Security, Associate (JNCIA-SEC) practice questions

1. Question 1 of 25

   Select 2

   Which two criteria should a zone-based security policy include? (Choose two.)

   • Aa source port
   • Ba destination port
   • Czone context
   • Dan action

   Show answer

   Correct answer: C, D

   How others answered

   • CD83%
   • AB17%

2. Question 2 of 25

   Select 2

   You are assigned a project to configure SRX Series devices to allow connections to your webservers. The webservers have a private IP address, and the packets must use NAT to be accessible from the Internet. You do not want the webservers to initiate connections with external update servers on the Internet using the same IP address as customers use to access them. Which two NAT types must be used to complete this project? (Choose two.)

   • Astatic NAT
   • Bhairpin NAT
   • Cdestination NAT
   • Dsource NAT

   Show answer

   Correct answer: C, D

   How others answered

   • CD75%
   • AC25%

3. Question 3 of 25

   You are asked to verify that a license for AppSecure is installed on an SRX Series device. In this scenario, which command will provide you with the required information?

   • Auser@srx> show system license
   • Buser@srx> show services accounting
   • Cuser@srx> show configuration system
   • Duser@srx> show chassis firmware

   Show answer

   Correct answer: A

   How others answered

   • A100%

4. Question 4 of 25

   Click the Exhibit button.

   

   Referring to the exhibit, a user is placed in which hierarchy when the exit command is run?

   • A[edit security policies from-zone trust to-zone dmz] user@vSRX-1#
   • B[edit] user@vSRX-1#
   • C[edit security policies] user@vSRX-1#
   • Duser@vSRX-1>

   Show answer

   Correct answer: C

   How others answered

   • C82%
   • A9%
   • B9%

5. Question 5 of 25

   Select 2

   You want to enable the minimum Juniper ATP services on a branch SRX Series device. In this scenario, what are two requirements to accomplish this task? (Choose two.)

   • AInstall a basic Juniper ATP license on the branch device.
   • BConfigure the juniper-atp user account on the branch device.
   • CRegister for a Juniper ATP account on https://sky.junipersecurity.net.
   • DExecute the Juniper ATP script on the branch device.

   Show answer

   Correct answer: C, D

   How others answered

   • CD60%
   • AC40%

   Only 60% agreed on this answer — treat it as contested rather than settled.

6. Question 6 of 25

   SRX Series devices have a maximum of how many rollback configurations?

   • A40
   • B60
   • C50
   • D10

   Show answer

   Correct answer: C

   How others answered

   • C100%

7. Question 7 of 25

   Select 3

   Unified threat management (UTM) inspects traffic from which three protocols? (Choose three.)

   • AFTP
   • BSMTP
   • CSNMP
   • DHTTP
   • ESSH

   Show answer

   Correct answer: A, B, D

   How others answered

   • ABD100%

8. Question 8 of 25

   When are Unified Threat Management services performed in a packet flow?

   • Abefore security policies are evaluated
   • Bas the packet enters an SRX Series device
   • Conly during the first path process
   • Dafter network address translation

   Show answer

   Correct answer: D

   How others answered

   • C50%
   • D50%

   Most people chose C, not D. Verify this one against the vendor documentation.

9. Question 9 of 25

   When configuring antispam, where do you apply any local lists that are configured?

   • Acustom objects
   • Badvanced security policy
   • Cantispam feature-profile
   • Dantispam UTM policy

   Show answer

   Correct answer: A

   How others answered

   • A73%
   • D27%

   Only 73% agreed on this answer — treat it as contested rather than settled.

10. Question 10 of 25

    Select 2

    Screens on an SRX Series device protect against which two types of threats? (Choose two.)

    • AIP spoofing
    • BICMP flooding
    • Czero-day outbreaks
    • Dmalicious e-mail attachments

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

11. Question 11 of 25

    Which statement about global NAT address persistence is correct?

    • AThe same IP address from a source NAT pool will be assigned for all sessions from a given host.
    • BThe same IP address from a source NAT pool is not guaranteed to be assigned for all sessions from a given host.
    • CThe same IP address from a destination NAT pool will be assigned for all sessions for a given host.
    • DThe same IP address from a destination NAT pool is not guaranteed to be assigned for all sessions for a given host.

    Show answer

    Correct answer: A

    How others answered

    • A100%

12. Question 12 of 25

    Select 2

    Which two statements are correct about IKE security associations? (Choose two.)

    • AIKE security associations are established during IKE Phase 1 negotiations.
    • BIKE security associations are unidirectional.
    • CIKE security associations are established during IKE Phase 2 negotiations.
    • DIKE security associations are bidirectional.

    Show answer

    Correct answer: A, D

    How others answered

    • AD67%
    • CD33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

13. Question 13 of 25

    You want to deploy a NAT solution. In this scenario, which solution would provide a static translation without PAT?

