JNCIP-ENT Layer 2 Authentication And Access Control — Timed 30 Questions

Question 1

You are troubleshooting an 802.1X deployment on an EX4300 switch. Clients fail to authenticate when using Supplicant-based authentication combined with MAC RADIUS fallback. You notice that the switch does not attempt MAC RADIUS after 802.1X times out. Which configuration error most likely caused this?

30 minute time limit — choose an answer to begin.

Accepted Answer

You failed to include both dot1x and mac-radius within the interface authentication-order statement.. To fall back to MAC RADIUS when 802.1X fails, the 'authentication-order' statement must explicitly list both dot1x and mac-radius, and the fallback mechanism must be configured properly.

Answer

You enabled static MAC pinning on the access port, which disables fallback mechanisms.

Answer

You omitted the mac-radius statement from the global protocols access-profile configuration.

Answer

You configured the supplicant mode as single-supplicant instead of multi-supplicant.

Question 2

You are implementing MAC RADIUS authentication on an EX4600 switch. You notice that when a device connects, the switch sends the MAC address in the Username attribute (RADIUS attribute 1) with hyphen separators (e.g., aa-bb-cc-dd-ee-ff). Your RADIUS server expects colons (aa:bb:cc:dd:ee:ff). Where must you configure this format change on Junos OS?

Accepted Answer

Under [edit protocols access-profile profile-name mac-radius] using the format option.. Junos OS allows modifying the MAC address format sent to the RADIUS server using the 'mac-radius' configuration hierarchy under access profile or interface settings, specifically via the 'mac-питан' or format options.

Answer

Under [edit system radius-server server-name] using the attribute-format option.

Answer

Under [edit interfaces ge-0/0/1 unit 0 family ethernet-switching] using the mac-radius format command.

Answer

Under [edit access profile profile-name firewall] using the translation map.

Question 3

An EX Series switch is configured with multiple-supplicant mode on an access port connected to an IP phone with a PC daisy-chained behind it. The IP phone authenticates via 802.1X, but the PC uses MAC RADIUS. The phone authenticates successfully and moves to the voice VLAN. However, when the PC boots, it fails authentication because the switch rejects a second supplicant on the same logical port index. Which configuration parameter resolves this issue?

Accepted Answer

Configure the interface with 'set protocols dot1x interface ge-0/0/1 supplicant multiple' and ensure multi-supplicant mode is active.. In multiple-supplicant mode, the switch allows more than one supplicant (e.g., phone and PC) to authenticate independently on the same port. The correct configuration is 'set protocols dot1x interface ge-0/0/1 supplicant multiple' to enable multiple supplicants, and the port must be in multiple-supplicant mode (not single-secure). This allows the phone to authenticate via 802.1X and the PC to authenticate via MAC RADIUS on the same interface.

Answer

Configure 'set access-profile captive-portal multiple-logins per-port'.

Answer

Set the port mode to trunk and enable voice-vlan stacking.

Answer

Configure the interface with 'set protocols dot1x interface ge-0/0/1 mac-radius multiple-clients'.

Question 4

You are configuring captive portal on an EX Series switch using J-Web and CLI. Users are redirected to the captive portal page, but after successful authentication, they still cannot access the external network. Inspecting the routing table and firewall filters, what is the most likely reason for this post-authentication restriction?

Accepted Answer

The captive portal dynamic firewall filter was not removed from the interface due to a failure in receiving the RADIUS Change of Authorization (CoA) or accounting update.. After successful captive portal authentication, the switch must dynamically remove the local firewall filter that redirects traffic to the portal server. If CoA or dynamic VLAN assignment fails, the filter remains active.

Answer

The default gateway address specified in the captive portal profile is in a different routing instance.

Answer

The user's MAC address was not statically added to the bypass list of the captive portal profile.

Answer

The captive portal profile lacks a defined redirect URL for the external network gateway.

Question 5

An administrator configures 802.1X authentication with local server fallback on an EX Series switch. When the external RADIUS server is unreachable, the switch fails over to the local user database. However, users authenticated via the local database are placed in the default access VLAN instead of the VLAN specified in their local user profile. What is the cause of this behavior?

