Knowledge + Practice

Juniper Networks Certified Associate Junos JNCIA-Junos (JN0-106) — Questions 1–75

156 questions total · 3pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 3

1

MCQeasy

Refer to the exhibit. Which interface has a physical layer connectivity problem?

A.ge-0/0/2

B.ge-0/0/0

C.ge-0/0/3

D.ge-0/0/1

AnswerD

ge-0/0/1 is administratively up (configuration enables the interface) but the link is down, meaning the physical layer is not establishing connectivity. This mismatch—admin up, link down—points to a Layer 1 problem such as a disconnected cable, faulty optics, or an unpowered peer. Unlike an administratively down interface, this is not expected; further troubleshooting like checking the SFP and cable is needed.

Why this answer

Interface ge-0/0/1 shows 'Physical link is Down' in the output, which directly indicates a physical layer connectivity problem. The 'Device present' field is also 'No', confirming that no transceiver or cable is detected, which is a Layer 1 issue.

Exam trap

The trap here is that candidates may focus on the 'Admin' status (up/down) rather than the 'Physical link' status, mistakenly assuming an administratively down interface is a physical layer problem, when in fact the physical layer issue is indicated by the link state being down regardless of administrative configuration.

How to eliminate wrong answers

Option A is wrong because ge-0/0/2 shows 'Physical link is Up' and 'Device present' is 'Yes', indicating no physical layer problem. Option B is wrong because ge-0/0/0 shows 'Physical link is Up' and 'Device present' is 'Yes', so the physical layer is functioning correctly. Option C is wrong because ge-0/0/3 shows 'Physical link is Up' and 'Device present' is 'Yes', meaning there is no physical layer connectivity issue.

Full explanation →

2

MCQmedium

An administrator executes 'show route 192.168.1.0/24' and sees no output, but the route is configured. Which command should be used to display the reason the route is not active?

A.show route hidden

B.show log messages

C.show route protocol static

D.show route forwarding-table

AnswerA

The `show route hidden` command is the definitive way to view routes that the routing table has marked as unusable, along with the specific reason for their hidden status. Junos maintains hidden routes in the routing table (e.g., inet.0) but excludes them from active forwarding and from normal `show route` output. This command directly reveals those routes and the `hidden` reason field, enabling targeted diagnosis. It is the only command listed that fully exposes hidden routes without additional filters.

Why this answer

The 'show route hidden' command displays routes that are present in the routing table but are not active due to reasons such as a next-hop being unreachable, a routing policy rejecting the route, or a route preference conflict. When a route is configured but not shown in the standard 'show route' output, it is likely hidden, and this command reveals the specific reason (e.g., 'next-hop unreachable' or 'rejected by policy').

Exam trap

The trap here is that candidates assume 'show route protocol static' will show all static routes, but they forget that hidden routes are excluded from standard protocol-specific outputs, leading them to overlook the dedicated 'show route hidden' command.

How to eliminate wrong answers

Option B is wrong because 'show log messages' displays system log messages (e.g., interface flaps, errors) but does not show hidden routes or the specific reason a route is inactive. Option C is wrong because 'show route protocol static' filters the routing table to show only static routes, but if the static route is hidden, it will not appear in this output either; it does not reveal why the route is hidden. Option D is wrong because 'show route forwarding-table' displays the kernel forwarding table (used for packet forwarding), not the routing table, and does not show hidden routes or reasons for inactivity.

Full explanation →

3

Drag & Dropmedium

Order the steps to configure a user account with a password in Junos.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order to configure a user account in Junos involves setting both the class and authentication before committing. Options A and B are both valid sequences because the order of setting the class and authentication does not matter; the configuration is applied only upon commit. Option C is wrong because committing before setting the authentication leaves the user without a password.

Option D is wrong because committing before setting the class results in an incomplete user configuration with no privilege level.

Exam trap

Many candidates erroneously think that the order of class and authentication matters, but Junos does not enforce a specific order; both sequences work as long as all parameters are configured before commit.

Full explanation →

4

MCQmedium

A network engineer is configuring a Juniper device in a production network. They have applied several changes to the candidate configuration and run 'commit check', which passes. After a brief pause, they run 'commit' but receive the error: 'commit failed: configuration database modified by another user. Please reload the configuration and try again.' The engineer is the only person currently logged into the device, but they know that another engineer was working on the same device earlier and may have left a commit pending. What is the most likely reason for the commit failure?

A.The other engineer committed their changes between the commit check and the commit.

B.The commit check did not validate the syntax of the new changes.

C.The candidate configuration has timed out and must be re-entered.

D.The device has insufficient storage to write the new configuration.

AnswerA

This is the most likely cause of the 'configuration database modified by another user' error.

Why this answer

The error message 'configuration database modified by another user' indicates that another user (the earlier engineer) had a pending commit that was not yet applied or discarded. When the current engineer ran 'commit check', it validated the candidate configuration against the current active configuration, but between that check and the actual 'commit', the other engineer's pending commit was applied (or their session was closed, causing their changes to be committed automatically if they had left a commit pending). This changed the configuration database, causing the commit to fail due to a version mismatch.

Exam trap

The trap here is that candidates may assume 'commit check' passes guarantee a successful commit, but they overlook that the configuration database can be modified by another user between the check and the commit, leading to a commit failure even when no other user is currently logged in.

How to eliminate wrong answers

Option B is wrong because 'commit check' does validate the syntax of the candidate configuration; if it passes, the syntax is correct. Option C is wrong because the candidate configuration does not 'time out' in Junos; it remains in the candidate database until explicitly committed or discarded. Option D is wrong because insufficient storage would typically produce a different error (e.g., 'no space left on device') and is not related to the 'configuration database modified by another user' message.

Full explanation →

5

MCQeasy

An engineer wants to revert all uncommitted changes in the candidate configuration and start fresh from the currently active configuration. Which command should be used?

A.rollback 0

B.commit check

C.rollback 1

D.load override terminal

AnswerA

In Junos, `rollback 0` directly loads the most recently committed configuration into the candidate configuration, discarding any uncommitted edits or staged changes. This makes the candidate an exact mirror of the active, running configuration without modifying that active configuration until a subsequent commit. It is the standard, intended way to revert all uncommitted changes while preserving the currently effective operational state.

Why this answer

The `rollback 0` command reverts all uncommitted changes in the candidate configuration and restores it to match the currently active configuration (the one most recently committed). This is because Junos stores the last 50 committed configurations, with index 0 always representing the active configuration. Using `rollback 0` effectively discards any uncommitted edits and starts fresh from the last committed state.

Exam trap

The trap here is that candidates often confuse `rollback 0` with `rollback 1`, mistakenly thinking that `rollback 1` reverts uncommitted changes, when in fact `rollback 1` reverts to the configuration before the last commit, not the current active configuration.

How to eliminate wrong answers

Option B is wrong because `commit check` only validates the syntax and semantics of the candidate configuration without committing it; it does not revert any changes. Option C is wrong because `rollback 1` reverts to the configuration that was active before the most recent commit (the previous committed version), not to the currently active configuration. Option D is wrong because `load override terminal` replaces the entire candidate configuration with text entered via the terminal, but it does not automatically revert to the active configuration; it requires manual input and is not a simple undo of uncommitted changes.

Full explanation →

6

MCQhard

A network operator needs to upgrade the Junos OS on the backup RE (re1) of a dual-RE system. Which procedure ensures that only the backup RE is upgraded and rebooted without affecting the forwarding plane?

A.Use 'request system software add <image> re1' and then 'request system reboot re1'

B.Use 'request system software add <image> both' and then 'request system reboot both'

C.Use 'request system software add <image> re0' and then 'request system reboot re0'

D.Copy the image to both REs and reboot the backup RE with 'request system reboot slice 1'

AnswerA

Targeting re1 with the 're1' keyword ensures the image is installed only on the backup Routing Engine, leaving the active primary RE untouched. Rebooting re1 restarts only that RE; the primary continues handling forwarding and control traffic, so there is no service interruption. After re1 returns online as standby, it is ready to assume primary role in a later switchover, which is the correct maintenance procedure.

Why this answer

The 'request system software add <image> re1' command installs the Junos OS image only on the backup Routing Engine (RE1), and the subsequent 'request system reboot re1' reboots only that RE. In a dual-RE system, this procedure isolates the upgrade to the backup RE, ensuring the forwarding plane remains active on the primary RE (RE0) and no traffic disruption occurs.

Exam trap

The trap here is that candidates may confuse the 'both' option with a safe upgrade method, not realizing it reboots both REs simultaneously and disrupts traffic, or they may incorrectly assume that copying the image manually and using a non-existent 'slice' command is a valid procedure.

How to eliminate wrong answers

Option B is wrong because 'request system software add <image> both' and 'request system reboot both' upgrade and reboot both REs simultaneously, which would disrupt the forwarding plane by causing a full system outage. Option C is wrong because 'request system software add <image> re0' and 'request system reboot re0' target the primary RE, which would interrupt the forwarding plane and potentially cause a traffic loss. Option D is wrong because 'request system reboot slice 1' is not a valid Junos command for rebooting a specific RE; the correct syntax uses 're0' or 're1' to specify the Routing Engine, and copying the image to both REs without using the proper 'request system software add' command does not ensure a controlled upgrade.

Full explanation →

7

MCQmedium

A router has two routes to the same destination: one with preference 10 and metric 5, and another with preference 15 and metric 3. Which route will be installed in the forwarding table?

A.The route with preference 10.

B.The route with metric 3.

C.Neither route is installed.

D.Both routes are installed if ECMP is enabled.

AnswerA

Preference is the primary selection criterion.

Why this answer

In Junos, the route preference (administrative distance) is the primary criterion for selecting the best route to a destination. The route with preference 10 is preferred over the route with preference 15, regardless of metric values. The route with preference 10 is installed in the forwarding table.

Exam trap

The trap here is that candidates often confuse metric with preference, assuming a lower metric always wins, but Junos prioritizes preference over metric in route selection.

How to eliminate wrong answers

Option B is wrong because metric is only used as a tiebreaker when preferences are equal; a lower metric (3) does not override a higher preference (15). Option C is wrong because one route will always be installed when there are valid routes to the same destination, unless both are rejected by policy or have the same preference and metric with ECMP disabled. Option D is wrong because ECMP (Equal-Cost Multipath) requires routes to have equal preference and equal metric; here preferences differ (10 vs 15), so ECMP does not apply.

Full explanation →

8

MCQeasy

A Juniper device has multiple candidate configurations loaded. The administrator wants to discard all uncommitted changes and revert to the last committed configuration. Which command should be used?

A.rollback 0

B.delete configuration

C.clear configuration

D.load override terminal

AnswerA

The `rollback 0` command reverts the candidate configuration to the last committed configuration by loading revision 0 from the configuration history, which always represents the most recently committed state. This directly satisfies the requirement to discard all uncommitted changes without affecting previously committed configurations, as rollback numbers increment with each commit and 0 is the fixed reference for the last committed configuration.

Why this answer

The 'rollback 0' command reverts the candidate configuration to the last committed configuration, discarding all uncommitted changes. In Junos, the rollback command uses a numeric index where 0 always refers to the most recently committed configuration, effectively undoing any uncommitted edits.

Exam trap

The trap here is that candidates may confuse 'rollback 0' with 'rollback 1', thinking 0 means 'no rollback' or that a higher number is needed to revert changes, when in fact 0 discards uncommitted edits and 1 reverts the last commit.

How to eliminate wrong answers

Option B is wrong because 'delete configuration' is not a valid Junos command; the correct approach to remove configuration is using 'delete' within configuration mode for specific statements, not a global delete. Option C is wrong because 'clear configuration' is not a valid Junos command; 'clear' is used for operational tasks like clearing counters or logs, not for reverting configuration. Option D is wrong because 'load override terminal' is used to replace the entire candidate configuration with text pasted from the terminal, but it does not revert to the last committed configuration; it loads new configuration from scratch.

Full explanation →

9

MCQhard

A host in VLAN 10 can ping a host in VLAN 20 without a default gateway configured. What feature is likely enabled on the router that interconnects the VLANs?

A.VLAN translation is configured on the trunk

B.Proxy ARP

C.IP routing is enabled on the router

D.Dynamic ARP Inspection

AnswerB

Proxy ARP enables the router to reply to ARP requests for IP addresses that are actually in other subnets, providing its own MAC address as the next hop. This makes the host believe the remote host is directly reachable, so it sends frames to the router, which then routes them to VLAN 20. This gives the host a path to the remote subnet without requiring a default gateway configuration, which is exactly why it works here.

Why this answer

Proxy ARP allows a router to respond to ARP requests on behalf of hosts in different subnets. When a host in VLAN 10 sends an ARP request for a host in VLAN 20, the router responds with its own MAC address if it has a route to the destination. This enables the host to send traffic to the router, which then forwards it to the destination VLAN, even without a default gateway configured on the host.

Exam trap

The trap here is that candidates often assume IP routing alone is sufficient for inter-VLAN communication, forgetting that hosts must have a default gateway or use proxy ARP to send traffic outside their local subnet.

How to eliminate wrong answers

Option A is wrong because VLAN translation modifies VLAN IDs on trunk links and does not enable inter-VLAN communication without a default gateway; it simply maps one VLAN tag to another. Option C is wrong because IP routing is a prerequisite for any inter-VLAN communication, but it alone does not allow a host to reach a different subnet without a default gateway—the host must still know where to send packets. Option D is wrong because Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets to prevent spoofing; it does not facilitate routing or proxy ARP responses.

Full explanation →

10

MCQhard

While in configuration mode, an administrator wants to see the difference between the candidate configuration and the active configuration. Which command accomplishes this?

A.show configuration

B.run show configuration

C.show | compare

D.show system commit

AnswerC

Shows changes between candidate and active.

Why this answer

The 'show | compare' command, when executed in configuration mode, displays the differences between the candidate configuration and the active (committed) configuration. This pipe filter compares the current candidate configuration against the last committed configuration, highlighting additions, deletions, and changes, which is the exact requirement for seeing the difference.

Exam trap

The trap here is that candidates confuse 'show configuration' (which shows the full candidate config) with 'show | compare' (which shows only the differences), or they mistakenly think 'run show configuration' provides a diff, when it simply runs the same full-config display command from operational mode.

How to eliminate wrong answers

Option A is wrong because 'show configuration' in configuration mode displays the entire candidate configuration, not the difference between candidate and active configurations. Option B is wrong because 'run show configuration' executes the operational mode command 'show configuration' from within configuration mode, which also shows the full candidate configuration, not a comparison. Option D is wrong because 'show system commit' displays the commit history (list of past commits with timestamps and IDs), not a diff between candidate and active configurations.

Full explanation →

11

MCQhard

A company runs a Juniper SRX firewall cluster consisting of two nodes (node0 primary, node1 secondary). The cluster has been stable. During maintenance, you modify the configuration on node0 and commit. After the commit, the cluster status shows node1 as 'ineligible'. You suspect a configuration mismatch. What should you do to synchronize the configuration without disrupting traffic?

A.On the primary node, execute 'commit synchronize'.

B.Reboot both nodes to force synchronization.

C.Manually copy the configuration file from primary to secondary.

D.On the secondary node, execute 'commit synchronize'.

