Free JNCIP-SEC Practice Questions

Question 1

A compromised workstation, 10.9.4.23, is uploading stolen files through a standalone SRX. An EMP-to-INTERNET zone policy permits employee HTTPS traffic. An emergency global policy denying all Internet traffic from 10.9.4.23 has been committed, but even new HTTPS connections from that host still succeed. Policy rematching is disabled. Other employees' web sessions must remain available. How can the team stop the ongoing upload and prevent further Internet connections from this host?

Accepted Answer

Insert a host deny before the EMP-to-INTERNET permit, then clear sessions sourced by 10.9.4.23.

Answer

Clear the workstation's sessions; leave both policy contexts unchanged.

Answer

Move the host-specific global deny ahead of every other global policy, then clear sessions sourced by 10.9.4.23.

Answer

Disable the broad zone permit and clear sessions from the employee subnet until workstation remediation is complete.

Question 2

A UDP relay application uses the live persistent NAT binding 10.20.30.40:41000 → 203.0.113.40:62010 with permit target-host-port. That endpoint has contacted relay 198.51.100.60:3478. The service now assigns relay 198.51.100.61:3478, whose packets to the existing reflexive endpoint are rejected. Security policies permit both relays, and the binding has spare session capacity. The requirement is to admit only remote IP-and-port pairs contacted by the application. What permits the relay change while retaining IP-and-port-specific filtering?

Accepted Answer

Send UDP from 10.20.30.40:41000 to the new relay at 198.51.100.61:3478.

Answer

Change permit target-host-port to permit target-host.

Answer

Increase the binding's inactivity timeout so it remains available throughout the relay change.

Answer

Clear the binding, then have the new relay send the first packet to the same reflexive endpoint.

Question 3

After a branch certificate renewal, IKEv2 authentication fails. The gateway enforces RFC 4945 identity binding, and the branch must continue using the identity branch34.example.net. Validation shows:

Transmitted ID_FQDN: branch34.example.net
Certificate subject CN: branch34.example.net
Only subjectAltName dNSName: branch-old.example.net
Certificate chain, signatures, validity and revocation checks: successful

Select the change that repairs authentication while retaining the required identity.

Accepted Answer

Issue a replacement peer certificate containing dNSName branch34.example.net.

Answer

Correct the public DNS record for branch34.example.net.

Answer

Import the existing peer certificate as an additional trusted certificate authority.

Answer

Configure the hub to accept branch-old.example.net as the branch's IKE identity.

Question 4

An audit of an Ethernet link finds a healthy static-CAK MKA association and MACsec frames that pass integrity validation. A passive capture taken on the wire between the two peers nevertheless reveals complete application payloads. The security requirement calls for confidentiality as well as integrity. Which configuration finding explains the lack of confidentiality?

Accepted Answer

The MACsec association uses no-encryption to provide integrity-only protection.

Answer

The peers use identical CAKs but different CKNs for their connectivity association.

Answer

The key server has been elected using a lower priority number than its peer.

Answer

The replay window permits correctly authenticated frames to arrive out of order.

Question 5

APBR steers a cloud-backup application into the forwarding instance ARCHIVE. Troubleshooting establishes the following:

The application rule matches the test sessions.
The selected static route is inactive because next hop 192.0.2.2 is unresolved.
The connected route 192.0.2.0/24 exists in inet.0 but not in ARCHIVE.inet.0.

Both possible egress interfaces are in the same security zone, and security policy permits the traffic. Which correction completes the forwarding path?

Accepted Answer

Import the required connected route into ARCHIVE.inet.0 through a RIB group.

Answer

Lower the administrative preference of the ARCHIVE static route.

Answer

Increase the APBR route-change limit to allow another attempt at forwarding.

Answer

Clear the application cache so AppID identifies the traffic before selecting ARCHIVE.

