The /.:/fs entry is the DFS junction entry. This is the entry for a server that manages the DFS file location database.
The /.:/sec entry is the DCE Security Service junction entry. This is the entry for a server that manages the security service database (also called the registry database).
The /.:/fs and /.:/sec root entries in the figure, The Cell Namespace after Configuration, are junctions maintained by DCE components. The /.:/sec junction is the security service's namespace of principal identities and related information. DFS's fileset location servers are reached through the /.:/fs entry, making /.:/fs effectively the entry point into the cell's distributed file system.
Note that /.:/sec and /.:/fs are both actually RPC group entries; the junctions are implemented by the servers whose entries are members of the group entries. (See the OSF DCE Administration Guide for further details on the security service and DFS junctions.)