JNCIA-JUNOS Networking Fundamentals — 20 Questions

Question 1

A network administrator notices that traffic between two VLANs is not reaching its destination. The switch has an IRB interface configured with an IP address in each VLAN's subnet. What is the most likely missing configuration?

Accepted Answer

The VLANs are not defined on the switch.. The IRB interface provides Layer 3 routing between VLANs, but it requires the VLANs themselves to be defined on the switch. If the VLANs are not defined, the switch cannot associate the IRB interface with the correct broadcast domains, and traffic will not be forwarded between them. Option C correctly identifies this missing configuration.

Answer

The IRB interface does not have an IP address configured.

Answer

The VLANs are on different switches.

Answer

The switch ports are not configured for VLAN tagging.

Question 2

A network engineer is troubleshooting OSPF adjacencies between two Juniper routers. The routers are directly connected and have matching OSPF configurations except for the router IDs. Router A has router-id 10.0.0.1, Router B has router-id 10.0.0.2. The adjacency remains in the EXSTART state. What is the most likely cause?

Accepted Answer

The MTU on the interface is mismatched.. The EXSTART state indicates that the routers have progressed past the 2-Way state and are attempting to exchange Database Description (DBD) packets. A common cause for getting stuck in EXSTART is an MTU mismatch, because OSPF uses the interface MTU to determine the maximum size of DBD packets. If Router A's MTU is larger than Router B's, Router B will drop the oversized DBD packet and the adjacency will remain in EXSTART.

Answer

The router IDs are not the same.

Answer

The area ID is not configured.

Answer

The hello and dead intervals are mismatched.

Question 3

An administrator needs to ensure that traffic from the 192.168.1.0/24 subnet is allowed to reach the internet through a Juniper SRX firewall. The SRX is configured with security policies. Which policy element is required to permit this traffic?

Accepted Answer

Source zone. In Juniper SRX security policies, the source zone is a mandatory element that defines the origin of the traffic. Since the traffic originates from the 192.168.1.0/24 subnet, the policy must specify the source zone (e.g., 'trust' or 'internal') to match the incoming traffic and permit it toward the internet (destination zone, e.g., 'untrust'). Without a source zone, the policy cannot be applied to the correct traffic flow.

Answer

Source address

Answer

Application

Answer

Destination zone

Question 4

A network engineer is designing a redundant network with two Juniper routers running VRRP. The virtual IP address is 10.0.0.1. Both routers are configured as VRRP group 1. What is the purpose of the 'priority' parameter in VRRP configuration?

Accepted Answer

It determines the master router election.. In VRRP, the 'priority' parameter (range 1-254, default 100) is used to elect the master router. The router with the highest priority becomes the master for the virtual IP address 10.0.0.1, ensuring redundancy by taking over traffic forwarding if the current master fails.

Answer

It sets the interval for VRRP advertisements.

Answer

It determines the virtual MAC address.

Answer

It changes the virtual IP address.

Question 5

Which TWO statements about Juniper's implementation of static routes are correct? (Choose two.)

Accepted Answer

The default preference for static routes is 5.. Option A is correct because in Juniper's Junos OS, the default preference (administrative distance) for static routes is 5. This value indicates that static routes are highly trusted, only surpassed by directly connected routes (preference 0). This is a Juniper-specific default, differing from Cisco's default of 1 for static routes.

Answer

Static routes always have a metric of 1.

Answer

Static routes are automatically redistributed into OSPF.

Answer

The default preference for static routes is 170.

Question 6

You are responsible for a Juniper MX router that connects two customer sites over a Layer 3 VPN. The router is configured with BGP for VPN routes and uses MPLS to forward traffic. Recently, the customer reported that traffic from Site A (10.0.1.0/24) to Site B (10.0.2.0/24) is intermittently failing. You check the routing table on the router and see that both routes are present with valid next-hops. However, when you ping from the router's loopback to the remote site's loopback, the ping succeeds. MPLS labels are being assigned and the LSP is up. You also notice that when the failure occurs, the router's BGP session to the remote PE is still established. The failure seems random and lasts a few seconds before recovering. Which troubleshooting step is most likely to identify the root cause?

