Juniper Networks · Free Practice Questions · Last reviewed May 2026
54 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator is configuring a new point-to-point link between two Junos routers running IS-IS. By default, how does IS-IS handle adjacency establishment on a point-to-point link compared to a broadcast link?
It uses a 3-way handshake TLV in IIH packets and bypasses the DIS election process entirely.
On point-to-point links, IS-IS establishes adjacencies using the three-way handshake TLV carried in IIH PDUs, confirming bidirectional connectivity before the adjacency reaches Up. Because the link is point-to-point, no DIS election occurs — that process applies only to broadcast links, satisfying the stem's comparison of the two link types.
It relies strictly on CSNPs sent every 10 seconds to establish the adjacency.
It requires manual mapping of neighbor system IDs using static ARP bindings.
It initiates a DIS election using priority values identical to broadcast segments.
During the examination of IS-IS packet captures on a multi-access LAN interface, an engineer notices a specific PDU type being transmitted periodically by the Designated Intermediate System (DIS) to maintain synchronized link-state databases. Which PDU type performs this function?
Partial Sequence Numbers PDU (PSNP)
Complete Sequence Numbers PDU (CSNP)
The DIS multicasts Complete Sequence Numbers PDUs every ten seconds on a multi-access LAN, listing every link-state PDU in its database so neighbours can compare and request anything missing. This satisfies the stem's requirement for the PDU that maintains synchronised link-state databases, whereas partial sequence numbers PDUs only describe a subset.
Intermediate System Hello (IIH)
Level 1 Link State PDU (LSP)
A network engineer wants to verify IS-IS link-state database entries, specifically checking for TLVs that carry extended IP reachability information with wide metrics. Which Junos operational command should be used?
show isis adjacency extensive
show isis database detail
The detail keyword expands each LSP, displaying its TLVs, including extended IP reachability entries carrying wide metrics. The summary form omits TLV contents, so only the detailed database output satisfies the requirement to inspect those specific TLVs.
show ospf database
show route protocols isis
Which TWO characteristics describe the behavior and properties of Level 1 and Level 2 routing in IS-IS? (Choose two)
Level 1 routers are strictly prohibited from connecting to Level 2 routers under any circumstances.
Level 1 routing requires the explicit configuration of a designated Area 0 backbone.
Level 2 routers form the backbone and can route traffic between different IS-IS areas.
Level 2 routers form the IS-IS backbone and route between areas, using Level 2 link-state databases to reach destinations outside their local area. This satisfies the stem's requirement for a characteristic of Level 2 routing behaviour.
Level 2 routers do not support wide metrics and only operate with narrow metrics.
Level 1 areas use intra-area routing and require all routers within the same area to share a common area address.
Level 1 routers exchange routing information only within their own area, using intra-area routes, and every router in that area must share the same area address. This area-address agreement defines the Level 1 area boundary.
During an audit of an IS-IS routing network, an engineer examines the Type-Length-Value (TLV) structures used in IS-IS PDUs. Which TLV is specifically responsible for carrying IPv4 internal and external reachability information when using wide metrics?
TLV 135
TLV 135 carries IPv4 internal and external reachability information as extended IP reachability entries, supporting wide metric values beyond the 6-bit limit. It is the correct TLV for advertising IPv4 prefixes when wide metrics are enabled in IS-IS.
TLV 128
TLV 1
TLV 2
Which command is used to verify the IS-IS adjacency state on a Junos device?
show isis interface
show isis database
show isis adjacency
`show isis adjacency` displays each IS-IS neighbour with its interface, state (Up, Initialising, Down), hold time and remaining lifetime, directly satisfying the stem's requirement to verify adjacency state on a Junos device. It reads the adjacency database maintained by the IS-IS process, unlike route or interface commands.
show protocols isis neighbors
Want more IS IS practice?
Practice this domainAn administrator wants to modify the Local Preference attribute for all routes received from a specific external BGP peer. Where must this policy be applied in Junos?
Import policy applied to the eBGP neighbor or group
Local Preference is a well-known discretionary attribute evaluated during inbound processing, so an import policy bound to the eBGP neighbour or group modifies it before best-path selection. Export policy would affect the peer's decision, not the local router's.
