JNCIP-ENT Practice Test 16 — 15 Questions

Question 1

You are configuring OSPFv2 on a Junos device and need to inject default routes into an OSPF NSSA area. Which configuration command under protocols ospf area should be used?

Accepted Answer

set protocols ospf area 0.0.0.1 nssa default-metric 10. To inject a default route into an NSSA area in Junos OSPF, the stub default-metric command or nssa no-summarize with default-metric is configured under the specific area. Specifically, 'nssa default-metric' generates a Type 7 default LSA.

Answer

set protocols ospf area 0.0.0.1 stub default-metric 10

Answer

set protocols ospf area 0.0.0.1 nssa originate-default

Answer

set protocols ospf area 0.0.0.1 nssa default-route-advertise

Question 2

An administrator is configuring a Junos device to support IGMPv3 on user-facing VLAN interfaces. Which configuration statement enables IGMPv3 processing on interface irb.10?

Accepted Answer

set protocols igmp interface irb.10 version 3. IGMP version selection on Junos interfaces is configured under protocols igmp interface.

Answer

set protocols pim interface irb.10 igmp-version 3

Answer

set interfaces irb.10 family inet igmp-version v3

Answer

set routing-options multicast igmp-version 3

Question 3

Which TWO actions occur when an 802.1X supplicant fails authentication and a guest VLAN is configured on the EX Series switch port? (Choose two)

Accepted Answer

The switch assigns the interface to the specified guest VLAN.. Option A is correct because on EX Series switches, when an 802.1X supplicant fails authentication and a guest VLAN is configured on the port, the switch places the interface into that guest VLAN, allowing limited access instead of blocking the port. Option B is correct because the client is then confined to the guest VLAN's Layer 2/Layer 3 boundaries, so it can reach only the resources permitted within that VLAN (typically Internet-only or remediation services) and nothing in the protected corporate VLANs. Option C is incorrect because a failed authentication does not generate a RADIUS accounting stop packet; accounting start/stop messages are tied to an authenticated session's lifecycle, not to a rejected supplicant. Option D is incorrect because the port is not permanently disabled; it is dynamically moved to the guest VLAN, and the port remains enabled for future authentication attempts. Option E is incorrect because critical authentication (critical VLAN) applies when RADIUS servers are unreachable, not when a supplicant fails authentication, and there is no automatic migration to a 'critical authentication server group.'

Answer

The switch sends a RADIUS accounting stop packet for the failed session.

Answer

The switch permanently disables the physical port until a manual reset is issued.

Answer

The supplicant is automatically migrated to the critical authentication server group.

Question 4

An administrator is troubleshooting an MSDP deployment between two autonomous systems. Which THREE factors can cause an MSDP peer session to fail to establish? (Choose three)

Accepted Answer

TCP port 639 being blocked by a firewall between the peers. MSDP runs over TCP port 639. Session establishment requires correct peer IP configuration, functional TCP connectivity, and matching authentication keys if configured.

Answer

An incorrect IGMPv2 timer setting on the receiver VLAN

Answer

An invalid PIM dense-mode setting on the core interface

Question 5

An EX4300 switch is configured with captive portal authentication. Unauthenticated users are successfully redirected when attempting HTTP traffic, but HTTPS traffic fails to redirect properly and instead shows a certificate warning or connection timeout in the user's browser. What is the fundamental reason for this behavior with standard captive portal implementations?

Accepted Answer

Standard captive portal redirects rely on intercepting unencrypted HTTP traffic; intercepting HTTPS without SSL proxy causes certificate mismatch errors.. Standard Layer 2 captive portal implementations intercept HTTP traffic via destination NAT or HTTP redirection. HTTPS traffic cannot be intercepted without a Man-in-the-Middle (MITM) proxy and SSL decryption because the TLS handshake fails due to certificate mismatch.

Answer

HTTPS traffic is blocked by default firewall filters and is excluded from the captive portal bypass list.

Answer

The captive portal server only listens on TCP port 80 and drops all incoming TCP port 443 SYN packets.

Answer

The captive portal profile lacks a valid SSL certificate for HTTPS traffic decryption.

Question 6

You are redistributing BGP routes into OSPF on an MX Series router. By default, what metric type and cost are assigned to these redistributed routes when they enter the OSPF domain?

Accepted Answer

Metric-type 2 with a cost of 1. By default, routes redistributed into OSPF are assigned metric-type 2 (E2) and a default metric value of 1.

Answer

Metric-type 1 with a cost of 20

Answer

Metric-type 1 with a cost of 0

Answer

Metric-type 2 with a cost of 10

Question 7

Which TWO statements are correct regarding the behavior and configuration of multi-supplicant mode on EX Series switches? (Choose two)

Accepted Answer

Each authenticated client on the port can be placed into its own dynamic VLAN via RADIUS.. Option E is correct because multi-supplicant mode on EX Series switches is specifically designed to allow multiple endpoints (supplicants) connected to the same physical interface to authenticate independently, each running its own 802.1X session rather than sharing a single port-based session. Option C is correct because in multi-supplicant mode each authenticated client can receive its own authorization attributes from RADIUS, including a dynamic VLAN assignment (typically via Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes), so clients on the same port can be placed into different VLANs. Option A is incorrect because multi-supplicant mode does not force the port into access trunk mode; the port remains an access port (or can be configured with other supported modes), and the statement misuses the term 'access trunk port.' Option B is incorrect because supplicants on the port are independent and may use different EAP methods and credentials; there is no requirement that they be identical. Option D is incorrect because multi-supplicant mode is not mutually exclusive with MAC RADIUS fallback; MAC RADIUS authentication can be configured alongside 802.1X to handle devices that do not support supplicant software.

