JNCIA Firewall Filters 3

Question 1

What is the primary reason for applying a Junos firewall filter to the loopback (lo0) interface?

Accepted Answer

To protect the Routing Engine from unwanted or malicious control-plane traffic

Answer

To rate-limit transit traffic passing through the router

Answer

To provide source NAT for management traffic leaving the router

Answer

To load-balance management sessions across multiple Routing Engines

Question 2

Which Junos operational command displays firewall filter match counts and packet counters?

Accepted Answer

show firewall

Answer

show firewall filter <name>

Answer

show interfaces firewall detail

Answer

show filter statistics counters

Question 3

Which action modifier in a Junos firewall filter term stores a short record of the packet header in a local buffer for later review?

Accepted Answer

log

Answer

syslog

Answer

sample

Answer

count

Question 4

In what order does Junos evaluate the terms within a firewall filter when a packet is received?

Accepted Answer

Terms are evaluated sequentially in the order they were configured

Answer

Terms are evaluated in random order determined by the PFE

Answer

Terms are evaluated alphabetically by their configured name

Answer

Terms are evaluated by an assigned numeric priority value

Question 5

Which Junos firewall filter match condition is used to match packets that belong to an already-established TCP session (packets with ACK or RST flags set)?

Accepted Answer

tcp-established

Answer

tcp-flags ack

Answer

tcp-session-active

Answer

established-session

Question 6

How does Junos handle a firewall filter term that contains a 'then' clause but no 'from' clause?

Accepted Answer

The term matches all packets and applies its action universally

Answer

The term is skipped and the next term is evaluated

Answer

Junos generates a commit error because 'from' is required

Answer

The term only matches TCP packets by default

Question 7

A network engineer wants to limit ICMP traffic to the Routing Engine to 1 Mbps using a firewall filter on lo0. Which Junos feature must be configured alongside the filter term to enforce this rate limit?

Accepted Answer

A policer defining the bandwidth limit and burst size

Answer

A prefix list referencing the ICMP source addresses

Answer

A routing policy redistributing ICMP into a discard route

Answer

A CoS scheduler map applied to the lo0 interface