Accepted Answer

Local database user profiles on Junos do not support dynamic VLAN assignment attributes natively, requiring interface-level default fallback VLANs.. On Junos EX Series switches, the local user database does not support dynamic VLAN assignment via attributes like Tunnel-Type, Tunnel-Medium-Type, or Tunnel-Private-Group-ID. These attributes are typically returned by a RADIUS server to assign a VLAN dynamically. When falling back to the local database, the switch cannot process such attributes because they are not part of the local user profile schema. Therefore, users are placed in the default access VLAN configured on the interface, not a VLAN specified in the local profile. This is a known limitation of local fallback authentication on Junos.

Answer

The local fallback profile was not bound to the interface using the 'fallback-profile' command.

Answer

The local database uses PAP, which strips VLAN assignment attributes from the authentication reply.

Answer

RADIUS accounting was disabled, preventing local attribute synchronization.

Question 6

Which command is used to clear dynamic MAC RADIUS authentication states and force a re-authentication on interface ge-0/0/5?

Accepted Answer

clear dot1x interface ge-0/0/5. To clear dot1x or mac-radius states on an interface, the 'clear dot1x statistics' or 'clear access security' commands are used, or more specifically 'clear dot1x interface' to reset the state machine.

Answer

clear ethernet-switching security-table interface ge-0/0/5

Answer

clear access client-profile ge-0/0/5

Answer

clear mac-radius statistics interface ge-0/0/5

Question 7

You are configuring captive portal on an EX Series switch. You want users to be redirected to an external web server hosted at https://portal.enterprise.com/login. Where do you specify this redirection URL in the Junos OS CLI?

Accepted Answer

Under [edit access captive-portal profile profile-name redirection url].. Captive portal redirect URLs are configured within the captive-portal profile hierarchy.

Answer

Under [edit protocols dot1x captive-portal url].

Answer

Under [edit system services web-management captive-portal interface ge-0/0/1 redirect-url].

Answer

Under [edit forwarding-options captive-portal gateway].

Question 8

You are configuring MAC RADIUS authentication on an EX Series switch and want to ensure that devices failing MAC RADIUS are assigned to a restricted quarantine VLAN. Where is the quarantine VLAN configured for failed MAC RADIUS attempts?

Accepted Answer

Under [edit protocols dot1x interface ge-0/0/1 failure-action vlan quarantine-vlan].. Failed authentication action (such as assigning a guest or restricted VLAN) in Junos switch access control is configured under the interface or protocol fallback/fail action hierarchy, such as 'retries' or 'no-response-action' / 'failure-action'.

Answer

Under [edit access profile profile-name radius-options quarantine-vlan].

Answer

Under [edit forwarding-options storm-control profile quarantine].

Answer

Under [edit vlans quarantine-vlan captive-portal-binding].

Question 9

An enterprise deploys 802.1X with dynamic VLAN assignment. When a user authenticates, the RADIUS server returns the correct VLAN name, but the switch places the port into a different VLAN. Upon checking the switch, you find that the VLAN name returned by RADIUS does not match any VLAN configured in the local 'vlans' configuration hierarchy. How does Junos OS handle this discrepancy?

Accepted Answer

The switch drops the port into the default native VLAN or rejects the connection if strict VLAN enforcement is enabled.. When the RADIUS server returns a VLAN name that does not exist in the switch's local VLAN database, Junos OS cannot assign the port to that VLAN. By default, the switch will either drop the port into the default native VLAN or reject the connection if strict VLAN enforcement is enabled. This prevents the port from being placed in an undefined VLAN.

Answer

The switch ignores the RADIUS attribute and keeps the port in its previous static configuration.

Answer

The switch dynamically creates the VLAN on the fly using default IEEE 802.1Q parameters.

Answer

The switch queries the VTP/GVRP server to dynamically learn the VLAN definition.

Question 10

You are configuring an EX Series switch to support MAC RADIUS authentication. You want to ensure that the switch sends accounting start and stop packets to the RADIUS server. Which configuration hierarchy is required to enable RADIUS accounting for access clients?

Accepted Answer

[edit protocols access-profile profile-name accounting]. To enable RADIUS accounting for access clients, you must configure an access profile and specify accounting under the profile. The correct hierarchy is '[edit protocols access-profile profile-name accounting]'. This allows the switch to send accounting start and stop packets to the RADIUS server.

Answer

[edit protocols dot1x accounting-options]

Answer

[edit system radius-server accounting]

Answer

[edit access-control accounting-profile]

Question 11

You are configuring an EX Series switch for 802.1X authentication. You want to ensure that if a supplicant fails authentication, the port is moved into a specific guest VLAN. Where is the guest VLAN referenced within the dot1x interface configuration?

