Courseiva

Juniper Networks Certified Associate Junos JNCIA-Junos (JN0-106) — Questions 76–150

156 questions total · 3pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 3

Page 3
76
MCQeasy

Refer to the exhibit. A frame with destination MAC 00:0c:29:2a:3b:4d arrives on interface ge-0/0/0. What action will the switch take?

A.Flood the frame to all ports except ge-0/0/0
B.Forward the frame out of ge-0/0/2 only
C.Drop the frame because the VLAN does not match
D.Forward the frame out of both ge-0/0/1 and ge-0/0/2
AnswerB

This is the correct behavior because Junos performs a lookup of the destination MAC address in the Layer 2 forwarding table. The entry for 00:0c:29... lists ge-0/0/2 as the egress interface in VLAN 10, so the frame is forwarded out of that single port. Known unicast frames are switched to exactly one port, as determined by the MAC table.

Why this answer

The switch learns MAC addresses and their associated VLANs from incoming frames. Since the destination MAC 00:0c:29:2a:3b:4d is already in the MAC address table and mapped to interface ge-0/0/2 within the same VLAN, the switch forwards the frame only out of ge-0/0/2. This is the fundamental behavior of transparent bridging: unicast frames are forwarded only to the port where the destination MAC was last seen.

Exam trap

The trap here is that candidates often assume a switch always floods unknown unicast frames, but the question explicitly provides a known destination MAC, so the correct action is unicast forwarding, not flooding.

How to eliminate wrong answers

Option A is wrong because flooding occurs only when the destination MAC is unknown (not in the MAC table) or is a broadcast/multicast address; here the MAC is known. Option C is wrong because the frame arrives on ge-0/0/0, which is an access port in the same VLAN as ge-0/0/2, so the VLAN matches; the switch does not drop the frame due to VLAN mismatch. Option D is wrong because the switch does not forward a known unicast frame out of multiple ports; it uses the single port from the MAC table, not both ge-0/0/1 and ge-0/0/2.

Full explanation →
77
MCQhard

Refer to the exhibit. What is the most likely cause of the error?

A.The IP address 1.1.1.1/32 is already in use.
B.The candidate configuration has no errors and this is a warning.
C.The policy-statement 'test' contains a syntax error in the protocol match condition.
D.The commit check command requires user confirmation.
AnswerC

The error indicates 'protocol is not valid' in the policy-statement.

Why this answer

The error message in the exhibit indicates a syntax error in the policy-statement 'test' when using the protocol match condition. In Junos, the 'protocol' match condition requires a valid protocol name (e.g., 'bgp', 'ospf', 'static'), and if an invalid or misspelled protocol is specified, the commit check fails with a syntax error. This is a common mistake when configuring policy-options, as the Junos CLI validates the protocol against a predefined list.

Exam trap

The trap here is that candidates may misinterpret a syntax error as a warning or an IP conflict, because Junos error messages can be verbose, but the key is to identify the specific line number and the 'syntax error' keyword in the output, which points directly to a configuration mistake in the policy-statement.

How to eliminate wrong answers

Option A is wrong because the error message does not indicate an IP address conflict; a '1.1.1.1/32 already in use' error would appear as a commit error with a specific message about duplicate address, not a syntax error in a policy statement. Option B is wrong because the candidate configuration contains an actual syntax error, not a warning; Junos warnings are typically informational (e.g., 'warning: statement ... is deprecated') and do not prevent a successful commit check, whereas this error blocks the commit. Option D is wrong because the commit check command does not require user confirmation; it validates the configuration and reports errors without prompting for confirmation, and the exhibit shows an error output, not a confirmation prompt.

Full explanation →
78
MCQhard

A network must forward traffic to 10.1.1.0/24 through a specific next-hop 192.168.1.1, even if a dynamic route with a lower preference is available. Which configuration will achieve this?

A.Configure the dynamic protocol to export the route with a metric of 1.
B.Configure a static route to 10.1.1.0/24 with next-hop 192.168.1.1 and preference 5.
C.Configure a filter to reject the dynamic route.
D.Configure a static route to 10.1.1.0/24 with next-hop 192.168.1.1 and preference 15.
AnswerB

Preference 5 is lower than most dynamic defaults, so static will be active.

Why this answer

A static route can be configured with a preference value lower than any dynamic routing protocol's default preference. In Junos, the default preference for OSPF internal routes is 10, for IS-IS level 1 is 15, for RIP is 100, and for BGP is 170. By setting the static route to 10.1.1.0/24 with next-hop 192.168.1.1 and preference 5, it will have a lower preference value than these defaults.

Therefore, even if a dynamic route with a lower preference (i.e., a smaller number but still greater than 5) exists, the static route will be installed in the routing table and used for forwarding, satisfying the requirement to always forward traffic through the specified next-hop.

Exam trap

The trap here is that candidates often confuse metric with preference (administrative distance) and assume that a lower metric on a dynamic route will make it preferred over a static route, or they mistakenly think a higher preference value on a static route (like 15) still makes it preferred over OSPF (10).

How to eliminate wrong answers

Option A is wrong because exporting a dynamic route with a metric of 1 does not change the route's preference; metric is used for route selection among routes from the same protocol, not for comparing routes from different protocols. Option C is wrong because rejecting the dynamic route with a filter would prevent it from being installed, but it does not ensure that the desired static route is used; additionally, it is an indirect and less reliable method compared to setting a lower preference on the static route. Option D is wrong because a preference of 15 is higher than the default preference of OSPF (10) and IS-IS (15), so the static route would not be preferred over an OSPF route (preference 10) and would tie with IS-IS (preference 15), failing to guarantee that traffic is forwarded through 192.168.1.1.

Full explanation →
79
MCQhard

During a maintenance window, an engineer issues 'commit confirmed 5' but the change causes a connectivity loss. The engineer is unable to reconnect to the device before the timeout expires. What will happen?

A.The engineer must manually rollback using the rollback command.
B.The change remains committed until the next reboot.
C.The device reloads with factory defaults.
D.The device automatically reverts to the previous active configuration.
AnswerD

Commit confirmed automatically rolls back after the timeout if not confirmed.

Why this answer

The 'commit confirmed 5' command activates a candidate configuration and starts a 5-minute rollback timer. If the engineer does not issue a 'commit' or 'commit check' before the timer expires, Junos automatically reverts to the previously active configuration. This ensures the device returns to a known working state without manual intervention, preserving connectivity after the failed change.

Exam trap

The trap here is that candidates may think a 'commit confirmed' requires a manual rollback command (Option A) or that the change persists until a reboot (Option B), but Junos automatically reverts the configuration upon timeout, making it a safety mechanism for remote changes.

How to eliminate wrong answers

Option A is wrong because the automatic rollback occurs without requiring manual intervention; the engineer does not need to use the 'rollback' command after the timeout. Option B is wrong because a confirmed commit is explicitly designed to not remain committed; it automatically reverts if not confirmed, so the change does not persist until the next reboot. Option C is wrong because the device does not reload with factory defaults; it reverts only to the previous active configuration, not to a factory-reset state.

Full explanation →
80
MCQhard

A network engineer sees an unknown unicast flood on a Juniper EX switch. Which mechanism is most effective at reducing such floods?

A.Enable storm control for unknown unicast traffic.
B.Configure static MAC addresses for all endpoints.
C.Increase the MAC address table aging time.
D.Disable MAC learning on trunk interfaces.
AnswerA

Storm control on Junos allows you to define a threshold for unknown unicast traffic, either as a percentage of interface bandwidth or as packets per second. When the unknown unicast flood exceeds that threshold, the switch drops excess traffic or shuts down the affected interface until it recovers, preventing the flood from saturating the network. This is a practical, policy-based mitigation because it does not require knowing every endpoint and can be applied per interface and per VLAN.

Why this answer

Unknown unicast flooding occurs when a switch does not have a MAC address entry for a destination, causing it to flood the frame out of all ports in the VLAN except the ingress port. Storm control for unknown unicast traffic (set using `set ethernet-switching-options storm-control interface <interface> unknown-unicast`) directly limits the rate of such flooded traffic, preventing excessive bandwidth consumption. This is the most effective mechanism because it specifically targets and rate-limits unknown unicast floods without altering MAC learning or aging behavior.

Exam trap

The trap here is that candidates often confuse storm control (which rate-limits flooded traffic) with broadcast suppression or MAC learning controls, and may incorrectly think that increasing aging time or disabling MAC learning will reduce flooding, when in fact those actions either have no effect or worsen the problem.

How to eliminate wrong answers

Option B is wrong because configuring static MAC addresses for all endpoints is not scalable in a dynamic network and does not dynamically reduce flooding; it only prevents flooding for those specific statically defined addresses. Option C is wrong because increasing the MAC address table aging time can actually increase the likelihood of stale entries and does not reduce unknown unicast floods; it may even exacerbate flooding by delaying the removal of outdated entries. Option D is wrong because disabling MAC learning on trunk interfaces would prevent the switch from learning MAC addresses on those links, which would increase unknown unicast flooding rather than reduce it, as the switch would have fewer learned entries.

Full explanation →
81
Multi-Selectmedium

Which TWO statements are true about the Junos file system? (Choose two.)

Select 2 answers
A.The /config directory contains configuration files.
B.The /var/tmp directory is used for temporary storage.
C.The /altroot directory is a backup root filesystem.
D.The /kernel directory contains the operating system kernel.
E.The root directory (/) is a RAM disk.
AnswersA, B

/config stores the active and candidate configuration files.

Why this answer

The /config directory in the Junos file system stores the active and backup configuration files, including juniper.conf and juniper.conf.gz. These files are critical for device operation and are loaded during the boot process.

Exam trap

The trap here is that candidates may confuse the /altroot directory with a backup root filesystem, when in fact it is used for alternate root images during software upgrades, not a persistent backup.

Full explanation →
82
Multi-Selecthard

Which THREE statements are true about commit operations in Junos OS?

Select 3 answers
A.The 'commit confirmed' command immediately discards changes if not confirmed.
B.Multiple users can make configuration changes simultaneously, but only one can commit at a time.
C.The 'commit check' command validates the configuration syntax without activating it.
D.The 'commit confirmed' command allows a rollback to the previous configuration if not confirmed within the timeout period.
E.The 'commit' command always requires 'commit synchronize' when using dual Routing Engines.
AnswersB, C, D

Junos uses a lock to serialize commits.

Why this answer

Junos OS allows multiple users to enter configuration mode and make changes simultaneously, but the commit operation is serialized: only one user can commit at a time. This prevents conflicting changes from being applied concurrently, ensuring configuration consistency.

Exam trap

The trap here is confusing 'commit confirmed' with an immediate discard of changes, when in fact it temporarily activates the configuration and only rolls back if the confirmation is not received within the timeout period.

Full explanation →
83
MCQmedium

A network engineer needs to view the operational status of all interfaces on a Junos device, including those that are disabled. Which command should be used?

A.show interfaces
B.show configuration interfaces
C.show interfaces terse
D.monitor interface traffic
AnswerC

Correct — 'show interfaces terse' displays a single-line-per-interface summary with columns for Interface, Admin, Link, Proto, and Local address, covering both physical and logical interfaces. It explicitly shows administratively disabled interfaces with an 'admin-down' flag, while also indicating the actual operational link state ('up' or 'down'). This makes it the most efficient command for quickly surveying the operational status of all interfaces on a Junos device.

Why this answer

The 'show interfaces' command displays detailed information for all interfaces, including those that are administratively disabled. However, 'show interfaces terse' provides a concise, one-line-per-interface summary that is more efficient for quickly viewing the operational status of all interfaces, including disabled ones. For the JNCIA exam, 'show interfaces terse' is the recommended command for this purpose because it offers a clear and compact overview of interface status across the device.

Exam trap

The trap is that candidates may assume 'show interfaces' only shows enabled interfaces, but in fact it shows all interfaces including disabled. The common mistake is to choose 'show interfaces' thinking 'show interfaces terse' might omit some interfaces. However, 'show interfaces terse' also includes disabled interfaces and is more efficient for a quick overview of operational status.

How to eliminate wrong answers

Option A is wrong because 'show interfaces' displays detailed information only for interfaces that are physically present and enabled; it does not show interfaces that are administratively disabled unless they are explicitly specified. Option B is wrong because 'show configuration interfaces' displays the configured interface statements from the candidate or active configuration, not the operational status (e.g., up/down, disabled state). Option D is wrong because 'monitor interface traffic' is used for real-time traffic monitoring and statistics, not for viewing the administrative or operational status of interfaces.

Full explanation →
84
MCQmedium

Which command is used to verify that the current active configuration is the same as the candidate configuration?

A.commit check
B.show configuration
C.show system configuration
D.show | compare
AnswerD

The 'show | compare' command displays the differences between the candidate configuration and the active configuration. It outputs only the lines that would change, in a unified diff format, and if there are no differences, it returns no output. This makes it the ideal command to verify that the candidate exactly matches the active configuration.

Why this answer

The command `show | compare` displays the differences between the candidate configuration and the active (committed) configuration. If there are no differences, the candidate configuration is identical to the active configuration. This is the correct way to verify whether the candidate configuration matches the active configuration in Junos.

Exam trap

The trap here is that candidates often confuse `commit check` (which only validates syntax) with a comparison command, leading them to select Option A, but `commit check` does not compare the candidate to the active configuration.

How to eliminate wrong answers

Option A is wrong because `commit check` validates the syntax and semantics of the candidate configuration but does not compare it to the active configuration; it only ensures the candidate can be committed without errors. Option B is wrong because `show configuration` displays the candidate configuration (or the active if no candidate changes exist), but it does not perform a comparison with the active configuration. Option C is wrong because `show system configuration` is not a valid Junos command; the correct command to view system configuration is `show configuration` or `show system` with specific filters.

Full explanation →
85
MCQmedium

A network administrator notices that traffic between two VLANs is not reaching its destination. The switch has an IRB interface configured with an IP address in each VLAN's subnet. What is the most likely missing configuration?

A.The IRB interface does not have an IP address configured.
B.The VLANs are on different switches.
C.The VLANs are not defined on the switch.
D.The switch ports are not configured for VLAN tagging.
AnswerC

For inter-VLAN routing to work in Junos, each VLAN must first be defined under the [edit vlans] hierarchy so the switch knows which VLAN ID or name to associate with the ports and IRB interface. Without that definition, the IRB interface cannot be logically bound to a broadcast domain, and traffic cannot be forwarded between the two VLAN subnets. The stem confirms the IRB has an IP address, but if the VLANs themselves are not configured, the switch has no way to match incoming frames to a routing instance. This missing VLAN definition is exactly what breaks the traffic flow, making this the correct answer.

Why this answer

The IRB interface provides Layer 3 routing between VLANs, but it requires the VLANs themselves to be defined on the switch. If the VLANs are not defined, the switch cannot associate the IRB interface with the correct broadcast domains, and traffic will not be forwarded between them. Option C correctly identifies this missing configuration.

Exam trap

The trap here is that candidates often assume an IRB interface with an IP address is sufficient for inter-VLAN routing, overlooking the prerequisite that the VLAN must be defined and associated with the IRB in the switch configuration.

How to eliminate wrong answers

Option A is wrong because the question states the IRB interface has an IP address in each VLAN's subnet, so an IP address is already configured. Option B is wrong because IRB interfaces can route between VLANs on the same switch or across different switches if the VLANs are extended via trunk links; the issue is not about switch placement. Option D is wrong because VLAN tagging on switch ports is only relevant for trunk ports carrying multiple VLANs, not for the IRB interface itself, and the problem is about inter-VLAN routing, not port configuration.

