JNCIA-JUNOS Practice Test 37 — 15 Questions

Question 1

You are administering a Juniper MX240 router that provides connectivity to multiple customer sites. The router uses BGP to exchange routes with two upstream ISPs. Recently, you applied a new firewall filter to the loopback interface to restrict management access. After committing the configuration, you can no longer establish SSH sessions to the router from the management network. You are currently connected via console. The loopback filter is still applied. You suspect the filter is blocking SSH traffic from the management network. What should you do to restore SSH access without losing the other filter rules?

Accepted Answer

Add a new term at the beginning of the filter that accepts SSH traffic from the management network, then reorder the terms so that this term is evaluated first.. Option C is correct because firewall filters in Junos are evaluated in order, and adding a term at the beginning that explicitly accepts SSH traffic from the management network ensures that the SSH packets are permitted before any subsequent deny terms are evaluated. This preserves all existing filter rules while restoring SSH access. The 'insert' command or reordering terms is necessary to place the new term first, as the default behavior appends new terms to the end of the filter.

Answer

Roll back to the previous configuration using 'rollback 0' and commit.

Answer

Add a new term at the end of the filter that accepts SSH traffic from any source.

Answer

Delete the firewall filter from the loopback interface and commit.

Question 2

You are a network administrator for a large enterprise. You have a Juniper SRX firewall that is used as the primary internet gateway. Users are reporting that they are unable to access certain external websites. You check the device and find that the security policies appear correct, and the routing is in place. You suspect that the issue might be related to the DNS resolution. You want to verify that the device can resolve DNS names and that the DNS server configuration is correct. Which command should you use to test DNS resolution from the Juniper device?

Accepted Answer

ping <external website FQDN>. Option B is correct because the `ping` command with a fully qualified domain name (FQDN) forces the Juniper device to perform a DNS resolution before sending ICMP echo requests. If the device cannot resolve the FQDN, the ping will fail with a 'hostname not found' error, directly indicating a DNS configuration or reachability issue. This tests both the DNS server configuration and the device's ability to resolve names, which is essential for verifying DNS functionality.

Answer

show system connections

Answer

traceroute <external website FQDN>

Answer

show dns name-server

Question 3

You are managing a Juniper EX4300 switch that serves as a Layer 3 access switch for a campus network. The switch has multiple VLANs configured with IRB interfaces. Users in VLAN 10 report that they cannot reach the default gateway (IRB.10) even though other VLANs are working fine. You check the configuration and see that interface irb.10 is configured with an IP address. You also verify that the VLAN is associated with the correct access ports. However, when you ping the IRB.10 address from the switch itself, it fails. You suspect that the issue might be that the IRB interface is not 'up'. Which command would you use to quickly verify the operational status of the IRB interface?

Accepted Answer

show interfaces terse irb.10. Option A is correct because `show interfaces terse irb.10` displays the operational status (up/down) of the IRB interface along with its configured IP address. Since the issue is that the IRB interface may not be 'up', this command quickly confirms whether the interface is operationally active, which is essential for Layer 3 forwarding.

Answer

show ethernet-switching table

Answer

show configuration interfaces irb.10

Answer

show vlan

Question 4

A company has a Juniper MX router acting as a BGP route reflector. The router has two routing instances: 'internet' and 'management'. The 'internet' instance uses a firewall filter to block traffic to the router's loopback address from external sources. After a recent configuration change, the engineer notices that SSH access to the router's loopback IP (10.0.0.1) from the internal management network (192.168.0.0/16) is being dropped. The firewall filter for the loopback interface in the 'internet' instance is correctly configured to allow traffic from 192.168.0.0/16. The management instance has no firewall filter applied. The engineer suspects that the issue is related to how the routing instances interact with the loopback interface. Which of the following is the most likely cause and solution?

Accepted Answer

The firewall filter applied to the loopback interface is shared across all routing instances; use a separate interface for management traffic or apply the filter only to the 'internet' instance's logical system.. In Junos, firewall filters applied to the loopback interface (lo0) are shared across all routing instances by default because the loopback is a single physical interface. Even though the filter is configured in the 'internet' instance, it affects traffic destined to the loopback IP from any instance, including the 'management' instance. To isolate management traffic, you must either use a separate physical interface or apply the filter only to the 'internet' instance's logical system (e.g., using a firewall filter with a routing-instance match condition).

