JNCIP-ENT Layer 2 Authentication And Access Control — 15 Questions

Question 1

Which THREE features or parameters can be configured under the 'protocols dot1x' interface hierarchy on an EX Series switch? (Choose two) -> wait, prompt says Which THREE, let's select three: supplicant timeout, max-retries, and guest-vlan.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

max-retries. Under protocols dot1x interface hierarchy, you can configure timers like supp-timeout, retries/max-retries, guest-vlan, and fallback actions.

Answer

captive-portal-profile

Answer

radius-server-group

Question 2

What is the primary function of the RADIUS server attribute 'Tunnel-Medium-Type' (Attribute 65) when received during an 802.1X authentication exchange on an EX Series switch?

Accepted Answer

It specifies the physical transport media type for the tunnel, such as 802 (Ethernet) for VLAN assignment.. Tunnel-Medium-Type specifies the media type of the tunnel, which for VLAN assignments in Junos is typically set to 802 (Ethernet).

Answer

It defines the VLAN ID or VLAN name to which the authenticated client port should be dynamically assigned.

Answer

It determines the encryption cipher used between the switch and the RADIUS server.

Answer

It indicates the authentication protocol (PAP, CHAP, EAP) being used in the tunnel.

Question 3

Which command allows an administrator to verify the active supplicant states and authentication status on a specific EX Series switch interface?

Accepted Answer

show dot1x interface. The 'show dot1x interface' command displays detailed information about 802.1X states on switch ports.

Answer

show ethernet-switching table dot1x

Answer

show access security clients

Answer

show radius-server authentication statistics

Question 4

You are troubleshooting an 802.1X deployment on an EX4300 switch. Clients fail to authenticate when using Supplicant-based authentication combined with MAC RADIUS fallback. You notice that the switch does not attempt MAC RADIUS after 802.1X times out. Which configuration error most likely caused this?

Accepted Answer

You failed to include both dot1x and mac-radius within the interface authentication-order statement.. To fall back to MAC RADIUS when 802.1X fails, the 'authentication-order' statement must explicitly list both dot1x and mac-radius, and the fallback mechanism must be configured properly.

Answer

You enabled static MAC pinning on the access port, which disables fallback mechanisms.

Answer

You omitted the mac-radius statement from the global protocols access-profile configuration.

Answer

You configured the supplicant mode as single-supplicant instead of multi-supplicant.

Question 5

An enterprise network administrator needs to configure 802.1X authentication on EX Series switches. Which statement is correct regarding the default behavior of the supplicant timeout timer?

Accepted Answer

It defines the duration the switch waits for an EAP-Request/Identity frame response before retransmitting.. The supp-timeout timer specifies the time the switch waits for a response to an EAP-Request/Identity frame from the supplicant before retransmitting.

Answer

It dictates how long the switch waits before failing over to MAC RADIUS authentication.

Answer

It determines how long an authenticated client can remain idle before being disconnected.

Answer

It specifies the interval before the switch drops the entire RADIUS authentication session.

Question 6

You are implementing MAC RADIUS authentication on an EX4600 switch. You notice that when a device connects, the switch sends the MAC address in the Username attribute (RADIUS attribute 1) with hyphen separators (e.g., aa-bb-cc-dd-ee-ff). Your RADIUS server expects colons (aa:bb:cc:dd:ee:ff). Where must you configure this format change on Junos OS?

Accepted Answer

Under [edit protocols access-profile profile-name mac-radius] using the format option.. Junos OS allows modifying the MAC address format sent to the RADIUS server using the 'mac-radius' configuration hierarchy under access profile or interface settings, specifically via the 'mac-питан' or format options.

Answer

Under [edit system radius-server server-name] using the attribute-format option.

Answer

Under [edit interfaces ge-0/0/1 unit 0 family ethernet-switching] using the mac-radius format command.

Answer

Under [edit access profile profile-name firewall] using the translation map.

Question 7

You are configuring a captive portal on an EX Series switch. You want to ensure that specific management traffic and critical server subnets are accessible to clients *before* they authenticate through the captive portal. Which configuration feature accomplishes this?

Accepted Answer

Captive portal firewall exemption filters or walled garden (bypass) configuration.. Pre-authentication access lists or firewall filters / bypass lists allow traffic to specific destinations before captive portal authentication occurs.

Answer

RADIUS dynamic authorization profiles with pre-auth attributes.

Answer

Global access profile authentication-bypass statements.

Answer

Static MAC bypass configuration under the protocols dot1x hierarchy.

Question 8

An EX Series switch is configured with multiple-supplicant mode on an access port connected to an IP phone with a PC daisy-chained behind it. The IP phone authenticates via 802.1X, but the PC uses MAC RADIUS. The phone authenticates successfully and moves to the voice VLAN. However, when the PC boots, it fails authentication because the switch rejects a second supplicant on the same logical port index. Which configuration parameter resolves this issue?

Accepted Answer

Configure the interface with 'set protocols dot1x interface ge-0/0/1 supplicant multiple' and ensure multi-supplicant mode is active.. In multiple-supplicant mode, you must configure 'supplicant multiple' and ensure the port is configured to support multiple clients using different authentication methods (e.g., multi-supplicant mode rather than single-supplicant).