Answer

It restricts the port to operating exclusively as an access trunk port.

Answer

It requires all connected devices to use identical EAP methods and credentials.

Answer

It is mutually exclusive with MAC RADIUS fallback configurations.

Question 8

Which TWO statements are correct regarding OSPF NSSA (Not-So-Stubby Area) behavior and configuration in Junos OS? (Choose two)

Accepted Answer

NSSAs allow the injection of external routes into the area using Type-7 LSAs.. NSSA areas allow external routes to be injected via Type-7 LSAs. By default, an NSSA does not flood default routes unless explicitly configured with 'default-lsa'.

Answer

Virtual links are fully supported to transit across an NSSA area.

Answer

An NSSA ABR automatically floods a default summary route into the NSSA by default.

Answer

NSSAs fully support external Type-5 LSAs originating from normal areas directly within the NSSA.

Question 9

You are configuring an EX Series switch to support IP phones that require both data and voice VLAN segregation on a single access port. You implement an access port configured with a voice VLAN. Which underlying Junos mechanism allows the switch to process untagged data traffic into the native/access VLAN and tagged voice traffic into the voice VLAN simultaneously?

Accepted Answer

Configuring an access port with the voice-vlan statement, which automatically handles tagging for the specified voice VLAN ID while keeping data untagged.. On Junos EX switches, configuring an access port with the 'voice-vlan' statement automatically enables the port to accept untagged data traffic into the native/access VLAN and tagged voice traffic into the specified voice VLAN. The switch internally treats the port as a special access port that can process both tagged and untagged frames, without requiring a full trunk configuration. This is the standard Junos mechanism for IP phone + PC daisy-chain deployments.

Answer

Configuring a trunk port with native-vlan-id and voice-vlan parameters.

Answer

Implementing IEEE 802.1ad provider bridging to double-tag voice and data frames.

Answer

Enabling port-based authentication with dynamic VLAN assignment via RADIUS.

Question 10

Which command allows an operator to view the local and remote MAC addresses learned via EVPN control plane and data plane across all bridge domains on an MX Series router?

Accepted Answer

show evpn database. The 'show evpn database' command displays the EVPN routing/MAC table containing MAC addresses learned via BGP EVPN control plane and local data plane learning.

Answer

show bridge domain

Answer

show route table inet.0

Answer

show mpls lsp

Question 11

Which THREE types of classifiers are natively supported in Junos Class of Service? (Choose three)

Accepted Answer

exp. Junos CoS natively supports three fixed classifier types: exp, dscp, and ieee-802.1. Option A (exp) is correct because the MPLS EXP classifier maps the 3-bit EXP field in the MPLS shim header to forwarding classes and loss priorities. Option B (dscp) is correct because the DSCP classifier examines the 6-bit Differentiated Services Code Point in the IP ToS byte for IP traffic. Option C (ieee-802.1) is correct because the IEEE 802.1 classifier inspects the 3-bit User Priority field in the 802.1Q VLAN tag for Layer 2 traffic. Options D (tcp-port) and E (mac-address) are not native Junos CoS classifier types; Junos classifiers operate on CoS marking fields such as EXP, DSCP, and 802.1p, not on TCP port numbers or MAC addresses.

Answer

tcp-port

Answer

mac-address

Question 12

What is the default OSPF reference bandwidth in Junos OS?

Accepted Answer

100 Mbps. The default OSPF reference bandwidth in Junos OS is 100 Mbps (100,000,000 bps).

Answer

10 Gbps

Answer

10 Mbps

Answer

1 Gbps

Question 13

Which LLDP TLV (Type-Length-Value) is mandatory for LLDP-MED operation and is used to distinguish media endpoint devices from standard network switches and routers?

Accepted Answer

LLDP-MED Capabilities TLV. The Capabilities TLV allows devices to advertise whether they are standard bridge/router devices or LLDP-MED endpoints.

Answer

MAC Address TLV

Answer

Port ID TLV

Answer

System Description TLV

Question 14

What does the LLDP-MED acronym stand for in the context of enterprise networking and IP telephony?

Accepted Answer

Link Layer Discovery Protocol - Media Endpoint Discovery. LLDP-MED stands for Link Layer Discovery Protocol - Media Endpoint Discovery.

Answer

Link Layer Device Protocol - Managed Ethernet Deployment

Answer

Local Loop Discovery Protocol - Mobile Ethernet Device

Answer

Logical Link Discovery Protocol - Multi-access Equipment Design

Question 15

A network administrator is configuring an enterprise router to join the Source-Specific Multicast (SSM) range. According to RFC standards, what is the standard IPv4 address block reserved for SSM?

Accepted Answer

232.0.0.0/8. The range 232.0.0.0/8 is globally reserved by IANA for Source-Specific Multicast (SSM).

Answer

239.0.0.0/8

Answer

224.0.0.0/24

Answer

224.0.1.0/24