As per Juniper you can actually check the defaults by:
- Log in as the root user and provide your credentials.
- In shell mode, navigate to the /etc/config folder. (% cd /etc/config)
- Use ls to list which files are available, there should be something similar to srx650-factory.conf or srx650-defaults.conf
- Use vi filename to view contents
Steps taken from SRX650 Services Gateway Hardware Guide, you can also see the sampling of the above steps if in doubt.
System default security
Deny all transit traffic.
By default, the Junos OS denies all traffic through an SRX Series
device. In fact, an implicit default security policy exists that
denies all packets. You can change this behavior by configuring a
standard security policy that permits certain types of traffic, or by
configuring the default policy to permit all traffic.
Factory default security policies
Trust to trust permit, trust to untrust permit, untrust to trust deny
- Trust-to-trust zone policy: Permits all intrazone traffic within the trust zone;
- Trust-to-untrust zone policy: Permits all traffic from the trust zone to the untrust zone; and
- Untrust-to-trust zone policy: Denies all traffic from the untrust zone to the trust zone.
*quotes taken from JNCIS-SEC Study Guide- Part 1, Ch 3:Security Policies