JN0-106 Junos OS Fundamentals Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. An operator tries to ping 192.168.1.2 from this router and fails. The router can ping itself (192.168.1.1). What is the most likely cause?

Accepted Answer

The remote host is not reachable or is not responding to ARP requests.. The router can ping its own interface (192.168.1.1), confirming that the interface is up and IP is configured correctly. The failure to ping 192.168.1.2 indicates that the router cannot reach the remote host, most likely because the host is down, not connected, or not responding to ARP requests. ARP resolution is required for the router to map the destination IP to a MAC address on the local subnet; without a successful ARP reply, the router cannot send the echo request.

Answer

Reverse path forwarding (RPF) check is dropping the echo request.

Answer

The interface is administratively down.

Answer

Proxy ARP is not configured on the interface.

Question 2

Refer to the exhibit. A security analyst sees repeated login failures from 10.0.0.2 for user1. Which Junos feature can be used to automatically block further login attempts from that IP?

Accepted Answer

Apply a firewall filter to the loopback interface that polices SSH traffic.. Applying a firewall filter to the loopback interface (lo0) that polices SSH traffic can automatically block further login attempts from a specific IP address, such as 10.0.0.2. The loopback interface is the termination point for all control-plane traffic on a Junos device, including SSH sessions. By configuring a firewall filter with a policer that limits the rate of SSH packets from a source IP, excessive login failures can trigger the policer to drop subsequent packets, effectively blocking the attacker without manual intervention.

Answer

Configure SSH to accept only public key authentication for user1.

Answer

Disable the user1 account.

Answer

Set the 'session-limit' for user1 to prevent multiple login attempts.

Question 3

Refer to the exhibit. An administrator wants to see authentication-related logs like SSH logins. In the current configuration, which log file contains this information?

Accepted Answer

messages. In Junos, authentication-related logs such as SSH login attempts are recorded by default in the 'messages' log file. This file captures syslog messages for various system events, including authentication successes and failures. The 'interactive-commands' log file only logs user-executed CLI commands after successful login, not the authentication process itself. The 'security' log is intended for firewall and security policy events, and 'utmp' is for user accounting. Therefore, option D is correct.

Answer

utmp

Answer

interactive-commands

Answer

security

Question 4

A company wants to implement best practice for password recovery on Juniper devices to avoid service disruption. Which of the following is the recommended method?

Accepted Answer

Boot the device into single-user mode from the console and reset the root password. Booting the device into single-user mode from the console is the standard, secure method for password recovery on Juniper devices. This process allows an administrator with physical console access to reset the root password without affecting the running configuration or causing service disruption, as the device boots with a minimal kernel and does not load the full configuration.

Answer

Perform a factory reset to default configuration

Answer

Use SNMP to modify the password field in the configuration

Answer

Contact JTAC to remotely reset the password

Question 5

An administrator notices that after committing a configuration change on a Juniper MX router, the device loses connectivity to the management network. The management interface is part of a dedicated management routing instance. Which of the following is the most likely cause?

Accepted Answer

The routing instance for the management interface was accidentally removed. The management interface is part of a dedicated management routing instance (often named mgmt_junos). If this routing instance is accidentally removed during a commit, the management interface loses its routing context and becomes unreachable, causing loss of connectivity to the management network. This is a common misconfiguration when an administrator modifies routing instance configurations without realizing the management interface depends on it.

Answer

A firewall filter was applied to the management interface that blocks all traffic

Answer

NTP was configured with an incorrect server address

Answer

A syslog server was configured that is unreachable

Question 6

A network engineer needs to upgrade Junos on an MX router with dual Routing Engines (RE0 and RE1). What is the recommended procedure to minimize downtime?

Accepted Answer

Upgrade the backup RE, perform a graceful switchover (RESTART ROUTING), then upgrade the former primary. It minimizes downtime by first upgrading the backup RE (RE1), then performing a graceful Routing Engine switchover (using the 'request chassis routing-engine master switch' command or equivalent), which causes the upgraded backup to become the new primary without disrupting traffic. After the switchover, the former primary (now the backup) can be upgraded and rebooted, ensuring that at least one RE is always processing traffic and routing protocols like BGP and OSPF maintain their adjacencies.

