JNCIP-ENT Layer 2 Authentication And Access Control Practice Test 2 — 15 Questions

Question 1

Which THREE diagnostic tools or show commands are useful when troubleshooting MAC RADIUS authentication failures on an EX Series switch? (Choose three)

Accepted Answer

Traceoptions configured under protocols dot1x and access-profile for logging.. Option A is correct because traceoptions under protocols dot1x and access-profile capture the EAPoL and RADIUS authentication exchange details, which is essential for diagnosing MAC RADIUS failures on EX Series switches. Option C is correct because show dot1x interface detail displays per-interface 802.1X/MAC RADIUS state, including authentication role, supplicant status, and failure reasons. Option E is correct because show access radius-server statistics reveals RADIUS request/response counters, timeouts, and rejects, helping identify whether the failure is on the switch-to-RADIUS path. Option B is not a valid Junos command for this purpose, and option D (traceroute mac-address) is an L2 path trace tool that does not inspect authentication or RADIUS behavior.

Answer

show access security clients

Answer

traceroute mac-address

Question 2

Which THREE features or parameters can be configured under the 'protocols dot1x' interface hierarchy on an EX Series switch? (Choose two) -> wait, prompt says Which THREE, let's select three: supplicant timeout, max-retries, and guest-vlan.

Accepted Answer

max-retries. Under protocols dot1x interface hierarchy, you can configure timers like supp-timeout, retries/max-retries, guest-vlan, and fallback actions.

Answer

captive-portal-profile

Answer

radius-server-group

Question 3

Which TWO conditions must be satisfied for an EX Series switch to successfully process a RADIUS Change of Authorization (CoA) request? (Choose two)

Accepted Answer

The RADIUS server must be configured as a dynamic client or CoA must be enabled on the switch access profile.. Option B is correct because for an EX Series switch to accept and process a RADIUS Change of Authorization (CoA) request, the RADIUS server sending the CoA must be recognized as a dynamic client (or CoA must be explicitly enabled in the switch's access profile), otherwise the switch will silently discard the unsolicited CoA packet. Option E is correct because the CoA request is a RADIUS packet that must be authenticated; the shared secret configured on the RADIUS server for CoA must match the shared secret configured on the switch, or the switch will reject the packet as invalid. Option A is not required because CoA can be processed for any authenticated session, not only captive portal sessions. Option C is wrong because RADIUS accounting is independent of CoA and does not need to be disabled. Option D is wrong because CoA works with standard access ports and does not require trunk mode or static VLAN pinning.

Answer

The client must be actively running a captive portal browser session.

Answer

RADIUS accounting must be disabled globally across the entire switch.

Answer

The switch port must be configured in access trunk mode with static VLAN pinning.

Question 4

You are deploying 802.1X on an EX4300 access switch. The authentication server is a Juniper Networks Steel-Belted Radius (SBR) Enterprise server. You want the switch to accept authenticated supplicants only if the RADIUS server returns an Access-Accept that includes the Filter-Id attribute with the value 'employee'. Which Junos configuration element on the EX switch is required to enforce this behavior?

Accepted Answer

On the interface, apply an 802.1X authenticator profile that references the access profile 'employee', and configure the access profile 'employee' with the filter-id 'employee'.. The switch uses the Filter-Id attribute from the RADIUS Access-Accept as a profile name. To enforce a specific value, you must configure an access profile with that filter-id and reference it in the 802.1X authenticator profile. This ensures only clients whose RADIUS reply contains the expected Filter-Id are granted access.

Answer

access-profile employee with radius-server 10.1.1.1 secret juniper

Answer

authentication-profile employee-profile { radius { authentication-server 10.1.1.1; } } and on the interface: dot1x authenticator { }

Answer

authentication-profile employee-profile with radius-attribute filter-id employee

Question 5

You manage an EX4300 switch that enforces 802.1X on an access port. Users complain they must wait about 60 seconds after plugging in before the port becomes authenticated. You have already verified the RADIUS server responds in under one second. Which setting should you tune to reduce this delay?

Accepted Answer

The transmit-period under the 802.1X authenticator interface configuration. The delay before authentication starts is governed by how long the authenticator waits for a supplicant to send EAPOL-Start when the client is silent. The transmit-period and maximum retransmissions together determine that startup latency. Reducing transmit-period makes the switch send EAPOL-Request Identity frames more frequently, shortening the time until the client responds and authentication proceeds.

Answer

The mac-radius restriction setting on the access interface

Answer

The server-timeout value under the access profile

Answer

The reauthentication interval configured on the authenticator interface

Question 6

You are deploying 802.1X on an EX Series switch. The RADIUS server returns the Filter-Id attribute with a value of 'restricted' after successful authentication. You want the switch to apply a specific set of CoS and firewall filters based on this attribute. Which configuration element must you define on the switch to map the Filter-Id value to the desired policies?