Full explanation →
86
MCQeasy

You are a network engineer for a company that uses two Juniper routers, R1 and R2, connected via an Ethernet link. R1 and R2 are running OSPF in the same area, and R2 also has an eBGP session with a service provider to reach the internet. On R1, you have configured a static route to the subnet 172.16.10.0/24 with a next-hop of 192.168.1.2, which is the IP address of R2's interface facing R1. You have verified that the static route is configured correctly in the configuration, but traffic from R1 to 172.16.10.0/24 is not being forwarded. You check the routing table on R1 and see that the static route is present but marked as 'hidden'. You also notice that R1 has an OSPF-learned route to 192.168.1.0/30 (the link between R1 and R2) with a cost of 1. What is the most appropriate next troubleshooting step?

A.Disable the eBGP session on R2 to remove the BGP routes from the routing table.
B.Increase the static route's preference to a lower value (e.g., 4).
C.Configure a more specific static route to 172.16.10.0/24 with a mask of /25.
D.Check if the next-hop IP 192.168.1.2 is reachable via the directly connected interface.
AnswerD

Correct: the next-hop unreachability is the most common cause of a hidden static route; verifying reachability (e.g., ping, ARP) will identify the issue.

Why this answer

A static route becomes hidden in Juniper's routing table when the next-hop is considered unreachable. Although R1 has an OSPF-learned route to the subnet 192.168.1.0/30, the router performs a recursive lookup to ensure the next-hop IP 192.168.1.2 is reachable via a directly connected interface or a valid route. In this case, the next-hop is directly connected, so the most likely cause is that the interface is down, or there is an ARP resolution issue, or a firewall filter blocking ARP.

Option D directs you to check if the next-hop is reachable via the directly connected interface, which is the appropriate first troubleshooting step. Option A is incorrect because disabling eBGP on R2 does not affect R1's static route next-hop reachability. Option B is incorrect because lowering preference would not resolve a hidden route; hidden routes are not considered for forwarding regardless of preference.

Option C is incorrect because making the route more specific does not address the reachability issue.

Full explanation →
87
MCQhard

A static route to 10.0.0.0/8 has next-hop 192.168.1.1. The route is not installed in the routing table. Which condition must be met for the route to become active?

A.The static route must have a lower preference than any dynamic route to the same prefix.
B.The next-hop must have an ARP entry in the ARP table.
C.The next-hop 192.168.1.1 must be reachable via an active route (e.g., a direct or OSPF route).
D.The metric of the static route must be lower than that of any other route to the same prefix.
AnswerC

A static route with an indirect next-hop is installed in the Junos routing table only after the next-hop address is recursively resolved via a routing table lookup. In this case, 192.168.1.1 must be matched by an active route — such as a directly connected subnet, an OSPF route, or another static route — otherwise the static route to 10.0.0.0/8 is marked as unresolved and is not placed in the forwarding table. This resolution is required regardless of the static route's preference or metric. If the active route to the next-hop is removed, the static route is immediately hidden from the active route table.

Why this answer

For a static route to be installed in the Junos routing table, its next-hop must be reachable via an active route in the routing table. This is because Junos performs recursive next-hop resolution: it looks up the next-hop IP address (192.168.1.1) in the routing table and requires a valid, active route (e.g., a directly connected or OSPF-learned route) to that address. Without this, the static route remains hidden and is not installed.

Exam trap

The trap here is that candidates often confuse the requirement for the next-hop to be reachable (a routing table condition) with Layer 2 resolution (ARP), leading them to incorrectly select Option B, but ARP is only used after the route is installed and the next-hop is determined to be reachable.

How to eliminate wrong answers

Option A is wrong because preference (administrative distance) only determines which route is selected among multiple routes to the same prefix that are already active; it does not affect whether a static route becomes active in the first place. Option B is wrong because an ARP entry is a Layer 2 resolution mechanism that occurs after the route is installed and the next-hop is reachable; the route will not become active solely because an ARP entry exists. Option D is wrong because metric is not used for static route selection in Junos; static routes have no metric, and route selection is based on preference, not metric.

Full explanation →
88
MCQeasy

An engineer is troubleshooting a network issue where hosts on the same VLAN cannot communicate with each other. Which configuration element is most likely missing?

A.Spanning Tree Protocol enabled
B.An IRB interface for the VLAN
C.A Layer 3 switchport
D.A default gateway for the VLAN
AnswerA

STP prevents loops, does not affect Layer 3 connectivity.

Why this answer

Hosts on the same VLAN communicate at Layer 2 and do not require any Layer 3 configuration such as an IRB interface or default gateway. The most likely missing configuration is that Spanning Tree Protocol (STP) is not enabled. Without STP, loops can cause broadcast storms and MAC address flapping, preventing communication between hosts in the same VLAN.

Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse the need for a default gateway (Layer 3) with Layer 2 connectivity, assuming hosts on the same VLAN need a gateway to communicate, when in fact they communicate directly via ARP and MAC addresses.

How to eliminate wrong answers

Option A is wrong because Spanning Tree Protocol (STP) prevents loops in redundant topologies but is not required for basic Layer 2 communication within a single VLAN; hosts can communicate without STP enabled. Option C is wrong because a Layer 3 switchport is used for routing between VLANs, not for same-VLAN communication; hosts on the same VLAN communicate at Layer 2, so a Layer 2 switchport is needed. Option D is wrong because a default gateway is only necessary for traffic destined outside the local subnet; hosts on the same VLAN communicate directly via MAC addresses and do not need a default gateway.

Full explanation →
89
MCQhard

You are a network engineer for a service provider that recently deployed a Juniper MX router at a new Point of Presence (PoP). The router is used to aggregate customer connections and exchange routes with upstream providers via BGP. After the initial configuration, you notice that the router is not learning any routes from one of the upstream BGP peers. You have verified that the BGP session is established (state Established) and that the peer is sending routes. You suspect that the issue might be related to the firewall filter or routing policy. You want to determine if any inbound routes are being rejected and why. Which command would provide the most direct information about why routes are being rejected?

A.show route protocol bgp
B.show route receive-protocol bgp 192.0.2.1
C.show bgp summary
D.show firewall filter <filter-name>
AnswerB

show route receive-protocol bgp 192.0.2.1 shows the exact updates received from that specific neighbor before they pass through the routing table, including the import-policy decision. The output marks each prefix with an 'A' (accept) or 'I' (ignore/reject) and, when rejected, prints the policy name and reason. This makes it the right diagnostic for verifying why a route from 192.0.2.1 was not installed, because it exposes the BGP input policy evaluation on every received prefix.

Why this answer

'show route receive-protocol bgp 192.0.2.1', is correct because it displays the exact routes received from a specific BGP peer along with any policy or filter actions applied (e.g., reject, accept). This command directly shows whether routes are being rejected and the reason (e.g., due to an import policy or firewall filter), making it the most direct diagnostic tool for the described issue.

Exam trap

The trap here is that candidates often assume 'show bgp summary' or 'show route protocol bgp' will reveal route rejection details, but they only show aggregated statistics or installed routes, not the per-peer policy decisions that cause routes to be hidden or rejected.

How to eliminate wrong answers

Option A is wrong because 'show route protocol bgp' displays all BGP routes in the routing table, but it does not show why routes were rejected or filtered before installation. Option C is wrong because 'show bgp summary' only shows BGP session state and statistics (e.g., prefixes received), not the specific routes or rejection reasons. Option D is wrong because 'show firewall filter <filter-name>' shows firewall filter counters and rules, but it does not directly correlate to BGP route rejection unless the filter is explicitly applied to the BGP session; it is indirect and less specific than the receive-protocol command.

Full explanation →
90
MCQhard

You are managing a Juniper MX router that serves as a BGP route reflector for multiple customer VPNs. The router has two routing engines (RE0 and RE1) in a graceful switchover (GRES) configuration. During a routine maintenance window, you need to upgrade the Junos OS from version 18.1R1 to 20.2R2. The upgrade must minimize traffic disruption. You have already staged the new image on both REs. Which sequence of commands ensures minimal impact?

A.On RE0: request system software add jinstall-20.2R2.tgz reboot; then on RE1 same command
B.On RE0: request system reboot (without adding software)
C.On RE1: request system software add jinstall-20.2R2.tgz reboot; after reboot, on RE0: request chassis routing-engine master switch; then request system software add jinstall-20.2R2.tgz reboot
D.On both REs: request system software add jinstall-20.2R2.tgz reboot
AnswerC

Minimizes downtime by upgrading backup first, then switching.

Why this answer

It performs a non-disruptive upgrade by first upgrading the backup RE (RE1), then switching mastership to the upgraded RE, and finally upgrading the original master RE. This sequence leverages Graceful Routing Engine Switchover (GRES) to maintain BGP sessions and VPN forwarding during the upgrade, minimizing traffic disruption.

Exam trap

The trap here is that candidates assume rebooting both REs sequentially with the same command is sufficient, but they overlook the need to switch mastership to the upgraded backup RE before upgrading the original master to avoid a double-reboot scenario that disrupts traffic.

How to eliminate wrong answers

Option A is wrong because rebooting both REs sequentially without first switching mastership causes a full outage when the master RE reboots, as the backup RE is not yet upgraded and may not take over cleanly. Option B is wrong because rebooting without adding the new software does not perform an upgrade, leaving the router on the old version. Option D is wrong because adding the software and rebooting both REs simultaneously or without proper mastership control can cause a complete loss of routing and forwarding, as both REs may reboot at the same time or the backup RE cannot take over gracefully.

Full explanation →
91
MCQhard

Based on the exhibit, what is the most likely impact on the router?

A.Routing protocol adjacencies will be lost, causing routing instability.
B.The CPU will be overloaded due to the kernel messages.
C.The router will stop forwarding packets immediately.
D.The router will reboot automatically.
AnswerA

The rpd (Routing Protocol Daemon) is the sole software process managing all dynamic routing protocols, including OSPF, BGP, and IS-IS. When it is killed, every established adjacency immediately tears down, causing neighboring routers to mark the node unreachable and recalculate paths. This produces route flap and forwarding loops until rpd restarts and rebuilds sessions, so the primary impact is severe routing instability.

Why this answer

The exhibit shows kernel messages indicating a hardware or software fault (e.g., a FPC crash or PIC restart). In Junos, such critical events cause the Packet Forwarding Engine (PFE) to reset, which tears down all routing protocol adjacencies (OSPF, BGP, IS-IS) because the control plane loses communication with the forwarding plane. This leads to route withdrawal and routing instability until the adjacencies are re-established.

Exam trap

The trap here is that candidates assume kernel messages always cause a full reboot or immediate forwarding stop, but Junos is designed to isolate failures to specific components (like FPCs) rather than crashing the entire router.

How to eliminate wrong answers

Option B is wrong because kernel messages are logged as part of normal fault handling and do not inherently overload the CPU; Junos prioritizes control plane stability. Option C is wrong because the router continues to forward packets using the last known forwarding table until the PFE restarts, and even then, forwarding may resume after the restart without a full stop. Option D is wrong because Junos does not automatically reboot on kernel messages; it isolates the faulty component (e.g., FPC restart) to maintain overall system availability.

Full explanation →
92
MCQhard

An administrator notices that after committing a configuration change on a Juniper MX router, the device loses connectivity to the management network. The management interface is part of a dedicated management routing instance. Which of the following is the most likely cause?

A.A firewall filter was applied to the management interface that blocks all traffic
B.NTP was configured with an incorrect server address
C.A syslog server was configured that is unreachable
D.The routing instance for the management interface was accidentally removed
AnswerD

The management interface (e.g., fxp0 or me0) is bound to a dedicated routing instance, often named mgmt_junos, which contains the management subnet's route. Removing this routing instance from the configuration causes the interface to lose its association with the routing table, effectively eliminating the route to the management network. As a result, remote management traffic cannot be routed to or from the device, even though the interface itself may still be administratively and operationally up. This correctly explains why the administrator loses connectivity after committing the configuration.

Why this answer

The management interface is part of a dedicated management routing instance (often named mgmt_junos). If this routing instance is accidentally removed during a commit, the management interface loses its routing context and becomes unreachable, causing loss of connectivity to the management network. This is a common misconfiguration when an administrator modifies routing instance configurations without realizing the management interface depends on it.

Exam trap

The trap here is that candidates often assume a firewall filter or service configuration (like NTP or syslog) is the cause, but the real issue is the removal of the routing instance that provides the logical separation for the management interface.

How to eliminate wrong answers

Option A is wrong because applying a firewall filter that blocks all traffic to the management interface would cause immediate loss of connectivity, but the question states the issue occurs after committing a configuration change, and the most likely cause is a structural change to the routing instance rather than a filter. Option B is wrong because configuring NTP with an incorrect server address would not cause loss of management connectivity; it would only prevent time synchronization. Option C is wrong because configuring an unreachable syslog server would only affect logging, not the management interface's ability to communicate on the network.

Full explanation →
93
MCQhard

An engineer enables Spanning Tree PortFast on a switch port connected to a host. Later, another switch is connected to that same port, causing a loop. What feature could have prevented this?

A.Loop guard
B.BPDU guard
C.Root guard
D.UplinkFast
AnswerB

BPDU guard is the correct companion feature for PortFast because PortFast places a port into the forwarding state immediately, assuming it connects only to an end host. If the port receives any Spanning Tree Protocol BPDU—indicating that a switch or bridge has been connected—BPDU guard immediately error-disables the port, stopping all traffic and preventing a potential bridging loop. This proactive shutdown is far faster than allowing the spanning tree algorithm to recalculate and block the port. By disabling the port on the very first BPDU, BPDU guard enforces the edge-port assumption and provides strong protection against accidental misconfigurations or malicious devices.

Why this answer

BPDU guard is the correct answer because it disables a port configured with PortFast if a BPDU is received, preventing loops when a switch is accidentally connected. In this scenario, PortFast was enabled for a host, but connecting another switch caused BPDUs to be sent, which BPDU guard detects and shuts down the port to break the loop.

Exam trap

The trap here is that candidates confuse BPDU guard with Loop guard, thinking both prevent loops, but Loop guard addresses unidirectional link failures, not the accidental connection of a switch to a PortFast port.

How to eliminate wrong answers

Option A is wrong because Loop guard is designed to prevent alternate or root ports from becoming designated in the absence of BPDUs (e.g., due to unidirectional link failure), not to block BPDUs on PortFast-enabled ports. Option C is wrong because Root guard enforces the root bridge position by disabling a port if it receives superior BPDUs, but it does not prevent loops from a switch connected to a PortFast port. Option D is wrong because UplinkFast is a Cisco-proprietary feature that accelerates convergence after a direct link failure on access switches, unrelated to protecting PortFast ports from BPDU reception.

Full explanation →
94
MCQhard

A network engineer accidentally committed a configuration on a Juniper router that caused a loss of management access via SSH and SNMP. The engineer has console access and the device is still operational. Before the change, the engineer had saved a rescue configuration using 'request system configuration rescue save'. Which action should the engineer take to restore management access most quickly?

A.At the shell prompt, execute 'cli -c "rollback rescue"' and then commit.
B.At the configuration mode, execute 'rollback 0'.
C.Power cycle the device; it will automatically boot with the rescue configuration.
D.Reboot the device and press the space bar to load the rescue configuration.
AnswerA

This loads the rescue configuration without rebooting.

Why this answer

The 'request system configuration rescue save' command stores a rescue configuration that can be rolled back to using 'rollback rescue' in configuration mode. Since the engineer has console access, they can enter configuration mode and execute 'rollback rescue' followed by 'commit' to instantly revert to the last known working configuration, restoring SSH and SNMP access without requiring a reboot.

Exam trap

The trap here is that candidates may confuse 'rollback rescue' with a boot-time recovery mechanism, assuming the rescue configuration loads automatically on reboot, when in fact it requires a manual command after the device is operational.

