Juniper Networks · Free Practice Questions · Last reviewed May 2026
48real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are configuring VSTP (VLAN Spanning Tree Protocol) on Juniper EX switches to interoperate with legacy third-party switches running PVST+. Which operational command allows you to verify the VSTP bridge identifier and root bridge status per VLAN?
show ethernet-switching vstp
show spanning-tree vlan detail
show vstp vlan
show vstp vlan provides per-VLAN spanning tree operational status.
show bridge vstp-status
When configuring advanced VLAN mapping on a Juniper MX Series router using flexible VLAN tagging, which term describes the action of replacing an incoming inner VLAN tag with a new tag before forwarding into the provider core?
VLAN stripping
VLAN swap
Swap replaces an existing tag with a new tag value.
VLAN push
VLAN pop
You need to design a scalable Layer 2 architecture across multiple data center buildings using Juniper switches, avoiding single points of failure while preventing bridging loops. Which scaling mechanism allows Active-Active multihoming without running Spanning Tree Protocol across the core?
Layer 2 Tunneling Protocol (L2TPv3) bridging
Multi-Chassis Link Aggregation (MC-LAG) with ICCP
MC-LAG uses ICCP to coordinate forwarding between two peer switches, enabling active-active uplinks without STP loops.
Rapid PVST+ with root guard on all access ports
Virtual Chassis with spanning-tree disabled
You are troubleshooting a Q-in-Q tunneling implementation on an MX Series router where customer VLAN tags are being stripped instead of preserved across the service provider core. Under which configuration hierarchy should the 'vlan-tagging' and 'pop-pop' or 'push' actions be applied on the interface?
set interfaces ge-0/0/1 flexible-vlan-tagging
flexible-vlan-tagging is required on the physical interface to process multiple VLAN tags.
set protocols l2-learning interface ge-0/0/1 q-in-q
set bridge-domains bd vlan-id-list 10
set interfaces ge-0/0/1 encapsulation flexible-ethernet-services
An enterprise network engineer needs to configure a trunk port on a Juniper EX Series switch running Junos OS to allow multiple VLANs while explicitly blocking VLAN 99. Which configuration statement under 'interfaces ge-0/0/1 unit 0 family ethernet-switching' correctly achieves this?
exclude-vlan-members 99;
block-vlan 99;
vlan-members except 99;
Using 'vlan-members except' allows all other VLANs except the one specified.
vlan-members [ vlan-members except 99 ];
You are configuring Q-in-Q tunneling on an MX Series router where customer frames arrive with VLAN tag 100, and you need to encapsulate them with a service provider outer VLAN tag 3000 using 'vlan-map'. Where is the VLAN map applied?
Under the routing-instance bridge-domain configuration
Under the logical interface unit configuration using input/output vlan-map
VLAN maps for tag manipulation are applied under logical interface units.
Under protocols l22-control configuration hierarchy
Under the physical interface encapsulation statement
Want more Ethernet Switching And Spanning Tree practice?
Practice this domainWhich BGP community is a well-known transitive community used to prevent a route from being advertised outside of a local autonomous system?
no-peer
local-as
no-export
The NO_EXPORT community prevents routes from being advertised outside the local autonomous system.
no-advertise
A network engineer has configured BGP multipath on a Junos routing device using the 'multipath' statement under the routing-options bgp hierarchy. However, traffic is still only utilizing a single path. Which condition must be met for BGP multipath to become active for a destination prefix?
Multipath requires BGP prefix-independent convergence (PIC) to be explicitly enabled on all routing engines.
The next hops must be directly connected interfaces without relying on IGP resolution.
All paths must originate from the exact same autonomous system in the AS path attribute.
All competing BGP paths must have identical AS path lengths, local preference, origin, and MED.
Junos requires key attributes including AS path length, local preference, origin, and MED to match for multipath consideration.
An administrator configures a BGP routing policy to match routes with community members using regex matching in Junos. Which statement accurately describes how Junos represents standard BGP communities in policy matching?
Communities are defined within policy-options using community members specified in AS:number format and matched via community-list.
Junos uses named community lists with AS:number syntax to match BGP communities.
Community matching in Junos requires explicit activation under the forwarding-options hierarchy.
Communities must be converted to extended communities before any regular expression can be applied.
Communities are matched exclusively using hexadecimal bitmasks in policy match conditions.
An administrator applies a policy containing 'as-path-prepend "65001 65001"' to outbound BGP updates sent to an external provider. What is the primary objective of this configuration?
To force the external peer to drop all updates due to an AS path loop check failure.
