Courseiva

CCNA Junos Os Fundamentals Questions

35 questions · Junos Os Fundamentals topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Drag & Dropmedium

Order the steps to configure a user account with a password in Junos.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct order to configure a user account in Junos involves setting both the class and authentication before committing. Options A and B are both valid sequences because the order of setting the class and authentication does not matter; the configuration is applied only upon commit. Option C is wrong because committing before setting the authentication leaves the user without a password.

Option D is wrong because committing before setting the class results in an incomplete user configuration with no privilege level.

Exam trap

Many candidates erroneously think that the order of class and authentication matters, but Junos does not enforce a specific order; both sequences work as long as all parameters are configured before commit.

Practice this question →
2
MCQmedium

A network administrator is configuring a new interface and wants to ensure that the interface is enabled and can pass traffic. Which configuration element is required?

A.set interfaces ge-0/0/0 enable
B.set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24
C.set interfaces ge-0/0/0 unit 0 family inet
D.set interfaces ge-0/0/0 disable
AnswerB

This command assigns an IPv4 address to unit 0 on ge-0/0/0, which automatically creates the logical interface and ties the inet address family to it. Once the address is committed, the interface is implicitly enabled and becomes operationally eligible to carry traffic. This is the correct minimal configuration for the task because it provides the required IP details and activates the interface without needing any additional 'enable' statement.

Why this answer

In Junos, an interface is administratively enabled by default (no explicit 'enable' command is needed), but to pass traffic it requires a logical unit with a configured protocol family and an IP address. The command 'set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24' creates unit 0, assigns the IPv4 address, and implicitly enables the interface for traffic forwarding. Without an address under a family, the interface cannot pass IP traffic even if it is administratively up.

Exam trap

The trap here is that candidates familiar with Cisco IOS may expect an explicit 'no shutdown' command (or an 'enable' keyword) to bring an interface up, but Junos interfaces are enabled by default, and the critical missing piece is the IP address under the logical unit, not an administrative enable command.

How to eliminate wrong answers

Option A is wrong because Junos does not have an 'enable' knob at the interface level; interfaces are administratively enabled by default, and the correct way to disable them is with 'disable'. Option C is wrong because 'set interfaces ge-0/0/0 unit 0 family inet' only enables the IPv4 protocol family on the logical unit but does not assign an IP address, so the interface cannot pass traffic (no local route or ARP entry is generated). Option D is wrong because 'set interfaces ge-0/0/0 disable' explicitly disables the interface, preventing it from passing any traffic, which is the opposite of the requirement.

Practice this question →
3
MCQmedium

A network engineer needs to upgrade Junos on an MX router with dual Routing Engines (RE0 and RE1). What is the recommended procedure to minimize downtime?

A.Upgrade the primary RE first, then the backup
B.Reboot both REs at the same time after copying the image
C.Upgrade the backup RE, perform a graceful switchover (RESTART ROUTING), then upgrade the former primary
D.Upgrade both REs simultaneously using the same image
AnswerC

This is the standard upgrade procedure for dual RE systems, minimizing traffic impact.

Why this answer

It minimizes downtime by first upgrading the backup RE (RE1), then performing a graceful Routing Engine switchover (using the 'request chassis routing-engine master switch' command or equivalent), which causes the upgraded backup to become the new primary without disrupting traffic. After the switchover, the former primary (now the backup) can be upgraded and rebooted, ensuring that at least one RE is always processing traffic and routing protocols like BGP and OSPF maintain their adjacencies.

Exam trap

The trap here is that candidates assume upgrading the primary first is safer or more logical, but Junos requires upgrading the backup first and performing a graceful switchover to maintain control plane continuity and avoid traffic loss.

How to eliminate wrong answers

Option A is wrong because upgrading the primary RE first forces a reboot of the active RE, causing immediate traffic disruption and routing protocol convergence delays, which defeats the purpose of dual REs for high availability. Option B is wrong because rebooting both REs simultaneously removes all redundancy and causes a complete outage, as no RE is available to forward traffic or maintain routing state. Option D is wrong because upgrading both REs at the same time (even with the same image) requires simultaneous reboots, which again eliminates redundancy and leads to downtime; Junos does not support in-service software upgrade (ISSU) across both REs in parallel.

Practice this question →
4
MCQeasy

A junior administrator wants to view the current active configuration on a Juniper device. Which operational mode command should be used?

A.show configuration | display set
B.show system services
C.show interfaces terse
D.show configuration
AnswerD

This command displays the current active configuration in hierarchy format.

Why this answer

The 'show configuration' command displays the current active configuration in the candidate configuration format, which is the configuration that is currently committed and running on the Juniper device. Option D is correct because it directly retrieves the active configuration from the /config/juniper.conf file, which is the authoritative source for the operational configuration.

Exam trap

The trap here is that candidates confuse the 'show configuration' command with the 'show | display set' pipe modifier, thinking the latter is a separate command to view the active configuration, when in fact it is just an output formatting option.

How to eliminate wrong answers

Option A is wrong because 'show configuration | display set' displays the configuration in a set-based format, which is a representation of the configuration but not the default active configuration view; it is a pipe modifier that changes the output format, not the command to view the active configuration. Option B is wrong because 'show system services' displays the status of system services like SSH, Telnet, or FTP, not the device's configuration. Option C is wrong because 'show interfaces terse' displays a summary of interface status and configuration, but it does not show the full active configuration of the device.

Practice this question →
5
Multi-Selecteasy

Which TWO statements describe correct methods to enter configuration mode? (Choose two.)

Select 3 answers
A.Type 'edit' at the operational mode prompt.
B.Type 'configure exclusive' at the operational mode prompt.
C.Type 'configure' at the operational mode prompt.
D.Type 'cli' at the operational mode prompt.
E.Type 'expert' at the operational mode prompt.
AnswersA, B, C

Correct: The 'edit' command is a direct method to enter configuration mode from operational mode.

Why this answer

The 'edit' command transitions from operational mode into configuration mode. Option B is correct because the 'configure exclusive' command enters configuration mode in exclusive mode, which is a valid method. Option C is correct because the 'configure' command enters configuration mode in shared mode.

Options D and E are invalid commands in Junos OS.

Exam trap

Candidates may mistakenly think only 'edit' and 'configure' are correct, but 'configure exclusive' is also a valid method. The question asks for two statements; any two of the first three are correct.

Practice this question →
6
MCQhard

A technician notices that the /var partition on a Junos device is 95% full. Which action will immediately free up disk space without affecting device operation?

A.Delete unused software packages using 'request system software delete'
B.Reboot the device
C.Remove the /var/log directory
D.Clear log files using 'clear log messages'
AnswerD

Using 'clear log messages' is the correct immediate action because it truncates the active log files under /var/log (specifically /var/log/messages) and instantly releases all allocated blocks to the filesystem, freeing space in /var without requiring a reboot or commit. The syslog daemon continues writing to the file, which is recreated/truncated gracefully, so no logging interruption or packet loss occurs. This targeted approach addresses the symptom—a full /var partition—while preserving all other system files and services.

Why this answer

The 'clear log messages' command immediately removes the contents of the active log files (e.g., messages, interactive-commands) without requiring a reboot or affecting running processes. This directly frees up space in /var/log, which is a primary consumer of the /var partition, while leaving the directory structure intact so logging continues normally.

