JN0-106 Hard Questions — 25 Difficult Questions

Question 1

Which THREE route types are considered protocol-independent in Junos?

Accepted Answer

Direct routes. Direct, local, and static routes are considered protocol-independent because they are not learned or installed by any dynamic routing protocol. Direct routes are automatically created for directly connected interfaces, local routes represent the interface's own IP address, and static routes are manually configured by an administrator. These routes exist in the routing table regardless of whether any routing protocol is running, hence the term 'protocol-independent'.

Answer

BGP routes

Answer

OSPF routes

Question 2

During a maintenance window, an engineer needs to apply a series of configuration changes that are stored in a text file. Which command sequence should be used to load and apply the changes from the file?

Accepted Answer

configure; load merge /var/tmp/changes.txt; commit. The engineer needs to enter configuration mode (configure) and then use the 'load merge' command to merge the contents of the text file into the candidate configuration without replacing the entire configuration. The 'commit' command then activates the changes. This is the standard Junos workflow for applying incremental changes from a file.

Answer

request system configuration rescue save

Answer

load override /var/tmp/changes.txt; commit

Answer

configure; load patch /var/tmp/changes.txt; commit

Question 3

Refer to the exhibit. A network administrator configured a static route to 10.0.0.0/24 with next-hop 192.168.1.1. The route is not appearing in the active routing table. What is the most likely reason?

Accepted Answer

The next-hop address is not reachable.. Option A is correct because a static route with a specified next-hop is only installed in the active routing table if that next-hop address is resolvable and reachable via a connected/recursive route; if 192.168.1.1 is not reachable, the route stays inactive. Option B is wrong because a reject route is a deliberately configured static route type that discards traffic, not the default behavior of a normal static route. Option C is wrong because OSPF routes typically have a higher administrative distance (110) than static routes (1), so OSPF would not override a static route. Option D is wrong because static route preference (administrative distance) being too high would only matter if a competing route existed, and it does not explain why the route is absent from the table.

Answer

The route is a reject route.

Answer

The route is being overridden by an OSPF route with lower preference.

Answer

The static route preference is too high.

Question 4

Refer to the exhibit. An administrator notices repeated failed login attempts. What should be configured to mitigate this attack?

Accepted Answer

Configure a firewall filter to block the source IP. A firewall filter can block traffic from the source IP address of the repeated failed login attempts, preventing further access from that host. This is a direct and immediate mitigation against an ongoing brute-force attack, as it stops the attacker's traffic at the network layer before it reaches the SSH or login service.

Answer

Set login retry limit

Answer

Disable SSH

Answer

Change the root password

Question 5

A router is experiencing intermittent packet loss. The engineer runs 'show interfaces ge-0/0/0 extensive' and notices a high number of input errors but no output errors. What is the most likely cause?

Accepted Answer

A faulty transceiver. A high number of input errors with no output errors on a Juniper interface typically indicates a Layer 1 issue at the receiving end. A faulty transceiver can cause signal degradation, leading to CRC errors, framing errors, or alignment errors, all of which are counted as input errors. Since output errors are absent, the problem is not with the router's transmission but with the incoming signal quality.

Answer

The cable is too long

Answer

MTU mismatch

Answer

The interface is oversubscribed

Question 6

Refer to the exhibit. An engineer notices that SNMP traffic from source 10.1.1.1 is being rejected on interface ge-0/0/1. The engineer wants to allow SNMP from this source while still blocking other SNMP traffic from the 10.0.0.0/8 range. Which change should be made?

Accepted Answer

Insert a term 0 before term 1 to permit SNMP from 10.1.1.1. Firewall filters in Junos are evaluated sequentially from the lowest term number. By inserting a new term 0 before the existing term 1 that explicitly permits SNMP traffic (UDP ports 161/162) from source 10.1.1.1, the filter will match and accept this traffic before reaching the deny term for the 10.0.0.0/8 range. This ensures the specific host is allowed while still blocking other SNMP traffic from the broader subnet.

