By default, TCP has a 30-minute idle timeout, and UDP has a 60-second idle timeout.
Additionally, known IP protocols have a 30-minute timeout, whereas unknown ones have a 60- second timeout. Setting the inactivity timeout is very useful, particularly if you are concerned about applications either timing out or remaining idle for too long and filling up the session table.
According to the Juniper SRX Series Services Guide, this can be configured using the 'timeout inactive' statement for the security policy.

Security policies can reference additional services and authentication behavior after traffic matches the policy criteria. SSL proxy is applied through a security policy by matching the traffic that should be decrypted and inspected, then referencing the SSL proxy profile as an application service. Firewall authentication is also policy-based; Juniper describes it as requiring users to authenticate to the SRX Series Firewall before access between zones and devices is permitted. Captive portal authentication is a web redirection mechanism and is not the direct security policy feature identified in this question. MAC bypass is not a standard SRX security policy service. Therefore, SSL proxy and firewall authentication are the two features applied through security policy processing.

NextGen Web Filtering (NGWF) requires SSL proxy functionality to inspect HTTPS traffic. To enable NGWF:
* Option B:You can generate aself-signed certificatefor SSL proxy functionality (or import a CA-signed certificate, but the course emphasizes self-signed for lab/demo purposes).
* Option D:You must configure anSSL proxy profileso that HTTPS traffic can be decrypted and inspected.
* Option A:A CA-signed certificate may be used in production but is not strictly required to enable NGWF.
* Option C:SSL initiation profiles are used for outbound SSL inspection initiated by the SRX, not for NGWF traffic interception.
Correct Actions:Generate a self-signed certificate, Configure an SSL proxy profile Reference:Juniper Networks -NextGen Web Filtering Configuration with SSL Proxy, Junos OS Security Fundamentals.

SSL proxy can be applied in a security policy to inspect and control encrypted traffic.
Firewall authentication can also be configured within a security policy to require user authentication before allowing traffic to pass through the SRX device.

SSH Access (Option B): Host-inbound-traffic controls traffic destined to the SRX device itself (management/control plane). If host-inbound-traffic is not configured to allow SSH, then SSH access to the firewall is blocked.
Explicit Zone Configuration (Option D): For user-defined security zones, host-inbound-traffic must be explicitly configured to allow specific services (SSH, ICMP, SNMP, etc.).
Console Access (Option A): Console access is not controlled by host-inbound-traffic. Console access is always available directly.
Management Zone (Option C): In the management functional zone, host-inbound-traffic is implicitly allowed for management services, so this is not explicitly required.
Correct Statements: B and D