Exam trap

The trap here is that candidates may think rebooting (Option B) clears all temporary files and logs, but Junos does not automatically delete persistent log files on reboot; only volatile /tmp is cleared, so /var remains full.

How to eliminate wrong answers

Option A is wrong because 'request system software delete' removes inactive software packages from /var/sw/pkg, but if the /var partition is 95% full due to log files, this action may not free significant space and could be unnecessary; also, it does not immediately address the most common cause of /var fullness. Option B is wrong because rebooting the device does not delete any files; it only clears temporary runtime data in /tmp and /var/tmp, but persistent log files in /var/log remain, so disk space is not freed. Option C is wrong because removing the /var/log directory would break logging functionality, cause loss of forensic data, and potentially disrupt system operations (e.g., syslogd may fail to start), which violates the requirement of not affecting device operation.

Practice this question →
7
MCQmedium

A company has multiple Juniper devices and wants to standardize configuration snapshots for backup and audit purposes. What is the best practice?

A.Run 'commit and-quit' to save the configuration to the flash
B.Use 'show configuration | save /var/tmp/config.txt' and then transfer the file via SCP to a backup server
C.Use the 'file archive' command to create a backup of the configuration
D.Use the 'show configuration | no-more' command and copy the output manually
AnswerB

This automates the backup and stores a retrievable file.

Why this answer

It uses the 'show configuration | save' command to write the current active configuration to a file in /var/tmp, which can then be securely transferred via SCP to a backup server. This is the standard Junos method for creating a portable, text-based snapshot of the configuration for backup and audit purposes, as it preserves the exact configuration syntax and can be easily compared or restored.

Exam trap

The trap here is that candidates may confuse the 'commit and-quit' command (which commits and exits) with a backup mechanism, or assume that 'file archive' is the correct tool for capturing configuration output, when in fact Junos requires explicit piping of the configuration output to a file for reliable backups.

How to eliminate wrong answers

Option A is wrong because 'commit and-quit' is not a valid Junos command; the correct command is 'commit and-quit' (with a space) which commits the configuration and exits the configuration mode, but it does not save a separate snapshot file to flash—it only activates the candidate configuration. Option C is wrong because the 'file archive' command is used to compress or archive files, not to capture the active configuration; it operates on existing files, not on the output of a 'show' command. Option D is wrong because 'show configuration | no-more' only displays the configuration without paging, but it does not save the output to a file; manually copying the output is error-prone and not a scalable or auditable practice for standardized backups.

Practice this question →
8
MCQmedium

Refer to the exhibit. The network administrator made a change that caused connectivity loss. They need to revert to the configuration before the most recent commit. Which command would accomplish this?

A.rollback 0
B.rollback 3
C.rollback 2
D.rollback 1
AnswerD

rollback 1 loads the configuration that was committed before the most recent commit. Because the administrator's latest change caused the connectivity loss, this returns the network to the exact working state immediately prior to that change. It is the only rollback target that precisely reverts the faulty modification while preserving all earlier configuration data.

Why this answer

In Junos, rollback numbers are stored with 0 being the most recent committed configuration. To revert to the configuration before the most recent commit, you need to load the configuration that was active before that change. That is rollback 1, which represents the second most recent commit.

Using rollback 0 would load the configuration that caused the issue, not fix it.

Exam trap

Many candidates mistakenly believe that rollback 0 undoes the last change. However, rollback 0 loads the most recent committed configuration—the one that caused the connectivity loss—so it would reload the problem, not fix it. To revert to the configuration before the last commit, you must use rollback 1.

How to eliminate wrong answers

Option B (rollback 3) is wrong because rollback 3 refers to the configuration from three commits ago, not the most recent commit. Option C (rollback 2) is wrong because rollback 2 refers to the configuration from two commits ago. Option D (rollback 1) is wrong because rollback 1 refers to the configuration immediately before the last commit, which is the same as the current active configuration after the last commit, not the configuration before the most recent commit.

The key distinction is that rollback 0 is the most recent commit, while rollback 1 is the previous commit.

Practice this question →
9
MCQmedium

A junior engineer is troubleshooting connectivity issues and wants to trace the path packets take to a remote destination. Which Junos command should be used?

A.monitor traffic
B.show route
C.traceroute
D.ping
AnswerC

traceroute is the correct tool because it actively probes the network path by sending packets with incrementally increasing TTL values, then collects the ICMP TTL-exceeded messages sent back by each router in turn. This reveals the sequence of IP addresses of every hop along the route to the destination, along with round-trip times for each hop, thus mapping the actual forwarding path hop by hop.

Why this answer

The 'traceroute' command in Junos is specifically designed to trace the path packets take to a remote destination by sending UDP probes with increasing TTL values and analyzing ICMP Time Exceeded messages from intermediate routers. This directly addresses the junior engineer's need to map the Layer 3 path and identify where connectivity failures occur.

Exam trap

The trap here is that candidates often confuse 'ping' (which tests reachability) with 'traceroute' (which traces the path), leading them to select Option D when the question explicitly asks for path tracing rather than simple connectivity testing.

How to eliminate wrong answers

Option A is wrong because 'monitor traffic' is used for real-time packet capture and analysis on an interface, not for tracing the path to a remote destination. Option B is wrong because 'show route' displays the routing table entries on the local device, showing how the local router would forward packets, but it does not actively trace the path taken by packets across multiple hops. Option D is wrong because 'ping' tests reachability and measures round-trip time to a destination, but it does not provide hop-by-hop path information or identify intermediate routers.

Practice this question →
10
MCQeasy

What is the primary function of the fxp0 interface on a Juniper device?

A.Internal routing
B.Management interface
C.Loopback testing
D.Data plane forwarding
AnswerB

fxp0 is specifically engineered as an out-of-band management interface, providing administrative access to the device via protocols like SSH, SNMP, and syslog. It is isolated from the data plane and much of the control plane, operating in its own management routing instance, so management connectivity remains available even when the network interfaces are down or the device is not forwarding traffic. This separation allows network operators to recover and configure a device remotely during outages, making fxp0 essential for lifecycle management.

Why this answer

The fxp0 interface is a dedicated out-of-band management Ethernet port on Juniper devices, used exclusively for management traffic such as SSH, SNMP, and syslog. It is separate from the data plane and control plane forwarding interfaces, ensuring administrative access remains available even if the routing or forwarding planes are disrupted.

Exam trap

The trap here is confusing fxp0 with loopback (lo0) or internal RE interfaces, leading candidates to incorrectly select internal routing or loopback testing, when in fact fxp0 is solely for out-of-band management.

How to eliminate wrong answers

Option A is wrong because internal routing between REs or between RE and PFE uses the internal fxp1 or fxp2 interfaces, not fxp0. Option C is wrong because loopback testing is performed on the lo0 interface, which provides a stable IP address for the router and is used for protocols like OSPF and BGP, not for management access. Option D is wrong because data plane forwarding is handled by network interfaces (e.g., ge-, xe-, et-) and the Packet Forwarding Engine (PFE), while fxp0 is strictly an out-of-band management interface that does not participate in forwarding transit traffic.

Practice this question →
11
MCQhard

Refer to the exhibit. A security analyst sees repeated login failures from 10.0.0.2 for user1. Which Junos feature can be used to automatically block further login attempts from that IP?