To enable BGP multipath load balancing across multiple external links.
To establish a confederation sub-AS relationship with the external provider.
To artificially increase the AS path length attribute to make this path less preferred by inbound traffic.
AS path prepending is a standard traffic engineering technique to make a route less attractive by lengthening the AS path.
Which command should an engineer use on a Junos device to verify whether a BGP next hop is successfully resolved via the routing table?
show route protocol bgp next-hop
This command is specifically designed to inspect BGP next-hop resolution state in Junos.
show bgp neighbor detail
show route forwarding-table destination
show bgp summary
An enterprise network uses a BGP route reflector (RR) architecture where client routers reflect routes to each other. A non-client router sends a route with an Originator ID and Cluster List to the RR. How does the route reflector handle these attributes when reflecting the route to other clients?
It removes the Originator ID and replaces the Cluster List with its own cluster ID.
It increments the Originator ID value by one and clears the Cluster List.
It leaves the Originator ID intact and appends its own cluster ID to the Cluster List.
The RR preserves the Originator ID and adds its local cluster ID to the front of the Cluster List.
It clears both the Originator ID and Cluster List to reset loop detection for the local cluster.
Want more BGP Advanced practice?
Practice this domainWhen configuring a hierarchical scheduler map on an MX Series router, what is the primary purpose of the aggregate level shaping?
To dynamically assign forwarding classes based on IP headers
To ensure absolute priority for best-effort traffic
To limit the total traffic across all queues associated with the scheduler map
Aggregate shaping controls the sum of all traffic belonging to the child schedulers.
To rewrite CoS bits on egress frames
An administrator needs to implement a traffic conditioning profile on a Juniper MX Series router to limit traffic to a specific burst size and drop packets exceeding the rate. Which policing action parameter is required to ensure that exceeding traffic is dropped immediately without coloring?
forwarding-class
transmit
mark-action
discard
The discard action drops the packet immediately.
Which standard Junos forwarding class is reserved for control plane traffic such as routing protocols and management traffic?
expedited-forwarding
assured-forwarding
best-effort
network-control
network-control is the default class for high-priority control plane traffic.
You need to ensure that delay-sensitive voice traffic is serviced before all other queues on an egress interface. Which scheduler property should you configure for the voice forwarding class?
buffer-size
transmit-rate
drop-profile
priority high
Setting priority to high enables strict priority queuing for the queue.
You want to apply a rewrite rule on an outgoing interface to remark the DSCP bits of packets leaving your Juniper router. Where must this rewrite rule be applied within the CoS hierarchy?
[edit firewall]
[edit class-of-service interfaces]
Rewrite rules are applied on egress interfaces.
[edit routing-options]
[edit class-of-service classifiers]
Which command is used to verify the operational state of forwarding classes and their assigned queues on a specific interface on Junos?
show route forwarding-table
show class-of-service interface
This command displays CoS settings and queue mappings for interfaces.
show interfaces extensive
show firewall
Want more Class OF Service practice?
Practice this domainAn administrator is deploying EVPN multi-homing with all-active mode on an MX Series router. Which configuration element uniquely identifies the provider edge (PE) router's attachment circuit to an Ethernet segment?
Route Distinguisher (RD)
Ethernet Tag ID
Ethernet Segment Identifier (ESI)
The ESI uniquely identifies the multi-homed segment across the network.
ESI Label Extended Community
You are troubleshooting a suboptimal traffic forwarding issue in an EVPN-VXLAN fabric with multi-homed devices. Traffic destined for a multi-homed server is being sent to only one of the PEs despite all-active mode being configured. Which EVPN route type and mechanism are responsible for enabling load balancing across all available PEs attached to the same Ethernet segment?
Route Type 1 (Ethernet Auto-Discovery per EVI)
Type 1 routes per EVI provide the aliasing function required for load balancing traffic across all PEs attached to a multi-homed segment.
Route Type 2 with MAC mobility extended community
Route Type 4 (Ethernet Segment Route)
Route Type 3 (Inclusive Multicast)
You are configuring a Junos EVPN-VXLAN environment where Type-3 (Inclusive Multicast Ethernet Tag) routes are being exchanged. A remote MX router is failing to establish ingress replication tunnels because it does not import the Type-3 route. Which configuration statement under the routing-instance is missing or misconfigured?
no-normalization
route-target import
Type-3 routes use standard BGP route targets. If the import route target is missing or incorrect, the Type-3 route will not be accepted into the EVPN routing instance's BGP table.
multicast-snooping
vtep-source-interface lo0.0
An administrator notices that broadcast, unknown unicast, and multicast (BUM) traffic sent from a local host is looping back to the originating multi-homed PE when using an all-active Ethernet segment. Which mechanism prevents this loop in EVPN?
