JN0-106 Junos Configuration Basics Practice Question
An engineer is designing a network and needs to ensure that management traffic (SSH, SNMP) is always permitted, even if an interface firewall filter is applied. Which Juniper best practice should be followed?
⚠ Common exam trap
Watch out — candidates often think management traffic must be permitted on each physical interface individually (Option A), not realizing that Junos uses the loopback interface as the central control plane filter point, making interface-specific filters unnecessary for management access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a firewall filter on the loopback interface (lo0) to protect the device
Applying a firewall filter to the loopback interface (lo0) is the Juniper best practice for protecting management traffic because the loopback interface is the logical termination point for all control plane traffic, including SSH and SNMP. This ensures that management traffic is always permitted regardless of which physical interface it arrives on, while still allowing interface-specific filters to be applied for data plane traffic without risk of blocking management access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a firewall filter that permits all management traffic at the top of the list on each interface
Why it's wrong here
Applying a per-interface firewall filter that permits all management traffic at the top of each list is inherently unscalable and error-prone. It requires careful, consistent configuration across every physical and logical interface, and any omission or ordering mistake leaves the device exposed. Furthermore, allowing all management traffic as a blanket permit at the top ignores source-address restrictions, so unauthorized hosts could reach management services if the filter is not finely tuned.
- ✓
Apply a firewall filter on the loopback interface (lo0) to protect the device
Why this is correct
The loopback interface (lo0) represents the device's control plane, and all traffic destined to the device's own IP addresses—such as SSH, SNMP, BGP, and OSPF—is processed through it, regardless of the physical ingress interface. Applying a firewall filter to lo0 in the input direction provides a single, centralized point to secure management and routing protocol access. This Juniper-recommended practice ensures consistent protection and simplifies administration, as the filter is applied once rather than on every interface.
- ✗
Apply a firewall filter to the management interface (fxp0)
Why it's wrong here
While fxp0 is the out-of-band management interface on some Juniper platforms, it is not universally present and does not handle in-band management traffic that arrives on data-plane interfaces. Relying solely on a filter applied to fxp0 would leave management protocols like SSH, SNMP, and BGP unprotected when they are accessed through network interfaces. The loopback filter is the preferred method because it catches all control-plane traffic, regardless of which interface it enters on, making it more reliable and consistent across device types.
- ✗
Disable the firewall filter on all interfaces
Why it's wrong here
Disabling firewall filters on all interfaces removes any protection for the control plane, leaving the device completely exposed to unauthorized access, denial-of-service attacks, and potential routing protocol manipulation. Management services such as SSH, SNMP, and Telnet would be reachable from any network, and routing adjacencies could be disrupted or hijacked. Firewall filters are a fundamental security mechanism on Junos, and disabling them directly contradicts Juniper's best practices for protecting network devices.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every JN0-106 question from scratch — 156 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.