JNCIP-ENT Practice Test 18 — 15 Questions

Question 1

Which TWO statements are correct regarding IGMP version 2 (IGMPv2) features compared to IGMPv1? (Choose two)

Accepted Answer

IGMPv2 includes a querier election mechanism among multiple routers on a subnet.. Option B is correct because IGMPv2 adds a querier election process: when multiple multicast routers exist on the same subnet, the one with the lowest source IP address on that subnet is elected as the querier, whereas IGMPv1 designated the querier via the multicast routing protocol (e.g., PIM). Option C is correct because IGMPv2 introduces the explicit Leave Group message (type 0x17), sent to the all-routers address 224.0.0.2, which allows the querier to send a group-specific query and prune the group quickly instead of waiting for the full group membership timeout. Option A is wrong because IGMPv2 specifically reduces reliance on the membership timeout by using the Leave Group message, though the timeout still exists as a fallback. Option D is wrong because source-specific include/exclude filtering is an IGMPv3 feature, not IGMPv2. Option E is wrong because IGMPv2 is a host-to-router protocol that does not require PIM sparse-mode on hosts; PIM is a router-to-router multicast routing protocol.

Answer

IGMPv2 relies entirely on group membership timeout for leaving groups.

Answer

IGMPv2 supports source-specific filtering lists (include/exclude).

Answer

IGMPv2 requires PIM sparse-mode to be enabled on all participating hosts.

Question 2

An enterprise network uses MBGP (Multicast BGP) alongside PIM sparse-mode. Which THREE statements accurately describe the function of MBGP in a multicast environment? (Choose three)

Accepted Answer

MBGP allows the multicast routing topology to be different from the unicast routing topology.. MBGP (Multicast BGP, defined in RFC 4760/2858) is an extension of BGP that carries multicast routing information in a separate RIB from unicast, so option A is correct: it lets the multicast topology diverge from the unicast topology (e.g., different paths or next hops for RPF). Option D is correct because MBGP is implemented through multiprotocol BGP extensions using the Address Family Identifier (AFI 1 = IPv4, 2 = IPv6) and Subsequent Address Family Identifier (SAFI 1 = unicast, 2 = multicast, 3 = both) to distinguish NLRI for multicast from unicast. Option E is correct because PIM relies on the unicast/multicast RIB populated by MBGP to determine the RPF interface and RPF neighbor toward the source or RP; MBGP supplies that path information for interdomain RPF. Option B is wrong because MSDP is a separate protocol that shares source-active (SA) messages between RPs across domains, and MBGP does not replace it. Option C is wrong because MBGP is a control-plane routing protocol only; it does not forward multicast data packets, which is the job of PIM and the multicast forwarding tables.

Answer

MBGP replaces the function of MSDP by sharing source-active states between RPs.

Answer

MBGP forwards multicast data packets directly across autonomous systems.

Question 3

An administrator applies a policy containing 'as-path-prepend "65001 65001"' to outbound BGP updates sent to an external provider. What is the primary objective of this configuration?

Accepted Answer

To artificially increase the AS path length attribute to make this path less preferred by inbound traffic.. Prepending the local AS number multiple times increases the AS path length attribute, making the path less desirable to external peers and manipulating inbound traffic engineering.

Answer

To force the external peer to drop all updates due to an AS path loop check failure.

Answer

To enable BGP multipath load balancing across multiple external links.

Answer

To establish a confederation sub-AS relationship with the external provider.

Question 4

Which TWO options are valid configurable parameters under an access profile in Junos OS? (Choose two)

Accepted Answer

radius-server-group. Option A (radius-server-group) is correct because an access profile in Junos OS can reference a RADIUS server group to authenticate users, configured with the set access profile radius-server-group statement. Option E (accounting) is correct because access profiles support accounting parameters such as accounting-order and accounting-stop-on-access-deny to control how user accounting records are generated. Option B (virtual-router-instance) is not a valid access profile parameter; it is a routing-instance type configured under routing-instances. Option C (ethernet-switching-options) is a switching configuration hierarchy, not an access profile parameter. Option D (storm-control) is configured under ethernet-switching-options or interface hierarchies, not within an access profile.

Answer

virtual-router-instance

Answer

ethernet-switching-options

Answer

storm-control

Question 5

You want to change the OSPF reference bandwidth globally on a Junos routing device to accurately calculate costs for high-speed interfaces. Where is this configured?

Accepted Answer

set protocols ospf reference-bandwidth 10g. The reference bandwidth for OSPF is configured globally under the protocols ospf hierarchy using the reference-bandwidth statement.