    • Ainterface-based source NAT
    • Bpool-based NAT with address shifting
    • Cpool-based NAT with PAT
    • Dpool-based NAT without PAT

    Show answer

    Correct answer: B

    How others answered

    • B54%
    • D46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

14. Question 14 of 25

    Which Juniper Networks solution uses static and dynamic analysis to search for day-zero malware threats?

    • Afirewall filters
    • BUTM
    • CJuniper ATP Cloud
    • DIPS

    Show answer

    Correct answer: C

    How others answered

    • C100%

15. Question 15 of 25

    You are configuring an SRX Series device. You have a set of servers inside your private network that need one-to-one mappings to public IP addresses. Which NAT configuration is appropriate in this scenario?

    • Asource NAT with PAT
    • Bdestination NAT
    • CNAT-T
    • Dstatic NAT

    Show answer

    Correct answer: D

    How others answered

    • D100%

16. Question 16 of 25

    Select 2

    Your ISP gives you an IP address of 203.0.113.0/27 and informs you that your default gateway is 203.0.113.1. You configure destination NAT to your internal server, but the requests sent to the webserver at 203.0.113.5 are not arriving at the server. In this scenario, which two configuration features need to be added? (Choose two.)

    • Afirewall filter
    • Bsecurity policy
    • Cproxy-ARP
    • DUTM policy

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

17. Question 17 of 25

    Select 3

    What are three primary match criteria used in a Junos security policy? (Choose three.)

    • Aapplication
    • Bsource address
    • Csource port
    • Dclass
    • Edestination address

    Show answer

    Correct answer: A, B, E

    How others answered

    • ABE75%
    • BCE25%

18. Question 18 of 25

    Select 2

    You have an FTP server and a webserver on the inside of your network that you want to make available to users outside of the network. You are allocated a single public IP address. In this scenario, which two NAT elements should you configure? (Choose two.)

    • Adestination NAT
    • BNAT pool
    • Csource NAT
    • Dstatic NAT

    Show answer

    Correct answer: A, B

    How others answered

    • AB64%
    • AD36%

    Only 64% agreed on this answer — treat it as contested rather than settled.

19. Question 19 of 25

    Select 3

    Which three Web filtering deployment actions are supported by Junos? (Choose three.)

    • AUse IPS.
    • BUse local lists.
    • CUse remote lists.
    • DUse Websense Redirect.
    • EUse Juniper Enhanced Web Filtering.

    Show answer

    Correct answer: B, D, E

    How others answered

    • BDE100%

20. Question 20 of 25

    Select 2

    When operating in packet mode, which two services are available on the SRX Series device? (Choose two.)

    • AMPLS
    • BUTM
    • CCoS
    • DIDP

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

21. Question 21 of 25

    Select 2

    Which two statements are correct about the default behavior on SRX Series devices? (Choose two.)

    • AThe SRX Series device is in flow mode.
    • BThe SRX Series device supports stateless firewalls filters.
    • CThe SRX Series device is in packet mode.
    • DThe SRX Series device does not support stateless firewall filters.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

22. Question 22 of 25

    You are assigned a project to configure SRX Series devices to allow connections to your webservers. The webservers have a private IP address, and the packets must use NAT to be accessible from the Internet. The webservers must use the same address for both connections from the Internet and communication with update servers. Which NAT type must be used to complete this project?

    • Asource NAT
    • Bdestination NAT
    • Cstatic NAT
    • Dhairpin NAT

    Show answer

    Correct answer: C

    How others answered

    • C100%

23. Question 23 of 25

    Select 2

    Which two user authentication methods are supported when using a Juniper Secure Connect VPN? (Choose two.)

    • Acertificate-based
    • Bmulti-factor authentication
    • Clocal authentication
    • Dactive directory

    Show answer

    Correct answer: C, D

    How others answered

    • CD92%
    • AC8%

24. Question 24 of 25

    Select 2

    Click the Exhibit button.

    

    Which two statements are correct about the partial policies shown in the exhibit? (Choose two.)

    • AUDP traffic matched by the deny-all policy will be silently dropped.
    • BTCP traffic matched by the reject-all policy will have a TCP RST sent.
    • CTCP traffic matched from the zone trust is allowed by the permit-all policy.
    • DUDP traffic matched by the reject-all policy will be silently dropped.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

25. Question 25 of 25

    You are monitoring an SRX Series device that has the factory-default configuration applied. In this scenario, where are log messages sent by default?

    • AJunos Space Log Director
    • BJunos Space Security Director
    • Cto a local syslog server on the management network
    • Dto a local log file named messages

    Show answer

    Correct answer: D

    How others answered

    • D100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

JN0-231 practice, question 1 of 25