Juniper JN0-231 Practice Exams
Last updated on Oct 22,2026- Exam Code: JN0-231
- Exam Name: Security - Associate (JNCIA-SEC)
- Certification Provider: Juniper
- Latest update: Oct 22,2026
Question #61
Which two IKE Phase 1 configuration options must match on both peers to successfully establish a tunnel? (Choose two.)
- A . VPN name
- B . gateway interfaces
- C . IKE mode
- D . Diffie-Hellman group
Correct Answer: C,D
Question #62
Which IPsec protocol is used to encrypt the data payload?
- A . ESP
- B . IKE
- C . AH
- D . TCP
Correct Answer: A
Question #63
You want to verify the peer before IPsec tunnel establishment.
What would be used as a final check in this scenario?
- A . traffic selector
- B . perfect forward secrecy
- C . st0 interfaces
- D . proxy ID
Correct Answer: D
D
Explanation:
The proxy ID is used as a final check to verify the peer before IPsec tunnel establishment. The proxy ID is a combination of local and remote subnet and protocol, and it is used to match the traffic that is to be encrypted. If the proxy IDs match between the two IPsec peers, the IPsec tunnel is established, and the traffic is encrypted.
Reference:
Juniper Networks SRX Series Services Gateway IPsec Configuration Guide:
https://www.juniper.net/documentation/en_US/release-independent/junos/topics/topic-map/security-ipsec-vpn-configuring.html
D
Explanation:
The proxy ID is used as a final check to verify the peer before IPsec tunnel establishment. The proxy ID is a combination of local and remote subnet and protocol, and it is used to match the traffic that is to be encrypted. If the proxy IDs match between the two IPsec peers, the IPsec tunnel is established, and the traffic is encrypted.
Reference:
Juniper Networks SRX Series Services Gateway IPsec Configuration Guide:
https://www.juniper.net/documentation/en_US/release-independent/junos/topics/topic-map/security-ipsec-vpn-configuring.html
Question #64
Which two components are part of a security zone? (Choose two.)
- A . inet.0
- B . fxp0
- C . address book
- D . ge-0/0/0.0
Correct Answer: B,D
Question #65
Exhibit.
Which two statements are correct referring to the output shown in the exhibit? (Choose two.)
- A . FTP and ping access for the Trust-DMZ-Access policy is permitted.
- B . FTP and ping access for the Trust-DMZ-Access policy is denied.
- C . The SSH access for the Trust-DMZ-Block policy is permitted.
- D . The SSH access for the Trust-DMZ-Block policy is denied.
Correct Answer: AD
AD
Explanation:
Understanding the Policies in the Exhibit:
The exhibit displays two policies configured on the Juniper SRX device for traffic between the trust zone and the dmz zone.
Policy 1:
Name: Trust-DMZ-Access
State: Enabled
Source Address: Trust-Net
Destination Address: DMZ-Net
Applications: junos-ftp, junos-ping
Action: permit
Log: Enabled
Policy 2:
Name: Trust-DMZ-Block
State: Enabled
Source Address: Trust-Net
Destination Address: DMZ-Net
Applications: junos-ssh
Action: deny, log
Analysis of Each Option:
Option A:
The Trust-DMZ-Access policy explicitly permits traffic for the junos-ftp and junos-ping applications.
This is validated by the action permit in the policy configuration.
Correct.
Option B:
This is incorrect because the Trust-DMZ-Access policy permits FTP and ping traffic rather than denying it.
Incorrect.
Option C:
The Trust-DMZ-Block policy explicitly denies traffic for the junos-ssh application.
Therefore, SSH access is not permitted.
Incorrect.
Option D:
The Trust-DMZ-Block policy denies SSH traffic from the Trust-Net to the DMZ-Net.
This is validated by the action deny.
Correct.
Juniper Security
Reference: Security Policy Overview:
Security policies in Junos OS are used to control and filter traffic between security zones. Each policy defines:
Source and destination zones
Source and destination addresses
Applications or services
Action: permit, deny
Logging options
Policy Action Details:
permit: Allows the specified traffic.
deny: Blocks the specified traffic.
Application Identification:
Juniper SRX uses predefined application identifiers (junos-ftp, junos-ping, junos-ssh) for traffic matching.
Policy Evaluation Order:
Policies are evaluated in sequence by their index number or sequence number. In this exhibit:
Trust-DMZ-Access is evaluated first (Sequence number: 1).
Trust-DMZ-Block is evaluated next (Sequence number: 2).