How to eliminate wrong answers

Option B is wrong because 'rollback 0' reverts to the most recently committed configuration, which is the same problematic configuration that caused the loss of management access, so it would not restore connectivity. Option C is wrong because power cycling the device does not automatically load the rescue configuration; Junos boots from the active file system (e.g., 'junos.conf') unless explicitly instructed otherwise via the boot loader or a rescue configuration load during boot. Option D is wrong because pressing the space bar during boot interrupts the normal boot process to access the loader prompt, but it does not automatically load the rescue configuration; the rescue configuration must be explicitly loaded via the 'load rescue' command in the loader or after booting into the operating system.

Full explanation →
95
MCQhard

Refer to the exhibit. An engineer runs the command shown. What does this output indicate?

A.The candidate configuration matches the committed configuration.
B.The candidate configuration has an IP address change.
C.The rollback 0 configuration is being displayed.
D.The interface ge-0/0/0 has been deleted.
AnswerB

In the diff output, the `-` line shows the committed IP address (10.0.0.1) being removed from interface ge-0/0/0, and the `+` line shows the candidate IP address (192.0.2.1) replacing it under `family inet`. This is a classic unified diff format: the `-` line is the old value, the `+` line is the new value. Since only the address line changes while the interface and its family structure remain, this correctly identifies an IP address change.

Why this answer

The output shows the candidate configuration differs from the committed configuration, as indicated by the 'show | compare' command displaying a change under the [edit interfaces ge-0/0/0 unit 0 family inet] hierarchy. Specifically, it shows the address 192.168.1.1/24 being replaced with 192.168.1.2/24, which is an IP address change. This confirms option B is correct because the candidate configuration has an IP address change that has not yet been committed.

Exam trap

The trap here is that candidates often confuse 'show | compare' with 'show configuration | display set' or assume no output means no candidate changes exist, but in reality, 'show | compare' outputs only differences, and any output indicates a pending change that does not match the committed configuration.

How to eliminate wrong answers

Option A is wrong because the output shows a difference between the candidate and committed configurations (the IP address change), so they do not match; a matching configuration would produce no output from 'show | compare'. Option C is wrong because the command 'show | compare' compares the candidate configuration to the active (committed) configuration, not specifically to rollback 0; while rollback 0 is the most recent commit, the command compares to the current active configuration, and the output does not indicate a rollback operation. Option D is wrong because the output shows the interface ge-0/0/0 still exists with a unit and family inet configuration; only the IP address is changed, not the interface being deleted.

Full explanation →
96
MCQeasy

A switch receives a unicast frame with a destination MAC address that is present in its MAC address table. How does the switch process the frame?

A.It sends the frame back to the source port
B.It floods the frame to all ports except the receiving port
C.It drops the frame
D.It forwards the frame only out of the port associated with that MAC address
AnswerD

When a switch receives a unicast frame with a destination MAC address already in its MAC address table, it forwards the frame only out of the port associated with that MAC address. This is the fundamental switching behavior: the MAC table records source MAC addresses and their corresponding ingress ports, and later lookups for known destinations are delivered to that single port. This preserves bandwidth, reduces unnecessary traffic, and ensures the frame reaches only the intended station.

Why this answer

When a switch receives a unicast frame and the destination MAC address is already in its MAC address table, it performs a lookup and forwards the frame only out of the specific port associated with that MAC address. This is the fundamental switching behavior known as 'unicast forwarding' or 'filtering,' which avoids unnecessary flooding and preserves bandwidth.

Exam trap

The trap here is that candidates often confuse the behavior for an unknown unicast (which is flooded) with a known unicast (which is forwarded only to the specific port), leading them to incorrectly select option B.

How to eliminate wrong answers

Option A is wrong because sending the frame back to the source port would create a loop and violate the basic switching principle that a frame is never forwarded out the port it was received on. Option B is wrong because flooding to all ports except the receiving port only occurs when the destination MAC address is unknown (not in the MAC table) or for broadcast/multicast frames, not for a known unicast address. Option C is wrong because the switch does not drop the frame; it has a matching entry in the MAC table and can forward it correctly to the intended destination.

Full explanation →
97
MCQeasy

Refer to the exhibit. An administrator notices the /var partition is nearly full. Which command can be used to safely reclaim disk space?

A.request system reboot
B.request system storage cleanup
C.delete /var/log/messages
D.request system software delete
AnswerB

The 'request system storage cleanup' command is the correct procedure because it safely identifies and removes files that are no longer needed, including old log backups, temporary files, and core dumps that have exceeded retention thresholds. It is designed to avoid deleting active or critical files, and it releases space on /var and other partitions in a controlled manner, making it the recommended first step when disk space is low.

Why this answer

The 'request system storage cleanup' command safely removes old log files, core dumps, and other temporary files that are no longer needed, freeing up space on the /var partition without risking system stability. This is the recommended Junos method for reclaiming disk space because it targets only files that can be safely deleted.

Exam trap

The trap here is that candidates may think manually deleting log files (option C) is safe and effective, but Junos relies on its own cleanup mechanisms to avoid breaking log rotation or losing important diagnostic data.

How to eliminate wrong answers

Option A is wrong because 'request system reboot' only restarts the system and does not delete any files, so it will not reclaim disk space. Option C is wrong because manually deleting '/var/log/messages' can cause loss of critical logging data and may not be safe if the file is still being written to; Junos manages log rotation automatically, and direct deletion can disrupt that. Option D is wrong because 'request system software delete' is used to remove installed software packages, not to clean up temporary or log files, and it could inadvertently remove needed software.

Full explanation →
98
Multi-Selecteasy

Which TWO statements about configuration archival in Junos are true?

Select 2 answers
A.Archival stores the candidate configuration.
B.The 'system archival' hierarchy enables automatic backup of configurations.
C.Archival only saves the rescue configuration.
D.Archival can use FTP or SCP to transfer files.
E.Archival automatically archives after every commit without any configuration.
AnswersB, D

This configuration block defines archival settings.

Why this answer

The 'system archival' hierarchy in Junos is specifically designed to enable automatic backup of configuration files. This feature allows administrators to configure periodic transfers of committed configurations to a remote server, ensuring configuration history is preserved without manual intervention.

Exam trap

The trap here is that candidates often confuse the candidate configuration with the committed configuration, assuming archival saves the uncommitted changes, when in fact it only archives the active committed configuration after a successful commit.

Full explanation →
99
MCQmedium

A network engineer needs to restore the factory-default configuration on a Junos device. Which command sequence is correct?

A.set system host-name factory-default
B.request system zeroize
C.load factory-default and then commit
D.delete configuration and reboot
AnswerC

`load factory-default` loads the vendor-provided factory-default configuration file into the candidate configuration, replacing all existing candidate settings. The subsequent `commit` promotes that candidate to the active (committed) configuration, thereby returning the device to its out-of-box state without erasing logs or other non-configuration files. This is the standard, supported procedure for restoring factory defaults on a Junos device.

Why this answer

The correct command sequence to restore factory-default configuration on a Junos device is 'load factory-default' followed by 'commit'. The 'load factory-default' command replaces the current candidate configuration with the factory-default configuration, but it does not take effect until a 'commit' is issued. This ensures the device reverts to its original settings without affecting the currently running configuration until explicitly committed.

Exam trap

The trap here is that candidates confuse 'load factory-default' with 'request system zeroize', thinking both achieve the same result, but 'zeroize' is a security wipe that destroys all data and requires a reboot, while 'load factory-default' is a configuration-only reset that is committed without rebooting.

How to eliminate wrong answers

Option A is wrong because 'set system host-name factory-default' only changes the hostname to 'factory-default', it does not restore the entire configuration to factory defaults. Option B is wrong because 'request system zeroize' is used to erase all data, including configuration files, logs, and user data, for security purposes before decommissioning a device; it does not simply restore factory-default configuration and requires a reboot to complete. Option D is wrong because 'delete configuration and reboot' is not a valid Junos command sequence; deleting the configuration without using 'load factory-default' would leave the device with an empty configuration, potentially causing boot issues or requiring manual recovery.

Full explanation →
100
Multi-Selecthard

Which TWO commands can be used to view the current routing table entries for IPv4 unicast routes?

Select 2 answers
A.show route protocol static
B.show route table inet.0
C.show forwarding-table
D.show route
E.show route table inet6.0
AnswersB, D

The command 'show route table inet.0' explicitly selects the IPv4 unicast routing table (inet.0) for display. In Junos, inet.0 is the default routing table for IPv4 unicast routes, holding both active and inactive routes from all protocols. This command is functionally equivalent to a plain 'show route' but makes the table selection explicit, ensuring the administrator is viewing the complete IPv4 unicast routing table rather than another table or protocol-specific subset.

Why this answer

`show route table inet.0` explicitly displays the IPv4 unicast routing table (inet.0) in Junos. Option D is correct because `show route` without any filter defaults to showing all routes in the inet.0 table, which is the primary IPv4 unicast routing table.

Exam trap

The trap here is that candidates confuse the routing table (`show route`) with the forwarding table (`show forwarding-table`), or assume a specific protocol filter like `protocol static` shows all routes, when in fact it only shows routes learned via that protocol.

Full explanation →
101
MCQhard

Two routers running IBGP with full mesh have a routing loop for prefix 10.1.1.0/24. Both routers have an IBGP route (preference 170) for the prefix with next-hop 10.2.2.2, and an OSPF route (preference 10) for the same prefix. The OSPF next-hop on each router points to the other router's loopback interface. Which action should be taken to stop the loop while preserving BGP route advertisement?

A.Increase the OSPF preference for 10.1.1.0/24 to 175
B.Add a static route for 10.1.1.0/24 with next-hop 10.2.2.2
C.Configure 'set protocol bgp group internal-mesh local-address 10.2.2.2' to set next-hop to self
D.Use route reflection to break the loop
AnswerA

In Junos, route preference is the first criterion in the route selection process. OSPF internal routes default to a preference of 10, while iBGP routes default to 170, so the router installs the OSPF route even if the BGP route has a better path out of the loop. By raising OSPF preference for 10.1.1.0/24 to 175, you make OSPF less desirable than BGP (170), allowing the iBGP route to become active and use a next hop that exits the loop. This targeted override of the default preference for a specific prefix resolves the loop without affecting other routes.

Why this answer

Increasing the OSPF preference for 10.1.1.0/24 to 175 makes the IBGP route (preference 170) more preferred than the OSPF route. This breaks the routing loop where each router's OSPF route points to the other's loopback, while preserving the IBGP route advertisement. The loop occurs because both routers prefer the OSPF route (preference 10) over IBGP (preference 170), causing traffic to bounce between them.

Exam trap

The trap here is that candidates may think the loop is caused by BGP next-hop behavior or session configuration, rather than recognizing it as a route preference issue where OSPF's lower preference overrides IBGP, leading to a forwarding loop between the two routers.

How to eliminate wrong answers

Option B is wrong because adding a static route for 10.1.1.0/24 with next-hop 10.2.2.2 would create a static route with default preference 5, which is more preferred than both OSPF and IBGP, but it does not address the loop caused by OSPF routes pointing to each other's loopbacks; it could also interfere with BGP route advertisement. Option C is wrong because configuring 'set protocol bgp group internal-mesh local-address 10.2.2.2' sets the local address for BGP sessions but does not change the next-hop for the IBGP route; the next-hop remains 10.2.2.2, and this does not resolve the OSPF route preference issue. Option D is wrong because route reflection is a scalability feature for IBGP that reduces the number of sessions, but it does not affect route preference or break the loop caused by OSPF routes being preferred over IBGP.

Full explanation →
102
MCQhard

You are administering a Juniper MX240 router that provides connectivity to multiple customer sites. The router uses BGP to exchange routes with two upstream ISPs. Recently, you applied a new firewall filter to the loopback interface to restrict management access. After committing the configuration, you can no longer establish SSH sessions to the router from the management network. You are currently connected via console. The loopback filter is still applied. You suspect the filter is blocking SSH traffic from the management network. What should you do to restore SSH access without losing the other filter rules?

A.Roll back to the previous configuration using 'rollback 0' and commit.
B.Add a new term at the end of the filter that accepts SSH traffic from any source.
C.Add a new term at the beginning of the filter that accepts SSH traffic from the management network, then reorder the terms so that this term is evaluated first.
D.Delete the firewall filter from the loopback interface and commit.
AnswerC

Inserting a new accept term at the top of the filter and committing it ensures that SSH packets sourced from the management network match this term first, before any deny term can be evaluated. Junos first-match semantics guarantee that once the accept action is applied, no later term can override it. Limiting the source to the management network preserves the security boundary and only restores the intended SSH access, rather than allowing SSH from arbitrary sources.

Why this answer

Firewall filters in Junos are evaluated in order, and adding a term at the beginning that explicitly accepts SSH traffic from the management network ensures that the SSH packets are permitted before any subsequent deny terms are evaluated. This preserves all existing filter rules while restoring SSH access. The 'insert' command or reordering terms is necessary to place the new term first, as the default behavior appends new terms to the end of the filter.

Exam trap

The trap here is that candidates assume adding a permit rule anywhere in the filter will work, but they forget that Junos filters are order-dependent and that new terms are appended to the end by default, which may be after a deny term that blocks the traffic.

How to eliminate wrong answers

Option A is wrong because 'rollback 0' rolls back to the most recently committed configuration, which would remove the entire firewall filter and any other recent changes, not just the problematic rule. Option B is wrong because adding a term at the end of the filter that accepts SSH from any source would still be evaluated after any existing deny terms that might block SSH traffic, so it would not restore access. Option D is wrong because deleting the entire firewall filter from the loopback interface removes all security restrictions, not just the one blocking SSH, which violates the requirement to keep other filter rules.

Full explanation →
103
MCQeasy

A technician needs to view the last 50 log messages from the system log file. Which command accomplishes this?

A.show system log messages
B.monitor start messages
C.show system syslog
D.show log messages | last 50
AnswerD

show log messages | last 50 is the correct operational command to view the most recent 50 entries from the default /var/log/messages file. The pipe to 'last' is a Junos CLI filter that displays only the final 50 lines of the output, similar to 'tail -50' in a Unix shell. This is both efficient and reliable because it avoids printing the entire log and directly shows the newest events.

Why this answer

The 'show log messages | last 50' command displays the last 50 lines from the /var/log/messages file on a Junos device. The pipe to 'last' is a Junos CLI filter that outputs only the final N lines of the command output, which is exactly what is needed to view the most recent log entries.

Exam trap

The trap here is that candidates confuse the 'show log' command with 'show system syslog' or 'show system log messages', misremembering the exact syntax for viewing log file contents versus configuration.

How to eliminate wrong answers

Option A is wrong because 'show system log messages' is not a valid Junos command; the correct command to view the system log file is 'show log messages'. Option B is wrong because 'monitor start messages' is used to tail the log file in real time, not to view a static set of the last 50 messages. Option C is wrong because 'show system syslog' displays the syslog configuration, not the actual log file contents.

Full explanation →
104
MCQeasy

What is the purpose of the 'commit confirmed' command in Junos OS?

A.It compares the candidate configuration with the active configuration
B.It allows the administrator to test a configuration change with automatic rollback if confirmation is not received
C.It permanently saves the candidate configuration to the startup configuration
D.It confirms that a previous commit was successful
AnswerB

This is the correct purpose of 'commit confirmed' in Junos. When you issue 'commit confirmed', the candidate configuration is applied and a timer (default 10 minutes, configurable with 'confirm <minutes>') starts. If you do not explicitly confirm the commit with a subsequent 'commit confirm' before the timer expires, the device automatically reverts to the previous active configuration. This is essential for safely applying remote changes that might disrupt connectivity, because a lost connection means you cannot confirm, so the router rolls back automatically.

Why this answer

The 'commit confirmed' command in Junos OS applies a candidate configuration change and starts a confirmation timer (default 10 minutes). If the administrator does not issue a 'commit' command before the timer expires, the system automatically rolls back to the previous active configuration. This allows safe testing of changes, especially over remote connections, preventing lockout if the change breaks connectivity.

