Security Fundamentals Flashcards

What is a prefix-list in Junos and how is it used?

Answer: A named list of IP prefixes used as a match condition in routing policies or firewall filters

A prefix-list in Junos is a named set of IP prefixes configured under policy-options. It can be referenced in routing policies (as 'route-filter') and firewall filters as a match condition.

In Junos SRX, what is a security zone?

Answer: A logical grouping of interfaces that share the same security requirements and trust level

A security zone in Junos SRX is a logical grouping of one or more interfaces that share a common security policy. Traffic between zones is controlled by security policies.

What does the 'screen' feature provide in Junos SRX?

Answer: Protection against network attacks such as SYN floods, ICMP floods, and port scans at the zone level

Screens in Junos SRX provide stateless attack detection and mitigation at the zone boundary, protecting against DoS attacks, reconnaissance scans, and malformed packets before they reach security policies.

In Junos, what is the purpose of the 'policer' action in a firewall filter?

Answer: To rate-limit traffic that matches the filter term, discarding or marking excess traffic

A policer attached to a firewall filter term enforces a rate limit (bandwidth limit with burst allowance). Traffic exceeding the limit is either discarded or re-marked with a higher loss priority.

Which Junos feature prevents IP spoofing by verifying packets arrive on the expected interface?

Answer: Unicast Reverse Path Forwarding (uRPF)

uRPF checks that a packet's source address would be reachable via the same interface it arrived on (strict mode) or via any interface (loose mode), discarding packets that fail this check.

What is the default behavior of a Junos SRX security policy when no policy matches traffic between two zones?

Answer: Traffic is denied (implicit deny-all at end of policy)

Junos SRX has an implicit deny-all policy at the end of every security policy list. If no configured policy matches the traffic, it is dropped without notification.