Applications and Application Layer Gateways (ALGs) JN0-232 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In Junos OS, what is an application set?

   • AA collection of security policies that apply to the same application.
   • BA list of IP addresses that are allowed to access the network.
   • CA set of ports that are open on the firewall.
   • DA group of application objects that can be referenced as a single entity in security policies.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An administrator needs to permit several related applications (e.g., FTP, FTP-Data, and a custom FTP variant) in a single security policy rule. The policy should be easy to maintain and avoid listing each application separately. What is the most efficient approach?

   • AUse the 'junos-ftp' predefined application and rely on the ALG to handle the rest.
   • BCreate an application set containing all the application objects and reference it in the policy.
   • CConfigure multiple security policies, one for each application.
   • DCreate a custom application object that includes all the protocols and ports.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the specific function of the SIP ALG in Junos OS?

   • ATo block all SIP traffic to prevent VoIP abuse.
   • BTo convert SIP to H.323 for interoperability.
   • CTo encrypt SIP signaling for secure calls.
   • DTo handle SIP signaling and media sessions, including NAT traversal for VoIP calls.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why are ALGs necessary in a security device that performs NAT?

   • ABecause some applications embed IP addresses and ports in the payload, which NAT alone cannot translate.
   • BBecause NAT cannot handle TCP traffic.
   • CBecause security policies are not applied to NAT traffic.
   • DBecause ALGs are required for all traffic passing through the device.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security team notices that traffic to a custom internal application is being blocked by the SRX security policy, even though the policy permits the destination port. The application uses a non-standard port and a proprietary protocol. The team wants to create a policy that matches this traffic without relying on port numbers alone. What should they do?

   • ACreate an application set containing the port number and use it in the policy.
   • BCreate a custom application object with the protocol and port, then use it in the policy.
   • CConfigure a security policy with the destination port and protocol as separate match conditions.
   • DEnable the application identification feature globally and rely on the default application signatures.
   Reveal Solution Discussion Select an answer first