Accepted Answer

Under [edit protocols dot1x interface ge-0/0/1 guest-vlan vlan-name].. In Junos, the guest VLAN for 802.1X is configured under the dot1x interface hierarchy. The correct syntax is 'set protocols dot1x interface ge-0/0/1 guest-vlan <vlan-name>'. This specifies the VLAN to which the port is moved if authentication fails. The other options reference incorrect hierarchies or unrelated features.

Answer

Under [edit access-control interface ge-0/0/1 fallback-vlan].

Answer

Under [edit access profile profile-name guest-vlan].

Answer

Under [edit vlans vlan-name dot1x-guest-access].

Question 12

An administrator implements MAC RADIUS authentication on an EX Series switch. Several legacy printers connected to the ports fail to authenticate because they send their MAC addresses in uppercase letters with no separators (AABBCCDDEEFF), while the RADIUS server expects lowercase with colons (aa:bb:cc:dd:ee:ff). How can you resolve this mismatch on the Junos switch?

Accepted Answer

Configure the MAC address format under the access-profile mac-radius options using the lowercase and colon-delimiter settings.. Junos OS allows configuring the MAC address format in MAC RADIUS requests via the 'mac-radius' settings under access profiles, allowing conversion to lowercase or specific separator formats.

Answer

Enable MAC-address translation (MAT) on the Ethernet switching table.

Answer

Configure the local user database to normalize MAC addresses automatically.

Answer

Configure a regex-based rewriting firewall filter on the interface facing the printers.

Question 13

Which Junos command displays the status of all captive portal sessions currently active on an EX Series switch?

Accepted Answer

show access captive-portal clients. The correct command is 'show access captive-portal clients' because it is the specific Junos CLI command that displays the status of all active captive portal sessions on EX Series switches. This command provides detailed information including the client MAC address, IP address, associated interface, and session state. The 'access' hierarchy is used for all access-related features like captive portal, 802.1X, and MAC RADIUS, making it the authoritative source for session status.

Answer

show system captive-portal sessions

Answer

show ethernet-switching captive-portal table

Answer

show dot1x captive-portal summary

Question 14

You are configuring an EX Series switch to use MAC RADIUS authentication. You notice that when devices connect, the switch sends authentication requests, but the accounting start packets are not being sent. What configuration is missing?

Accepted Answer

You did not configure the accounting server and enable accounting under the access-profile hierarchy.. To enable accounting along with MAC RADIUS, you must explicitly enable accounting under the access profile associated with the interface.

Answer

You must enable accounting globally using [edit system accounting radius].

Answer

You failed to enable accounting under the [edit protocols dot1x accounting] hierarchy.

Answer

MAC RADIUS does not support accounting; accounting is exclusive to 802.1X.

Question 15

Which THREE attributes or conditions must be met for successful dynamic VLAN assignment via RADIUS during 802.1X authentication on Junos EX Series switches? (Choose three)

Accepted Answer

The RADIUS server must return Tunnel-Type (Attribute 64), Tunnel-Medium-Type (Attribute 65), and Tunnel-Private-Group-ID (Attribute 81).. Option B is correct because Junos EX Series switches performing dynamic VLAN assignment via 802.1X rely on the standard RADIUS tunnel attributes: Tunnel-Type (64) set to VLAN, Tunnel-Medium-Type (65) set to IEEE-802, and Tunnel-Private-Group-ID (81) carrying the VLAN name or ID. Option C is correct because the VLAN named or numbered in Tunnel-Private-Group-ID must already exist in the switch's VLAN configuration; otherwise the switch cannot place the supplicant's traffic into that VLAN and authentication/assignment fails. Option E is correct because the authenticator interface must be able to carry the dynamically assigned VLAN — typically configured with the appropriate port mode (access with dynamic VLAN support or trunk) so the VLAN can be applied to the session. Option A is not required because dynamic VLAN assignment works with various EAP methods (for example PEAP-MSCHAPv2 or EAP-TTLS), not exclusively EAP-TLS with mutual certificates. Option D is incorrect because Junos supports the standard RADIUS tunnel attributes for VLAN assignment, not an exclusive requirement for a Cisco-AVPair VSA.

Answer

The supplicant must initiate EAP-TLS with mutual certificate validation.

Answer

The RADIUS server must return the VLAN ID encoded inside a Vendor-Specific Attribute (VSA) using Cisco-AVPair format exclusively.