Exam trap

The trap here is that candidates confuse 'commit confirmed' with a simple confirmation prompt or a verification step, when in fact it is a timed rollback mechanism designed to prevent lockout during remote configuration changes.

How to eliminate wrong answers

Option A is wrong because comparing the candidate configuration with the active configuration is done using the 'show | compare' command or 'show configuration | compare', not 'commit confirmed'. Option C is wrong because permanently saving the candidate configuration to the startup configuration is achieved with 'commit' (or 'commit and-quit'), not 'commit confirmed'; the 'commit confirmed' command applies the change temporarily and requires a subsequent 'commit' to make it permanent. Option D is wrong because confirming a previous commit was successful is not a function of 'commit confirmed'; the system logs commit success or failure in the event log, and 'show system commit' displays the commit history, but 'commit confirmed' is used to test a change with automatic rollback, not to verify a past commit.

Full explanation →
105
MCQmedium

Refer to the exhibit. An operator tries to ping 192.168.1.2 from this router and fails. The router can ping itself (192.168.1.1). What is the most likely cause?

A.Reverse path forwarding (RPF) check is dropping the echo request.
B.The remote host is not reachable or is not responding to ARP requests.
C.The interface is administratively down.
D.Proxy ARP is not configured on the interface.
AnswerB

To ping 192.168.1.2 from a directly connected interface, the router must first resolve that destination IP to a MAC address using an ARP request. If the remote host is down, unreachable at Layer 2, or configured with a different IP, it will not send an ARP reply, and the router will report the ping as failing (e.g., 'Host is down' or an incomplete ARP entry). Since the interface is up and has an IP in the same subnet, ARP resolution failure is the classic and most likely explanation for this symptom.

Why this answer

The router can ping its own interface (192.168.1.1), confirming that the interface is up and IP is configured correctly. The failure to ping 192.168.1.2 indicates that the router cannot reach the remote host, most likely because the host is down, not connected, or not responding to ARP requests. ARP resolution is required for the router to map the destination IP to a MAC address on the local subnet; without a successful ARP reply, the router cannot send the echo request.

Exam trap

The trap here is that candidates may confuse a local connectivity issue (like a down interface or RPF) with a remote host unreachability, but the ability to ping the local interface proves the interface is operational and the problem lies with the destination host or its ARP response.

How to eliminate wrong answers

Option A is wrong because reverse path forwarding (RPF) checks are used in multicast or unicast RPF (uRPF) scenarios to verify the source address of incoming packets, not to drop locally generated echo requests. Option C is wrong because if the interface were administratively down, the router would not be able to ping its own address (192.168.1.1). Option D is wrong because Proxy ARP is used to allow a router to respond to ARP requests on behalf of hosts on another subnet; it is not required for a router to ping a host on the same directly connected subnet.

Full explanation →
106
MCQmedium

A router receives a packet with destination IP 10.1.1.100. The routing table contains two entries: a static route to 10.1.1.0/24 via 192.168.1.1, and an OSPF route to 10.1.1.0/25 via 192.168.2.1. Which route will the router use?

A.The router drops the packet due to a routing conflict
B.The OSPF route to 10.1.1.0/25
C.The static route to 10.1.1.0/24
D.Both routes are used for load balancing
AnswerB

The destination address 10.1.1.100 falls inside both the 10.1.1.0/24 and 10.1.1.0/25 networks, but the forwarding decision is based on longest prefix match. Since /25 (255.255.255.128) is more specific than /24 (255.255.255.0), the OSPF route to 10.1.1.0/25 is the selected best route. This holds regardless of the administrative distance ranking of the two protocols because prefix length is evaluated before administrative distance.

Why this answer

The router will use the OSPF route to 10.1.1.0/25 because it has a longer prefix length (/25) than the static route (/24). Juniper Junos uses the most specific (longest) prefix match in the routing table, regardless of administrative distance or protocol preference. The destination IP 10.1.1.100 falls within the 10.1.1.0/25 range (10.1.1.0–10.1.1.127), so the /25 route is more specific and thus preferred.

Exam trap

The trap here is that candidates often assume OSPF routes are always preferred over static routes due to administrative distance, but Junos (and all routers) prioritize the longest prefix match first, so a more specific static route would win over a less specific OSPF route.

How to eliminate wrong answers

Option A is wrong because there is no routing conflict; the router uses the longest prefix match rule, not a tie-breaking mechanism that drops packets. Option C is wrong because the static route to 10.1.1.0/24 is less specific than the OSPF /25 route, so it is not selected for this destination. Option D is wrong because load balancing only occurs when multiple routes have identical prefix lengths and equal preference/metrics; here the prefix lengths differ (/24 vs /25), so only the most specific route is used.

Full explanation →
107
MCQmedium

A technician notices that the /var partition is filling up on a Juniper device. Which action would be most appropriate to free up space while preserving critical logs?

A.Delete core files manually
B.Run 'request system storage cleanup'
C.Reboot the device
D.Delete all files in /var/log
AnswerB

The 'request system storage cleanup' command is the correct method because it systematically scans well-known system directories and removes only files that are safe to delete, such as stale core files, old log files, and unused software images, while preserving the current system's operational logs and active configuration. It reports how much space was reclaimed and is designed by Juniper to be the standard, nondestructive way to free the /var partition. This avoids the pitfalls of ad-hoc deletion and ensures essential diagnostic data remains intact.

Why this answer

The 'request system storage cleanup' command is the correct action because it safely removes non-essential files such as old log files, core dumps, and temporary files that are no longer needed, while preserving critical logs and configuration files. This command performs a controlled cleanup without risking the deletion of important operational data, making it the most appropriate method for freeing up space on the /var partition.

Exam trap

The trap here is that candidates often assume manual deletion (Option A) or a reboot (Option C) are quick fixes, but they overlook the Junos-specific safe cleanup command that automates the process while preserving essential data.

How to eliminate wrong answers

Option A is wrong because manually deleting core files is risky and inefficient; core files may be needed for debugging, and manual deletion could accidentally remove files that are still in use or miss other space-consuming temporary files. Option C is wrong because rebooting the device does not free up disk space; it only clears temporary memory and may cause unnecessary downtime without addressing the underlying storage issue. Option D is wrong because deleting all files in /var/log would remove critical logs needed for troubleshooting and compliance, and it could also delete active log files that are still being written to, potentially causing system instability or loss of forensic data.

Full explanation →
108
Multi-Selecthard

Which TWO statements about configuration groups in Junos are correct? (Choose two.)

Select 2 answers
A.Configuration groups are defined under the [edit groups] hierarchy.
B.Configuration groups are stored in separate files that are imported using the 'file' statement.
C.The 'apply-groups' statement is used to include a group's configuration at a specific hierarchy level.
D.The 'replace' tag is used to reference a configuration group.
E.Configuration groups are applied only at the [edit interfaces] hierarchy level.
AnswersA, C

Configuration groups are indeed defined under the 'groups' hierarchy and can be inherited.

Why this answer

Configuration groups in Junos are defined under the [edit groups] hierarchy. This allows you to create reusable configuration snippets that can be applied to multiple parts of the configuration, reducing duplication and simplifying management.

Exam trap

The trap here is that candidates often confuse configuration groups with Junos's 'apply-path' or 'apply-macro' features, or mistakenly think groups are external files, when in fact they are defined inline under [edit groups] and applied via 'apply-groups'.

Full explanation →
109
MCQeasy

Which configuration group feature allows an administrator to apply common configuration settings to multiple interfaces without repeating the configuration?

A.groups statement
B.interface-range
C.apply-groups
D.apply-path
AnswerC

The "apply-groups" statement is the correct feature; it references a named group defined under the "groups" hierarchy and applies that group's configuration to the current hierarchy level. When placed at a particular level, it causes the configuration from the referenced group to be merged or overlaid, providing inheritance and override capabilities. This is the standard method for reusing configuration blocks and applying them to multiple levels.

Why this answer

The `apply-groups` statement is the correct feature because it allows an administrator to define a common configuration template within a `groups` hierarchy and then apply that template to multiple interfaces (or other configuration sections) using the `apply-groups` command. This avoids repeating the same configuration statements across individual interfaces, streamlining management and reducing errors.

Exam trap

The trap here is that candidates confuse `groups` (the definition container) with `apply-groups` (the activation command), often selecting Option A because they think defining the group is sufficient, but without `apply-groups`, the group configuration is never applied.

How to eliminate wrong answers

Option A is wrong because `groups` is the container where common configuration is defined, but it is not the feature that applies the configuration to interfaces; without `apply-groups`, the group configuration is inactive. Option B is wrong because `interface-range` is a feature for creating a named range of interfaces to apply a single configuration block, but it is not a configuration group feature; it is used with `set interfaces interface-range <name>` and applies configuration directly, not via a reusable group template. Option D is wrong because `apply-path` is used to dynamically derive configuration values from the contents of a specified path in the configuration hierarchy (e.g., for BGP or firewall filters), not for applying common settings to multiple interfaces.

Full explanation →
110
MCQhard

What happens when a user issues the 'request system reboot' command without any options?

A.The device reboots after the current commit.
B.The device reboots immediately.
C.The device prompts for confirmation.
D.The device schedules a reboot in 5 minutes.
AnswerC

By default, 'request system reboot' is an interactive command that prompts for confirmation. When executed, it displays a message asking the user to confirm the action, and optionally warns about unsaved configuration changes. The user must respond affirmatively (typically 'yes' or 'y') before the device begins the reboot sequence. This confirmation step is a safety mechanism to prevent accidental reboots and is the default behavior unless the 'now' option is provided.

Why this answer

When a user issues the 'request system reboot' command without any options, Junos OS prompts for confirmation before proceeding. This is a safety mechanism to prevent accidental reboots, as the command does not automatically reboot the device immediately or schedule a delayed reboot by default.

Exam trap

The trap here is that candidates often assume 'request system reboot' behaves like a typical Linux 'reboot' command (immediate execution), but Junos requires explicit confirmation or the 'now' option to proceed without a prompt.

How to eliminate wrong answers

Option A is wrong because the 'request system reboot' command does not wait for a commit; it reboots the device immediately after confirmation, and the current configuration is already active. Option B is wrong because the command does not reboot immediately; it first prompts the user for confirmation to avoid unintended disruptions. Option D is wrong because the command does not schedule a reboot in 5 minutes; that behavior requires the 'at' or 'in' option (e.g., 'request system reboot at 12:00' or 'request system reboot in 5').

Full explanation →
111
MCQhard

An engineer is designing a network and needs to ensure that management traffic (SSH, SNMP) is always permitted, even if an interface firewall filter is applied. Which Juniper best practice should be followed?

A.Use a firewall filter that permits all management traffic at the top of the list on each interface
B.Apply a firewall filter on the loopback interface (lo0) to protect the device
C.Apply a firewall filter to the management interface (fxp0)
D.Disable the firewall filter on all interfaces
AnswerB

The loopback interface (lo0) represents the device's control plane, and all traffic destined to the device's own IP addresses—such as SSH, SNMP, BGP, and OSPF—is processed through it, regardless of the physical ingress interface. Applying a firewall filter to lo0 in the input direction provides a single, centralized point to secure management and routing protocol access. This Juniper-recommended practice ensures consistent protection and simplifies administration, as the filter is applied once rather than on every interface.

Why this answer

Applying a firewall filter to the loopback interface (lo0) is the Juniper best practice for protecting management traffic because the loopback interface is the logical termination point for all control plane traffic, including SSH and SNMP. This ensures that management traffic is always permitted regardless of which physical interface it arrives on, while still allowing interface-specific filters to be applied for data plane traffic without risk of blocking management access.

Exam trap

The trap here is that candidates often think management traffic must be permitted on each physical interface individually (Option A), not realizing that Junos uses the loopback interface as the central control plane filter point, making interface-specific filters unnecessary for management access.

How to eliminate wrong answers

Option A is wrong because placing a firewall filter that permits all management traffic at the top of the list on each interface is not scalable and can inadvertently allow unwanted traffic if the filter is misconfigured or omitted on a new interface; it also violates the principle of separating control plane and data plane filtering. Option B is wrong because it is actually the correct answer, not a wrong option. Option C is wrong because applying a firewall filter to the management interface (fxp0) only protects traffic arriving on that dedicated management port, but management traffic like SSH and SNMP can also arrive on other interfaces (e.g., ge-0/0/0), leaving the device unprotected on those paths.

Option D is wrong because disabling firewall filters on all interfaces removes all traffic filtering, which is not a best practice and would expose the device to unauthorized access or attacks.

Full explanation →
112
MCQeasy

A network engineer configures a static route to a remote network. They want the route to be automatically removed from the routing table if the directly connected interface used to reach the next hop fails. Which configuration approach should be used?

A.Configure a higher metric on the static route.
B.Configure a preference of 0 on the static route.
C.Configure the next-hop as an IP address.
D.Configure the next-hop as the interface name.
AnswerD

In Junos, specifying an interface name as the next-hop creates an interface-dependent static route that is installed only when that interface is present and operational. When the interface goes down, the route is automatically withdrawn from both the routing and forwarding tables, allowing immediate failover to any backup route. This is exactly the behavior needed to remove the route without relying on ARP timeout or reachability checks.

Why this answer

Configuring the next-hop as an interface name (e.g., ge-0/0/0) creates a static route that is automatically removed from the routing table when that interface goes down. This is due to the route being 'qualified' by the interface's operational state; if the interface fails, the route is withdrawn. In contrast, using an IP address as the next-hop does not tie the route to the interface's state, so the route remains even if the interface fails, as long as the next-hop is reachable via another path.

Exam trap

The trap here is that Cisco engineers often assume that specifying a next-hop IP address is the only valid way to configure a static route, but in Junos, using the interface name directly ties the route to the interface's state, which is the key to automatic removal upon interface failure.

How to eliminate wrong answers

Option A is wrong because configuring a higher metric on a static route does not cause it to be removed when an interface fails; metric (or cost) is used for route selection among multiple routes to the same destination, not for interface-based withdrawal. Option B is wrong because setting a preference of 0 makes the static route the most preferred route (lowest preference value), but it does not tie the route to the interface's operational state; the route remains even if the interface fails. Option C is wrong because configuring the next-hop as an IP address creates a static route that is not automatically removed when the directly connected interface fails; the route persists in the routing table unless the next-hop becomes unreachable via any interface, which may not happen if an alternate path exists.

Full explanation →
113
MCQeasy

You are a network administrator for a service provider that uses Juniper MX series routers to provide MPLS VPN services to customers. Management has requested that you implement a secure out-of-band management (OOBM) solution for all MX routers to ensure that management traffic is isolated from the production network, reducing the risk of unauthorized access and management plane attacks. You are tasked with designing the OOBM solution using a dedicated management interface (me0) and a separate management routing instance. Which of the following best practices should you follow?

A.Place me0 in the inet.0 routing table and rely on static routes
B.Enable VLAN tagging on me0 to separate management traffic into different subnets
C.Configure the me0 interface in the default routing instance with a simple ACL
D.Create a dedicated routing instance for management, assign me0 to it, and apply a firewall filter to restrict access
AnswerD

Creating a dedicated routing instance creates a separate RIB/FIB context for management, so me0's traffic never shares routes with production. Assigning me0 to that instance ensures incoming and outgoing management packets use only that isolated table. Applying a firewall filter on the interface or within the instance provides granular control over allowed sources/ports, while the routing-instance separation prevents transit use and route leakages. This combination is the recommended approach for out-of-band management isolation in Junos.

Why this answer

It follows Juniper's best practice for OOBM: creating a dedicated management routing instance (e.g., mgmt_junos) and assigning the me0 interface to it. This ensures management traffic is completely isolated from the production routing table (inet.0), preventing management plane attacks and unauthorized access. Applying a firewall filter on the me0 interface further restricts access to only authorized management hosts, aligning with security hardening guidelines.