BGP Best Path Selection algorithm
EVPN Split Horizon filtering using ESI labels
Split horizon filtering ensures that a PE does not echo BUM traffic back to an Ethernet segment it shares with another PE.
Designated Forwarder (DF) election
Spanning Tree Protocol (STP) root guard
During a maintenance window, an administrator needs to manually force a Designated Forwarder (DF) role change on a multi-homed Ethernet segment for an EVPN instance. Which parameter must be adjusted to influence the DF election algorithm in Junos OS?
BGP AS path prepending
Route Distinguisher value
Router ID of the BGP speaker
Ethernet segment preference value
Configuring a higher or lower segment preference value under the ESI configuration explicitly influences the DF election.
When configuring VXLAN data plane encapsulation inside an EVPN routing instance on Junos OS, which logical interface type must be bound to the bridge domain to provide VXLAN VNI mapping?
lo0.0
gre0
VLAN interface (vlan statement with vni)
Bridge domains configured with a specific vni identifier handle the mapping between VLANs and VXLAN VNIs.
fxp0
Want more EVPN practice?
Practice this domainAn administrator notices that an EX4300 switch is supplying power using LLDP-MED power negotiation, but the IP phone is drawing more power than the initial hardware class allows. Where would you check the advertised LLDP-MED TLV power value received from the phone?
show system lldp-med power-statistics
show poe interface ge-0/0/10 lldp-negotiation
show lldp neighbor interface ge-0/0/10 detail
The detail modifier displays all received TLVs, including LLDP-MED power management details.
show ethernet-switching interfaces lldp ge-0/0/10
Which command allows you to verify the real-time PoE power consumption, allocated wattage, and operational status of all interfaces on an EX Series switch?
show interfaces diagnostics poe
show chassis poe status
show lldp poe-status
show poe interface
show poe interface is the correct operational command to view PoE statistics on Junos switches.
You are configuring a voice VLAN on an EX Series switch access port where an IP phone is connected in series with a PC. Which configuration is required on the switch interface to handle both tagged voice traffic and untagged data traffic?
Configure the port as an RSTP edge port with voice optimization.
Configure the port as a pure trunk port blocking all native VLAN traffic.
Configure the interface as access mode with both voice-vlan and native-vlan parameters.
Using an access port with a voice VLAN allows untagged PC traffic to fall into the native VLAN while tagged phone traffic uses the voice VLAN.
Configure the port using bridge-domains with dual-tagging (QinQ).
An EX3400 switch experiences a total PoE power budget exhaustion after multiple high-power IP phones and security cameras are plugged in. You want to ensure that if a power deficit occurs, the switch immediately cuts power to lower-priority ports while maintaining power to executive phones on specific ports. How should you configure this?
set poe interface all priority low and set poe interface ge-0/0/1 to ge-0/0/4 priority high
Setting interface priorities ensures the power management daemon sheds low-priority ports first during an overload condition.
set poe power-budget-threshold 80
set poe management-mode class-based
set interfaces all poe shutdown-on-overload
What is the default behavior of an EX Series switch when an LLDP-MED capable IP phone connects and requests a network policy for voice VLAN?
The switch drops the LLDP packet unless explicit authorization is configured.
The switch responds with the configured LLDP-MED network policy containing the voice VLAN ID and Layer 2/3 priority markings.
The switch replies with the network policy TLV matching the configured parameters.
The switch converts the port into a full trunk interface automatically.
The switch reboots the port to force DHCP discovery.
You are troubleshooting an IP phone that is failing to discover its voice VLAN via LLDP-MED on an EX4600 switch. You issue the show lldp interface command and see that LLDP is transmitting properly, but the phone reports no voice VLAN TLV received. What is the most likely cause of this issue?
The voice VLAN is not configured under the switch-options vlan-group hierarchy.
The LLDP-MED network policy for voice has not been defined and mapped to the interface or device profile.
Without an explicit LLDP-MED network policy defining the voice VLAN ID and DSCP values, the switch will not advertise the voice VLAN TLV.
IEEE 802.1p priority marking is missing from the global bridge-options statement.
LLDP advertisement interval is set too high, causing timeout on the phone.
Want more IP Telephony Features practice?