Answer

Configure 'set access-profile captive-portal multiple-logins per-port'.

Answer

Set the port mode to trunk and enable voice-vlan stacking.

Answer

Configure the interface with 'set protocols dot1x interface ge-0/0/1 mac-radius multiple-clients'.

Question 9

You are configuring captive portal on an EX Series switch using J-Web and CLI. Users are redirected to the captive portal page, but after successful authentication, they still cannot access the external network. Inspecting the routing table and firewall filters, what is the most likely reason for this post-authentication restriction?

Accepted Answer

The captive portal dynamic firewall filter was not removed from the interface due to a failure in receiving the RADIUS Change of Authorization (CoA) or accounting update.. After successful captive portal authentication, the switch must dynamically remove the local firewall filter that redirects traffic to the portal server. If CoA or dynamic VLAN assignment fails, the filter remains active.

Answer

The default gateway address specified in the captive portal profile is in a different routing instance.

Answer

The user's MAC address was not statically added to the bypass list of the captive portal profile.

Answer

The captive portal profile lacks a defined redirect URL for the external network gateway.

Question 10

An administrator configures 802.1X authentication with local server fallback on an EX Series switch. When the external RADIUS server is unreachable, the switch fails over to the local user database. However, users authenticated via the local database are placed in the default access VLAN instead of the VLAN specified in their local user profile. What is the cause of this behavior?

Accepted Answer

Local database user profiles on Junos do not support dynamic VLAN assignment attributes natively, requiring interface-level default fallback VLANs.. When using local fallback authentication on Junos switches, local user database entries lack the rich attribute support (like dynamic VLAN assignment via RADIUS VSA equivalents) unless explicitly mapped or configured via local database profiles.

Answer

The local fallback profile was not bound to the interface using the 'fallback-profile' command.

Answer

The local database uses PAP, which strips VLAN assignment attributes from the authentication reply.

Answer

RADIUS accounting was disabled, preventing local attribute synchronization.

Question 11

Which statement accurately describes the function of the 'server-timeout' setting within a Juniper access profile?

Accepted Answer

It defines how long the switch waits for a reply from the RADIUS server before failing over to the next server.. The server-timeout setting determines how long the switch waits for a response from a RADIUS server before trying the next server in the server group.

Answer

It determines the maximum duration a client session can remain active before forced re-authentication.

Answer

It dictates the interval at which the switch sends RADIUS accounting interim updates.

Answer

It specifies the idle timeout period for disconnected supplicants.

Question 12

Which command is used to clear dynamic MAC RADIUS authentication states and force a re-authentication on interface ge-0/0/5?

Accepted Answer

clear dot1x interface ge-0/0/5. To clear dot1x or mac-radius states on an interface, the 'clear dot1x statistics' or 'clear access security' commands are used, or more specifically 'clear dot1x interface' to reset the state machine.

Answer

clear ethernet-switching security-table interface ge-0/0/5

Answer

clear access client-profile ge-0/0/5

Answer

clear mac-radius statistics interface ge-0/0/5

Question 13

You are configuring captive portal on an EX Series switch. You want users to be redirected to an external web server hosted at https://portal.enterprise.com/login. Where do you specify this redirection URL in the Junos OS CLI?

Accepted Answer

Under [edit access captive-portal profile profile-name redirection url].. Captive portal redirect URLs are configured within the captive-portal profile hierarchy.

Answer

Under [edit protocols dot1x captive-portal url].

Answer

Under [edit system services web-management captive-portal interface ge-0/0/1 redirect-url].

Answer

Under [edit forwarding-options captive-portal gateway].

Question 14

An EX Series switch is configured with 802.1X and MAC RADIUS. A client device connects that does not support 802.1X. The switch attempts 802.1X, times out, and successfully falls back to MAC RADIUS. However, the administrator notices a significant delay (several seconds) before the MAC RADIUS request is sent to the server. What parameter should be tuned to reduce this delay?

Accepted Answer

Reduce the 'supp-timeout' and 'max-retries' parameters under the 802.1X interface configuration.. The delay is caused by the 802.1X supplicant timeout and retries before giving up and falling back to MAC RADIUS. Reducing 'supp-timeout' and 'max-retries' minimizes this delay.

Answer

Increase the 'server-timeout' parameter in the access-profile configuration.

Answer

Disable EAPOL-start message generation on the switch port.

Answer

Enable fast-reauth under the system authentication options.

Question 15

You are configuring MAC RADIUS authentication on an EX Series switch and want to ensure that devices failing MAC RADIUS are assigned to a restricted quarantine VLAN. Where is the quarantine VLAN configured for failed MAC RADIUS attempts?

Accepted Answer

Under [edit protocols dot1x interface ge-0/0/1 failure-action vlan quarantine-vlan].. Failed authentication action (such as assigning a guest or restricted VLAN) in Junos switch access control is configured under the interface or protocol fallback/fail action hierarchy, such as 'retries' or 'no-response-action' / 'failure-action'.

Answer

Under [edit access profile profile-name radius-options quarantine-vlan].

Answer

Under [edit forwarding-options storm-control profile quarantine].

Answer

Under [edit vlans quarantine-vlan captive-portal-binding].