JN0-106 Junos OS Fundamentals Practice Question
You are administering a Juniper MX240 router that provides connectivity to multiple customer sites. The router uses BGP to exchange routes with two upstream ISPs. Recently, you applied a new firewall filter to the loopback interface to restrict management access. After committing the configuration, you can no longer establish SSH sessions to the router from the management network. You are currently connected via console. The loopback filter is still applied. You suspect the filter is blocking SSH traffic from the management network. What should you do to restore SSH access without losing the other filter rules?
⚠ Common exam trap
Many exam-takers assume adding a permit rule anywhere in the filter will work, but they forget that Junos filters are order-dependent and that new terms are appended to the end by default, which may be after a deny term that blocks the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a new term at the beginning of the filter that accepts SSH traffic from the management network, then reorder the terms so that this term is evaluated first.
Firewall filters in Junos are evaluated in order, and adding a term at the beginning that explicitly accepts SSH traffic from the management network ensures that the SSH packets are permitted before any subsequent deny terms are evaluated. This preserves all existing filter rules while restoring SSH access. The 'insert' command or reordering terms is necessary to place the new term first, as the default behavior appends new terms to the end of the filter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Roll back to the previous configuration using 'rollback 0' and commit.
Why it's wrong here
The 'rollback 0' command loads the most recently committed configuration as the candidate configuration; if the problem was introduced in that last commit, you are simply reloading the same broken filter. It would not restore an earlier, working configuration unless you specify a higher rollback number such as 'rollback 1'. Furthermore, this approach discards every other uncommitted or subsequent change in the candidate, so it could remove unrelated modifications you need to keep.
- ✗
Add a new term at the end of the filter that accepts SSH traffic from any source.
Why it's wrong here
Junos firewall filters evaluate terms in numeric order and stop at the first match, so an accept term placed after a deny term that matches SSH traffic will never be executed. Even if the deny term targets other protocols, using 'any' as the source would explicitly accept SSH from all IP addresses, violating the least-privilege principle for management-plane access. The term would need to be inserted before the relevant deny term and restricted to the management source prefix.
- ✓
Add a new term at the beginning of the filter that accepts SSH traffic from the management network, then reorder the terms so that this term is evaluated first.
Why this is correct
Inserting a new accept term at the top of the filter and committing it ensures that SSH packets sourced from the management network match this term first, before any deny term can be evaluated. Junos first-match semantics guarantee that once the accept action is applied, no later term can override it. Limiting the source to the management network preserves the security boundary and only restores the intended SSH access, rather than allowing SSH from arbitrary sources.
- ✗
Delete the firewall filter from the loopback interface and commit.
Why it's wrong here
Removing the entire firewall filter from the loopback interface would strip away all protection for the Routing Engine, including filters that block ICMP, unauthenticated probes, or other management-plane traffic. This is a far more disruptive action than fixing the specific filter term, and it leaves the router exposed to network-based attacks. The filter should be edited surgically instead, by reordering or inserting a term, while keeping the rest of the security policy intact.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every JN0-106 question from scratch — 156 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.