Free JNCIA-SEC certification exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the JNCIA-SEC certification exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which Junos component controls routing updates and system management?

   1. A. The Packet Forwarding Engine
   2. B. The Routing Engine
   3. C. The physical interface controller
   4. D. The switching fabric

   Answer: B

   Explanation: The documentation states, "The Routing Engine controls the routing updates and the system management." These are control-plane responsibilities of the Routing Engine.

   Reference: Junos OS Architecture Overview — Routing Engine

2. 2What is the basis for grouping interfaces into a Junos security zone?

   1. A. They must use the same physical port number.
   2. B. They must advertise the same routing protocol.
   3. C. They must share one interface address.
   4. D. They have identical security requirements.

   Answer: D

   Explanation: The zone overview states, "Interfaces with identical security requirements can be grouped together into a single security zone." Zone membership expresses a security boundary rather than a common port number or address.

   Reference: Security Zones — Security Zones Overview

3. 3What defines a zone-based security policy context in Junos?

   1. A. The source and destination TCP ports
   2. B. The incoming and outgoing security zones
   3. C. The policy's name and logging action
   4. D. The routing protocol and next-hop address

   Answer: B

   Explanation: Juniper states, "This combination of a from-zone and to-zone is called a context." A context holds policies for that directional zone pair.

   Reference: Security Policies Overview — Security Policies Overview — policy contexts

4. 4Which packet field does source NAT translate to let private hosts use a public-facing address for outbound connections?

   1. A. The destination IP address
   2. B. The destination MAC address
   3. C. The source IP address
   4. D. The IP protocol number

   Answer: C

   Explanation: Juniper defines it directly: "Source NAT is the translation of the source IP address of a packet leaving the Juniper Networks device." Destination translation and changes to MAC addresses or protocol numbers do not describe source NAT.

   Reference: Source NAT — Understanding Source NAT

5. 5In the enhanced content filtering introduced in Junos OS 21.4R1, what is examined to determine a transferred file's type?

   1. A. The file's content
   2. B. Only the file's extension
   3. C. Only the HTTP MIME declaration
   4. D. Only the destination TCP port

   Answer: A

   Explanation: Juniper states, "Starting in Junos OS Release 21.4R1, Content Security performs content filtering to determine the file type based on the file content and not based on the file extensions." Actual content analysis avoids relying solely on a filename or a declared type.

   Reference: Content Filtering — Content Filtering Overview — Content Filtering Based on File Content

6. 6Which command can test security policy matching offline using a proposed flow's addresses, ports, protocol, and zones?

   1. A. show security policies hit-count
   2. B. show security match-policies
   3. C. show security policies checksum
   4. D. show security flow statistics

   Answer: B

   Explanation: Juniper states, "the show security match-policies command allows you to work offline and identify where the problem actually exists." It accepts traffic match criteria, unlike counters or checksum displays.

   Reference: Monitoring and Troubleshooting Security Policies — Matching Security Policies

7. 7In the Junos architecture, what is the Packet Forwarding Engine responsible for?

   1. A. Establishing routing protocol adjacencies
   2. B. Authenticating administrative CLI users
   3. C. Maintaining the candidate configuration
   4. D. Forwarding packets between interfaces

   Answer: D

   Explanation: Juniper states, "The Packet Forwarding Engine forwards packets between input and output interfaces." The other choices describe control or management work rather than the forwarding function.

   Reference: Junos OS Architecture Overview — Packet Forwarding Engine

8. 8What is a documented property of a functional management zone in Junos?

   1. A. It forwards management-port traffic through normal transit policies.
   2. B. It prevents traffic received on its management interface from transiting another interface.
   3. C. It automatically places all data interfaces in the management zone.
   4. D. It applies the same transit policy context as every security zone.

   Answer: B

   Explanation: Juniper states, "Traffic entering management zones does not match policies; therefore, traffic cannot transit out of any other interface if it was received in the management interface." A functional management zone is not a normal transit-security zone.

   Reference: Security Zones — Security Zones Overview — Understanding Functional Zones

9. 9A zone-based policy permits hosts in zone A to initiate connections to zone B. What is needed to permit independently initiated connections from B to A?

   1. A. A second policy permitting B-to-A traffic
   2. B. A session-close log on the A-to-B policy
   3. C. A higher timeout on the A-to-B policy
   4. D. A second address entry in the same A-to-B policy

   Answer: A

   Explanation: The overview states, "To allow traffic to flow the other way, you must configure another policy permitting traffic from zone B to zone A." The question concerns independently initiated connections, not response packets belonging to an existing stateful session.

   Reference: Security Policies Overview — Security Policies Overview — directional policy permissions

10. 10Which IP address does interface source NAT use as the translated source address?

    1. A. The egress interface's IP address
    2. B. The ingress interface's IP address
    3. C. The next-hop gateway's IP address
    4. D. The originating client's private IP address

    Answer: A

    Explanation: The source NAT guide states, "Translation to the address of the egress interface does not require an address pool". Interface source NAT uses the SRX egress interface address, not its ingress address, the upstream gateway, or the untranslated client address.

    Reference: Source NAT — Understanding Source NAT — translation options