Answer

Upgrade the primary RE first, then the backup

Answer

Reboot both REs at the same time after copying the image

Answer

Upgrade both REs simultaneously using the same image

Question 7

A junior administrator wants to view the current active configuration on a Juniper device. Which operational mode command should be used?

Accepted Answer

show configuration. The 'show configuration' command displays the current active configuration in the candidate configuration format, which is the configuration that is currently committed and running on the Juniper device. Option D is correct because it directly retrieves the active configuration from the /config/juniper.conf file, which is the authoritative source for the operational configuration.

Answer

show configuration | display set

Answer

show system services

Answer

show interfaces terse

Question 8

During a network traffic storm, a Juniper EX switch's CPU utilization spikes to 100%. Which command would best help identify the cause?

Accepted Answer

monitor traffic interface ge-0/0/0. The 'monitor traffic interface' command captures live packet headers on the specified interface, allowing you to see the type and source of traffic causing the CPU spike. During a traffic storm (e.g., broadcast storm), this command reveals excessive broadcast, multicast, or unknown unicast frames, which are typically the root cause of high CPU utilization on Juniper EX switches.

Answer

show spanning-tree bridge

Answer

show ethernet-switching table

Answer

show interfaces extensive ge-0/0/0

Question 9

A company has multiple Juniper devices and wants to standardize configuration snapshots for backup and audit purposes. What is the best practice?

Accepted Answer

Use 'show configuration | save /var/tmp/config.txt' and then transfer the file via SCP to a backup server. It uses the 'show configuration | save' command to write the current active configuration to a file in /var/tmp, which can then be securely transferred via SCP to a backup server. This is the standard Junos method for creating a portable, text-based snapshot of the configuration for backup and audit purposes, as it preserves the exact configuration syntax and can be easily compared or restored.

Answer

Run 'commit and-quit' to save the configuration to the flash

Answer

Use the 'file archive' command to create a backup of the configuration

Answer

Use the 'show configuration | no-more' command and copy the output manually

Question 10

What is the purpose of the 'commit confirmed' command in Junos OS?

Accepted Answer

It allows the administrator to test a configuration change with automatic rollback if confirmation is not received. The 'commit confirmed' command in Junos OS applies a candidate configuration change and starts a confirmation timer (default 10 minutes). If the administrator does not issue a 'commit' command before the timer expires, the system automatically rolls back to the previous active configuration. This allows safe testing of changes, especially over remote connections, preventing lockout if the change breaks connectivity.

Answer

It compares the candidate configuration with the active configuration

Answer

It permanently saves the candidate configuration to the startup configuration

Answer

It confirms that a previous commit was successful

Question 11

You are a network engineer at a company that operates a pair of Juniper SRX firewalls in an active/passive cluster (Chassis Cluster). The cluster has been running Junos 15.1X49-D100 for over a year. Management has mandated an upgrade to a newer version to address security vulnerabilities. You follow the recommended upgrade procedure and successfully upgrade the primary node (node0) first, then failover to make node0 the backup, and upgrade the new primary (node1). After the upgrade, both nodes have the same version and appear to be in the cluster, but you notice that the backup node (node0) is stuck in 'ineligible' state and does not synchronize configuration changes. What is the most likely cause?

Accepted Answer

The cluster control link is down or misconfigured on the backup node. The backup node being stuck in 'ineligible' state after a chassis cluster upgrade indicates that the cluster control link (control port) is not functioning correctly. In a Juniper SRX active/passive cluster, the control link is used for heartbeat and cluster state synchronization; if it is down or misconfigured on the backup node, the node cannot participate in the cluster election process and remains ineligible. This is a common issue after upgrades if the control link interfaces are not properly re-established or if the cable is faulty.

Answer

The backup node has not been configured with 'commit synchronize'

Answer

The 'set chassis cluster reth-count' statement is missing on the backup node

Answer

The 'monitor interface' configuration is causing a mis-match between nodes

Question 12

You are a network administrator for a service provider that uses Juniper MX series routers to provide MPLS VPN services to customers. Management has requested that you implement a secure out-of-band management (OOBM) solution for all MX routers to ensure that management traffic is isolated from the production network, reducing the risk of unauthorized access and management plane attacks. You are tasked with designing the OOBM solution using a dedicated management interface (me0) and a separate management routing instance. Which of the following best practices should you follow?

