JNCIP-ENT Practice Test 15 — 15 Questions

Question 1

You are configuring private VLANs (PVLANs) on a Juniper EX switch to isolate customer ports from one another while sharing a common gateway. Which VLAN type is configured to allow communication only with promiscuous ports?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolated VLAN. Isolated VLAN ports can only communicate with promiscuous ports.

Answer

Primary VLAN

Answer

Community VLAN

Answer

Target VLAN

Question 2

Which TWO BGP attributes are classified as well-known mandatory attributes that must be recognized by all BGP implementations? (Choose TWO)

Accepted Answer

AS_PATH. The well-known mandatory BGP attributes are AS_Path, NEXT_HOP, and ORIGIN. Among the choices, AS_PATH and NEXT_HOP are well-known mandatory attributes.

Answer

COMMUNITIES

Answer

MULTI_EXIT_DISC

Answer

LOCAL_PREF

Question 3

Which operational command is used to verify the operational status and peer state of MSDP sessions on a Junos device?

Accepted Answer

show msdp summary. The 'show msdp summary' command provides an overview of MSDP peers, state, and connection status.

Answer

show igmp summary

Answer

show pim summary

Answer

show multicast summary

Question 4

An administrator implements LLDP-MED on an EX Series switch network. To prevent unauthorized devices from masquerading as IP phones and requesting voice VLAN access, which feature should be combined with LLDP-MED?

Accepted Answer

IEEE 802.1X port-based authentication with dynamic VLAN assignment. MAC Radius or 802.1X authentication combined with VLAN assignment and LLDP-MED ensures security before voice policies are trusted.

Answer

Storm control with broadcast filtering

Answer

DHCP snooping and Dynamic ARP Inspection (DAI)

Answer

IP Source Guard

Question 5

Which statement is true regarding the behavior of the supplicant mode 'single' on an EX Series switch port?

Accepted Answer

Only one supplicant is allowed on the port; if a second device connects, it is blocked or unauthenticated.. Single-supplicant mode allows only a single authenticated client on the port. If a hub or IP phone with a PC is connected, only one device passes authentication.

Answer

It allows up to 256 MAC addresses to authenticate simultaneously via MAC RADIUS.

Answer

Multiple supplicants are allowed, but they must all share the same VLAN and credentials.

Answer

It enables multi-domain authentication for voice and data devices.

Question 6

When configuring voice VLANs and PoE on an EX Series switch, which THREE benefits are achieved by implementing LLDP-MED alongside standard PoE? (Choose three.)

Accepted Answer

Dynamic power negotiation allowing devices to request exact wattage rather than class maximums.. LLDP-MED extends standard LLDP with media endpoint discovery TLVs, so option A is correct because its Extended Power-via-MDI TLV lets an endpoint negotiate its actual power requirement in watts instead of being limited to the 802.3af/at class maximum, improving PoE budget efficiency. Option C is correct because LLDP-MED inventory TLVs (such as hardware revision, firmware revision, software revision, serial number, manufacturer name, and asset ID) are exchanged with the switch, enabling asset management and inventory tracking of attached endpoints. Option E is correct because the LLDP-MED Network Policy TLV carries the voice VLAN ID and Layer 2 priority, allowing an IP phone to discover and automatically tag its voice traffic with the correct VLAN without manual static provisioning. Option B is wrong because LLDP-MED does not eliminate Layer 2 broadcast traffic; broadcasts such as ARP and DHCP are still flooded within their broadcast domains. Option D is wrong because LLDP-MED does not configure IPsec VPN tunnels; IPsec is a security protocol configured independently and is not part of LLDP-MED signaling.

Answer

Elimination of all Layer 2 broadcast traffic on the switch.

Answer

Automatic configuration of IPsec VPN tunnels on the switch.

Question 7

An administrator wants to configure Candidate-RP (C-RP) advertisements using the Bootstrap Router (BSR) mechanism in PIM sparse-mode. Which hierarchy level in Junos is used to configure the local router as a Candidate-RP?

Accepted Answer

[edit protocols pim candidate-rp]. Candidate RPs in Junos are configured under protocols pim candidate-rp.