Answer

set system ospf reference-bandwidth 10g

Answer

set protocols ospf area 0.0.0.0 reference-bandwidth 10g

Answer

set routing-options ospf reference-bandwidth 10g

Question 6

An administrator needs to filter Type-3 LSAs entering an OSPF stub area on a Junos routing device. Which statement under the area hierarchy is required?

Accepted Answer

set protocols ospf area 0.0.0.2 area-range 192.168.1.0/24 restrict. In Junos OS, you can filter inbound Type-3 LSAs into a stub or NSSA area using the 'area-range' command with the 'restrict' or 'hidden' parameter, or using an import policy at the area level, but specifically for summarization and blocking, the area-range statement with 'restrict' prevents the LSA from being advertised.

Answer

set protocols ospf area 0.0.0.2 type-3-lsa-block

Answer

set protocols ospf area 0.0.0.2 stub lsa-filter block-type-3

Answer

set protocols ospf area 0.0.0.2 filter type-3-lsa

Question 7

You are troubleshooting an EX Series switch where 802.1X authentication is failing for all users. The RADIUS server is reachable and the shared secret matches. Users report that authentication never completes and the switch logs show EAPOL exchanges starting but no Access-Request being sent. Which Junos command should you use to view the current 802.1X authentication state and counters on the interface?

Accepted Answer

show dot1x interface ge-0/0/10 detail. When EAPOL exchanges begin but no RADIUS Access-Request is generated, the issue lies in the authenticator-supplicant interaction rather than the RADIUS path. The 802.1X operational command for an interface provides EAPOL counters and state, revealing whether the switch is waiting for a supplicant response or has transitioned to an authenticated or held state. This directly addresses the observed symptom.

Answer

show interfaces ge-0/0/10 extensive

Answer

show network-access aaa statistics radius

Answer

show ethernet-switching table

Question 8

You are configuring a Juniper EX Series switch to prevent loops in a VSTP environment. An access port connected to an end-user device is receiving BPDUs from an unauthorized switch. You want to automatically disable the port if BPDUs are received. Which feature should you enable on the access port?

Accepted Answer

BPDU protection. BPDU protection is specifically designed to disable edge ports that receive BPDUs, preventing loops caused by unauthorized switches. When enabled on an access port, any BPDU received will cause the port to enter an err-disabled state. This is the standard best practice for end-user ports in a VSTP or RSTP environment. Root protection and loop protection serve different purposes, and storm control does not address BPDU reception.

Answer

Loop protection

Answer

Storm control

Answer

Root protection

Question 9

You are configuring an EVPN-VXLAN fabric on Juniper devices. You want to enable the exchange of EVPN routes between PE routers. Which BGP configuration is required on each PE to support EVPN signaling?

Accepted Answer

Configure the family evpn signaling under the BGP group.. To exchange EVPN routes, BGP must be configured with the evpn signaling address family. This allows the PE routers to negotiate and exchange EVPN NLRIs, which carry MAC and IP reachability information. Other families like inet unicast, inet-vpn unicast, or route-target do not enable EVPN signaling and are therefore incorrect.

Answer

Configure the family inet-vpn unicast under the BGP group.

Answer

Configure the family route-target under the BGP group.

Answer

Configure the family inet unicast under the BGP group.

Question 10

You administer a Junos router that has two equal-cost paths toward the PIM rendezvous point for group 239.1.1.1. Users report intermittent multicast outages whenever the unicast route to the RP flaps. You want to eliminate the dependency on unicast reachability to the RP for this group. Which configuration accomplishes this?

Accepted Answer

Configure the group in a PIM source-specific multicast (SSM) group range on all routers in the path.. Source-specific multicast removes the rendezvous point from the forwarding path for the configured group range. Receivers signal interest in a specific source and group, and PIM immediately builds a shortest-path tree toward that source without any shared-tree or RP interaction. Because the RP address is never resolved, a flapping unicast route toward the RP cannot disrupt delivery for that group.

Answer

Configure a static RP for the group with the address of the local router's loopback interface.

Answer

Configure the group as a PIM sparse-dense-mode group so it uses source-specific trees.

Answer

Enable PIM dense-mode on the interfaces facing the multicast receivers for the group.

Question 11

You are configuring an EVPN-VXLAN fabric on Juniper devices and need to enable ARP suppression to reduce broadcast traffic. Which statement correctly describes how ARP suppression works in this environment?

Accepted Answer

The local VTEP intercepts ARP requests and responds if it has a matching IP-MAC binding learned via EVPN Type-2 routes, preventing the ARP request from being flooded.. ARP suppression in EVPN-VXLAN involves the local VTEP intercepting ARP requests and responding if it has the target IP-MAC binding in its cache, which is populated from EVPN Type-2 routes. This prevents the ARP request from being flooded across the VXLAN fabric, reducing broadcast traffic and improving network efficiency.

