JNCIP-ENT Layer 2 Authentication And Access Control Practice Test 2 — 15 Questions

Question 1

What is the default authentication order when authentication is enabled on an EX Series switch interface without explicit ordering configuration?

Accepted Answer

dot1x. By default, if authentication order is not specified, dot1x is evaluated first.

Answer

captive-portal

Answer

local database

Answer

mac-radius

Question 2

You are configuring an EX Series switch to support MAC RADIUS authentication. You want to ensure that the switch sends accounting start and stop packets to the RADIUS server. Which configuration hierarchy is required to enable RADIUS accounting for access clients?

Accepted Answer

[edit protocols access-profile profile-name accounting]. RADIUS accounting for access control clients in Junos is configured under the access profile hierarchy using the 'accounting' statement.

Answer

[edit protocols dot1x accounting-options]

Answer

[edit system radius-server accounting]

Answer

[edit access-control accounting-profile]

Question 3

An EX4300 switch is configured with captive portal authentication. Unauthenticated users are successfully redirected when attempting HTTP traffic, but HTTPS traffic fails to redirect properly and instead shows a certificate warning or connection timeout in the user's browser. What is the fundamental reason for this behavior with standard captive portal implementations?

Accepted Answer

Standard captive portal redirects rely on intercepting unencrypted HTTP traffic; intercepting HTTPS without SSL proxy causes certificate mismatch errors.. Standard Layer 2 captive portal implementations intercept HTTP traffic via destination NAT or HTTP redirection. HTTPS traffic cannot be intercepted without a Man-in-the-Middle (MITM) proxy and SSL decryption because the TLS handshake fails due to certificate mismatch.

Answer

HTTPS traffic is blocked by default firewall filters and is excluded from the captive portal bypass list.

Answer

The captive portal server only listens on TCP port 80 and drops all incoming TCP port 443 SYN packets.

Answer

The captive portal profile lacks a valid SSL certificate for HTTPS traffic decryption.

Question 4

You are troubleshooting an issue where an 802.1X supplicant on a Windows client fails to connect to an EX Series switch port. The switch logs show 'EAPOL-TIMEOUT' errors. What does this error indicate?

Accepted Answer

The switch did not receive an EAPOL response from the client after sending an EAPOL request.. An EAPOL-TIMEOUT error indicates that the switch sent an EAPOL packet (such as EAPOL-Request/Identity) but did not receive a response from the client within the timeout window.

Answer

The RADIUS server took too long to validate the client credentials and dropped the session.

Answer

The switch port's operational mode reverted from access to trunk, dropping EAPOL frames.

Answer

The client sent an invalid EAP message that failed integrity checks.

Question 5

Which RADIUS attribute is commonly used to assign a specific session timeout value to an 802.1X authenticated client on an EX Series switch?

Accepted Answer

Session-Timeout (Attribute 27). RADIUS Attribute 27 (Session-Timeout) specifies the maximum number of seconds of service to be provided to the user.

Answer

Idle-Timeout (Attribute 28)

Answer

Tunnel-Client-End-Id (Attribute 66)

Answer

Termination-Action (Attribute 29)

Question 6

You are configuring an EX Series switch for 802.1X authentication. You want to ensure that if a supplicant fails authentication, the port is moved into a specific guest VLAN. Where is the guest VLAN referenced within the dot1x interface configuration?

Accepted Answer

Under [edit protocols dot1x interface ge-0/0/1 guest-vlan vlan-name].. Guest VLANs in Junos 802.1X configurations are assigned under the interface authentication options using the 'guest-vlan' statement.

Answer

Under [edit access-control interface ge-0/0/1 fallback-vlan].

Answer

Under [edit access profile profile-name guest-vlan].

Answer

Under [edit vlans vlan-name dot1x-guest-access].

Question 7

An administrator implements MAC RADIUS authentication on an EX Series switch. Several legacy printers connected to the ports fail to authenticate because they send their MAC addresses in uppercase letters with no separators (AABBCCDDEEFF), while the RADIUS server expects lowercase with colons (aa:bb:cc:dd:ee:ff). How can you resolve this mismatch on the Junos switch?

Accepted Answer

Configure the MAC address format under the access-profile mac-radius options using the lowercase and colon-delimiter settings.. Junos OS allows configuring the MAC address format in MAC RADIUS requests via the 'mac-radius' settings under access profiles, allowing conversion to lowercase or specific separator formats.

Answer

Enable MAC-address translation (MAT) on the Ethernet switching table.

Answer

Configure the local user database to normalize MAC addresses automatically.

Answer

Configure a regex-based rewriting firewall filter on the interface facing the printers.