Accepted Answer

Review the forwarding table for the affected prefixes and check for any discrepancies.. Option B is correct because the issue is intermittent packet loss with valid routes in the routing table but successful pings from the loopback. This points to a forwarding table (FIB) inconsistency, where the control plane (routing table) has the correct next-hop, but the forwarding plane (PFE) may have a stale or incorrect entry for the specific prefixes. Checking the forwarding table with 'show route forwarding-table' will reveal if the next-hop or label information differs from the routing table, which is a classic symptom of a hardware programming issue or a transient PFE problem.

Answer

Check the interface error counters for CRC errors or drops.

Answer

Verify the BGP session state and check for route flapping.

Answer

Check the MPLS label switching table to ensure labels are correctly assigned.

Question 7

A network engineer is troubleshooting connectivity between two directly connected Juniper routers. The interface on Router A shows 'up' but no packets are being received from Router B. Which command should the engineer use on Router A to check if the interface is expecting to receive a specific encapsulation type?

Accepted Answer

show interfaces terse. Option B is correct because the 'show interfaces terse' command displays a concise summary of interface status, including the encapsulation type configured on each interface. If Router A expects a specific encapsulation (e.g., PPP, HDLC, or Ethernet) that does not match what Router B is sending, the interface will show 'up' but will not receive packets. This command allows the engineer to quickly verify the configured encapsulation type without extraneous details.

Answer

show interfaces extensive

Answer

show configuration interfaces

Answer

monitor traffic interface

Question 8

A network administrator is configuring a new subnet for servers that must not communicate with each other directly but must be able to reach a default gateway. Which type of route should be configured on the servers?

Accepted Answer

Default route pointing to the gateway. A default route (0.0.0.0/0) pointing to the gateway is correct because it allows servers to reach any external destination (including the gateway) without requiring explicit routes to each other. Since the servers must not communicate directly, they should not have routes to each other's subnets; the default route ensures all non-local traffic is forwarded to the gateway, which can then enforce isolation policies.

Answer

Host route for the gateway

Answer

Dynamic route via OSPF

Answer

Static route to each other server

Question 9

An engineer is designing a network with two routers connected via a serial link. The link should support multiple logical subinterfaces for different VLANs. Which encapsulation type must be used on the serial interface?

Accepted Answer

Frame Relay. Frame Relay is correct because it supports multiple logical subinterfaces (DLCIs) on a single serial link, allowing different VLANs to be mapped to separate virtual circuits. Unlike PPP or HDLC, Frame Relay inherently provides the ability to create point-to-point or multipoint subinterfaces for Layer 2 segmentation.

Answer

Ethernet

Answer

PPP

Answer

HDLC

Question 10

A Juniper router is configured with two static routes to the same destination network, both with the same preference. One route has a metric of 5, the other a metric of 10. Which route will be installed in the routing table?

Accepted Answer

The route with metric 5 is installed. In JUNOS, when multiple static routes to the same destination have the same preference (administrative distance), the route with the lower metric is selected for installation in the routing table. Here, metric 5 is lower than metric 10, so the route with metric 5 is installed. This behavior follows the standard route selection process where preference is evaluated first, then metric (also called cost or next-hop metric) as a tiebreaker.

Answer

Neither route is installed because they conflict

Answer

The route with metric 10 is installed

Answer

Both routes are installed with equal preference

Question 11

Arrange the steps to configure an IPsec VPN on a Junos SRX in the correct order.

Question 12

Match each Junos system log severity level to its meaning.

Question 13

A network engineer is troubleshooting connectivity between two hosts on the same VLAN connected to different Juniper EX switches. The MAC address table on each switch shows the correct MAC addresses for both hosts, but ping fails. What is the most likely cause?

Accepted Answer

The VLAN is not allowed on the trunk between the switches. If both hosts are on the same VLAN and their MAC addresses are correctly learned on each switch, the issue is likely that the VLAN is not allowed on the trunk link connecting the switches. Without the VLAN being permitted on the trunk, frames from that VLAN will be dropped at the trunk interface, preventing Layer 2 communication between the hosts even though the MAC tables are correct.

Answer

The hosts are configured with IP addresses in different subnets

Answer

The ARP cache on the hosts is stale

Answer

Spanning Tree Protocol is blocking a port

Question 14

A host needs to verify that its assigned IP address is not already in use on the network. Which type of packet does the host send?

Accepted Answer

ARP request with target IP set to its own IP. When a host wants to verify that its assigned IP address is not already in use on the network, it sends an ARP request with the target IP set to its own IP address. This is known as a gratuitous ARP request, and if another host responds with an ARP reply, it indicates an IP address conflict. This process is part of the Duplicate Address Detection (DAD) mechanism, commonly used in IPv4 networks to ensure uniqueness before the address is fully configured.