Exam trap

The trap here is that candidates assume VLAN tagging (Option B) is a valid method for separating management traffic on any interface, but the me0 interface on Juniper MX routers does not support VLAN tagging as it is a dedicated Layer 3 out-of-band port, not a trunk port.

How to eliminate wrong answers

Option A is wrong because placing me0 in the inet.0 routing table mixes management traffic with production traffic, defeating the purpose of OOBM isolation and exposing the management plane to potential attacks. Option B is wrong because VLAN tagging on me0 is not supported; the me0 interface is a dedicated out-of-band management port that operates at Layer 3 and does not support subinterfaces or VLAN tagging. Option C is wrong because keeping me0 in the default routing instance (inet.0) does not isolate management traffic; a simple ACL is insufficient for full isolation, and the default instance is shared with production routes, violating OOBM principles.

Full explanation →
114
MCQhard

Refer to the exhibit. The route for 192.168.0.0/16 is hidden. What is the most likely reason?

A.The BGP next-hop is unreachable
B.The route has a lower local preference
C.The route has a longer AS path
D.The route has a higher MED value
AnswerA

In Junos, a BGP route is considered 'hidden' when it cannot be installed into the inet.0 routing table because its BGP next-hop address is not resolvable by an active IPv4 or IPv6 route. The route remains in the BGP database (Adj-RIB-In) but is excluded from forwarding and from best-path selection. Use 'show route protocol bgp hidden' to display such routes; as soon as next-hop reachability is restored, the route becomes visible and active.

Why this answer

In JUNOS, a BGP route is hidden when the next-hop address is not reachable via any active route in the routing table. The router cannot install the route into the forwarding table because it lacks a valid path to the next-hop, causing the route to be marked as hidden. This is a common issue when the next-hop is not covered by a directly connected or static route, or when the IGP route to the next-hop is missing.

Exam trap

The trap here is that candidates often confuse route selection attributes (like local preference, AS path, MED) with route installation conditions, assuming a less preferred attribute hides the route, when in fact only next-hop unreachability or policy-based rejection can cause a route to be hidden in JUNOS.

How to eliminate wrong answers

Option B is wrong because local preference is a BGP path attribute used for route selection within an AS, but it does not cause a route to be hidden; a lower local preference would simply make the route less preferred but still active. Option C is wrong because a longer AS path affects route selection by making the route less preferred, but it does not hide the route; the route remains visible in the routing table. Option D is wrong because a higher MED value influences route selection between multiple paths to the same prefix, but it does not cause a route to be hidden; the route would still be active if the next-hop is reachable.

Full explanation →
115
MCQmedium

An organization has two ISPs and wants to load-balance traffic equally across both links for all outbound traffic. Which routing configuration approach should be used?

A.Configure two static default routes with different metric values.
B.Configure policy-based routing to match all traffic and forward to both ISPs.
C.Configure two static default routes with equal metric values and enable ECMP.
D.Establish BGP sessions with both ISPs and rely on BGP path selection.
AnswerC

In Junos, two static default routes with equal metrics have the same preference and are both installed in the routing table as equal-cost paths. To actually balance traffic, you must enable ECMP, typically by configuring 'load-balance per-packet' in the forwarding options or a policy statement. This allows Junos to distribute flows across both ISPs while maintaining per-flow consistency, which is essential for TCP sessions.

Why this answer

Configuring two static default routes with equal metric values and enabling Equal-Cost Multi-Path (ECMP) allows the Juniper device to load-balance outbound traffic equally across both ISP links. ECMP uses per-flow or per-packet load balancing based on the hash of source/destination IP addresses and ports, ensuring traffic is distributed evenly without relying on dynamic routing protocols.

Exam trap

The trap here is that candidates often confuse metric (cost) with preference (administrative distance) in Junos, assuming that different metric values still allow load balancing, whereas Junos requires equal metric values for ECMP to activate.

How to eliminate wrong answers

Option A is wrong because configuring two static default routes with different metric values results in only the route with the lower metric being active in the routing table, providing failover but not load balancing. Option B is wrong because policy-based routing (PBR) can forward traffic based on match criteria, but it does not inherently load-balance equally across two links without additional configuration like filter-based forwarding and per-packet load balancing, which is not the standard approach for simple equal load sharing. Option D is wrong because establishing BGP sessions with both ISPs and relying on BGP path selection does not guarantee equal load balancing; BGP selects only the best path based on attributes like local preference and AS path length, and additional configuration (e.g., multipath) is required to enable ECMP for BGP routes.

Full explanation →
116
MCQeasy

A host needs to verify that its assigned IP address is not already in use on the network. Which type of packet does the host send?

A.ARP reply with its own MAC address
B.ARP request with target IP set to its own IP
C.Gratuitous ARP reply
D.ARP request with target IP set to the default gateway
AnswerB

The standard DAD probe is an ARP request with the sender IP and protocol address set to 0.0.0.0 and the target IP set to the host's own intended address, broadcast to the local segment. Per RFC 5227, the host then waits to see whether any device answers; if a reply or another ARP announcement arrives, the address is already in use. This is often called an ARP probe, and it explicitly asks the network 'does anyone own this IP?' before the host commits to it.

Why this answer

When a host wants to verify that its assigned IP address is not already in use on the network, it sends an ARP request with the target IP set to its own IP address. This is known as a gratuitous ARP request, and if another host responds with an ARP reply, it indicates an IP address conflict. This process is part of the Duplicate Address Detection (DAD) mechanism, commonly used in IPv4 networks to ensure uniqueness before the address is fully configured.

Exam trap

The trap here is that candidates often confuse a gratuitous ARP reply (used to announce an address) with a gratuitous ARP request (used for duplicate address detection), leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because an ARP reply with its own MAC address is a response, not a probe; the host must first send a request to check for conflicts, not assume its address is free. Option C is wrong because a gratuitous ARP reply is typically sent to update other hosts' ARP caches after an address is confirmed, not to detect duplicates; the detection phase uses a gratuitous ARP request (target IP = own IP). Option D is wrong because an ARP request with target IP set to the default gateway is used to resolve the gateway's MAC address for outbound traffic, not to verify the host's own IP address uniqueness.

Full explanation →
117
MCQmedium

You are a network engineer for a company that has just deployed a Juniper SRX firewall in a branch office. The device has multiple interfaces: ge-0/0/0 connected to the internet, ge-0/0/1 connected to the internal LAN (192.168.1.0/24), and ge-0/0/2 connected to a DMZ (10.0.0.0/24). After initial configuration, you attempt to ping from the SRX to a server on the internet (8.8.8.8) but receive no response. You also notice that internal users can access the internet. You have verified the routing table shows a default route via ge-0/0/0. The security policies appear correct. You suspect the issue is related to interface configuration. What is the most likely cause and the correct course of action?

A.The security policy from the trust zone to the untrust zone is blocking traffic; you should create a policy allowing all traffic from the SRX itself.
B.The interface ge-0/0/0 has an incorrect MAC address; you should clear the ARP cache.
C.The interface ge-0/0/0 is missing the 'host-inbound-traffic' configuration under its security zone; you should add the appropriate system services under the zone.
D.The default route is missing or incorrect; you should add a default route via the internet gateway IP.
AnswerC

This is the most likely cause because the device cannot initiate traffic without explicit host-inbound traffic settings.

Why this answer

The SRX can ping internal hosts but not the internet because the interface ge-0/0/0 is in the untrust zone, which by default blocks all inbound traffic, including pings originated from the device itself. The 'host-inbound-traffic' configuration under the security zone allows system services such as ping, SSH, and SNMP to be received on that interface. Without it, even though the routing table and security policies are correct, the SRX will drop its own outbound ICMP echo requests before they can be sent, or drop the replies if they are treated as inbound traffic.

Exam trap

The trap here is that candidates confuse transit security policies (which control traffic passing through the device) with host-inbound traffic controls (which manage traffic destined to the device itself), leading them to incorrectly modify security policies instead of enabling system services under the zone.

How to eliminate wrong answers

Option A is wrong because the security policy from trust to untrust controls traffic passing through the SRX, not traffic originated from the SRX itself; device-originated traffic is governed by the 'host-inbound-traffic' settings, not security policies. Option B is wrong because an incorrect MAC address would cause a failure to resolve the next-hop MAC, which would prevent all traffic (including internal users) from reaching the internet, but internal users can access the internet, so ARP is working. Option D is wrong because the routing table already shows a default route via ge-0/0/0, and internal users can access the internet, confirming the default route is correct.

Full explanation →
118
MCQhard

Your company operates a dual-homed network with two Juniper MX routers (R1 and R2) each connected to a different ISP. R1 uses BGP to receive a default route from ISP-A (preference 170), and R2 uses BGP to receive a default route from ISP-B (preference 170). Additionally, both routers have a static default route pointing to a local next-hop (192.0.2.1) with preference 5 for backup. R1 and R2 are connected via an internal link (10.0.0.0/30) and run OSPF to exchange internal routes. You notice that traffic from internal hosts is always exiting via R1's ISP-A link, even when R1's BGP session to ISP-A goes down. The OSPF routes are preferred. You want traffic to fail over to R2's ISP-B link when R1 loses its BGP default. Which configuration change should you make?

A.Increase the preference of the BGP default routes to 180 so that the static default is always preferred.
B.Configure a routing policy on R2 to reject the default route from ISP-B, forcing all traffic through R1.
C.Remove the static default route and rely on OSPF to propagate a default route from the router with the active BGP session.
D.Configure the static default route with a preference of 180 so that the BGP default routes (pref 170) are preferred when available.
AnswerD

This ensures BGP default is used when up, and OSPF routes to R2's default become active when R1's BGP is down.

Why this answer

The static default route currently has a preference of 5, making it preferred over the BGP default (preference 170) even when the BGP route is available. By raising the static default's preference to 180 (higher than BGP's 170), the BGP default will be chosen when present, and the static default will only be used as a backup when BGP is unavailable. This ensures traffic fails over to R2's ISP-B link when R1 loses its BGP default, as OSPF will propagate the default from R2.

Exam trap

The trap here is that candidates often assume static routes with a lower preference are always better, but the question requires the static route to act as a backup, so it must have a higher preference than the BGP route to be less preferred when the BGP route is available.

How to eliminate wrong answers

Option A is wrong because increasing the BGP default preference to 180 would make it less preferred than the static default (preference 5), causing the static route to always be used, which does not solve the failover issue. Option B is wrong because rejecting the default route from ISP-B on R2 would prevent R2 from having any default route, breaking failover entirely and not addressing the preference problem on R1. Option C is wrong because removing the static default route would leave no backup path; OSPF does not automatically propagate a default route unless explicitly configured with a default-information originate statement, and even then, the OSPF default would have a preference of 10 (or 150 for external routes), which could still be preferred over BGP's 170, potentially causing the same issue.

Full explanation →
119
MCQeasy

Which command displays the status of all configured interfaces, including administrative and operational status?

A.show interfaces terse
B.show configuration interfaces
C.show chassis hardware
D.show interface statistics
AnswerA

The 'show interfaces terse' command renders each interface on the device—including all configured interfaces—as a single line in a table with columns for Interface, Admin, Link, Proto, and Local address. Admin reflects the administrative state (up when not administratively disabled, regardless of the physical condition), Link reflects the actual operational state (up only when a valid carrier or signal is detected), and Proto indicates whether a protocol such as inet/IPv4 is active on the interface. Because it combines both the configured administrative state and the real-time operational state in one compact, easy-to-scan output, it is the standard quick check for interface health.

Why this answer

The 'show interfaces terse' command displays a concise summary of all interfaces, including their administrative status (up or down) and operational status (up or down), along with protocol states. This makes it the correct choice for quickly viewing the status of all configured interfaces in a single output.

Exam trap

The trap here is that candidates often confuse 'show interfaces terse' with 'show interface statistics' or 'show configuration interfaces', mistakenly thinking statistics or configuration output will show operational status, but only 'show interfaces terse' provides the concise admin and link status in a single view.

How to eliminate wrong answers

Option B is wrong because 'show configuration interfaces' displays the current configuration of interfaces, not their real-time operational or administrative status. Option C is wrong because 'show chassis hardware' shows physical hardware components (like FPCs, PICs, and power supplies), not interface status. Option D is wrong because 'show interface statistics' shows traffic counters and error statistics for interfaces, but does not explicitly display administrative or operational status in a summary format.

Full explanation →
120
Drag & Dropmedium

Arrange the steps to configure an IPsec VPN on a Junos SRX in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

IPsec VPN setup involves IKE for key exchange, IPsec for encryption, and binding to an interface.

Full explanation →
121
MCQhard

You are responsible for a Juniper MX router that connects two customer sites over a Layer 3 VPN. The router is configured with BGP for VPN routes and uses MPLS to forward traffic. Recently, the customer reported that traffic from Site A (10.0.1.0/24) to Site B (10.0.2.0/24) is intermittently failing. You check the routing table on the router and see that both routes are present with valid next-hops. However, when you ping from the router's loopback to the remote site's loopback, the ping succeeds. MPLS labels are being assigned and the LSP is up. You also notice that when the failure occurs, the router's BGP session to the remote PE is still established. The failure seems random and lasts a few seconds before recovering. Which troubleshooting step is most likely to identify the root cause?

A.Check the interface error counters for CRC errors or drops.
B.Review the forwarding table for the affected prefixes and check for any discrepancies.
C.Verify the BGP session state and check for route flapping.
D.Check the MPLS label switching table to ensure labels are correctly assigned.
AnswerB

The forwarding table may have stale entries or incorrect label operations causing intermittent forwarding failures.

Why this answer

The issue is intermittent packet loss with valid routes in the routing table but successful pings from the loopback. This points to a forwarding table (FIB) inconsistency, where the control plane (routing table) has the correct next-hop, but the forwarding plane (PFE) may have a stale or incorrect entry for the specific prefixes. Checking the forwarding table with 'show route forwarding-table' will reveal if the next-hop or label information differs from the routing table, which is a classic symptom of a hardware programming issue or a transient PFE problem.

Exam trap

The trap here is that candidates assume a successful ping from the loopback confirms end-to-end forwarding, but the loopback ping uses a different path (e.g., in-band management) and does not test the specific MPLS label path for the customer prefixes, masking the forwarding table discrepancy.

How to eliminate wrong answers

Option A is wrong because CRC errors or interface drops would cause persistent or pattern-based failures, not intermittent failures that last seconds and recover, and the ping from the loopback succeeds, indicating the interface is functional. Option C is wrong because the BGP session is established and not flapping, so route flapping is not the cause; the issue is in the forwarding plane, not the control plane session. Option D is wrong because MPLS labels are correctly assigned and the LSP is up, as confirmed by the successful ping from the loopback, so the label switching table is not the source of the intermittent failure.

Full explanation →
122
MCQeasy

Refer to the exhibit. What does the 'user' type indicate about the route?

A.The route is from the kernel.
B.The route was manually configured.
C.The route is a default route generated by the router.
D.The route was learned from a routing protocol.
AnswerB

The 'user' route type in Junos specifically indicates that the route was manually configured by an administrator, typically as a static route. When you see this type in the routing table, it confirms that the route was entered via configuration commands and not dynamically learned or automatically generated. This is a quick way to distinguish static routes from protocol-learned or kernel-derived routes in the routing table.

Why this answer

In Junos, the 'user' type in a route table indicates that the route was manually configured, typically via a static route statement under the 'routing-options' hierarchy. This distinguishes it from routes learned dynamically through routing protocols or derived from the kernel's interface addresses.

Exam trap

The trap here is that candidates often confuse 'user' with 'kernel' or 'direct' routes, mistakenly thinking any route not learned from a protocol must be kernel-generated, but Junos explicitly labels manually configured static routes as 'user' to differentiate them from kernel-derived interface routes.

