Juniper MX Series

Chapter Review Questions

1. Which is true regarding the DDoS prevention feature?

   1. The feature is off by default

   2. The feature is on by default with aggressive policers

   3. The feature is on by default but requires policer configuration before any alerts or policing can occur

   4. The feature is on by default with high policer rates that in most cases exceed system control plane capacity to ensure no disruption to existing functionality

2. Which is true about DDoS policers and RE protection policers evoked though a filter?

   1. The lo0 policer is disabled when DDoS is in effect

   2. The DDoS policers run first with the lo0 policer executed last

   3. The lo0 policer is executed before and after the DDoS policers, once at ingress and again in the RE

   4. Combining lo0 and DDoS policers is not permitted and a commit error is retuned

3. A strong RE protection filter should end with which of the following?

   1. An accept all to ensure no disruption

   2. A reject all, to send error messages to sources of traffic that is not permitted

   3. A discard all to silently discard traffic that is not permitted

   4. A log action to help debug filtering of valid/permitted services

   5. Both C and D

4. A filter is applied to the main instance lo0.0 and a VRF is defined without its own lo0.n ifl. Which is true?

   1. Traffic from the instance to the local control plane is filtered by the lo0.0 filter

   2. Traffic from the instance to remote VRF destinations is filtered by the lo0.0 filter

   3. Traffic from the instance to the local control plane is not filtered

   4. None of the above. VRFs require a lo0.n ...