Routing Policy and Firewall Filters

JN0-106 · 35 questions

• Prairie Broadband Cooperative's engineers want to control which routes get installed in the routing table or advertised to a neighboring carrier, without changing how the routing protocol itself calculates best paths. Which Junos mechanism is built for this job?
• A technician at Ridgeline Fiber Cooperative is reviewing policy applied where routes learned from a BGP peering session are evaluated before Junos decides whether to place them into the routing table. Which type of routing policy does this describe?
• At a cooperative's aggregation router, a policy is applied where routes already sitting in the routing table are evaluated before Junos decides whether to advertise them out to an upstream transit provider. Which type of routing policy does this describe?
• A cooperative's edge router learns a subscriber-aggregation route from OSPF and also has a matching static route toward the same subnet. No export policy has been configured on the BGP session to its transit provider. By Junos's default BGP export behavior, what happens to these routes?
• A cooperative runs OSPF across its internal aggregation network and has several static routes pointing to subscriber DSL pools. With no export policy configured on OSPF, what happens to those static routes with respect to OSPF advertisement?
• While writing a routing-policy term, an engineer at a regional ISP needs to match on the source protocol and prefix of incoming routes, separately from matching on which neighbor or protocol the route is being sent toward. Which two match-condition keywords in a Junos policy term correspond to these two directions?
• A term in an export policy matches routes destined for a specific transit neighbor and includes the action accept. What effect does this accept action have on policy evaluation for a matching route?
• An engineer adds a term near the top of an export policy toward an upstream peer with the action reject, intended to withhold one subscriber block from that peer. What is the effect of reject on evaluation of a matching route?
• A policy term at a cooperative's border router does not match the current route, but the policy has additional terms below it that might. Which flow-control action would Junos apply by default in this situation?
• An engineer wants a route that matches an early term in one export policy to stop being evaluated in that policy and instead be evaluated against a completely separate policy further down the export chain. Which then action accomplishes this?
• A cooperative's BGP export statement lists three policies in order: FILTER-MARTIANS, LIMIT-SUBSCRIBER-BLOCKS, then ADVERTISE-DEFAULT. A route matches a terminating term in LIMIT-SUBSCRIBER-BLOCKS. What happens to that route with respect to ADVERTISE-DEFAULT?
• A cooperative's OSPF neighbor advertises a route that does not match any term in the router's configured import policy. With no explicit default action configured, what happens to that route by Junos's built-in default import behavior?
• A cooperative configures an export policy toward its transit provider with a single term that matches only the co-op's own aggregate prefix. A subscriber static route does not match that term. What happens to the subscriber static route with respect to advertisement to the transit provider?
• A cooperative agreed with a peering partner to accept only two specific subscriber blocks over a peering session, nothing else. Which routing-policy match condition lets the import policy match precisely those two prefixes, including any more-specific routes within them, while still not matching a route the peer accidentally advertises for someone else's block?
• A cooperative wants its BGP export policy toward a transit provider to advertise only the static routes representing its subscriber DSL pools, and nothing learned via OSPF or direct interface routes. Which from match condition in the export policy term achieves this source-based selection?
• A policy term is written with a then action of reject but includes no from or to condition at all. Which routes will this term match when evaluation reaches it?
• An engineer needs an export policy term to match a subscriber aggregate block plus every more-specific route contained within it, not just the exact aggregate prefix itself. Which Junos route-filter match type is appropriate?
• A rural cooperative peers separately with Transit-A and Transit-B. Engineers are concerned that if a term is missing, the co-op's router could start forwarding traffic between the two transit providers, effectively becoming unpaid transit itself. Which policy design correctly prevents this?
• A network engineer at a rural broadband cooperative wants to drop management traffic addressed to a POP router unless it comes from the NOC subnet, without changing which routes the router installs in its routing table. Which Junos OS mechanism inspects individual packets against match conditions to make that permit-or-deny decision, rather than influencing route selection?
• A technician at a regional ISP is building a firewall filter with three terms to protect a subscriber aggregation router: term one permits DNS to the resolver, term two permits established management sessions, and term three is a catch-all. When Junos evaluates this filter against an incoming packet, in what order does it check the terms?
• A cooperative's NOC wants a firewall-filter term that tallies how much traffic from a suspicious source address is arriving at a POP router, but still lets that traffic continue to be evaluated against the remaining terms in the filter. Which kind of then action should the term use?
• A rural broadband cooperative applies a firewall filter to a subscriber-facing interface with two terms: one permits DHCP, and one permits DNS. A subscriber's device then sends an ICMP echo request that matches neither term. What happens to that packet?
• A cooperative's engineer needs to filter traffic arriving from subscribers into a POP router's aggregation interface, while leaving traffic the router sends back out to those same subscribers unaffected. Under family inet on that interface, which statement should reference the firewall filter?
• A regional carrier-hotel operator wants to protect a POP router's Routing Engine from unauthorized SSH and SNMP attempts, without affecting the transit customer traffic the router forwards through its packet-forwarding engine. Which interface should the firewall filter be applied to for this purpose?
• A rural fiber cooperative wants a firewall-filter term to cap how much traffic a single residential subscriber's aggregation port can send toward the core, allowing a small burst above the cap for normal web-browsing behavior. Which introductory Junos concept, referenced inside a filter term's then action, is designed for this kind of rate limiting?
• An engineer at a small-town head-end facility writes a firewall-filter term intended to match only inbound TCP traffic destined for port 22 on the POP router from a specific NOC host address. Which part of the term should carry the source address, destination port, and protocol conditions that decide whether a packet matches?
• A co-op's NOC configures a filter term with the then action set to log, matching traffic from an unfamiliar address range hitting a POP router. After that term, the filter has two more terms: one permitting known partner traffic and a final explicit discard-all term. Does the log action by itself stop the matched packet from reaching the later terms?
• A cooperative's filter has four terms applied to a POP router's transit-facing interface. Traffic from a peering partner matches term two, and term two's then action is accept, a terminating action. What happens to terms three and four for that specific packet?
• A rural broadband cooperative notices that one subscriber on a shared aggregation port is consuming enough upstream bandwidth to degrade service for neighboring subscribers on the same port. Which combination of Junos concepts, applied together on that interface, addresses this at an introductory level?
• A new technician at a regional ISP asks why the co-op's POP router evaluates each packet against a firewall filter independently, rather than remembering that a subscriber's device already had an accepted connection a moment earlier. Which characteristic of a Junos firewall filter explains this behavior?
• A carrier-hotel operator applies a firewall filter to a POP router's transit interface that discards packets from a specific bogon range. After the filter is committed, does the router's routing table change as a result of packets from that range being discarded?
• A rural telecom cooperative wants unauthorized SSH attempts hitting its POP router's loopback filter to be dropped without any indication being sent back to the source, so a scanning host gets no useful feedback at all. Which terminating then action fits this requirement better than the alternative that would notify the sender?
• A regional ISP's edge router receives a packet claiming a source address from a private, non-routable range on an interface facing the public internet, which should never legitimately appear there. Which introductory firewall-filter approach addresses this kind of spoofed-source traffic at the network edge?
• A technician configures a POP router's firewall filter with term A first, which broadly discards all TCP traffic, followed by term B, which is meant to permit TCP port 22 from the NOC subnet. After committing, NOC staff can no longer reach the router by SSH. What is the most likely cause?
• A cooperative's NOC is troubleshooting a suspected DDoS-style flood aimed at a POP router and wants to see, in near real time, how much traffic each firewall-filter term is matching without disrupting the accept and discard decisions already configured. Which action should be added to the terms of interest to provide this visibility?