Global security policies extend the flexibility of policy enforcement across the SRX. They are not tied to specific source and destination zones:

From-zone and to-zone contexts are not required (Option A). Global policies apply across all zones unless restricted by match conditions.

Global security policies do not require specific zone contexts (Option B is incorrect).

Global policies are processed after zone-based policies , not before. This means that zone-based security policies take precedence (Option C is incorrect).

Administrators can configure both zone-based security policies and global security policies at the same time on the same device (Option D is correct).

This allows flexible designs where specific policies can be enforced by zone, while general policies can be applied globally without duplicating rules across multiple zones.

Juniper SRX evaluates security policies sequentially from top to bottom. Once a policy match is found, no further policies are evaluated. In this exhibit:

First Policy (FTP, deny):

Source: 172.25.11.0/24

Destination: 10.1.0.0/16

Application: FTP

Action: deny ⇒ Any FTP traffic from 172.25.11.0/24 to 10.1.0.0/16 is denied .

Second Policy (SSH, permit):

Same source/destination but application = SSH

Action = permit ⇒ SSH traffic from 172.25.11.0/24 to 10.1.0.0/16 is permitted .

Third Policy (HTTPS, permit): ⇒ HTTPS from the same source/destination is permitted .

Fourth Policy (Ping, permit):

Source: 172.25.11.0/24 to any destination

Application: ping

Action: permit ⇒ ICMP echo requests (ping) from 172.25.11.0/24 to any destination are permitted .

Fifth Policy (any → any, deny): ⇒ Serves as a default deny all at the end.

Now checking each option:

Option A: SSH from 172.25.11.10 → 10.1.0.10 matches the SSH permit rule (second policy). ✅ Correct.

Option B: Ping from 172.25.11.100 → 10.1.0.10 matches the ping permit rule (fourth policy). This traffic is permitted, not denied. ❌ Incorrect.

Option C: FTP from 10.1.0.10 → 172.25.11.100 is reverse traffic (untrust to trust) . The table applies only trust → untrust , so this policy does not apply. ❌ Incorrect.

Option D: FTP from 172.25.11.11 → 10.1.0.10 matches the first policy ( FTP deny rule ). ✅ Correct.

Correct Statements: A, D

Intra-zone traffic: On SRX devices, traffic between interfaces in the same security zone is allowed without requiring a security policy (Option C is correct). Policies are only evaluated for inter-zone traffic.

Junos-host functional zone: This zone is a predefined functional zone that allows administrators to apply policies controlling access to the SRX firewall itself, such as SSH, HTTP, or SNMP traffic (Option D is correct).

Null zone: This zone is a predefined discard zone. Interfaces placed in the null zone drop all traffic. It does not allow policy logging of dropped control plane traffic (Option A is incorrect).

Management functional zone: This is used to define management interfaces, not the “functional zone” as stated in Option B (incorrect wording).

Correct Statements: C and D

After confirming correct routing:

The next step is to verify security zone assignments (Option A) . If interfaces are not correctly assigned to zones, traffic will not be evaluated against proper inter-zone or intra-zone security policies, causing drops.

Option B: The routing protocol is irrelevant once the correct route lookup is confirmed.

Option C: NAT is checked later in the flow, not the immediate next step after routing.

Option D: ALG is only needed for specific applications (FTP, SIP), not general troubleshooting.

Correct Next Step: Verify that interfaces are assigned to the correct security zones.

Security policies on SRX support several actions:

Permit: Allows traffic to pass according to the rule.

Deny: Silently drops the traffic without notifying the source.

Reject: Drops the traffic and sends a TCP RST (for TCP) or ICMP unreachable (for UDP/other protocols) back to the source. This provides feedback to the sending host.

Next-policy: Allows policy chaining to evaluate the next policy set.

Therefore, the action that causes traffic to drop and a message to be sent to the source is reject .

From the exhibit:

The user attempted to access https://www.wikipedia.org.

The block page indicates:

CATEGORY: NG_Reference

REASON: BY_PRE_DEFINED

The header states: “Juniper Web Filtering has been set to block this site.”

Analysis of options:

Option A: Correct. The log shows “REASON: BY_PRE_DEFINED,” which means the site was blocked because it matched a predefined category in the Web filtering database.

Option B: Correct. The category “NG_Reference” indicates that the NextGen (Enhanced/Cloud-based) Web Filtering type is being used.

Option C: Incorrect. The exhibit does not provide any information about SSL proxy configuration; it only shows that the HTTPS site was blocked.

Option D: Incorrect. The block page shown is the standard Juniper default block page, not a custom message.

Correct Statements: The URL matches a predefined Web filtering category, and the NextGen Web Filtering type is being used.

The Routing Engine is the control-plane component in Junos OS. It runs routing protocols, maintains routing tables, handles system management functions, and derives the forwarding table from active routes. Juniper documentation explains that the Routing Engine constructs and maintains routing tables and then copies the forwarding table into the Packet Forwarding Engine. The Routing Engine kernel also provides communication with the PFE and keeps the PFE forwarding table synchronized with the master copy on the Routing Engine. Therefore, options B and C are correct. Option A is incorrect because the PFE does not manage the Routing Engine; the relationship is the opposite. Option D is incorrect because transit packet forwarding is performed by the Packet Forwarding Engine, while the Routing Engine controls and programs forwarding behavior.

The policy table applies to traffic from the Trust zone to the Untrust zone. The source prefix 172.25.11.0/24 and destination prefix 10.1.0.0/16 are matched for FTP, SSH, HTTPS, and ping actions. FTP traffic from 172.25.11.11 to 10.1.0.10 matches the FTP deny policy, so option A is correct. SSH traffic from 172.25.11.10 to 10.1.0.10 matches the SSH permit policy, so option C is correct. Ping from 172.25.11.100 to 10.1.0.10 is permitted, not denied, because the ping policy permits it. Option D reverses the source and destination direction and does not match the displayed Trust-to-Untrust policy table. Security policies are matched using zone context, source address, destination address, and application.

Unified security policies integrate traditional zone-based policies with application-based policies . Their characteristics include:

Zone-based or global (Option B): Unified policies can be applied as either zone-specific or global policies.

AppID engine (Option C): They leverage the AppID engine for application identification, enabling fine-grained control at the application layer.

Policy matching (Option A): Policies are evaluated sequentially like standard security policies; applications are not matched before policy processing.

Multiple matches (Option D): If multiple policies could match, the first match applies (sequential order), not the “most restrictive.”

Correct Statements: B and C

Destination NAT purpose (Option C): Used to allow external hosts on the Internet to access internal/private resources (such as a web server in the DMZ). Destination NAT changes the destination IP of incoming traffic to match the internal server.

Pool-based NAT (Option D): SRX supports destination NAT pools, allowing multiple public IP addresses or ranges to be translated to internal servers.

Incorrect options:

Option A describes source NAT , not destination NAT.

Option B is incorrect because SRX does not support “interface-based” destination NAT.

Correct Statements: C and D