Juniper Networks JN0-232: Security, Associate (JNCIA-SEC)

Last checked November 10, 2026 against the official Juniper Networks exam page.

1. Question 1SRX Series Service Gateways

   A technician has just installed a new branch SRX and needs to set the root password and hostname before the device goes into service. In which Junos CLI mode should these settings be entered?

   1. AConfiguration mode, using set or edit commands
   2. BOperational mode, using show and request commands
   3. CThe UNIX shell, using standard Linux commands
   4. DThe bootloader prompt, which edits the configuration file directly
   Show answer and explanationHide answer

   Correct answer: A

   System settings such as root-authentication and host-name are entered in configuration mode with set or edit statements and then activated with commit. Operational mode is for viewing status and running operational tasks, the UNIX shell is not the normal way to change Junos settings, and the bootloader does not edit the configuration.

2. Question 2Junos OS Security Objects

   Clients on the untrust side can open SSH sessions to the SRX's untrust interface address, but pings to the same address time out. Which setting most likely explains this?

   1. AThe untrust zone has no route back to the client's subnet
   2. BThe untrust zone's address book is missing an entry for the client's subnet
   3. CThere is no application layer gateway enabled for ICMP on the untrust interface
   4. DPing is not enabled under host-inbound-traffic for the untrust security zone
   Show answer and explanationHide answer

   Correct answer: D

   Traffic addressed to the SRX itself is governed by host-inbound-traffic on the receiving zone. Because SSH works, the route and the interface address are fine, so ping must be added explicitly under system-services. ALGs relate to protocols that carry embedded addresses or ports, and address-book entries affect policy matching rather than traffic to the device.

3. Question 3Security Policies

   Two zone-based policies exist from trust to untrust. Policy P1 permits SSH from any source, and policy P2 denies SSH from host 192.168.1.50. P1 is listed above P2. What happens to SSH from 192.168.1.50?

   1. AIt is permitted, because P1 matches first and policies are evaluated from the top of the list down
   2. BIt is denied, because deny policies always take precedence over permit policies in the same zone pair
   3. CIt is ignored by both policies, because traffic from the trust zone bypasses policy for SSH
   4. DIt is permitted, because the policies are sorted alphabetically by name before they are evaluated
   Show answer and explanationHide answer

   Correct answer: A

   Zone-based policies are evaluated in order from the top, and the first matching rule is applied. Because P1 matches this SSH traffic before P2 is reached, the traffic is permitted, which is why the deny rule must be placed above the permit rule to work.

4. Question 4Network Address Translation

   Internal LAN hosts need to reach the Internet, but the ISP has assigned only one public address, which is the address of the untrust interface. Which NAT approach fits this requirement?

   1. AStatic NAT with a one-to-one mapping between each internal host and its own public address
   2. BSource NAT that translates internal addresses to the egress interface address
   3. CDestination NAT that publishes an internal web server on TCP port 80
   4. DSource NAT with a pool of several public addresses, which the ISP has not assigned
   Show answer and explanationHide answer

   Correct answer: B

   Interface-based source NAT lets many internal hosts share the single address already on the egress interface. Static NAT needs a public address for each internal host, destination NAT serves inbound connections to servers, and a pool needs several public addresses that the ISP has not provided.

5. Question 5Content Security

   A company wants to stop staff from downloading executable files over HTTP, while still allowing normal web browsing. Which UTM feature is the best fit?

   1. AWeb filtering that blocks websites by category, such as gambling or news sites
   2. BContent filtering that blocks specific file extensions or MIME types in HTTP traffic
   3. CAntispam that checks the sender reputation of incoming email messages before delivery
   4. DA screen that limits the rate of TCP SYN packets from each individual source address
   Show answer and explanationHide answer

   Correct answer: B

   Content filtering matches file characteristics such as extension or MIME type, so it can block executables while leaving other HTTP content alone. Web filtering decides by URL category, antispam handles email, and screens are IDS protections that limit traffic patterns rather than file types.