Question 6

A planned load test will add 22,000 concurrent flow sessions to a logical system. Its security profile reserves 100,000 sessions and permits a maximum of 200,000; current usage is 124,000. The primary administrator confirms that 30,000 additional sessions are available to this logical system from the shared pool after accounting for all reservations and current usage. Other systems' usage will remain steady, and no other resource limit will be reached. Can the planned peak load be admitted, and how much shared capacity would remain?

Accepted Answer

Accept it; usage becomes 146,000, with 8,000 of the available shared sessions remaining.

Answer

Reject it; the logical system is already 24,000 sessions beyond its usable quota.

Answer

Limit it to 6,000 sessions; existing use above the reservation consumes the rest.

Answer

Accept it; usage becomes 146,000, with 54,000 of the available shared sessions remaining.

Question 7

Two route-based VPNs on an SRX have established IPsec SAs. The active routes and negotiated selectors are:

st0.10: route 172.20.0.0/16; local selector 10.10.0.0/16; remote selector 172.20.0.0/16
st0.20: route 172.20.30.0/24; local selector 10.20.0.0/16; remote selector 172.20.30.0/24

There is no NAT, and security policy permits the traffic through either VPN. Predict the treatment of a new packet from 10.10.4.8 to 172.20.30.9.

Accepted Answer

Drop it: routing selects st0.20, whose selector excludes the source.

Answer

Encrypt it through st0.10 because that VPN's selector matches both endpoints.

Answer

Encrypt through st0.20; the destination matches its selector.

Answer

Try st0.20, then encrypt through st0.10 when the first selector fails.

Question 8

A multinode HA design uses two supported SRX nodes running Junos OS 22.2. Different firewall/NAT sessions traverse each node; both directions of every session stay on the same node. IPsec will be active on A and standby on B. A reviewer calls this split brain because both nodes process traffic. Which assessment of service ownership is accurate?

Accepted Answer

SRG0 can be active on both nodes while SRG1 retains one active owner.

Answer

All firewall and NAT sessions must follow the node that owns SRG1.

Answer

Both SRG0 and SRG1 must be active on both nodes whenever any traffic is shared between them.

Answer

Node B must stop forwarding until a failure transfers both the routing process and SRG1 to it.

Question 9

Juniper ATP Cloud uses a threat-level threshold of 7 for the infected-hosts feed. Its current host records are:

10.20.0.11 - threat level 8; follow the configured policy
10.20.0.22 - threat level 5; follow the configured policy
10.20.0.33 - threat level 2; Always include host in infected hosts feed

None of these records has expired. Which hosts belong in the infected-hosts feed?

Accepted Answer

10.20.0.11 and 10.20.0.33 only

Answer

10.20.0.11 only

Answer

10.20.0.11 and 10.20.0.22 only

Answer

10.20.0.11, 10.20.0.22 and 10.20.0.33

Question 10

During an NPTv6 deployment, an engineer compares the same TCP packet before and after translation. The IPv6 source prefix changes, and a 16-bit portion of the address outside that prefix changes as well. The TCP ports and checksum remain identical, and the checksum validates at the receiver. Should these packet differences be treated as a translation fault?

Accepted Answer

No; checksum-neutral address adjustment permits translation without a per-flow mapping.

Answer

Yes; NPTv6 must leave every bit outside the translated prefix unchanged.

Answer

Yes; changing an IPv6 source prefix always requires rewriting the TCP checksum field.

Answer

No; the changed address word records a per-flow binding allocated for translating reply traffic.

Free JNCIP-SEC Practice Questions

Domain 1: Troubleshooting Security Policies and Security Zones

Question 1

Domain 2: Logical Systems and Tenant Systems

Question 2

Domain 3: Layer 2 Security

Question 3

Domain 4: Advanced Network Address Translation (NAT)

Question 4

Question 5

Domain 5: Advanced IPsec VPNs

Question 6

Question 7

Domain 6: Advanced Policy-Based Routing (APBR)

Question 8

Domain 7: Multinode High Availability (HA)

Question 9

Domain 8: Automated Threat Mitigation

Question 10

That's 10 of 1,030