Exception traffic refers to traffic that must be sent from the Packet Forwarding Engine (PFE) to the Routing Engine (RE) for processing, such as routing protocol updates, management traffic, and control-plane destined packets.
Option B: Correct. Exception traffic is rate-limited on the internal connection between the PFE and RE to protect the Routing Engine from denial-of-service attacks.
Option A: Incorrect. Exception traffic is not handled only on the PFE; it requires RE involvement.
Option C: Incorrect. Rejected traffic by security policies is simply dropped, not classified as exception traffic.
Option D: Incorrect. Malformed packets are dropped, not considered exception traffic.
Correct Statement: Exception traffic is rate-limited between the PFE and RE.

Intra-zone traffic: On SRX devices, traffic between interfaces in the same security zone is allowed without requiring a security policy (Option C is correct). Policies are only evaluated for inter-zone traffic.
Junos-host functional zone: This zone is a predefined functional zone that allows administrators to apply policies controlling access to the SRX firewall itself, such as SSH, HTTP, or SNMP traffic (Option D is correct).
Null zone: This zone is a predefined discard zone. Interfaces placed in the null zone drop all traffic. It does not allow policy logging of dropped control plane traffic (Option A is incorrect).
Management functional zone: This is used to define management interfaces, not the "functional zone" as stated in Option B (incorrect wording).
Correct Statements: C and D

Transit traffic is defined as traffic passing through the SRX firewall (from one interface/zone to another). To allow transit traffic:
Interfaces must be placed into a user-defined security zone (Option C).
Policies between zones are then applied to control traffic.
The null zone (Option A) discards all traffic.
The Junos-host zone (Option B) is used for traffic destined to the SRX itself, not transit.
Functional zones (Option D) are predefined and used for special purposes (like management), not for transit traffic.
Correct Configuration: User-defined security zone

In Juniper SRX flow-based packet processing, the flow module is responsible for security functions such as screening, session management, NAT, and policy enforcement. The processing order is critical:
Screens are applied before any session lookup. This ensures that packets are inspected for anomalies, floods, or protocol violations before consuming resources for session management. Examples of these screens include TCP SYN flood protection, ICMP flood protection, and port scanning protection.
After screening, the session lookup occurs. At this point, the firewall checks whether the packet belongs to an existing session in the session table. If a matching session is found, the packet bypasses policy evaluation and is forwarded according to the session state.
If no existing session is found, the packet continues through route lookup, NAT processing, and security policy evaluation before a new session is created.
Thus, screening occurs before the session lookup, protecting the system early in the flow process. This design ensures efficiency by dropping malicious or malformed traffic before allocating session resources.

Content filtering on SRX Series Firewalls is part of Juniper Content Security, but Juniper documentation states that content filtering does not require a separate license. Content filtering provides basic data loss prevention by filtering traffic based on MIME type, file extension, and protocol commands. Therefore, option C is correct because no separate content filtering license is required, and option B is correct because file extension is one of the supported filtering attributes. Option A is incorrect because it directly contradicts Juniper's content filtering documentation. Option D is not the best answer because content filtering is not described as full file-content inspection for determining file type; deeper inspection functions are associated with other Content Security services such as antivirus and AppID-based inspection.