Answer

The management instance needs a firewall filter that allows SSH; add a filter to the management instance's loopback.

Answer

The firewall filter in the 'internet' instance incorrectly blocks SSH; modify the filter to allow SSH from any source.

Answer

The BGP configuration is causing the loopback to be unreachable; disable BGP on the management instance.

Question 5

You are troubleshooting an OSPF issue on a Juniper router. The router has a single interface ge-0/0/1 with IP 10.1.1.1/30 connected to a neighbor with IP 10.1.1.2/30. OSPF is configured area 0. The 'show ospf neighbor' command shows no neighbors. 'show interfaces ge-0/0/1 terse' shows the interface is up. 'show configuration protocols ospf' shows:
   area 0.0.0.0 {
       interface ge-0/0/1.0 {
           passive;
       }
   }
What is the problem?

Accepted Answer

The OSPF interface is configured as passive. The 'passive' statement under the OSPF interface configuration prevents the router from sending or processing OSPF Hello packets on that interface. Without Hello packets, the router cannot discover neighbors or form adjacencies, which is why 'show ospf neighbor' returns no neighbors even though the interface is operationally up.

Answer

The hello timer is too slow

Answer

Authentication is missing

Answer

The interface is administratively down

Question 6

Your company has deployed a Juniper MX router at a branch office. The router has two upstream connections to different ISPs. The configuration currently uses a single static default route to ISP-A. The network team wants to add redundancy so that if ISP-A fails, traffic automatically uses ISP-B. The ISP-B connection is already configured on interface ge-1/0/0 with IP address 203.0.113.2/30. The next-hop IP for ISP-B is 203.0.113.1. The routing table should have a backup default route with a higher metric. Which configuration change meets the requirement?

Accepted Answer

set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1 metric 2. Option C is correct because it adds a static default route to ISP-B with a metric of 2, which is higher than the default metric of 0 (or 1 if explicitly set) for the existing route to ISP-A. In Junos, when multiple static routes to the same destination exist, the route with the lower metric (preference) is installed in the routing table. If the primary route fails (e.g., interface down), the route with the higher metric becomes active, providing automatic failover.

Answer

set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1 metric 1

Answer

set routing-options static route 0.0.0.0/0 discard

Answer

set routing-options static route 0.0.0.0/0 next-table inet.0

Question 7

You are a network engineer for a company that has just deployed a Juniper SRX firewall in a branch office. The device has multiple interfaces: ge-0/0/0 connected to the internet, ge-0/0/1 connected to the internal LAN (192.168.1.0/24), and ge-0/0/2 connected to a DMZ (10.0.0.0/24). After initial configuration, you attempt to ping from the SRX to a server on the internet (8.8.8.8) but receive no response. You also notice that internal users can access the internet. You have verified the routing table shows a default route via ge-0/0/0. The security policies appear correct. You suspect the issue is related to interface configuration. What is the most likely cause and the correct course of action?

Accepted Answer

The interface ge-0/0/0 is missing the 'host-inbound-traffic' configuration under its security zone; you should add the appropriate system services under the zone.. The SRX can ping internal hosts but not the internet because the interface ge-0/0/0 is in the untrust zone, which by default blocks all inbound traffic, including pings originated from the device itself. The 'host-inbound-traffic' configuration under the security zone allows system services such as ping, SSH, and SNMP to be received on that interface. Without it, even though the routing table and security policies are correct, the SRX will drop its own outbound ICMP echo requests before they can be sent, or drop the replies if they are treated as inbound traffic.

Answer

The security policy from the trust zone to the untrust zone is blocking traffic; you should create a policy allowing all traffic from the SRX itself.

Answer

The interface ge-0/0/0 has an incorrect MAC address; you should clear the ARP cache.

Answer

The default route is missing or incorrect; you should add a default route via the internet gateway IP.

