JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam - JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam

Question 1

During a JNCIE-SEC lab scenario, you are configuring chassis clustering on two SRX5800 devices. After the cluster forms, you observe that the primary node's control plane is unresponsive after a fabric link failure, and both nodes simultaneously attempt to take primary status. Which condition describes this failure mode and what is the correct recovery procedure?

This is a split-brain condition; recovery requires manually setting the priority to 0 on the unintended primary using 'set chassis cluster redundancy-group 0 node 1 priority 0' and rebooting This is a split-brain condition caused by simultaneous loss of both the control link and fabric links; recovery requires connecting to each node's console and running 'request chassis cluster in-service-upgrade' on the lower-priority node to restore arbitration This is a fabric link failure causing split-brain; recovery requires connecting to the console of the node that should be secondary and issuing 'request chassis cluster failover reset redundancy-group 1' followed by verifying HA state with 'show chassis cluster status' This is a normal failover event; the secondary node automatically becomes primary and no intervention is needed as long as the control link remains intact

Correct Answer:

This is a fabric link failure causing split-brain; recovery requires connecting to the console of the node that should be secondary and issuing 'request chassis cluster failover reset redundancy-group 1' followed by verifying HA state with 'show chassis cluster status'

Question 2

You are configuring graceful restart (GR) on a chassis cluster SRX to minimize routing disruption during a Routing Engine (RE) failover. Which statement correctly describes the behavior of graceful restart in a chassis cluster context?

Graceful restart is not supported on SRX chassis clusters because the backup RE does not synchronize routing tables Graceful restart allows the forwarding plane to continue forwarding packets using stale routes during RE failover; the new primary RE signals its GR capability to neighbors using the Restart flag in BGP OPEN or OSPF Hello messages Graceful restart requires configuring 'set routing-options graceful-restart' only on the primary node; the backup RE inherits the setting automatically through RTG synchronization Graceful restart in chassis cluster prevents any routing table recalculation for 300 seconds regardless of whether neighbors support GR

Correct Answer:

Graceful restart allows the forwarding plane to continue forwarding packets using stale routes during RE failover; the new primary RE signals its GR capability to neighbors using the Restart flag in BGP OPEN or OSPF Hello messages

Question 3

In a multi-SRX deployment scenario, you need to configure AutoVPN hub-and-spoke with IKEv2 where spokes use dynamic IP addresses. The hub SRX must identify each spoke and install spoke-specific routes. Which configuration approach correctly achieves this on the hub?

Configure a single IKE gateway with 'dynamic hostname' and a wildcard pre-shared key; use traffic-selector-based routing so the hub installs a /32 host route per spoke based on spoke subnet announcements Configure the hub with 'set security ike gateway dynamic distinguished-name' using certificate-based authentication; use a routing protocol (OSPF or BGP) over st0 interfaces with 'point-to-multipoint' mode so spokes advertise their subnets to the hub dynamically Configure a separate IKE gateway and IPsec VPN for each spoke; use numbered st0 sub-interfaces (st0.1, st0.2, etc.) with static routes per spoke — AutoVPN requires pre-defined per-spoke configurations Configure AutoVPN with 'set security ike gateway dynamic connections-limit' and use GRE over IPsec so GRE handles the spoke identification independently of IKE

Correct Answer:

Configure the hub with 'set security ike gateway dynamic distinguished-name' using certificate-based authentication; use a routing protocol (OSPF or BGP) over st0 interfaces with 'point-to-multipoint' mode so spokes advertise their subnets to the hub dynamically

Question 4

You are troubleshooting an IPsec VPN using IKEv2 with PKI certificates. The Phase 1 negotiation fails. The 'show security ike security-associations' output shows no SAs established. You run 'show security ike statistics' and see IKE_AUTH failures. Which sequence of CLI commands provides the most direct diagnostic path for a certificate validation failure?

show security pki ca-certificate detail; show security pki local-certificate detail; show security ike policy show security ike security-associations detail; request security pki ca-certificate verify ca-profile ; show log kmd | match 'certificate' show interfaces st0; show route 0.0.0.0/0; show security ipsec security-associations show security flow session; show security zones; show security policies from-zone trust to-zone vpn

Correct Answer:

show security ike security-associations detail; request security pki ca-certificate verify ca-profile ; show log kmd | match 'certificate'

Question 5

During a JNCIE-SEC lab, you must configure ADVPN (Auto Discovery VPN) so that spoke-to-spoke traffic flows directly without traversing the hub after the initial shortcut is established. Which two configurations are mandatory on the spoke SRX to enable shortcut tunnel establishment?

Configure 'set security ipsec vpn establish-tunnels on-traffic' and 'set security ike gateway dynamic connections-limit ' on each spoke Configure 'set security ipsec vpn establish-tunnels on-traffic' and set the IKE gateway with 'set security ike gateway dynamic distinguished-name wildcard' Configure the IKE proposal with 'set security ike proposal authentication-method ecdsa-signatures' and enable PFS group 20 on the IPsec proposal Configure 'set routing-options static route next-hop st0.0' and set BGP with 'set protocols bgp group type internal' over the hub tunnel for shortcut route advertisement

Correct Answer:

Configure 'set security ipsec vpn establish-tunnels on-traffic' and set the IKE gateway with 'set security ike gateway dynamic distinguished-name wildcard'

Question 1

Exam overview

About this Exam

Prepare with the JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam practice quiz. This question bank includes 100 questions covering traffic, configuring, configuration, configure, and security. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam

This practice set contains 100 questions from the matching question bank and focuses on traffic, configuring, configuration, configure, and security. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Keep studying

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

JNCIE-SEC Practice Questions - Juniper Networks Certified Expert, Security (JNCIE-SEC) Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

Arizona CNA Certified Nursing Assistant Practice Exam

Certified Professional Public Buyer (CPPB) Practice Exam

Arizona Security Guard Knowledge Practice Exam

Certified Specialist Business Intelligence (CSBI) Practice Test

Certified Specialist In Renal Nutrition (CSR) Practice Exam