JNCIS-ENT Practice Test 14 — 15 Questions

Question 1

What is the purpose of the BGP Keepalive message and what is its default interval in Junos?

Accepted Answer

To maintain the session; sent every 30 seconds by default.. BGP KEEPALIVE messages are sent periodically to confirm that the peer session is still alive and to reset the Hold Timer, preventing the session from being torn down. In Junos (and per RFC 4271), the default Keepalive interval is 30 seconds, with a default Hold Time of 90 seconds — exactly three times the Keepalive interval. If three consecutive Keepalives are missed, the Hold Timer expires and the session resets.

Answer

To report session errors; sent immediately upon failure.

Answer

To negotiate capabilities; sent every 60 seconds.

Answer

To update routing tables; sent every 5 seconds.

Question 2

Which TWO states are valid OSPF operational adjacency states seen in Junos operational outputs? (Choose two)

Accepted Answer

2-Way. Option A (2-Way) is correct because in OSPF, 2-Way is a valid adjacency state where bidirectional communication between two routers is confirmed; on broadcast and NBMA networks, routers remain in 2-Way with non-DR/BDR neighbors, and it appears in Junos outputs such as 'show ospf neighbor'. Option D (Full) is correct because Full is the final OSPF adjacency state, indicating that the link-state databases of the two routers are fully synchronized, and it is likewise displayed in Junos operational output. The unmarked options do not belong: Listen is an OSPF interface state (not an adjacency/neighbor state), Connected is not an OSPF state at all, and Active is not a valid OSPF neighbor state (it is associated with other protocols such as EIGRP or PIM).

Answer

Listen

Answer

Connected

Answer

Active

Question 3

Which operational command allows you to view the real-time status of LACP packet exchanges and partner system IDs for an aggregated interface on a Junos switch?

Accepted Answer

show lacp interface. The 'show lacp interface' command displays detailed LACP partner information, partner port numbers, and state flags.

Answer

show interfaces ae0 statistics

Answer

show chassis lacp-status

Answer

show vrrp lacp-summary

Question 4

An administrator is setting up VRRP tracking on an EX4300 switch interface. If the uplink interface monitoring the core network fails, what should happen to the VRRP priority on the gateway interface?

Accepted Answer

The VRRP priority is decremented by a configured value so that the backup router can assume the master role.. VRRP interface tracking automatically decrements the local router's priority when a monitored tracking interface goes down, allowing a backup router with higher priority to take over as master.

Answer

The VRRP priority is increased to maximum to force immediate forwarding.

Answer

The interface shuts down all LACP bundles connected to the switch.

Answer

The switch initiates an immediate In-Service Software Upgrade.

Question 5

Which LSA type is originated by a Designated Router (DR) on a broadcast or NBMA network to describe all the routers attached to that multi-access segment?

Accepted Answer

Type 2 (Network LSA). The Type 2 Network LSA is originated by the Designated Router (DR) on a broadcast or NBMA multi-access segment and lists all routers that are fully adjacent to the DR on that segment, including the DR itself. It describes the multi-access network as a pseudo-node, allowing other routers to compute the topology without needing full-mesh adjacencies. The Network LSA's Link State ID is the DR's interface IP address on that segment.

Answer

Type 3 (Summary LSA)

Answer

Type 4 (ASBR Summary LSA)

Answer

Type 1 (Router LSA)

Question 6

An administrator configures link aggregation (ae0) using LACP between two EX Series switches running RSTP. How does RSTP treat the aggregated interface ae0?

Accepted Answer

RSTP treats the aggregate interface as a single logical port.. RSTP operates on the aggregate interface (ae0) as a single logical port, not on the individual physical member links. This means the entire bundle is either in a forwarding or discarding state based on the spanning tree topology, and LACP handles the distribution of traffic across the active member links. The aggregated interface presents a single MAC address and a single port cost to RSTP, so the spanning tree calculation sees it as one link.

Answer

RSTP places all member links except the primary active link into a permanent discarding state.

Answer

RSTP disables itself on aggregated links to prevent conflicts with LACP.

Answer

RSTP runs an independent spanning tree instance on each physical member link of the aggregate.

Question 7

An administrator configures a new VLAN ID 300 on an EX Series switch but forgets to assign any interfaces to it. What is the operational status of this VLAN?

Accepted Answer

The VLAN remains inactive in the switching table until an interface or IRB is associated with it.. In Junos on EX Series switches, a VLAN that is configured but has no interfaces or IRB associated with it remains inactive in the switching table. The VLAN exists in the configuration but does not become operational until at least one interface or IRB is assigned to it.

Answer

The switch assigns all unused ports to VLAN 300 by default.

Answer

The switch generates a critical alarm preventing further configuration.

Answer

The switch automatically deletes the VLAN after 5 minutes if no ports are assigned.

Question 8

What is the primary purpose of the Hello timer in RSTP?

