JN0-106 Junos OS Fundamentals Practice Question
Exhibit
Refer to the exhibit. root@router> show log messages | match "login" Jun 15 10:30:22 router login: LOGIN FAILED FOR user1 FROM 10.0.0.2 Jun 15 10:30:25 router login: LOGIN FAILED FOR user1 FROM 10.0.0.2 Jun 15 10:30:28 router login: LOGIN FAILED FOR user1 FROM 10.0.0.2
Refer to the exhibit. A security analyst sees repeated login failures from 10.0.0.2 for user1. Which Junos feature can be used to automatically block further login attempts from that IP?
⚠ Common exam trap
Many candidates confuse control-plane policing (applied to lo0) with data-plane firewall filters applied to interfaces like ge-0/0/0, or mistakenly think that session limits or disabling accounts are automated responses to brute-force attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a firewall filter to the loopback interface that polices SSH traffic.
Applying a firewall filter to the loopback interface (lo0) that polices SSH traffic can automatically block further login attempts from a specific IP address, such as 10.0.0.2. The loopback interface is the termination point for all control-plane traffic on a Junos device, including SSH sessions. By configuring a firewall filter with a policer that limits the rate of SSH packets from a source IP, excessive login failures can trigger the policer to drop subsequent packets, effectively blocking the attacker without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSH to accept only public key authentication for user1.
Why it's wrong here
Disabling password authentication for user1 forces all SSH sessions for that account to use a public key, eliminating brute-force password guessing for that username. However, this change is user-specific and does nothing to block or throttle the source IP address that is generating the repeated login attempts; the attacker can still attempt other usernames or attack another service. A management-plane filter, not an authentication policy, is required to stop the network-level attack.
- ✗
Disable the user1 account.
Why it's wrong here
Disabling the user1 account removes that single user as a target, but it is a reactive measure that does not identify or stop the attacker. The offending IP remains active and can simply run the same brute-force attack against other valid accounts, and the login logs would still show repeated failures. This action also potentially breaks legitimate operations if user1 is a functional account, whereas the immediate concern is the source address.
- ✗
Set the 'session-limit' for user1 to prevent multiple login attempts.
Why it's wrong here
The 'session-limit' parameter in Junos limits the number of concurrent authenticated sessions that user1 may have open, not the number of failed login attempts or authentication failures. Repeated login failures occur serially and never establish a session, so this knob has no effect on the brute-force activity. It also does not address the IP address, so a single attacker can keep retrying regardless of the session limit.
- ✓
Apply a firewall filter to the loopback interface that polices SSH traffic.
Why this is correct
Applying a firewall filter to the loopback interface (lo0.0) is the correct way to protect the Routing Engine's own SSH service. A policer attached to the filter term for SSH traffic can rate-limit the number of packets or bytes per burst; once the configured rate is exceeded, the policer drops subsequent packets from that traffic class, which causes TCP retransmissions and effectively stops further login attempts. For a true per-source limit, the policer should be configured with 'prefix-specific' so that a single attacking IP cannot consume the aggregate allowance and deny SSH to all operators.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every JN0-106 question from scratch — 156 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.