JNCIP-ENT Practice Test 19 — 15 Questions

Question 1

You are enabling 802.1X on an EX Series switch. You want to allow a PC that does not support 802.1X to access the network after a user opens a web browser and authenticates. Which feature should you configure on the switch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Captive portal authentication. Captive portal authentication is the correct feature for allowing non-802.1X devices to authenticate via a web browser. It redirects the user's HTTP traffic to a portal where they enter credentials. After successful authentication, the switch grants access. This is ideal for guest users or devices without 802.1X supplicants.

Answer

Guest VLAN

Answer

RADIUS Change of Authorization (CoA)

Answer

MAC RADIUS authentication

Question 2

An enterprise network runs PIM sparse-mode with a static RP. A Junos router receives a PIM Register message from a directly connected first-hop router for a new multicast source. The router is the RP for that group. Which action does the RP take upon receiving the Register message?

Accepted Answer

It sends a PIM Join toward the source to build the shortest-path tree and then sends a Register-Stop to the first-hop router.. When a first-hop router receives multicast traffic from a new source, it encapsulates the data in PIM Register messages and unicasts them to the RP. The RP, upon receiving the Register, must join the source tree by sending a PIM Join toward the source. Once the RP starts receiving native multicast traffic on the source tree, it sends a Register-Stop to the first-hop router to stop the encapsulation. This ensures efficient forwarding along the shortest-path tree.

Answer

It immediately sends a Register-Stop to the first-hop router and waits for the source to send native multicast traffic.

Answer

It forwards the Register message to the BSR to request a new RP mapping for the group.

Answer

It immediately decapsulates the Register message and forwards the multicast data to the shared tree.

Question 3

An engineer is deploying VSTP (VLAN Spanning Tree Protocol) on a Juniper EX Series switch in a network that also includes RSTP bridges. The engineer wants to ensure that VSTP BPDUs are properly handled and that the network converges quickly. Which statement about VSTP operation is correct?

Accepted Answer

VSTP is compatible with RSTP and can interoperate using RSTP BPDUs on a per-VLAN basis.. VSTP runs a separate spanning-tree instance for each VLAN, using RSTP BPDU format. It can interoperate with RSTP bridges by sending standard RSTP BPDUs on a per-VLAN basis, often using 802.1Q tags to identify the VLAN. This allows a VSTP-enabled switch to participate in an RSTP network while maintaining per-VLAN topologies. The correct statement highlights this interoperability, which is essential for mixed-vendor or mixed-protocol environments.

Answer

VSTP BPDUs are encapsulated in 802.1Q tags with a special EtherType to differentiate them from RSTP BPDUs.

Answer

VSTP uses a single spanning-tree instance for all VLANs, similar to MSTP.

Answer

VSTP requires all switches in the network to run VSTP; it cannot interoperate with RSTP.

Question 4

You are troubleshooting a CoS issue on a Juniper EX Series switch. You have configured a policer to limit traffic to 100 Mbps with a burst size of 10 KB. You notice that traffic occasionally exceeds 100 Mbps for short periods but is not being dropped. Which statement explains this behavior?

Accepted Answer

The policer is configured as a single-rate two-color policer, which allows bursting up to the burst size before dropping.. A single-rate two-color policer allows traffic to burst up to the configured burst size without being dropped, even if the instantaneous rate exceeds the committed information rate. The short periods of exceeding 100 Mbps are within the burst allowance, so the policer does not drop packets. This is the expected behavior for this type of policer.

Answer

The policer is applied to the egress interface, and egress policers do not drop packets that exceed the rate.

Answer

The policer is misconfigured because it should drop all traffic that exceeds 100 Mbps immediately.

Answer

The policer is configured as a two-rate three-color policer, which allows traffic to exceed the committed rate without penalty.

Question 5

You are configuring an EVPN-VXLAN fabric with a distributed gateway (anycast gateway) to optimize routing for hosts in different subnets. You need to ensure that the distributed gateway functions correctly. Which TWO statements are true about the distributed gateway implementation on Juniper devices? (Choose two.)

Accepted Answer

Each leaf switch uses the same virtual MAC address for the anycast gateway, allowing hosts to use a single default gateway IP.. In a distributed gateway (anycast gateway) deployment, all leaf switches in the same subnet share a common virtual MAC address and IP address for the gateway. This allows hosts to use a single default gateway configuration and ensures that traffic is routed locally at the attached leaf, avoiding suboptimal paths. Additionally, all leaf switches must use the same VXLAN VNI for that subnet to maintain consistent forwarding and encapsulation across the fabric.

Answer

The anycast gateway IP address must be unique on each leaf switch to avoid IP conflicts.