Answer

Add a term at the end to permit all from 10.1.1.1

Answer

Change the source-address in term 1 to 10.0.0.0/8 except 10.1.1.1

Answer

Remove the filter and apply a new filter that permits SNMP from 10.1.1.1

Question 7

A junior admin tries to commit a configuration but receives a 'commit error: syntax error' message. They suspect a missing closing brace. Which CLI command helps identify the exact line with the error?

Accepted Answer

commit check. The 'commit check' command validates the candidate configuration for syntax errors without committing it. When a syntax error like a missing closing brace is present, commit check outputs the exact line number and file where the error occurs, allowing the admin to locate and fix the issue before attempting a commit again.

Answer

rollback 0

Answer

load merge

Answer

show configuration

Question 8

A network engineer needs to analyze NTP synchronization status and offset. Which command provides detailed NTP peer information including delay, offset, and jitter?

Accepted Answer

show ntp associations. The 'show ntp associations' command displays detailed NTP peer information, including delay, offset, and jitter, which are essential for analyzing synchronization status. This command lists all configured NTP peers and their current state, providing the specific metrics needed to assess clock accuracy and stability.

Answer

show ntp statistics

Answer

show ntp status

Answer

show ntp peer

Question 9

A service provider operates a Juniper MX router that receives a default route from two different ISPs via EBGP. Both ISPs advertise 0.0.0.0/0 with the same local preference (100), same AS path length, and same metric. The network administrator wants to load balance outgoing traffic across both ISPs for redundancy and bandwidth utilization. After applying the configuration, the administrator checks the routing table and sees that only one default route is active, the one from ISP-A. The other route from ISP-B is present but not active. The administrator verifies that both routes have the same preference (170) and same BGP attributes. The ISP links are different: ISP-A is connected via interface ge-0/0/0.0 with next-hop 10.1.1.2, and ISP-B via interface ge-0/0/1.0 with next-hop 10.2.2.2. What is the most likely reason that both routes are not active and load-balanced?

Accepted Answer

The BGP routes are from different autonomous systems.. By default, Junos BGP does not load balance routes from different autonomous systems. To enable multipath across different ASes, the 'multipath multiple-as' command must be configured under BGP. Option A is irrelevant. Option B is not a cause because different next-hops can be load-balanced under multipath. Option D is the solution, not the cause. Therefore, the most likely cause is that the routes are from different ASes.

Answer

The router has 'no-policy-statistics' enabled on the BGP sessions.

Answer

The BGP routes have different next-hop addresses.

Answer

The router is configured with 'multipath multiple-as' under BGP.

Question 10

Which TWO statements correctly describe the behavior of the 'commit confirmed' command in Junos?

Accepted Answer

The confirmation timeout can be modified by specifying a number of minutes.. The `commit confirmed` command in Junos accepts an optional numeric argument (in minutes) to override the default confirmation timeout. For example, `commit confirmed 10` sets a 10-minute window during which the administrator must issue a `commit` to make the changes permanent; otherwise, the system automatically rolls back to the previous active configuration.

Answer

The default confirmation timeout is 5 minutes.

Answer

It requires a reboot to revert to the previous configuration.

Answer

It stages the configuration in the candidate configuration but does not apply it until confirmed.

Question 11

Which THREE are valid methods to exit configuration mode in Junos? (Choose three.)

Accepted Answer

exit configuration-mode. 'exit configuration-mode' is a valid operational mode command that explicitly exits from configuration mode back to operational mode. This command is used when you are at the top of the configuration hierarchy and want to leave the configuration CLI session.

Answer

commit check

Answer

quit

Question 12

During a network traffic storm, a Juniper EX switch's CPU utilization spikes to 100%. Which command would best help identify the cause?