AnswerA

On the primary node, execute 'commit synchronize' is the correct approach because in a Juniper chassis cluster, the primary node is the sole controller that can propagate configuration changes to its cluster peer. This command commits the local configuration and then replicates that same candidate configuration to the secondary node over the control link, followed by a commit on both nodes. Without specifying 'synchronize', a normal commit only updates the node on which it is executed, so this is the definitive way to ensure both nodes run identical configurations.

Why this answer

The 'commit synchronize' command on the primary node (node0) pushes the active configuration to the secondary node (node1) and commits it on both nodes, ensuring configuration consistency without requiring a reboot or traffic disruption. In a Juniper SRX cluster, the primary node is the authoritative source for configuration synchronization, and this command is the standard method to resolve a configuration mismatch that causes a node to become 'ineligible'.

Exam trap

The trap here is that candidates may think the secondary node can initiate synchronization (option D) or that a manual file copy (option C) is acceptable, but Juniper clusters require the primary to be the source of truth for configuration synchronization to maintain cluster integrity and avoid split-brain scenarios.

How to eliminate wrong answers

Option B is wrong because rebooting both nodes is an unnecessary and disruptive action that would cause traffic loss; it does not directly synchronize the configuration and may not resolve the mismatch if the secondary's configuration remains out of sync. Option C is wrong because manually copying the configuration file from primary to secondary is not a supported or safe method in a cluster; it bypasses Junos's internal synchronization mechanisms and could lead to file corruption or cluster instability. Option D is wrong because executing 'commit synchronize' on the secondary node (node1) is ineffective; the secondary node cannot push its configuration to the primary, and the command would fail or not achieve synchronization since the primary is the authoritative source for cluster configuration.

Full explanation →

12

MCQmedium

Refer to the exhibit. An administrator needs to ensure that all emergency (emerg) messages are logged to the console. Based on the configuration shown, which statement is correct?

A.Emergency messages are logged to the console only.

B.Emergency messages are logged to all destinations.

C.Emergency messages are logged only to the file 'messages'.

D.Emergency messages are logged only to the remote host.

AnswerB

Emergency messages are indeed logged to all destinations because each configured syslog target has a severity threshold that includes 'emerg'. The console's 'any warning' means it logs warning and everything more severe (emerg, alert, crit, err), the file 'messages' with 'any any' logs every severity including emerg, and the remote host with 'any critical' logs critical and above, which again includes emerg. Since all thresholds capture severity level 0, every destination receives emergency messages, making this the correct statement.

Why this answer

The configuration shown includes the 'any' facility and 'emerg' severity for the console, file, and remote host destinations. In JUNOS, when a severity level is set for a syslog destination, all messages of that severity and higher are logged. Since 'emerg' is the highest severity, it applies to all configured destinations, not just one.

Exam trap

The trap here is that candidates may assume that configuring 'emerg' for a specific destination limits logging to that destination, but in JUNOS, the severity level applies independently to each destination, and all destinations with that severity configured will receive the messages.

How to eliminate wrong answers

Option A is wrong because the configuration explicitly defines syslog destinations for console, file, and remote host, so emergency messages are not limited to the console only. Option C is wrong because the file destination is configured with 'any emerg', meaning emergency messages are logged to the file, but they are also logged to other destinations. Option D is wrong because the remote host is configured with 'any emerg', but emergency messages are not logged only to the remote host; they are logged to all destinations.

Full explanation →

13

MCQmedium

A network administrator is configuring a new interface and wants to ensure that the interface is enabled and can pass traffic. Which configuration element is required?

A.set interfaces ge-0/0/0 enable

B.set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24

C.set interfaces ge-0/0/0 unit 0 family inet

D.set interfaces ge-0/0/0 disable

AnswerB

This command assigns an IPv4 address to unit 0 on ge-0/0/0, which automatically creates the logical interface and ties the inet address family to it. Once the address is committed, the interface is implicitly enabled and becomes operationally eligible to carry traffic. This is the correct minimal configuration for the task because it provides the required IP details and activates the interface without needing any additional 'enable' statement.

Why this answer

In Junos, an interface is administratively enabled by default (no explicit 'enable' command is needed), but to pass traffic it requires a logical unit with a configured protocol family and an IP address. The command 'set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24' creates unit 0, assigns the IPv4 address, and implicitly enables the interface for traffic forwarding. Without an address under a family, the interface cannot pass IP traffic even if it is administratively up.

Exam trap

The trap here is that candidates familiar with Cisco IOS may expect an explicit 'no shutdown' command (or an 'enable' keyword) to bring an interface up, but Junos interfaces are enabled by default, and the critical missing piece is the IP address under the logical unit, not an administrative enable command.

How to eliminate wrong answers

Option A is wrong because Junos does not have an 'enable' knob at the interface level; interfaces are administratively enabled by default, and the correct way to disable them is with 'disable'. Option C is wrong because 'set interfaces ge-0/0/0 unit 0 family inet' only enables the IPv4 protocol family on the logical unit but does not assign an IP address, so the interface cannot pass traffic (no local route or ARP entry is generated). Option D is wrong because 'set interfaces ge-0/0/0 disable' explicitly disables the interface, preventing it from passing any traffic, which is the opposite of the requirement.

Full explanation →

14

MCQmedium

A network engineer needs to upgrade Junos on an MX router with dual Routing Engines (RE0 and RE1). What is the recommended procedure to minimize downtime?

A.Upgrade the primary RE first, then the backup

B.Reboot both REs at the same time after copying the image

C.Upgrade the backup RE, perform a graceful switchover (RESTART ROUTING), then upgrade the former primary

D.Upgrade both REs simultaneously using the same image

AnswerC

This is the standard upgrade procedure for dual RE systems, minimizing traffic impact.

Why this answer

It minimizes downtime by first upgrading the backup RE (RE1), then performing a graceful Routing Engine switchover (using the 'request chassis routing-engine master switch' command or equivalent), which causes the upgraded backup to become the new primary without disrupting traffic. After the switchover, the former primary (now the backup) can be upgraded and rebooted, ensuring that at least one RE is always processing traffic and routing protocols like BGP and OSPF maintain their adjacencies.

Exam trap

The trap here is that candidates assume upgrading the primary first is safer or more logical, but Junos requires upgrading the backup first and performing a graceful switchover to maintain control plane continuity and avoid traffic loss.

How to eliminate wrong answers

Option A is wrong because upgrading the primary RE first forces a reboot of the active RE, causing immediate traffic disruption and routing protocol convergence delays, which defeats the purpose of dual REs for high availability. Option B is wrong because rebooting both REs simultaneously removes all redundancy and causes a complete outage, as no RE is available to forward traffic or maintain routing state. Option D is wrong because upgrading both REs at the same time (even with the same image) requires simultaneous reboots, which again eliminates redundancy and leads to downtime; Junos does not support in-service software upgrade (ISSU) across both REs in parallel.

Full explanation →

15

MCQeasy

A network administrator wants to see the current CPU load average over the last 1, 5, and 15 minutes on a Juniper device. Which command displays this information?

A.show chassis routing-engine

B.show system uptime

C.show system processes

D.show system statistics

AnswerB

The `show system uptime` command is the correct way to view CPU load averages on Junos because its output begins with a `Load averages:` line that shows the 1-, 5-, and 15-minute averages. These three numbers indicate how many threads are runnable or waiting for I/O, providing a historical trend that a simple percentage cannot capture. The command also shows system uptime, time, and active users, but the load average is the key field for this question.

Why this answer

The 'show system uptime' command displays the system's uptime along with the load averages for the last 1, 5, and 15 minutes. This is the standard Junos command for viewing CPU load averages, which are calculated based on the number of processes in the run queue over those time intervals.

Exam trap

The trap here is that candidates often confuse 'show chassis routing-engine' (which shows current CPU utilization) with the load average command, not realizing that load averages are a separate time-weighted metric displayed by 'show system uptime'.

How to eliminate wrong answers

Option A is wrong because 'show chassis routing-engine' displays the status and resource utilization of the Routing Engine (including CPU and memory), but it does not show the load average over 1, 5, and 15 minutes; it shows current CPU utilization percentage. Option C is wrong because 'show system processes' lists all running processes with their PID, memory, and CPU usage, but it does not aggregate the load average over time intervals. Option D is wrong because 'show system statistics' displays various system-wide counters and statistics (e.g., packet counts, memory usage), but it does not include CPU load averages.

Full explanation →

16

MCQeasy

A junior administrator wants to view the current active configuration on a Juniper device. Which operational mode command should be used?

A.show configuration | display set

B.show system services

C.show interfaces terse

D.show configuration

AnswerD

This command displays the current active configuration in hierarchy format.

Why this answer

The 'show configuration' command displays the current active configuration in the candidate configuration format, which is the configuration that is currently committed and running on the Juniper device. Option D is correct because it directly retrieves the active configuration from the /config/juniper.conf file, which is the authoritative source for the operational configuration.

Exam trap

The trap here is that candidates confuse the 'show configuration' command with the 'show | display set' pipe modifier, thinking the latter is a separate command to view the active configuration, when in fact it is just an output formatting option.

How to eliminate wrong answers

Option A is wrong because 'show configuration | display set' displays the configuration in a set-based format, which is a representation of the configuration but not the default active configuration view; it is a pipe modifier that changes the output format, not the command to view the active configuration. Option B is wrong because 'show system services' displays the status of system services like SSH, Telnet, or FTP, not the device's configuration. Option C is wrong because 'show interfaces terse' displays a summary of interface status and configuration, but it does not show the full active configuration of the device.

Full explanation →

17

MCQmedium

A static route is configured with next-hop 10.0.0.1, but the route does not appear in the routing table. The interface ge-0/0/0 has IP 192.168.1.2/24 and is up. What is the most likely reason?

A.The static route has a preference of 5.

B.The route is hidden due to an import policy.

C.The static route is configured with the 'discard' option.

D.The next-hop IP is not on a directly connected subnet.

AnswerD

For a static route with an IP next hop to be installed in the Junos routing table, that next hop must be directly reachable via one of the router's connected interfaces. If 10.0.0.1 does not belong to any subnet configured on the router, the route cannot resolve the next-hop MAC address and remains hidden. Without the 'resolve' option, Junos does not perform recursive lookup, so the route is not installed; this matches the symptom exactly.

Why this answer

D is correct because Junos requires the next-hop IP of a static route to be reachable via a directly connected subnet for the route to be installed in the routing table. Since the next-hop 10.0.0.1 is not on the same subnet as the interface ge-0/0/0 (192.168.1.2/24), the route remains hidden and does not appear in the routing table.

Exam trap

The trap here is that candidates often assume any IP address can be used as a next-hop for a static route, but Junos strictly enforces that the next-hop must be on a directly connected subnet unless recursive resolution is explicitly configured.

How to eliminate wrong answers

Option A is wrong because a preference of 5 is actually lower (more preferred) than the default static route preference of 5, so it would not prevent the route from appearing; in fact, it would make it more likely to be installed. Option B is wrong because import policies affect routes learned from routing protocols, not locally configured static routes; static routes are not subject to import policies unless explicitly filtered with an export policy on the forwarding table. Option C is wrong because the 'discard' option would still install the route in the routing table as a discard route (with next-hop 'discard'), not hide it entirely.

Full explanation →

18

Multi-Selecteasy

Which TWO statements describe correct methods to enter configuration mode? (Choose two.)

Select 3 answers

A.Type 'edit' at the operational mode prompt.

B.Type 'configure exclusive' at the operational mode prompt.

C.Type 'configure' at the operational mode prompt.

D.Type 'cli' at the operational mode prompt.

E.Type 'expert' at the operational mode prompt.

AnswersA, B, C

Correct: The 'edit' command is a direct method to enter configuration mode from operational mode.

Why this answer

The 'edit' command transitions from operational mode into configuration mode. Option B is correct because the 'configure exclusive' command enters configuration mode in exclusive mode, which is a valid method. Option C is correct because the 'configure' command enters configuration mode in shared mode.

Options D and E are invalid commands in Junos OS.

Exam trap

Candidates may mistakenly think only 'edit' and 'configure' are correct, but 'configure exclusive' is also a valid method. The question asks for two statements; any two of the first three are correct.

Full explanation →

19

MCQhard

A technician notices that the /var partition on a Junos device is 95% full. Which action will immediately free up disk space without affecting device operation?

A.Delete unused software packages using 'request system software delete'

B.Reboot the device

C.Remove the /var/log directory

D.Clear log files using 'clear log messages'

AnswerD

Using 'clear log messages' is the correct immediate action because it truncates the active log files under /var/log (specifically /var/log/messages) and instantly releases all allocated blocks to the filesystem, freeing space in /var without requiring a reboot or commit. The syslog daemon continues writing to the file, which is recreated/truncated gracefully, so no logging interruption or packet loss occurs. This targeted approach addresses the symptom—a full /var partition—while preserving all other system files and services.

Why this answer

The 'clear log messages' command immediately removes the contents of the active log files (e.g., messages, interactive-commands) without requiring a reboot or affecting running processes. This directly frees up space in /var/log, which is a primary consumer of the /var partition, while leaving the directory structure intact so logging continues normally.

Exam trap

The trap here is that candidates may think rebooting (Option B) clears all temporary files and logs, but Junos does not automatically delete persistent log files on reboot; only volatile /tmp is cleared, so /var remains full.

How to eliminate wrong answers

Option A is wrong because 'request system software delete' removes inactive software packages from /var/sw/pkg, but if the /var partition is 95% full due to log files, this action may not free significant space and could be unnecessary; also, it does not immediately address the most common cause of /var fullness. Option B is wrong because rebooting the device does not delete any files; it only clears temporary runtime data in /tmp and /var/tmp, but persistent log files in /var/log remain, so disk space is not freed. Option C is wrong because removing the /var/log directory would break logging functionality, cause loss of forensic data, and potentially disrupt system operations (e.g., syslogd may fail to start), which violates the requirement of not affecting device operation.

Full explanation →

20

MCQeasy

Refer to the exhibit. What does this command accomplish?

A.Displays help for syslog messages that include 'error'.

B.Displays all syslog messages.

C.Displays syslog messages containing the word 'error'.

D.Displays the error log file.

AnswerC

This is correct because the command combines a log display command with a match filter. For example, `show log messages | match error` displays every line from the messages log that contains the substring "error" (case-sensitive by default in Junos). This is a standard way for an operator to quickly search a system log for error-related entries without reading the whole file. It is not restricted to a specific severity class; it is simply a text-pattern match against the log output.

Why this answer

The command shown filters the output of the system log file to display only lines containing the substring 'error'. This allows the administrator to quickly see log entries related to errors, rather than viewing all messages or a dedicated error log file.

Exam trap

Candidates often assume that the 'match' operator performs a whole-word search or that there is a dedicated error log file, but in Junos it performs a substring match on the default messages log.

How to eliminate wrong answers

Option B is wrong because 'show log messages' alone displays all syslog messages, but the pipe with 'match error' filters the output, so it does not display all messages. Option C is wrong because the 'match' filter performs a substring match, not a whole-word match; it would also match messages containing 'error' as part of a larger word (e.g., 'error-handling'), so it does not strictly display only messages containing the word 'error'. Option D is wrong because there is no separate 'error log file' in Junos; syslog messages are stored in the messages log file, and this command filters that file, not a dedicated error log.

Full explanation →

21

Multi-Selectmedium

Which two factors determine whether a route is active for a given destination when multiple routes from different protocols exist? (Choose two.)

Select 2 answers

A.Metric

B.Route preference

C.Route origin

D.Next-hop reachability

E.Local preference

AnswersB, D

Route preference is used to compare routes from different protocols; lower preference is preferred.