Accepted Answer

A 'filter-id' mapping under the access profile that associates the string 'restricted' with a firewall filter and CoS profile.. The correct approach is to configure a filter-id mapping under the access profile on the EX Series switch. This mapping translates the RADIUS Filter-Id string into a local firewall filter and CoS profile, which are then applied to the authenticated session. This allows dynamic policy enforcement based on RADIUS attributes without manual per-user configuration.

Answer

A RADIUS server group with the 'filter-id' attribute enabled under the authentication profile.

Answer

A CoS classifier under the interface that matches the Filter-Id attribute value and applies the corresponding forwarding class.

Answer

A Junos OS 'radius-options' statement under the access profile to translate the Filter-Id into a firewall filter.

Question 7

You are configuring MAC RADIUS authentication on an EX Series switch. You want to ensure that the switch sends both the MAC address and the interface name to the RADIUS server during authentication. Which TWO statements are correct about the RADIUS Access-Request packet generated by the switch in this scenario? (Choose two.)

Accepted Answer

The switch includes the NAS-IP-Address attribute set to the loopback interface address if configured.. In MAC RADIUS authentication, the switch sends the MAC address as the username and includes the interface name in NAS-Port-Id. The NAS-IP-Address attribute identifies the switch to the RADIUS server, often using a loopback address if configured. These attributes allow the RADIUS server to authenticate and authorize the device based on its MAC and physical port.

Answer

The switch sends the MAC address in the User-Password attribute encrypted with the shared secret.

Answer

The MAC address is sent in the User-Name attribute in the format 00-11-22-33-44-55.

Answer

The MAC address is sent in the Calling-Station-Id attribute in the format 00-11-22-33-44-55.

Question 8

You are configuring MAC RADIUS authentication on an EX4300 switch. A PC connects to interface ge-0/0/10 and its MAC address is not in the RADIUS server database, so authentication fails. You want the switch to place the interface into a restricted VLAN where the user can only access a remediation server. Which Junos OS feature should you configure to achieve this?

Accepted Answer

Configure a restricted VLAN under the interface with the 'restricted-vlan' statement.. When MAC RADIUS authentication fails because the MAC address is not authorized, the restricted VLAN feature allows the switch to place the port into a limited-access VLAN. This is configured using the 'restricted-vlan' statement under the interface or in the access profile. It provides a remediation path without granting full network access.

Answer

Configure a dynamic VLAN assignment using the 'dynamic-vlan' statement under the interface.

Answer

Configure a guest VLAN under the interface with the 'guest-vlan' statement.

Answer

Configure a server-reject VLAN using the 'server-reject-vlan' statement under the interface.

Question 9

You are configuring an EX Series switch to use 802.1X with EAP-TLS. The RADIUS server is configured to return a Filter-Id attribute containing the name of an egress firewall filter. The switch receives the attribute but does not apply the filter to the authenticated user's traffic. Which action must you take to ensure the filter is applied?

Accepted Answer

Define the filter under [edit firewall family ethernet-switching] and reference it in the access profile using the filter statement.. To apply a RADIUS-provided Filter-Id as a dynamic filter, the filter must exist in the ethernet-switching family and be referenced in the access profile. When the RADIUS server returns the Filter-Id attribute, the switch matches the name and applies the filter to the authenticated session. This provides per-user traffic filtering without affecting other users on the port.

Answer

Enable the radius-server attribute 11 filter-id command under the access profile.

Answer

Configure the filter name under the interface's family ethernet-switching filter output stanza.

Answer

Configure the filter name under the access profile with the filter command and enable radius-server attribute 11.

Question 10

An EX Series switch is configured with 802.1X on ge-0/0/10. A VoIP phone that supports 802.1X is attached, and a PC is daisy-chained behind the phone. You want the phone authenticated via 802.1X and the PC authenticated via MAC RADIUS on the same physical port. Which configuration element is required to support this?

Accepted Answer

Enable supplicant multiple on the interface with authentication mode set to multiple. When multiple devices share a single access port, each must be authenticated individually. Junos supports this through supplicant multiple mode, which permits several supplicants on one interface. Combined with an authentication order that includes both 802.1X and MAC RADIUS, the phone can authenticate with 802.1X while the PC is validated by its MAC address, satisfying the requirement.

Answer

Enable MAC move limiting on the interface

Answer

Set the authentication order to mac-radius first, then 802.1X

Answer

Configure guest VLAN and restrict the PC to that VLAN

Question 11

You are configuring 802.1X authentication on an EX Series switch. You want to ensure that the switch sends the correct NAS-Identifier and NAS-Port-Type attributes in RADIUS Access-Request messages. Which two statements are true about these attributes on Junos? (Choose two.)

