JNCIA Firewall Filters

Question 1

What is the primary function of a stateless firewall filter in Junos OS?

Accepted Answer

To examine individual packets based on match conditions and apply defined actions

Answer

To track connection state and allow or deny traffic based on session tables

Answer

To provide NAT functionality for translating IP addresses on interfaces

Answer

To encrypt traffic between network endpoints using IPsec

Question 2

Which Junos CLI command correctly applies a firewall filter in the inbound direction on a logical interface?

Accepted Answer

set interfaces ge-0/0/0 unit 0 family inet filter input <filter-name>

Answer

set firewall filter <filter-name> apply interface ge-0/0/0 input

Answer

set policy-options policy-statement <filter-name> apply ge-0/0/0

Answer

set interfaces ge-0/0/0 firewall-filter <filter-name> direction input

Question 3

What are the two fundamental building blocks of a Junos OS firewall filter?

Accepted Answer

Terms and actions

Answer

Policies and rules

Answer

Access lists and extended lists

Answer

Match sets and forwarding tables

Question 4

What happens to a packet that does not match any term in a Junos firewall filter?

Accepted Answer

It is silently discarded by an implicit default action

Answer

It is accepted and forwarded normally

Answer

It is rejected with an ICMP unreachable message sent to the source

Answer

It is forwarded to the Routing Engine for further processing

Question 5

Which of the following is a valid match condition that can be used in a Junos firewall filter term?

Accepted Answer

source-address

Answer

next-hop

Answer

ttl-exceeded

Answer

routing-instance

Question 6

What is the key difference between the 'reject' and 'discard' actions in a Junos firewall filter?

Accepted Answer

'Reject' sends an ICMP unreachable to the sender; 'discard' drops the packet silently

Answer

'Reject' drops the packet silently; 'discard' sends an ICMP unreachable back to the sender

Answer

Both actions are identical and produce the same behavior

Answer

'Reject' logs the packet to syslog; 'discard' increments a counter only

Question 7

On which Junos component are stateless firewall filters primarily processed for transit traffic?

Accepted Answer

Packet Forwarding Engine (PFE)

Answer

Routing Engine (RE)

Answer

Management plane daemon

Answer

Control plane protocol stack