Juniper JN0-231 Practice Test

JN0-231 practice test: what's covered

• Junos Security Associate
• SRX

Free JN0-231 sample questions

1. An engineer is comparing the SRX architecture against a traditional router. Which statement BEST describes how an SRX series device separates its planes?

   • A. The Routing Engine (RE) handles forwarding while the PFE handles routing protocols
   • B. The Routing Engine (RE) handles control-plane tasks (routing protocols, CLI, commit) while the Packet Forwarding Engine (PFE) handles data-plane forwarding and session lookup
   • C. There is only one shared plane; the SRX uses a single CPU for both
   • D. The PFE handles commits and the RE handles encryption only
   Show answer

   Correct: B. Junos uses a strict control-plane/data-plane split. The RE runs Junos OS (routing daemons, CLI, commit). The PFE runs the real-time forwarding code and the flow/session table. Confusing which plane does what is a JNCIA-SEC staple trap — RE never forwards packets, PFE never runs routing protocols.

2. A branch SRX300 is misbehaving — sessions are dropping under load. Which architectural fact about branch SRX devices is MOST relevant here?

   • A. Branch SRX devices use dedicated ASIC line cards like the high-end SRX
   • B. Branch SRX devices run the flow and routing code on the same multi-core CPU (no separate PFE ASIC), so heavy load impacts both planes
   • C. Branch SRX cannot run security policies
   • D. Branch SRX devices forward only at Layer 2
   Show answer

   Correct: B. Branch SRX (SRX300/320/340/345/380/550) uses a shared multi-core CPU — the flow daemon and the routing daemons share the same hardware. High-end SRX (SRX4000/5000) has dedicated SPUs/IOCs in the PFE. This explains why branch SRX devices can starve the control plane under DDoS or session-table churn.

3. Which TWO statements about Junos "packet mode" versus "flow mode" on an SRX are TRUE? (Choose 2)

   • A. Packet mode processes each packet independently without creating a session
   • B. Flow mode is the default mode on SRX devices and creates a session for the first packet of a connection
   • C. Packet mode supports stateful firewall and NAT
   • D. Flow mode bypasses all security policies
   • E. Switching modes requires a reboot
   Show answer

   Correct: A and B. Flow mode is default — stateful, session-based, supports policies/NAT/UTM. Packet mode is stateless (like a classic router) and used for things like sampled flow or MPLS LSR transit; it does NOT support stateful firewall or NAT. Changing forwarding-options family inet mode does require a reboot on most platforms.

4. Given the following output on an SRX: <pre>user@srx> show security flow session summary Unicast-sessions: 12450 Multicast-sessions: 0 Failed-sessions: 0 Sessions-in-use: 12450 Valid sessions: 12450 Maximum-sessions: 524288</pre> What does this confirm about the SRX?

   • A. It is running in packet mode
   • B. It is running in flow mode and tracks 12,450 active sessions out of a 524k capacity
   • C. It has stopped forwarding traffic
   • D. NAT is disabled
   Show answer

   Correct: B. Only flow mode populates the session table. The summary shows 12450 active unicast sessions, well below the 524288 cap. Packet mode would show no sessions because no flow daemon is creating them.

5. A junior engineer asks: "Why does my SRX5800 scale higher than my SRX300?" The MOST accurate answer is:

   • A. The SRX5800 uses a faster Junos OS image
   • B. The SRX5800 has dedicated Services Processing Units (SPUs) and I/O cards in the PFE, providing distributed session and security processing in hardware
   • C. The SRX5800 ships with more software licences enabled
   • D. The SRX5800 runs in packet mode by default
   Show answer

   Correct: B. High-end SRX (SRX4600/5400/5600/5800) distributes flow processing across multiple SPU cards — sessions are sharded across SPUs, IOCs handle I/O. That hardware fan-out gives the scale jump. Same Junos OS image; the difference is the PFE silicon.

Last updated: 2026-10-19

JN0-231 practice test FAQ

Related practice tests

• Juniper JN0-106 practice test
• Juniper JN0-335 practice test