Answer

[edit protocols pim bsr]

Answer

[edit routing-options candidate-rp]

Answer

[edit protocols igmp candidate-rp]

Question 8

You are configuring MACsec (Media Access Control Security) on an EX Series switch interface to secure Layer 2 links between two enterprise buildings. Which requirement is mandatory for MACsec to establish a secure session successfully between the two switches?

Accepted Answer

Both switches must have identical pre-shared keys (connectivity association keys) and matching cipher suites configured.. MACsec requires pre-shared keys (PSK) or MKA (MACsec Key Agreement) with matching connectivity association keys (CAK) and cipher suites.

Answer

Both switches must run RSVP-TE to reserve bandwidth for encrypted frames prior to session establishment.

Answer

Both switches must disable Spanning Tree Protocol on the MACsec-secured interface.

Answer

Both switches must be configured as part of the same VSTP region.

Question 9

During BGP route resolution on Junos, an indirect next hop is encountered. What mechanism does Junos use to resolve this indirect next hop to a direct forwarding next hop?

Accepted Answer

Recursive lookups through the routing table using the active IGP or static route entries.. Junos relies on the underlying IGP (OSPF or IS-IS) or static routes to resolve indirect BGP next hops to direct interface and gateway forwarding entries.

Answer

BGP Link-State (BGP-LS) topology databases.

Answer

Multiprotocol Label Switching (MPLS) label imposition without routing table participation.

Answer

Address Resolution Protocol (ARP) directly against the BGP peer IP address.

Question 10

Which THREE of the following statements describe the behavior and purpose of EVPN Route Type 5 (IP Prefix Route)? (Choose three)

Accepted Answer

It is frequently used for inter-subnet routing and integration with MPLS L3VPN backbones.. Route Type 5 carries IP prefixes independently of MAC addresses, supports inter-subnet forwarding in IP-VRF or EVPN-VXLAN integrations, and can carry gateway IP information.

Answer

It is mandatory for establishing basic Layer 2 bridging across a single VLAN.

Answer

It replaces Ethernet Segment Identifiers on multi-homed ports.

Question 11

When designing an EVPN-VXLAN fabric with integrated routing and bridging (IRB), which THREE considerations are critical for proper inter-subnet forwarding across VTEPs? (Choose three)

Accepted Answer

Configuring consistent virtual gateway MAC and IP addresses on all IRB interfaces across leaf VTEPs.. Distributed IRB gateways require consistent anycast gateway MAC and IP configurations across all leaf nodes, correct VNI to bridge domain mappings, and EVPN Type-5 or Type-2 route propagation for host/subnet reachability.

Answer

Enforcing physical loopback interfaces to run in layer 2 bridging mode.

Answer

Disabling BGP EVPN signaling on all spine nodes to save CPU resources.

Question 12

Which THREE actions occur during the BGP next-hop resolution process on a Junos device when evaluating an eBGP-learned route? (Choose THREE)

Accepted Answer

The resolved next-hop information along with the egress interface and MAC address are installed into the forwarding table.. When eBGP routes are learned, the next hop is typically the IP address of the external peer. Junos must resolve this next-hop IP in the routing table (RIB-local) via an active IGP or static route, verify that the resolving route is valid and active, and program the forwarding table (FIB) with the resolved next hop.

Answer

The BGP next-hop IP address is automatically rewritten to the local router loopback address by default for eBGP.

Answer

Junos automatically ignores next-hop resolution if multipath is enabled.

Question 13

Which command allows an administrator to verify the active supplicant states and authentication status on a specific EX Series switch interface?

Accepted Answer

show dot1x interface. The 'show dot1x interface' command displays detailed information about 802.1X states on switch ports.

Answer

show ethernet-switching table dot1x

Answer

show access security clients

Answer

show radius-server authentication statistics

Question 14

What is the default authentication order when authentication is enabled on an EX Series switch interface without explicit ordering configuration?

Accepted Answer

dot1x. By default, if authentication order is not specified, dot1x is evaluated first.

Answer

captive-portal

Answer

local database

Answer

mac-radius

Question 15

An engineer configures a two-color policer on an MX router. What are the two states or outcomes for evaluated packets in a standard two-color policer?

Accepted Answer

Green and Red. A two-color policer evaluates packets as either conforming (within the rate limit) or non-conforming (exceeding the rate limit).

Answer

In-profile and Out-of-profile only with temporal buffers

Answer

Green, Yellow, and Red

Answer

Discard and Forward without loss priority marking