A.Configure SSH to accept only public key authentication for user1.
B.Disable the user1 account.
C.Set the 'session-limit' for user1 to prevent multiple login attempts.
D.Apply a firewall filter to the loopback interface that polices SSH traffic.
AnswerD

Applying a firewall filter to the loopback interface (lo0.0) is the correct way to protect the Routing Engine's own SSH service. A policer attached to the filter term for SSH traffic can rate-limit the number of packets or bytes per burst; once the configured rate is exceeded, the policer drops subsequent packets from that traffic class, which causes TCP retransmissions and effectively stops further login attempts. For a true per-source limit, the policer should be configured with 'prefix-specific' so that a single attacking IP cannot consume the aggregate allowance and deny SSH to all operators.

Why this answer

Applying a firewall filter to the loopback interface (lo0) that polices SSH traffic can automatically block further login attempts from a specific IP address, such as 10.0.0.2. The loopback interface is the termination point for all control-plane traffic on a Junos device, including SSH sessions. By configuring a firewall filter with a policer that limits the rate of SSH packets from a source IP, excessive login failures can trigger the policer to drop subsequent packets, effectively blocking the attacker without manual intervention.

Exam trap

The trap here is that candidates often confuse control-plane policing (applied to lo0) with data-plane firewall filters applied to interfaces like ge-0/0/0, or mistakenly think that session limits or disabling accounts are automated responses to brute-force attacks.

How to eliminate wrong answers

Option A is wrong because configuring SSH to accept only public key authentication for user1 does not automatically block repeated login failures from 10.0.0.2; it only changes the authentication method, and failed public key attempts could still occur. Option B is wrong because disabling the user1 account is a manual, static action that does not automatically respond to repeated login failures from a specific IP; it also prevents legitimate access for that user. Option C is wrong because the 'session-limit' for user1 limits the number of concurrent sessions, not the rate of login attempts; it does not block repeated failed logins from a single IP address.

Practice this question →
12
MCQeasy

A junior network administrator is setting up a Juniper MX router for the first time. After powering on the device, the administrator notices that the LED on the front panel blinks amber and the device does not complete the boot process. The console displays messages reporting file system errors. The administrator has no previous configuration changes and the device was shipped with factory defaults. Which action should the administrator take to resolve the boot issue?

A.Boot into single-user mode and run file system checks.
B.Perform a password recovery procedure to gain access.
C.Use the 'request system software add' command from the boot loader.
D.Reinstall the Junos OS using a USB flash drive with the software image.
AnswerA

Entering single-user mode (e.g., by interrupting the boot process at the U-Boot loader and issuing `boot -s`) provides a maintenance shell before normal Junos processes start. From there, you can manually run filesystem consistency checks with `fsck` (or `check`) on the root and /var partitions. Repairing corrupted metadata in this mode is the standard first-line recovery step for a device that fails to boot cleanly, as it addresses the underlying filesystem errors without the risk of an immediate full reinstall.

Why this answer

The amber blinking LED and file system errors indicate a corrupted file system, which is common on factory-default devices if the flash memory was not properly initialized. Booting into single-user mode (option A) allows the administrator to run 'fsck' (file system check) to repair the root file system without loading the full Junos OS, which is the standard recovery procedure for such boot failures.

Exam trap

The trap here is that candidates may confuse a boot failure due to file system corruption with a password issue or a need to reinstall the OS, but the amber LED and file system error messages point directly to a corrupted file system that can be repaired with fsck in single-user mode.

How to eliminate wrong answers

Option B is wrong because password recovery is used to reset login credentials, not to repair file system corruption; the device cannot boot, so password recovery is irrelevant. Option C is wrong because 'request system software add' is a Junos CLI command that requires a fully booted system, not the boot loader; the boot loader does not support this command. Option D is wrong because reinstalling Junos OS from a USB is a more drastic step that should only be taken if file system checks fail; it is not the first-line action for file system errors on a factory-default device.

Practice this question →
13
MCQmedium

A network administrator makes several changes to the configuration but decides to discard all uncommitted changes and start fresh. Which command should be used to revert the candidate configuration back to the current active configuration?

A.load override
B.rollback 0
C.commit check
D.rollback 1
AnswerB

rollback 0 discards all uncommitted changes and reloads the candidate configuration to exactly match the current committed (active) configuration. The index 0 always points to the most recent commit, so this operation cleans the candidate without altering the running configuration. Since the administrator simply wants to start fresh from the last committed state, rollback 0 is the precise command. Note that you still must issue a commit to make any further changes active, but no commit is required to just discard edits.

Why this answer

The 'rollback 0' command reverts the candidate configuration to the currently active configuration, discarding all uncommitted changes. This is because Junos maintains a rollback database of the last 50 committed configurations, with index 0 always representing the active configuration. Using 'rollback 0' effectively resets the candidate configuration to match the active one, allowing the administrator to start fresh without affecting the running system.

Exam trap

The trap here is that candidates often confuse 'rollback 0' with 'rollback 1', mistakenly thinking that 'rollback 1' discards uncommitted changes, when in fact 'rollback 1' reverts to the previous committed configuration, which would undo the last commit and potentially cause service disruption.

How to eliminate wrong answers

Option A is wrong because 'load override' replaces the entire candidate configuration with the contents of a specified file, not with the current active configuration; it does not discard uncommitted changes by reverting to the active config. Option C is wrong because 'commit check' validates the syntax and semantics of the candidate configuration without committing it, and does not discard any changes. Option D is wrong because 'rollback 1' reverts to the previous committed configuration (the one before the most recent commit), not to the current active configuration; this would discard the last committed changes, not just uncommitted ones.

Practice this question →
14
MCQmedium

You are a network engineer at a company that operates a pair of Juniper SRX firewalls in an active/passive cluster (Chassis Cluster). The cluster has been running Junos 15.1X49-D100 for over a year. Management has mandated an upgrade to a newer version to address security vulnerabilities. You follow the recommended upgrade procedure and successfully upgrade the primary node (node0) first, then failover to make node0 the backup, and upgrade the new primary (node1). After the upgrade, both nodes have the same version and appear to be in the cluster, but you notice that the backup node (node0) is stuck in 'ineligible' state and does not synchronize configuration changes. What is the most likely cause?

A.The cluster control link is down or misconfigured on the backup node
B.The backup node has not been configured with 'commit synchronize'
C.The 'set chassis cluster reth-count' statement is missing on the backup node
D.The 'monitor interface' configuration is causing a mis-match between nodes
AnswerA

A node becomes ineligible when the cluster control link is not operational on that node, because the control link is the physical interface used to exchange heartbeat messages and cluster control traffic. If the control link is down, misconfigured (e.g., wrong interface name, VLAN mismatch, or disabled), or not connected, the node cannot participate in cluster state synchronization or failover, forcing it into the ineligible state. Even if the node is otherwise healthy and has all other cluster settings correct, the lack of a functioning control link alone is sufficient to prevent it from reaching eligible status.

Why this answer

The backup node being stuck in 'ineligible' state after a chassis cluster upgrade indicates that the cluster control link (control port) is not functioning correctly. In a Juniper SRX active/passive cluster, the control link is used for heartbeat and cluster state synchronization; if it is down or misconfigured on the backup node, the node cannot participate in the cluster election process and remains ineligible. This is a common issue after upgrades if the control link interfaces are not properly re-established or if the cable is faulty.