Conclusion:
Based on the exhibit, FTP and ping traffic is permitted under Trust-DMZ-Access, and SSH traffic is denied under Trust-DMZ-Block. The answers to the question are therefore:
AD
Explanation:
Understanding the Policies in the Exhibit:
The exhibit displays two policies configured on the Juniper SRX device for traffic between the trust zone and the dmz zone.
Policy 1:
Name: Trust-DMZ-Access
State: Enabled
Source Address: Trust-Net
Destination Address: DMZ-Net
Applications: junos-ftp, junos-ping
Action: permit
Log: Enabled
Policy 2:
Name: Trust-DMZ-Block
State: Enabled
Source Address: Trust-Net
Destination Address: DMZ-Net
Applications: junos-ssh
Action: deny, log
Analysis of Each Option:
Option A:
The Trust-DMZ-Access policy explicitly permits traffic for the junos-ftp and junos-ping applications.
This is validated by the action permit in the policy configuration.
Correct.
Option B:
This is incorrect because the Trust-DMZ-Access policy permits FTP and ping traffic rather than denying it.
Incorrect.
Option C:
The Trust-DMZ-Block policy explicitly denies traffic for the junos-ssh application.
Therefore, SSH access is not permitted.
Incorrect.
Option D:
The Trust-DMZ-Block policy denies SSH traffic from the Trust-Net to the DMZ-Net.
This is validated by the action deny.
Correct.
Juniper Security
Reference: Security Policy Overview:
Security policies in Junos OS are used to control and filter traffic between security zones. Each policy defines:
Source and destination zones
Source and destination addresses
Applications or services
Action: permit, deny
Logging options
Policy Action Details:
permit: Allows the specified traffic.
deny: Blocks the specified traffic.
Application Identification:
Juniper SRX uses predefined application identifiers (junos-ftp, junos-ping, junos-ssh) for traffic matching.
Policy Evaluation Order:
Policies are evaluated in sequence by their index number or sequence number. In this exhibit:
Trust-DMZ-Access is evaluated first (Sequence number: 1).
Trust-DMZ-Block is evaluated next (Sequence number: 2).
Conclusion:
Based on the exhibit, FTP and ping traffic is permitted under Trust-DMZ-Access, and SSH traffic is denied under Trust-DMZ-Block. The answers to the question are therefore:
Question #66
Which two statements are correct about the default behavior on SRX Series devices? (Choose two.)
- A . The SRX Series device is in flow mode.
- B . The SRX Series device supports stateless firewalls filters.
- C . The SRX Series device is in packet mode.
- D . The SRX Series device does not support stateless firewall filters.
Correct Answer: A,B
Question #67
Which security policy type will be evaluated first?
- A . A zone policy with no dynamic application set
- B . A global with no dynamic application set
- C . A zone policy with a dynamic application set
- D . A global policy with a dynamic application set
Correct Answer: D
Question #68
Which two features are included with UTM on an SRX Series device? (Choose two.)
- A . antivirus
- B . NAT
- C . IDP
- D . content filtering
Correct Answer: A, D
A, D
Explanation:
Comprehensive Detailed Step-by-Step Explanation with All Juniper Security
Reference: Understanding UTM (Unified Threat Management) Features on SRX Devices:
UTM is a security framework available on Juniper SRX Series devices that integrates multiple security features to protect against various threats. UTM functionalities are focused on advanced traffic inspection, content management, and threat prevention.
Explanation of Each Option:
Option A: Antivirus
UTM on SRX Series devices includes an antivirus feature that scans traffic for malware and viruses.
This feature is implemented using either:
Sophos Antivirus: A cloud-based solution.
Kaspersky Antivirus: A local database-based solution.
The antivirus feature detects and blocks malicious files, providing robust malware protection.
Correct.
Option B: NAT
Network Address Translation (NAT) is a fundamental networking feature on SRX devices but is not part of the UTM suite.
NAT is used to translate private IP addresses to public IP addresses and does not provide traffic filtering or threat management.
Incorrect.
Option C: IDP (Intrusion Detection and Prevention)
IDP is a separate feature on SRX devices for detecting and mitigating intrusions, but it is not part of the UTM framework.
IDP focuses on identifying malicious traffic patterns and blocking threats at the network level, whereas UTM focuses on content inspection and filtering.
Incorrect.
Option D: Content Filtering
Content filtering is a key UTM feature that blocks or allows traffic based on URL categories,
keywords, and custom filtering rules.
