JNCIA Firewall Filters 2 — Questions and Answers
Question 1: In a Junos firewall filter term, which keyword introduces the match conditions for the term?
- then
- apply
- from (Correct answer)
- match
Correct answer: from
The 'from' clause in a Junos firewall filter term defines the match conditions that a packet must satisfy for the term's actions to be applied.
Question 2: What does the 'then' clause in a Junos firewall filter term specify?
- The match conditions a packet must meet
- The actions to take when the match conditions are satisfied (Correct answer)
- The interface direction where the filter is applied
- The sequence number for ordering terms in the filter
Correct answer: The actions to take when the match conditions are satisfied
The 'then' clause defines the actions (such as accept, discard, reject, or count) that are applied when a packet matches the term's 'from' conditions.
Question 3: Which match condition in a Junos inet firewall filter is used to match packets based on the IP protocol number or name?
- protocol (Correct answer)
- ip-version
- layer-4-protocol
- transport-type
Correct answer: protocol
The 'protocol' match condition in a Junos inet filter matches packets based on the IP protocol field, such as tcp, udp, or icmp.
Question 4: Where must a Junos firewall filter be applied to inspect inbound packets arriving on a specific interface?
- Under the 'output' direction of the interface
- Under the 'input' direction of the interface (Correct answer)
- At the routing table level using a routing policy
- On the loopback interface only
Correct answer: Under the 'input' direction of the interface
To inspect packets as they arrive on an interface, the filter must be applied in the 'input' direction under that interface's logical unit.
Question 5: Which firewall filter action causes Junos to evaluate the current packet against the next term in the filter rather than stopping?
- accept
- discard
- next term (Correct answer)
- continue
Correct answer: next term
The 'next term' action in a Junos firewall filter causes evaluation to move to the following term without accepting or discarding the packet.
Question 6: What is the role of a policer when referenced within a Junos firewall filter term?
- It logs all packets matching the term to a file
- It enforces a rate limit on traffic matching the term's conditions (Correct answer)
- It sends matching packets to the Routing Engine for inspection
- It marks packets with a DSCP value for quality-of-service classification
Correct answer: It enforces a rate limit on traffic matching the term's conditions
A policer referenced in a firewall filter term enforces bandwidth limits on matching traffic, dropping or remarking packets that exceed the configured rate.
Question 7: Which address family must be configured when creating a Junos firewall filter that matches IPv4 packets?
- family iso
- family inet6
- family inet (Correct answer)
- family mpls
Correct answer: family inet
IPv4 firewall filters in Junos must be configured under 'family inet' in the firewall hierarchy.
JNCIA Firewall Filters 2
In a Junos firewall filter term, which keyword introduces the match conditions for the term?