Export policy applied to the eBGP group
Forwarding plane firewall filter
Global system-level static route policy
During troubleshooting of a flapping BGP session, you notice BGP Notification messages being sent. Which BGP message type is responsible for tearing down a session due to an error condition?
KEEPALIVE
UPDATE
OPEN
NOTIFICATION
The NOTIFICATION message carries error codes and subcodes, and its receipt causes the peer to tear down the BGP session. Unlike OPEN, UPDATE or KEEPALIVE, it is the message type explicitly used to signal an error condition and terminate the adjacency.
An engineer must inspect the BGP state and verify the received prefix counts from a specific neighbor on an MX Series router. Which operational command should be used?
show bgp neighbor 10.1.1.1
`show bgp neighbor 10.1.1.1` queries the BGP neighbour session directly, displaying its state and the received prefix count for that specific peer. This satisfies the stem's requirement to inspect state and verify received prefixes from one neighbour on the MX Series, unlike summary or route-table commands that lack per-neighbour detail.
show ospf neighbor
show route protocol bgp
show bgp summary
While reviewing BGP updates, you notice an attribute type code of 3 with a value representing an IP address. Which well-known mandatory path attribute is this?
AS_PATH
ORIGIN
NEXT_HOP
NEXT_HOP carries attribute type code 3 and holds an IP address, exactly matching the observed BGP update. As a well-known mandatory attribute, it specifies the next-hop IP for the advertised prefix, satisfying the stem's requirement to identify the attribute by its type code and IP-address value.
LOCAL_PREF
An administrator configures a BGP policy to reject routes with an AS_PATH containing a specific AS number. Which match condition in a Junos routing policy is used to evaluate the AS_PATH?
pref
metric
as-path
The `as-path` match condition evaluates a route's AS_PATH attribute against a regular expression, directly satisfying the requirement to reject routes containing a specific AS number. Junos applies this condition within a policy term, so any path whose AS sequence matches the expression is filtered before advertisement or installation.
community
What is the primary function of the BGP OPEN message?
To advertise reachability and path attributes for network prefixes.
To maintain the connection state and verify liveliness at regular intervals.
To signal fatal errors and immediately terminate the BGP session.
To establish a peering session and negotiate capabilities such as ASNs and timers.
The OPEN message initiates the BGP session after TCP establishment, carrying the version, local AS number, hold time, router ID, and optional capability parameters. This negotiation satisfies the stem's requirement by exchanging ASNs and timers before any UPDATE messages flow.
Want more BGP practice?
Practice this domainWhat is the default bridge priority value assigned to Juniper EX Series switches when RSTP is enabled?
61440
0
32768
Juniper EX Series switches use 32768 as the default bridge priority for RSTP, satisfying the stem's request for the out-of-the-box value. This 16-bit field, combined with the switch's MAC address, forms the 8-byte bridge identifier that determines root bridge election; lower values win, so 32768 is the midpoint default.
4096
An administrator needs to configure MSTP on a group of EX Series switches. Which three parameters must be identical across all switches in the same MST region?
MAC address, system ID extension, and MSTP version
Configuration name, revision number, and VLAN-to-instance mapping
MSTP regions require three matching attributes: the configuration name, the revision number, and the VLAN-to-instance mapping table. Switches sharing these identical values join the same region, so the stem's requirement for consistent region membership is satisfied. Mismatched mapping tables would place a switch in a separate region, breaking the intended topology.
Bridge priority, root identifier, and Hello timer
Max age, forward delay, and region map digest
You need to ensure that a core switch retains its position as the root bridge even if a new switch with a manually lowered bridge priority is added to the network. Which feature should you configure on the core switch's ports facing the downstream switches?
Loop protection
BPDU guard
Root protection
Root protection forces a port into a root-inconsistent blocking state if it receives superior BPDUs, preventing a downstream switch with a lowered priority from becoming root. This preserves the core switch's root bridge role, satisfying the requirement to retain its position.
Edge port configuration
While examining an RSTP topology, you notice that a designated port has suddenly stopped receiving BPDUs from its upstream neighbor, causing the port to transition into a discarding state to prevent potential loops. Which feature is actively providing this protection?
