JNCIP-ENT Practice Exam 3 — 20 Questions

Question 1

How do you examine the specific OSPF routing table entries learned via OSPF on a Junos device?

Accepted Answer

show route protocol ospf. The 'show route protocol ospf' command displays routes learned specifically through the OSPF routing protocol.

Answer

show protocols ospf route-table

Answer

show ospf routes

Answer

show ip route ospf

Question 2

Which THREE configuration tasks are required when implementing OSPFv3 on Junos devices? (Choose three)

Accepted Answer

Enabling OSPFv3 under the protocols ospf3 hierarchy. Configuring OSPFv3 requires specifying protocols ospf3, configuring areas, and enabling OSPFv3 on specific interfaces (IPv6 enabled).

Answer

Configuring BGP autonomous system numbers for OSPFv3 operation

Answer

Enabling IPv4 address families inside protocols ospf3

Question 3

Which THREE statements describe the behavior of LLDP-MED capability on Junos EX Series switches? (Choose three.)

Accepted Answer

It automates network policy configuration for voice, video, and guest VLANs.. LLDP-MED enables advanced capabilities like device location, inventory management, and network policies for endpoints.

Answer

It replaces the need for Ethernet switching entirely by converting access ports into routed links.

Answer

It requires OSPFv3 to be running on all connected IP phones.

Question 4

An administrator notices that broadcast, unknown unicast, and multicast (BUM) traffic sent from a local host is looping back to the originating multi-homed PE when using an all-active Ethernet segment. Which mechanism prevents this loop in EVPN?

Accepted Answer

EVPN Split Horizon filtering using ESI labels. EVPN uses Split Horizon filtering via the ESI Label Extended Community or local split-horizon checks to ensure that BUM traffic received from a remote PE on a shared Ethernet segment is not sent back out to the same segment.

Answer

BGP Best Path Selection algorithm

Answer

Designated Forwarder (DF) election

Answer

Spanning Tree Protocol (STP) root guard

Question 5

Which TWO options are valid authentication methods that can be specified in the 'authentication-order' statement on an EX Series switch interface? (Choose two)

Accepted Answer

mac-radius. On Juniper EX Series switches, the 'authentication-order' statement under an interface (or globally) accepts authentication methods such as 'dot1x', 'mac-radius', and 'captive-portal'. Option D (dot1x) is correct because IEEE 802.1X is a supported access-control authentication method that can be listed in the authentication order to authenticate supplicants via an AAA server. Option A (mac-radius) is correct because MAC RADIUS authentication is also a supported method, allowing the switch to authenticate a device by its MAC address against a RADIUS server. Option B (kerberos) is not a valid authentication-order method on EX switches, as Kerberos is not implemented as an interface authentication method there. Option C (tacacs-plus) is not valid because TACACS+ is an AAA protocol used for administrative login/authorization, not a client authentication method in the interface authentication-order list. Option E (ldap-direct) is not valid because EX switches do not support a direct LDAP authentication method in the authentication-order statement; LDAP would be reached through a RADIUS server instead.

Answer

kerberos

Answer

tacacs-plus

Answer

ldap-direct

Question 6

You are configuring a captive portal on an EX Series switch. You want to ensure that specific management traffic and critical server subnets are accessible to clients *before* they authenticate through the captive portal. Which configuration feature accomplishes this?

Accepted Answer

Captive portal firewall exemption filters or walled garden (bypass) configuration.. Pre-authentication access lists or firewall filters / bypass lists allow traffic to specific destinations before captive portal authentication occurs.

Answer

RADIUS dynamic authorization profiles with pre-auth attributes.

Answer

Global access profile authentication-bypass statements.

Answer

Static MAC bypass configuration under the protocols dot1x hierarchy.

Question 7

Which THREE parameters are part of the standard Junos BGP route selection algorithm prior to evaluating the router ID? (Choose three)

Accepted Answer

Weight (local to the router). Before router ID, Junos evaluates Weight, Local Preference, AS path length, Origin, MED, and IBGP vs EBGP preference.

