Security Fundamentals Flashcards

What is the primary purpose of a Junos firewall filter?

Answer: To match packets and apply actions such as accept, discard, or reject

Junos firewall filters (stateless ACLs) use match conditions and actions to control packet forwarding. They operate at line rate and can accept, discard, reject, or count packets.

Which Junos feature provides stateful packet inspection for SRX devices?

Answer: Security policies with zones

On Junos SRX devices, security policies combined with security zones provide stateful inspection, tracking connection state for TCP, UDP, and ICMP sessions.

In Junos, what is the default action of a firewall filter term if no 'then' action is specified?

Answer: Accept

If a firewall filter term matches but has no 'then' action specified, the default action is 'accept'. However, the implicit default at the end of a filter is 'discard'.

What does the 'reject' action in a Junos firewall filter do differently from 'discard'?

Answer: 'reject' sends an ICMP unreachable message to the sender; 'discard' silently drops the packet

The 'reject' action drops the packet and sends an ICMP 'destination unreachable' message back to the source, while 'discard' performs a silent drop with no notification.

In Junos OS, what is the purpose of the 'log' action in a firewall filter?

Answer: Stores packet header information in the Routing Engine's firewall log buffer

The 'log' action in a Junos firewall filter records basic packet information (timestamp, protocol, addresses, ports) in the Routing Engine's local firewall log, viewable with 'show firewall log'.

Which command applies a firewall filter to an interface in the input direction?

Answer: set interfaces ge-0/0/0 unit 0 family inet filter input FILTER-NAME

Firewall filters are applied to logical interfaces under the protocol family. The correct syntax is 'set interfaces [if] unit [n] family inet filter input [name]'.