Exam trap

The trap here is that candidates often confuse 'ineligible' state with configuration synchronization issues, leading them to choose 'commit synchronize' or other configuration-related options, when the root cause is actually a physical or logical connectivity problem on the control link.

How to eliminate wrong answers

Option B is wrong because 'commit synchronize' is a configuration command that ensures changes are automatically synchronized from the primary to the backup node, but it does not affect the node's eligibility state; the backup node can still be eligible without it. Option C is wrong because the 'set chassis cluster reth-count' statement defines the number of redundant Ethernet interfaces and is required for cluster operation, but its absence would cause a different issue (e.g., reth interfaces not working), not specifically the backup node being stuck in 'ineligible' state. Option D is wrong because 'monitor interface' configuration is used for interface monitoring to trigger failover, and a mismatch between nodes would cause a different problem (e.g., false failovers), not the backup node being stuck in 'ineligible' state.

Practice this question →
15
MCQmedium

An engineer wants to roll back to the previous configuration. Which command should be used?

A.rollback 1
B.delete
C.rollback 0
D.commit check
AnswerA

The `rollback 1` command reloads the candidate configuration from the previous committed configuration (rollback ID 1), completely discarding any uncommitted changes currently staged in the candidate. This precisely achieves the engineer's goal of returning to the previous configuration, making it the correct command for this scenario.

Why this answer

The `rollback 1` command loads the previous committed configuration (the configuration before the last commit) into the candidate configuration, discarding any uncommitted changes. This allows the engineer to replace the current candidate with the desired historical configuration. In Junos, `rollback 0` loads the most recently committed configuration (the current active configuration), not the previous one.

Exam trap

Candidates often think that `rollback 0` is the previous configuration, but `rollback 0` actually loads the currently active configuration. `rollback 1` is the previous committed configuration.

How to eliminate wrong answers

Option B is wrong because `delete` removes configuration statements from the candidate configuration, not from the committed configuration, and it does not perform a rollback to a previous state. Option C is wrong because `rollback 0` reverts the candidate configuration to the currently active committed configuration, which would discard any uncommitted changes the engineer wants to keep. Option D is wrong because `commit check` only validates the syntax and semantics of the candidate configuration without committing it; it does not roll back to any previous configuration.

Practice this question →
16
MCQeasy

Which Junos CLI mode allows a user to view the configuration and execute operational commands, but not make configuration changes?

A.Operational mode
B.Monitor mode
C.Enable mode
D.Configuration mode
AnswerA

Operational mode, indicated by the `>` prompt, is the default Junos CLI mode. It allows users to run `show` commands, including `show configuration` and its variants, to view the active configuration without making any changes. This mode is sufficient for viewing; entering configuration mode is unnecessary for read-only access.

Why this answer

In Junos OS, Operational mode (indicated by the `>` prompt) allows users to execute operational commands (e.g., `show`, `ping`, `traceroute`) and view the active configuration using `show configuration`, but it does not permit any changes to the configuration. Configuration changes require entering Configuration mode (indicated by the `#` prompt) via the `configure` command. This separation enforces a strict two-tier access model, ensuring that operational tasks do not inadvertently alter the device's configuration.

Exam trap

The trap here is that candidates familiar with Cisco IOS may confuse 'Enable mode' (which grants configuration privileges in Cisco) with Junos's Operational mode, not realizing that Junos uses a completely different two-tier model where Operational mode is read-only and Configuration mode is required for any changes.

How to eliminate wrong answers

Option B (Monitor mode) is wrong because Junos does not have a 'Monitor mode'; this term is a distractor that might be confused with Cisco's monitor mode for software upgrades or with the `monitor` operational command used for real-time interface traffic viewing. Option C (Enable mode) is wrong because 'Enable mode' is a Cisco IOS concept that provides privileged access for configuration changes; Junos uses a different paradigm with distinct Operational and Configuration modes. Option D (Configuration mode) is wrong because this mode (indicated by the `#` prompt) is specifically designed for making configuration changes, not for viewing the configuration or executing operational commands without the ability to modify settings.

Practice this question →
17
MCQhard

During a network traffic storm, a Juniper EX switch's CPU utilization spikes to 100%. Which command would best help identify the cause?

A.monitor traffic interface ge-0/0/0
B.show spanning-tree bridge
C.show ethernet-switching table
D.show interfaces extensive ge-0/0/0
AnswerA

`monitor traffic interface ge-0/0/0` runs a real-time packet capture on the specified interface, displaying packet headers so you can see broadcast, multicast, or unknown-unicast traffic flooding the switch. This is the key diagnostic during a storm because it lets you identify the source MAC/IP and the packet type that is overwhelming the CPU. It captures traffic as it arrives, giving immediate evidence for where the storm originates.

Why this answer

The 'monitor traffic interface' command captures live packet headers on the specified interface, allowing you to see the type and source of traffic causing the CPU spike. During a traffic storm (e.g., broadcast storm), this command reveals excessive broadcast, multicast, or unknown unicast frames, which are typically the root cause of high CPU utilization on Juniper EX switches.

Exam trap

The trap here is that candidates often confuse 'show interfaces extensive' (which shows error counters like CRC errors or giants) with the ability to see live traffic, but it only provides historical statistics, not the packet-level detail needed to pinpoint the storm's source.

How to eliminate wrong answers

Option B is wrong because 'show spanning-tree bridge' displays STP bridge parameters and port roles, which help diagnose Layer 2 loops but not the specific traffic types or sources causing a CPU storm. Option C is wrong because 'show ethernet-switching table' shows MAC address entries and their associated interfaces, which is useful for verifying forwarding tables but does not reveal real-time traffic patterns or packet contents. Option D is wrong because 'show interfaces extensive' provides detailed interface statistics and errors, but it does not capture live packet data; it only shows counters and historical data, not the actual traffic causing the CPU spike.

Practice this question →
18
MCQeasy

A company wants to implement best practice for password recovery on Juniper devices to avoid service disruption. Which of the following is the recommended method?

A.Perform a factory reset to default configuration
B.Boot the device into single-user mode from the console and reset the root password
C.Use SNMP to modify the password field in the configuration
D.Contact JTAC to remotely reset the password
AnswerB

This is the standard Juniper password recovery procedure, allowing password reset without affecting configuration.

Why this answer

Booting the device into single-user mode from the console is the standard, secure method for password recovery on Juniper devices. This process allows an administrator with physical console access to reset the root password without affecting the running configuration or causing service disruption, as the device boots with a minimal kernel and does not load the full configuration.

Exam trap

The trap here is that candidates may confuse Juniper's single-user mode recovery with Cisco's password recovery process, which often involves a configuration register change and may require a factory reset; Juniper's method is designed to preserve the configuration, while Cisco's recovery can sometimes erase the startup configuration if not done carefully.

How to eliminate wrong answers

Option A is wrong because performing a factory reset to default configuration erases all configuration data, causing complete service disruption and loss of custom settings, which is not a best practice for password recovery. Option C is wrong because SNMP is a monitoring and management protocol that does not provide a mechanism to modify password fields in the Junos configuration; it is read-only for security purposes and cannot be used for password changes. Option D is wrong because contacting JTAC to remotely reset the password is not a standard or recommended procedure; JTAC does not have direct access to reset passwords, and this would require a support contract and potentially cause delays, not to mention that remote password reset is not a supported feature.

Practice this question →
19
Multi-Selectmedium

Which TWO statements are true about the Junos file system? (Choose two.)

