JN0-106 Junos OS Fundamentals Practice Question
You are a network administrator for a large enterprise. You have a Juniper SRX firewall that is used as the primary internet gateway. Users are reporting that they are unable to access certain external websites. You check the device and find that the security policies appear correct, and the routing is in place. You suspect that the issue might be related to the DNS resolution. You want to verify that the device can resolve DNS names and that the DNS server configuration is correct. Which command should you use to test DNS resolution from the Juniper device?
⚠ Common exam trap
It's easy for candidates to confuse `show dns name-server` with a valid operational command, but Junos uses `show configuration system name-server` to view DNS server settings, and the `ping` command with an FQDN is the standard method to test live DNS resolution from the device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ping <external website FQDN>
The `ping` command with a fully qualified domain name (FQDN) forces the Juniper device to perform a DNS resolution before sending ICMP echo requests. If the device cannot resolve the FQDN, the ping will fail with a 'hostname not found' error, directly indicating a DNS configuration or reachability issue. This tests both the DNS server configuration and the device's ability to resolve names, which is essential for verifying DNS functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
show system connections
Why it's wrong here
The 'show system connections' operational command displays the current TCP and UDP socket table, similar to netstat, showing local and remote addresses and connection states. It does not perform any DNS lookups or query a resolver; it only reads the kernel's connection table. If a hostname was previously resolved and left in the socket cache, it might appear, but the command itself never triggers a name resolution for the purpose of testing DNS. Therefore, it cannot verify whether the configured DNS servers are able to resolve an external FQDN.
- ✓
ping <external website FQDN>
Why this is correct
When you execute 'ping <external website FQDN>' on Junos, the CLI first resolves the hostname to an IP address using the DNS servers configured under 'system name-server'. A successful resolution is shown directly in the output, where ping reports the target IP before sending ICMP requests. If the DNS query times out or fails, Junos returns a 'unable to resolve hostname' error, making this an effective, one-command DNS resolution test. Note that even if ICMP is blocked by the remote host, the appearance of the IP address in the output already confirms forward DNS works.
- ✗
traceroute <external website FQDN>
Why it's wrong here
Traceroute uses ICMP or UDP packets to map the hop-by-hop path to a destination, but it does not perform a DNS lookup to validate name resolution. This command is useful for diagnosing routing paths and identifying where packet loss occurs along a network trajectory. It would be the correct tool if you needed to identify which specific router in a sequence is dropping traffic to an IP address.
- ✗
show dns name-server
Why it's wrong here
The 'show dns name-server' command outputs the list of IP addresses configured as DNS servers on the device, typically from the 'system name-server' hierarchy. It is a read-only display of configuration; it does not send any DNS query packets to those servers, nor does it check whether they are reachable, responding, or returning correct answers. A server could be listed but be down, or have a misconfigured network path, and this command would still show it without any error. Thus, while useful for verifying which servers should be used, it cannot diagnose resolution failures.
Visual reference
Go deeper
Related to this question
About these practice questions
This JN0-106 question is part of Courseiva's 156-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.