JNCIA-JUNOS Junos Configuration Basics — 50 Questions

Question 1

A network engineer is configuring a new Juniper device. They intend to apply a firewall filter to an interface to only allow SSH traffic from a specific management subnet. Which configuration approach best follows Juniper best practices?

Accepted Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces ge-0/0/0 unit 0 family inet filter input filter-name'. Option A is correct because it follows Juniper best practices by defining the firewall filter under the `firewall family inet` hierarchy (which is the standard location for IPv4 filters) and applying it as an input filter on the physical interface `ge-0/0/0 unit 0 family inet`. This configuration ensures that only SSH traffic from the specified management subnet is permitted inbound on that interface, while all other traffic is dropped by default (since firewall filters in Junos have an implicit deny at the end).

Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces lo0 unit 0 family inet filter input filter-name'

Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces ge-0/0/0 unit 0 family inet input'

Answer

Define the filter under 'firewall family any' and apply it under 'interfaces ge-0/0/0 unit 0 family any filter input'

Question 2

A junior engineer is asked to change the hostname of a Juniper device from 'Router-1' to 'Core-Router'. Which command sequence correctly commits the change?

Accepted Answer

set system host-name Core-Router; commit. Option A is correct because the Junos CLI uses the 'set system host-name' command (with a hyphen in 'host-name') to change the device hostname, and 'commit' applies the change to the active configuration. The command sequence is syntactically valid and follows Junos configuration hierarchy.

Answer

edit system; set host-name Core-Router; commit

Answer

set system hostname Core-Router; commit

Answer

set system host-name Core-Router; commit

Question 3

During troubleshooting, an engineer notices that BGP sessions are flapping. They suspect that the issue might be related to the maximum number of routes allowed. To see if the BGP import policy is rejecting routes, which operational command would provide immediate insight?

Accepted Answer

show bgp neighbor x.x.x.x. Option D is correct because the 'show bgp neighbor x.x.x.x' command displays detailed BGP session information, including the number of received and accepted routes, as well as any prefix-limit or policy-related rejections. If the BGP import policy is rejecting routes due to exceeding the maximum allowed, this command will show the 'received prefixes' count alongside the 'accepted prefixes' count, immediately revealing if routes are being dropped. This provides direct insight into whether the flapping is caused by route limit enforcement.

Answer

show version

Answer

show interfaces terse

Answer

show route protocol bgp

Question 4

When configuring a new Juniper router, an engineer needs to ensure that configuration changes are not automatically committed after a certain time if not explicitly confirmed. Which configuration parameter controls this?

Accepted Answer

commit confirmed. The 'commit confirmed' command is used to apply a configuration change that will automatically roll back to the previous configuration if not explicitly confirmed within a specified time period (default 10 minutes). This ensures that changes are not permanently applied unless the engineer verifies them, preventing accidental lockout or misconfiguration.

Answer

commit check

Answer

commit at

Answer

commit synchronize

Question 5

A network administrator wants to view the current candidate configuration that has not yet been committed. Which command should be used?

Accepted Answer

show configuration. The command 'show configuration' displays the current candidate configuration that has been staged but not yet committed. In Junos, the candidate configuration is stored separately from the active (committed) configuration, and this command shows all uncommitted changes. Option B is correct because it directly retrieves the candidate configuration without any comparison or filtering.

Answer

show configuration | display set

Answer

show configuration | compare rollback 0

Answer

show interface terse

Question 6

An engineer is designing a network and needs to ensure that management traffic (SSH, SNMP) is always permitted, even if an interface firewall filter is applied. Which Juniper best practice should be followed?

Accepted Answer

Apply a firewall filter on the loopback interface (lo0) to protect the device. Applying a firewall filter to the loopback interface (lo0) is the Juniper best practice for protecting management traffic because the loopback interface is the logical termination point for all control plane traffic, including SSH and SNMP. This ensures that management traffic is always permitted regardless of which physical interface it arrives on, while still allowing interface-specific filters to be applied for data plane traffic without risk of blocking management access.

Answer

Use a firewall filter that permits all management traffic at the top of the list on each interface

Answer

Apply a firewall filter to the management interface (fxp0)

Answer

Disable the firewall filter on all interfaces

Question 7

A network engineer needs to add an additional IP address to an interface that already has a primary IP configured. Which method should be used?

Accepted Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24 secondary. Option B is correct because in Junos, to add an additional IP address to an interface that already has a primary IP configured, you must append the 'secondary' keyword to the address configuration statement. This allows multiple IPv4 addresses on the same logical interface unit, with the first address assigned being the primary and subsequent addresses marked as secondary.

Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24

Answer

set interfaces ge-0/0/0 unit 0 family inet secondary address 10.0.0.2/24

Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24 primary

Question 8

After making several configuration changes, an engineer wants to see what changes were made in the candidate configuration compared to the last committed configuration. Which command should be used?