Select 2 answers
A.The /config directory contains configuration files.
B.The /var/tmp directory is used for temporary storage.
C.The /altroot directory is a backup root filesystem.
D.The /kernel directory contains the operating system kernel.
E.The root directory (/) is a RAM disk.
AnswersA, B

/config stores the active and candidate configuration files.

Why this answer

The /config directory in the Junos file system stores the active and backup configuration files, including juniper.conf and juniper.conf.gz. These files are critical for device operation and are loaded during the boot process.

Exam trap

The trap here is that candidates may confuse the /altroot directory with a backup root filesystem, when in fact it is used for alternate root images during software upgrades, not a persistent backup.

Practice this question →
20
Multi-Selecthard

Which THREE statements are true about commit operations in Junos OS?

Select 3 answers
A.The 'commit confirmed' command immediately discards changes if not confirmed.
B.Multiple users can make configuration changes simultaneously, but only one can commit at a time.
C.The 'commit check' command validates the configuration syntax without activating it.
D.The 'commit confirmed' command allows a rollback to the previous configuration if not confirmed within the timeout period.
E.The 'commit' command always requires 'commit synchronize' when using dual Routing Engines.
AnswersB, C, D

Junos uses a lock to serialize commits.

Why this answer

Junos OS allows multiple users to enter configuration mode and make changes simultaneously, but the commit operation is serialized: only one user can commit at a time. This prevents conflicting changes from being applied concurrently, ensuring configuration consistency.

Exam trap

The trap here is confusing 'commit confirmed' with an immediate discard of changes, when in fact it temporarily activates the configuration and only rolls back if the confirmation is not received within the timeout period.

Practice this question →
21
MCQhard

Based on the exhibit, what is the most likely impact on the router?

A.Routing protocol adjacencies will be lost, causing routing instability.
B.The CPU will be overloaded due to the kernel messages.
C.The router will stop forwarding packets immediately.
D.The router will reboot automatically.
AnswerA

The rpd (Routing Protocol Daemon) is the sole software process managing all dynamic routing protocols, including OSPF, BGP, and IS-IS. When it is killed, every established adjacency immediately tears down, causing neighboring routers to mark the node unreachable and recalculate paths. This produces route flap and forwarding loops until rpd restarts and rebuilds sessions, so the primary impact is severe routing instability.

Why this answer

The exhibit shows kernel messages indicating a hardware or software fault (e.g., a FPC crash or PIC restart). In Junos, such critical events cause the Packet Forwarding Engine (PFE) to reset, which tears down all routing protocol adjacencies (OSPF, BGP, IS-IS) because the control plane loses communication with the forwarding plane. This leads to route withdrawal and routing instability until the adjacencies are re-established.

Exam trap

The trap here is that candidates assume kernel messages always cause a full reboot or immediate forwarding stop, but Junos is designed to isolate failures to specific components (like FPCs) rather than crashing the entire router.

How to eliminate wrong answers

Option B is wrong because kernel messages are logged as part of normal fault handling and do not inherently overload the CPU; Junos prioritizes control plane stability. Option C is wrong because the router continues to forward packets using the last known forwarding table until the PFE restarts, and even then, forwarding may resume after the restart without a full stop. Option D is wrong because Junos does not automatically reboot on kernel messages; it isolates the faulty component (e.g., FPC restart) to maintain overall system availability.

Practice this question →
22
MCQhard

An administrator notices that after committing a configuration change on a Juniper MX router, the device loses connectivity to the management network. The management interface is part of a dedicated management routing instance. Which of the following is the most likely cause?

A.A firewall filter was applied to the management interface that blocks all traffic
B.NTP was configured with an incorrect server address
C.A syslog server was configured that is unreachable
D.The routing instance for the management interface was accidentally removed
AnswerD

The management interface (e.g., fxp0 or me0) is bound to a dedicated routing instance, often named mgmt_junos, which contains the management subnet's route. Removing this routing instance from the configuration causes the interface to lose its association with the routing table, effectively eliminating the route to the management network. As a result, remote management traffic cannot be routed to or from the device, even though the interface itself may still be administratively and operationally up. This correctly explains why the administrator loses connectivity after committing the configuration.

Why this answer

The management interface is part of a dedicated management routing instance (often named mgmt_junos). If this routing instance is accidentally removed during a commit, the management interface loses its routing context and becomes unreachable, causing loss of connectivity to the management network. This is a common misconfiguration when an administrator modifies routing instance configurations without realizing the management interface depends on it.

Exam trap

The trap here is that candidates often assume a firewall filter or service configuration (like NTP or syslog) is the cause, but the real issue is the removal of the routing instance that provides the logical separation for the management interface.

How to eliminate wrong answers

Option A is wrong because applying a firewall filter that blocks all traffic to the management interface would cause immediate loss of connectivity, but the question states the issue occurs after committing a configuration change, and the most likely cause is a structural change to the routing instance rather than a filter. Option B is wrong because configuring NTP with an incorrect server address would not cause loss of management connectivity; it would only prevent time synchronization. Option C is wrong because configuring an unreachable syslog server would only affect logging, not the management interface's ability to communicate on the network.

Practice this question →
23
MCQhard

You are administering a Juniper MX240 router that provides connectivity to multiple customer sites. The router uses BGP to exchange routes with two upstream ISPs. Recently, you applied a new firewall filter to the loopback interface to restrict management access. After committing the configuration, you can no longer establish SSH sessions to the router from the management network. You are currently connected via console. The loopback filter is still applied. You suspect the filter is blocking SSH traffic from the management network. What should you do to restore SSH access without losing the other filter rules?

A.Roll back to the previous configuration using 'rollback 0' and commit.
B.Add a new term at the end of the filter that accepts SSH traffic from any source.
C.Add a new term at the beginning of the filter that accepts SSH traffic from the management network, then reorder the terms so that this term is evaluated first.
D.Delete the firewall filter from the loopback interface and commit.
AnswerC

Inserting a new accept term at the top of the filter and committing it ensures that SSH packets sourced from the management network match this term first, before any deny term can be evaluated. Junos first-match semantics guarantee that once the accept action is applied, no later term can override it. Limiting the source to the management network preserves the security boundary and only restores the intended SSH access, rather than allowing SSH from arbitrary sources.

Why this answer

Firewall filters in Junos are evaluated in order, and adding a term at the beginning that explicitly accepts SSH traffic from the management network ensures that the SSH packets are permitted before any subsequent deny terms are evaluated. This preserves all existing filter rules while restoring SSH access. The 'insert' command or reordering terms is necessary to place the new term first, as the default behavior appends new terms to the end of the filter.

Exam trap

The trap here is that candidates assume adding a permit rule anywhere in the filter will work, but they forget that Junos filters are order-dependent and that new terms are appended to the end by default, which may be after a deny term that blocks the traffic.

How to eliminate wrong answers

Option A is wrong because 'rollback 0' rolls back to the most recently committed configuration, which would remove the entire firewall filter and any other recent changes, not just the problematic rule. Option B is wrong because adding a term at the end of the filter that accepts SSH from any source would still be evaluated after any existing deny terms that might block SSH traffic, so it would not restore access. Option D is wrong because deleting the entire firewall filter from the loopback interface removes all security restrictions, not just the one blocking SSH, which violates the requirement to keep other filter rules.

Practice this question →
24
MCQeasy

What is the purpose of the 'commit confirmed' command in Junos OS?

