JNCIA-JUNOS Junos Configuration Basics — Timed 10 Questions

Question 1

A network engineer is configuring a new Juniper device. They intend to apply a firewall filter to an interface to only allow SSH traffic from a specific management subnet. Which configuration approach best follows Juniper best practices?

Accepted Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces ge-0/0/0 unit 0 family inet filter input filter-name'. Option A is correct because it follows Juniper best practices by defining the firewall filter under the `firewall family inet` hierarchy (which is the standard location for IPv4 filters) and applying it as an input filter on the physical interface `ge-0/0/0 unit 0 family inet`. This configuration ensures that only SSH traffic from the specified management subnet is permitted inbound on that interface, while all other traffic is dropped by default (since firewall filters in Junos have an implicit deny at the end).

Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces lo0 unit 0 family inet filter input filter-name'

Answer

Define the filter under 'firewall family inet' and apply it under 'interfaces ge-0/0/0 unit 0 family inet input'

Answer

Define the filter under 'firewall family any' and apply it under 'interfaces ge-0/0/0 unit 0 family any filter input'

Question 2

A junior engineer is asked to change the hostname of a Juniper device from 'Router-1' to 'Core-Router'. Which command sequence correctly commits the change?

Accepted Answer

set system host-name Core-Router; commit. Option A is correct because the Junos CLI uses the 'set system host-name' command (with a hyphen in 'host-name') to change the device hostname, and 'commit' applies the change to the active configuration. The command sequence is syntactically valid and follows Junos configuration hierarchy.

Answer

edit system; set host-name Core-Router; commit

Answer

set system hostname Core-Router; commit

Answer

set system host-name Core-Router; commit

Question 3

During troubleshooting, an engineer notices that BGP sessions are flapping. They suspect that the issue might be related to the maximum number of routes allowed. To see if the BGP import policy is rejecting routes, which operational command would provide immediate insight?

Accepted Answer

show bgp neighbor x.x.x.x. Option D is correct because the 'show bgp neighbor x.x.x.x' command displays detailed BGP session information, including the number of received and accepted routes, as well as any prefix-limit or policy-related rejections. If the BGP import policy is rejecting routes due to exceeding the maximum allowed, this command will show the 'received prefixes' count alongside the 'accepted prefixes' count, immediately revealing if routes are being dropped. This provides direct insight into whether the flapping is caused by route limit enforcement.

Answer

show version

Answer

show interfaces terse

Answer

show route protocol bgp

Question 4

When configuring a new Juniper router, an engineer needs to ensure that configuration changes are not automatically committed after a certain time if not explicitly confirmed. Which configuration parameter controls this?

Accepted Answer

commit confirmed. The 'commit confirmed' command is used to apply a configuration change that will automatically roll back to the previous configuration if not explicitly confirmed within a specified time period (default 10 minutes). This ensures that changes are not permanently applied unless the engineer verifies them, preventing accidental lockout or misconfiguration.

Answer

commit check

Answer

commit at

Answer

commit synchronize

Question 5

A network administrator wants to view the current candidate configuration that has not yet been committed. Which command should be used?

Accepted Answer

show configuration. The command 'show configuration' displays the current candidate configuration that has been staged but not yet committed. In Junos, the candidate configuration is stored separately from the active (committed) configuration, and this command shows all uncommitted changes. Option B is correct because it directly retrieves the candidate configuration without any comparison or filtering.

Answer

show configuration | display set

Answer

show configuration | compare rollback 0

Answer

show interface terse

Question 6

An engineer is designing a network and needs to ensure that management traffic (SSH, SNMP) is always permitted, even if an interface firewall filter is applied. Which Juniper best practice should be followed?

Accepted Answer

Apply a firewall filter on the loopback interface (lo0) to protect the device. Applying a firewall filter to the loopback interface (lo0) is the Juniper best practice for protecting management traffic because the loopback interface is the logical termination point for all control plane traffic, including SSH and SNMP. This ensures that management traffic is always permitted regardless of which physical interface it arrives on, while still allowing interface-specific filters to be applied for data plane traffic without risk of blocking management access.

Answer

Use a firewall filter that permits all management traffic at the top of the list on each interface

Answer

Apply a firewall filter to the management interface (fxp0)

Answer

Disable the firewall filter on all interfaces

Question 7

A network engineer needs to add an additional IP address to an interface that already has a primary IP configured. Which method should be used?

Accepted Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24 secondary. Option B is correct because in Junos, to add an additional IP address to an interface that already has a primary IP configured, you must append the 'secondary' keyword to the address configuration statement. This allows multiple IPv4 addresses on the same logical interface unit, with the first address assigned being the primary and subsequent addresses marked as secondary.

Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24

Answer

set interfaces ge-0/0/0 unit 0 family inet secondary address 10.0.0.2/24

Answer

set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24 primary

Question 8

After making several configuration changes, an engineer wants to see what changes were made in the candidate configuration compared to the last committed configuration. Which command should be used?

Accepted Answer

show configuration | compare. Option B is correct because the 'show configuration | compare' command displays the differences between the candidate configuration and the active committed configuration. This pipe filter compares the current candidate configuration against the last committed configuration, showing added, changed, or deleted lines with '+' and '-' prefixes, which directly meets the engineer's requirement.

Answer

show configuration

Answer

show system rollback

Answer

show log messages

Question 9

Which TWO statements are true regarding the Junos OS commit model?

Accepted Answer

Multiple users can make changes simultaneously in configure private mode.. Option C is correct because Junos OS allows multiple users to enter configure private mode, where each user has an independent candidate configuration. This prevents conflicts and allows simultaneous edits without interfering with each other's changes. Option E is correct because the 'commit' command activates the candidate configuration, making it the active configuration on the device.

Answer

Configuration changes are activated immediately upon entering the 'set' command.

Answer

The 'commit check' command activates the candidate configuration if syntax is valid.

Answer

The 'commit confirmed' command automatically commits changes permanently.

Question 10

Which THREE are valid methods to apply a firewall filter in Junos?

Accepted Answer

Apply the filter to an interface under 'family inet filter input'. Option A is correct because in Junos, a firewall filter is applied to an interface by configuring it under the 'family inet' hierarchy with the 'filter input' statement. This directs the filter to inspect all inbound IPv4 packets on that interface before they are processed by the routing engine.

Answer

Apply the filter globally using 'firewall family inet filter filter-name'

Answer

Apply the filter under 'routing-options'