JN0-102 · Question #331
You have configured a firewall filter with a single term matching on packets with a source address in the 10.0.0.0/24 subnet. This term only includes the count action. Which two statements are true…
The correct answer is B. Packets outside the 10.0.0.0/24 subnet will be rejected. D. Packets outside the 10.0.0.0/24 subnet will not be counted. Packets originating outside the 10.0.0.0/24 subnet will not match the firewall filter's single term, thus they will not be counted. Instead, these unmatched packets will be subjected to the firewall filter's implicit default action, which is to be discarded.
Question
You have configured a firewall filter with a single term matching on packets with a source address in the 10.0.0.0/24 subnet. This term only includes the count action. Which two statements are true about traffic evaluated by this firewall filter? (Choose two.)
Options
- APackets outside the 10.0.0.0/24 subnet will be accepted.
- BPackets outside the 10.0.0.0/24 subnet will be rejected.
- CPackets outside the 10.0.0.0/24 subnet will be counted.
- DPackets outside the 10.0.0.0/24 subnet will not be counted.
How the community answered
(37 responses)- A16% (6)
- B76% (28)
- C8% (3)
Why each option
Packets originating outside the 10.0.0.0/24 subnet will not match the firewall filter's single term, thus they will not be counted. Instead, these unmatched packets will be subjected to the firewall filter's implicit default action, which is to be discarded.
Packets outside the 10.0.0.0/24 subnet do not match the `count` term, and thus are not implicitly accepted by that term; they are handled by the default filter action.
Packets that do not match the configured term (i.e., those outside 10.0.0.0/24) will fall through to the implicit default action of the firewall filter, which is to discard them, effectively rejecting their passage.
Only packets matching the source address 10.0.0.0/24 subnet are subjected to the `count` action; packets outside this range are not counted by this specific term.
The `count` action is associated with the term matching the 10.0.0.0/24 subnet, so packets with source addresses outside this subnet will not match the term and therefore will not be counted.
Concept tested: Junos firewall filter default action and term matching
Source: https://www.juniper.net/documentation/us/en/software/junos/firewall-authentication/firewall-filters/topics/topic-map/firewall-filter-config-example.html
Topics
Community Discussion
No community discussion yet for this question.