Free JN0-232: Security - Associate (JNCIA-SEC) Exam Questions and Answers

Which content filtering criterion on an SRX Series Firewall blocks transferred objects whose names end in a particular suffix, such as .exe or .zip?

• AA. MIME type
• BB. Protocol command
• CC. Embedded object type
• DD. File extension

You are configuring a new SRX Series Firewall from the console. When you enter the commit command, it fails with a message that the root password must be configured. Which configuration statement resolves the problem?

• AA. set system root-authentication plain-text-password
• BB. set system login user root authentication plain-text-password
• CC. set system services ssh root-login allow
• DD. set security zones functional-zone management host-inbound-traffic system-services ssh

Which sequence shows the order in which an SRX Series Firewall evaluates security policies for the first packet of a transit session?

• AA. Global policies, zone-based policies, default policy
• BB. Zone-based policies, global policies, default policy
• CC. Zone-based policies, default policy, global policies
• DD. Default policy, zone-based policies, global policies

A host at 172.16.8.20 has an established HTTPS session through an SRX Series Firewall. You must verify which security policy and which NAT translation were applied to that active session. Which command displays this information?

• AA. show security policies from-zone trust to-zone untrust detail
• BB. show security match-policies from-zone trust to-zone untrust source-ip 172.16.8.20 destination-ip 198.51.100.10 protocol tcp destination-port 443
• CC. show security nat source rule all
• DD. show security flow session source-prefix 172.16.8.20/32 extensive

Referring to the configuration shown below, no other security policies are configured, and hosts exist in the trust, dmz, and untrust zones. user@srx# show security policies from-zone trust to-zone untrust { policy allow-web { match { source-address any; destination-address any; application junos-http; } then { permit; } } } global { policy block-http { match { source-address any; destination-address any; application junos-http; } then { deny; } } } Which statement is correct?

• AA. HTTP from the trust zone to the untrust zone and HTTP from the dmz zone to the untrust zone are both permitted by the zone-based policy.
• BB. HTTP from the trust zone to the untrust zone is denied by the global policy, and HTTP from the dmz zone to the untrust zone is permitted by the default policy.
• CC. HTTP from the trust zone to the untrust zone is permitted, and HTTP from the dmz zone to the untrust zone is denied by the global policy.
• DD. HTTP from the trust zone to the untrust zone and HTTP from the dmz zone to the untrust zone are both denied by the global policy.

A static NAT rule set maps 192.168.10.0/24 to 203.0.113.0/24. Which statement is correct?

• AA. Each address in 192.168.10.0/24 maps to the address with the same host portion in 203.0.113.0/24.
• BB. Hosts in 192.168.10.0/24 share a single address from 203.0.113.0/24 by using port translation.
• CC. Only sessions initiated from 192.168.10.0/24 are translated, and return traffic requires a second rule.
• DD. Addresses are assigned from 203.0.113.0/24 on a first-come basis and released when each session ends.

Which command displays how many times each security policy has been matched by traffic?

• AA. show security flow session summary
• BB. show security flow statistics
• CC. show security screen statistics zone untrust
• DD. show security policies hit-count

Which set of match criteria must be configured in every zone-based security policy on an SRX Series Firewall?

• AA. Source address, destination address, and dynamic application
• BB. Source address, destination address, and application
• CC. Destination address, application, and URL category
• DD. Source address, application, and source identity

IP phones in the trust zone register with a SIP server in the untrust zone through an SRX Series Firewall. Registration succeeds, but calls have no audio. The security policy permits junos-sip, and the media ports are negotiated dynamically in the signaling messages. Which feature allows the SRX Series Firewall to permit the negotiated media ports?

• AA. The SIP ALG inspecting the signaling messages
• BB. A static NAT rule for the SIP server address
• CC. A content filter profile applied to the SIP protocol
• DD. A SIP-specific screen option on the untrust zone

You want to create an address entry named app1 for the host 172.16.20.15 in the global address book so that it can be referenced in security policies for any zone. Which command accomplishes this task?

• AA. set security address-book global address app1 172.16.20.15/32
• BB. set security zones address-book address app1 172.16.20.15/32
• CC. set security address-book global address-set app1 address 172.16.20.15/32
• DD. set security policies global address app1 172.16.20.15/32