JN0-106 Junos Configuration Basics Practice Question
Scenario: Your company has a Juniper SRX300 firewall used as a branch gateway. It runs Junos 15.1X49. The firewall has multiple security policies, NAT rules, and VPN tunnels. Recently, you added a new security policy to allow traffic from the internal network to a specific public server. After committing, you notice that the firewall is logging repeated denials for traffic that should be matched by the new policy. The policy appears correctly configured in the candidate configuration. You want to verify that the policy is actually active and check for any hidden rules that might be causing the issue. Which of the following is the most effective first step to troubleshoot this problem?
⚠ Common exam trap
Many candidates assume a correctly configured policy will automatically be applied, but Junos requires careful attention to policy order, and the exam tests whether you know to verify the active policy sequence rather than just the configuration syntax.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'show security policies detail' and examine the policy order to see if a previous policy is denying the traffic.
The most common cause of traffic being denied despite a seemingly correct new policy is that a preceding policy in the security policy order matches the traffic and denies it before the new policy is evaluated. Junos security policies are evaluated in sequential order from top to bottom, and the first matching policy is applied. Running 'show security policies detail' displays the active configured policy order, allowing you to see if an earlier policy is intercepting the traffic. Note: default policies are not shown with this command; use 'show security policies default' for that.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Roll back to the previous configuration to ensure the device is in a known state.
Why it's wrong here
Rolling back to the previous committed configuration is a reactive, disruptive measure that removes the new policy and returns the device to an older state without addressing the underlying cause. It does not reveal whether a previously existing policy is intercepting the traffic, and the same denial could recur even after rollback if the issue lies in policy ordering or other global settings.
- ✗
Run 'show configuration | display set | match policy' to verify the policy is present.
Why it's wrong here
The 'show configuration | display set | match policy' command displays the candidate configuration in set format, confirming that the policy exists in the configuration hierarchy, but it does not show the active, evaluated policy order at runtime. A policy can be present yet still be shadowed by an earlier rule; this command lacks the operational context needed to diagnose a traffic matching issue.
- ✓
Run 'show security policies detail' and examine the policy order to see if a previous policy is denying the traffic.
Why this is correct
The 'show security policies detail' command displays all active security policies in their actual evaluation order, including the specific match criteria, actions, and sequence numbers. By inspecting the order, you can quickly determine whether a preceding policy with a higher priority matches the same traffic and denies it before your new policy is ever reached, making it the most direct diagnostic for ordering problems.
- ✗
Check the firewall logs with 'show log messages | match deny' to see which policy is denying.
Why it's wrong here
Checking 'show log messages | match deny' is indirect and often misleading because 'show log messages' primarily displays system operations logs, not the dedicated security event stream where firewall deny logs are recorded unless specifically configured. Even if you locate a deny entry, it only tells you that a denial occurred, not which policy caused it or why it matched before your intended rule; examining the active policy order is far more definitive.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 326 original JN0-106 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.