Why this answer

B is correct because Junos uses route preference (administrative distance) as the primary tiebreaker when multiple routing protocols offer routes to the same destination. The route with the lowest preference value is installed into the routing table as the active route. D is correct because even if a route has the best preference, it must have a reachable next hop to be considered active; if the next hop is unreachable, the route is hidden and not used.

Exam trap

The trap here is that candidates often confuse metric with preference, thinking metric is used to compare routes from different protocols, but Junos uses preference as the first tiebreaker, and metric only applies within the same protocol.

Full explanation →

22

MCQeasy

An engineer wants to configure a static route that will be used only if the primary route (learned via OSPF) becomes unavailable. Which feature should be used?

A.Floating static route with a higher preference.

B.Static route with a lower metric.

C.Reverse path forwarding.

D.Routing policy.

AnswerA

A floating static route is configured with a higher preference value than the dynamic protocol's default. Since OSPF's default preference is 10, setting the static route's preference to, say, 15 ensures it is only used when the OSPF route is unavailable. This makes it a backup route.

Why this answer

A floating static route is configured with a higher preference (administrative distance) than the OSPF-learned route. Since JUNOS prefers routes with lower preference values, the static route will only be installed in the routing table when the OSPF route is withdrawn, providing a backup path.

Exam trap

The trap here is that candidates often confuse 'metric' with 'preference' (administrative distance), assuming a lower metric on a static route would make it preferred over OSPF, but metric only applies within the same routing protocol, not between different sources.

How to eliminate wrong answers

Option B is wrong because metric is used by dynamic routing protocols (like OSPF cost) to compare routes within the same protocol, not to influence route selection between different protocols; a static route with a lower metric does not affect its preference over OSPF. Option C is wrong because Reverse Path Forwarding (RPF) is a unicast or multicast forwarding security feature that verifies the source address of incoming packets, not a mechanism for route redundancy or failover. Option D is wrong because routing policies can manipulate route attributes or filter routes, but they do not directly create a backup static route that automatically activates only when the primary route is lost; the concept of a floating route relies on preference values, not policy alone.

Full explanation →

23

MCQmedium

Which field in an Ethernet frame is used by a switch to learn which source MAC address belongs to which port?

A.Ethertype field

B.Destination MAC address

C.VLAN ID field

D.Source MAC address

AnswerD

The switch learns that the source MAC address is reachable out of the port on which the frame arrived, creating or updating a MAC address table entry. This is the fundamental operation of transparent bridging: the switch records the association between the source MAC address, ingress port, and VLAN ID. Once learned, the entry is used to forward future frames destined to that MAC address only to the correct port, rather than flooding. Thus, the source MAC address is the field that triggers and drives MAC learning in an Ethernet switch.

Why this answer

A switch learns MAC address-to-port mappings by examining the source MAC address field of incoming Ethernet frames. When a frame arrives on a port, the switch records the source MAC address and associates it with that port in its MAC address table, enabling future frames destined for that MAC to be forwarded only to the correct port.

Exam trap

The trap here is that candidates often confuse the role of the destination MAC address (used for forwarding decisions) with the source MAC address (used for learning), especially when they recall that switches forward frames based on destination MAC, but forget that learning is done from the source MAC.

How to eliminate wrong answers

Option A is wrong because the Ethertype field indicates the upper-layer protocol (e.g., IPv4 or IPv6) encapsulated in the frame, not the source or destination MAC address, and is not used for MAC learning. Option B is wrong because the destination MAC address is used by the switch to look up the forwarding decision (which port to send the frame out of) after the MAC address table is built, not to learn which port a source MAC belongs to. Option C is wrong because the VLAN ID field (part of the 802.1Q tag) identifies the VLAN membership of the frame, but MAC learning is performed per VLAN using the source MAC address, not the VLAN ID itself.

Full explanation →

24

MCQmedium

A company has multiple Juniper devices and wants to standardize configuration snapshots for backup and audit purposes. What is the best practice?

A.Run 'commit and-quit' to save the configuration to the flash

B.Use 'show configuration | save /var/tmp/config.txt' and then transfer the file via SCP to a backup server

C.Use the 'file archive' command to create a backup of the configuration

D.Use the 'show configuration | no-more' command and copy the output manually

AnswerB

This automates the backup and stores a retrievable file.

Why this answer

It uses the 'show configuration | save' command to write the current active configuration to a file in /var/tmp, which can then be securely transferred via SCP to a backup server. This is the standard Junos method for creating a portable, text-based snapshot of the configuration for backup and audit purposes, as it preserves the exact configuration syntax and can be easily compared or restored.

Exam trap

The trap here is that candidates may confuse the 'commit and-quit' command (which commits and exits) with a backup mechanism, or assume that 'file archive' is the correct tool for capturing configuration output, when in fact Junos requires explicit piping of the configuration output to a file for reliable backups.

How to eliminate wrong answers

Option A is wrong because 'commit and-quit' is not a valid Junos command; the correct command is 'commit and-quit' (with a space) which commits the configuration and exits the configuration mode, but it does not save a separate snapshot file to flash—it only activates the candidate configuration. Option C is wrong because the 'file archive' command is used to compress or archive files, not to capture the active configuration; it operates on existing files, not on the output of a 'show' command. Option D is wrong because 'show configuration | no-more' only displays the configuration without paging, but it does not save the output to a file; manually copying the output is error-prone and not a scalable or auditable practice for standardized backups.

Full explanation →

25

MCQmedium

Refer to the exhibit. The network administrator made a change that caused connectivity loss. They need to revert to the configuration before the most recent commit. Which command would accomplish this?

A.rollback 0

B.rollback 3

C.rollback 2

D.rollback 1

AnswerD

rollback 1 loads the configuration that was committed before the most recent commit. Because the administrator's latest change caused the connectivity loss, this returns the network to the exact working state immediately prior to that change. It is the only rollback target that precisely reverts the faulty modification while preserving all earlier configuration data.

Why this answer

In Junos, rollback numbers are stored with 0 being the most recent committed configuration. To revert to the configuration before the most recent commit, you need to load the configuration that was active before that change. That is rollback 1, which represents the second most recent commit.

Using rollback 0 would load the configuration that caused the issue, not fix it.

Exam trap

Many candidates mistakenly believe that rollback 0 undoes the last change. However, rollback 0 loads the most recent committed configuration—the one that caused the connectivity loss—so it would reload the problem, not fix it. To revert to the configuration before the last commit, you must use rollback 1.

How to eliminate wrong answers

Option B (rollback 3) is wrong because rollback 3 refers to the configuration from three commits ago, not the most recent commit. Option C (rollback 2) is wrong because rollback 2 refers to the configuration from two commits ago. Option D (rollback 1) is wrong because rollback 1 refers to the configuration immediately before the last commit, which is the same as the current active configuration after the last commit, not the configuration before the most recent commit.

The key distinction is that rollback 0 is the most recent commit, while rollback 1 is the previous commit.

Full explanation →

26

Drag & Dropmedium

Order the steps to reset the root password on a Junos device via the console.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Root password recovery requires boot interruption and selecting the recovery option from the boot menu.

Full explanation →

27

MCQeasy

Refer to the exhibit. Why is the route for 192.168.1.0/24 hidden?

A.The route has a higher metric

B.The route has a lower preference

C.The route is not committed

D.The next-hop is unreachable

AnswerD

Junos marks static routes as hidden when the configured next-hop address cannot be resolved to an active outgoing interface or next-hop route. Because the destination 192.168.1.0/24 is unreachable through that next-hop, the routing protocol process retains the route but does not install it in the forwarding table, displaying it with the 'hidden' flag. This is the standard condition that creates hidden static routes.

Why this answer

A route is hidden in the JUNOS routing table when its next-hop is unreachable. The show route command displays only active routes; if the next-hop address is not reachable via any active interface or route, the route is suppressed (hidden) and not used for forwarding. This is a fundamental behavior of JUNOS route selection and differs from Cisco IOS, which may still display such routes.

Exam trap

The trap here is that candidates often confuse hidden routes with routes that are not committed or have a higher metric, but JUNOS specifically hides routes when the next-hop is unreachable, not due to metric or preference comparisons.

How to eliminate wrong answers

Option A is wrong because metric (cost) is used for comparing routes from the same protocol to the same destination, but a hidden route is not hidden due to a higher metric—it is hidden because the next-hop is unreachable. Option B is wrong because preference (administrative distance) determines which route is active among different protocols, but a lower preference would make the route more preferred, not hidden; a hidden route is not caused by preference values. Option C is wrong because the route is committed (it appears in the configuration and is present in the routing table as a hidden route), but it is not active due to next-hop unreachability, not because it was not committed.

Full explanation →

28

MCQmedium

You are troubleshooting a network connectivity issue at a medium-sized company that uses Juniper EX4300 switches. Users in VLAN 100 (10.10.100.0/24) report that they cannot access a server in VLAN 200 (10.10.200.0/24). The switch has IRB interfaces configured for both VLANs and is acting as the default gateway. The IRB interfaces are up and have correct IP addresses. The server and users have correct IP configurations. 'show arp' on the switch shows incomplete entries for some hosts in VLAN 100. 'show ethernet-switching table' shows MAC addresses for users are present on the correct access ports. However, pings from the switch to a user in VLAN 100 fail. What is the most likely issue?

A.Spanning Tree Protocol is blocking the user ports.

B.A static MAC address entry for the server is missing.

C.The switch cannot resolve ARP requests because the user's host is not responding.

D.The IRB interface for VLAN 100 is not configured with a proxy ARP.

AnswerC

When a switch's ARP table shows an entry as 'incomplete', it means the switch has sent ARP requests for that IP address but has not received any ARP reply. This occurs when the target host is down, has the wrong IP address, or is configured with a firewall that silently drops ARP probes. The user's host is not responding to the ARP requests, so the switch cannot determine the MAC address needed to forward frames, breaking connectivity even though the host may be physically connected.

Why this answer

The 'incomplete' entries in the 'show arp' output indicate that the switch sent ARP requests for hosts in VLAN 100 but received no replies. Since the switch is the default gateway, it must resolve the Layer 2 MAC address of each host to forward traffic. If a user's host is not responding to ARP (e.g., due to a firewall, misconfiguration, or the host being offline), the switch cannot complete the ARP cache entry, causing pings from the switch to fail and potentially disrupting inter-VLAN routing.

Exam trap

The trap here is that candidates may confuse a Layer 2 issue (like STP blocking or missing MAC entries) with a Layer 3 issue (ARP resolution failure), overlooking that 'incomplete' ARP entries directly point to a host not responding to ARP requests.

How to eliminate wrong answers

Option A is wrong because Spanning Tree Protocol (STP) blocking a port would prevent all traffic, including ARP replies, but the 'show ethernet-switching table' shows MAC addresses on the correct access ports, indicating STP is not blocking those ports. Option B is wrong because a missing static MAC address entry for the server would affect reachability to the server, not the switch's ability to ping a user in VLAN 100; the issue is with ARP resolution for local hosts, not the server. Option D is wrong because proxy ARP is used to allow hosts in one subnet to resolve MAC addresses for hosts in another subnet when the switch is not the default gateway; here, the switch is the default gateway with IRB interfaces, so proxy ARP is not required for the switch to resolve its own ARP requests.

Full explanation →

29

MCQeasy

An administrator configures a static route to 192.168.2.0/24 with next-hop 10.0.0.1. The route does not appear in the routing table. What is the most likely cause?

A.The next-hop 10.0.0.1 is not reachable.

B.The static route has a higher preference than an existing dynamic route.

C.The configuration was not committed.

D.The prefix 192.168.2.0/24 already exists in the forwarding table.

AnswerA

A static route is only installed if the next-hop is reachable via an active route.

Why this answer

A static route will only be installed in the routing table if the next-hop address is reachable via an active route in the routing table. If 10.0.0.1 is not reachable (e.g., no route to that subnet, or the interface is down), Junos will reject the static route and not place it in the inet.0 table. This is a fundamental validation check in Junos that prevents black-hole routing.

Exam trap

The trap here is that candidates assume a static route is always installed immediately after configuration, forgetting that Junos requires the next-hop to be reachable via an existing route in the routing table before the static route becomes active.

How to eliminate wrong answers

Option B is wrong because preference (administrative distance) only matters when comparing routes to the same destination prefix; if the static route does not appear at all, it is not being suppressed by a more preferred route—it failed the next-hop reachability check. Option C is wrong because if the configuration were not committed, the route would not appear in the running configuration, but the question states the administrator configured it; a missing commit would mean the route is not in the candidate config, not that it fails to appear in the routing table. Option D is wrong because the forwarding table is derived from the routing table; if the prefix already existed in the forwarding table, it would have come from a route in the routing table, and a static route to the same prefix could still be installed (with a different preference) or could be rejected only if it were less preferred, but the primary issue is next-hop reachability.

Full explanation →

30

MCQhard

A network administrator is trying to configure a firewall filter on a Juniper device. They enter configuration mode and type 'set firewall family inet filter BLOCK-ICMP term 1 from protocol icmp'. They then type 'set firewall family inet filter BLOCK-ICMP term 1 then reject'. After committing, they notice that ICMP traffic is not being blocked. They run 'show configuration firewall' and see the filter is present. They run 'show firewall filter BLOCK-ICMP' to see the counters and notice the packet count is zero. What is the most likely reason?

A.The protocol icmp is not correct; it should be 'icmp6'.

B.The filter is not applied to any interface.

C.The term 'then reject' should be 'then discard'.

D.The filter must be applied under the 'edit firewall' hierarchy.

AnswerB

In Junos, a firewall filter takes effect only when it is applied to an interface, typically under the "family" hierarchy using an "apply-filter" statement. Without such a binding, the filter remains defined in the configuration but is never evaluated, so all traffic—including ICMP echo requests—continues to pass. The filter must be attached to the appropriate interface and address family to actually block traffic.

Why this answer

A firewall filter in Junos must be applied to an interface to take effect. Simply configuring the filter under the 'edit firewall' hierarchy does not activate it; the filter must be referenced with a 'family inet' statement under the interface configuration (e.g., 'set interfaces ge-0/0/0 unit 0 family inet filter input BLOCK-ICMP'). Without this application, the filter exists in the configuration but never processes traffic, resulting in zero packet counts.

Exam trap

The trap here is that candidates often assume configuring a firewall filter under the 'edit firewall' hierarchy automatically activates it, similar to Cisco IOS where ACLs are applied globally or to interfaces with separate commands, but Junos requires explicit interface application for the filter to process traffic.

How to eliminate wrong answers

Option A is wrong because 'protocol icmp' is correct for IPv4 ICMP; 'icmp6' is used for IPv6 ICMP, which is not relevant here. Option C is wrong because 'then reject' is a valid action that drops packets and sends an ICMP unreachable message; 'then discard' would also drop packets but without notification, and the issue is not about the action type. Option D is wrong because the 'edit firewall' hierarchy is the correct location for configuring firewall filters; the problem is the filter is not applied to an interface, not that it is configured in the wrong place.