Accepted Answer

Create a dedicated routing instance for management, assign me0 to it, and apply a firewall filter to restrict access. It follows Juniper's best practice for OOBM: creating a dedicated management routing instance (e.g., mgmt_junos) and assigning the me0 interface to it. This ensures management traffic is completely isolated from the production routing table (inet.0), preventing management plane attacks and unauthorized access. Applying a firewall filter on the me0 interface further restricts access to only authorized management hosts, aligning with security hardening guidelines.

Answer

Place me0 in the inet.0 routing table and rely on static routes

Answer

Enable VLAN tagging on me0 to separate management traffic into different subnets

Answer

Configure the me0 interface in the default routing instance with a simple ACL

Question 13

Your data center uses Juniper QFX5110 switches as leaf nodes in a Virtual Chassis Fabric (VCF) topology with QFX5100 as spine nodes. You are adding a new QFX5110 leaf node to the fabric. The new switch is physically connected to all spine nodes as per the cabling guidelines. However, after powering on the new switch, it does not automatically join the fabric. The existing fabric shows the new switch's member ID as 8, but it remains in 'standalone' state. The VCF has been operational for several months without issues. You check the configuration on the existing VC and notice that the 'virtual-chassis' configuration does not include the new member. What is the most likely reason the new switch does not join?

Accepted Answer

The new switch does not have the same virtual-chassis ID configured as the existing fabric. In a Virtual Chassis Fabric (VCF), all member switches must share the same virtual-chassis ID to be recognized as part of the same fabric. The existing fabric has a configured virtual-chassis ID, but the new QFX5110, by default, has a different or no virtual-chassis ID set. Without a matching virtual-chassis ID, the new switch cannot join the fabric and remains in 'standalone' state, even though it is physically connected and assigned a member ID.

Answer

The new switch is running a different version of Junos that is not compatible with the fabric

Answer

The new switch is only connected to one spine node, and VCF requires full mesh connections to all spines

Answer

The new switch has 'set virtual-chassis no-split-detection' enabled, preventing it from joining

Question 14

A junior network administrator is setting up a Juniper MX router for the first time. After powering on the device, the administrator notices that the LED on the front panel blinks amber and the device does not complete the boot process. The console displays messages reporting file system errors. The administrator has no previous configuration changes and the device was shipped with factory defaults. Which action should the administrator take to resolve the boot issue?

Accepted Answer

Boot into single-user mode and run file system checks.. The amber blinking LED and file system errors indicate a corrupted file system, which is common on factory-default devices if the flash memory was not properly initialized. Booting into single-user mode (option A) allows the administrator to run 'fsck' (file system check) to repair the root file system without loading the full Junos OS, which is the standard recovery procedure for such boot failures.

Answer

Perform a password recovery procedure to gain access.

Answer

Use the 'request system software add' command from the boot loader.

Answer

Reinstall the Junos OS using a USB flash drive with the software image.

Question 15

A network engineer made several configuration changes on a Juniper QFX switch to implement new VLANs. After committing the changes, the engineer realized that the new configuration caused a critical loss of connectivity to the management network. The engineer needs to revert to the previous configuration that was working. The switch is still accessible via the console port, and the engineer has privilege level access. The previous configuration was committed two commits ago, and the current active configuration is the problematic one. Which action should the engineer take to restore the previous working configuration?

Accepted Answer

Execute 'rollback 2' followed by 'commit'.. The working configuration was committed two commits ago. The 'rollback 2' command loads the configuration from two commits prior into the candidate configuration. After that, 'commit' makes it active, restoring connectivity. Note that 'rollback 1' would load the intermediate commit, which is also problematic, and 'rollback 0' refers to the current active configuration.

Answer

Use 'load override /config/juniper.conf.1.gz' followed by 'commit'.

Answer

Use 'delete system' to remove all configuration and then commit.

Answer

Execute 'rollback 0' followed by 'commit'.