JNCIS-SEC study plan
JNCIS-SEC · Give each week a clear focus.
8 weeks · About 6 hours per week
SRX Series Firewall fundamentals
Describe the SRX architecture (control plane, data plane, flow-based forwarding) and the boot process from power-on to operational state.
Configure basic management access (root authentication, management interface, static routes, DNS, NTP) on a lab SRX.
Compare packet-based vs. flow-based processing and identify which features require flow mode.
Use operational commands (show version, show chassis, show interfaces, show route) to verify device health and connectivity.
Your checkpoint
A one-page lab summary showing initial configuration, verification command output, and a diagram of the SRX control/data plane.
SRX Series Firewall fundamentals & Security policies and zones
Configure security zones, assign interfaces, and define address books and applications.
Write and order security policies to permit, deny, and log traffic between zones.
Explain the policy evaluation order and the effect of global policies.
Verify policy enforcement using show security policies and session table inspection.
Your checkpoint
A working lab with at least three zones and five policies; capture session output proving correct permit/deny behavior.
Security policies and zones & NAT and flow-based forwarding
Differentiate source NAT, destination NAT, and static NAT, and identify when each is required.
Configure and verify source NAT with interface and pool-based translation.
Configure destination NAT to publish an internal service and confirm return-path behavior.
Trace a flow through NAT using session detail and flow debugging commands.
Your checkpoint
A NAT lab report with configuration snippets and session output for source, destination, and static NAT scenarios.
NAT and flow-based forwarding & IPsec VPNs and traffic inspection
Explain how flow-based forwarding interacts with NAT, policies, and VPN traffic.
Configure a route-based IPsec VPN between two SRX devices with IKE and IPsec proposals.
Verify VPN status (IKE SAs, IPsec SAs, tunnel interfaces) and troubleshoot phase 1/phase 2 failures.
Apply NAT and policy rules correctly around VPN traffic.
Your checkpoint
A two-site VPN lab with successful ping across the tunnel and captured IKE/IPsec status output.
IPsec VPNs and traffic inspection
Configure policy-based VPN and compare it with route-based VPN design.
Implement traffic inspection features such as screens and firewall filters to protect against common attacks.
Tune TCP MSS and MTU settings for IPsec to avoid fragmentation issues.
Use traceoptions to debug IKE and IPsec negotiation.
Your checkpoint
A troubleshooting log showing a deliberately broken VPN phase and the traceoptions evidence used to fix it.
Unified threat management and monitoring
Configure UTM features: antivirus, antispam, content filtering, and web filtering profiles.
Attach UTM profiles to security policies and verify inspection in session logs.
Explain the role of the UTM engine and signature update process.
Monitor UTM events using show security utm commands and log inspection.
Your checkpoint
A UTM lab with at least two profiles applied; provide log excerpts showing a blocked threat and an allowed session.
Unified threat management and monitoring & SRX Series Firewall fundamentals
Configure logging, syslog, and SNMP for operational monitoring.
Use flow and session monitoring commands to identify top talkers and denied traffic.
Perform a configuration backup and restore, and compare configurations.
Review SRX high availability basics (chassis cluster) and how monitoring differs in a cluster.
Your checkpoint
A monitoring runbook with commands and sample outputs for health, logging, and backup/restore.
SRX Series Firewall fundamentals & Security policies and zones & NAT and flow-based forwarding & IPsec VPNs and traffic inspection & Unified threat management and monitoring
Complete a timed practice exam covering all domains and review every incorrect answer.
Reconfigure a full scenario from scratch: zones, policies, NAT, VPN, and UTM.
Identify weak areas and create a one-page cheat sheet of commands and concepts.
Verify readiness by scoring at least 80% on a second practice exam.
Your checkpoint
A final lab integrating all domains plus a scored practice exam report with a remediation list.
Milestones
Week 2: Can configure zones, policies, and basic management without reference; verify with session table output.
Week 4: Successfully establish a route-based IPsec VPN and pass traffic through NAT and policy.
Week 6: Demonstrate UTM inspection blocking a test threat and logging the event.
Week 8: Score 80% or higher on a timed practice exam and complete an integrated lab from a blank configuration.