Accepted Answer

show configuration | compare. Option B is correct because the 'show configuration | compare' command displays the differences between the candidate configuration and the active committed configuration. This pipe filter compares the current candidate configuration against the last committed configuration, showing added, changed, or deleted lines with '+' and '-' prefixes, which directly meets the engineer's requirement.

Answer

show configuration

Answer

show system rollback

Answer

show log messages

Question 9

Which TWO statements are true regarding the Junos OS commit model?

Accepted Answer

Multiple users can make changes simultaneously in configure private mode.. Option C is correct because Junos OS allows multiple users to enter configure private mode, where each user has an independent candidate configuration. This prevents conflicts and allows simultaneous edits without interfering with each other's changes. Option E is correct because the 'commit' command activates the candidate configuration, making it the active configuration on the device.

Answer

Configuration changes are activated immediately upon entering the 'set' command.

Answer

The 'commit check' command activates the candidate configuration if syntax is valid.

Answer

The 'commit confirmed' command automatically commits changes permanently.

Question 10

Which THREE are valid methods to apply a firewall filter in Junos?

Accepted Answer

Apply the filter to an interface under 'family inet filter input'. Option A is correct because in Junos, a firewall filter is applied to an interface by configuring it under the 'family inet' hierarchy with the 'filter input' statement. This directs the filter to inspect all inbound IPv4 packets on that interface before they are processed by the routing engine.

Answer

Apply the filter globally using 'firewall family inet filter filter-name'

Answer

Apply the filter under 'routing-options'

Question 11

Which TWO are correct statements about the Junos configuration hierarchy?

Accepted Answer

The 'interfaces' hierarchy is used to configure physical and logical interfaces.. Option B is correct because the 'interfaces' hierarchy in Junos is specifically designed to configure both physical interfaces (e.g., ge-0/0/0) and logical interfaces (e.g., ge-0/0/0.100), including parameters like IP addresses, MTU, and VLAN tagging. This is a fundamental part of Junos configuration, as all network traffic flows through interfaces defined under this hierarchy.

Answer

The 'routing-options' hierarchy is used to configure interface IP addresses.

Answer

Firewall filters are configured under 'policy-options'.

Answer

The 'protocols' hierarchy includes system-level settings like hostname.

Question 12

Which THREE statements about the 'commit' command are correct?

Accepted Answer

The 'commit check' command validates the syntax of the candidate configuration.. Option A is correct because the 'commit check' command validates the syntax and semantics of the candidate configuration without activating it. This allows an administrator to verify that the configuration is valid before committing, preventing potential errors from being applied to the active configuration.

Answer

The 'commit full' command activates the configuration without performing any validation.

Answer

The 'commit' command can only be issued when no other users are in configuration mode.

Question 13

Refer to the exhibit. An engineer has made changes to the candidate configuration. What will happen when the engineer issues the 'commit' command?

Accepted Answer

Both the interface address and security policy will be activated.. Option D is correct because in Junos, the 'commit' command activates all changes in the candidate configuration atomically. Both the interface address change and the security policy will be applied simultaneously after validation. Junos does not require a reboot for security policy changes, and syntax errors cause the commit to fail, not be ignored.

Answer

The commit will succeed but the security policy will be ignored due to a syntax error.

Answer

Only the interface address change will be committed because security policies require a reboot.

Answer

The configuration will be validated; if errors exist, the commit will fail.

Question 14

Refer to the exhibit. An engineer notices that SNMP traffic from source 10.1.1.1 is being rejected on interface ge-0/0/1. The engineer wants to allow SNMP from this source while still blocking other SNMP traffic from the 10.0.0.0/8 range. Which change should be made?

Accepted Answer

Insert a term 0 before term 1 to permit SNMP from 10.1.1.1. Option C is correct because firewall filters in Junos are evaluated sequentially from the lowest term number. By inserting a new term 0 before the existing term 1 that explicitly permits SNMP traffic (UDP ports 161/162) from source 10.1.1.1, the filter will match and accept this traffic before reaching the deny term for the 10.0.0.0/8 range. This ensures the specific host is allowed while still blocking other SNMP traffic from the broader subnet.

Answer

Add a term at the end to permit all from 10.1.1.1

Answer

Change the source-address in term 1 to 10.0.0.0/8 except 10.1.1.1

Answer

Remove the filter and apply a new filter that permits SNMP from 10.1.1.1

Question 15

A company has a Juniper MX router acting as a BGP route reflector. The router has two routing instances: 'internet' and 'management'. The 'internet' instance uses a firewall filter to block traffic to the router's loopback address from external sources. After a recent configuration change, the engineer notices that SSH access to the router's loopback IP (10.0.0.1) from the internal management network (192.168.0.0/16) is being dropped. The firewall filter for the loopback interface in the 'internet' instance is correctly configured to allow traffic from 192.168.0.0/16. The management instance has no firewall filter applied. The engineer suspects that the issue is related to how the routing instances interact with the loopback interface. Which of the following is the most likely cause and solution?