Accepted Answer

monitor traffic interface ge-0/0/0. The 'monitor traffic interface' command captures live packet headers on the specified interface, allowing you to see the type and source of traffic causing the CPU spike. During a traffic storm (e.g., broadcast storm), this command reveals excessive broadcast, multicast, or unknown unicast frames, which are typically the root cause of high CPU utilization on Juniper EX switches.

Answer

show spanning-tree bridge

Answer

show ethernet-switching table

Answer

show interfaces extensive ge-0/0/0

Question 13

You are the network engineer for a mid-sized enterprise with a Juniper MX router running Junos. The router has two uplinks to the internet: one to ISP-A via ge-0/0/0 (10.0.0.1/30) and one to ISP-B via ge-0/0/1 (10.0.0.5/30). You have configured static default routes to both ISPs: one to 10.0.0.2 and one to 10.0.0.6. Both routes have the same preference (default 5) and metric. You enabled ECMP to load-balance outbound traffic. After testing, you notice that all traffic is being sent only to ISP-A, and none to ISP-B. You verify that both interfaces are up and that the next-hop addresses are reachable. You check the routing table and see both routes are active but with different next-hop counts. What is the most likely cause of the traffic not being load-balanced?

Accepted Answer

One of the static routes resolves to multiple next hops, causing imbalance.. When both static default routes have the same preference and metric, Junos installs both in the routing table. However, ECMP load-balancing requires that each route resolve to a single next hop. If one static route resolves to multiple next hops (e.g., through a recursive lookup to a prefix with multiple paths), the route with a single next hop (ISP-A) becomes the sole active path for forwarding, while the multi-next-hop route (ISP-B) is not used for load balancing. This explains why all traffic goes to ISP-A despite both routes being present.

Answer

ECMP is not enabled in the forwarding-options.

Answer

The route to ISP-B is not active.

Answer

Hash-based load balancing requires per-packet configuration.

Question 14

You are managing a Juniper MX router that serves as a BGP route reflector for multiple customer VPNs. The router has two routing engines (RE0 and RE1) in a graceful switchover (GRES) configuration. During a routine maintenance window, you need to upgrade the Junos OS from version 18.1R1 to 20.2R2. The upgrade must minimize traffic disruption. You have already staged the new image on both REs. Which sequence of commands ensures minimal impact?

Accepted Answer

On RE1: request system software add jinstall-20.2R2.tgz reboot; after reboot, on RE0: request chassis routing-engine master switch; then request system software add jinstall-20.2R2.tgz reboot. It performs a non-disruptive upgrade by first upgrading the backup RE (RE1), then switching mastership to the upgraded RE, and finally upgrading the original master RE. This sequence leverages Graceful Routing Engine Switchover (GRES) to maintain BGP sessions and VPN forwarding during the upgrade, minimizing traffic disruption.

Answer

On RE0: request system software add jinstall-20.2R2.tgz reboot; then on RE1 same command

Answer

On RE0: request system reboot (without adding software)

Answer

On both REs: request system software add jinstall-20.2R2.tgz reboot

Question 15

An engineer is implementing VLAN trunking between two Juniper EX switches. Which statement about native VLANs on a trunk is correct?

Accepted Answer

Untagged frames arriving on a trunk port are assigned to the native VLAN.. On Juniper EX switches, a trunk port can accept both tagged and untagged frames. Untagged frames received on a trunk port are automatically assigned to the native VLAN, which by default is VLAN 1. This behavior is defined by the IEEE 802.1Q standard, where the native VLAN is the only VLAN that can carry untagged traffic on a trunk link.

Answer

The native VLAN cannot be changed after initial configuration.

Answer

Frames in the native VLAN are always tagged with the VLAN ID on the trunk.

Answer

The native VLAN must be the same as the management VLAN.

Question 16

During a network outage, a router is unresponsive via SSH. You have console access but the console displays 'Amnesiac (ttyd0)' prompt. What is the most likely cause and recovery action?

