Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of a security policy on a Juniper device?
1.1 Describe common security concepts and components
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of a security policy on a Juniper device?
To define allowed traffic between zones
To configure interface IP addresses
To manage user accounts
To update device firmware
Correct answer
To define allowed traffic between zones
Security policies define what traffic is permitted or denied between different security zones. They do not handle IP configuration, account management, or firmware updates.
Which protocol is commonly used for secure remote management of Juniper devices?
SSH
Telnet
FTP
HTTP
Correct answer
SSH
SSH provides encrypted remote access, protecting credentials and configuration commands. Telnet, FTP, and HTTP transmit data in clear text and are not recommended for secure management.
What does a trust interface typically represent in a security zone model?
A network with high security requirements
A network with low security requirements
An interface used for logging only
An interface reserved for management
Correct answer
A network with low security requirements
In a basic zone model, the trust zone is often used for internal, more trusted networks, while the untrust zone faces external, less trusted networks like the Internet.
Which action is performed by a deny statement in a firewall filter?
Drops matching traffic without notification
Logs matching traffic and allows it
Forwards matching traffic to a quarantine network
Sends an ICMP notification to the sender
Correct answer
Drops matching traffic without notification
A deny action in a firewall filter discards packets that match the rule conditions. By default, it does not send notifications to the sender or log unless explicitly configured.
What is the role of a default route in routing configuration?
To provide a path for traffic when no specific route matches
To ensure all traffic uses a single interface
To advertise routes to neighboring devices
To encrypt traffic between devices
Correct answer
To provide a path for traffic when no specific route matches
A default route is used as a last resort to forward packets when no other specific route exists in the routing table. It helps simplify routing tables for edge devices.
Which feature helps prevent IP address spoofing attacks?
Unicast reverse path forwarding (uRPF)
Network Address Translation (NAT)
Dynamic Host Configuration Protocol (DHCP)
Virtual LANs (VLANs)
Correct answer
Unicast reverse path forwarding (uRPF)
Unicast reverse path forwarding checks if the source IP address of an incoming packet is reachable via the same interface, helping to block spoofed packets.
What does a stateful firewall inspection track?
The state of protocol handshakes
Physical interface status
Configuration change history
User login attempts
Correct answer
Physical interface status
Stateful inspection monitors the state of active connections and uses this context to evaluate packets. It allows return traffic for established sessions without additional rules.
Which Juniper tool is used to troubleshoot connectivity issues between devices?
ping
show configuration
request system reboot
file copy
Correct answer
ping
The ping command tests reachability of a destination by sending ICMP echo requests. It is a fundamental tool for verifying basic network connectivity.
What is the purpose of Network Address Translation (NAT)?
To translate private IP addresses to public IP addresses
To encrypt data packets in transit
To filter malicious traffic
To assign IP addresses to devices
Correct answer
To translate private IP addresses to public IP addresses
NAT modifies IP address information in packet headers, commonly to allow multiple internal devices to share a single public IP address. It is not a security or addressing assignment mechanism.
Which interface type is commonly used as the external interface in a basic security configuration?
ge-0/0/0
lo0
fxp0
st0
Correct answer
ge-0/0/0
ge-0/0/0 represents a typical Gigabit Ethernet interface used to connect to external networks. fxp0 is often used for management, lo0 is a loopback interface, and st0 is used for tunnels.
What is a common use of a security log on a Juniper device?
To record denied and permitted traffic for analysis
To store device configuration backups
To manage software licenses
To update device time settings
Correct answer
To record denied and permitted traffic for analysis
Security logs capture information about permitted and denied traffic based on policy and filter rules. They are essential for monitoring, auditing, and troubleshooting security events.
Which statement best describes a virtual router in Junos OS?
It maintains its own independent routing table
It shares the same routing table as the default router
It is used exclusively for Layer 2 forwarding
It disables all firewall filters when active
Correct answer
It maintains its own independent routing table
A virtual router provides a separate routing table and forwarding instances, allowing multiple logical routing domains on a single device. This supports network segmentation and diverse routing protocols.
What is the purpose of the 'any' destination address in a firewall rule?
To match traffic destined to any address
To block all outgoing traffic
To restrict management access
To enable dynamic routing protocols
Correct answer
To match traffic destined to any address
Using 'any' as the destination address matches packets going to any IP address. It is often used in broad rules where specific destination filtering is not required.
Which feature can be used to group multiple interfaces into a single logical segment?
VLAN
NAT
OSPF
IKE
Correct answer
VLAN
VLANs allow multiple interfaces to be grouped into the same broadcast domain, logically separating traffic even when they share the same physical infrastructure.
What is a common best practice for managing device configurations?