Loop protection
Loop protection detects a designated port that stops receiving BPDUs from its upstream neighbour. It then moves that port into a discarding state, preventing a unidirectional link failure from creating a bridging loop, which matches the described RSTP behaviour.
Root protection
BPDU guard
TC protection
What is the role of the Root Port in an RSTP topology?
It forwards traffic between two different MST regions.
It connects the root bridge to all downstream non-root switches.
It provides the lowest-cost path from a non-root switch to the root bridge.
RSTP elects one Root Port per non-root bridge: the port advertising the lowest cumulative root path cost toward the root bridge. This satisfies the stem's requirement, giving that switch its single best path to the root, with Designated Ports forwarding downstream.
It serves as the backup forwarding path when the designated port fails.
An enterprise network runs MSTP. Instance 0 is always reserved for which specific purpose?
The Internal Regional Boundary instance (IRBI)
The Designated Root Backup instance (DRB)
The Common and Internal Spanning Tree (CIST) instance
MSTP reserves instance 0 for the Common and Internal Spanning Tree, which carries all VLANs not explicitly mapped elsewhere and interoperates with other spanning-tree regions. This satisfies the stem's constraint that instance 0 has a fixed, reserved purpose rather than user-defined VLAN mapping.
The Vlan-to-Instance Mapping table (VIM)
Want more Spanning Tree practice?
Practice this domainWhich command allows an administrator to view the OSPF link-state database (LSDB) summary on a Junos device?
show ospf neighbor
show route protocol ospf
show ospf database
The 'show ospf database' operational command queries the router's link-state advertisements, displaying the LSDB contents and summary per area and LSA type. It directly satisfies the requirement to view the OSPF link-state database summary on a Junos device.
show ospf interface
While reviewing OSPF logs on a Junos device, you notice frequent adjacency flaps. You suspect a mismatch in the OSPF timer configurations. Which two timers must match identically on adjacent OSPF interfaces for an adjacency to form?
Hello interval and Dead interval
OSPF neighbours exchange Hello packets at the Hello interval; the Dead interval is the silence period before declaring the neighbour down. Both values must match identically on adjacent interfaces, otherwise the router tears down the adjacency, producing exactly the frequent flaps observed in the logs.
Reference bandwidth and Cost metric
SPF delay timer and Hold timer
Retransmit interval and Poll interval
An OSPF area contains routers running Junos OS where external routes must be imported into the OSPF domain from a BGP core. However, the area must not accept external AS-external LSAs (Type 5) from other areas, but must allow routers within this area to originate external routes themselves. Which area type fulfills this requirement?
Backbone Area (Area 0)
Totally Stubby Area
Standard Stub Area
Not-So-Stubby Area (NSSA)
An NSSA blocks Type 5 AS-external LSAs from other areas while permitting its own routers to originate external routes as Type 7 LSAs, later translated to Type 5 at the ABR. This exactly matches the stem's dual constraint.
You are troubleshooting an OSPF adjacency issue between two Juniper EX Series switches. One switch logs an error stating 'OSPF packet received with mismatched area ID'. Where in the Junos CLI should you check and correct this parameter?
[edit protocols ospf area <area-id> interface <interface-name>]
The area ID is configured under the OSPF area hierarchy, so mismatches are corrected at [edit protocols ospf area <area-id>]. Both switches must share an identical area ID on the connecting interface for the adjacency to form; editing this stanza resolves the logged mismatch error directly.
[edit system services ospf]
[edit protocols ospf area <area-id> stub]
[edit routing-options router-id <ip-address>]
Which OSPF packet type is responsible for discovering neighbors and maintaining adjacencies on a Junos device?
Link-State Update (Type 4)
Hello (Type 1)
Hello packets (Type 1) are exchanged periodically on OSPF-enabled interfaces to discover neighbours and maintain adjacencies. They carry parameters such as hello and dead intervals, area ID and router priority, which must match before an adjacency forms.
Link-State Request (Type 3)
Database Description (Type 2)
An administrator is configuring OSPF on a Junos device and notices that two routers on a broadcast segment are stuck in the 2-Way state. What is the most likely cause of this behavior on a broadcast network?