Practice this domainWhen configuring OSPFv3, which Junos address-family hierarchy is used to enable OSPFv3 on an interface?
set protocols ospf3 area 0.0.0.0 interface xe-0/0/0.0
OSPFv3 is configured under protocols ospf3 referencing areas and interfaces directly.
set protocols ospf version 3 area 0.0.0.0 interface xe-0/0/0.0
set protocols ipv6 ospf area 0.0.0.0 interface xe-0/0/0.0
set protocols ospf3 ipv6 area 0.0.0.0 interface xe-0/0/0.0
You want to tune OSPF convergence by reducing the hello and dead intervals on a point-to-point interface. Which configuration is valid?
set protocols ospf area 0.0.0.0 timers hello-interval 1
set interfaces xe-0/0/0.1 ospf hello-interval 1
set protocols ospf hello-interval 1 dead-interval 4
set protocols ospf area 0.0.0.0 interface xe-0/0/0.1 hello-interval 1
Hello and dead intervals are configured per interface under the OSPF area.
You are redistributing static routes into OSPF on a Junos device and want to assign a specific metric type to the resulting External LSAs. Where is this metric-type defined?
set policy-options policy-statement REDIST-STATIC term 1 from external-type 1
set protocols ospf export REDIST-STATIC metric-type 1
set policy-options policy-statement REDIST-STATIC term 1 then metric-type type-1
The 'metric-type' action within a routing policy 'then' clause sets the OSPF external metric type.
set protocols ospf redistribute static metric-type 1
An OSPF area in your network contains multiple ABRs. You need to suppress the generation of Type-4 summary LSAs into a totally stubby area. How does Junos handle this natively?
You must apply an export policy on the ABR blocking Type-4 LSAs.
You must use set protocols ospf suppress-fa to remove Type-4 LSAs.
Totally stubby areas automatically block Type-4 LSAs by design without additional configuration.
Type-4 LSAs (ASBR summaries) are blocked along with Type-3 and Type-5 LSAs in totally stubby areas.
You must configure set protocols ospf area <area> stub no-summary-asbr.
Which Junos command displays the link-state database for OSPFv2, showing router LSAs and network LSAs?
show route ospf database
show link-state ospf database
show ospf database
This command outputs the complete OSPF LSDB.
show protocols ospf database
An administrator needs to filter Type-3 LSAs entering an OSPF stub area on a Junos routing device. Which statement under the area hierarchy is required?
set protocols ospf area 0.0.0.2 type-3-lsa-block
set protocols ospf area 0.0.0.2 stub lsa-filter block-type-3
set protocols ospf area 0.0.0.2 filter type-3-lsa
set protocols ospf area 0.0.0.2 area-range 192.168.1.0/24 restrict
The 'restrict' option prevents the summary LSA from being injected into the area.
Want more Interior Gateway Protocols practice?
Practice this domainIn an enterprise network running PIM sparse-mode, an engineer notices that multicast traffic is switched from the shared tree (*,G) to the source-specific tree (S,G) prematurely, causing micro-bursts on core links. Which command disables this automatic switchover behavior on a Junos router?
set routing-options multicast spt-mode disable
set protocols pim disable-spt-switchover
set protocols igmp spt-threshold 0
set protocols pim spt-threshold infinity
Setting the SPT threshold to infinity prevents the last-hop router from switching to the source-specific tree, keeping it on the shared tree.
An enterprise network uses PIM sparse-mode across multiple routing instances. An administrator notices that source registration messages are looping between the designated router (DR) and the RP. Which configuration statement under [edit protocols pim] will prevent the DR from continuously encapsulating and sending register messages when no receivers are joined?
set protocols pim interface all no-bsr
set protocols pim rp static address 192.168.1.1 register-policy REJECT-REG
set protocols pim rp static address 192.168.1.1 no-registration-suppression
set protocols pim rp static address 192.168.1.1
Configuring a static RP properly ensures the DR knows the unicast destination for register encapsulation, and Junos handles register-stop suppression natively when configured correctly.
An engineer wants to restrict IGMP membership reports to only accept version 2 on a specific VLAN interface configured on an MX Series router. Which configuration statement achieves this requirement?
set protocols pim interface vlan.10 igmp-version 2
set protocols igmp interface vlan.10 version 2
This explicitly forces the IGMP version on the specified interface to version 2.
set routing-options multicast igmp-version 2 interface vlan.10
set interfaces vlan.10 igmp-version 2
A network administrator needs to display the multicast routing table entries, including incoming interfaces and outgoing interface lists (OIL), on a Junos device. Which operational command should be used?
show ospf route
show multicast route
This command displays the active multicast forwarding cache and routing state.
show igmp interface
show pim join
An administrator wants to configure MSDP (Multicast Source Discovery Protocol) between two autonomous system border routers to share active source information. Which configuration hierarchy in Junos is used to define the MSDP peer relationship?