Answer

The anycast gateway requires that all leaf switches are in the same OSPF area for underlay connectivity.

Answer

The anycast gateway MAC address must be manually configured on each leaf and must be different for each leaf.

Question 6

You are configuring Class of Service on an MX Series router. You want to ensure that the best-effort forwarding class receives at least 10 Mbps of bandwidth during congestion on a 1 Gbps interface, but you also want to allow it to use additional bandwidth if other queues are idle. Which scheduler configuration should you apply?

Accepted Answer

transmit-rate 10m;. The scheduler transmit-rate statement with a specific value like 10m sets a guaranteed minimum bandwidth for the queue. When other queues are not using their allocated bandwidth, the scheduler allows this queue to exceed its minimum, up to the interface or shaping rate. This provides both a guaranteed floor and the ability to burst, which matches the scenario requirements.

Answer

transmit-rate percent 1;

Answer

transmit-rate remainder;

Answer

shaping-rate 10m;

Question 7

You are troubleshooting an EVPN-VXLAN fabric where a host connected to a multi-homed Ethernet segment is not receiving traffic from a remote PE. The remote PE has learned the host's MAC address via EVPN Type 2 routes. You suspect an issue with the Designated Forwarder (DF) election. Which command would you use on the local PE to verify the DF election state for the Ethernet segment?

Accepted Answer

show evpn ethernet-segment extensive. The DF election state for an Ethernet segment is best verified using the show evpn ethernet-segment extensive command, which provides detailed information about the DF role and election status. Other commands like show evpn instance extensive or show bgp evpn summary do not include DF election details, and show ethernet-switching table focuses on MAC learning rather than DF election.

Answer

show evpn instance extensive

Answer

show ethernet-switching table

Answer

show bgp evpn summary

Question 8

An administrator configures a scheduler map on a Junos MX Series router with three queues: best-effort with transmit-rate remainder, expedited-forwarding with a strict-high transmit rate, and assured-forwarding with a transmit rate of 30 percent. Users report that voice quality degrades whenever assured-forwarding traffic bursts, even though expedited-forwarding is marked strict-high. Which statement explains this behavior?

Accepted Answer

Strict-high scheduling only guarantees priority when the queue is not rate-limited by a shared shaper or when the interface is not oversubscribed by other strict-high queues.. A strict-high queue is always serviced before other queues, but its throughput is still bounded by any interface-level shaper and by the aggregate demand of other strict-high queues. When the interface is oversubscribed or shaped, voice can be delayed despite the strict-high designation, which matches the reported symptom.

Answer

Assured-forwarding queues always preempt expedited-forwarding queues because assured-forwarding has a defined transmit rate.

Answer

Expedited-forwarding requires a buffer size larger than the default to guarantee priority service.

Answer

Strict-high priority traffic is only guaranteed bandwidth in excess of the configured shaping rate on the physical interface.

Question 9

An administrator applies a DSCP rewrite rule to an SRX Series device interface that faces an untrusted WAN. The goal is to mark voice packets with EF (46) and best-effort traffic with 0 before they leave the device. After applying the rewrite rule, the administrator notices that some packets still leave with their original DSCP values. Which statement explains the most likely cause?

Accepted Answer

The rewrite rule only applies to packets whose forwarding class and loss priority match an entry in the rewrite table, and unmatched packets keep their original DSCP.. A DSCP rewrite rule rewrites only packets whose forwarding class and loss priority are listed in the rewrite table. Packets assigned to a forwarding class or loss priority that is absent from the table keep their original DSCP, which produces the mixed marking observed on the WAN interface.

Answer

The rewrite rule is applied to the wrong interface and must be applied to the ingress interface to take effect.

Answer

Rewrite rules are only supported on MPLS interfaces and cannot rewrite DSCP on IP interfaces.

Answer

The rewrite rule is applied on the egress interface but the packets were already classified into a different forwarding class by the ingress BA classifier.

Question 10

You are configuring RSTP on a Juniper EX Series switch. You need to ensure that the switch can quickly converge in case of a link failure. Which two statements are correct about RSTP edge ports and their configuration? (Choose two.)

Accepted Answer

Edge ports are configured using the 'set protocols rstp interface <interface> edge' command.. RSTP edge ports are configured per interface with the 'edge' keyword. They transition immediately to forwarding, improving convergence for end devices. If an edge port receives a BPDU, it loses its edge status and becomes a normal RSTP port, ensuring loop prevention. These behaviors are key to RSTP's fast convergence and network stability.

Answer

Edge ports are automatically enabled on all access ports by default in Junos OS.

Answer

Edge ports participate in the spanning-tree topology and can become root ports if they receive a superior BPDU.