Answer

ARP reply with its own MAC address

Answer

Gratuitous ARP reply

Answer

ARP request with target IP set to the default gateway

Question 15

A Juniper EX switch has two VLANs configured, each with an IRB interface assigned an IP address. Pings between hosts in different VLANs fail. What is the most likely missing configuration?

Accepted Answer

IP routing is not enabled globally: set routing-options router-id 10.0.0.1; set routing-options rib inet.0 static route 0.0.0.0/0 next-hop 203.0.113.1. Option B is correct because on a Juniper EX switch, inter-VLAN routing requires IP routing to be explicitly enabled. By default, routing is disabled on Juniper switches, so even with IRB interfaces configured, traffic between VLANs will not be forwarded unless routing is enabled globally using the `set routing-options router-id` command (which activates the routing engine) and a default route is configured to provide a next-hop for inter-VLAN traffic. Without this, the switch will not perform Layer 3 forwarding between the IRB interfaces.

Answer

The VLANs are not configured with the same VLAN ID

Answer

The switch needs an external router configured for VLAN routing

Answer

The IRB interfaces are not in the same routing instance

Question 16

A router receives a packet with destination IP 10.1.1.100. The routing table contains two entries: a static route to 10.1.1.0/24 via 192.168.1.1, and an OSPF route to 10.1.1.0/25 via 192.168.2.1. Which route will the router use?

Accepted Answer

The OSPF route to 10.1.1.0/25. The router will use the OSPF route to 10.1.1.0/25 because it has a longer prefix length (/25) than the static route (/24). Juniper Junos uses the most specific (longest) prefix match in the routing table, regardless of administrative distance or protocol preference. The destination IP 10.1.1.100 falls within the 10.1.1.0/25 range (10.1.1.0–10.1.1.127), so the /25 route is more specific and thus preferred.

Answer

The router drops the packet due to a routing conflict

Answer

The static route to 10.1.1.0/24

Answer

Both routes are used for load balancing

Question 17

A host in VLAN 10 can ping a host in VLAN 20 without a default gateway configured. What feature is likely enabled on the router that interconnects the VLANs?

Accepted Answer

Proxy ARP. Proxy ARP allows a router to respond to ARP requests on behalf of hosts in different subnets. When a host in VLAN 10 sends an ARP request for a host in VLAN 20, the router responds with its own MAC address if it has a route to the destination. This enables the host to send traffic to the router, which then forwards it to the destination VLAN, even without a default gateway configured on the host.

Answer

VLAN translation is configured on the trunk

Answer

IP routing is enabled on the router

Answer

Dynamic ARP Inspection

Question 18

An engineer enables Spanning Tree PortFast on a switch port connected to a host. Later, another switch is connected to that same port, causing a loop. What feature could have prevented this?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it disables a port configured with PortFast if a BPDU is received, preventing loops when a switch is accidentally connected. In this scenario, PortFast was enabled for a host, but connecting another switch caused BPDUs to be sent, which BPDU guard detects and shuts down the port to break the loop.

Answer

Loop guard

Answer

Root guard

Answer

UplinkFast

Question 19

A switch receives a unicast frame with a destination MAC address that is present in its MAC address table. How does the switch process the frame?

Accepted Answer

It forwards the frame only out of the port associated with that MAC address. When a switch receives a unicast frame and the destination MAC address is already in its MAC address table, it performs a lookup and forwards the frame only out of the specific port associated with that MAC address. This is the fundamental switching behavior known as 'unicast forwarding' or 'filtering,' which avoids unnecessary flooding and preserves bandwidth.

Answer

It sends the frame back to the source port

Answer

It floods the frame to all ports except the receiving port

Answer

It drops the frame

Question 20

Which field in an Ethernet frame is used by a switch to learn which source MAC address belongs to which port?

Accepted Answer

Source MAC address. A switch learns MAC address-to-port mappings by examining the source MAC address field of incoming Ethernet frames. When a frame arrives on a port, the switch records the source MAC address and associates it with that port in its MAC address table, enabling future frames destined for that MAC to be forwarded only to the correct port.

Answer

Ethertype field

Answer

Destination MAC address

Answer

VLAN ID field