[edit routing-options msdp]
[edit protocols msdp]
MSDP peer parameters and local address configurations are placed under protocols msdp.
[edit protocols pim msdp]
[edit protocols bgp group msdp]
An enterprise design requires configuring an Anycast RP setup using two Junos routers to provide redundancy for PIM sparse-mode. Which mechanism is required to synchronize source state information between the two Anycast RPs within the same AS?
Multicast Source Discovery Protocol (MSDP)
MSDP is used between Anycast RPs to exchange source-active information so that receivers joined to one RP learn about sources registered to the other RP.
Protocol Independent Multicast Dense-Mode (PIM-DM)
IGMPv3 snooping
Multicast BGP (MBGP)
Want more IP Multicast practice?
Practice this domainWhat is the primary function of the RADIUS server attribute 'Tunnel-Medium-Type' (Attribute 65) when received during an 802.1X authentication exchange on an EX Series switch?
It defines the VLAN ID or VLAN name to which the authenticated client port should be dynamically assigned.
It determines the encryption cipher used between the switch and the RADIUS server.
It specifies the physical transport media type for the tunnel, such as 802 (Ethernet) for VLAN assignment.
Correct. Attribute 65 defines the medium type (typically 802 for IEEE 802 networks).
It indicates the authentication protocol (PAP, CHAP, EAP) being used in the tunnel.
Which command allows an administrator to verify the active supplicant states and authentication status on a specific EX Series switch interface?
show ethernet-switching table dot1x
show access security clients
show radius-server authentication statistics
show dot1x interface
Correct. This command shows the operational state of 802.1X on interfaces.
You are troubleshooting an 802.1X deployment on an EX4300 switch. Clients fail to authenticate when using Supplicant-based authentication combined with MAC RADIUS fallback. You notice that the switch does not attempt MAC RADIUS after 802.1X times out. Which configuration error most likely caused this?
You enabled static MAC pinning on the access port, which disables fallback mechanisms.
You omitted the mac-radius statement from the global protocols access-profile configuration.
You configured the supplicant mode as single-supplicant instead of multi-supplicant.
You failed to include both dot1x and mac-radius within the interface authentication-order statement.
Correct. The switch evaluates authentication methods based on the defined authentication-order.
An enterprise network administrator needs to configure 802.1X authentication on EX Series switches. Which statement is correct regarding the default behavior of the supplicant timeout timer?
It dictates how long the switch waits before failing over to MAC RADIUS authentication.
It determines how long an authenticated client can remain idle before being disconnected.
It defines the duration the switch waits for an EAP-Request/Identity frame response before retransmitting.
Correct. supp-timeout dictates the wait time for the initial identity response.
It specifies the interval before the switch drops the entire RADIUS authentication session.
You are implementing MAC RADIUS authentication on an EX4600 switch. You notice that when a device connects, the switch sends the MAC address in the Username attribute (RADIUS attribute 1) with hyphen separators (e.g., aa-bb-cc-dd-ee-ff). Your RADIUS server expects colons (aa:bb:cc:dd:ee:ff). Where must you configure this format change on Junos OS?
Under [edit protocols access-profile profile-name mac-radius] using the format option.
Correct. Access profile configurations define the MAC address format for RADIUS requests.
Under [edit system radius-server server-name] using the attribute-format option.
Under [edit interfaces ge-0/0/1 unit 0 family ethernet-switching] using the mac-radius format command.
Under [edit access profile profile-name firewall] using the translation map.
You are configuring a captive portal on an EX Series switch. You want to ensure that specific management traffic and critical server subnets are accessible to clients *before* they authenticate through the captive portal. Which configuration feature accomplishes this?
RADIUS dynamic authorization profiles with pre-auth attributes.
Captive portal firewall exemption filters or walled garden (bypass) configuration.
Correct. Walled garden or bypass settings permit pre-auth traffic to specific IP ranges.
Global access profile authentication-bypass statements.
Static MAC bypass configuration under the protocols dot1x hierarchy.
Want more Layer 2 Authentication And Access Control practice?
Practice this domainThe JNCIP-ENT exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 8 domains: Ethernet Switching And Spanning Tree, BGP Advanced, Class OF Service, EVPN, IP Telephony Features, Interior Gateway Protocols, IP Multicast, Layer 2 Authentication And Access Control. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Juniper Networks JNCIP-ENT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.