Answer

Edge ports can be configured globally using the 'set protocols rstp edge' command.

Question 11

You are configuring OSPFv3 on a Junos router and need to enable it on an interface that has IPv6 enabled. Which configuration statement is required to activate OSPFv3 on that interface?

Accepted Answer

set protocols ospf3 area 0 interface ge-0/0/0.0. To enable OSPFv3 on a Junos router, you must configure the interface under the [edit protocols ospf3] hierarchy with the area and interface statements. The correct syntax is set protocols ospf3 area 0 interface ge-0/0/0.0. This activates OSPFv3 on the interface and allows it to form adjacencies with other OSPFv3 routers.

Answer

set protocols ospf3 area 0 interface ge-0/0/0.0 ipv6

Answer

set protocols ospf area 0 interface ge-0/0/0.0

Answer

set protocols ospf3 interface ge-0/0/0.0 area 0

Question 12

You are configuring a Junos SRX Series device to protect the control plane from a flood of BGP keepalives. You want to police traffic destined to the Routing Engine and apply a rate limit that drops excess packets while allowing normal protocol operation. Which CoS mechanism should you use?

Accepted Answer

A policer applied to a firewall filter that is bound to the loopback interface as an input filter. Policers are the Junos mechanism for enforcing a rate limit and dropping or marking excess traffic. To protect the Routing Engine, the policer is referenced by a firewall filter applied as an input filter on the loopback interface, which is the standard control-plane protection pattern.

Answer

A drop profile applied to the loopback interface

Answer

A rewrite rule applied to the loopback interface

Answer

A scheduler map applied to the loopback interface

Question 13

You are implementing MSTP on a network of Juniper EX Series switches. You need to ensure that the MSTP region is correctly configured and that VLANs are mapped to the appropriate MSTIs. Which two statements are correct about MSTP configuration on Juniper EX switches? (Choose two.)

Accepted Answer

The MSTP region name must be identical on all switches in the same region.. For MSTP to function correctly, all switches in a region must share the same region name, revision level, and VLAN-to-MSTI mapping. These parameters form the MSTP region identifier. If any of these differ, the switches will not form a single region, leading to potential network issues. The other statements are incorrect: revision level must be identical, MSTI roots can differ from the CIST root, and while MSTP and VSTP are mutually exclusive, that is not a configuration statement per se.

Answer

MSTP can only be configured on EX Series switches when VSTP is disabled.

Answer

The MSTP revision level can be different on each switch in the region.

Answer

Each MSTI can have a different root bridge, and the root bridge for MSTI 1 must be the same as the root bridge for the CIST.

Question 14

An engineer is deploying PIM sparse-mode with anycast RP using two Junos routers that share the loopback address 10.0.0.1/32. Both routers are configured as static RPs for all groups and as MSDP peers with each other using their unique loopback addresses. Receivers attached to Router A join a group whose source is registered with Router B. Traffic initially flows, but after Router B reloads, receivers lose the stream even though Router A still has the anycast RP address reachable. Which mechanism is responsible for restoring source information to Router A?

Accepted Answer

Router B sends Source-Active messages to Router A over the MSDP peering once it relearns the source from the first-hop router.. Anycast RP uses a shared RP address on multiple routers plus MSDP peering between them using unique addresses. When one RP instance relearns a source through PIM registration, it advertises that source to its MSDP peers with Source-Active messages. The other RP instance installs the state and can build a path for its receivers. Without MSDP synchronization, receivers attached to the instance that lacks (S,G) state would remain without the stream.

Answer

Router A learns the source through the shared (*,G) tree because both routers use the same anycast RP address.

Answer

The first-hop router sends a PIM Assert to Router A to advertise the source location after the reload.

Answer

Router B re-registers the source with Router A through PIM Register messages sent to the anycast address.

Question 15

You are configuring an EX Series switch to authenticate users via 802.1X. The RADIUS server returns a Filter-Id attribute of 'student-acl' in the Access-Accept. You want the switch to apply a firewall filter named 'student-acl' to the authenticated user's traffic. Which configuration is required on the switch?

Accepted Answer

Define a firewall filter named student-acl and reference it under the 802.1X authenticator interface configuration. When RADIUS returns a Filter-Id, the switch must have a corresponding firewall filter defined locally and must be configured to apply it to the authenticated session. This is done by referencing the filter in the 802.1X authenticator interface configuration or access profile, enabling dynamic application based on the RADIUS response. Static MAC binding and CoA are not required for this initial assignment.

Answer

Enable MAC RADIUS authentication and rely on the Filter-Id returned for the MAC address

Answer

Create a CoA client configuration to push the filter to the switch

Answer

Configure a static MAC address entry for the user and bind the filter to that entry