Full explanation →

31

MCQmedium

You are troubleshooting an OSPF adjacency issue between two Juniper MX series routers, R1 and R2, both running Junos 18.2. They are directly connected via a Gigabit Ethernet link. R1's interface ge-0/0/0 is configured with IP 192.168.1.1/24, and R2's ge-0/0/0 is configured with IP 192.168.1.2/24. Both interfaces are in OSPF area 0.0.0.0. The physical connectivity is confirmed up, and both interfaces are administratively enabled. You have checked that the hello and dead intervals match (hello 10, dead 40), the area IDs are identical, and the subnet masks are /24. No firewall filters are blocking OSPF. The OSPF configuration on R1 includes 'authentication-type md5' and 'authentication-key juniper123' under the interface. On R2, the configuration also includes 'authentication-type md5' but the key is 'juniper321'. Both routers have loopback addresses as router IDs: 1.1.1.1 for R1 and 2.2.2.2 for R2. No explicit OSPF network type is set, so the default is broadcast. Despite these configurations, the OSPF adjacency state on both routers remains in INIT. What is the most likely cause of this issue?

A.The interface MTU size is mismatched.

B.The OSPF network type is mismatched.

C.The OSPF authentication keys do not match.

D.The router IDs are not properly configured.

AnswerC

When MD5 authentication keys differ, each router silently drops the other's Hello packets after the keyed digest fails verification. Because the local router never receives a valid Hello containing its own router ID, the neighbor state cannot advance from INIT to 2-Way. The adjacency therefore remains stuck in INIT, even though the Hello packets arrive at the interface, making this the misconfiguration exactly consistent with the symptoms.

Why this answer

OSPF authentication keys must match exactly for the adjacency to form. R1 uses key 'juniper123' while R2 uses 'juniper321', causing the MD5 digest computed on each Hello packet to differ. Since OSPF authentication is validated per-packet, mismatched keys prevent the routers from moving past the INIT state.

Exam trap

The trap here is that candidates often overlook authentication key consistency because they focus on matching hello/dead intervals and area IDs, assuming authentication is correctly configured if the type matches.

How to eliminate wrong answers

Option A is wrong because an MTU mismatch would typically cause the adjacency to stall in EXSTART/EXCHANGE state, not INIT, and both interfaces are Gigabit Ethernet with default MTU 1500. Option B is wrong because both interfaces use the default OSPF network type 'broadcast' (no explicit type set), so there is no mismatch. Option D is wrong because the router IDs (1.1.1.1 and 2.2.2.2) are valid and properly configured; mismatched router IDs do not prevent the INIT state, as OSPF uses router IDs only after the 2-Way state.

Full explanation →

32

MCQmedium

A junior engineer is troubleshooting connectivity issues and wants to trace the path packets take to a remote destination. Which Junos command should be used?

A.monitor traffic

B.show route

C.traceroute

D.ping

AnswerC

traceroute is the correct tool because it actively probes the network path by sending packets with incrementally increasing TTL values, then collects the ICMP TTL-exceeded messages sent back by each router in turn. This reveals the sequence of IP addresses of every hop along the route to the destination, along with round-trip times for each hop, thus mapping the actual forwarding path hop by hop.

Why this answer

The 'traceroute' command in Junos is specifically designed to trace the path packets take to a remote destination by sending UDP probes with increasing TTL values and analyzing ICMP Time Exceeded messages from intermediate routers. This directly addresses the junior engineer's need to map the Layer 3 path and identify where connectivity failures occur.

Exam trap

The trap here is that candidates often confuse 'ping' (which tests reachability) with 'traceroute' (which traces the path), leading them to select Option D when the question explicitly asks for path tracing rather than simple connectivity testing.

How to eliminate wrong answers

Option A is wrong because 'monitor traffic' is used for real-time packet capture and analysis on an interface, not for tracing the path to a remote destination. Option B is wrong because 'show route' displays the routing table entries on the local device, showing how the local router would forward packets, but it does not actively trace the path taken by packets across multiple hops. Option D is wrong because 'ping' tests reachability and measures round-trip time to a destination, but it does not provide hop-by-hop path information or identify intermediate routers.

Full explanation →

33

MCQhard

Scenario: Your company has a Juniper MX Series router at a branch office running Junos 18.4. The device has been in production for two years with a stable configuration. Yesterday, a senior engineer made several changes to the OSPF configuration to optimize routing for a new link. They committed the changes and left for the day. This morning, the branch office experiences intermittent connectivity, and the OSPF neighbor relationships are flapping. You suspect the recent OSPF changes caused the issue. You have remote console access to the router. The goal is to restore network stability as quickly as possible while preserving the ability to re-apply the changes after troubleshooting. Which course of action should you take?

A.Use 'deactivate protocols ospf' to disable OSPF entirely and then manually re-enable pieces.

B.Immediately delete the OSPF configuration sections that were changed and re-add the original settings manually.

C.Use 'rollback 1' to revert to the configuration before the changes, then 'commit confirmed 10' to verify stability.

D.Perform a 'load factory-default' and 'commit' to reset the device to base settings, then reconfigure from backup.

AnswerC

This is the correct approach because rollback 1 reverts the candidate configuration to the last committed configuration prior to the current one, which is exactly the stable state you want. Issuing commit confirmed 10 activates that configuration for 10 minutes; if nothing else is done, the system automatically rolls back to the previous config, ensuring connectivity is restored without a permanent lock-in. You can later issue commit (or commit confirmed again) to make the change permanent once you have verified OSPF stability.

Why this answer

'rollback 1' reverts the active configuration to the previous committed version (before the problematic OSPF changes), and 'commit confirmed 10' applies that rollback with a 10-minute confirmation timer. If connectivity stabilizes, the rollback becomes permanent; if not, the router automatically reverts to the previous configuration, ensuring no prolonged outage. This approach restores stability quickly while preserving the ability to later re-apply and test the OSPF changes in a controlled manner.

Exam trap

The trap here is that candidates may choose Option A (deactivate OSPF) thinking it is a quick fix, but they overlook that deactivating the entire protocol causes a complete routing disruption, whereas 'rollback' with 'commit confirmed' is the precise, safe, and reversible method Junos provides for this exact scenario.

How to eliminate wrong answers

Option A is wrong because 'deactivate protocols ospf' disables the entire OSPF process, which would drop all OSPF adjacencies and potentially cause a complete routing blackout, not just intermittent flapping, and it does not preserve the changed configuration for later re-application. Option B is wrong because manually deleting and re-adding configuration sections is error-prone, time-consuming, and does not leverage Junos's built-in rollback capability, which is the fastest and safest method to revert to a known-good state. Option D is wrong because 'load factory-default' resets the entire device to factory settings, wiping all configurations, including interfaces, security policies, and routing protocols, which would cause a total outage and require full reconfiguration from backup, far exceeding the goal of quickly restoring stability.

Full explanation →

34

MCQeasy

What is the primary function of the fxp0 interface on a Juniper device?

A.Internal routing

B.Management interface

C.Loopback testing

D.Data plane forwarding

AnswerB

fxp0 is specifically engineered as an out-of-band management interface, providing administrative access to the device via protocols like SSH, SNMP, and syslog. It is isolated from the data plane and much of the control plane, operating in its own management routing instance, so management connectivity remains available even when the network interfaces are down or the device is not forwarding traffic. This separation allows network operators to recover and configure a device remotely during outages, making fxp0 essential for lifecycle management.

Why this answer

The fxp0 interface is a dedicated out-of-band management Ethernet port on Juniper devices, used exclusively for management traffic such as SSH, SNMP, and syslog. It is separate from the data plane and control plane forwarding interfaces, ensuring administrative access remains available even if the routing or forwarding planes are disrupted.

Exam trap

The trap here is confusing fxp0 with loopback (lo0) or internal RE interfaces, leading candidates to incorrectly select internal routing or loopback testing, when in fact fxp0 is solely for out-of-band management.

How to eliminate wrong answers

Option A is wrong because internal routing between REs or between RE and PFE uses the internal fxp1 or fxp2 interfaces, not fxp0. Option C is wrong because loopback testing is performed on the lo0 interface, which provides a stable IP address for the router and is used for protocols like OSPF and BGP, not for management access. Option D is wrong because data plane forwarding is handled by network interfaces (e.g., ge-, xe-, et-) and the Packet Forwarding Engine (PFE), while fxp0 is strictly an out-of-band management interface that does not participate in forwarding transit traffic.

Full explanation →

35

MCQeasy

A network administrator is troubleshooting a missing route in the routing table. The route is learned via OSPF, and the OSPF neighbor adjacency is up. Which command would help determine if OSPF received the route?

A.show route protocol ospf

B.show ospf neighbor

C.show ospf database

D.show interface terse

AnswerC

The OSPF database command reveals the link-state advertisements (LSAs) stored in the router's OSPF LSDB, including Router, Network, and Summary LSAs that contain the actual prefix information. This is the authoritative source to verify whether a route's LSA has been received and is present in the network topology. If the prefix appears here but not in the routing table, the troubleshooting focus shifts to route selection or policy, making this the correct diagnostic step.

Why this answer

The OSPF link-state database (LSDB) contains all received LSAs, including Type 1 (Router) and Type 3 (Summary) LSAs that advertise routes. Even if a route is not installed in the routing table (e.g., due to a higher administrative distance or a missing route preference), the 'show ospf database' command confirms whether OSPF has received the LSA carrying that route. This directly answers the question of whether OSPF received the route, independent of route installation.

Exam trap

The trap here is that candidates often confuse 'show route protocol ospf' (which shows installed routes) with 'show ospf database' (which shows received LSAs), leading them to pick option A when the route is missing from the routing table but still present in the LSDB.

How to eliminate wrong answers

Option A is wrong because 'show route protocol ospf' displays only routes that are actually installed in the routing table, not all routes received by OSPF; a missing route in the routing table could be due to filtering or preference issues, and this command would not show it. Option B is wrong because 'show ospf neighbor' only verifies the adjacency state (e.g., Full) and does not reveal the contents of received LSAs or specific routes. Option D is wrong because 'show interface terse' shows interface status and configuration, not OSPF-specific route information or LSA details.

Full explanation →

36

MCQeasy

You are managing a Juniper MX240 router at a small ISP. The router has been operating normally for months. This morning, a customer reports intermittent packet loss on their connection, which is served by interface ge-0/0/2. You SSH into the router and run 'show interfaces ge-0/0/2 extensive'. The output shows input errors increasing rapidly, including CRC errors and frame errors. The interface is up/up. You also notice that the interface statistics show a high number of carrier transitions. The cable connecting the router to the customer's CPE was recently replaced by the customer's technician. What is the most likely cause of the errors and the correct action to resolve the issue?

A.Clear the MAC address table on the router to fix possible MAC flapping issues.

B.Administer a 'shutdown' and 'no shutdown' on the interface to reset the line protocol.

C.Replace the cable with a known good one because CRC and frame errors indicate a physical layer problem such as a damaged cable or loose connector.

D.Change the interface speed and duplex settings to auto-negotiate because the errors are due to a mismatch between the router and CPE.

AnswerC

CRC and frame errors indicate that frames are receiving an invalid FCS, which is a classic symptom of a physical-layer issue such as a damaged cable, loose connector, or excessive signal attenuation. The problem appeared after a recent cable change, which strongly implicates the new cable or its seating. Replacing that cable with a known-good one is the correct first step because it directly tests the most likely failure point, and a clean interface afterward confirms the diagnosis.

Why this answer

CRC and frame errors increasing rapidly, combined with a high number of carrier transitions, are classic symptoms of a physical-layer issue. Since the cable was recently replaced by the customer's technician, the most likely cause is a faulty cable or a loose connector. Replacing the cable with a known good one directly addresses the physical layer problem, which is the root cause of these errors.

Exam trap

The trap here is that candidates may confuse CRC/frame errors with a speed/duplex mismatch (Option D) or think a simple interface reset (Option B) will fix the problem, when the rapid increase in carrier transitions and the recent cable replacement clearly indicate a physical cabling fault.

How to eliminate wrong answers

Option A is wrong because MAC address table clearing addresses MAC flapping, which is a Layer 2 issue unrelated to CRC/frame errors or carrier transitions. Option B is wrong because administratively resetting the interface (shutdown/no shutdown) would only temporarily clear counters and restart the line protocol, but it would not fix the underlying physical-layer problem causing the errors. Option D is wrong because while speed/duplex mismatch can cause errors, the presence of carrier transitions and the recent cable replacement strongly point to a physical cabling issue, not a negotiation mismatch; auto-negotiation is already the default on modern Juniper interfaces and would not resolve a faulty cable.

Full explanation →

37

MCQhard

Refer to the exhibit. The OSPF neighbor adjacency repeatedly goes up and down on R1. What is a likely cause?

A.The physical link is flapping

B.MTU mismatch between the two routers

C.OSPF authentication is misconfigured

D.The routers are in different OSPF areas

AnswerB

MTU mismatch is the correct answer because OSPF uses Database Description (DBD) packets to exchange link-state summaries, and these packets can exceed the interface MTU. When a router receives a DBD packet larger than its configured MTU, it silently drops the packet, causing the neighbor to remain stuck or repeatedly restart the ExStart/Exchange process. The router that is the slave in the exchange will detect the mismatch via the MTU field in the DBD packet and cycle back to ExStart, which produces the repeated adjacency behavior shown in the exhibit.

Why this answer

An MTU mismatch between OSPF neighbors can cause the adjacency to flap because OSPF includes the interface MTU in the Database Description (DBD) packets. If the MTU values do not match, the receiving router will reject the DBD packet, preventing the exchange of LSAs and causing the neighbor state to reset. This is a common cause of repeated up/down OSPF adjacencies even when the physical link is stable.

Exam trap

The trap here is that candidates often assume physical link flapping (Option A) is the cause, but OSPF adjacency flapping can occur with a stable link due to Layer 3 mismatches like MTU, which is a subtle but classic JNCIA-JUNOS exam topic.

How to eliminate wrong answers

Option A is wrong because a physical link flapping would typically cause interface state changes and error counters to increment, but the question specifies the OSPF adjacency goes up and down while the physical link may remain stable; MTU mismatch can cause this without link flapping. Option C is wrong because if OSPF authentication were misconfigured, the adjacency would fail to form entirely or remain in a state like EXSTART/EXCHANGE, not repeatedly go up and down. Option D is wrong because OSPF routers in different areas cannot form a neighbor adjacency at all; they would remain stuck in the INIT or 2-WAY state, not repeatedly transition up and down.

Full explanation →

38

MCQhard

Refer to the exhibit. A security analyst sees repeated login failures from 10.0.0.2 for user1. Which Junos feature can be used to automatically block further login attempts from that IP?

A.Configure SSH to accept only public key authentication for user1.

B.Disable the user1 account.

C.Set the 'session-limit' for user1 to prevent multiple login attempts.

D.Apply a firewall filter to the loopback interface that polices SSH traffic.

AnswerD

Applying a firewall filter to the loopback interface (lo0.0) is the correct way to protect the Routing Engine's own SSH service. A policer attached to the filter term for SSH traffic can rate-limit the number of packets or bytes per burst; once the configured rate is exceeded, the policer drops subsequent packets from that traffic class, which causes TCP retransmissions and effectively stops further login attempts. For a true per-source limit, the policer should be configured with 'prefix-specific' so that a single attacking IP cannot consume the aggregate allowance and deny SSH to all operators.

Why this answer

Applying a firewall filter to the loopback interface (lo0) that polices SSH traffic can automatically block further login attempts from a specific IP address, such as 10.0.0.2. The loopback interface is the termination point for all control-plane traffic on a Junos device, including SSH sessions. By configuring a firewall filter with a policer that limits the rate of SSH packets from a source IP, excessive login failures can trigger the policer to drop subsequent packets, effectively blocking the attacker without manual intervention.

