fundamentals

Which command displays the current session table on an SRX Series firewall?

  1. show security zones
  2. show security flow session Correct answer.
  3. show security policies hit-count
  4. show chassis forwarding

Explanation

The show security flow session command lists active sessions along with their policy, NAT, and state information. It is the primary tool for confirming that traffic is being permitted and tracked.

Question 8SRX Series Firewall fundamentals

What does the global policy configuration allow an administrator to do on an SRX Series firewall?

  1. Automatically generate NAT rules from address books
  2. Disable stateful inspection for all sessions
  3. Bypass zone assignment for transit interfaces
  4. Apply a single policy to traffic between any pair of zones Correct answer.

Explanation

Global policies are evaluated regardless of the specific from-zone and to-zone pair, which makes them useful for catch-all rules such as default deny or logging. Zone-pair policies are still evaluated first, so global policies act as a fallback layer.

Question 9SRX Series Firewall fundamentals

An administrator wants traffic from the trust zone to the untrust zone to be permitted only for HTTP and HTTPS while all other applications are denied. Which policy design achieves this?

  1. A global policy permitting any application
  2. A single deny policy matching any application
  3. A permit policy matching any application with logging enabled
  4. One permit policy matching application junos-http and junos-https, followed by a deny policy matching any Correct answer.

Explanation

Policies are evaluated top-down, so a permit policy scoped to the required applications followed by a deny-any policy produces the intended allow-list behavior. The explicit deny also enables logging of rejected traffic.

Question 10SRX Series Firewall fundamentals

Two policies exist from trust to untrust: policy A matches any source and any application with action permit, and policy B matches a specific server with application junos-ssh and action deny. SSH to that server is currently succeeding. What is the most likely cause?

  1. The session table is full
  2. Screen options are dropping the SSH packets
  3. Policy B was configured with the wrong source zone
  4. Policy A is positioned above policy B in the policy list Correct answer.

Explanation

Junos evaluates policies in order and stops at the first match, so a broad permit placed above a specific deny shadows the deny. Reordering so the specific policy appears first restores the intended behavior.

Question 11SRX Series Firewall fundamentals

Which policy action should be used to log denied traffic so that an administrator can review attempted connections that no permit policy allowed?

  1. permit with count
  2. deny with log Correct answer.
  3. permit with log session-close
  4. reject with count

Explanation

A deny policy with logging enabled records packets that match the deny rule, giving visibility into blocked attempts. Without an explicit deny-with-log rule, the implicit deny discards traffic silently.

Question 12SRX Series Firewall fundamentals

An SRX device has interfaces ge-0/0/1 in the trust zone and ge-0/0/2 in the untrust zone. A host on the trust side can ping the untrust gateway, but cannot reach a web server beyond it. Which troubleshooting step best isolates whether the SRX is dropping the traffic?

  1. Check the session table for a session matching the web server flow Correct answer.
  2. Verify the ge-0/0/1 link status
  3. Inspect the routing table for the default route
  4. Review the zone address book entries

Explanation

If no session exists for the web server flow, the SRX is likely dropping the traffic before session creation, pointing to policy, screen, or routing issues. A session in the table with no return traffic would instead suggest a downstream or return-path problem.

Question 13SRX Series Firewall fundamentals

Which statement about the order of policy evaluation for a packet entering the trust zone and exiting the untrust zone is correct?

  1. Policies from trust to untrust are evaluated first Correct answer.
  2. Policies from untrust to trust are evaluated first
  3. Both zone-pair directions are evaluated simultaneously
  4. Only global policies are evaluated

Explanation

The SRX evaluates policies in the from-zone of the ingress interface to the to-zone of the egress interface, so trust-to-untrust policies apply to traffic flowing in that direction. Global policies are consulted only after the zone-pair policy list is exhausted.

Question 14SRX Series Firewall fundamentals

A policy is configured with the application junos-https. Which behavior does this produce for a client connecting to TCP port 443?

  1. The SRX inspects the payload for HTTPS-specific threats before permitting
  2. The SRX requires an IDP policy to be attached
  3. The SRX permits the session based on the predefined application matching TCP port 443 Correct answer.
  4. The SRX translates the destination port to 8443

Explanation

junos-https is a predefined application object that matches TCP destination port 443, allowing the session without deep payload inspection by itself. Additional security features such as IDP or SSL inspection must be configured separately.

