When traffic matches a unified security policy, the SRX immediately stops further policy evaluation and applies the action (such as permit, deny, or reject) defined in that matching policy.
Unified security policies, like traditional ones, are processed in a top-down order.

Destination NAT allows inbound session initiation from the external network by translating the public (untrust) address to a private internal (trust) address, ensuring that sessions can only be established from the external device.

Content Security is the Juniper solution that adds antivirus capabilities to SRX Series Firewalls. Juniper Content Security includes several UTM-style services, such as antivirus, antispam, content filtering, and web filtering. The antivirus feature scans supported traffic to detect and block malicious files or virus-related content according to configured profiles and policies. IDP provides intrusion detection and prevention signatures, but it is not the specific solution that adds antivirus scanning. NAT translates IP addresses and ports and has no antivirus function. Firewall filters provide stateless packet filtering and traffic classification, not file-based malware inspection. Therefore, Content Security is the correct answer for adding antivirus features to an SRX Series device.

Unified security policies (USPs) provide integrated application-aware controls using AppID and extend traditional zone-based policy enforcement.
Option A: Correct. If traffic matches a unified security policy, it is not re-evaluated by traditional security policies. Unified policies take precedence for matched flows.
Option B: Incorrect. Traditional policies rely on Layer 3/4 attributes. Unified policies go deeper by leveraging AppID, which inspects traffic up to Layer 7.
Option C: Incorrect. Traffic matching a traditional policy is unaffected by unified policy unless unified mode is explicitly configured for those flows.
Option D: Correct. Dynamic application recognition in unified policies uses Layer 7 (application-layer) inspection via AppID.
Correct Statements: A and D

Screening in the flow module occurs before session lookup, allowing the device to drop unwanted or malicious traffic early in the processing path before any session is created.