JN0-106 Networking Fundamentals Practice Test 3 — 15 Questions

Question 1

Arrange the steps to configure an IPsec VPN on a Junos SRX in the correct order.

Accepted Answer

Step 1: Configure IKE proposals and policies (Phase 1). Step 2: Configure IPsec proposals and policies (Phase 2). Step 3: Configure security policies to permit VPN traffic. Step 4: Apply the IPsec VPN configuration to an interface (e.g., st0).. IPsec VPN setup involves IKE for key exchange, IPsec for encryption, and binding to an interface.

Answer

Step 1: Configure IPsec proposals and policies (Phase 2). Step 2: Configure IKE proposals and policies (Phase 1). Step 3: Apply the IPsec VPN configuration to an interface. Step 4: Configure security policies.

Answer

Step 1: Configure security policies to permit VPN traffic. Step 2: Configure IKE proposals and policies. Step 3: Configure IPsec proposals and policies. Step 4: Apply the IPsec VPN configuration to an interface.

Answer

Step 1: Apply the IPsec VPN configuration to an interface. Step 2: Configure IKE proposals and policies. Step 3: Configure IPsec proposals and policies. Step 4: Configure security policies.

Question 2

A host needs to verify that its assigned IP address is not already in use on the network. Which type of packet does the host send?

Accepted Answer

ARP request with target IP set to its own IP. When a host wants to verify that its assigned IP address is not already in use on the network, it sends an ARP request with the target IP set to its own IP address. This is known as a gratuitous ARP request, and if another host responds with an ARP reply, it indicates an IP address conflict. This process is part of the Duplicate Address Detection (DAD) mechanism, commonly used in IPv4 networks to ensure uniqueness before the address is fully configured.

Answer

ARP reply with its own MAC address

Answer

Gratuitous ARP reply

Answer

ARP request with target IP set to the default gateway

Question 3

A router receives a packet with destination IP 10.1.1.100. The routing table contains two entries: a static route to 10.1.1.0/24 via 192.168.1.1, and an OSPF route to 10.1.1.0/25 via 192.168.2.1. Which route will the router use?

Accepted Answer

The OSPF route to 10.1.1.0/25. The router will use the OSPF route to 10.1.1.0/25 because it has a longer prefix length (/25) than the static route (/24). Juniper Junos uses the most specific (longest) prefix match in the routing table, regardless of administrative distance or protocol preference. The destination IP 10.1.1.100 falls within the 10.1.1.0/25 range (10.1.1.0–10.1.1.127), so the /25 route is more specific and thus preferred.

Answer

The router drops the packet due to a routing conflict

Answer

The static route to 10.1.1.0/24

Answer

Both routes are used for load balancing

Question 4

A host in VLAN 10 can ping a host in VLAN 20 without a default gateway configured. What feature is likely enabled on the router that interconnects the VLANs?

Accepted Answer

Proxy ARP. Proxy ARP allows a router to respond to ARP requests on behalf of hosts in different subnets. When a host in VLAN 10 sends an ARP request for a host in VLAN 20, the router responds with its own MAC address if it has a route to the destination. This enables the host to send traffic to the router, which then forwards it to the destination VLAN, even without a default gateway configured on the host.

Answer

VLAN translation is configured on the trunk

Answer

IP routing is enabled on the router

Answer

Dynamic ARP Inspection

Question 5

An engineer enables Spanning Tree PortFast on a switch port connected to a host. Later, another switch is connected to that same port, causing a loop. What feature could have prevented this?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it disables a port configured with PortFast if a BPDU is received, preventing loops when a switch is accidentally connected. In this scenario, PortFast was enabled for a host, but connecting another switch caused BPDUs to be sent, which BPDU guard detects and shuts down the port to break the loop.

Answer

Loop guard

Answer

Root guard

Answer

UplinkFast

Question 6

A switch receives a unicast frame with a destination MAC address that is present in its MAC address table. How does the switch process the frame?