Exam trap

The trap here is that candidates often confuse control-plane policing (applied to lo0) with data-plane firewall filters applied to interfaces like ge-0/0/0, or mistakenly think that session limits or disabling accounts are automated responses to brute-force attacks.

How to eliminate wrong answers

Option A is wrong because configuring SSH to accept only public key authentication for user1 does not automatically block repeated login failures from 10.0.0.2; it only changes the authentication method, and failed public key attempts could still occur. Option B is wrong because disabling the user1 account is a manual, static action that does not automatically respond to repeated login failures from a specific IP; it also prevents legitimate access for that user. Option C is wrong because the 'session-limit' for user1 limits the number of concurrent sessions, not the rate of login attempts; it does not block repeated failed logins from a single IP address.

Full explanation →

39

MCQeasy

A junior network administrator is setting up a Juniper MX router for the first time. After powering on the device, the administrator notices that the LED on the front panel blinks amber and the device does not complete the boot process. The console displays messages reporting file system errors. The administrator has no previous configuration changes and the device was shipped with factory defaults. Which action should the administrator take to resolve the boot issue?

A.Boot into single-user mode and run file system checks.

B.Perform a password recovery procedure to gain access.

C.Use the 'request system software add' command from the boot loader.

D.Reinstall the Junos OS using a USB flash drive with the software image.

AnswerA

Entering single-user mode (e.g., by interrupting the boot process at the U-Boot loader and issuing `boot -s`) provides a maintenance shell before normal Junos processes start. From there, you can manually run filesystem consistency checks with `fsck` (or `check`) on the root and /var partitions. Repairing corrupted metadata in this mode is the standard first-line recovery step for a device that fails to boot cleanly, as it addresses the underlying filesystem errors without the risk of an immediate full reinstall.

Why this answer

The amber blinking LED and file system errors indicate a corrupted file system, which is common on factory-default devices if the flash memory was not properly initialized. Booting into single-user mode (option A) allows the administrator to run 'fsck' (file system check) to repair the root file system without loading the full Junos OS, which is the standard recovery procedure for such boot failures.

Exam trap

The trap here is that candidates may confuse a boot failure due to file system corruption with a password issue or a need to reinstall the OS, but the amber LED and file system error messages point directly to a corrupted file system that can be repaired with fsck in single-user mode.

How to eliminate wrong answers

Option B is wrong because password recovery is used to reset login credentials, not to repair file system corruption; the device cannot boot, so password recovery is irrelevant. Option C is wrong because 'request system software add' is a Junos CLI command that requires a fully booted system, not the boot loader; the boot loader does not support this command. Option D is wrong because reinstalling Junos OS from a USB is a more drastic step that should only be taken if file system checks fail; it is not the first-line action for file system errors on a factory-default device.

Full explanation →

40

MCQmedium

A technician needs to load a new configuration file that replaces only the specific hierarchy paths present in the file, leaving all other existing configuration unchanged. Which load statement is appropriate?

A.load replace

B.load set

C.load override

D.load merge

AnswerD

The 'load merge' command is the correct choice because it combines the contents of the configuration file with the current candidate configuration, adding or updating only the statements present in the file while leaving all other existing configuration untouched. It accepts both hierarchical configuration files and files containing 'set' commands, making it flexible for various file formats. This precisely matches the technician's need to load a new configuration file that applies changes without discarding existing settings.

Why this answer

The 'load merge' command is correct because it merges the contents of the specified configuration file with the current candidate configuration, adding or updating only the hierarchy paths present in the file while preserving all other existing configuration. This matches the requirement to replace only specific hierarchy paths without affecting the rest of the configuration.

Exam trap

The trap here is that candidates often confuse 'load merge' with 'load replace' or 'load override', mistakenly thinking 'replace' means partial replacement, when in fact 'replace' replaces the entire candidate configuration, while 'merge' is the correct command for targeted, non-destructive updates.

How to eliminate wrong answers

Option A is wrong because 'load replace' replaces the entire candidate configuration with the contents of the file, not just specific hierarchy paths. Option B is wrong because 'load set' is used to load a set of configuration commands (in 'set' format) and applies them sequentially, which can add or modify paths but does not inherently restrict changes to only the paths in the file—it can also delete or override if the set commands include 'delete' statements. Option C is wrong because 'load override' completely replaces the entire candidate configuration with the file, discarding all existing configuration.

Full explanation →

41

MCQmedium

A network administrator accidentally deleted a vital part of the configuration while in configuration mode. They need to revert to the previous configuration without losing recent changes that are correct. Which action should they take?

A.deactivate

B.rollback 1

C.delete

D.rollback 0

AnswerD

Rollback 0 resets the candidate configuration to match the current active committed configuration, discarding any uncommitted changes. Because the accidental deletion was never committed, this command reverts that deletion while leaving all previously committed correct changes intact. This is exactly the requirement: undo the uncommitted mistake without affecting the committed configuration. It is the standard way to abandon a set of uncommitted edits in Junos.

Why this answer

The 'rollback 0' command reverts the candidate configuration to the most recently committed configuration (the current active configuration), discarding any uncommitted changes. This allows the administrator to undo the accidental deletion without affecting any recently committed correct changes, as those are already part of the active configuration. Option B, 'rollback 1', would revert to the previous commit, which could remove recently committed correct changes if they were made in the most recent commit.

Therefore, 'rollback 0' is the safer choice when you want to preserve correct changes that have already been committed.

Exam trap

The trap is that candidates often confuse 'rollback 0' (reverts to current active config) with 'rollback 1' (reverts to previous config). While 'rollback 1' might seem like it goes back one step, it could discard recently committed changes. The correct approach to undo an uncommitted deletion while preserving committed correct changes is to use 'rollback 0'.

How to eliminate wrong answers

Option A is wrong because 'deactivate' disables a configuration statement without removing it, but it does not revert the configuration to a previous state; it only suppresses the active effect of the specified statement. Option C is wrong because 'delete' removes configuration statements from the candidate configuration, which would worsen the situation by further deleting parts of the configuration. Option D is wrong because 'rollback 0' reverts to the current active configuration (the one that was last committed), which would discard all uncommitted changes, including any correct recent modifications the administrator wants to keep.

Full explanation →

42

MCQeasy

A network engineer wants to quickly restore the device to a known good configuration after a failed change. What is the recommended approach?

A.Use the 'request system configuration rescue save' command.

B.Use the 'rollback 0' command.

C.Use the 'rollback rescue' command.

D.Use the 'load override terminal' command.

AnswerC

The 'rollback rescue' command loads the previously saved rescue configuration from the rescue area into the candidate configuration. This is the correct restore mechanism because it explicitly retrieves the snapshot created via 'request system configuration rescue save'. The command does not automatically commit the change; the engineer must still run 'commit' to apply the rescued configuration to the active Janos configuration.

Why this answer

The 'rollback rescue' command restores the device to the rescue configuration, which is a known good configuration saved explicitly for recovery after a failed change. The rescue configuration is stored as a separate file and is not affected by normal commit operations, making it the recommended approach for quick restoration.

Exam trap

The trap here is that candidates confuse 'rollback rescue' with 'rollback 0', mistakenly thinking the most recent committed configuration is always a safe fallback, but 'rollback 0' includes the failed change if it was committed, whereas 'rollback rescue' restores a deliberately saved known good state.

How to eliminate wrong answers

Option A is wrong because 'request system configuration rescue save' is used to save the current active configuration as the rescue configuration, not to restore it; it is a save action, not a restore action. Option B is wrong because 'rollback 0' reverts to the most recently committed configuration, which may include the failed change if it was committed; it does not guarantee a known good state. Option D is wrong because 'load override terminal' is used to load a configuration from terminal input, overwriting the candidate configuration; it is not a quick restore mechanism and requires manual entry or pasting of configuration data.

Full explanation →

43

MCQmedium

Refer to the exhibit. If the primary next-hop (192.168.1.1) becomes unreachable, what will happen to the route?

A.The route is removed from the routing table.

B.The route remains but with the primary next-hop marked as unreachable.

C.The secondary next-hop (192.168.2.1) will be used.

D.The route becomes hidden.

AnswerC

When the primary next-hop (192.168.1.1) becomes unreachable, Junos automatically selects the secondary next-hop (192.168.2.1) as the active forwarding next-hop because the secondary is configured as the fallback and is still valid. The route remains installed in the routing table and is forwarded via the secondary next-hop until the primary recovers and is preferred again.

Why this answer

In Junos, when a route has multiple next-hops configured (e.g., primary and secondary), the secondary next-hop serves as a backup. If the primary next-hop (192.168.1.1) becomes unreachable, Junos automatically fails over to the secondary next-hop (192.168.2.1) without removing the route from the routing table. This behavior is controlled by the 'next-hop' configuration under a static route or via routing protocol policies, ensuring continuous reachability.

Exam trap

The trap here is that candidates often assume a route is removed or hidden when a next-hop fails, but Junos maintains the route and uses the backup next-hop, unlike some other vendors that may withdraw the route entirely.

How to eliminate wrong answers

Option A is wrong because the route is not removed from the routing table; Junos retains the route and simply switches to the secondary next-hop when the primary is unreachable. Option B is wrong because the route does not remain with the primary next-hop marked as unreachable; instead, the primary next-hop is removed from the active forwarding path and the secondary next-hop is used. Option D is wrong because the route does not become hidden; hidden routes are typically those suppressed by routing policies or protocols (e.g., due to route summarization or BGP), not due to next-hop failure in a static route with a backup.

Full explanation →

44

MCQmedium

Refer to the exhibit. What is the purpose of the 'unit 0' statement?

A.Enables IPv6.

B.Sets the MTU.

C.Defines a physical interface.

D.Defines a logical interface.

AnswerD

The 'unit 0' statement in Junos defines a logical interface on a physical interface. Logical interfaces allow you to configure separate Layer 3 properties (IP addresses, protocol families, VLAN tags) on the same physical port. Unit 0 is the default logical unit for untagged traffic, and additional units (1, 2, ...) correspond to subinterfaces or VLAN-tagged logical interfaces.

Why this answer

In Junos, the 'unit 0' statement is used to define a logical interface (also known as a subinterface) under a physical interface. Every physical interface must have at least one logical unit, and unit 0 is the default logical interface that carries Layer 3 configuration such as IP addresses. This is fundamental to Junos architecture, where all protocol configurations are applied at the logical unit level, not the physical interface level.

Exam trap

The trap here is that candidates familiar with Cisco IOS might assume 'unit 0' is a physical interface or a default MTU setting, but in Junos, the unit number always defines a logical interface, and physical interfaces are configured separately without a unit keyword.

How to eliminate wrong answers

Option A is wrong because 'unit 0' does not enable IPv6; IPv6 is enabled by configuring a family inet6 address under the logical unit, not by the unit number itself. Option B is wrong because the MTU is set using the 'mtu' statement at the physical interface level (e.g., 'set interfaces ge-0/0/0 mtu 1500'), not by the 'unit 0' statement. Option C is wrong because a physical interface is defined by the interface name (e.g., ge-0/0/0), not by the 'unit' statement; 'unit 0' creates a logical subinterface on top of that physical interface.

Full explanation →

45

MCQmedium

A network administrator makes several changes to the configuration but decides to discard all uncommitted changes and start fresh. Which command should be used to revert the candidate configuration back to the current active configuration?

A.load override

B.rollback 0

C.commit check

D.rollback 1

AnswerB

rollback 0 discards all uncommitted changes and reloads the candidate configuration to exactly match the current committed (active) configuration. The index 0 always points to the most recent commit, so this operation cleans the candidate without altering the running configuration. Since the administrator simply wants to start fresh from the last committed state, rollback 0 is the precise command. Note that you still must issue a commit to make any further changes active, but no commit is required to just discard edits.

Why this answer

The 'rollback 0' command reverts the candidate configuration to the currently active configuration, discarding all uncommitted changes. This is because Junos maintains a rollback database of the last 50 committed configurations, with index 0 always representing the active configuration. Using 'rollback 0' effectively resets the candidate configuration to match the active one, allowing the administrator to start fresh without affecting the running system.

Exam trap

The trap here is that candidates often confuse 'rollback 0' with 'rollback 1', mistakenly thinking that 'rollback 1' discards uncommitted changes, when in fact 'rollback 1' reverts to the previous committed configuration, which would undo the last commit and potentially cause service disruption.

How to eliminate wrong answers

Option A is wrong because 'load override' replaces the entire candidate configuration with the contents of a specified file, not with the current active configuration; it does not discard uncommitted changes by reverting to the active config. Option C is wrong because 'commit check' validates the syntax and semantics of the candidate configuration without committing it, and does not discard any changes. Option D is wrong because 'rollback 1' reverts to the previous committed configuration (the one before the most recent commit), not to the current active configuration; this would discard the last committed changes, not just uncommitted ones.

Full explanation →

46

MCQmedium

A network is experiencing intermittent routing loops. The engineer discovers that routes are being redistributed from OSPF into BGP and then from BGP back into OSPF on different routers. What is the most effective way to prevent this?

A.Use a higher preference for BGP routes.

B.Configure route filters to prevent mutual redistribution.

C.Set a lower metric on OSPF routes.

D.Increase the OSPF cost on interfaces.

AnswerB

Configuring route filters is the correct fix because mutual redistribution loops occur when a route from protocol A is exported to protocol B, then re-imported into protocol A, creating a feedback cycle. Route filters can block this by matching on route tags, protocol origin, or prefix lists at the redistribution boundary, preventing a route from being re-advertised back into its source protocol. For example, tagging OSPF routes when redistributing into BGP and then filtering out that tag on the reverse redistribution breaks the loop.

Why this answer

Mutual redistribution between OSPF and BGP creates routing loops when routes are exported from OSPF into BGP on one router and then re-injected back into OSPF on another router. The most effective way to prevent this is to use route filters (e.g., prefix lists, route-maps, or policy-statement in Junos) to control which routes are redistributed, ensuring that routes learned from one protocol are not re-advertised back into the same protocol. This breaks the redistribution cycle without altering protocol preference or metrics.

Exam trap

The trap here is that candidates often think adjusting administrative distance or metrics can break redistribution loops, but only explicit route filtering (or tagging) prevents the cycle of mutual redistribution.

How to eliminate wrong answers

Option A is wrong because increasing the preference (administrative distance) of BGP routes would make BGP routes less preferred over OSPF routes, but it does not prevent the redistribution loop; the loop occurs due to re-injection of routes, not due to route selection. Option C is wrong because setting a lower metric on OSPF routes only influences OSPF path selection, not the redistribution process; it does not stop routes from being re-injected from BGP back into OSPF. Option D is wrong because increasing OSPF cost on interfaces affects OSPF link metric calculations and can change path selection, but it has no effect on redistribution policies or the prevention of mutual redistribution loops.

Full explanation →

47

MCQhard

A router receives two OSPF routes for 10.10.10.0/24: one intra-area with preference 10 and metric 1, and one external type 2 with preference 150 and metric 20. Which route is selected as active?

A.The external route because it is type 2

B.The intra-area route because it has a lower preference

C.The external route because it has a higher metric

D.The intra-area route because it has a lower metric

AnswerB

The intra-area route is the correct choice because Junos selects the route with the lowest preference value among all candidate routes for the same prefix. In this case, the intra-area OSPF route has a preference of 10, while the external OSPF route has a preference of 150; since 10 is lower than 150, the intra-area route is installed as active in the forwarding table. Preference is checked before metric—only when two routes share the same preference does the router compare metrics. Therefore, the lower preference of the intra-area route is the decisive factor, not the route type or metric.