Answer

Cluster List length

Answer

Originator ID value

Question 8

You want to apply a rewrite rule on an outgoing interface to remark the DSCP bits of packets leaving your Juniper router. Where must this rewrite rule be applied within the CoS hierarchy?

Accepted Answer

[edit class-of-service interfaces]. Rewrite rules in Junos are applied on egress interfaces under the interfaces statement within the class-of-service configuration hierarchy.

Answer

[edit firewall]

Answer

[edit routing-options]

Answer

[edit class-of-service classifiers]

Question 9

An administrator configures EVPN with VXLAN encapsulation and wants to ensure that interfaces assigned to bridge domains drop frames whose source MAC address is not learned or is unauthorized. Which feature should be enabled?

Accepted Answer

MAC security / MAC limit with drop action. Configuring MAC limit or bpdu protection/port security features on access interfaces prevents unauthorized MAC learning, while EVPN sticky MAC features can lock MACs to specific interfaces.

Answer

Ingress replication disabling

Answer

BGP route filtering

Answer

EVPN Route Type 4 filtering

Question 10

You are troubleshooting an issue where an 802.1X supplicant on a Windows client fails to connect to an EX Series switch port. The switch logs show 'EAPOL-TIMEOUT' errors. What does this error indicate?

Accepted Answer

The switch did not receive an EAPOL response from the client after sending an EAPOL request.. An EAPOL-TIMEOUT error indicates that the switch sent an EAPOL packet (such as EAPOL-Request/Identity) but did not receive a response from the client within the timeout window.

Answer

The RADIUS server took too long to validate the client credentials and dropped the session.

Answer

The switch port's operational mode reverted from access to trunk, dropping EAPOL frames.

Answer

The client sent an invalid EAP message that failed integrity checks.

Question 11

Which Junos configuration hierarchy is used to define an EVPN routing instance of type 'evpn'?

Accepted Answer

routing-instances instance-type evpn. In Junos OS, EVPN instances are defined under 'routing-instances instance-type evpn'.

Answer

bridge-domains <name> evpn

Answer

protocols evpn

Answer

interfaces xe-0/0/0 unit 0 family evpn

Question 12

An administrator configures PoE management mode on an EX4300 switch to 'consumption'. An IP phone connects, but before booting up completely, the switch denies power. Upon investigation, you find that the switch's static power reservation table is maxed out. What is the reason for this behavior in consumption mode?

Accepted Answer

Consumption mode still requires an initial allocation based on maximum class rating until LLDP-MED or CDP successfully negotiates the lower actual consumption value.. Even in consumption mode, Junos initially allocates power based on class or a default maximum until the device negotiates its actual consumption via LLDP-MED or CDP.

Answer

Consumption mode only works with non-PoE+ devices.

Answer

Consumption mode requires manual CLI power limits for every single port.

Answer

Consumption mode disables all dynamic power allocations permanently.

Question 13

Which BGP address family must be enabled under the BGP neighbor configuration to exchange EVPN routes between PE routers?

Accepted Answer

evpn signaling (or l2vpn evpn). To exchange EVPN routing information, the 'evpn signaling' or 'l2vpn evpn' address family must be configured under the BGP protocol hierarchy and neighbor sessions.

Answer

inet-unicast

Answer

vpls-signaling

Answer

iso-unicast

Question 14

Which command is used to verify the operational state of forwarding classes and their assigned queues on a specific interface on Junos?

Accepted Answer

show class-of-service interface. The show class-of-service interface command displays operational CoS details, including queue mappings, for specified interfaces.

Answer

show route forwarding-table

Answer

show interfaces extensive

Answer

show firewall

Question 15

An operator configures a BGP routing policy to modify the Local Preference attribute. Under which BGP neighbor relationship type can Local Preference be advertised and evaluated?

Accepted Answer

Internal BGP (IBGP) peers only. Local Preference is an IBGP attribute and is exchanged only between internal BGP peers within the same autonomous system.

Answer

BGP confederation member AS boundaries only

Answer

Both EBGP and IBGP peers equally

Answer

External BGP (EBGP) peers only

Question 16

Which statement describes the function of a drop-profile in Junos CoS?