Commit changes with a descriptive comment
Apply changes without reviewing them
Disable logging to improve performance
Use the same password for all accounts
Correct answer
Commit changes with a descriptive comment
Committing changes with comments provides an audit trail and makes troubleshooting and rollback easier. Best practices emphasize review, logging, and strong authentication.
Recall the answer before opening each card.
A security policy defines traffic allowed or denied between zones. It controls flow based on source, destination, application, and action.
SSH (Secure Shell) encrypts the session for secure remote access, protecting credentials and data.
The trust zone represents an internal, more trusted network with lower security requirements.
A deny action drops matching packets silently without notification, unless logging is explicitly configured.
A default route (0.0.0.0/0) is used as the last resort to forward packets when no specific route matches.
uRPF checks that the source IP of an incoming packet is reachable via the receiving interface, discarding it if not.
Stateful inspection tracks the state of active connections, allowing return traffic for established sessions and enforcing policy context.
The ping command sends ICMP echo requests to test reachability and latency.
NAT translates private IP addresses to public IP addresses, allowing multiple internal devices to share a single public IP.
A gigabit Ethernet interface like ge-0/0/0 is commonly used as the external (untrust) interface.
Security logs record denied and permitted traffic, providing an audit trail for analysis, monitoring, and troubleshooting security events.
A virtual router maintains its own independent routing table, allowing multiple logical routing domains on one device.
The 'any' destination matches traffic destined to any IP address, used in broad rules without specific destination filtering.
VLANs group interfaces into the same logical segment, even if they are on different physical switches.
Always include a descriptive commit comment to provide an audit trail and aid troubleshooting and rollback.
The permit action allows matching traffic to pass through the firewall between zones.
Security policies are stateful and zone-based; firewall filters are stateless and interface-based, matching packet headers only.
The show log command displays contents of log files, such as event logs or security logs, for troubleshooting.
Telnet should be avoided because it transmits data in clear text, making it insecure for remote management.
A security zone groups interfaces with common security requirements, and policies are applied between zones to control traffic flow.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section covers the core concepts of security policies and zone models. The practice bank tests the purpose of security policies (define allowed traffic between zones), typical trust/untrust zones, and stateful inspection tracking connection state. Also, firewall filter actions like deny drop without notification. Understanding these is crucial for configuring Juniper SRX devices.
Proper device management includes secure remote access methods and interface roles. The practice bank emphasizes SSH for encrypted management, contrasts with insecure protocols. It also covers common interface types: ge-0/0/0 for external, fxp0 for management, lo0 for loopback, st0 for tunnels. Best practices like commit comments and secure authentication are highlighted.
Basic routing concepts are tested, including default routes as the last resort path. Virtual routers maintain independent routing tables, enabling logical segmentation. NAT translates private to public IP addresses, allowing multiple devices to share one public IP. The 'any' destination in firewall rules matches all addresses.
Troubleshooting involves using ping to test connectivity and logging to record traffic for analysis. Security threats like IP spoofing are mitigated with uRPF, which verifies source IP reachability. VLANs group interfaces into logical segments. The practice bank tests these tools and concepts for maintaining network security and reliability.
Study workflow
To configure a security policy on Junos, first define zones (trust, untrust) and assign interfaces. Then create a policy from source zone to destination zone, specifying source and destination addresses, application, and action (permit/deny). Commit the configuration.
Enter configuration mode and set system services ssh to enable SSH. Optionally restrict access with firewall filters. Commit the change and verify connectivity using an SSH client.
Configure a static route with destination 0.0.0.0/0 pointing to the next-hop gateway. For example: set routing-options static route 0.0.0.0/0 next-hop <gateway-ip>. Commit and verify with show route.
For source NAT, configure an interface with source-address and a pool. Typically, set security nat source rule-set <name> from zone trust to zone untrust, then match source address 0.0.0.0/0 and then interface as the pool. Commit.
Use ping <destination> from the CLI to test reachability. To enable logging, configure security policies to log at session init and close, then use show log <log-name> to analyze denied/permitted traffic.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Firewall filters are stateless and apply to interfaces, matching packets based on headers and taking actions like accept, discard, or reject. Security policies are stateful and operate between zones, allowing or denying traffic based on source, destination, and application, with awareness of connection state.
uRPF checks the source IP of incoming packets against the routing table. If the source IP is not reachable via the incoming interface, the packet is discarded, preventing attackers from using forged source addresses.
A security zone groups interfaces that share common security requirements. Policies are applied between zones, controlling traffic flow. Common zones include trust (internal) and untrust (external), simplifying rule management and enhancing segmentation.
No, Telnet transmits passwords and data in clear text. For secure management, use SSH which encrypts the session. Juniper devices support SSH by default; Telnet should be disabled or avoided.
Commit comments provide a log of configuration changes, aiding troubleshooting and rollback. They help administrators understand why a change was made, especially in multi-admin environments. Best practice is to always add a descriptive comment.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