There is a mismatch in the OSPF hello interval configuration.
The routers are neither the DR nor the BDR on a multi-access network.
On a broadcast multi-access segment, routers that are neither DR nor BDR remain in 2-Way with each other by design, since full adjacency is only formed with the DR and BDR. This is expected, not a fault.
Authentication keys differ between the neighboring interfaces.
The area type is incorrectly configured as a totally stubby area.
Want more OSPF practice?
Practice this domainAn engineer is preparing to perform an In-Service Software Upgrade (ISSU) on a pair of dual-RE MX240 routers. Which condition must be met to ensure the ISSU succeeds without dropping traffic?
The backup Routing Engine must be physically removed from the chassis during the upgrade.
All physical interfaces must be manually disabled prior to issuing the request system software in-service command.
Graceful Route Engine Switchover (GRES) and Nonstop Active Routing (NSR) must be enabled and functioning.
ISSU on dual-RE MX240 routers requires GRES and NSR to be enabled and functioning, satisfying the stem's no-traffic-loss constraint. GRES preserves forwarding state across RE switchover, while NSR keeps routing protocol adjacencies and sessions intact, so neither control-plane nor data-plane traffic is dropped during the upgrade.
All routing protocols must be migrated from OSPF to IS-IS before starting ISSU.
You are configuring VRRP between two EX4600 switches to provide a default gateway for a VLAN. To ensure that the switch with the higher physical interface capacity assumes the master role, what parameter should you adjust?
Decrease the VRRP advertisement interval on the backup switch.
Set the virtual router identifier (VRID) to a lower integer value on the preferred switch.
Disable the VRRP preempt feature on both routers.
Increase the VRRP priority value on the preferred switch's interface.
VRRP priority determines which router becomes master; the highest priority wins. Raising the priority on the preferred switch's interface ensures it assumes the master role, satisfying the stem's requirement for the higher-capacity switch to lead.
An EX4300 Virtual Chassis experiences a split-brain condition due to a failure of all stacking cables between members 0/1 and members 2/3. How does Junos handle this scenario by default?
Each partition elects its own primary routing engine if dual primary detection is not enabled, leading to potential duplicate IP scenarios.
Without dual primary detection, each Virtual Chassis partition independently elects its own primary Routing Engine, since the split severs the control-plane path used for mastership arbitration. Both partitions then remain active, so identical IP and MAC addresses can appear on the network simultaneously, satisfying the stem's default split-brain behaviour.
All member switches across both partitions automatically shut down all data interfaces to prevent loops.
The backup routing engine instantly shuts down its control plane daemon permanently.
The entire Virtual Chassis reboots simultaneously until stacking cables are re-seated.
An administrator is configuring Graceful Restart on a pair of Juniper MX series routers running OSPF. What is the primary purpose of Graceful Restart in this scenario?
To instantly drop all adjacencies and force an immediate full SPF recalculation across the network.
To ensure uninterrupted data packet forwarding while the control plane routing protocol restarts.
Graceful Restart preserves forwarding entries in the data plane while the OSPF control plane restarts, so traffic continues flowing. This satisfies the stem's requirement of uninterrupted packet forwarding during the routing protocol restart on the MX routers.
To automatically upgrade Junos OS images without rebooting the forwarding plane.
To synchronize firewall filter counters between primary and backup Routing Engines.
You are verifying BGP Graceful Restart helper mode on a Juniper router. A peering router restarts its control plane. What output or verification command confirms that your router is acting as a Graceful Restart helper for the peer?
Run 'show chassis routing-engine' to verify that the remote neighbor has updated its local RE priority.
Run 'show bgp neighbor' and verify that the 'Graceful Restart' capability is advertised and received, and observe the restart state flags.
'show bgp neighbor' displays the Graceful Restart capability exchanged with the peer and the helper-mode restart state flags, confirming whether the local router is retaining routes for the restarting peer. This satisfies the stem's requirement to verify helper operation during a control-plane restart.
Run 'show lacp statistics ae0' to see if LACP packets are being suppressed during restart.
Run 'show vrrp summary' to check if the BGP neighbor has assumed the master VRRP role.
You are configuring a Link Aggregation Group (LAG) on an EX series switch. Which statement is correct regarding LACP active mode?