Question 8

You are the network administrator for a large enterprise with a Juniper MX480 router running Junos 18.2R3. The router has two Routing Engines (RE0 and RE1) in a graceful Routing Engine switchover (GRES) configuration. During a scheduled maintenance window, you need to upgrade the Junos OS to a newer version while minimizing traffic loss. The upgrade process requires a reboot of both REs. You have staged the software on both REs. Which sequence of commands should you use to perform the upgrade with minimal disruption?

Accepted Answer

On RE1 (backup): request system software add re1; request system reboot re1. After reboot, request chassis routing-engine master switch. On RE0 (now backup): request system software add re0; request system reboot re0.. Option D is correct because it performs a hitless upgrade by first upgrading and rebooting the backup RE (RE1), then performing a graceful mastership switch using 'request chassis routing-engine master switch', and finally upgrading and rebooting the former primary (now backup) RE0. This sequence ensures that during each RE reboot, the other RE remains active and continues forwarding traffic, leveraging GRES to maintain state and minimize packet loss.

Answer

On both REs: request system software add <image>; then request system reboot both REs simultaneously.

Answer

On RE0: request system software add re0; on RE1: request system software add re1; then request system reboot both.

Answer

On RE0 (primary): request system software add re0; request system reboot re0. After reboot, on RE1: request system software add re1; request system reboot re1.

Question 9

Your Juniper router is running OSPF with multiple neighbors. You have a prefix 10.10.10.0/24 that is being learned via OSPF from two different routers: Router A with metric 30 and Router B with metric 20. The OSPF route from Router B is active. You want to ensure that traffic to 10.10.10.0/24 uses the path through Router A instead, even though it has a higher metric. You cannot change the OSPF metric on Router A. Which action should you take?

Accepted Answer

Use a routing policy to increase the preference of the OSPF route from Router B.. In JUNOS, route preference (administrative distance) determines which route is installed in the routing table when multiple protocols or sources provide the same prefix. By default, OSPF internal routes have a preference of 10. You can use a routing policy to increase the preference of the OSPF route from Router B (making it less preferred), which will cause the route from Router A (with its default preference of 10) to become active, even though its metric is higher. This approach does not require changing the OSPF metric or removing the route from Router A.

Answer

Increase the metric on Router B for that prefix.

Answer

Use a routing policy to reject the OSPF route from Router A.

Answer

Configure a static route to 10.10.10.0/24 pointing to Router A.

Question 10

A network operations team has received a new Juniper router to replace an existing legacy router. The team needs to apply a baseline configuration that includes system settings, interfaces, and security policies. The configuration is provided as a text file containing Junos configuration hierarchy syntax (e.g., 'system { host-name... }'). The engineer connects to the console and sees the prompt 'root@%'. What is the most efficient way to apply the configuration?

Accepted Answer

Use the 'load merge' command to merge the configuration file.. Option D is correct because the engineer is at the shell prompt (root@%), not in configuration mode. The 'load merge' command is used within configuration mode to merge a configuration file (in Junos hierarchy syntax) into the candidate configuration, which is the most efficient way to apply a pre-written baseline configuration without manual typing or complex file transfers.

Answer

Use the 'load set' command to load a set of configuration commands.

Answer

Use FTP to transfer the file and then commit.

Answer

Enter configuration mode and manually type each command.

Question 11

A network engineer accidentally committed a configuration on a Juniper router that caused a loss of management access via SSH and SNMP. The engineer has console access and the device is still operational. Before the change, the engineer had saved a rescue configuration using 'request system configuration rescue save'. Which action should the engineer take to restore management access most quickly?

Accepted Answer

At the shell prompt, execute 'cli -c "rollback rescue"' and then commit.. Option A is correct because the 'request system configuration rescue save' command stores a rescue configuration that can be rolled back to using 'rollback rescue' in configuration mode. Since the engineer has console access, they can enter configuration mode and execute 'rollback rescue' followed by 'commit' to instantly revert to the last known working configuration, restoring SSH and SNMP access without requiring a reboot.

Answer

At the configuration mode, execute 'rollback 0'.