Accepted Answer

It determines when and how many packets to drop based on buffer occupancy. A drop-profile defines the packet drop probability as a function of buffer occupancy to implement RED or WRED congestion avoidance.

Answer

It maps incoming CoS bits to internal forwarding classes

Answer

It defines how traffic is shaped to a specific peak rate

Answer

It rewrites outer VLAN tags on trunk interfaces

Question 17

An engineer needs to ensure that routes received from an external BGP peer are evaluated using multipath load balancing across different next hops. By default, Junos requires several conditions to be met for multipath. Which condition is mandatory for BGP multipath to consider two paths as valid candidates?

Accepted Answer

The IGP metric to the BGP next hop must be identical for all participating paths.. To qualify for BGP multipath in Junos, multiple attributes must match by default, including AS path length, local preference, origin, MED, and the IGP metric to the respective next hops must be equal (or within an acceptable variance if configured).

Answer

The peer IP addresses must reside on the exact same subnet.

Answer

The advertising router IDs must be identical.

Answer

The cluster lists must be completely empty.

Question 18

In a BGP confederation setup, two member ASNs (65001 and 65002) belong to a larger confederation AS (65100). When routes are advertised between these two member ASs, how is the AS path attribute handled?

Accepted Answer

The member AS numbers are placed in AS_CONFED_SEQUENCE segments and are not treated as external AS hops.. Confederation member AS numbers are included in the AS_CONFED_SEQUENCE attribute and are stripped when the route exits the confederation boundary.

Answer

The confederation AS number is prepended to the front of the path, removing all member AS numbers.

Answer

The member AS numbers are completely stripped and replaced by the confederation AS number.

Answer

The route is dropped by the receiving member AS due to an inter-AS loop prevention violation.

Question 19

An engineer is troubleshooting a multicast forwarding issue where data from a specific source is not reaching receivers in a remote PIM sparse-mode domain. Which THREE operational commands and diagnostic steps should be used to verify the multicast forwarding state and RPF path on a Junos router? (Choose three)

Accepted Answer

Run 'show pim join' to inspect upstream neighbor information and verify the RPF interface for the source.. Option B is correct because 'show pim join' displays the PIM join state, including the upstream neighbor (RPF neighbor) and the incoming/RPF interface for each (S,G) or (*,G) entry, which is exactly what is needed to confirm the RPF path toward the source in a PIM sparse-mode domain. Option C is correct because 'show igmp group' verifies that receivers on the local segment have actually sent IGMP joins for the group, confirming the last-hop router has the group membership needed to build the multicast forwarding state. Option E is correct because 'show multicast route' shows the installed (S,G)/(*,G) forwarding entries along with their incoming and outgoing interfaces and packet counters, letting the engineer confirm whether traffic is being forwarded and where it may be dropping. Option A is not correct because OSPF LSA type 6 (group-membership LSA) is MOSPF-specific and is not used for RPF checks in a PIM sparse-mode domain. Option D is not correct because there is no 'show bgp summary multicast-unicast' command, and multicast RPF lookups in Junos use the unicast routing table (inet.0) or an explicit multicast RPF table, not a BGP multicast-unicast summary.

Answer

Run 'show ospf database multicast' to verify LSA type 6 propagation.

Answer

Run 'show bgp summary multicast-unicast' to verify BGP routing tables for multicast RPF checks.

Question 20

An enterprise network uses Q-in-Q tunneling over an MX Series provider network. Customer BPDUs must pass transparently across the provider core without being processed by the provider's own VSTP/MSTP instances. Which feature must be enabled on the provider switch access ports to achieve this?

Accepted Answer

Layer 2 Protocol Tunneling (L2PT). Layer 2 protocol tunneling (L2PT) or BPDU tunneling is required to encapsulate L2 control frames (like STP BPDUs) into multicast destination MAC addresses so they cross the core transparently.

Answer

MSTP region boundary enforcement

Answer

BPDU filter across all bridging domains

Answer

VLAN translation swapping on inner tags