Question 15SRX Series Firewall fundamentals

An administrator creates a custom application that matches TCP destination port 8080 and references it in a policy. What must also be true for the policy to commit successfully?

  1. The zone must be configured as a functional zone
  2. The application object must exist and be referenced correctly in the policy Correct answer.
  3. The application must be defined in the global application set
  4. A NAT rule must reference the same application

Explanation

A policy can only reference application objects that exist in the configuration, whether predefined or user-defined. If the custom application definition is missing or misnamed, the commit fails.

Question 16SRX Series Firewall fundamentals

Which feature allows an SRX Series device to identify and control applications that use dynamic ports or tunnel other protocols?

  1. Class of service schedulers
  2. Virtual routers
  3. Application identification with application signatures Correct answer.
  4. Stateless firewall filters

Explanation

Application identification uses signatures to recognize applications beyond simple port matching, which is necessary for protocols that negotiate ports dynamically or tunnel inside other sessions. Standard predefined applications rely only on protocol and port.

Question 17SRX Series Firewall fundamentals

A security policy references address book entry web-server in the untrust zone, but the entry is actually defined in the trust zone address book. What is the result?

  1. The SRX automatically copies the entry to the untrust zone
  2. The commit fails because the referenced address is not found in the untrust address book Correct answer.
  3. The policy matches the address regardless of zone
  4. The policy matches but logs a warning

Explanation

Policy address references are resolved within the address book of the zone named in the policy, so an entry defined only in another zone cannot be resolved. The configuration check fails at commit with an error indicating the address is not defined.

Question 18SRX Series Firewall fundamentals

What is the effect of configuring the policy action reject instead of deny for TCP traffic?

  1. The SRX silently discards the packets with no response
  2. The SRX forwards the packets to the untrust zone for inspection
  3. The SRX permits the session but logs it
  4. The SRX sends a TCP reset to the client and drops the session Correct answer.

Explanation

The reject action actively notifies the client that the connection is refused, typically with a TCP reset for TCP traffic or an ICMP unreachable for UDP. The deny action instead discards traffic silently, which can cause clients to wait for timeouts.

Question 19SRX Series Firewall fundamentals

Which statement correctly describes how an SRX handles the return traffic for a session that was permitted by a trust-to-untrust policy?

  1. Return traffic is permitted because it matches the existing stateful session Correct answer.
  2. Return traffic requires a separate untrust-to-trust policy
  3. Return traffic is always denied by the implicit deny
  4. Return traffic must match a global policy

Explanation

The SRX is a stateful firewall, so once a session is established, return packets matching that session are allowed without a reverse policy. This is why administrators do not need to create mirror-image policies for each direction.

Question 20SRX Series Firewall fundamentals

An administrator wants to confirm which policy permitted a specific session. Which command output provides this information most directly?

  1. show interfaces ge-0/0/1 statistics
  2. show security flow session extensive Correct answer.
  3. show security zones
  4. show system alarms

Explanation

The extensive form of the flow session command includes the policy name and NAT details associated with each session. This lets an administrator map a live session back to the rule that allowed it.

Question 21SRX Series Firewall fundamentals

A security policy is configured with the source-address any and destination-address any, and the application any. Which additional consideration determines whether traffic between the zones is actually permitted?

  1. The policy must be duplicated in the reverse direction
  2. The policy requires a NAT rule to function
  3. The policy requires a screen profile to be attached
  4. The policy must be placed before any deny rules that would match the traffic Correct answer.

Explanation

Because policies are evaluated top-down and the first match wins, a broad permit-any policy only takes effect if no earlier policy matches the traffic. Ordering relative to other rules is therefore decisive.

Question 22SRX Series Firewall fundamentals

An SRX device has a policy from trust to untrust permitting junos-http. A user reports that HTTP to a public server fails, but the session table shows no session for the flow. Which conclusion is best supported?

  1. The return path is asymmetric
  2. The server is rejecting the connection
  3. The application object is misconfigured for port 80
  4. The SRX is dropping the packet before session creation, possibly due to routing or screen Correct answer.

