You are deploying a new SRX Series device and you need to log denied traffic. In this scenario, which two policy parameters are required to…

To log traffic that is denied by a security policy on an SRX Series device, two specific parameters are required within the policy configuration. First, the policy's action must be set to deny to instruct the device to block the matching traffic. Second, the log session-init parameter must be configured. For policies with a deny action, Junos OS generates a log entry when the initial packet is processed and dropped. A full session is never established, so only the session-init log is created.

B. session-close: This is incorrect because a session is never established for denied traffic. Therefore, there is no session to close, and a session-close log cannot be generated.

D. count: This is incorrect because the count parameter only increments a statistical counter for traffic that matches the policy rule; it does not generate a detailed log message.

1. Juniper Networks TechLibrary

Junos OS Security Configuration Guide

"Understanding Security Policy Logging": This document explicitly states

"For policies with a “deny” action

only the session-init log is created. The session-close log is not created because a session is never established." This supports selecting session-init (A) and rejecting session-close (B).

2. Juniper Networks TechLibrary

Junos OS Security Configuration Guide

"Example: Configuring a Security Policy to Permit or Deny Traffic": This guide demonstrates the basic structure of a security policy

showing that deny (C) is the fundamental action required to block traffic

which is a prerequisite for logging that denied traffic.

3. Juniper Networks TechLibrary

Junos OS Security Configuration Guide

"then (Security Policies)": This configuration reference details the available actions within a policy's then block

clearly distinguishing between the log action (which generates system log messages) and the count action (which increments a packet counter)

confirming that count (D) does not fulfill the requirement to log traffic.