Why this answer

B is correct because Junos uses route preference (administrative distance) as the primary tiebreaker when selecting the active route for a destination. The intra-area OSPF route has a default preference of 10, which is lower than the external type 2 route's preference of 150, so the intra-area route is installed into the routing table regardless of metric values.

Exam trap

The trap here is that candidates often focus on metric or route type (intra-area vs external) as the tiebreaker, but Junos strictly uses route preference first, and the large difference (10 vs 150) makes the intra-area route the clear winner regardless of metric values.

How to eliminate wrong answers

Option A is wrong because OSPF external type 2 routes do not have inherent priority over intra-area routes; route preference is the decisive factor, not route type. Option C is wrong because a higher metric does not make a route more preferred; in Junos, preference is evaluated before metric, and a higher metric is actually less desirable. Option D is wrong because while the intra-area route does have a lower metric, the primary reason it is selected is its lower preference (10 vs 150); metric is only considered if preferences are equal.

Full explanation →

48

Multi-Selecthard

Which THREE statements about the 'commit' command are correct?

Select 3 answers

A.The 'commit check' command validates the syntax of the candidate configuration.

B.The 'commit synchronize' command is used on a dual-RE system to commit on both REs.

C.The 'commit full' command activates the configuration without performing any validation.

D.The 'commit' command can only be issued when no other users are in configuration mode.

E.The 'commit confirmed 5' command will roll back the configuration after 5 minutes if not confirmed.

AnswersA, B, E

Correct.

Why this answer

The 'commit check' command validates the syntax and semantics of the candidate configuration without activating it. This allows an administrator to verify that the configuration is valid before committing, preventing potential errors from being applied to the active configuration.

Exam trap

The trap here is that candidates often confuse 'commit full' with a validation-skipping command, when in fact it performs a more thorough validation, and they may incorrectly assume that multiple users cannot commit simultaneously in Junos, unlike some other network operating systems.

Full explanation →

49

MCQhard

Refer to the exhibit. Why is the static route not active?

A.The static route has a high preference.

B.The outbound interface is not up.

C.The static route is not committed.

D.The next-hop address is not reachable in the routing table.

AnswerD

For a static route with a next-hop IP address, Junos performs recursive route resolution: it looks up that next-hop address in the routing table to find a valid, active route to that address. The command 'show route 10.10.10.1' returns no output, proving there is no route in the table to the next-hop. Without a route to the next-hop, the static route cannot be installed as active, even though it is present in the routing table as an eligible route. This is exactly why the route is inactive.

Why this answer

For a static route to be active in the JUNOS routing table, the next-hop address must be reachable via an active route in the routing table. If the next-hop is not reachable, the static route is considered invalid and will not be installed as active, even if the outbound interface is up and the configuration is committed.

Exam trap

The trap here is that candidates often assume a static route is always active once configured and committed, forgetting that JUNOS requires the next-hop to be reachable in the routing table for the route to be installed.

How to eliminate wrong answers

Option A is wrong because a high preference (i.e., a less preferred route) does not prevent a static route from being active; it only affects route selection among multiple routes to the same destination. Option B is wrong because the outbound interface being down would cause the route to be inactive, but the question specifically states the static route is not active due to the next-hop not being reachable, not the interface state. Option C is wrong because the static route must be committed to be considered for activation; if it were not committed, it would not appear in the configuration at all, but the exhibit shows the route is configured.

Full explanation →

50

MCQmedium

You are a network engineer at a company that operates a pair of Juniper SRX firewalls in an active/passive cluster (Chassis Cluster). The cluster has been running Junos 15.1X49-D100 for over a year. Management has mandated an upgrade to a newer version to address security vulnerabilities. You follow the recommended upgrade procedure and successfully upgrade the primary node (node0) first, then failover to make node0 the backup, and upgrade the new primary (node1). After the upgrade, both nodes have the same version and appear to be in the cluster, but you notice that the backup node (node0) is stuck in 'ineligible' state and does not synchronize configuration changes. What is the most likely cause?

A.The cluster control link is down or misconfigured on the backup node

B.The backup node has not been configured with 'commit synchronize'

C.The 'set chassis cluster reth-count' statement is missing on the backup node

D.The 'monitor interface' configuration is causing a mis-match between nodes

AnswerA

A node becomes ineligible when the cluster control link is not operational on that node, because the control link is the physical interface used to exchange heartbeat messages and cluster control traffic. If the control link is down, misconfigured (e.g., wrong interface name, VLAN mismatch, or disabled), or not connected, the node cannot participate in cluster state synchronization or failover, forcing it into the ineligible state. Even if the node is otherwise healthy and has all other cluster settings correct, the lack of a functioning control link alone is sufficient to prevent it from reaching eligible status.

Why this answer

The backup node being stuck in 'ineligible' state after a chassis cluster upgrade indicates that the cluster control link (control port) is not functioning correctly. In a Juniper SRX active/passive cluster, the control link is used for heartbeat and cluster state synchronization; if it is down or misconfigured on the backup node, the node cannot participate in the cluster election process and remains ineligible. This is a common issue after upgrades if the control link interfaces are not properly re-established or if the cable is faulty.

Exam trap

The trap here is that candidates often confuse 'ineligible' state with configuration synchronization issues, leading them to choose 'commit synchronize' or other configuration-related options, when the root cause is actually a physical or logical connectivity problem on the control link.

How to eliminate wrong answers

Option B is wrong because 'commit synchronize' is a configuration command that ensures changes are automatically synchronized from the primary to the backup node, but it does not affect the node's eligibility state; the backup node can still be eligible without it. Option C is wrong because the 'set chassis cluster reth-count' statement defines the number of redundant Ethernet interfaces and is required for cluster operation, but its absence would cause a different issue (e.g., reth interfaces not working), not specifically the backup node being stuck in 'ineligible' state. Option D is wrong because 'monitor interface' configuration is used for interface monitoring to trigger failover, and a mismatch between nodes would cause a different problem (e.g., false failovers), not the backup node being stuck in 'ineligible' state.

Full explanation →

51

MCQmedium

An engineer needs to apply a configuration change to the Junos device that must survive a reboot. Which configuration mode command should be used to save the changes?

A.commit

B.commit confirmed

C.commit synchronize

D.commit check

AnswerA

The 'commit' command permanently activates the candidate configuration by copying it into the active configuration and applying it to the routing and forwarding planes. It also writes the configuration to non-volatile storage (e.g., flash), ensuring it survives a reboot or power cycle. This is the standard, definitive way to make configuration changes persistent in Junos.

Why this answer

The 'commit' command is the standard way to apply a candidate configuration to the active configuration in Junos. When you issue 'commit', the changes are saved to the /config/juniper.conf.gz file, which is loaded upon reboot, ensuring the configuration survives a restart.

Exam trap

The trap here is that candidates may confuse 'commit' with 'commit confirmed', thinking the latter is required for persistence, but 'commit confirmed' is specifically designed for safe rollback during maintenance windows, not for permanent saves.

How to eliminate wrong answers

Option B is wrong because 'commit confirmed' temporarily activates the configuration but automatically rolls back to the previous configuration if not confirmed within the default 10-minute timeout, so it does not guarantee survival across a reboot unless explicitly confirmed. Option C is wrong because 'commit synchronize' is used in a chassis cluster to commit the configuration on both nodes simultaneously; it is not a general-purpose command for saving changes on a standalone device. Option D is wrong because 'commit check' only validates the syntax and semantics of the candidate configuration without applying or saving it, so no changes survive a reboot.

Full explanation →

52

MCQeasy

A network administrator is configuring a new subnet for servers that must not communicate with each other directly but must be able to reach a default gateway. Which type of route should be configured on the servers?

A.Host route for the gateway

B.Default route pointing to the gateway

C.Dynamic route via OSPF

D.Static route to each other server

AnswerB

A default route (0.0.0.0/0) is the least-specific route and matches all packets whose destination has no other matching entry in the routing table. In Junos, configuring a static default route with next-hop pointing to the gateway is the standard way to give a server off-subnet reachability. This is exactly what a default gateway does for a host.

Why this answer

A default route (0.0.0.0/0) pointing to the gateway is correct because it allows servers to reach any external destination (including the gateway) without requiring explicit routes to each other. Since the servers must not communicate directly, they should not have routes to each other's subnets; the default route ensures all non-local traffic is forwarded to the gateway, which can then enforce isolation policies.

Exam trap

The trap here is that candidates often confuse a default route with a host route, thinking a specific route to the gateway is sufficient, but a default route is required to reach all external destinations beyond the local subnet.

How to eliminate wrong answers

Option A is wrong because a host route for the gateway (e.g., a /32 route to the gateway's IP) would only allow the server to reach that single IP address, not any other external destinations; it does not provide a path to the default gateway for general traffic. Option C is wrong because dynamic routing via OSPF would require the servers to participate in OSPF, which is unnecessary and complex for simple hosts; OSPF is designed for routers, not end devices, and would introduce overhead and potential security risks. Option D is wrong because a static route to each other server would explicitly allow direct communication between servers, violating the requirement that they must not communicate with each other directly.

Full explanation →

53

MCQmedium

An engineer wants to roll back to the previous configuration. Which command should be used?

A.rollback 1

B.delete

C.rollback 0

D.commit check

AnswerA

The `rollback 1` command reloads the candidate configuration from the previous committed configuration (rollback ID 1), completely discarding any uncommitted changes currently staged in the candidate. This precisely achieves the engineer's goal of returning to the previous configuration, making it the correct command for this scenario.

Why this answer

The `rollback 1` command loads the previous committed configuration (the configuration before the last commit) into the candidate configuration, discarding any uncommitted changes. This allows the engineer to replace the current candidate with the desired historical configuration. In Junos, `rollback 0` loads the most recently committed configuration (the current active configuration), not the previous one.

Exam trap

Candidates often think that `rollback 0` is the previous configuration, but `rollback 0` actually loads the currently active configuration. `rollback 1` is the previous committed configuration.

How to eliminate wrong answers

Option B is wrong because `delete` removes configuration statements from the candidate configuration, not from the committed configuration, and it does not perform a rollback to a previous state. Option C is wrong because `rollback 0` reverts the candidate configuration to the currently active committed configuration, which would discard any uncommitted changes the engineer wants to keep. Option D is wrong because `commit check` only validates the syntax and semantics of the candidate configuration without committing it; it does not roll back to any previous configuration.

Full explanation →

54

Drag & Dropmedium

Order the steps to configure firewall filters (ACLs) in Junos.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Firewall filters are defined with terms (match conditions and actions) and applied to interfaces.

Full explanation →

55

Multi-Selectmedium

Which TWO commands can be used to monitor system log messages in real-time?

Select 1 answer

A.show log messages | last 100

B.show system log messages

C.show configuration system syslog

D.monitor start interactive-commands

E.monitor start messages

AnswersE

The 'monitor start messages' command displays new log messages in real-time as they are written to the /var/log/messages file.

Why this answer

The 'monitor start messages' command streams the contents of the /var/log/messages file in real-time, allowing you to monitor system log messages as they are generated. 'monitor start interactive-commands' (Option D) monitors logs specific to interactive CLI commands, not general system log messages, so it does not satisfy the stem. The other options ('show log messages | last 100', 'show system log messages', 'show configuration system syslog') either display historical data or configuration, not real-time system log monitoring.

Exam trap

The trap here is that candidates confuse static 'show log' commands (which display historical log data) with dynamic 'monitor start' commands (which provide real-time streaming), and may also mistakenly think 'show system log messages' is a valid command when it is not.

Full explanation →

56

MCQhard

In a dual Routing Engine (RE) setup, an engineer commits a configuration change that should be applied to both REs synchronously. What is the correct command to ensure both REs receive the same configuration immediately?

A.commit confirmed

B.commit check synchronize

C.commit and-quit

D.commit synchronize

AnswerD

This commits the candidate configuration to both Routing Engines in a single atomic operation, ensuring both have identical active configurations. It is the standard command for applying changes in a dual-RE chassis, and it is essential for maintaining consistency and enabling clean failover. The commit is performed on the local RE and the other RE simultaneously.

Why this answer

The 'commit synchronize' command commits the configuration on the master Routing Engine and then automatically copies and commits the same configuration to the backup RE, ensuring both REs have identical active configurations immediately. This is the standard Junos method for synchronizing configurations in a dual-RE chassis.

Exam trap

The trap here is that candidates confuse 'commit synchronize' with 'commit check' or 'commit confirmed', not realizing that only 'commit synchronize' explicitly pushes the configuration to the backup RE in a dual-RE setup.

How to eliminate wrong answers

Option A is wrong because 'commit confirmed' is used to automatically roll back a commit after a specified timeout if not confirmed, not for synchronizing configurations between REs. Option B is wrong because 'commit check synchronize' is not a valid Junos command; 'commit check' validates syntax but does not apply changes, and the 'synchronize' option is only valid with 'commit'. Option C is wrong because 'commit and-quit' is used in configuration mode to commit and exit, but it does not synchronize the configuration to the backup RE.

Full explanation →

57

MCQhard

A company has a Juniper MX router acting as a BGP route reflector. The router has two routing instances: 'internet' and 'management'. The 'internet' instance uses a firewall filter to block traffic to the router's loopback address from external sources. After a recent configuration change, the engineer notices that SSH access to the router's loopback IP (10.0.0.1) from the internal management network (192.168.0.0/16) is being dropped. The firewall filter for the loopback interface in the 'internet' instance is correctly configured to allow traffic from 192.168.0.0/16. The management instance has no firewall filter applied. The engineer suspects that the issue is related to how the routing instances interact with the loopback interface. Which of the following is the most likely cause and solution?

A.The management instance needs a firewall filter that allows SSH; add a filter to the management instance's loopback.

B.The firewall filter in the 'internet' instance incorrectly blocks SSH; modify the filter to allow SSH from any source.

C.The BGP configuration is causing the loopback to be unreachable; disable BGP on the management instance.

D.The firewall filter applied to the loopback interface is shared across all routing instances; use a separate interface for management traffic or apply the filter only to the 'internet' instance's logical system.

AnswerD

The loopback interface is shared; the filter affects all traffic to the loopback.

Why this answer

In Junos, firewall filters applied to the loopback interface (lo0) are shared across all routing instances by default because the loopback is a single physical interface. Even though the filter is configured in the 'internet' instance, it affects traffic destined to the loopback IP from any instance, including the 'management' instance. To isolate management traffic, you must either use a separate physical interface or apply the filter only to the 'internet' instance's logical system (e.g., using a firewall filter with a routing-instance match condition).

Exam trap

The trap here is that candidates assume firewall filters are instance-specific on the loopback interface, but Junos applies them globally by default, leading to the misconception that adding a filter to the management instance or modifying the existing filter will solve the problem.

How to eliminate wrong answers

Option A is wrong because the management instance has no firewall filter, and adding one would not resolve the issue—the problem is that the filter from the 'internet' instance is blocking traffic. Option B is wrong because the filter is correctly configured to allow SSH from 192.168.0.0/16; modifying it to allow SSH from any source would violate security policy and does not address the root cause of filter sharing. Option C is wrong because BGP configuration does not inherently cause the loopback to be unreachable; BGP is a routing protocol and does not affect firewall filter application on the loopback interface.

