Juniper JN0-231 Practice Exams
Last updated on Oct 22,2026- Exam Code: JN0-231
- Exam Name: Security - Associate (JNCIA-SEC)
- Certification Provider: Juniper
- Latest update: Oct 22,2026
Which statement about global NAT address persistence is correct?
- A . The same IP address from a source NAT pool will be assigned for all sessions from a given host.
- B . The same IP address from a source NAT pool is not guaranteed to be assigned for all sessions from a given host.
- C . The same IP address from a destination NAT pool will be assigned for all sessions for a given host.
- D . The same IP address from a destination NAT pool is not guaranteed to be assigned for all sessions for a given host.
You want to deploy a NAT solution.
In this scenario, which solution would provide a static translation without PAT?
- A . interface-based source NAT
- B . pool-based NAT with address shifting
- C . pool-based NAT with PAT
- D . pool-based NAT without PAT
Which two IPsec hashing algorithms are supported on an SRX Series device? (Choose two.)
- A . SHA-1
- B . SHAKE128
- C . MD5
- D . RIPEMD-256
You are investigating a communication problem between two hosts and have opened a session on the SRX Series device closest to one of the hosts and entered the show security flow session command.
What information will this command provide? (Choose two.)
- A . The total active time of the session.
- B . The end-to-end data path that the packets are taking.
- C . The IP address of the host that initiates the session.
- D . The security policy name that is controlling the session.
What is the number of concurrent Secure Connect user licenses that an SRX Series device has by default?
- A . 3
- B . 4
- C . 2
- D . 5
C
Explanation:
The number of concurrent Secure Connect user licenses that an SRX Series device has by default is 2. Secure Connect is a feature of Juniper SRX Series devices that allows you to securely connect to remote networks via IPsec VPN tunnels. Each SRX Series device comes with two concurrent Secure Connect user licenses by default, meaning that it can support up to two simultaneous IPsec VPN connections. For more information, please refer to the Juniper Networks SRX Series Services Gateways Security Configuration Guide, which can be found on Juniper’s website.
Your company is adding IP cameras to your facility to increase physical security. You are asked to help protect these loT devices from becoming zombies in a DDoS attack.
Which Juniper ATP feature should you configure to accomplish this task?
- A . IPsec
- B . static NAT
- C . allowlists
- D . C&C feeds
D
Explanation:
Juniper ATP should be configured with C&C feeds that contain lists of malicious domains and IP addresses in order to prevent IP cameras from becoming zombies in a DDoS attack.
This is an important step to ensure that the IP cameras are protected from malicious requests – and thus, they will not be able to be used in any DDoS attacks against the facility.
You are creating Ipsec connections.
In this scenario, which two statements are correct about proxy IDs? (Choose two.)
- A . Proxy IDs are used to configure traffic selectors.
- B . Proxy IDs are optional for Phase 2 session establishment.
- C . Proxy IDs must match for Phase 2 session establishment.
- D . Proxy IDs default to 0.0.0.0/0 for policy-based VPNs.
You are monitoring an SRX Series device that has the factory-default configuration applied.
In this scenario, where are log messages sent by default?
- A . Junos Space Log Director
- B . Junos Space Security Director
- C . to a local syslog server on the management network
- D . to a local log file named messages
Which two statements are correct about IKE security associations? (Choose two.)
- A . IKE security associations are established during IKE Phase 1 negotiations.
- B . IKE security associations are unidirectional.
- C . IKE security associations are established during IKE Phase 2 negotiations.
- D . IKE security associations are bidirectional.
You are assigned a project to configure SRX Series devices to allow connections to your webservers. The webservers have a private IP address, and the packets must use NAT to be accessible from the
Internet. The webservers must use the same address for both connections from the Internet and communication with update servers.
Which NAT type must be used to complete this project?
- A . source NAT
- B . destination NAT
- C . static NAT
- D . hairpin NAT