JN0-106 Practice Test 21 — 15 Questions

Question 1

Scenario: Your company has a Juniper SRX300 firewall used as a branch gateway. It runs Junos 15.1X49. The firewall has multiple security policies, NAT rules, and VPN tunnels. Recently, you added a new security policy to allow traffic from the internal network to a specific public server. After committing, you notice that the firewall is logging repeated denials for traffic that should be matched by the new policy. The policy appears correctly configured in the candidate configuration. You want to verify that the policy is actually active and check for any hidden rules that might be causing the issue. Which of the following is the most effective first step to troubleshoot this problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'show security policies detail' and examine the policy order to see if a previous policy is denying the traffic.. The most common cause of traffic being denied despite a seemingly correct new policy is that a preceding policy in the security policy order matches the traffic and denies it before the new policy is evaluated. Junos security policies are evaluated in sequential order from top to bottom, and the first matching policy is applied. Running 'show security policies detail' displays the active configured policy order, allowing you to see if an earlier policy is intercepting the traffic. Note: default policies are not shown with this command; use 'show security policies default' for that.

Answer

Roll back to the previous configuration to ensure the device is in a known state.

Answer

Run 'show configuration | display set | match policy' to verify the policy is present.

Answer

Check the firewall logs with 'show log messages | match deny' to see which policy is denying.

Question 2

A network engineer made several configuration changes on a Juniper QFX switch to implement new VLANs. After committing the changes, the engineer realized that the new configuration caused a critical loss of connectivity to the management network. The engineer needs to revert to the previous configuration that was working. The switch is still accessible via the console port, and the engineer has privilege level access. The previous configuration was committed two commits ago, and the current active configuration is the problematic one. Which action should the engineer take to restore the previous working configuration?

Accepted Answer

Execute 'rollback 2' followed by 'commit'.. The working configuration was committed two commits ago. The 'rollback 2' command loads the configuration from two commits prior into the candidate configuration. After that, 'commit' makes it active, restoring connectivity. Note that 'rollback 1' would load the intermediate commit, which is also problematic, and 'rollback 0' refers to the current active configuration.

Answer

Use 'load override /config/juniper.conf.1.gz' followed by 'commit'.

Answer

Use 'delete system' to remove all configuration and then commit.

Answer

Execute 'rollback 0' followed by 'commit'.

Question 3

During a maintenance window, an engineer issues 'commit confirmed 5' but the change causes a connectivity loss. The engineer is unable to reconnect to the device before the timeout expires. What will happen?

Accepted Answer

The device automatically reverts to the previous active configuration.. The 'commit confirmed 5' command activates a candidate configuration and starts a 5-minute rollback timer. If the engineer does not issue a 'commit' or 'commit check' before the timer expires, Junos automatically reverts to the previously active configuration. This ensures the device returns to a known working state without manual intervention, preserving connectivity after the failed change.

Answer

The engineer must manually rollback using the rollback command.

Answer

The change remains committed until the next reboot.

Answer

The device reloads with factory defaults.

Question 4

An engineer is configuring multiple static routes to the same destination for redundancy. The primary link uses 192.168.1.1 and the backup uses 192.168.2.1. They want the backup to be used only when the primary next-hop is unreachable. Which configuration is correct?

Accepted Answer

Configure the primary with a lower preference and the backup with a higher preference.. In JUNOS, a lower preference value indicates a more preferred route. By setting the primary next-hop (192.168.1.1) with a lower preference (e.g., 5) and the backup next-hop (192.168.2.1) with a higher preference (e.g., 10), the primary route is installed in the routing table. If the primary next-hop becomes unreachable, the route is withdrawn, and the backup route with the higher preference is then installed, providing redundancy.

Answer

Configure the primary with a higher preference and the backup with a lower preference.

Answer

Configure two static routes with equal preferences; the active route will be chosen based on next-hop IP.

Answer

Configure the routes with the same preference but use a policy to set metric.