Question 16

Which THREE diagnostic tools or show commands are useful when troubleshooting MAC RADIUS authentication failures on an EX Series switch? (Choose three)

Accepted Answer

Traceoptions configured under protocols dot1x and access-profile for logging.. Option A is correct because traceoptions under protocols dot1x and access-profile capture the EAPoL and RADIUS authentication exchange details, which is essential for diagnosing MAC RADIUS failures on EX Series switches. Option C is correct because show dot1x interface detail displays per-interface 802.1X/MAC RADIUS state, including authentication role, supplicant status, and failure reasons. Option E is correct because show access radius-server statistics reveals RADIUS request/response counters, timeouts, and rejects, helping identify whether the failure is on the switch-to-RADIUS path. Option B is not a valid Junos command for this purpose, and option D (traceroute mac-address) is an L2 path trace tool that does not inspect authentication or RADIUS behavior.

Answer

show access security clients

Answer

traceroute mac-address

Question 17

Which THREE features or parameters can be configured under the 'protocols dot1x' interface hierarchy on an EX Series switch? (Choose two) -> wait, prompt says Which THREE, let's select three: supplicant timeout, max-retries, and guest-vlan.

Accepted Answer

max-retries. Under protocols dot1x interface hierarchy, you can configure timers like supp-timeout, retries/max-retries, guest-vlan, and fallback actions.

Answer

captive-portal-profile

Answer

radius-server-group

Question 18

Which TWO conditions must be satisfied for an EX Series switch to successfully process a RADIUS Change of Authorization (CoA) request? (Choose two)

Accepted Answer

The RADIUS server must be configured as a dynamic client or CoA must be enabled on the switch access profile.. Option B is correct because for an EX Series switch to accept and process a RADIUS Change of Authorization (CoA) request, the RADIUS server sending the CoA must be recognized as a dynamic client (or CoA must be explicitly enabled in the switch's access profile), otherwise the switch will silently discard the unsolicited CoA packet. Option E is correct because the CoA request is a RADIUS packet that must be authenticated; the shared secret configured on the RADIUS server for CoA must match the shared secret configured on the switch, or the switch will reject the packet as invalid. Option A is not required because CoA can be processed for any authenticated session, not only captive portal sessions. Option C is wrong because RADIUS accounting is independent of CoA and does not need to be disabled. Option D is wrong because CoA works with standard access ports and does not require trunk mode or static VLAN pinning.

Answer

The client must be actively running a captive portal browser session.

Answer

RADIUS accounting must be disabled globally across the entire switch.

Answer

The switch port must be configured in access trunk mode with static VLAN pinning.

Question 19

You are deploying 802.1X on an EX4300 access switch. The authentication server is a Juniper Networks Steel-Belted Radius (SBR) Enterprise server. You want the switch to accept authenticated supplicants only if the RADIUS server returns an Access-Accept that includes the Filter-Id attribute with the value 'employee'. Which Junos configuration element on the EX switch is required to enforce this behavior?

Accepted Answer

On the interface, apply an 802.1X authenticator profile that references the access profile 'employee', and configure the access profile 'employee' with the filter-id 'employee'.. The switch uses the Filter-Id attribute from the RADIUS Access-Accept as a profile name. To enforce a specific value, you must configure an access profile with that filter-id and reference it in the 802.1X authenticator profile. This ensures only clients whose RADIUS reply contains the expected Filter-Id are granted access.

Answer

access-profile employee with radius-server 10.1.1.1 secret juniper

Answer

authentication-profile employee-profile { radius { authentication-server 10.1.1.1; } } and on the interface: dot1x authenticator { }

Answer

authentication-profile employee-profile with radius-attribute filter-id employee

Question 20

You manage an EX4300 switch that enforces 802.1X on an access port. Users complain they must wait about 60 seconds after plugging in before the port becomes authenticated. You have already verified the RADIUS server responds in under one second. Which setting should you tune to reduce this delay?

Accepted Answer

The transmit-period under the 802.1X authenticator interface configuration. The delay before authentication starts is governed by how long the authenticator waits for a supplicant to send EAPOL-Start when the client is silent. The transmit-period and maximum retransmissions together determine that startup latency. Reducing transmit-period makes the switch send EAPOL-Request Identity frames more frequently, shortening the time until the client responds and authentication proceeds.

Answer

The mac-radius restriction setting on the access interface

Answer

The server-timeout value under the access profile

Answer

The reauthentication interval configured on the authenticator interface