Question 8

Which statement is true regarding the behavior of the supplicant mode 'single' on an EX Series switch port?

Accepted Answer

Only one supplicant is allowed on the port; if a second device connects, it is blocked or unauthenticated.. Single-supplicant mode allows only a single authenticated client on the port. If a hub or IP phone with a PC is connected, only one device passes authentication.

Answer

It allows up to 256 MAC addresses to authenticate simultaneously via MAC RADIUS.

Answer

Multiple supplicants are allowed, but they must all share the same VLAN and credentials.

Answer

It enables multi-domain authentication for voice and data devices.

Question 9

An enterprise network uses 802.1X authentication with dynamic VLAN assignment on EX Series switches. A client authenticates, and the RADIUS server returns both a VLAN name and a set of dynamic firewall filter names via RADIUS attributes (Filter-Id). When the client connects, the VLAN assignment works perfectly, but the firewall filters are not applied to the interface. What is the most likely cause?

Accepted Answer

The named firewall filters were not pre-configured and committed locally on the EX Series switch.. For dynamic Filter-Id attributes returned by RADIUS to be applied successfully on an EX Series switch, the named firewall filters must already be pre-configured and committed locally on the switch. If the filter does not exist locally, the application fails.

Answer

The dynamic filter must be defined inside the global access profile instead of being returned by RADIUS.

Answer

RADIUS Filter-Id attributes are not supported on EX Series switches for dynamic firewall application.

Answer

Dynamic filter assignment requires MAC RADIUS and is not supported with 802.1X.

Question 10

Which Junos command displays the status of all captive portal sessions currently active on an EX Series switch?

Accepted Answer

show access captive-portal clients. The command 'show access captive-portal clients' displays active captive portal sessions and their status.

Answer

show system captive-portal sessions

Answer

show ethernet-switching captive-portal table

Answer

show dot1x captive-portal summary

Question 11

You are configuring an EX Series switch to use MAC RADIUS authentication. You notice that when devices connect, the switch sends authentication requests, but the accounting start packets are not being sent. What configuration is missing?

Accepted Answer

You did not configure the accounting server and enable accounting under the access-profile hierarchy.. To enable accounting along with MAC RADIUS, you must explicitly enable accounting under the access profile associated with the interface.

Answer

You must enable accounting globally using [edit system accounting radius].

Answer

You failed to enable accounting under the [edit protocols dot1x accounting] hierarchy.

Answer

MAC RADIUS does not support accounting; accounting is exclusive to 802.1X.

Question 12

Which TWO statements are correct regarding the behavior and configuration of multi-supplicant mode on EX Series switches? (Choose two)

Accepted Answer

Each authenticated client on the port can be placed into its own dynamic VLAN via RADIUS.. Multi-supplicant mode allows multiple clients on a single port to authenticate independently. Each client maintains its own authentication state machine.

Answer

It restricts the port to operating exclusively as an access trunk port.

Answer

It requires all connected devices to use identical EAP methods and credentials.

Answer

It is mutually exclusive with MAC RADIUS fallback configurations.

Question 13

Which THREE attributes or conditions must be met for successful dynamic VLAN assignment via RADIUS during 802.1X authentication on Junos EX Series switches? (Choose three)

Accepted Answer

The RADIUS server must return Tunnel-Type (Attribute 64), Tunnel-Medium-Type (Attribute 65), and Tunnel-Private-Group-ID (Attribute 81).. Dynamic VLAN assignment requires the VLAN to exist locally, the RADIUS server to return Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID, and the port to be capable of dynamic VLAN membership.

Answer

The supplicant must initiate EAP-TLS with mutual certificate validation.

Answer

The RADIUS server must return the VLAN ID encoded inside a Vendor-Specific Attribute (VSA) using Cisco-AVPair format exclusively.

Question 14

Which TWO actions occur when an 802.1X supplicant fails authentication and a guest VLAN is configured on the EX Series switch port? (Choose two)

Accepted Answer

The switch assigns the interface to the specified guest VLAN.. When authentication fails and a guest VLAN is defined, the port is moved to the guest VLAN, and standard re-authentication timers or failure actions apply.

Answer

The switch sends a RADIUS accounting stop packet for the failed session.

Answer

The switch permanently disables the physical port until a manual reset is issued.

Answer

The supplicant is automatically migrated to the critical authentication server group.

Question 15

Which TWO options are valid authentication methods that can be specified in the 'authentication-order' statement on an EX Series switch interface? (Choose two)

Accepted Answer

mac-radius. The authentication-order statement supports methods such as dot1x, mac-radius, and captive-portal.

Answer

kerberos

Answer

tacacs-plus

Answer

ldap-direct