Accepted Answer

The firewall filter applied to the loopback interface is shared across all routing instances; use a separate interface for management traffic or apply the filter only to the 'internet' instance's logical system.. In Junos, firewall filters applied to the loopback interface (lo0) are shared across all routing instances by default because the loopback is a single physical interface. Even though the filter is configured in the 'internet' instance, it affects traffic destined to the loopback IP from any instance, including the 'management' instance. To isolate management traffic, you must either use a separate physical interface or apply the filter only to the 'internet' instance's logical system (e.g., using a firewall filter with a routing-instance match condition).

Answer

The management instance needs a firewall filter that allows SSH; add a filter to the management instance's loopback.

Answer

The firewall filter in the 'internet' instance incorrectly blocks SSH; modify the filter to allow SSH from any source.

Answer

The BGP configuration is causing the loopback to be unreachable; disable BGP on the management instance.

Question 16

An engineer needs to apply a configuration change that adds a new static route to the Junos device. The engineer wants to ensure the change takes effect immediately and is persistent across reboots. Which command should the engineer use?

Accepted Answer

commit. The 'commit' command is correct because it immediately activates the candidate configuration (including the new static route) and makes it the active configuration that survives a reboot. Junos uses a two-stage configuration model where changes are first made to the candidate configuration and then committed to become the active, persistent configuration.

Answer

load override

Answer

commit confirmed

Answer

rollback

Question 17

Which TWO statements about configuration groups in Junos are correct? (Choose two.)

Accepted Answer

Configuration groups are defined under the [edit groups] hierarchy.. Option A is correct because configuration groups in Junos are defined under the [edit groups] hierarchy. This allows you to create reusable configuration snippets that can be applied to multiple parts of the configuration, reducing duplication and simplifying management.

Answer

Configuration groups are stored in separate files that are imported using the 'file' statement.

Answer

The 'replace' tag is used to reference a configuration group.

Answer

Configuration groups are applied only at the [edit interfaces] hierarchy level.

Question 18

Refer to the exhibit. An engineer configures interface ge-0/0/0 with both IPv4 and IPv6 addresses. The engineer notices that the interface is operationally up, but the IPv6 address is not pingable from a directly connected host. The host has an IPv6 address in the same subnet. What is the most likely cause?

Accepted Answer

The interface does not have IPv6 neighbor discovery enabled.. IPv6 neighbor discovery (ND) is required for address resolution and duplicate address detection on a link. If ND is not enabled on the interface, the router cannot respond to Neighbor Solicitation messages from the host, making the IPv6 address unreachable even though the interface is operationally up. In Junos, ND is enabled by default on IPv6-enabled interfaces, but it can be disabled with the 'no-neighbor-discovery' configuration statement.

Answer

The interface MTU is too small for IPv6 packets.

Answer

The IPv6 address is not configured under the correct unit.

Answer

The interface has an IPv4 address, which prevents IPv6 from working.

Question 19

Your company has deployed a Juniper MX router at a branch office. The router has two upstream connections to different ISPs. The configuration currently uses a single static default route to ISP-A. The network team wants to add redundancy so that if ISP-A fails, traffic automatically uses ISP-B. The ISP-B connection is already configured on interface ge-1/0/0 with IP address 203.0.113.2/30. The next-hop IP for ISP-B is 203.0.113.1. The routing table should have a backup default route with a higher metric. Which configuration change meets the requirement?

Accepted Answer

set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1 metric 2. Option C is correct because it adds a static default route to ISP-B with a metric of 2, which is higher than the default metric of 0 (or 1 if explicitly set) for the existing route to ISP-A. In Junos, when multiple static routes to the same destination exist, the route with the lower metric (preference) is installed in the routing table. If the primary route fails (e.g., interface down), the route with the higher metric becomes active, providing automatic failover.

Answer

set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1 metric 1

Answer

set routing-options static route 0.0.0.0/0 discard

Answer

set routing-options static route 0.0.0.0/0 next-table inet.0

Question 20

An engineer needs to apply a configuration change to the Junos device that must survive a reboot. Which configuration mode command should be used to save the changes?

Accepted Answer

commit. The 'commit' command is the standard way to apply a candidate configuration to the active configuration in Junos. When you issue 'commit', the changes are saved to the /config/juniper.conf.gz file, which is loaded upon reboot, ensuring the configuration survives a restart.

Answer

commit confirmed

Answer

commit synchronize

Answer

commit check