A.It compares the candidate configuration with the active configuration
B.It allows the administrator to test a configuration change with automatic rollback if confirmation is not received
C.It permanently saves the candidate configuration to the startup configuration
D.It confirms that a previous commit was successful
AnswerB

This is the correct purpose of 'commit confirmed' in Junos. When you issue 'commit confirmed', the candidate configuration is applied and a timer (default 10 minutes, configurable with 'confirm <minutes>') starts. If you do not explicitly confirm the commit with a subsequent 'commit confirm' before the timer expires, the device automatically reverts to the previous active configuration. This is essential for safely applying remote changes that might disrupt connectivity, because a lost connection means you cannot confirm, so the router rolls back automatically.

Why this answer

The 'commit confirmed' command in Junos OS applies a candidate configuration change and starts a confirmation timer (default 10 minutes). If the administrator does not issue a 'commit' command before the timer expires, the system automatically rolls back to the previous active configuration. This allows safe testing of changes, especially over remote connections, preventing lockout if the change breaks connectivity.

Exam trap

The trap here is that candidates confuse 'commit confirmed' with a simple confirmation prompt or a verification step, when in fact it is a timed rollback mechanism designed to prevent lockout during remote configuration changes.

How to eliminate wrong answers

Option A is wrong because comparing the candidate configuration with the active configuration is done using the 'show | compare' command or 'show configuration | compare', not 'commit confirmed'. Option C is wrong because permanently saving the candidate configuration to the startup configuration is achieved with 'commit' (or 'commit and-quit'), not 'commit confirmed'; the 'commit confirmed' command applies the change temporarily and requires a subsequent 'commit' to make it permanent. Option D is wrong because confirming a previous commit was successful is not a function of 'commit confirmed'; the system logs commit success or failure in the event log, and 'show system commit' displays the commit history, but 'commit confirmed' is used to test a change with automatic rollback, not to verify a past commit.

Practice this question →
25
MCQmedium

Refer to the exhibit. An operator tries to ping 192.168.1.2 from this router and fails. The router can ping itself (192.168.1.1). What is the most likely cause?

A.Reverse path forwarding (RPF) check is dropping the echo request.
B.The remote host is not reachable or is not responding to ARP requests.
C.The interface is administratively down.
D.Proxy ARP is not configured on the interface.
AnswerB

To ping 192.168.1.2 from a directly connected interface, the router must first resolve that destination IP to a MAC address using an ARP request. If the remote host is down, unreachable at Layer 2, or configured with a different IP, it will not send an ARP reply, and the router will report the ping as failing (e.g., 'Host is down' or an incomplete ARP entry). Since the interface is up and has an IP in the same subnet, ARP resolution failure is the classic and most likely explanation for this symptom.

Why this answer

The router can ping its own interface (192.168.1.1), confirming that the interface is up and IP is configured correctly. The failure to ping 192.168.1.2 indicates that the router cannot reach the remote host, most likely because the host is down, not connected, or not responding to ARP requests. ARP resolution is required for the router to map the destination IP to a MAC address on the local subnet; without a successful ARP reply, the router cannot send the echo request.

Exam trap

The trap here is that candidates may confuse a local connectivity issue (like a down interface or RPF) with a remote host unreachability, but the ability to ping the local interface proves the interface is operational and the problem lies with the destination host or its ARP response.

How to eliminate wrong answers

Option A is wrong because reverse path forwarding (RPF) checks are used in multicast or unicast RPF (uRPF) scenarios to verify the source address of incoming packets, not to drop locally generated echo requests. Option C is wrong because if the interface were administratively down, the router would not be able to ping its own address (192.168.1.1). Option D is wrong because Proxy ARP is used to allow a router to respond to ARP requests on behalf of hosts on another subnet; it is not required for a router to ping a host on the same directly connected subnet.

Practice this question →
26
MCQhard

What happens when a user issues the 'request system reboot' command without any options?

A.The device reboots after the current commit.
B.The device reboots immediately.
C.The device prompts for confirmation.
D.The device schedules a reboot in 5 minutes.
AnswerC

By default, 'request system reboot' is an interactive command that prompts for confirmation. When executed, it displays a message asking the user to confirm the action, and optionally warns about unsaved configuration changes. The user must respond affirmatively (typically 'yes' or 'y') before the device begins the reboot sequence. This confirmation step is a safety mechanism to prevent accidental reboots and is the default behavior unless the 'now' option is provided.

Why this answer

When a user issues the 'request system reboot' command without any options, Junos OS prompts for confirmation before proceeding. This is a safety mechanism to prevent accidental reboots, as the command does not automatically reboot the device immediately or schedule a delayed reboot by default.

Exam trap

The trap here is that candidates often assume 'request system reboot' behaves like a typical Linux 'reboot' command (immediate execution), but Junos requires explicit confirmation or the 'now' option to proceed without a prompt.

How to eliminate wrong answers

Option A is wrong because the 'request system reboot' command does not wait for a commit; it reboots the device immediately after confirmation, and the current configuration is already active. Option B is wrong because the command does not reboot immediately; it first prompts the user for confirmation to avoid unintended disruptions. Option D is wrong because the command does not schedule a reboot in 5 minutes; that behavior requires the 'at' or 'in' option (e.g., 'request system reboot at 12:00' or 'request system reboot in 5').

Practice this question →
27
MCQeasy

You are a network administrator for a service provider that uses Juniper MX series routers to provide MPLS VPN services to customers. Management has requested that you implement a secure out-of-band management (OOBM) solution for all MX routers to ensure that management traffic is isolated from the production network, reducing the risk of unauthorized access and management plane attacks. You are tasked with designing the OOBM solution using a dedicated management interface (me0) and a separate management routing instance. Which of the following best practices should you follow?

A.Place me0 in the inet.0 routing table and rely on static routes
B.Enable VLAN tagging on me0 to separate management traffic into different subnets
C.Configure the me0 interface in the default routing instance with a simple ACL
D.Create a dedicated routing instance for management, assign me0 to it, and apply a firewall filter to restrict access
AnswerD

Creating a dedicated routing instance creates a separate RIB/FIB context for management, so me0's traffic never shares routes with production. Assigning me0 to that instance ensures incoming and outgoing management packets use only that isolated table. Applying a firewall filter on the interface or within the instance provides granular control over allowed sources/ports, while the routing-instance separation prevents transit use and route leakages. This combination is the recommended approach for out-of-band management isolation in Junos.

Why this answer

It follows Juniper's best practice for OOBM: creating a dedicated management routing instance (e.g., mgmt_junos) and assigning the me0 interface to it. This ensures management traffic is completely isolated from the production routing table (inet.0), preventing management plane attacks and unauthorized access. Applying a firewall filter on the me0 interface further restricts access to only authorized management hosts, aligning with security hardening guidelines.

Exam trap

The trap here is that candidates assume VLAN tagging (Option B) is a valid method for separating management traffic on any interface, but the me0 interface on Juniper MX routers does not support VLAN tagging as it is a dedicated Layer 3 out-of-band port, not a trunk port.

How to eliminate wrong answers

Option A is wrong because placing me0 in the inet.0 routing table mixes management traffic with production traffic, defeating the purpose of OOBM isolation and exposing the management plane to potential attacks. Option B is wrong because VLAN tagging on me0 is not supported; the me0 interface is a dedicated out-of-band management port that operates at Layer 3 and does not support subinterfaces or VLAN tagging. Option C is wrong because keeping me0 in the default routing instance (inet.0) does not isolate management traffic; a simple ACL is insufficient for full isolation, and the default instance is shared with production routes, violating OOBM principles.