Accepted Answer

The NAS-Identifier attribute, if not configured, defaults to the switch's hostname.. The NAS-Identifier can be configured under the access profile and defaults to the hostname if not set. The NAS-Port-Type is automatically determined based on the interface type and is not configurable via a simple statement on EX Series switches. These attributes are important for RADIUS server policies and logging.

Answer

The NAS-Port-Type attribute is set based on the physical interface type and cannot be overridden.

Answer

The NAS-Port-Type attribute can be configured using the 'nas-port-type' statement under the access profile.

Answer

The NAS-Port-Type attribute is automatically set to 'Ethernet' for all 802.1X authentications on EX Series switches.

Question 12

You are configuring 802.1X on an EX Series switch. You want to allow supplicants that do not support 802.1X to be authenticated via MAC RADIUS as a fallback. You also want to ensure that if the RADIUS server is unreachable, the switch places the port in a VLAN that provides limited access. Which configuration accomplishes this?

Accepted Answer

Configure an authenticator profile with 'mac-radius' and 'dot1x' as authentication methods. Set 'server-fail-vlan' to a restricted VLAN. Apply the profile to the interface.. To support non-802.1X clients and handle RADIUS server unavailability, configure an authenticator profile with both 'dot1x' and 'mac-radius' methods. The 'server-fail-vlan' determines the VLAN used when the server is unreachable, ensuring limited access. Applying this profile to the interface achieves the required behavior.

Answer

Enable 'dot1x' on the interface and set 'mac-radius' globally. Configure 'server-reject-vlan' for limited access and 'server-fail-vlan' for full access.

Answer

Set the interface to 'dot1x' mode and configure 'mac-radius' under the interface. Define a 'server-reject-vlan' with limited access and a 'server-fail-vlan' with limited access.

Answer

Configure 'dot1x' and 'mac-radius' under the interface. Set 'server-fail-vlan' to a restricted VLAN. Configure 'server-reject-vlan' to the same restricted VLAN.

Question 13

You are configuring an EX Series switch to support 802.1X authentication with dynamic VLAN assignment. The RADIUS server returns Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes. Which two statements are correct about how the switch processes these attributes? (Choose two.)

Accepted Answer

The switch uses the Tunnel-Private-Group-ID attribute to identify the VLAN by name or 802.1Q tag.. Dynamic VLAN assignment via 802.1X on Junos requires the RADIUS server to send Tunnel-Type (VLAN=13) and Tunnel-Medium-Type (IEEE-802=6), along with Tunnel-Private-Group-ID specifying the VLAN name or ID. The switch validates these attributes and places the authenticated user into the designated VLAN, provided the VLAN exists on the switch.

Answer

The switch applies the VLAN assignment only after the user successfully authenticates and the RADIUS server sends an Access-Accept with the attributes.

Answer

The switch ignores the Tunnel-Type and Tunnel-Medium-Type attributes if the Tunnel-Private-Group-ID is present.

Answer

The switch automatically creates the VLAN if it does not exist when processing the Tunnel-Private-Group-ID attribute.

Question 14

You are configuring an EX Series switch to use MAC RADIUS authentication. You want the switch to send accounting start and stop records to the RADIUS server for each authenticated MAC address. Which configuration step is required?

Accepted Answer

Configure the RADIUS server with accounting and enable accounting under the access profile.. For MAC RADIUS accounting on EX Series switches, you must configure the RADIUS server with accounting enabled and then enable accounting under the access profile. This causes the switch to send Accounting-Request Start and Stop records for each authenticated MAC address, providing session tracking and billing information.

Answer

Enable accounting under the access profile with the accounting command.

Answer

Enable accounting under the interface configuration with the accounting command.

Answer

Configure the RADIUS server with accounting and enable accounting under the interface.

Question 15

You are troubleshooting an EX Series switch where 802.1X authentication fails for a specific client. The switch logs show 'EAPOL packet received but no response from RADIUS server'. You verify that the RADIUS server is reachable and other clients authenticate successfully. Which action should you take to resolve the issue?

Accepted Answer

Verify that the client's supplicant is configured to use the correct EAP method and that any required certificates are installed.. The log message suggests the switch received an EAPOL packet but did not forward a valid RADIUS request, likely because the client's EAP response was not understood. Since other clients authenticate, the RADIUS server and shared secret are fine. The issue is client-specific, so verifying the supplicant's EAP method and certificates is the correct troubleshooting step.

Answer

Configure the interface to use MAC RADIUS authentication as a fallback for this client.

Answer

Increase the RADIUS server timeout value under the access profile to allow more time for the server to respond.

Answer

Check the access profile to ensure the correct RADIUS server is configured and that the shared secret matches.