Full explanation →

58

MCQhard

A senior network administrator is logged into a Juniper device in operational mode. They need to make a configuration change to the BGP group 'INTERNAL'. They type 'configure terminal' and receive 'unknown command'. They then type 'configure' and enter configuration mode. They make the needed changes and exit configuration mode using 'exit'. They then try to view the active configuration to verify the changes by typing 'show configuration | match INTERNAL'. They see no output. What is the most likely reason?

A.The command 'show configuration' only shows the candidate configuration, not the active.

B.They exited configuration mode without committing, so the changes were lost.

C.They should have used 'commit' before exiting configuration mode.

D.They need to be in configuration mode to run 'show configuration'.

AnswerC

To make configuration changes take effect in Junos, you must execute 'commit' from configuration mode. The commit command copies the candidate configuration to the active configuration, activating the changes. If the administrator exits configuration mode without committing, the active configuration remains unchanged, which explains why the changes did not appear to take effect. Therefore, the correct action before exiting is to commit the candidate configuration.

Why this answer

In Junos, configuration changes made in configuration mode are stored in a candidate configuration until explicitly committed using the 'commit' command. Exiting configuration mode with 'exit' does not discard the candidate configuration; the changes remain in the candidate but are not part of the active configuration. The 'show configuration' command displays the active (committed) configuration, which explains why no output matching 'INTERNAL' was seen.

The administrator needed to use 'commit' to activate the changes before viewing them with 'show configuration'.

Exam trap

The trap here is that candidates familiar with other platforms may expect 'exit' to discard changes (as in some OS) or that 'show configuration' shows the candidate configuration. In Junos, the candidate persists after exit, but the active configuration is only updated upon 'commit'.

How to eliminate wrong answers

Option A is wrong because 'show configuration' in operational mode displays the active (committed) configuration, not the candidate configuration; the candidate configuration is viewed with 'show | compare' or by being in configuration mode. Option B is wrong because exiting configuration mode without committing does not automatically lose changes—the candidate configuration persists until explicitly discarded with 'rollback' or overridden, but the changes are not active until committed; however, the question states they exited and then ran 'show configuration', which shows the active config, so the changes were effectively not visible because they were never committed. Option D is wrong because 'show configuration' can be run from operational mode (it is a valid operational command) and does not require being in configuration mode.

Full explanation →

59

MCQhard

A route learned via BGP appears as 'hidden' in the routing table. Which condition is most likely the cause?

A.The BGP route has a higher AS path length than another route

B.The BGP route has been rejected by a policy

C.The BGP next-hop is unreachable

D.The BGP local preference is too high

AnswerC

For a BGP route to be active, its next-hop must be reachable via an existing route in the inet.0 routing table; if not, the BGP route is considered invalid and is placed in a hidden state. This is a fundamental BGP rule: the protocol relies on resolving next-hop addresses through IGP or static routes before installing the route. If the next-hop is unreachable, the route remains hidden in the BGP RIB and is not used for forwarding. This is the correct answer because it directly explains the hidden state.

Why this answer

In JUNOS, a BGP route is marked as 'hidden' in the routing table when the next-hop address is not reachable via any active route in the inet.0 table. This is a fundamental BGP path selection prerequisite: the next-hop must be resolvable (typically via an IGP or static route) for the route to be considered active and installed.

Exam trap

The trap here is that candidates often confuse 'hidden' with 'rejected by policy' or 'less preferred by AS path', but JUNOS specifically uses 'hidden' to indicate a next-hop unreachability issue, not a policy or selection problem.

How to eliminate wrong answers

Option A is wrong because a higher AS path length would make the route less preferred in BGP path selection, but it would not cause the route to be hidden; it would simply be outcompeted by a better path. Option B is wrong because if a BGP route is rejected by a policy, it typically does not appear in the routing table at all (or is marked as 'rejected'), not as 'hidden'. Option D is wrong because a high local preference makes a route more preferred, not hidden; local preference is a path attribute used in selection, not a condition that causes a route to be hidden.

Full explanation →

60

MCQeasy

An administrator is asked to check the system log files for any error messages related to interface failures. Which command would be most efficient?

A.monitor start messages | match "error"

B.show log file messages | match "error"

C.show log messages

D.show system syslog messages

AnswerC

show log messages — This is the correct operational command to display the contents of the default system log file /var/log/messages. It shows all messages stored in that file, providing the administrator with the historical log data needed. While it outputs everything without a match filter, it is the only valid command among the options that actually works for viewing existing log entries. Additional filtering could be applied with a pipe, e.g., 'show log messages | match error', but the base command is sufficient.

Why this answer

'show log messages' is the standard JUNOS command to display the contents of the /var/log/messages file. While it does not include a filter, it is the only valid command among the options that allows the administrator to view existing system log messages. The other options are either invalid commands (B and D) or used for real-time monitoring (A), which is not efficient for checking historical log files.

Exam trap

The trap here is that candidates may confuse 'monitor start messages' with 'show log messages', thinking the real-time monitor is more efficient for checking logs, but the question asks for checking existing log files, not monitoring live events.

How to eliminate wrong answers

Option A is wrong because 'monitor start messages' is a real-time monitoring command that continuously streams new log entries to the terminal, not a static search of existing log files; it would require the administrator to wait for errors to occur and does not efficiently check historical logs. Option C is wrong because 'show log messages' displays the entire contents of the messages log file without any filtering, which is inefficient for finding specific error messages related to interface failures, especially on a busy system with many log entries. Option D is wrong because 'show system syslog messages' is not a valid JUNOS command; the correct command to view syslog configuration is 'show configuration system syslog', but this does not display log file contents or error messages.

Full explanation →

61

MCQhard

Your company runs a Juniper MX480 router as the core gateway. The router has been experiencing intermittent connectivity issues with a remote site over a point-to-point OC3 link. Users report that the link goes down for a few seconds several times a day. You suspect that the issue might be related to physical layer errors or framing. You need to determine the cause and collect relevant data to present to the service provider. Which course of action should you take first?

A.Run 'monitor interface so-0/0/0' and observe for any CRC errors or alarms over a period of time.

B.Perform a loopback test on the interface using 'test interface so-0/0/0'.

C.Review the system syslog file using 'show log messages' and search for interface down messages.

D.Immediately replace the serial interface card to rule out hardware failure.

AnswerA

This command provides a continuous real-time view of interface statistics and alarms, allowing you to observe transient physical-layer errors such as CRC errors, framing errors, or loss of signal that might occur intermittently. By watching the output over time, you can correlate error bursts with specific conditions (e.g., nearby equipment, cable movement) without disrupting traffic. It directly confirms the health of the physical layer before moving to more invasive testing or hardware replacement.

Why this answer

'monitor interface so-0/0/0' provides real-time, continuous display of interface counters and alarms, allowing you to observe CRC errors, framing errors, or alarms (e.g., LOS, LOF) as they occur. This is the most direct way to capture transient physical-layer issues on a SONET/SDH OC3 link without disrupting service, making it the appropriate first step before escalating to the service provider.

Exam trap

The trap here is that candidates may choose the loopback test (Option B) because it is a classic troubleshooting tool, but they overlook that it is an intrusive, out-of-service test that should follow passive monitoring to avoid unnecessary downtime.

How to eliminate wrong answers

Option B is wrong because performing a loopback test ('test interface so-0/0/0') would disrupt live traffic and is typically used for out-of-service troubleshooting after initial data collection, not as a first step. Option C is wrong because reviewing the system syslog ('show log messages') may show interface down messages but lacks the granularity to capture brief, intermittent physical-layer errors like CRC or framing alarms that occur over seconds. Option D is wrong because immediately replacing the serial interface card is a premature and invasive action that should only be taken after diagnostic data (e.g., from monitoring or loopback tests) confirms a hardware fault.

Full explanation →

62

MCQmedium

Your Juniper router is running OSPF with multiple neighbors. You have a prefix 10.10.10.0/24 that is being learned via OSPF from two different routers: Router A with metric 30 and Router B with metric 20. The OSPF route from Router B is active. You want to ensure that traffic to 10.10.10.0/24 uses the path through Router A instead, even though it has a higher metric. You cannot change the OSPF metric on Router A. Which action should you take?

A.Use a routing policy to increase the preference of the OSPF route from Router B.

B.Increase the metric on Router B for that prefix.

C.Use a routing policy to reject the OSPF route from Router A.

D.Configure a static route to 10.10.10.0/24 pointing to Router A.

AnswerA

Using a routing policy to increase the preference of the OSPF route from Router B makes that route less desirable in the Junos routing table. Since Junos selects the route with the lowest preference value, raising Router B's preference (say, from the default 10 to 15) leaves Router A's default OSPF route as the active path. This allows you to influence the active route selection centrally on the local router without changing OSPF metrics or filtering prefixes.

Why this answer

In JUNOS, route preference (administrative distance) determines which route is installed in the routing table when multiple protocols or sources provide the same prefix. By default, OSPF internal routes have a preference of 10. You can use a routing policy to increase the preference of the OSPF route from Router B (making it less preferred), which will cause the route from Router A (with its default preference of 10) to become active, even though its metric is higher.

This approach does not require changing the OSPF metric or removing the route from Router A.

Exam trap

The trap here is that candidates often confuse metric (cost) with preference (administrative distance) and think they must change the metric or reject routes, when in fact JUNOS allows preference manipulation via routing policies to influence route selection without altering the OSPF metric.

How to eliminate wrong answers

Option B is wrong because increasing the metric on Router B for that prefix would make the route from Router B even less attractive, but the goal is to prefer Router A; increasing Router B's metric would not help and might break other routing decisions. Option C is wrong because rejecting the OSPF route from Router A would remove the route entirely, but the question states the route from Router A is already not active; rejecting it would not make it active. Option D is wrong because configuring a static route to 10.10.10.0/24 pointing to Router A would install a static route with a default preference of 5, which is lower than OSPF's 10, making it active; however, this is not the best practice and does not leverage OSPF's dynamic capabilities, and the question asks for an action related to OSPF routes, not a static override.

Full explanation →

63

Multi-Selectmedium

Which two statements about static routes in Junos OS are correct?

Select 3 answers

A.A static route with a next-hop of 127.0.0.1 is an unreachable route.

B.Static routes have a default preference of 5.

C.A static route configured with a next-hop of an interface name (e.g., ge-0/0/0) uses Address Resolution Protocol (ARP) to resolve the next-hop MAC address.

D.A static route with a next-hop of 0.0.0.0 is a discard route.

E.Static routes can have a preference value of 0.

AnswersB, C, D

Correct. Static routes in Junos OS have a default preference of 5.

Why this answer

Static routes have a default preference of 5 in Junos OS. Option C is correct: when a static route uses an interface as the next-hop (e.g., ge-0/0/0), the router uses ARP to resolve the MAC address of the next-hop device. Option D is correct: a static route with a next-hop of 0.0.0.0 is a discard route that silently drops packets.

Option A is incorrect: a static route with a next-hop of 127.0.0.1 creates a reject route (sends ICMP unreachable), not an unreachable route. Option E is incorrect: static routes cannot have a preference value of 0 because preference 0 is reserved for directly connected routes.

Full explanation →

64

Multi-Selectmedium

Which two commands can be used to monitor real-time interface statistics and errors on a Junos device?

Select 2 answers

A.show interfaces terse

B.show interfaces ge-0/0/0

C.show interfaces extensive ge-0/0/0 | refresh 1

D.monitor interface ge-0/0/0

E.monitor security log

AnswersC, D

With the refresh pipe option, it provides continuous updates of extensive interface statistics.

Why this answer

The 'show interfaces extensive ge-0/0/0 | refresh 1' command displays detailed interface statistics and errors, and the 'refresh 1' pipe modifier automatically updates the output every second, enabling real-time monitoring. Option D is correct because the 'monitor interface ge-0/0/0' command is specifically designed for real-time monitoring of interface counters and errors, refreshing the display at a default interval of 1 second. Both commands provide live views of interface statistics such as input/output packets, errors, drops, and CRC errors.

Exam trap

The trap here is that candidates often confuse static 'show interfaces' commands (which provide a point-in-time snapshot) with real-time monitoring commands, leading them to select option B instead of the correct real-time options C and D.

Full explanation →

65

MCQeasy

Which Junos CLI mode allows a user to view the configuration and execute operational commands, but not make configuration changes?

A.Operational mode

B.Monitor mode

C.Enable mode

D.Configuration mode

AnswerA

Operational mode, indicated by the `>` prompt, is the default Junos CLI mode. It allows users to run `show` commands, including `show configuration` and its variants, to view the active configuration without making any changes. This mode is sufficient for viewing; entering configuration mode is unnecessary for read-only access.

Why this answer

In Junos OS, Operational mode (indicated by the `>` prompt) allows users to execute operational commands (e.g., `show`, `ping`, `traceroute`) and view the active configuration using `show configuration`, but it does not permit any changes to the configuration. Configuration changes require entering Configuration mode (indicated by the `#` prompt) via the `configure` command. This separation enforces a strict two-tier access model, ensuring that operational tasks do not inadvertently alter the device's configuration.

Exam trap

The trap here is that candidates familiar with Cisco IOS may confuse 'Enable mode' (which grants configuration privileges in Cisco) with Junos's Operational mode, not realizing that Junos uses a completely different two-tier model where Operational mode is read-only and Configuration mode is required for any changes.

How to eliminate wrong answers

Option B (Monitor mode) is wrong because Junos does not have a 'Monitor mode'; this term is a distractor that might be confused with Cisco's monitor mode for software upgrades or with the `monitor` operational command used for real-time interface traffic viewing. Option C (Enable mode) is wrong because 'Enable mode' is a Cisco IOS concept that provides privileged access for configuration changes; Junos uses a different paradigm with distinct Operational and Configuration modes. Option D (Configuration mode) is wrong because this mode (indicated by the `#` prompt) is specifically designed for making configuration changes, not for viewing the configuration or executing operational commands without the ability to modify settings.

Full explanation →

66

MCQhard

A network engineer is troubleshooting OSPF adjacencies between two Juniper routers. The routers are directly connected and have matching OSPF configurations except for the router IDs. Router A has router-id 10.0.0.1, Router B has router-id 10.0.0.2. The adjacency remains in the EXSTART state. What is the most likely cause?

A.The MTU on the interface is mismatched.

B.The router IDs are not the same.

C.The area ID is not configured.

D.The hello and dead intervals are mismatched.

AnswerA

An MTU mismatch is a classic cause of OSPF adjacency being stuck in the EXSTART state. During the Database Description (DD) packet exchange, OSPF embeds the interface MTU in the DD header. If one interface has a larger MTU and sends a DD packet that exceeds the neighbor's MTU, the receiving router will drop the packet. Since the neighbor never receives the DD packet, the routers cannot complete the master/slave negotiation, and the adjacency remains permanently in EXSTART rather than progressing to FULL.

Why this answer

The EXSTART state indicates that the routers have progressed past the 2-Way state and are attempting to exchange Database Description (DBD) packets. A common cause for getting stuck in EXSTART is an MTU mismatch, because OSPF uses the interface MTU to determine the maximum size of DBD packets. If Router A's MTU is larger than Router B's, Router B will drop the oversized DBD packet and the adjacency will remain in EXSTART.

Exam trap

The trap here is that candidates often assume mismatched hello/dead intervals are the cause of any adjacency problem, but those issues manifest earlier (at the 2-Way state), while EXSTART specifically points to MTU or DBD packet exchange problems.