Explanation

The absence of any session indicates the packet never passed policy and session setup, so the drop occurs earlier in processing, such as a routing failure or a screen check. Server rejection or asymmetric return traffic would typically appear as an established session.

Question 23SRX Series Firewall fundamentals

An administrator needs traffic between two internal zones to be inspected by a security policy but does not want the zones to be treated as trust or untrust. What is the recommended configuration?

  1. Create user-defined security zones and bind the interfaces to them Correct answer.
  2. Disable zone assignment for the interfaces
  3. Use functional zones for both interfaces
  4. Place both interfaces in the junos-host zone

Explanation

Security zones are user-defined names, so an administrator can create custom zones with appropriate names and bind interfaces to them. Policies are then written between those custom zones just like trust and untrust.

Question 24SRX Series Firewall fundamentals

A policy from trust to untrust matches application junos-ssh and has the action permit with count enabled. After a day of operation, the hit count remains zero although users report successful SSH sessions to external hosts. Which explanation is most plausible?

  1. The count option only increments for denied traffic
  2. The session table was cleared before the count was read
  3. An earlier policy matching the same traffic is permitting the sessions Correct answer.
  4. SSH uses UDP and is not matched by junos-ssh

Explanation

Counters increment only for the policy that actually matches and permits the session, so a zero count on this rule suggests another earlier rule is handling the traffic. Reviewing policy order and hit counts across the zone pair reveals the effective rule.

Question 25SRX Series Firewall fundamentals

Which design consideration explains why placing a broad permit-any policy at the top of a zone-pair policy list is discouraged?

  1. It disables stateful inspection for the zone pair
  2. It forces all traffic through the junos-host zone
  3. It converts the zone pair to transparent mode
  4. It prevents later, more specific policies from ever being evaluated Correct answer.

Explanation

Because the first matching policy wins, a broad permit at the top shadows every rule below it, making the more specific rules ineffective. Best practice is to order specific restrictive rules above broader ones.

Question 26SRX Series Firewall fundamentals

On an SRX Series firewall running Junos, which zone type is assigned to interfaces that face the public internet and typically host servers reachable from outside?

  1. The untrust zone, which is a predefined security zone with a default trust level of 5 Correct answer.
  2. The junos-host zone, which handles traffic destined to the device itself
  3. The trust zone, which is a predefined security zone with a default trust level of 100
  4. The null zone, which is used for interfaces that must not be inspected

Explanation

Junos software ships with predefined security zones: trust (level 100), untrust (level 5), and junos-host (traffic to the device). Interfaces facing the internet are normally bound to the untrust zone, whose low trust level means security policies must explicitly permit inbound sessions.

Question 27SRX Series Firewall fundamentals

Which statement describes the default behavior of an SRX Series firewall when an interface is bound to a zone but no security policy has yet been configured for the relevant zone pair?

  1. All transit traffic between zones is discarded because no policy exists to permit it Correct answer.
  2. Traffic is permitted only when the source zone has a higher trust level than the destination zone
  3. All transit traffic between zones is permitted because zones are trusted by default
  4. Only TCP traffic is permitted while UDP and ICMP are discarded

Explanation

Security policies on an SRX are evaluated to decide whether a session may be created, and the implicit default is to drop traffic that matches no policy. Trust levels alone do not authorize traffic; they are used for ordering and for features such as screens, not as an implicit permit.

Question 28SRX Series Firewall fundamentals

An administrator wants to reference the same host object in policies for several zone pairs and needs the object to be usable regardless of which zone the host resides in. Which address book configuration meets this requirement?

  1. Define the address as an application object and reference it in the destination-address field
  2. Define the address only in the untrust zone address book and reference it from the trust zone policy
  3. Define the address in the global address book and reference it from policies in any zone pair Correct answer.
  4. Define the address separately in each zone address book and reference each copy in its local policy

Explanation

The global address book holds objects that can be referenced by policies across all zones, which avoids duplicating the same prefix in multiple zone books. Zone address books remain scoped to their zone and can only be referenced by policies whose zone pair includes that zone.

Question 29SRX Series Firewall fundamentals

What is the purpose of the junos-host security zone on an SRX Series firewall?