The interface will actively transmit LACP packets to initiate and negotiate the aggregation with the peer device.
Active mode makes the interface transmit LACPDUs unconditionally rather than waiting for the peer, so negotiation begins immediately. This satisfies the stem's requirement that the local interface initiate and negotiate the aggregation with the peer device.
The interface will only respond to LACP packets and never transmit them.
Active mode can only be used when connecting Juniper switches to non-Juniper servers.
LACP active mode requires static pinning of member links and disables dynamic hash selection.
Want more High Availability practice?
Practice this domainAn administrator has configured a forwarding-type routing instance to perform filter-based forwarding. Which configuration statement is mandatory under the routing-instances hierarchy to properly define this instance type?
set routing-instances dept-fwd routing-options interface ge-0/0/0.0
set routing-instances dept-fwd instance-type virtual-router
set routing-instances dept-fwd instance-type l3vpn
set routing-instances dept-fwd instance-type forwarding
Filter-based forwarding requires the routing instance to be declared with instance-type forwarding, which activates the forwarding table used by firewall filter actions to steer traffic into that instance. Without this statement, the instance cannot perform filter-based forwarding.
By default, what is the Junos routing protocol preference value assigned to static routes?
170
10
150
5
Static routes carry the default Junos preference of 5, making them more trusted than OSPF internal (10), IS-IS (18) and RIP (100), but less than direct and local routes. This default value applies unless explicitly overridden with the preference statement.
What is the primary function of a Junos routing instance of type 'forwarding'?
To terminate BGP sessions from multiple external peers
To run multiple independent OSPF instances
To provide transparent bridging across WAN circuits
To support filter-based forwarding without running routing protocols
A forwarding routing instance holds only forwarding tables, with no routing protocol process, and is used with firewall filters to direct traffic into specific next-hop or VRF paths. This satisfies filter-based forwarding without protocol adjacencies.
You need to configure a static floating route that will only become active if the primary dynamic route learned via OSPF fails. Which configuration parameter must be adjusted to achieve this behavior?
as-path prepend
local-preference
preference
Setting a higher preference value than OSPF's default (10) keeps the static route inactive in the routing table while the OSPF route exists. Junos installs only the route with the lowest preference, so the floating static activates solely when OSPF withdraws, satisfying the failover constraint.
metric
Which command allows you to inspect the active forwarding table entries and verify next-hops on a Junos router?
show route forwarding-table
The forwarding table holds the router's active next-hop and egress interface entries, distinct from the routing table's protocol paths. Running this command displays those installed forwarding entries, letting you confirm which next-hop each destination actually resolves to on the Junos device.
show interfaces extensive
show pfe traffic
show routing-engine status
You are configuring Filter-Based Forwarding (FBF) on an interface. You apply a firewall filter that matches specific source addresses and uses 'then routing-instance' as an action. What must be configured in that target routing instance to ensure return traffic is handled correctly?
A default route pointing back to the core gateway within that routing instance's routing table.
Filter-based forwarding steers matched traffic into a separate routing instance, which by default has no path back to the core. Installing a default route (0.0.0.0/0) inside that instance's table ensures return traffic reaches the core gateway rather than being dropped.
A static ARP entry for every device on the network.
An RSVP LSP bridging the source and destination instances.
A BGP peering session with the loopback address.
Want more Protocol Independent Routing practice?
Practice this domainWhen configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?
set interfaces gr-0/0/0 unit 0 tunnel source <ip> destination <ip>
GRE tunnel endpoints are configured under the tunnel interface's unit stanza using the tunnel source and destination statements. Setting them at interfaces gr-0/0/0 unit 0 matches the stem's requirement for the correct Junos configuration hierarchy.
set routing-options tunnels source <ip> destination <ip>
set protocols gre source <ip> destination <ip>
set system tunnel source <ip> destination <ip>
What is the official protocol number assigned in the outer IP header for GRE encapsulation?
50
4
47
GRE-encapsulated packets carry IP protocol number 47 in the outer IP header's Protocol field, identifying the payload as GRE. This value is assigned by IANA and distinguishes GRE from protocols such as TCP (6), UDP (17) and ESP (50).