Answer

The remote VTEP responds to ARP requests on behalf of local hosts, so the local VTEP does not need to maintain a cache.

Answer

ARP suppression is only effective for hosts in the same subnet and does not work for inter-subnet traffic.

Answer

ARP suppression requires that all ARP requests be flooded to all VTEPs, and each VTEP checks its local cache to respond.

Question 12

You are deploying 802.1X on an EX4300 access port facing a conference room. The security team wants to prevent a user from unplugging an authenticated IP phone and plugging in an unauthorized laptop on the same port. You configure MACsec on the port. Which statement describes the security benefit that MACsec provides in this scenario?

Accepted Answer

MACsec establishes a secure channel using MKA and only devices with valid keys can transmit or receive frames, preventing unauthorized device insertion.. MACsec on Juniper EX Series switches provides hop-by-hop encryption and integrity using the MACsec Key Agreement protocol. Only devices that possess the correct connectivity association key can participate in the secure channel, so an unauthorized laptop plugged into the port cannot send or receive traffic even if it spoofs a MAC address. This directly addresses the conference room threat of device substitution.

Answer

MACsec enforces 802.1X authentication by redirecting unauthenticated devices to a captive portal before granting access.

Answer

MACsec encrypts all traffic on the link, but unauthenticated devices can still pass traffic if they present valid MAC addresses.

Answer

MACsec limits the number of MAC addresses learned on the port to one, blocking any additional devices.

Question 13

An administrator is enabling PIM sparse-mode on a Junos router that connects to a Layer 2 switch carrying several user VLANs. Receivers on those VLANs need to join multicast groups, but the router is not seeing any IGMP membership reports from the hosts. PIM is enabled on the router's interface toward the switch. Which action is required on the router to receive IGMP reports?

Accepted Answer

Enable IGMP on the interface facing the VLANs in addition to PIM sparse-mode.. PIM sparse-mode operates between multicast routers and does not itself interpret host IGMP membership reports. For a router to learn that receivers on a directly attached subnet want a group, IGMP must be enabled on that interface. The resulting local membership state causes the router to send a PIM join toward the RP. IGMP snooping belongs on the switch, and static joins bypass rather than enable dynamic membership.

Answer

Enable PIM dense-mode on the interface so IGMP reports are flooded to all routers.

Answer

Enable IGMP snooping on the router interface facing the VLANs.

Answer

Configure a static IGMP group join for each multicast group on the router interface.

Question 14

You are configuring a Junos router where a customer wants assured forwarding for three classes of traffic: AF11, AF21, and AF31. Each class must receive its own bandwidth guarantee and its own congestion behaviour. You are defining the behavior aggregate classifier. Which configuration element maps the incoming DSCP values to the correct forwarding classes and loss priorities?

Accepted Answer

A behavior aggregate classifier containing dscp and loss-priority entries for each code point. Behavior aggregate classifiers perform a single-field lookup on the DSCP value and assign forwarding class and loss priority, making them the correct mechanism for mapping AF11, AF21, and AF31 to distinct classes with appropriate drop precedence. Multifield classifiers match multiple fields, rewrite rules act on egress, and scheduler maps govern scheduling after classification, so none of those performs the required ingress DSCP mapping.

Answer

A scheduler map binding forwarding classes to schedulers with drop profiles

Answer

A multifield classifier referencing a firewall filter with dscp match conditions

Answer

A forwarding-class-to-DSCP rewrite rule applied on the egress interface

Question 15

You are the network architect for a service provider that offers BGP/MPLS IP VPNs to enterprise customers. A customer reports that routes from one of its sites are being leaked into the global Internet table of a remote provider edge (PE) router. You have already verified that the VRF import policy on the remote PE is correct and that the route target (RT) communities are properly assigned. Which Junos configuration on the originating PE router is the most likely cause of the route leak?

Accepted Answer

The PE router has a 'rib-groups' configuration that imports the customer's VPN routes into the inet.0 table, and the export policy to the remote PE allows those routes.. Routes leak into the global table when they are copied from a VPN instance into inet.0, typically via a rib-group import. The export policy then advertises them as global routes. The other options describe features that either are correct for VPNs or do not cause global leakage. The key is that the rib-group makes the customer routes part of the main routing table, and the export policy sends them out.

Answer

The export policy applied under the customer's routing instance uses a 'then accept' term that matches all routes, including the global table, and the instance is configured with 'vrf-table-label'.

Answer

The customer's CE router is advertising the same prefixes with a different route distinguisher (RD) than the one configured on the PE.

Answer

The BGP session to the remote PE is configured with 'family inet-vpn unicast' instead of 'family inet unicast'.