Accepted Answer

It forwards the frame only out of the port associated with that MAC address. When a switch receives a unicast frame and the destination MAC address is already in its MAC address table, it performs a lookup and forwards the frame only out of the specific port associated with that MAC address. This is the fundamental switching behavior known as 'unicast forwarding' or 'filtering,' which avoids unnecessary flooding and preserves bandwidth.

Answer

It sends the frame back to the source port

Answer

It floods the frame to all ports except the receiving port

Answer

It drops the frame

Question 7

Which field in an Ethernet frame is used by a switch to learn which source MAC address belongs to which port?

Accepted Answer

Source MAC address. A switch learns MAC address-to-port mappings by examining the source MAC address field of incoming Ethernet frames. When a frame arrives on a port, the switch records the source MAC address and associates it with that port in its MAC address table, enabling future frames destined for that MAC to be forwarded only to the correct port.

Answer

Ethertype field

Answer

Destination MAC address

Answer

VLAN ID field

Question 8

Refer to the exhibit. A frame with destination MAC 00:0c:29:2a:3b:4d arrives on interface ge-0/0/0. What action will the switch take?

Accepted Answer

Forward the frame out of ge-0/0/2 only. The switch learns MAC addresses and their associated VLANs from incoming frames. Since the destination MAC 00:0c:29:2a:3b:4d is already in the MAC address table and mapped to interface ge-0/0/2 within the same VLAN, the switch forwards the frame only out of ge-0/0/2. This is the fundamental behavior of transparent bridging: unicast frames are forwarded only to the port where the destination MAC was last seen.

Answer

Flood the frame to all ports except ge-0/0/0

Answer

Drop the frame because the VLAN does not match

Answer

Forward the frame out of both ge-0/0/1 and ge-0/0/2

Question 9

Refer to the exhibit. The OSPF neighbor adjacency repeatedly goes up and down on R1. What is a likely cause?

Accepted Answer

MTU mismatch between the two routers. An MTU mismatch between OSPF neighbors can cause the adjacency to flap because OSPF includes the interface MTU in the Database Description (DBD) packets. If the MTU values do not match, the receiving router will reject the DBD packet, preventing the exchange of LSAs and causing the neighbor state to reset. This is a common cause of repeated up/down OSPF adjacencies even when the physical link is stable.

Answer

The physical link is flapping

Answer

OSPF authentication is misconfigured

Answer

The routers are in different OSPF areas

Question 10

An engineer is troubleshooting a network issue where hosts on the same VLAN cannot communicate with each other. Which configuration element is most likely missing?

Accepted Answer

Spanning Tree Protocol enabled. Hosts on the same VLAN communicate at Layer 2 and do not require any Layer 3 configuration such as an IRB interface or default gateway. The most likely missing configuration is that Spanning Tree Protocol (STP) is not enabled. Without STP, loops can cause broadcast storms and MAC address flapping, preventing communication between hosts in the same VLAN. Therefore, option A is correct.

Answer

An IRB interface for the VLAN

Answer

A Layer 3 switchport

Answer

A default gateway for the VLAN

Question 11

A network engineer sees an unknown unicast flood on a Juniper EX switch. Which mechanism is most effective at reducing such floods?

Accepted Answer

Enable storm control for unknown unicast traffic.. Unknown unicast flooding occurs when a switch does not have a MAC address entry for a destination, causing it to flood the frame out of all ports in the VLAN except the ingress port. Storm control for unknown unicast traffic (set using `set ethernet-switching-options storm-control interface <interface> unknown-unicast`) directly limits the rate of such flooded traffic, preventing excessive bandwidth consumption. This is the most effective mechanism because it specifically targets and rate-limits unknown unicast floods without altering MAC learning or aging behavior.

Answer

Configure static MAC addresses for all endpoints.

Answer

Increase the MAC address table aging time.

Answer

Disable MAC learning on trunk interfaces.

Question 12

A company is deploying an EVPN-VXLAN fabric with Juniper QFX switches. To provide inter-subnet routing, which interface type must be configured?