Question 5

A network engineer is configuring a new Juniper MX router to replace an existing core router. The engineer has applied several configuration changes and wants to ensure that the new configuration can be tested safely. If the test fails (e.g., loss of management connectivity), the router should automatically revert to the previous configuration after a 5-minute period. The engineer performs a commit confirmed with a timeout of 5 minutes. After 4 minutes, the engineer verifies that the change is successful and wants to make it permanent. Which action should the engineer take to ensure the configuration persists?

Accepted Answer

Issue a standard 'commit' command to confirm the configuration.. The correct action is D: issue a standard 'commit' command to confirm the configuration. In Junos, 'commit confirmed' activates the candidate configuration on a trial basis and automatically rolls back to the previous configuration unless it is confirmed within the specified timeout; issuing a normal 'commit' within that window makes the change permanent and cancels the rollback timer. Option A is wrong because 'rollback 0' loads the currently active configuration (the trial config) but does not by itself confirm it, and it is not the standard confirmation step. Option B is wrong because re-issuing 'commit confirmed 5' merely restarts the confirmation timer rather than making the configuration persistent. Option C is wrong because rebooting the router would not confirm the candidate configuration and could even trigger the pending rollback behavior.

Answer

Issue the 'rollback 0' command, then commit.

Answer

Issue the 'commit confirmed 5' command again to reset the timer.

Answer

Issue the 'request system reboot' command to reload the router.

Question 6

Which THREE statements are true about commit operations in Junos OS?

Accepted Answer

Multiple users can make configuration changes simultaneously, but only one can commit at a time.. Option B is correct because Junos OS uses a shared candidate configuration with per-user edit sessions, so multiple users can edit concurrently, but the commit operation itself is serialized through a lock so only one commit can activate changes at a time. Option C is correct because 'commit check' performs syntax and semantic validation of the candidate configuration against the schema without activating it, leaving the active configuration unchanged. Option D is correct because 'commit confirmed' activates the candidate configuration but automatically rolls back to the previously committed configuration unless the commit is confirmed within the timeout period (default 10 minutes). Option A is not correct because 'commit confirmed' does not immediately discard changes; it applies them and only rolls back if confirmation is not received before the timer expires. Option E is not correct because 'commit synchronize' is only needed to propagate a commit to both Routing Engines on a dual-RE system, and a plain 'commit' can still be used (it just commits to the local RE unless synchronize is specified).

Answer

The 'commit confirmed' command immediately discards changes if not confirmed.

Answer

The 'commit' command always requires 'commit synchronize' when using dual Routing Engines.

Question 7

A Juniper device fails to boot and stops at the 'loader>' prompt. What is the most likely cause of this issue?

Accepted Answer

Bad boot device or missing kernel. When a Juniper device stops at the 'loader>' prompt, it indicates that the boot process has failed to locate or load the kernel (juniper-kernel) from the boot device (e.g., internal flash, USB, or hard disk). This is typically caused by a corrupted boot device, missing kernel image, or incorrect boot device selection in the boot loader (UBoot or CFE). The loader prompt is a low-level environment used for recovery, not a sign of configuration or authentication issues.

Answer

Corrupted configuration file

Answer

Hardware failure of the power supply

Answer

Missing root password

Question 8

An administrator executes 'show route 192.168.1.0/24' and sees no output, but the route is configured. Which command should be used to display the reason the route is not active?

Accepted Answer

show route hidden. The 'show route hidden' command displays routes that are present in the routing table but are not active due to reasons such as a next-hop being unreachable, a routing policy rejecting the route, or a route preference conflict. When a route is configured but not shown in the standard 'show route' output, it is likely hidden, and this command reveals the specific reason (e.g., 'next-hop unreachable' or 'rejected by policy').

Answer

show log messages

Answer

show route protocol static

Answer

show route forwarding-table

Question 9

A router receives two OSPF routes for 10.10.10.0/24: one intra-area with preference 10 and metric 1, and one external type 2 with preference 150 and metric 20. Which route is selected as active?

Accepted Answer

The intra-area route because it has a lower preference. B is correct because Junos uses route preference (administrative distance) as the primary tiebreaker when selecting the active route for a destination. The intra-area OSPF route has a default preference of 10, which is lower than the external type 2 route's preference of 150, so the intra-area route is installed into the routing table regardless of metric values.