Practice this question →
28
MCQhard

A network engineer made several configuration changes on a Juniper QFX switch to implement new VLANs. After committing the changes, the engineer realized that the new configuration caused a critical loss of connectivity to the management network. The engineer needs to revert to the previous configuration that was working. The switch is still accessible via the console port, and the engineer has privilege level access. The previous configuration was committed two commits ago, and the current active configuration is the problematic one. Which action should the engineer take to restore the previous working configuration?

A.Use 'load override /config/juniper.conf.1.gz' followed by 'commit'.
B.Use 'delete system' to remove all configuration and then commit.
C.Execute 'rollback 0' followed by 'commit'.
D.Execute 'rollback 2' followed by 'commit'.
AnswerD

rollback 2 sets the candidate configuration to the snapshot saved two commit operations ago, stored as /config/juniper.conf.2.gz. This bypasses the two most recent commits, returning to the last known working configuration. A subsequent commit activates this as the new active configuration, effectively undoing the problematic changes.

Why this answer

The working configuration was committed two commits ago. The 'rollback 2' command loads the configuration from two commits prior into the candidate configuration. After that, 'commit' makes it active, restoring connectivity.

Note that 'rollback 1' would load the intermediate commit, which is also problematic, and 'rollback 0' refers to the current active configuration.

Exam trap

The trap here is confusing the rollback numbering: candidates often think 'rollback 0' reverts to a previous configuration, but it actually refers to the current active configuration, while 'rollback 1' is needed to go back one commit (the previous working state).

How to eliminate wrong answers

Option A is wrong because '/config/juniper.conf.1.gz' is the backup of the configuration that was active one commit ago, but using 'load override' loads that file into the candidate configuration without automatically applying it; however, the correct rollback command is simpler and more appropriate, and 'juniper.conf.1.gz' corresponds to the configuration before the last commit, not two commits ago. Option B is wrong because 'delete system' removes all system configuration, which would cause a complete loss of management access and is an irreversible destructive action, not a targeted rollback. Option C is wrong because 'rollback 0' reverts to the current active configuration (the problematic one), which does nothing to restore the previous working configuration.

Practice this question →
29
MCQmedium

A Junos device has multiple configuration files saved. Which command shows the available rollback configurations?

A.show system configuration
B.show system rollback
C.show configuration | display rollback
D.show system commit
AnswerD

'show system commit' is the correct operational-mode command because it lists every committed configuration on the device, along with its commit ID, timestamp, user, and optional comment. These commit IDs are the exact rollback identifiers used to restore or inspect previous configurations with 'rollback <id>' or 'show system rollback <id>'. Thus it provides the complete inventory of rollback points needed to answer the question.

Why this answer

The 'show system commit' command displays a list of all committed configuration revisions, including their commit IDs and timestamps, which are used to roll back to a previous configuration. The rollback feature in Junos relies on these stored commit files, and the command explicitly shows the available rollback points.

Exam trap

The trap here is that candidates familiar with Cisco IOS might expect a 'show rollback' command to list available rollbacks, but Junos uses 'show system commit' for this purpose, and 'show system rollback' only shows the content of a specific rollback when given an ID.

How to eliminate wrong answers

Option A is wrong because 'show system configuration' is not a valid Junos command; the correct command to view the current active configuration is 'show configuration'. Option B is wrong because 'show system rollback' is not a valid command; the correct command to view a specific rollback configuration is 'show system rollback <id>', but it does not list available rollback configurations. Option C is wrong because 'show configuration | display rollback' is not a valid syntax; the correct way to view a specific rollback configuration is 'show configuration rollback <id>', and the 'display rollback' option is used with 'show system commit' to show the configuration differences, not to list available rollbacks.

Practice this question →
30
MCQhard

A Juniper device fails to boot and stops at the 'loader>' prompt. What is the most likely cause of this issue?

A.Bad boot device or missing kernel
B.Corrupted configuration file
C.Hardware failure of the power supply
D.Missing root password
AnswerA

The loader prompt (typically 'loader>') is the bootloader's interactive menu, reached when it cannot locate a valid kernel to load. If the boot device is absent, unreadable, or the kernel file is missing/corrupt, the bootloader cannot proceed with the normal boot sequence and instead drops to this prompt for manual intervention. This is the expected symptom when storage or kernel integrity is compromised.

Why this answer

When a Juniper device stops at the 'loader>' prompt, it indicates that the boot process has failed to locate or load the kernel (juniper-kernel) from the boot device (e.g., internal flash, USB, or hard disk). This is typically caused by a corrupted boot device, missing kernel image, or incorrect boot device selection in the boot loader (UBoot or CFE). The loader prompt is a low-level environment used for recovery, not a sign of configuration or authentication issues.

Exam trap

The trap here is that candidates confuse a boot loader failure (loader prompt) with a configuration or authentication issue, assuming that any boot problem is due to a corrupted config or password, when in fact the loader prompt specifically indicates a missing or inaccessible kernel.

How to eliminate wrong answers

Option B is wrong because a corrupted configuration file would cause the device to boot but fail to load the configuration, resulting in the 'amnesiac' state or a request to enter recovery mode, not a stop at the 'loader>' prompt. Option C is wrong because a power supply failure would prevent the device from powering on at all, not allow it to reach the boot loader stage. Option D is wrong because a missing root password does not affect the boot process; it only prevents login after the system has fully booted, and recovery can be performed via the console or root password recovery procedure.

Practice this question →
31
MCQmedium

You are a network administrator for a large enterprise. You have a Juniper SRX firewall that is used as the primary internet gateway. Users are reporting that they are unable to access certain external websites. You check the device and find that the security policies appear correct, and the routing is in place. You suspect that the issue might be related to the DNS resolution. You want to verify that the device can resolve DNS names and that the DNS server configuration is correct. Which command should you use to test DNS resolution from the Juniper device?

A.show system connections
B.ping <external website FQDN>
C.traceroute <external website FQDN>
D.show dns name-server
AnswerB

When you execute 'ping <external website FQDN>' on Junos, the CLI first resolves the hostname to an IP address using the DNS servers configured under 'system name-server'. A successful resolution is shown directly in the output, where ping reports the target IP before sending ICMP requests. If the DNS query times out or fails, Junos returns a 'unable to resolve hostname' error, making this an effective, one-command DNS resolution test. Note that even if ICMP is blocked by the remote host, the appearance of the IP address in the output already confirms forward DNS works.

Why this answer

The `ping` command with a fully qualified domain name (FQDN) forces the Juniper device to perform a DNS resolution before sending ICMP echo requests. If the device cannot resolve the FQDN, the ping will fail with a 'hostname not found' error, directly indicating a DNS configuration or reachability issue. This tests both the DNS server configuration and the device's ability to resolve names, which is essential for verifying DNS functionality.

Exam trap

The trap here is that candidates often confuse `show dns name-server` with a valid operational command, but Junos uses `show configuration system name-server` to view DNS server settings, and the `ping` command with an FQDN is the standard method to test live DNS resolution from the device.