Accepted Answer

IRB interface. In an EVPN-VXLAN fabric, Integrated Routing and Bridging (IRB) interfaces are required to provide inter-subnet routing. IRB interfaces act as Layer 3 gateways within the VXLAN overlay, enabling routing between different VLANs/VXLANs by terminating both the bridge domain and the routing instance. Without IRB, traffic cannot be routed between subnets in the EVPN-VXLAN fabric.

Answer

Physical interface with vlan-tagging

Answer

VXLAN tunnel endpoint (VTEP)

Answer

Loopback interface

Question 13

Refer to the exhibit. A host connected to ge-0/0/1 cannot reach a host connected to ge-0/0/2 even though both are in VLAN10. What is the most likely cause?

Accepted Answer

The hosts are configured with IP addresses on different subnets.. Although both hosts are in the same VLAN and can communicate at Layer 2 (MAC addresses), IP communication requires them to be on the same IP subnet. If the hosts have IP addresses on different subnets, they will attempt to use a default gateway for routing. Without a router or IRB interface configured, the traffic cannot be delivered, leading to unreachability.

Answer

VLAN10 is not defined in the global VLAN configuration.

Answer

An IRB interface for VLAN10 is not configured.

Answer

The interface ge-0/0/2 is configured as a trunk port.

Question 14

You are a network engineer for a large enterprise deploying a new data center using a spine-and-leaf architecture with Juniper QFX5100 switches. The underlay network uses OSPF for loopback reachability, and the overlay uses EBGP for EVPN. The leaf switches are configured as VTEPs (Virtual Tunnel Endpoints). One of the leaf switches, leaf-03, cannot establish OSPF adjacency with its spine switch, spine-01. The interfaces are up/up and the IP addresses are correctly configured. 'show ospf neighbor' on leaf-03 returns nothing. 'show ospf interface' shows the interface is in state DOWN. Both switches are configured with the same OSPF area (0.0.0.0) and the same hello interval (10 seconds). The MTU on both sides is 1500. Authentication is not configured. The spine switch has multiple OSPF neighbors from other leaves. The network is in production and other leaf switches are working fine. What is the most likely cause of the problem?

Accepted Answer

OSPF is disabled on the interface at the leaf switch.. The OSPF interface is in state DOWN while the physical interface is up/up, indicating that OSPF is not enabled on that interface. This can happen if OSPF is explicitly disabled under protocol configuration or if the interface is not included in the OSPF configuration. Option A is wrong because network type mismatch would not cause the interface state to be DOWN; adjacency would fail but the interface would remain UP. Option B is wrong because MTU issues would cause OSPF adjacency problems but the interface state would be UP (not DOWN). Option D is wrong because duplicate router IDs would affect all adjacencies, not just this one, and other leaves are working fine.

Answer

The OSPF network type is not consistent between the two switches.

Answer

The interface MTU is misconfigured on one side.

Answer

Duplicate router ID on leaf-03 and spine-01.

Question 15

You are troubleshooting a network connectivity issue at a medium-sized company that uses Juniper EX4300 switches. Users in VLAN 100 (10.10.100.0/24) report that they cannot access a server in VLAN 200 (10.10.200.0/24). The switch has IRB interfaces configured for both VLANs and is acting as the default gateway. The IRB interfaces are up and have correct IP addresses. The server and users have correct IP configurations. 'show arp' on the switch shows incomplete entries for some hosts in VLAN 100. 'show ethernet-switching table' shows MAC addresses for users are present on the correct access ports. However, pings from the switch to a user in VLAN 100 fail. What is the most likely issue?

Accepted Answer

The switch cannot resolve ARP requests because the user's host is not responding.. The 'incomplete' entries in the 'show arp' output indicate that the switch sent ARP requests for hosts in VLAN 100 but received no replies. Since the switch is the default gateway, it must resolve the Layer 2 MAC address of each host to forward traffic. If a user's host is not responding to ARP (e.g., due to a firewall, misconfiguration, or the host being offline), the switch cannot complete the ARP cache entry, causing pings from the switch to fail and potentially disrupting inter-VLAN routing.

Answer

Spanning Tree Protocol is blocking the user ports.

Answer

A static MAC address entry for the server is missing.

Answer

The IRB interface for VLAN 100 is not configured with a proxy ARP.