How to eliminate wrong answers

Option A is wrong because the 'user' type does not indicate a kernel-derived route; kernel routes are typically marked with the 'kernel' type, which includes directly connected and local interface routes. Option C is wrong because a default route generated by the router (e.g., via a dynamic routing protocol or default-route advertisement) would show a protocol type like 'static', 'ospf', or 'bgp', not 'user'. Option D is wrong because routes learned from a routing protocol (e.g., OSPF, BGP, IS-IS) are marked with the respective protocol type (e.g., 'ospf', 'bgp'), not 'user'.

Full explanation →
123
MCQhard

Refer to the exhibit. What is the most likely cause of this BGP route being hidden?

A.The route has a higher preference than another route.
B.The BGP session to 10.0.0.2 is down.
C.The prefix 10.1.1.0/24 is filtered by an import policy.
D.The next-hop 192.168.100.1 is not reachable via any active route.
AnswerD

The reason given is 'next hop unreachable', so the next-hop is not reachable.

Why this answer

In JUNOS, a BGP route is hidden when the next-hop address is not reachable via any active route in the routing table. The show route protocol bgp command displays the route as hidden if the next-hop 192.168.100.1 is not resolvable, because BGP requires a valid IGP or static route to the next-hop for the route to be considered active and installed in the forwarding table.

Exam trap

The trap here is that candidates often confuse a hidden route with a route that is filtered by policy or has a higher preference, but JUNOS specifically uses the 'hidden' flag to indicate next-hop unreachability, not policy rejection or preference comparison.

How to eliminate wrong answers

Option A is wrong because a higher preference (lower administrative distance) would make the route more preferred, not hidden; hidden routes are not a result of preference comparison but of next-hop unreachability or policy filtering. Option B is wrong because if the BGP session to 10.0.0.2 were down, the route would not appear in the routing table at all, rather than being marked as hidden. Option C is wrong because if the prefix 10.1.1.0/24 were filtered by an import policy, the route would not be present in the routing table (neither active nor hidden), whereas a hidden route is still present but not usable due to next-hop issues.

Full explanation →
124
MCQhard

A router has two ISIS adjacencies to the same router, both with equal metrics. The router installs both routes in the routing table and performs load balancing. The network team wants to verify that both next-hops are being used for a particular destination. Which command provides this information?

A.`show route 10.0.0.0/24 extensive`
B.`show route forwarding-table destination 10.0.0.0/24`
C.`show route protocol isis`
D.`show route 10.0.0.0/24 detail`
AnswerB

`show route forwarding-table destination 10.0.0.0/24` is the authoritative command for verifying actual forwarding behavior. It displays the forwarding-table entry, where the next-hop has been resolved to a specific interface and IP address (e.g., via ARP or neighbor discovery), and it explicitly shows whether multiple next-hops are installed with equal weights for load balancing. This is the only command in the set that shows the PFE's forwarding state, so it directly answers which next-hops are used when forwarding packets to 10.0.0.0/24.

Why this answer

The `show route forwarding-table destination 10.0.0.0/24` command displays the actual forwarding entries in the Packet Forwarding Engine (PFE), including all next-hops used for load balancing. Unlike the routing table, the forwarding table shows which next-hops are actively installed and used for forwarding traffic, making it the definitive command to verify equal-cost multipath (ECMP) usage.

Exam trap

The trap here is that candidates assume `show route` commands (like `detail` or `extensive`) confirm actual forwarding behavior, but in Junos, only the forwarding table reveals which next-hops are truly used for packet forwarding, especially under ECMP.

How to eliminate wrong answers

Option A is wrong because `show route 10.0.0.0/24 extensive` shows detailed routing table information, including multiple next-hops, but it does not confirm which next-hops are actually used in the forwarding plane; it only shows the routing table state. Option C is wrong because `show route protocol isis` filters routes by protocol but does not provide per-destination next-hop usage or forwarding table details. Option D is wrong because `show route 10.0.0.0/24 detail` shows routing table details for a specific prefix, including multiple next-hops, but like option A, it does not verify the forwarding table's active next-hops for load balancing.

Full explanation →
125
MCQmedium

A network engineer suspects a hardware issue on an interface. Which command provides the most detailed hardware error counters, including CRC errors, framing errors, and runts?

A.show interfaces diagnostics optics
B.show interfaces detail
C.show interfaces extensive
D.show log messages
AnswerC

'show interfaces extensive' is the definitive operational command for hardware error analysis on Junos. It outputs each interface's input breakdown, including CRC errors, frame errors, runts, giants, and resource exhaustion, plus output error subcategories like carrier transitions and errors. It also reveals physical-layer state and multiple logical unit statistics, making it possible to correlate errors with transmit/receive activity. When you suspect a hardware fault, this command gives the most complete and structured view of interface health.

Why this answer

The 'show interfaces extensive' command provides the most detailed hardware error counters for a Junos interface, including CRC errors, framing errors, and runts. This command displays per-interface statistics at the physical layer, such as input errors, output errors, and specific error types like frame, runts, giants, and CRC errors, which are essential for diagnosing hardware issues.

Exam trap

The trap here is that candidates often confuse 'show interfaces detail' with 'show interfaces extensive', assuming 'detail' provides the most granular error counters, but only 'extensive' includes the full hardware error breakdown required for hardware fault diagnosis.

How to eliminate wrong answers

Option A is wrong because 'show interfaces diagnostics optics' is used to display optical transceiver diagnostics (e.g., temperature, voltage, laser bias) and does not show interface error counters like CRC or framing errors. Option B is wrong because 'show interfaces detail' provides more information than the basic output but does not include the extensive hardware error counters; it omits the per-error-type breakdown found in the extensive output. Option D is wrong because 'show log messages' displays system log messages, not real-time interface hardware error counters; it is used for troubleshooting events and errors logged by the system, not for granular interface statistics.

Full explanation →
126
Multi-Selecteasy

Which TWO commands can be used to view the system log messages on a Juniper device? (Select two.)

Select 2 answers
A.show log dcd
B.show log messages
C.monitor start messages
D.show log file
E.show system messages
AnswersB, C

Displays and tails the current log messages.

Why this answer

'show log messages' displays the contents of the default system log file, /var/log/messages, which contains kernel, daemon, and system-level messages. Option C is correct because 'monitor start messages' provides a real-time tail of the same /var/log/messages file, allowing live monitoring of system log entries as they are written.

Exam trap

The trap here is that candidates confuse the generic 'show log' syntax with a nonexistent 'show log file' command, or they mistakenly think 'show system messages' is valid because of similarity to other vendors' commands like 'show logging' on Cisco IOS.

Full explanation →
127
MCQeasy

A network administrator configures a static route on a Juniper device: `set routing-options static route 192.168.100.0/24 next-hop 10.0.0.1`. The administrator verifies the route is present in the routing table but notices it is not active. What is the most likely cause?

A.The route is not committed.
B.The next-hop address 10.0.0.1 is not reachable.
C.The preference of the static route is higher than 15.
D.The destination prefix is already learned via OSPF with a lower metric.
AnswerB

If the next-hop is not in the routing table, the static route is not active.

Why this answer

A static route becomes active only if the next-hop address is reachable via a directly connected or active route in the routing table. Since the administrator verified the route is present but not active, the most likely cause is that the next-hop 10.0.0.1 is not reachable (e.g., no ARP resolution or no interface with that subnet). Junos marks such routes as hidden or inactive until the next hop is reachable.

Exam trap

The trap here is that candidates often assume a static route is always active once configured and committed, overlooking Junos's requirement that the next-hop must be reachable via an active directly connected route for the route to be installed as active.

How to eliminate wrong answers

Option A is wrong because the route is already present in the routing table, which means it has been committed; an uncommitted route would not appear at all. Option B is the correct answer as explained. Option C is wrong because the default preference for static routes in Junos is 5, which is lower than 15, and a higher preference (worse) would not prevent activation—it would only affect route selection among multiple routes to the same prefix.

Option D is wrong because OSPF routes have a default preference of 10 (internal) or 150 (external), and a static route with preference 5 would be preferred over OSPF; moreover, the question states the route is not active, not that it is not preferred.

Full explanation →
128
MCQhard

A network engineer made several configuration changes on a Juniper QFX switch to implement new VLANs. After committing the changes, the engineer realized that the new configuration caused a critical loss of connectivity to the management network. The engineer needs to revert to the previous configuration that was working. The switch is still accessible via the console port, and the engineer has privilege level access. The previous configuration was committed two commits ago, and the current active configuration is the problematic one. Which action should the engineer take to restore the previous working configuration?

A.Use 'load override /config/juniper.conf.1.gz' followed by 'commit'.
B.Use 'delete system' to remove all configuration and then commit.
C.Execute 'rollback 0' followed by 'commit'.
D.Execute 'rollback 2' followed by 'commit'.
AnswerD

rollback 2 sets the candidate configuration to the snapshot saved two commit operations ago, stored as /config/juniper.conf.2.gz. This bypasses the two most recent commits, returning to the last known working configuration. A subsequent commit activates this as the new active configuration, effectively undoing the problematic changes.

Why this answer

The working configuration was committed two commits ago. The 'rollback 2' command loads the configuration from two commits prior into the candidate configuration. After that, 'commit' makes it active, restoring connectivity.

Note that 'rollback 1' would load the intermediate commit, which is also problematic, and 'rollback 0' refers to the current active configuration.

Exam trap

The trap here is confusing the rollback numbering: candidates often think 'rollback 0' reverts to a previous configuration, but it actually refers to the current active configuration, while 'rollback 1' is needed to go back one commit (the previous working state).

How to eliminate wrong answers

Option A is wrong because '/config/juniper.conf.1.gz' is the backup of the configuration that was active one commit ago, but using 'load override' loads that file into the candidate configuration without automatically applying it; however, the correct rollback command is simpler and more appropriate, and 'juniper.conf.1.gz' corresponds to the configuration before the last commit, not two commits ago. Option B is wrong because 'delete system' removes all system configuration, which would cause a complete loss of management access and is an irreversible destructive action, not a targeted rollback. Option C is wrong because 'rollback 0' reverts to the current active configuration (the problematic one), which does nothing to restore the previous working configuration.

Full explanation →
129
MCQhard

A company has two Juniper routers in a high-availability cluster with dual Routing Engines. The administrator performs a commit on the primary RE. What is the effect of using the 'commit synchronize' command?

A.It performs a commit check on both REs but does not activate the config.
B.It commits the configuration on both Routing Engines simultaneously.
C.It commits the configuration only on the primary RE.
D.It commits the configuration only on the backup RE.
AnswerB

The correct behavior is 'commit synchronize', a Junos command that loads and activates the candidate configuration on both the primary and backup Routing Engines simultaneously, ensuring they operate with identical active configurations. This is critical for high-availability clusters because it prevents config drift, so failover to the backup will use the same settings and policies as the primary. The simultaneous commit minimizes the window of inconsistency and is the standard method for configuring both REs in one operation.

Why this answer

The 'commit synchronize' command on Juniper routers with dual Routing Engines ensures that the configuration is committed on both the primary and backup REs simultaneously. This is critical for maintaining configuration consistency in a high-availability cluster, as it prevents a split-brain scenario where the backup RE has a different active configuration than the primary. The command performs a full commit (including validation and activation) on both REs, not just a check.

Exam trap

The trap here is that candidates often confuse 'commit synchronize' with 'commit check' or assume it only affects one RE, failing to recognize that Juniper's high-availability design requires explicit synchronization to maintain configuration consistency across both Routing Engines.

How to eliminate wrong answers

Option A is wrong because 'commit synchronize' performs a full commit (validation and activation) on both REs, not just a commit check; the 'commit check' command is used for validation only. Option C is wrong because 'commit synchronize' explicitly commits on both REs, not only the primary; committing only on the primary would leave the backup out of sync. Option D is wrong because 'commit synchronize' commits on both REs, not only the backup; committing only on the backup would not update the primary's active configuration.

Full explanation →
130
MCQmedium

A Junos device has multiple configuration files saved. Which command shows the available rollback configurations?

A.show system configuration
B.show system rollback
C.show configuration | display rollback
D.show system commit
AnswerD

'show system commit' is the correct operational-mode command because it lists every committed configuration on the device, along with its commit ID, timestamp, user, and optional comment. These commit IDs are the exact rollback identifiers used to restore or inspect previous configurations with 'rollback <id>' or 'show system rollback <id>'. Thus it provides the complete inventory of rollback points needed to answer the question.

Why this answer

The 'show system commit' command displays a list of all committed configuration revisions, including their commit IDs and timestamps, which are used to roll back to a previous configuration. The rollback feature in Junos relies on these stored commit files, and the command explicitly shows the available rollback points.

Exam trap

The trap here is that candidates familiar with Cisco IOS might expect a 'show rollback' command to list available rollbacks, but Junos uses 'show system commit' for this purpose, and 'show system rollback' only shows the content of a specific rollback when given an ID.

How to eliminate wrong answers

Option A is wrong because 'show system configuration' is not a valid Junos command; the correct command to view the current active configuration is 'show configuration'. Option B is wrong because 'show system rollback' is not a valid command; the correct command to view a specific rollback configuration is 'show system rollback <id>', but it does not list available rollback configurations. Option C is wrong because 'show configuration | display rollback' is not a valid syntax; the correct way to view a specific rollback configuration is 'show configuration rollback <id>', and the 'display rollback' option is used with 'show system commit' to show the configuration differences, not to list available rollbacks.

Full explanation →
131
MCQhard

A Juniper device fails to boot and stops at the 'loader>' prompt. What is the most likely cause of this issue?

A.Bad boot device or missing kernel
B.Corrupted configuration file
C.Hardware failure of the power supply
D.Missing root password
AnswerA

The loader prompt (typically 'loader>') is the bootloader's interactive menu, reached when it cannot locate a valid kernel to load. If the boot device is absent, unreadable, or the kernel file is missing/corrupt, the bootloader cannot proceed with the normal boot sequence and instead drops to this prompt for manual intervention. This is the expected symptom when storage or kernel integrity is compromised.

Why this answer

When a Juniper device stops at the 'loader>' prompt, it indicates that the boot process has failed to locate or load the kernel (juniper-kernel) from the boot device (e.g., internal flash, USB, or hard disk). This is typically caused by a corrupted boot device, missing kernel image, or incorrect boot device selection in the boot loader (UBoot or CFE). The loader prompt is a low-level environment used for recovery, not a sign of configuration or authentication issues.

Exam trap

The trap here is that candidates confuse a boot loader failure (loader prompt) with a configuration or authentication issue, assuming that any boot problem is due to a corrupted config or password, when in fact the loader prompt specifically indicates a missing or inaccessible kernel.

How to eliminate wrong answers

Option B is wrong because a corrupted configuration file would cause the device to boot but fail to load the configuration, resulting in the 'amnesiac' state or a request to enter recovery mode, not a stop at the 'loader>' prompt. Option C is wrong because a power supply failure would prevent the device from powering on at all, not allow it to reach the boot loader stage. Option D is wrong because a missing root password does not affect the boot process; it only prevents login after the system has fully booted, and recovery can be performed via the console or root password recovery procedure.

Full explanation →
132
MCQhard

During troubleshooting, an engineer needs to view real-time logging messages on a Junos device. Which command should be used?

A.file show /var/log/messages
B.monitor start messages
C.show log messages
D.traceoptions
AnswerB

Displays real-time log messages.

Why this answer

The 'monitor start messages' command enables real-time, tail-like display of the /var/log/messages log file on a Junos device, allowing the engineer to view new log entries as they are generated. This is the correct command for live troubleshooting because it continuously updates the terminal with incoming syslog messages, unlike static file viewing commands.