This feature is used to restrict access to inappropriate or harmful websites and manage user behavior.
Correct.
UTM Features on SRX Devices Include:
Antivirus: Scans and blocks malware in real time.
Content Filtering: Manages access to websites and controls internet usage.
Web Filtering: Enforces policies on web content based on URL categories.
Spam Filtering: Blocks spam emails.
Juniper Security
Reference: Refer to the Juniper UTM Documentation for detailed configuration and feature details.
A, D
Explanation:
Comprehensive Detailed Step-by-Step Explanation with All Juniper Security
Reference: Understanding UTM (Unified Threat Management) Features on SRX Devices:
UTM is a security framework available on Juniper SRX Series devices that integrates multiple security features to protect against various threats. UTM functionalities are focused on advanced traffic inspection, content management, and threat prevention.
Explanation of Each Option:
Option A: Antivirus
UTM on SRX Series devices includes an antivirus feature that scans traffic for malware and viruses.
This feature is implemented using either:
Sophos Antivirus: A cloud-based solution.
Kaspersky Antivirus: A local database-based solution.
The antivirus feature detects and blocks malicious files, providing robust malware protection.
Correct.
Option B: NAT
Network Address Translation (NAT) is a fundamental networking feature on SRX devices but is not part of the UTM suite.
NAT is used to translate private IP addresses to public IP addresses and does not provide traffic filtering or threat management.
Incorrect.
Option C: IDP (Intrusion Detection and Prevention)
IDP is a separate feature on SRX devices for detecting and mitigating intrusions, but it is not part of the UTM framework.
IDP focuses on identifying malicious traffic patterns and blocking threats at the network level, whereas UTM focuses on content inspection and filtering.
Incorrect.
Option D: Content Filtering
Content filtering is a key UTM feature that blocks or allows traffic based on URL categories,
keywords, and custom filtering rules.
This feature is used to restrict access to inappropriate or harmful websites and manage user behavior.
Correct.
UTM Features on SRX Devices Include:
Antivirus: Scans and blocks malware in real time.
Content Filtering: Manages access to websites and controls internet usage.
Web Filtering: Enforces policies on web content based on URL categories.
Spam Filtering: Blocks spam emails.
Juniper Security
Reference: Refer to the Juniper UTM Documentation for detailed configuration and feature details.
Question #69
Which two statements are true about Juniper ATP Cloud? (Choose two.)
- A . Juniper ATP Cloud is an on-premises ATP appliance.
- B . Juniper ATP Cloud can be used to block and allow IPs.
- C . Juniper ATP Cloud is a cloud-based ATP subscription.
- D . Juniper ATP Cloud delivers intrusion protection services.
Correct Answer: C,D
C,D
Explanation:
Juniper ATP Cloud is a cloud-based ATP subscription that delivers advanced threat protection services, such as URL categorization, file reputation analysis, and malware analysis. It is able to quickly and accurately categorize URLs and other web content, and can also provide detailed reporting on web usage, as well as the ability to define and enforce acceptable use policies. Additionally, Juniper ATP Cloud is able to block and allow specific IPs, providing additional protection against malicious content.
References:
https://www.juniper.net/documentation/en_US/junos-space-security-director/topics/task/configuration/security-services-web-filtering-atp-cloud.html
https://www.juniper.net/documentation/en_US/junos-space-security-director/topics/task/configuration/security-services-web-filtering-atp-cloud-overview.html
C,D
Explanation:
Juniper ATP Cloud is a cloud-based ATP subscription that delivers advanced threat protection services, such as URL categorization, file reputation analysis, and malware analysis. It is able to quickly and accurately categorize URLs and other web content, and can also provide detailed reporting on web usage, as well as the ability to define and enforce acceptable use policies. Additionally, Juniper ATP Cloud is able to block and allow specific IPs, providing additional protection against malicious content.
References:
https://www.juniper.net/documentation/en_US/junos-space-security-director/topics/task/configuration/security-services-web-filtering-atp-cloud.html
https://www.juniper.net/documentation/en_US/junos-space-security-director/topics/task/configuration/security-services-web-filtering-atp-cloud-overview.html
Question #70
What is the correct order in which interface names should be identified?
- A . system slot number C> interface media type C> port number C> line card slot number
- B . system slot number C> port number C> interface media type C> line card slot number
- C . interface media type C> system slot number C> line card slot number C> port number
- D . interface media type C> port number C> system slot number C> line card slot number
Correct Answer: C