How to eliminate wrong answers

Option A is wrong because `show system connections` displays active TCP/UDP connections and their states, not DNS resolution capabilities or configuration. Option C is wrong because `traceroute` with an FQDN also triggers DNS resolution, but it is designed to trace the path to the destination and is less direct for simply testing DNS resolution; a failed traceroute could be due to routing or firewall issues rather than DNS. Option D is wrong because `show dns name-server` is not a valid Junos command; the correct command to view DNS server configuration is `show configuration system name-server`.

Practice this question →
32
MCQmedium

Your data center uses Juniper QFX5110 switches as leaf nodes in a Virtual Chassis Fabric (VCF) topology with QFX5100 as spine nodes. You are adding a new QFX5110 leaf node to the fabric. The new switch is physically connected to all spine nodes as per the cabling guidelines. However, after powering on the new switch, it does not automatically join the fabric. The existing fabric shows the new switch's member ID as 8, but it remains in 'standalone' state. The VCF has been operational for several months without issues. You check the configuration on the existing VC and notice that the 'virtual-chassis' configuration does not include the new member. What is the most likely reason the new switch does not join?

A.The new switch is running a different version of Junos that is not compatible with the fabric
B.The new switch does not have the same virtual-chassis ID configured as the existing fabric
C.The new switch is only connected to one spine node, and VCF requires full mesh connections to all spines
D.The new switch has 'set virtual-chassis no-split-detection' enabled, preventing it from joining
AnswerB

In a Juniper Virtual Chassis Fabric, every member must share the same virtual-chassis ID (VC-ID) to be recognized as part of the fabric. If the new leaf's VC-ID differs, it will not accept member-add requests and will remain isolated even though physically connected. The VC-ID is typically configured at initial provisioning, and mismatches manifest as the device failing to join the fabric.

Why this answer

In a Virtual Chassis Fabric (VCF), all member switches must share the same virtual-chassis ID to be recognized as part of the same fabric. The existing fabric has a configured virtual-chassis ID, but the new QFX5110, by default, has a different or no virtual-chassis ID set. Without a matching virtual-chassis ID, the new switch cannot join the fabric and remains in 'standalone' state, even though it is physically connected and assigned a member ID.

Exam trap

The trap here is that candidates may assume a switch with a member ID assigned has successfully joined the fabric, but in VCF, member ID assignment happens early in the discovery process and does not guarantee full integration—the switch must also have a matching virtual-chassis ID to move out of 'standalone' state.

How to eliminate wrong answers

Option A is wrong because Junos supports mixed software versions in a VCF only if they are within the same major release train and compatible; the question states the fabric has been operational for months, and version incompatibility would typically cause a different error (e.g., 'version mismatch') rather than a 'standalone' state with a member ID assigned. Option C is wrong because VCF does not require full mesh connections to all spines; the cabling guidelines for VCF typically require each leaf to be connected to at least two spines for redundancy, but a single connection would not prevent the switch from joining—it would still join and then potentially have forwarding issues. Option D is wrong because 'set virtual-chassis no-split-detection' is a feature used to disable split-brain detection in a Virtual Chassis (not VCF) and is not relevant to a new switch joining a VCF; it does not prevent a switch from joining the fabric.

Practice this question →
33
MCQmedium

Refer to the exhibit. An administrator wants to see authentication-related logs like SSH logins. In the current configuration, which log file contains this information?

A.utmp
B.interactive-commands
C.security
D.messages
AnswerD

The 'messages' file is the default syslog destination in Junos that captures a broad range of system events, including authentication and authorization messages. By default, the authentication facility is logged to /var/log/messages, so SSH login attempts (both successful and failed) appear there. This is confirmed by the 'show log messages' command, which reveals entries from sshd that contain 'Accepted password' or 'Failed password'.

Why this answer

In Junos, authentication-related logs such as SSH login attempts are recorded by default in the 'messages' log file. This file captures syslog messages for various system events, including authentication successes and failures. The 'interactive-commands' log file only logs user-executed CLI commands after successful login, not the authentication process itself.

The 'security' log is intended for firewall and security policy events, and 'utmp' is for user accounting. Therefore, option D is correct.

Exam trap

The trap is that candidates may assume interactive-commands logs authentication events because it records CLI commands, but authentication occurs before command logging begins. The default location for authentication logs is the messages file.

How to eliminate wrong answers

Option A is wrong because utmp is a Unix-style file that tracks currently logged-in users, not historical authentication logs; Junos does not use utmp for persistent logging of SSH logins. Option C is wrong because the 'security' log file is used for security-related events like firewall filters, NAT, and IPsec, not for authentication or SSH login logs. Option D is wrong because the 'messages' log file contains general system messages (e.g., kernel, interface, and daemon events) but does not specifically capture interactive command or authentication logs.

Practice this question →
34
MCQmedium

A network operator needs to backup the current configuration to a file on the local flash. Which command accomplishes this?

A.request system configuration rescue save
B.save /var/tmp/backup.conf
C.commit and-quit
D.show configuration | save /var/tmp/backup.conf
AnswerD

The `show configuration | save /var/tmp/backup.conf` command is the correct operational-mode method to back up the active configuration. `show configuration` displays the current committed configuration from operational mode, and the pipe to `save` redirects that output to a file, creating an ASCII text backup. This is a common practice for configuration archiving, as it captures exactly what is running without entering configuration mode. It is the only option that produces a usable backup file of the current configuration.

Why this answer

The correct command to backup the current configuration from operational mode is `show configuration | save /var/tmp/backup.conf`. This pipes the active configuration to the save command, writing it to the specified file. Option B (`save /var/tmp/backup.conf`) is a configuration mode command and will not work in operational mode.

Option A saves the rescue configuration, not the active configuration. Option C commits the configuration and exits but does not save to a file.

Exam trap

Watch out for the assumption that `save` alone works in operational mode — it is only available in configuration mode. The operational mode equivalent requires piping `show configuration` to `save`.

How to eliminate wrong answers

Option A is wrong because `request system configuration rescue save` saves the current active configuration as the rescue configuration, not to an arbitrary file path like `/var/tmp/backup.conf`. Option C is wrong because `commit and-quit` commits the candidate configuration and exits configuration mode, but does not save a backup copy to a file. Option D is wrong because `show configuration | save /var/tmp/backup.conf` saves the output of `show configuration` (which displays the active configuration) to a file, but this is a pipe to `save` that writes the text output, not a direct configuration backup command; it works but is less standard and can include formatting artifacts, whereas `save` is the proper operational-mode command for this task.

Practice this question →
35
Multi-Selecthard

Which THREE of the following statements are true regarding Junos OS commit operations?

Select 3 answers
A.The 'commit check' command validates the candidate configuration without activating it.
B.The commit command activates the candidate configuration.
C.The 'commit confirmed' command automatically rolls back if not confirmed within the timeout.
D.You can run multiple commit scripts during a single commit operation.
E.The rollback command reverts to the current active configuration.
AnswersA, B, C

It checks syntax and semantics without applying.

Why this answer

The 'commit check' command validates the candidate configuration for syntax and semantic errors without activating it. This allows an administrator to verify changes before making them active, preventing potential misconfigurations from disrupting network operations.

Exam trap

The trap here is that candidates often confuse 'rollback' with reverting to the current active configuration, when in fact 'rollback 0' refers to the current active configuration, and any other number refers to a previous committed configuration.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Junos Os Fundamentals questions.

Start 20-question session