Exam trap

The trap here is that candidates often confuse 'show log messages' (a static snapshot) with 'monitor start messages' (a live streaming view), because both involve the 'messages' log file, but only the latter provides real-time output.

How to eliminate wrong answers

Option A is wrong because 'file show /var/log/messages' displays the entire contents of the log file at once, not in real-time, and is not suitable for monitoring live events. Option C is wrong because 'show log messages' displays the current contents of the messages log file but does not provide a live, streaming view; it shows a snapshot. Option D is wrong because 'traceoptions' is a configuration statement used to enable debug logging for specific protocols or features, not a command to view real-time log output.

Full explanation →
133
MCQhard

An operator wants to monitor the temperature and voltage sensors on a Juniper chassis. Which command displays current sensor readings?

A.show chassis environment
B.show chassis hardware
C.show system health
D.show log messages | match temperature
AnswerA

The `show chassis environment` operational command in Junos is the standard tool for environmental monitoring: it reads live temperature sensors, voltage rails, and fan speeds across the Routing Engine, line cards, and power supplies. Without any filters it returns current values for all monitored components, and with `detail` it also shows acceptable operating ranges and alarm thresholds. This is the only option that delivers a structured, real-time view of the exact sensors the operator asked about.

Why this answer

The 'show chassis environment' command displays real-time sensor readings for temperature, voltage, and fan status on Juniper devices. It is the standard operational command for monitoring chassis environmental health, directly matching the operator's requirement to check temperature and voltage sensors.

Exam trap

The trap here is that candidates may confuse 'show chassis hardware' (static inventory) with 'show chassis environment' (dynamic sensor data), or assume 'show system health' is a valid Junos command when it is not.

How to eliminate wrong answers

Option B is wrong because 'show chassis hardware' lists installed components (like FRUs, serial numbers, and part numbers) but does not display dynamic sensor readings such as temperature or voltage. Option C is wrong because 'show system health' is not a valid Junos command; the correct command for system health checks is 'request system health' or 'show chassis environment'. Option D is wrong because 'show log messages | match temperature' filters system log messages for temperature-related entries, but it does not show current sensor readings—it only displays historical log events that may be outdated or incomplete.

Full explanation →
134
MCQmedium

You are a network administrator for a large enterprise. You have a Juniper SRX firewall that is used as the primary internet gateway. Users are reporting that they are unable to access certain external websites. You check the device and find that the security policies appear correct, and the routing is in place. You suspect that the issue might be related to the DNS resolution. You want to verify that the device can resolve DNS names and that the DNS server configuration is correct. Which command should you use to test DNS resolution from the Juniper device?

A.show system connections
B.ping <external website FQDN>
C.traceroute <external website FQDN>
D.show dns name-server
AnswerB

When you execute 'ping <external website FQDN>' on Junos, the CLI first resolves the hostname to an IP address using the DNS servers configured under 'system name-server'. A successful resolution is shown directly in the output, where ping reports the target IP before sending ICMP requests. If the DNS query times out or fails, Junos returns a 'unable to resolve hostname' error, making this an effective, one-command DNS resolution test. Note that even if ICMP is blocked by the remote host, the appearance of the IP address in the output already confirms forward DNS works.

Why this answer

The `ping` command with a fully qualified domain name (FQDN) forces the Juniper device to perform a DNS resolution before sending ICMP echo requests. If the device cannot resolve the FQDN, the ping will fail with a 'hostname not found' error, directly indicating a DNS configuration or reachability issue. This tests both the DNS server configuration and the device's ability to resolve names, which is essential for verifying DNS functionality.

Exam trap

The trap here is that candidates often confuse `show dns name-server` with a valid operational command, but Junos uses `show configuration system name-server` to view DNS server settings, and the `ping` command with an FQDN is the standard method to test live DNS resolution from the device.

How to eliminate wrong answers

Option A is wrong because `show system connections` displays active TCP/UDP connections and their states, not DNS resolution capabilities or configuration. Option C is wrong because `traceroute` with an FQDN also triggers DNS resolution, but it is designed to trace the path to the destination and is less direct for simply testing DNS resolution; a failed traceroute could be due to routing or firewall issues rather than DNS. Option D is wrong because `show dns name-server` is not a valid Junos command; the correct command to view DNS server configuration is `show configuration system name-server`.

Full explanation →
135
MCQeasy

A network administrator notices that the CPU utilization on an MX240 router has been consistently above 90% for the past hour. Users are reporting intermittent connectivity issues. The administrator logs in and runs 'show system processes extensive' which shows the Routing Protocol Daemon (rpd) consuming 70% of the CPU. Further investigation reveals that the router has over 5000 BGP prefixes from multiple peers. The administrator suspects that the high CPU is due to continuous route processing. What should the administrator do to immediately reduce CPU load while maintaining network stability?

A.Perform a 'show log messages' to check for errors before taking action
B.Apply a prefix-limit on each BGP session to restrict the number of prefixes received
C.Bounce all BGP sessions by clearing them with 'clear bgp neighbor *'
D.Disable BGP multipath to reduce route processing
AnswerB

Applying a prefix-limit on each BGP session directly caps the number of routes that rpd must read, parse, and install in the RIB and BGP table. By rejecting excess updates (or tearing down the session when a threshold is exceeded), you stop route churn and table bloat at the source, which is the most effective way to lower CPU utilization. It also protects the router from a peer that advertises an abnormally large table due to misconfiguration or a route leak.

Why this answer

Applying a prefix-limit on each BGP session immediately restricts the number of prefixes the router will accept from peers. This prevents the Routing Protocol Daemon (rpd) from processing excessive BGP updates, reducing CPU load while maintaining network stability by keeping existing sessions and routes intact. The prefix-limit action (e.g., with a teardown threshold) ensures the router does not accept more prefixes than it can handle, directly addressing the root cause of high CPU usage.

Exam trap

The trap here is that candidates may confuse diagnostic actions (like checking logs) or disruptive resets (like clearing all BGP sessions) with immediate corrective measures, overlooking the targeted, non-disruptive solution of applying prefix limits to control route processing load.

How to eliminate wrong answers

Option A is wrong because checking logs ('show log messages') is a diagnostic step that does not reduce CPU load; it only gathers information, which is not an immediate action to alleviate the high CPU caused by continuous route processing. Option C is wrong because bouncing all BGP sessions with 'clear bgp neighbor *' would temporarily drop all BGP peers, causing a complete loss of routing information and network instability, and the CPU spike would likely recur when sessions re-establish and process the same 5000+ prefixes again. Option D is wrong because disabling BGP multipath does not reduce the number of prefixes being processed; it only affects how multiple equal-cost paths are used for forwarding, not the volume of route processing by rpd.

Full explanation →
136
MCQhard

You are the network engineer for a mid-sized enterprise with a Juniper MX router running Junos. The router has two uplinks to the internet: one to ISP-A via ge-0/0/0 (10.0.0.1/30) and one to ISP-B via ge-0/0/1 (10.0.0.5/30). You have configured static default routes to both ISPs: one to 10.0.0.2 and one to 10.0.0.6. Both routes have the same preference (default 5) and metric. You enabled ECMP to load-balance outbound traffic. After testing, you notice that all traffic is being sent only to ISP-A, and none to ISP-B. You verify that both interfaces are up and that the next-hop addresses are reachable. You check the routing table and see both routes are active but with different next-hop counts. What is the most likely cause of the traffic not being load-balanced?

A.One of the static routes resolves to multiple next hops, causing imbalance.
B.ECMP is not enabled in the forwarding-options.
C.The route to ISP-B is not active.
D.Hash-based load balancing requires per-packet configuration.
AnswerA

If one route resolves to multiple next hops, it may appear as multiple routes, skewing load balancing.

Why this answer

When both static default routes have the same preference and metric, Junos installs both in the routing table. However, ECMP load-balancing requires that each route resolve to a single next hop. If one static route resolves to multiple next hops (e.g., through a recursive lookup to a prefix with multiple paths), the route with a single next hop (ISP-A) becomes the sole active path for forwarding, while the multi-next-hop route (ISP-B) is not used for load balancing.

This explains why all traffic goes to ISP-A despite both routes being present.

Exam trap

The trap here is that candidates assume both routes are equally valid for ECMP simply because they appear in the routing table, but they overlook how recursive resolution can cause one route to have multiple next hops, breaking the equal-cost multipath condition.

How to eliminate wrong answers

Option B is wrong because ECMP is enabled by default in Junos when multiple equal-cost routes exist; no explicit 'forwarding-options' configuration is required for basic ECMP. Option C is wrong because the scenario states both routes are active in the routing table, so the route to ISP-B is indeed active. Option D is wrong because hash-based load balancing is the default behavior for ECMP in Junos; per-packet configuration is not needed for load balancing to occur, and the issue here is not about load-balancing mode but about next-hop resolution.

Full explanation →
137
MCQmedium

Your data center uses Juniper QFX5110 switches as leaf nodes in a Virtual Chassis Fabric (VCF) topology with QFX5100 as spine nodes. You are adding a new QFX5110 leaf node to the fabric. The new switch is physically connected to all spine nodes as per the cabling guidelines. However, after powering on the new switch, it does not automatically join the fabric. The existing fabric shows the new switch's member ID as 8, but it remains in 'standalone' state. The VCF has been operational for several months without issues. You check the configuration on the existing VC and notice that the 'virtual-chassis' configuration does not include the new member. What is the most likely reason the new switch does not join?

A.The new switch is running a different version of Junos that is not compatible with the fabric
B.The new switch does not have the same virtual-chassis ID configured as the existing fabric
C.The new switch is only connected to one spine node, and VCF requires full mesh connections to all spines
D.The new switch has 'set virtual-chassis no-split-detection' enabled, preventing it from joining
AnswerB

In a Juniper Virtual Chassis Fabric, every member must share the same virtual-chassis ID (VC-ID) to be recognized as part of the fabric. If the new leaf's VC-ID differs, it will not accept member-add requests and will remain isolated even though physically connected. The VC-ID is typically configured at initial provisioning, and mismatches manifest as the device failing to join the fabric.

Why this answer

In a Virtual Chassis Fabric (VCF), all member switches must share the same virtual-chassis ID to be recognized as part of the same fabric. The existing fabric has a configured virtual-chassis ID, but the new QFX5110, by default, has a different or no virtual-chassis ID set. Without a matching virtual-chassis ID, the new switch cannot join the fabric and remains in 'standalone' state, even though it is physically connected and assigned a member ID.

Exam trap

The trap here is that candidates may assume a switch with a member ID assigned has successfully joined the fabric, but in VCF, member ID assignment happens early in the discovery process and does not guarantee full integration—the switch must also have a matching virtual-chassis ID to move out of 'standalone' state.

How to eliminate wrong answers

Option A is wrong because Junos supports mixed software versions in a VCF only if they are within the same major release train and compatible; the question states the fabric has been operational for months, and version incompatibility would typically cause a different error (e.g., 'version mismatch') rather than a 'standalone' state with a member ID assigned. Option C is wrong because VCF does not require full mesh connections to all spines; the cabling guidelines for VCF typically require each leaf to be connected to at least two spines for redundancy, but a single connection would not prevent the switch from joining—it would still join and then potentially have forwarding issues. Option D is wrong because 'set virtual-chassis no-split-detection' is a feature used to disable split-brain detection in a Virtual Chassis (not VCF) and is not relevant to a new switch joining a VCF; it does not prevent a switch from joining the fabric.

Full explanation →
138
MCQmedium

Refer to the exhibit. An administrator wants to see authentication-related logs like SSH logins. In the current configuration, which log file contains this information?

A.utmp
B.interactive-commands
C.security
D.messages
AnswerD

The 'messages' file is the default syslog destination in Junos that captures a broad range of system events, including authentication and authorization messages. By default, the authentication facility is logged to /var/log/messages, so SSH login attempts (both successful and failed) appear there. This is confirmed by the 'show log messages' command, which reveals entries from sshd that contain 'Accepted password' or 'Failed password'.

Why this answer

In Junos, authentication-related logs such as SSH login attempts are recorded by default in the 'messages' log file. This file captures syslog messages for various system events, including authentication successes and failures. The 'interactive-commands' log file only logs user-executed CLI commands after successful login, not the authentication process itself.

The 'security' log is intended for firewall and security policy events, and 'utmp' is for user accounting. Therefore, option D is correct.

Exam trap

The trap is that candidates may assume interactive-commands logs authentication events because it records CLI commands, but authentication occurs before command logging begins. The default location for authentication logs is the messages file.

How to eliminate wrong answers

Option A is wrong because utmp is a Unix-style file that tracks currently logged-in users, not historical authentication logs; Junos does not use utmp for persistent logging of SSH logins. Option C is wrong because the 'security' log file is used for security-related events like firewall filters, NAT, and IPsec, not for authentication or SSH login logs. Option D is wrong because the 'messages' log file contains general system messages (e.g., kernel, interface, and daemon events) but does not specifically capture interactive command or authentication logs.

Full explanation →
139
MCQmedium

A network operator needs to backup the current configuration to a file on the local flash. Which command accomplishes this?

A.request system configuration rescue save
B.save /var/tmp/backup.conf
C.commit and-quit
D.show configuration | save /var/tmp/backup.conf
AnswerD

The `show configuration | save /var/tmp/backup.conf` command is the correct operational-mode method to back up the active configuration. `show configuration` displays the current committed configuration from operational mode, and the pipe to `save` redirects that output to a file, creating an ASCII text backup. This is a common practice for configuration archiving, as it captures exactly what is running without entering configuration mode. It is the only option that produces a usable backup file of the current configuration.

Why this answer

The correct command to backup the current configuration from operational mode is `show configuration | save /var/tmp/backup.conf`. This pipes the active configuration to the save command, writing it to the specified file. Option B (`save /var/tmp/backup.conf`) is a configuration mode command and will not work in operational mode.

Option A saves the rescue configuration, not the active configuration. Option C commits the configuration and exits but does not save to a file.

Exam trap

Watch out for the assumption that `save` alone works in operational mode — it is only available in configuration mode. The operational mode equivalent requires piping `show configuration` to `save`.

How to eliminate wrong answers

Option A is wrong because `request system configuration rescue save` saves the current active configuration as the rescue configuration, not to an arbitrary file path like `/var/tmp/backup.conf`. Option C is wrong because `commit and-quit` commits the candidate configuration and exits configuration mode, but does not save a backup copy to a file. Option D is wrong because `show configuration | save /var/tmp/backup.conf` saves the output of `show configuration` (which displays the active configuration) to a file, but this is a pipe to `save` that writes the text output, not a direct configuration backup command; it works but is less standard and can include formatting artifacts, whereas `save` is the proper operational-mode command for this task.

Full explanation →
140
MCQhard

A company is deploying an EVPN-VXLAN fabric with Juniper QFX switches. To provide inter-subnet routing, which interface type must be configured?

A.Physical interface with vlan-tagging
B.VXLAN tunnel endpoint (VTEP)
C.IRB interface
D.Loopback interface
AnswerC

An IRB (Integrated Routing and Bridging) interface is a logical, per-VLAN Layer 3 interface that provides the default gateway for hosts within that VLAN in an EVPN-VXLAN fabric. It bridges frames within the VLAN (via the bridging table) and routes packets between VLANs (via the routing table), enabling local inter-VLAN traffic without hair-pinning to an external router. This is exactly the required function: a Layer 3 gateway that is integrated with the VXLAN overlay, making IRB the correct answer.

Why this answer

In an EVPN-VXLAN fabric, Integrated Routing and Bridging (IRB) interfaces are required to provide inter-subnet routing. IRB interfaces act as Layer 3 gateways within the VXLAN overlay, enabling routing between different VLANs/VXLANs by terminating both the bridge domain and the routing instance. Without IRB, traffic cannot be routed between subnets in the EVPN-VXLAN fabric.