Answer

The external route because it is type 2

Answer

The external route because it has a higher metric

Answer

The intra-area route because it has a lower metric

Question 10

An engineer wants to view the current active configuration file that the device is using. Which command displays this information?

Accepted Answer

show configuration. The 'show configuration' command displays the current active configuration that the device is using, which is the committed configuration stored in /config/juniper.conf.gz. This command reads the active configuration file directly from the file system, showing the exact operational configuration that Junos applies to the device.

Answer

show configuration candidates

Answer

show system commit

Answer

show configuration | display set

Question 11

An administrator suspects that routing protocol updates are being sent to an incorrect next-hop. Which command can be used to capture and analyze the routing protocol packets on an interface?

Accepted Answer

monitor traffic interface ge-0/0/0.0. The 'monitor traffic interface' command in Junos captures live packets on a specified interface, allowing the administrator to inspect routing protocol packets (e.g., OSPF, BGP) in real time. This is the only option that directly captures and displays packet-level data to verify the next-hop IP address in routing protocol updates.

Answer

show log messages | match ospf

Answer

show route forwarding-table

Answer

show ospf neighbor detail

Question 12

You are managing a small enterprise network with one Juniper router and two switches. The router connects to an ISP via ge-0/0/0 and to the internal network via ge-0/0/1. The internal network uses the 192.168.1.0/24 subnet. You need to configure a default route on the router to send all Internet-bound traffic to the ISP gateway at 203.0.113.1. You also want to ensure that internal hosts can reach the Internet. After configuring the default route, you test connectivity from a host on the internal network to an external website, but the ping fails. You verify that the host has an IP address of 192.168.1.100/24 and a default gateway of 192.168.1.1 (the router's internal interface). On the router, you run 'show route 0.0.0.0/0' and see the default route active. You also run 'ping 203.0.113.1' from the router and it succeeds. However, pinging from the host to the ISP gateway fails. What is the most likely cause?

Accepted Answer

The host's default gateway is incorrectly configured.. The host's default gateway is configured as 192.168.1.1, which is the router's internal interface. However, if the host's gateway is incorrectly set (e.g., to a different IP or a non-existent router), it cannot send packets to the router. The router's default route and ping to the ISP gateway succeed from the router itself, indicating the router's configuration is correct. The failure from the host points to an issue at the host's network configuration, most likely the default gateway setting. Other possibilities include NAT or return route issues, but these are not listed as options. Proxy ARP is not required for directly connected hosts and is not the most likely cause.

Answer

DNS resolution is failing on the host.

Answer

The default route is not active on the router.

Answer

Proxy ARP is not enabled on the router's internal interface.

Question 13

During troubleshooting, an engineer needs to view real-time logging messages on a Junos device. Which command should be used?

Accepted Answer

monitor start messages. The 'monitor start messages' command enables real-time, tail-like display of the /var/log/messages log file on a Junos device, allowing the engineer to view new log entries as they are generated. This is the correct command for live troubleshooting because it continuously updates the terminal with incoming syslog messages, unlike static file viewing commands.

Answer

file show /var/log/messages

Answer

show log messages

Answer

traceoptions

Question 14

A network engineer notices that a device is not sending SNMP traps to the NMS. Which operational command should be used to verify SNMP configuration?

Accepted Answer

show snmp. The 'show snmp' command in Junos displays the current SNMP configuration, including community strings, trap destinations, and enabled trap groups. Since the issue is that the device is not sending SNMP traps, this command allows the engineer to verify that trap destinations are correctly configured and that the appropriate trap groups are enabled. Other commands like 'show system uptime' or 'show route' do not provide any SNMP-specific configuration details.

Answer

show system uptime

Answer

show route

Answer

show interfaces terse

Question 15

A technician needs to display the contents of a configuration file stored on the device's hard disk. Which operational mode command should they use?

Accepted Answer

file show. The 'file show' command in Junos operational mode is used to display the contents of a file stored on the device's hard disk, such as a configuration file. Unlike 'show configuration', which displays the active candidate or committed configuration, 'file show' reads the raw file from the filesystem, making it the correct choice for viewing a stored configuration file.

Answer

show configuration

Answer

file list

Answer

view file