89
You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?
The security policies are blocking the return traffic.
Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.
IP-IP tunnels add an outer header, reducing effective MTU. Packets with the DF bit set that exceed this reduced MTU cannot be fragmented and are dropped, incrementing input drops. This matches the observed symptom on the tunnel interface.
OSPF hello packets are malformed.
The tunnel destination IP address is unreachable via the routing table.
What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?
To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.
A tunnel interface presents a virtual point-to-point Layer 3 link, allowing routing protocol adjacencies to form across transport networks that lack direct connectivity or are untrusted. It satisfies the need to run protocols such as OSPF or BGP over disjointed or insecure paths.
To act as a physical layer 2 bridge for VLAN extension without IP addresses.
To encrypt all transit traffic by default using hardware-based AES-256.
To replace physical interfaces for standard local area network connections.
On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?
They must be part of the same subnet as the tunnel payload addresses.
They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).
GRE encapsulates the payload, then forwards the resulting packet using the outer header, so tunnel endpoints must resolve in the transport table. This satisfies the stem's constraint: the source and destination addresses must be routable in the routing table associated with the underlying transport interface.
They must be resolved via BGP inet-vpn routes only.
They must be configured as loopback addresses in the destination VRF exclusively.
You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?
family inet
family inet6
GRE over IPv4 encapsulates the IPv6 payload, so the tunnel's logical unit must carry the inner protocol. Configuring family inet6 on gr-0/0/0/0 assigns the IPv6 address and enables IPv6 processing across the tunnel, satisfying the requirement to pass IPv6 traffic over the IPv4 transport.
family iso
family mpls
Want more Tunnels practice?
Practice this domainAn administrator needs to view the MAC address learning table on an EX Series switch to verify which switchport a specific server is connected to. Which operational command should be used?
show mac-address-table
show ethernet-switching table
The show ethernet-switching table command displays learned MAC addresses with their associated VLAN and switchport, letting the administrator confirm which port the server attaches to. This satisfies the requirement to view the MAC learning table.
show vlans mac-table
show bridge-domain mac-table
An administrator needs to create a VLAN named 'voice' with a VLAN ID of 50 on a Junos EX Series switch. Which configuration path achieves this?
set vlans voice vlan-id 50
Junos stores VLAN membership under the [vlans] hierarchy, where the VLAN name is the identifier and vlan-id assigns the 802.1Q tag. Setting 'voice' with vlan-id 50 creates the required VLAN and binds it to tag 50, satisfying the named-VLAN-with-ID-50 constraint.
set ethernet-switching-options vlans voice id 50
set bridge-domains voice vlan-id 50
set interfaces vlan unit 50 name voice
An administrator is configuring a new EX Series switch running Junos OS and needs to assign an access port to VLAN finance. Which configuration hierarchy is used to assign an interface to a specific VLAN?
[edit vlans finance]
[edit interfaces <interface-name> unit 0 family ethernet-switching]
Access VLAN membership is assigned under the interface's unit 0 family ethernet-switching hierarchy, where the vlan member statement names the target VLAN. This is the Junos hierarchy that binds a switched port to VLAN finance, satisfying the access port requirement.
[edit bridge-domains finance]
[edit protocols l2-learning]
You are troubleshooting a connectivity issue between an EX4300 switch access port and an end-host. The port is configured as an access port for VLAN 100, but the host cannot communicate. You run 'show ethernet-switching interface ge-0/0/1' and notice the port status is down/down. Which underlying reason most likely explains this state?
The native VLAN ID does not match the upstream trunk switch.
BPDU protection has disabled the port due to a loop.
The VLAN 100 has not been created under the [edit vlans] hierarchy.
The physical cable is disconnected or the transceiver is faulty.
down/down means the physical link is not established: the switch sees no signal from the host. The usual causes are a disconnected or damaged cable, a faulty or incompatible SFP transceiver, or a host network interface that is disabled or broken. Check the port and host LEDs, try a known-good cable or optic, and use 'show interfaces ge-0/0/1 extensive' or the optics diagnostics command to inspect link details.
An enterprise network uses private VLANs. A server connected to an isolated port needs to send traffic out of the primary VLAN. Which statement accurately describes how traffic forwarding operates for an isolated port in Junos?