How to eliminate wrong answers

Option B is wrong because OSPF requires router IDs to be unique within an OSPF domain; having different router IDs (10.0.0.1 and 10.0.0.2) is correct and does not prevent adjacency formation. Option C is wrong because if the area ID were not configured, the routers would not even reach the EXSTART state; they would fail at the 2-Way or Init state due to mismatched area IDs in Hello packets. Option D is wrong because mismatched hello/dead intervals would cause the adjacency to stall at the 2-Way state (or prevent reaching 2-Way), not at EXSTART, as these parameters are checked in Hello packets before neighbor state progression.

Full explanation →

67

MCQeasy

A network engineer needs to make a change to a Junos device and ensure the change can be reverted if it causes issues. Which feature should be used?

A.configure exclusive

B.commit confirmed

C.commit check

D.rollback 0

AnswerB

The `commit confirmed` operation commits the candidate configuration and starts a rollback timer (default 10 minutes, up to 285 minutes with `commit confirmed <minutes>`). If the engineer does not issue a confirming `commit` or `commit confirm` before the timer expires, Junos automatically reverts to the previous active configuration. This provides a safety net for testing break-fix changes, making it the correct answer.

Why this answer

The `commit confirmed` command allows an engineer to commit a configuration change with a timer (default 10 minutes). If the change causes issues and the engineer does not confirm the commit within the timer, the device automatically reverts to the previous active configuration. This provides a safety net to revert changes without manual intervention.

Exam trap

The trap here is that candidates may confuse `commit confirmed` with `rollback 0`, thinking both revert changes, but `rollback 0` is a manual step that does not provide automatic, time-based reversion.

How to eliminate wrong answers

Option A is wrong because `configure exclusive` locks the candidate configuration to a single user, preventing others from making changes, but it does not provide any automatic rollback mechanism if the change causes issues. Option C is wrong because `commit check` validates the syntax and semantics of the candidate configuration without committing it; it does not revert a change after it has been applied. Option D is wrong because `rollback 0` reverts to the most recently committed configuration, but this is a manual action and does not provide an automatic, time-based revert if the change causes issues.

Full explanation →

68

MCQhard

You are a junior network engineer at a company that uses Juniper MX routers. You are troubleshooting a connectivity issue on a branch router. The branch router has two upstream links to the corporate network: ge-0/0/0 (10.1.1.1/30, connected to core router A) and ge-0/0/1 (10.1.1.5/30, connected to core router B). The branch router runs OSPF and has a default route learned from both upstream routers. The routing table shows two equal-cost default routes via both next hops. However, traffic from the branch to the corporate network is experiencing intermittent high latency and some packet loss. You suspect that asymmetric routing is causing issues because the return traffic is not following the same path. You want to influence the router to prefer one upstream link for all traffic to the corporate network. You have decided to adjust the OSPF metric on the branch router to make the link to core router A more preferred. You are in configuration mode on the branch router. Which single configuration change will accomplish this goal?

A.set interfaces ge-0/0/1 unit 0 family inet cost 200

B.set protocols ospf area 0 interface ge-0/0/1 passive

C.set protocols ospf area 0 interface ge-0/0/1 metric 200

D.set interfaces lo0 unit 0 family inet address 10.0.0.1/32 metric 100

AnswerC

This is the correct configuration because in JUNOS, OSPF interface metric is explicitly set with the `metric` statement under `protocols ospf` for the specific interface. By assigning a metric of 200 to ge-0/0/1, the router's OSPF cost calculation makes that interface significantly more expensive than ge-0/0/0 (which retains the default metric, typically 10 for Ethernet), thereby forcing transit traffic to prefer ge-0/0/0. This effectively shifts traffic away from ge-0/0/1 while still allowing the OSPF adjacency to remain established, so the link stays available for redundancy or less-preferred use.

Why this answer

Setting the OSPF metric on interface ge-0/0/1 to a higher value (200) increases the cost of that link, making the default route via ge-0/0/0 (which retains the default OSPF metric of 1 on a Gigabit Ethernet interface) more preferred. This influences the branch router to use the lower-cost path through core router A for all traffic to the corporate network, resolving asymmetric routing issues.

Exam trap

The trap here is that candidates often confuse the 'metric' configuration under the OSPF protocol hierarchy with the 'cost' parameter under interfaces, or mistakenly think that making an interface passive or adjusting loopback metrics will influence OSPF path selection.

How to eliminate wrong answers

Option A is wrong because the 'cost' parameter is not a valid configuration statement under 'set interfaces'; OSPF cost is configured under the OSPF protocol hierarchy, not directly on the interface. Option B is wrong because setting the interface to 'passive' prevents OSPF from sending or receiving hello packets on that interface, which would break OSPF adjacency entirely, rather than simply adjusting path preference. Option D is wrong because the 'metric' statement under the loopback interface is used for static routes or other protocols, not for OSPF interface cost; OSPF uses a cost value derived from interface bandwidth or explicitly set under 'protocols ospf'.

Full explanation →

69

MCQeasy

A router has a directly connected route to 10.10.10.0/24 on interface ge-0/0/0.0, a static route to the same prefix with next-hop 192.168.1.1, and an OSPF route to the same prefix. Which route is active in the routing table?

A.The static route

B.No route is active due to multiple routes

C.The OSPF route

D.The directly connected route

AnswerD

Direct routes have preference 0, which is the lowest possible, so they are always preferred.

Why this answer

In Junos, the routing table (inet.0) selects the active route based on the route preference (administrative distance). Directly connected routes have a default preference of 0, which is the lowest possible value, making them preferred over static routes (default preference 5) and OSPF routes (preference 10 for intra-area, 150 for external). Therefore, the directly connected route to 10.10.10.0/24 on ge-0/0/0.0 is active.

Exam trap

The trap here is that candidates familiar with Cisco IOS might assume static routes (AD 1) are preferred over OSPF (AD 110) but forget that directly connected routes (AD 0) always take precedence, or they might think multiple routes cause a tie or require load-balancing, which is incorrect for a single active route selection.

How to eliminate wrong answers

Option A is wrong because static routes have a default preference of 5 in Junos, which is higher than the directly connected route's preference of 0, so the static route is not selected. Option B is wrong because Junos does not deactivate all routes when multiple routes exist; it selects the route with the lowest preference, and only one route is active per prefix unless load-balancing is configured. Option C is wrong because OSPF routes have a preference of 10 (intra-area) or higher, which is greater than 0, so they are not preferred over the directly connected route.

Full explanation →

70

Multi-Selecteasy

Which TWO statements about route preferences in Junos are correct?

Select 2 answers

A.The preference of a route cannot be changed.

B.Direct routes have a default preference of 0.

C.OSPF internal routes have a default preference of 10.

D.Static routes have a default preference of 10.

E.BGP routes have a default preference of 200.

AnswersB, C

Direct routes, representing directly connected networks via active interfaces, are automatically assigned a default preference of 0 in Junos. This exceptionally low preference value ensures they are always the most preferred route source, taking precedence over all other route types like static, OSPF, or BGP routes. This mechanism is fundamental to Junos's routing logic, satisfying the question's requirement for a correct statement about route preferences.

Why this answer

In Junos, direct (connected) routes have a default route preference of 0, which is the highest possible preference, ensuring they are always preferred over other route types for directly attached networks. Option C is correct because OSPF internal routes (both intra-area and inter-area) have a default preference of 10 in Junos, which is lower than most other dynamic routing protocols, making OSPF routes more preferred by default.

Exam trap

The trap here is that candidates often confuse Junos default preference values with Cisco IOS administrative distance values, particularly for BGP (170 in Junos vs. 200 in Cisco) and static routes (5 in Junos vs. 1 in Cisco), leading them to select incorrect options based on Cisco knowledge.

Full explanation →

71

MCQhard

An engineer needs to check if the device has any pending changes that have not been committed. Which operational command should they run?

A.show system configuration

B.show system rollback

C.show configuration | compare

D.show system commit

AnswerC

Shows uncommitted configuration differences.

Why this answer

The 'show configuration | compare' command displays the differences between the candidate configuration (changes made but not yet committed) and the active configuration. This allows the engineer to see any pending changes that have not been committed, which is exactly what the question asks.

Exam trap

The trap here is that candidates often confuse 'show system commit' (which shows commit history) with showing pending changes, or they think 'show configuration' alone shows uncommitted changes, but without the '| compare' pipe it only shows the active configuration.

How to eliminate wrong answers

Option A is wrong because 'show system configuration' is not a valid Junos operational command; the correct command to view the active configuration is 'show configuration'. Option B is wrong because 'show system rollback' displays a list of previous committed configurations (rollback snapshots), not pending uncommitted changes. Option D is wrong because 'show system commit' shows the commit history (log of past commits), not any uncommitted changes in the candidate configuration.

Full explanation →

72

MCQhard

During a network traffic storm, a Juniper EX switch's CPU utilization spikes to 100%. Which command would best help identify the cause?

A.monitor traffic interface ge-0/0/0

B.show spanning-tree bridge

C.show ethernet-switching table

D.show interfaces extensive ge-0/0/0

AnswerA

`monitor traffic interface ge-0/0/0` runs a real-time packet capture on the specified interface, displaying packet headers so you can see broadcast, multicast, or unknown-unicast traffic flooding the switch. This is the key diagnostic during a storm because it lets you identify the source MAC/IP and the packet type that is overwhelming the CPU. It captures traffic as it arrives, giving immediate evidence for where the storm originates.

Why this answer

The 'monitor traffic interface' command captures live packet headers on the specified interface, allowing you to see the type and source of traffic causing the CPU spike. During a traffic storm (e.g., broadcast storm), this command reveals excessive broadcast, multicast, or unknown unicast frames, which are typically the root cause of high CPU utilization on Juniper EX switches.

Exam trap

The trap here is that candidates often confuse 'show interfaces extensive' (which shows error counters like CRC errors or giants) with the ability to see live traffic, but it only provides historical statistics, not the packet-level detail needed to pinpoint the storm's source.

How to eliminate wrong answers

Option B is wrong because 'show spanning-tree bridge' displays STP bridge parameters and port roles, which help diagnose Layer 2 loops but not the specific traffic types or sources causing a CPU storm. Option C is wrong because 'show ethernet-switching table' shows MAC address entries and their associated interfaces, which is useful for verifying forwarding tables but does not reveal real-time traffic patterns or packet contents. Option D is wrong because 'show interfaces extensive' provides detailed interface statistics and errors, but it does not capture live packet data; it only shows counters and historical data, not the actual traffic causing the CPU spike.

Full explanation →

73

Multi-Selectmedium

Which TWO commands can be used to view the current running configuration?

Select 2 answers

A.show configuration | display inheritance

B.show configuration | display set

C.show configuration | match

D.show configuration

E.show configuration | compare

AnswersB, D

Displays the configuration as a series of set commands.

Why this answer

The 'show configuration | display set' command outputs the current active configuration in 'set' format, which is a flat, line-by-line representation of configuration statements. Option D is correct because 'show configuration' without any pipe modifier displays the entire running configuration in its native hierarchical format. Both commands allow you to view the current running configuration, just in different presentation styles.

Exam trap

The trap here is that candidates confuse pipe modifiers like 'display inheritance' or 'compare' as valid ways to view the current configuration, when in fact they either add inherited data or compare revisions, not display the running config as-is.

Full explanation →

74

MCQmedium

A network engineer is troubleshooting connectivity between two directly connected Juniper routers. The interface on Router A shows 'up' but no packets are being received from Router B. Which command should the engineer use on Router A to check if the interface is expecting to receive a specific encapsulation type?

A.show interfaces extensive

B.show interfaces terse

C.show configuration interfaces

D.monitor traffic interface

AnswerA

The 'show interfaces extensive' command is essential because it reveals the actual data-link encapsulation currently in use on the interface, along with detailed physical and protocol state information. This allows the engineer to confirm whether both routers are configured with matching encapsulation types (e.g., PPP, HDLC, or Frame Relay). It also provides error counters and keepalive statistics, which can expose framing mismatches or negotiation failures. Without this operational view, a layer-1 connectivity issue could be mistakenly attributed to configuration when the real cause is an encapsulation mismatch.

Why this answer

The 'show interfaces extensive' command displays detailed interface information, including the encapsulation type configured on the interface. If Router A expects a specific encapsulation (e.g., PPP, HDLC, or Ethernet) that does not match what Router B is sending, the interface will show 'up' but will not receive packets. This command allows the engineer to verify the configured encapsulation type.

Option B is incorrect because 'show interfaces terse' provides a concise summary (name, status, protocol, and address) but does not include encapsulation details.

Exam trap

Candidates often assume 'show interfaces terse' includes encapsulation details, but it only provides a quick summary. The 'extensive' option is needed for encapsulation type.

How to eliminate wrong answers

Option A is wrong because 'show interfaces extensive' provides detailed interface statistics and error counters but does not explicitly highlight the encapsulation type in a concise manner; it is more useful for deep packet-level troubleshooting rather than checking encapsulation expectations. Option C is wrong because 'show configuration interfaces' displays the configuration stanza for interfaces, which includes encapsulation settings, but it shows the intended configuration rather than the operational state; the interface could be 'up' with a mismatched encapsulation if the configuration was committed incorrectly or if the peer is misconfigured. Option D is wrong because 'monitor traffic interface' captures live packet headers on the interface, which can help identify encapsulation mismatches by showing malformed frames, but it is a real-time diagnostic tool that does not directly display the configured encapsulation type; it is more appropriate for advanced troubleshooting after verifying the configuration.

Full explanation →

75

MCQeasy

A company wants to implement best practice for password recovery on Juniper devices to avoid service disruption. Which of the following is the recommended method?

A.Perform a factory reset to default configuration

B.Boot the device into single-user mode from the console and reset the root password

C.Use SNMP to modify the password field in the configuration

D.Contact JTAC to remotely reset the password

AnswerB

This is the standard Juniper password recovery procedure, allowing password reset without affecting configuration.

Why this answer

Booting the device into single-user mode from the console is the standard, secure method for password recovery on Juniper devices. This process allows an administrator with physical console access to reset the root password without affecting the running configuration or causing service disruption, as the device boots with a minimal kernel and does not load the full configuration.

Exam trap

The trap here is that candidates may confuse Juniper's single-user mode recovery with Cisco's password recovery process, which often involves a configuration register change and may require a factory reset; Juniper's method is designed to preserve the configuration, while Cisco's recovery can sometimes erase the startup configuration if not done carefully.

How to eliminate wrong answers

Option A is wrong because performing a factory reset to default configuration erases all configuration data, causing complete service disruption and loss of custom settings, which is not a best practice for password recovery. Option C is wrong because SNMP is a monitoring and management protocol that does not provide a mechanism to modify password fields in the Junos configuration; it is read-only for security purposes and cannot be used for password changes. Option D is wrong because contacting JTAC to remotely reset the password is not a standard or recommended procedure; JTAC does not have direct access to reset passwords, and this would require a support contract and potentially cause delays, not to mention that remote password reset is not a supported feature.

Full explanation →

Page 1 of 3

All pages

Practice JN0-106 by domain

Target a specific domain to shore up weak areas.

User Interfaces Junos Configuration Basics Operational Monitoring and Maintenance Routing Fundamentals Networking Fundamentals Junos OS Fundamentals

See all domains with question counts →