Accepted Answer

The router lost its configuration; load the rescue configuration using 'rollback rescue-config' or 'load override /config/rescue.conf.gz' then commit. The 'Amnesiac (ttyd0)' prompt indicates the router has booted without a valid configuration file in the /config directory. This typically occurs after a 'request system zeroize' command, a failed commit that corrupted the configuration, or a storage issue that prevented the configuration from loading. The recovery action is to load a previously saved rescue configuration using 'rollback rescue' or 'load override /config/rescue.conf.gz' and then commit, which restores the router to a known working state.

Answer

The router's boot device failed; need to replace hardware

Answer

The router booted from backup media; run 'request system software add' to reinstall Junos

Answer

The router's flash memory is corrupted; perform a full reinstall via USB

Question 17

An enterprise uses OSPF across multiple areas. To reduce routing table size in the backbone area, the engineer wants to advertise a single summary route for all subnets in area 2. Which configuration is appropriate?

Accepted Answer

Configure 'area 2 area-range 10.0.0.0/16' on the ABR. The 'area-range' command on an Area Border Router (ABR) allows you to summarize a set of routes from a specific area into the backbone (area 0) by advertising a single aggregate route (e.g., 10.0.0.0/16) instead of all individual subnets. This reduces the routing table size in area 0 while still providing reachability to all subnets in area 2.

Answer

Configure a virtual-link between area 2 and area 0

Answer

Configure a default route from area 2 using 'default-metric'

Answer

Use a static route for the summary and redistribute it into OSPF

Question 18

A host in VLAN 10 can ping a host in VLAN 20 without a default gateway configured. What feature is likely enabled on the router that interconnects the VLANs?

Accepted Answer

Proxy ARP. Proxy ARP allows a router to respond to ARP requests on behalf of hosts in different subnets. When a host in VLAN 10 sends an ARP request for a host in VLAN 20, the router responds with its own MAC address if it has a route to the destination. This enables the host to send traffic to the router, which then forwards it to the destination VLAN, even without a default gateway configured on the host.

Answer

VLAN translation is configured on the trunk

Answer

IP routing is enabled on the router

Answer

Dynamic ARP Inspection

Question 19

An operator wants to monitor the temperature and voltage sensors on a Juniper chassis. Which command displays current sensor readings?

Accepted Answer

show chassis environment. The 'show chassis environment' command displays real-time sensor readings for temperature, voltage, and fan status on Juniper devices. It is the standard operational command for monitoring chassis environmental health, directly matching the operator's requirement to check temperature and voltage sensors.

Answer

show chassis hardware

Answer

show system health

Answer

show log messages | match temperature

Question 20

Your company operates a dual-homed network with two Juniper MX routers (R1 and R2) each connected to a different ISP. R1 uses BGP to receive a default route from ISP-A (preference 170), and R2 uses BGP to receive a default route from ISP-B (preference 170). Additionally, both routers have a static default route pointing to a local next-hop (192.0.2.1) with preference 5 for backup. R1 and R2 are connected via an internal link (10.0.0.0/30) and run OSPF to exchange internal routes. You notice that traffic from internal hosts is always exiting via R1's ISP-A link, even when R1's BGP session to ISP-A goes down. The OSPF routes are preferred. You want traffic to fail over to R2's ISP-B link when R1 loses its BGP default. Which configuration change should you make?

Accepted Answer

Configure the static default route with a preference of 180 so that the BGP default routes (pref 170) are preferred when available.. The static default route currently has a preference of 5, making it preferred over the BGP default (preference 170) even when the BGP route is available. By raising the static default's preference to 180 (higher than BGP's 170), the BGP default will be chosen when present, and the static default will only be used as a backup when BGP is unavailable. This ensures traffic fails over to R2's ISP-B link when R1 loses its BGP default, as OSPF will propagate the default from R2.

Answer

Increase the preference of the BGP default routes to 180 so that the static default is always preferred.

Answer

Configure a routing policy on R2 to reject the default route from ISP-B, forcing all traffic through R1.

Answer

Remove the static default route and rely on OSPF to propagate a default route from the router with the active BGP session.