  1. It provides a default zone for IPsec tunnel interfaces created by the administrator
  2. It groups all interfaces that are not yet assigned to a user-defined zone
  3. It governs traffic that is destined to the device itself, such as management access to an interface IP Correct answer.
  4. It governs traffic that transits between two physical interfaces on the device

Explanation

The junos-host zone is a predefined zone that represents the device itself, and host-inbound traffic policies applied to it control sessions terminating on the SRX. Transit traffic between interfaces is governed by the policies of the zone pair the packet traverses.

Question 30SRX Series Firewall fundamentals

An administrator needs to allow ping from the trust zone to the untrust zone while keeping all other traffic blocked. Which application reference in the policy accomplishes this?

  1. junos-icmp-ping, which matches ICMP echo request and reply Correct answer.
  2. junos-icmp-all, which matches every ICMP type including echo
  3. junos-ping-tcp, which matches TCP port 7 for echo service
  4. junos-udp-any, which matches all UDP ports used by ICMP

Explanation

Junos provides predefined applications for common protocols, and junos-icmp-ping specifically matches ICMP echo request and echo reply so that ping works while other traffic stays blocked. Using a broader ICMP application would permit additional message types beyond the requirement.

Question 31SRX Series Firewall fundamentals

A security policy is configured with source-address any and destination-address any but with a specific application junos-smtp. What does this policy match?

  1. SMTP sessions from any source to any destination within the policy's zone pair Correct answer.
  2. All sessions from any source to any destination regardless of protocol
  3. Only SMTP sessions between hosts in the same zone
  4. Only SMTP sessions whose source address is in the global address book

Explanation

The any keyword in the address fields matches every address, so the only restrictive match condition in this policy is the application, junos-smtp. The policy therefore permits SMTP flows between the zones of the pair while other applications are not matched.

Question 32SRX Series Firewall fundamentals

Which statement about the relationship between a zone and the interfaces bound to it on an SRX Series firewall is correct?

  1. An interface must be bound to the junos-host zone before it can be bound to a user zone
  2. An interface can be bound to up to two security zones for bidirectional inspection
  3. An interface inherits its zone from the routing instance name automatically
  4. An interface can be bound to only one security zone at a time Correct answer.

Explanation

Each logical interface is assigned to exactly one security zone, and that binding determines which zone-pair policies apply to traffic entering or leaving the interface. Changing the zone binding changes which policies govern the traffic.

Question 33SRX Series Firewall fundamentals

An administrator wants traffic entering the trust zone and exiting the untrust zone to be permitted for web browsing, and also wants a separate policy that permits DNS lookups. Which configuration approach applies these two policies correctly?

  1. Create the web policy in trust-to-untrust and the DNS policy in untrust-to-trust
  2. Create both policies in the global policy list so they apply to every zone pair
  3. Create the web policy in the trust zone address book and the DNS policy in the untrust zone address book
  4. Create both policies in the trust-to-untrust zone pair, with the DNS policy ordered according to the intended evaluation order Correct answer.

Explanation

Policies are configured within a zone pair, and multiple policies can coexist in the same pair with an evaluation order that determines which one matches first. Address books hold objects and do not themselves permit traffic, and the reverse zone pair governs sessions initiated from the untrust side.

Question 34SRX Series Firewall fundamentals

Which two pieces of information does the session table entry for an established flow contain that allow return traffic to be permitted without a new policy lookup? (Choose the best single answer.)

  1. The application name only, with no session state
  2. The source and destination addresses and ports of both directions of the flow Correct answer.
  3. The policy name only, with addresses resolved at forwarding time
  4. The zone names only, with no address or port details

Explanation

A session caches the full five-tuple for both directions, so return packets are matched to the existing session and forwarded without a fresh policy evaluation. This stateful behavior is what allows a policy that permits only the initiating direction to also pass replies.

Question 35SRX Series Firewall fundamentals

An administrator configures a policy action of reject for TCP traffic from trust to untrust. What does the client observe compared with a deny action?