Exam trap

The trap here is that candidates often confuse VTEPs (which handle tunneling) with the routing function, mistakenly thinking that configuring a VTEP alone enables inter-subnet routing, when in fact an IRB interface is required to act as the Layer 3 gateway.

How to eliminate wrong answers

Option A is wrong because a physical interface with vlan-tagging is used for trunking multiple VLANs on a single physical port, but it does not provide Layer 3 routing between subnets in an EVPN-VXLAN fabric. Option B is wrong because a VXLAN tunnel endpoint (VTEP) is responsible for encapsulating and decapsulating VXLAN traffic, but it does not perform routing; routing requires a separate logical interface like IRB. Option D is wrong because a loopback interface is a virtual interface used for management, OSPF router ID, or BGP peering, but it cannot serve as a gateway for inter-subnet routing in the overlay.

Full explanation →
141
MCQmedium

An engineer configures a static route to 192.168.0.0/16 with next-hop 172.16.1.1. The static route appears as 'hidden' in the routing table. What is the most likely cause?

A.The static route preference is set too high
B.The next-hop address 172.16.1.1 is unreachable
C.The static route has not been committed
D.The static route is a discard route
AnswerB

For a static route to be installed, its next-hop address must be resolvable through an entry in the routing table. If 172.16.1.1 is not reachable—for instance, the directly connected subnet is down or no route to that address exists—Junos marks the route as hidden because the next-hop cannot be resolved. The route remains in the configuration and can be seen with 'show route protocol static hidden', but it is not placed in the forwarding table. This is the exact reason the route appears as hidden.

Why this answer

In JUNOS, a static route with a next-hop that is not reachable (i.e., there is no active route to the next-hop) is automatically placed in a 'hidden' state. The most likely cause is that the next-hop 172.16.1.1 is unreachable.

Exam trap

The trap is that candidates might think a hidden route is due to protocol preference or commit issues. In JUNOS, 'hidden' specifically indicates a next-hop resolution failure, meaning the next-hop address is not reachable via any active route.

How to eliminate wrong answers

Option A is wrong because a high preference (administrative distance) would cause the route to be present in the routing table but not selected as active (it would be a 'non-preferred' route, not 'hidden'). Option C is wrong because an uncommitted configuration would not appear in the routing table at all; 'hidden' routes are committed but not usable due to a reachability issue. Option D is wrong because a discard route (e.g., 'static route next-hop discard') is explicitly configured and appears as an active 'discard' route in the routing table, not as 'hidden'.

Full explanation →
142
MCQeasy

Refer to the exhibit. How many next hops are installed for the 10.1.1.0/24 route?

A.4
B.2
C.3
D.1
AnswerB

Two next hops are installed for the 10.1.1.0/24 route because Junos OS leverages Equal-Cost Multipath (ECMP). When the routing table contains multiple paths to a destination with identical metrics, Junos selects all of them. These paths are then installed as distinct next hops in the forwarding table, enabling traffic to be load-balanced. This directly addresses the question regarding the number of *installed* next hops.

Why this answer

The route 10.1.1.0/24 has two next hops installed because the routing table shows two distinct next-hop addresses (e.g., 192.168.1.1 and 192.168.2.1) under the same route entry. In JUNOS, when equal-cost paths exist, the route is installed with multiple next hops, and the count reflects the number of unique next-hop entries, not the number of interfaces or paths in a load-balancing set.

Exam trap

The trap here is that candidates often count the number of interfaces or paths shown in the output (e.g., two interfaces with two IPs each) and mistakenly think each interface represents a separate next hop, when JUNOS counts only the unique next-hop IP addresses.

How to eliminate wrong answers

Option A is wrong because 4 would imply four next hops, but the exhibit shows only two next-hop addresses for this route, not four. Option C is wrong because 3 would require three next hops, but the routing table output clearly lists two next hops. Option D is wrong because 1 would indicate a single next hop, but the route has two next hops due to ECMP (Equal-Cost Multi-Path) being active.

Full explanation →
143
MCQmedium

A Juniper router is configured with two static routes to the same destination network, both with the same preference. One route has a metric of 5, the other a metric of 10. Which route will be installed in the routing table?

A.Neither route is installed because they conflict
B.The route with metric 5 is installed
C.The route with metric 10 is installed
D.Both routes are installed with equal preference
AnswerB

Lower metric is preferred when preference is equal.

Why this answer

In JUNOS, when multiple static routes to the same destination have the same preference (administrative distance), the route with the lower metric is selected for installation in the routing table. Here, metric 5 is lower than metric 10, so the route with metric 5 is installed. This behavior follows the standard route selection process where preference is evaluated first, then metric (also called cost or next-hop metric) as a tiebreaker.

Exam trap

The trap here is that candidates often confuse metric with preference or assume that both routes will be installed for load balancing, but JUNOS requires equal metrics (and equal preferences) for ECMP, not just equal preferences.

How to eliminate wrong answers

Option A is wrong because static routes to the same destination with different metrics do not conflict; JUNOS can select one based on metric when preference is equal. Option C is wrong because the route with metric 10 is not installed; the lower metric (5) is preferred, not the higher one. Option D is wrong because both routes are not installed with equal preference; only the best metric route is installed, and JUNOS does not install multiple equal-preference static routes to the same destination unless they have equal metrics (and even then, only one is typically active).

Full explanation →
144
MCQeasy

A Juniper device receives several routes to the same destination prefix from different routing protocols. Which parameter is used first to select the active route?

A.Route preference (administrative distance)
B.Metric
C.AS path length
D.Local preference
AnswerA

Route preference (administrative distance) is the first criterion Junos uses when selecting the best route to a destination among routes from different routing protocols. Each protocol has a default preference value (e.g., OSPF 10, BGP 170), and the route with the lowest preference wins. Because these values are locally defined and universally comparable across protocols, they serve as the primary tie-breaker.

Why this answer

When a Juniper device receives multiple routes to the same destination prefix from different routing protocols, the route preference (also known as administrative distance) is the first tiebreaker used to select the active route. Each protocol has a default preference value (e.g., OSPF internal routes have a preference of 10, while static routes have a preference of 5), and the route with the lowest preference is chosen as active. This occurs before any metric or other path attribute is considered.

Exam trap

The trap here is that candidates often confuse route preference with metric, thinking that a lower metric from one protocol will automatically beat a higher metric from another protocol, but in reality, metric comparisons are only valid within the same routing protocol.

How to eliminate wrong answers

Option B is wrong because metric is only compared among routes from the same routing protocol (e.g., OSPF cost or BGP MED) and is not used to compare routes from different protocols. Option C is wrong because AS path length is a BGP-specific attribute used for path selection within BGP, not for comparing routes from different routing protocols. Option D is wrong because local preference is a BGP attribute used to influence outbound traffic within an AS and is only considered during BGP path selection, not across different routing protocols.

Full explanation →
145
MCQhard

Refer to the exhibit. Based on the log messages, what is the most likely cause of the interface flapping?

A.Faulty SFP module
B.MTU mismatch
C.Duplicate IP address
D.Spanning tree topology change
AnswerA

Rapid link up/down events (flapping) are often caused by physical layer issues such as a faulty SFP, loose cable, or bad fiber. This pattern is characteristic of hardware failure.

Why this answer

The log messages show repeated link up/down events (interface flapping). In Junos, interface flapping is most commonly caused by a faulty SFP module, as physical layer issues like degraded optics or loose connections trigger continuous link transitions. The logs typically show 'link up' followed by 'link down' without any protocol-level errors, pointing to a hardware fault rather than configuration mismatches.

Exam trap

The trap here is that candidates often attribute interface flapping to higher-layer issues like MTU or IP conflicts, but Junos logs physical link transitions (up/down) are almost always due to Layer 1 problems such as faulty optics, cables, or hardware, not configuration mismatches.

How to eliminate wrong answers

Option B is wrong because an MTU mismatch causes packet fragmentation or drops but does not cause the physical link state to toggle; it would generate error counters or ICMP messages, not interface up/down events. Option C is wrong because a duplicate IP address results in address conflict logs and connectivity issues, not physical interface flapping; Junos would log 'Duplicate IP address detected' or ARP-related errors. Option D is wrong because spanning tree topology changes affect forwarding state (blocking/forwarding) but do not cause the interface itself to go up/down; STP events would show 'STP topology change' in logs, not link state transitions.

Full explanation →
146
MCQhard

Refer to the exhibit. Why is the static route not active?

A.The OSPF route has a lower metric.
B.The static route's next-hop is not reachable.
C.The static route is not committed.
D.The static route has a higher preference than the OSPF route.
AnswerD

Junos uses preference to select the best route to a destination when multiple protocols offer a route. The default preference for static is 15, while OSPF internal routes have a default preference of 10. A higher preference value means less preferred, so OSPF's route is chosen as active, and the static route becomes inactive (but still in the routing table). This explains why the static route appears but is not used for forwarding.

Why this answer

Junos uses route preference (administrative distance) to select the active route when multiple routes to the same destination exist. By default, OSPF has a preference of 10, while a static route has a preference of 5. Since a lower preference value is more preferred, the static route should normally be active.

However, the question indicates the static route is not active, which implies the static route's preference has been manually set higher than OSPF's preference (e.g., static route preference > 10), causing OSPF to be selected as the active route.

Exam trap

The trap here is that candidates often confuse metric with preference, assuming a lower OSPF metric would override a static route, but in Junos, preference is the primary tiebreaker between different routing protocols, not metric.

How to eliminate wrong answers

Option A is wrong because OSPF metric (cost) is only compared among OSPF routes; route preference is evaluated first before metric when comparing routes from different protocols. Option B is wrong because if the static route's next-hop were not reachable, the route would be hidden or marked as unreachable, not simply inactive; the exhibit would show a 'hidden' flag or the route would not appear in the routing table. Option C is wrong because if the static route were not committed, it would not appear in the configuration or routing table at all; the exhibit shows the route exists, so it has been committed.

Full explanation →
147
Multi-Selecteasy

Which TWO statements about configuration storage in Junos are true?

Select 2 answers
A.The rescue configuration is stored in /config/rescue.conf.gz.
B.The rollback configurations are stored in /config/juniper.conf.0.gz, .1.gz, etc.
C.The active configuration is stored in /config/juniper.conf.gz.
D.The candidate configuration is stored in /config/.
E.The factory default configuration is stored in /etc/config/.
AnswersA, C

Rescue configuration is a special saved configuration.

Why this answer

The rescue configuration is stored as a compressed file at /config/rescue.conf.gz on Junos devices. This configuration is saved using the 'request system configuration rescue save' command and can be loaded with 'rollback rescue' to recover from a configuration that prevents the device from booting properly.

Exam trap

The trap here is that candidates often confuse the numbering of rollback files (thinking .0.gz is a rollback instead of the active configuration) or assume the candidate configuration is stored persistently on disk rather than existing only in memory until committed.

Full explanation →
148
Multi-Selecthard

Which THREE of the following statements are true regarding Junos OS commit operations?

Select 3 answers
A.The 'commit check' command validates the candidate configuration without activating it.
B.The commit command activates the candidate configuration.
C.The 'commit confirmed' command automatically rolls back if not confirmed within the timeout.
D.You can run multiple commit scripts during a single commit operation.
E.The rollback command reverts to the current active configuration.
AnswersA, B, C

It checks syntax and semantics without applying.

Why this answer

The 'commit check' command validates the candidate configuration for syntax and semantic errors without activating it. This allows an administrator to verify changes before making them active, preventing potential misconfigurations from disrupting network operations.

Exam trap

The trap here is that candidates often confuse 'rollback' with reverting to the current active configuration, when in fact 'rollback 0' refers to the current active configuration, and any other number refers to a previous committed configuration.

Full explanation →
149
MCQeasy

An engineer needs to view the current active configuration of a Junos device without making any changes. Which CLI mode should they use?

A.Operational mode
B.Privileged mode
C.Configuration mode
D.Exclusive configuration mode
AnswerA

Operational mode is the default Junos CLI state, where an engineer can execute read-only commands such as 'show configuration' and 'show interfaces'. It provides a complete view of the active configuration without permitting any direct edits. To change the configuration, the engineer must explicitly enter configuration mode, making operational mode strictly for monitoring and verification.

Why this answer

Operational mode is the default CLI mode in Junos, used for monitoring, troubleshooting, and viewing the current active configuration without making any changes. Commands in this mode are read-only and do not modify the device's configuration. The active configuration is the one currently running on the device, and it can be viewed using commands like 'show configuration' in operational mode.

Exam trap

The trap here is that candidates familiar with Cisco IOS may confuse 'Privileged mode' (which allows viewing and some changes) with Junos operational mode, but Junos strictly separates read-only (operational) and read-write (configuration) modes.

How to eliminate wrong answers

Option B is wrong because 'Privileged mode' is a Cisco IOS term, not a Junos CLI mode; Junos uses operational mode for read-only access and configuration mode for changes. Option C is wrong because Configuration mode is used to modify the candidate configuration, not just view the active configuration; entering this mode allows changes to be made. Option D is wrong because Exclusive configuration mode is a variant of configuration mode that locks the configuration database to prevent other users from making changes, but it still allows modifications and is not for read-only viewing.

Full explanation →
150
MCQmedium

You are a network engineer responsible for a Juniper MX240 router in a data center. The router is running Junos 18.2R1 and you need to upgrade it to 19.1R2 to fix a critical security vulnerability. You establish an SSH session to the router and enter configuration mode to prepare the upgrade. While in configuration mode, you notice that the candidate configuration contains several uncommitted changes from a previous engineer that attempted to modify BGP settings but introduced a syntax error. The candidate configuration fails any commit operation due to this error. The currently active configuration is stable and the router is handling production traffic. The upgrade process requires you to change the boot media and specify the new image. Which action should you take to clear the candidate configuration and proceed with the upgrade?

A.Reboot the router to clear the candidate configuration and then start the upgrade.
B.Execute the 'rollback 0' command to discard the candidate and replace it with the active configuration, then proceed with the upgrade commands.
C.Run the 'load override terminal' command and paste the active configuration from memory, then commit and upgrade.
D.Use the 'commit force' command to override the syntax error and commit the candidate, then perform the upgrade.
AnswerB

The 'rollback 0' command is the correct recovery action because it discards the entire candidate configuration and copies the last committed active configuration into the candidate, giving you a clean, syntactically valid starting point. This operation is local to the configuration database and does not affect the running system until you commit, so you can safely rollback, verify with 'show configuration', and then proceed with the standard software upgrade commands such as 'request system software add'.

Why this answer

The 'rollback 0' command discards all uncommitted changes in the candidate configuration and replaces it with the active, committed configuration. This clears the syntax error without affecting the running router, allowing you to proceed with the upgrade commands (e.g., 'request system software add') without a reboot or forced commit.

Exam trap

The trap here is that candidates may think a reboot is needed to clear uncommitted changes (Option A) or that 'commit force' can bypass syntax errors (Option D), when in fact Junos provides a dedicated 'rollback' command to safely discard the candidate configuration without impacting the active state.

How to eliminate wrong answers

Option A is wrong because rebooting the router would disrupt production traffic and is unnecessary; the candidate configuration is not stored in active memory that requires a reboot to clear. Option C is wrong because 'load override terminal' is used to load a configuration from a terminal session, not to discard the candidate; it would require manually pasting the active config, which is error-prone and redundant when 'rollback 0' exists. Option D is wrong because 'commit force' does not override syntax errors; it only bypasses certain validation warnings (e.g., missing root password), and a syntax error in the candidate will still cause the commit to fail.

Full explanation →
Page 1

Page 2 of 3

Page 3

All pages

123

Practice JN0-106 by domain

Target a specific domain to shore up weak areas.

User InterfacesJunos Configuration BasicsOperational Monitoring and MaintenanceRouting FundamentalsNetworking FundamentalsJunos OS Fundamentals
See all domains with question counts →