Traffic from an isolated port can reach other isolated ports within the same secondary VLAN.
Isolated ports can communicate freely with community ports, but not other isolated ports.
Traffic from an isolated port can only be forwarded to the designated promiscuous port.
Isolated ports have no Layer 2 connectivity to each other or to community ports; their only permitted destination is the promiscuous port, which forwards traffic out of the primary VLAN. This satisfies the isolation constraint while still allowing server traffic to reach the gateway.
Traffic from an isolated port is dropped unless a Layer 3 firewall filter explicitly permits it.
An administrator configures a new VLAN ID 300 on an EX Series switch but forgets to assign any interfaces to it. What is the operational status of this VLAN?
The switch assigns all unused ports to VLAN 300 by default.
The VLAN remains inactive in the switching table until an interface or IRB is associated with it.
A VLAN with no member interfaces or IRB retains its configuration but stays inactive, so it never enters the active switching table. Junos activates a VLAN only once at least one access, trunk, or IRB interface is bound to it, satisfying the stem's forgotten-assignment constraint.
The switch generates a critical alarm preventing further configuration.
The switch automatically deletes the VLAN after 5 minutes if no ports are assigned.
Want more Layer 2 Switching And VLANs practice?
Practice this domainYou are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?
The interface automatically recovers after a default hold-down timer of 300 seconds.
The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.
A violation triggers the configured shutdown, placing the interface in a disabled state that persists until an administrator intervenes. Restoration requires clearing the port security error via the clear ethernet-switching port-error command, or administratively disabling then re-enabling the interface. This satisfies the stem's requirement for the default operational state and recovery method.
The interface drops violating packets but remains operationally up until manually disabled.
The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.
You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?
Configure the interface as a trusted interface for DHCP snooping.
DHCP snooping drops server replies arriving on untrusted ports, so the port facing the legitimate corporate server must be marked trusted to permit its offers through. This satisfies the stem's requirement to allow only that server's replies.
Configure the interface as a trunk port.
Apply an ingress firewall filter blocking UDP port 67.
Enable IP Source Guard on the uplink interface.
Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?
Dynamic ARP Inspection
IP Source Guard
DHCP Snooping
DHCP snooping builds the binding table by intercepting DHCP messages on untrusted access ports, recording client IP-to-MAC-to-port-to-VLAN mappings. Enabling it on the access switch is the prerequisite for populating legitimate bindings, satisfying the stem's requirement.
Port Security MAC-Limit
You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?
Internet Key Exchange version 2 (IKEv2)
Secure Session Protocol (SSP)
802.1AE Dynamic Key Distribution (AKD)
MACsec Key Agreement (MKA) protocol
Junos MACsec uses the MACsec Key Agreement protocol, defined in IEEE 802.1X-2010, to elect a key server and negotiate secure associations and encryption keys between peers. MKA is the default dynamic key-management mechanism, satisfying the EX4300 link-securing requirement.
An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?
IP Source Guard requires static ARP inspection to be enabled simultaneously.
The client's MAC address is in the port security violation log.
DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.
IP Source Guard relies on the DHCP snooping binding table to validate source IP and MAC pairs. Without DHCP snooping enabled on the client's VLAN, no binding is created, so all traffic is dropped despite successful DHCP lease acquisition.
IP Source Guard only supports static IP bindings, not DHCP-derived bindings.
You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?
Applied to the routing-instance forwarding table.
Applied globally under system services l2-firewall.
Applied to the input of an interface or VLAN under family ethernet-switching.
Layer 2 firewall filters on EX Series switches match frame fields such as source MAC and must be applied under family ethernet-switching, either at the interface input or VLAN input, so the filter processes inbound frames before forwarding decisions.
Applied to the output of the VLAN interface under family inet.
Want more Layer 2 Security practice?
Practice this domainThe JNCIS-ENT exam has 65 questions and must be completed in 90 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 9 domains: IS IS, BGP, Spanning Tree, OSPF, High Availability, Protocol Independent Routing, Tunnels, Layer 2 Switching And VLANs, Layer 2 Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Juniper Networks JNCIS-ENT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.