  1. The client receives no response and the connection attempt times out
  2. The client receives an ICMP echo reply indicating the port is closed
  3. The client receives a TCP reset, so the connection attempt fails immediately Correct answer.
  4. The client is redirected to a captive portal page

Explanation

The reject action sends a TCP reset for TCP traffic, which causes the client to fail fast rather than wait for a timeout. The deny action silently drops the packet, so the client sees no response and eventually times out.

Question 36SRX Series Firewall fundamentals

Which command displays detailed information about a single session, including the policy that created it, when the session ID is known?

  1. show security flow session session-id <id> extensive Correct answer.
  2. show security zones
  3. show security policies hit-count
  4. show configuration security policies

Explanation

The flow session command with a session ID and the extensive option prints the full session detail, including the policy name that permitted the flow. This is the standard way to confirm which policy created a specific session.

Question 37SRX Series Firewall fundamentals

An SRX Series firewall is deployed with two ISP links, and the administrator wants sessions to fail over to the second link when the first link fails. Which feature provides this behavior?

  1. A security policy with the action permit-any applied to both links
  2. Junos-host zone policies applied to both ISP interfaces
  3. Interface monitoring with redundant Ethernet or link failover, which re-evaluates sessions and routes Correct answer.
  4. A global address book entry shared by both ISP interfaces

Explanation

Link redundancy features such as redundant Ethernet interfaces with interface monitoring, or route-based failover, detect a failed link and move traffic to the alternate path. Security policies and address books do not themselves provide link failure detection or session failover.

Question 38SRX Series Firewall fundamentals

An administrator notices that a policy from trust to untrust permitting junos-http is not matching sessions from a specific host, even though the host can reach other destinations. Which troubleshooting step best isolates whether the policy or the address object is at fault?

  1. Change the policy action to reject to see if the client receives a reset
  2. Reboot the device to clear stale sessions
  3. Disable all other policies in the zone pair to force a match
  4. Check the policy hit counters and the flow session detail to see which policy, if any, matched the host's session Correct answer.

Explanation

Policy hit counters show whether the intended policy is being evaluated and matched, while the session detail shows the policy actually applied to the flow. Comparing the two quickly separates a policy-matching problem from an address-object or routing problem.

Question 39SRX Series Firewall fundamentals

A security policy references a custom application that matches TCP destination port 8443, but sessions to that port are being dropped. The application object is defined correctly. Which configuration issue most likely explains the drop?

  1. The address book entry for the server is in the wrong zone
  2. The application is not included in the policy's application list, or a preceding policy matches the traffic first Correct answer.
  3. The interface is bound to the junos-host zone
  4. The session table is full

Explanation

A custom application only takes effect when it is referenced in the policy's application field and no earlier policy in the pair matches the flow first. If the application is omitted from the policy, or a broader policy precedes it, the traffic is handled by whatever rule actually matches.

Question 40SRX Series Firewall fundamentals

Which statement best explains why an SRX Series firewall evaluates security policies in order within a zone pair?

  1. Policies are evaluated only after the session is established
  2. All matching policies are applied and the most restrictive action wins
  3. Policies are evaluated in random order and the most specific match always wins
  4. The first policy that matches a new session determines the action, so specific policies should precede broad ones Correct answer.

Explanation

Policy evaluation is top-down within a zone pair, and the first matching policy supplies the action for the new session. Administrators therefore place specific rules above broad permit rules so that the intended specific action is applied.

Question 41Security policies and zones

A Junos security device processes a packet that matches a session already in its session table. Which security policy action is applied to that packet?

  1. The default deny action of the global policy
  2. The action configured in the firewall filter applied to the interface
  3. The action of the policy that created the session Correct answer.
  4. The action of the first policy in the zone pair

Explanation

Junos SRX is a stateful device: after the first packet of a flow creates a session, subsequent packets are matched against the session table and receive the action recorded for that session, not a fresh policy lookup. Policy evaluation only happens for the first packet of a new flow (or for traffic that is not session-cached).

Question 42Security policies and zones

In the Junos default policy order, which policy is evaluated last for traffic from the trust zone to the untrust zone?

  1. The implicit default deny-all policy Correct answer.
  2. The user-defined policy with the highest sequence number
  3. The junos-host zone policy
  4. The policy matching the source-any destination-any pair

Explanation

Junos evaluates policies in the order they appear, and if no user-defined policy matches, the implicit default policy (deny-all) is applied last. This implicit policy cannot be deleted, only its logging behavior adjusted.

