The host-inbound-traffic parameter controls traffic destined to the SRX device itself, not transit traffic passing through the firewall. This traffic is commonly called self traffic or exception traffic because it terminates on the firewall's Routing Engine for services such as SSH, ping, BGP, OSPF, or management access. Juniper describes host-inbound-traffic as controlling the type of traffic that can reach the device from interfaces bound to a security zone. Junos security zone configuration is applied to logical interfaces, such as ge-0/0/1.0, not merely physical ports. Therefore, exception traffic and protocols on logical interfaces are the correct choices. Transit traffic is controlled by security policies, not host-inbound-traffic.

When traffic enters an SRX Series Firewall, the ingress interface determines the source security zone because that interface is already bound to a zone. The route lookup is then used to determine where the packet should leave the device. Juniper documentation explains that the packet's outgoing zone is determined by the forwarding lookup, and together the incoming zone and outgoing zone determine which security policy context is used. Therefore, the route lookup determines the egress interface and, indirectly through the egress interface's zone membership, the egress security zone. It does not determine the ingress interface because the packet has already arrived on that interface. It also does not determine a DNS name; DNS resolution is unrelated to SRX route lookup and security zone selection.

PAT (Port Address Translation), also called NAT overload, allows many devices to share a single public IP:
Option C: Correct. Multiple internal hosts share a single external IP.
Option D: Correct. Each internal host is mapped to the same public IP but differentiated by unique port numbers.
Option A: This describes basic static NAT (1-to-1 mapping).
Option B: Incorrect, this describes general NAT behavior but not specific to PAT.
Correct Statements: PAT enables multiple internal devices to share one external IP, and it maps internal IPs to external IP + port.

On SRX Series Firewalls, Junos OS automatically creates system-defined zones that have special functions:
Null zone (Option A): A predefined discard zone. By default, all interfaces belong to the null zone until assigned to a user-defined zone. Traffic destined to the null zone is dropped.
Junos-host zone (Option B): A predefined functional zone that allows security policies to control traffic directed to the SRX device itself (management traffic, such as SSH, HTTP, SNMP).
Management zone (Option C): There is a predefined management functional zone, but it is not called "management" as a system-defined security zone.
DMZ (Option D): A DMZ zone must be explicitly created by the administrator, it is not system-defined.
Correct Zones: null, junos-host

Option B: Correct. Interfaces in the same security zone must belong to the same routing instance; zones cannot span multiple routing instances.
Option D: Correct. A security zone can contain multiple interfaces, allowing grouping of similar trust levels (e.g., multiple LAN subnets in a trust zone).
Option A: Incorrect. An interface can belong to only one zone at a time.
Option C: Incorrect. Interfaces within the same zone cannot be split across routing instances.
Correct Statements: Interfaces in the same zone must share the same routing instance, and a zone can contain multiple interfaces.