Answer

Power cycle the device; it will automatically boot with the rescue configuration.

Answer

Reboot the device and press the space bar to load the rescue configuration.

Question 12

Your company runs a Juniper MX480 router as the core gateway. The router has been experiencing intermittent connectivity issues with a remote site over a point-to-point OC3 link. Users report that the link goes down for a few seconds several times a day. You suspect that the issue might be related to physical layer errors or framing. You need to determine the cause and collect relevant data to present to the service provider. Which course of action should you take first?

Accepted Answer

Run 'monitor interface so-0/0/0' and observe for any CRC errors or alarms over a period of time.. Option A is correct because 'monitor interface so-0/0/0' provides real-time, continuous display of interface counters and alarms, allowing you to observe CRC errors, framing errors, or alarms (e.g., LOS, LOF) as they occur. This is the most direct way to capture transient physical-layer issues on a SONET/SDH OC3 link without disrupting service, making it the appropriate first step before escalating to the service provider.

Answer

Perform a loopback test on the interface using 'test interface so-0/0/0'.

Answer

Review the system syslog file using 'show log messages' and search for interface down messages.

Answer

Immediately replace the serial interface card to rule out hardware failure.

Question 13

You are a junior network engineer tasked with upgrading the Junos OS on a pair of EX3400 switches that are in a Virtual Chassis. You have downloaded the new software image to the primary switch. Before performing the upgrade, you must verify the image's integrity and check the current version. Which sequence of commands should you use?

Accepted Answer

Run 'show version' and then 'request system software validate /var/tmp/junos-new.tgz'.. Option C is correct because 'show version' displays the current Junos OS version running on the switch, which is necessary to confirm the starting point before an upgrade. Then 'request system software validate /var/tmp/junos-new.tgz' performs a checksum verification and package integrity check on the image file without installing it, ensuring the image is not corrupted. This sequence directly addresses the two tasks: verifying the image's integrity and checking the current version.

Answer

Run 'show system uptime' and then 'request system software add /var/tmp/junos-new.tgz'.

Answer

Run 'show system software' and then 'request system software add validate'.

Answer

Run 'show configuration system software' and then 'file checksum sha256 /var/tmp/junos-new.tgz'.

Question 14

A junior network engineer is learning JunOS CLI and wants to view the last 10 lines of the system log file. They log into the device and type 'show log messages | last 10'. They receive an error: 'unknown pipe command'. Which pipe command should they use instead?

Accepted Answer

| tail 10. In JunOS CLI, the pipe command to display the last N lines of output is '| tail N', not '| last N'. The 'tail' command filters the output to show only the final lines, analogous to the Unix 'tail' utility. Option D is correct because '| tail 10' will show the last 10 lines of the system log file.

Answer

| last 10

Answer

| display 10

Answer

| head 10

Question 15

You are a network engineer responsible for a Juniper MX240 router in a data center. The router is running Junos 18.2R1 and you need to upgrade it to 19.1R2 to fix a critical security vulnerability. You establish an SSH session to the router and enter configuration mode to prepare the upgrade. While in configuration mode, you notice that the candidate configuration contains several uncommitted changes from a previous engineer that attempted to modify BGP settings but introduced a syntax error. The candidate configuration fails any commit operation due to this error. The currently active configuration is stable and the router is handling production traffic. The upgrade process requires you to change the boot media and specify the new image. Which action should you take to clear the candidate configuration and proceed with the upgrade?

Accepted Answer

Execute the 'rollback 0' command to discard the candidate and replace it with the active configuration, then proceed with the upgrade commands.. Option B is correct because the 'rollback 0' command discards all uncommitted changes in the candidate configuration and replaces it with the active, committed configuration. This clears the syntax error without affecting the running router, allowing you to proceed with the upgrade commands (e.g., 'request system software add') without a reboot or forced commit.

Answer

Reboot the router to clear the candidate configuration and then start the upgrade.

Answer

Run the 'load override terminal' command and paste the active configuration from memory, then commit and upgrade.

Answer

Use the 'commit force' command to override the syntax error and commit the candidate, then perform the upgrade.