Question 43Security policies and zones

Which zone is predefined on an SRX and is used for traffic that is addressed to the device itself, such as management and control-plane traffic?

  1. The untrust zone
  2. The null zone
  3. The trust zone
  4. The junos-host zone Correct answer.

Explanation

The junos-host zone is a predefined zone that represents the device itself. Traffic destined to the SRX (for example SSH, SNMP, or NTP to a device interface) is evaluated against policies between the source zone and junos-host.

Question 44Security policies and zones

An administrator issues the command 'show security policies hit-count'. What information does this command display?

  1. The number of addresses in each policy's address book
  2. The number of times each policy has been matched Correct answer.
  3. The number of zones bound to each policy
  4. The number of sessions currently active per policy

Explanation

The hit-count output shows how many times each configured policy has been matched since the counters were last cleared. It is commonly used to identify unused policies that can be safely removed or reordered.

Question 45Security policies and zones

Which statement correctly describes the relationship between zones and interfaces on an SRX running Junos?

  1. A single interface can belong to multiple security zones simultaneously
  2. Zones are automatically created when an interface is configured with an IP address
  3. Interfaces are assigned to zones only through the host-inbound-traffic configuration
  4. An interface must be assigned to a security zone before policies can reference that zone Correct answer.

Explanation

Security policies operate between zones, so interfaces must first be bound to a zone under the security-zone hierarchy. Until an interface is assigned to a zone, traffic on it is not processed by zone-based policy.

Question 46Security policies and zones

A policy from zone trust to zone untrust is configured with action permit and application any. A session is created. Which additional behavior occurs by default for return traffic from untrust to trust?

  1. Return traffic is permitted because the session is stateful in both directions Correct answer.
  2. Return traffic is dropped unless a separate untrust-to-trust policy exists
  3. Return traffic is permitted only after the policy is set to log
  4. Return traffic is permitted only if a firewall filter allows it

Explanation

Because the SRX maintains state, the return traffic of an established session is allowed without a reverse policy. The session table tracks both directions of the flow, so a separate untrust-to-trust policy is unnecessary for replies to an existing session.

Question 47Security policies and zones

Which policy action should be configured to silently discard matching traffic without sending a reset or ICMP unreachable to the source?

  1. deny Correct answer.
  2. permit
  3. reject
  4. log

Explanation

The deny action drops matching traffic silently, giving the source no feedback. The reject action, in contrast, sends a TCP reset or ICMP unreachable back to the sender.

Question 48Security policies and zones

What is the purpose of the 'then log session-close' action in a security policy?

  1. It increments the policy hit counter at session close
  2. It generates a log entry when the session is terminated Correct answer.
  3. It sends a copy of every packet to a syslog server
  4. It generates a log entry when the first packet matches the policy

Explanation

The session-close log option records a log event at the end of a session, capturing summary information such as bytes and duration. The session-init option, by contrast, logs when the session is first created.

Question 49Security policies and zones

An administrator wants a policy to match only HTTP traffic on TCP port 8080. Which predefined application should be referenced, and how is the port adjusted?

  1. Reference any, since port matching is handled by the zone
  2. Create a custom application that uses junos-http as a parent with a destination port of 8080 Correct answer.
  3. Reference junos-http, which already listens on 8080 by default
  4. Reference junos-https, since 8080 is the HTTPS port

Explanation

Predefined applications such as junos-http match their standard ports. To match a nonstandard port, you define a custom application that inherits the junos-http protocol characteristics and sets the desired destination port, then reference that custom application in the policy.

Question 50Security policies and zones

A policy is configured from zone trust to zone untrust with source-address any and destination-address any. What does this configuration accomplish?

  1. It permits all traffic from trust to untrust that reaches this policy in sequence Correct answer.
  2. It blocks all traffic from trust to untrust
  3. It applies only to traffic destined to the device itself
  4. It matches traffic in both directions between the two zones

Explanation

A policy with any/any addresses matches any source and destination within the specified zone pair. If the action is permit and the policy is reached in sequence, all trust-to-untrust traffic is allowed, making it a broad catch-all rule.