Accepted Answer

It dictates how often configuration BPDUs are generated and sent by the root bridge.. In RSTP (IEEE 802.1w), the Hello timer defines the interval at which the root bridge generates and transmits configuration BPDUs. Non-root bridges do not originate BPDUs; they relay the root's BPDUs downstream after updating them. The default Hello time is 2 seconds, and this timer is configured only on the root bridge (or the intended root) and propagated throughout the spanning tree via the BPDU fields. Thus, the Hello timer directly controls the frequency of configuration BPDU generation and transmission by the root bridge.

Answer

It sets the interval between topology change notifications.

Answer

It determines the maximum time a switch waits before declaring a neighbor dead.

Answer

It defines the duration of the listening and learning states during convergence.

Question 9

An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?

Accepted Answer

Configure IEEE 802.1X with multiple supplicants or MAC Authentication Bypass (MAB).. IEEE 802.1X with multiple supplicants (or MAC Authentication Bypass for non-802.1X devices) allows multiple authenticated MAC addresses to share a single switch port, which is exactly the scenario of an IP phone with a PC daisy-chained behind it. The phone authenticates via 802.1X (or MAB), and the PC authenticates separately, each getting its own authorization. This is the secure, standards-based way to support multiple devices on one port without simply raising the MAC limit.

Answer

Enable DHCP snooping with static ARP inspection override.

Answer

Increase the mac-limit to 2 and enable dynamic MAC learning persistence.

Answer

Configure storm control with a multi-device profile.

Question 10

Which TWO statements are true regarding IP Source Guard? (Choose two)

Accepted Answer

It prevents IP spoofing attacks by filtering traffic based on binding databases.. Option D is correct because IP Source Guard (IPSG) is an anti-spoofing feature that filters ingress traffic by comparing each packet's source IP (and often MAC) against a trusted binding table, dropping any packet whose source address does not match an entry, thereby preventing IP spoofing attacks. Option E is correct because on Juniper devices IPSG builds its binding table from the DHCP snooping database (populated by snooped DHCP ACK/lease bindings), so client source IP addresses are validated against dynamically learned DHCP bindings; static bindings can also be added, but the primary mechanism relies on DHCP snooping. Option A is incorrect because IPSG is configured at the interface/access-port level (e.g., 'ip-source-guard' under the interface or VLAN/forwarding-options hierarchy), not under the routing-instances protocol hierarchy. Option B is incorrect because IPSG performs filtering and validation, not encryption; AES-256 encryption is unrelated to this feature. Option C is incorrect because IPSG does not monitor or rate-limit broadcast ARP storms; ARP storm control and related protections are separate features (e.g., ARP policing/storm control), not IP Source Guard.

Answer

It is configured under the routing-instances protocol hierarchy.

Answer

It automatically encrypts all user data packets using AES-256.

Answer

It functions by monitoring and rate-limiting broadcast ARP traffic storms.

Question 11

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

Accepted Answer

clear ethernet-switching security-violation. Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Answer

reset interface security-violations

Answer

clear bridge security-counters

Answer

clear arp-inspection statistics

Question 12

You are a network administrator for a company using Juniper EX Series switches. You have an iBGP session between two routers in the same AS. You notice that routes learned from one iBGP peer are not being advertised to another iBGP peer. What is the default behavior of iBGP that explains this?

Accepted Answer

iBGP split horizon: routes learned from an iBGP peer are not advertised to other iBGP peers.. iBGP split horizon is the default behavior that prevents a route learned from one iBGP peer from being advertised to another iBGP peer. This is designed to prevent routing loops within an AS. To allow route propagation, you must use a full mesh, route reflectors, or confederations.

Answer

The AS path loop prevention detects the local AS and discards the route.

Answer

The next-hop attribute is not changed, so the route is considered invalid.

Answer

iBGP requires a full mesh, so routes are only advertised to eBGP peers.

Question 13

An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?

Accepted Answer

The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.. MACsec encapsulation adds overhead (ICV and security headers) to the Ethernet frame, increasing its size. If the transport provider network or physical interface MTU is not increased to accommodate this overhead, frames are dropped.

Answer

The MKA key exchange failed due to MTU handshake validation timeouts.

Answer

Dynamic ARP Inspection is dropping fragmented Ethernet frames.

Answer

The cipher suite GCM-AES-256 compresses frames beyond the minimum frame size limit.

Question 14

Which THREE states are defined in Rapid Spanning Tree Protocol (RSTP)? (Choose three.)

Accepted Answer

Discarding. RSTP (IEEE 802.1w) defines only three port states: Discarding, Learning, and Forwarding. Option B (Discarding) is correct because RSTP merged the 802.1D Disabled, Blocking, and Listening states into a single Discarding state, in which the port neither learns MAC addresses nor forwards frames but still participates in the topology (e.g., receiving BPDUs). Option C (Learning) is correct because it is retained in RSTP: the port processes BPDUs and populates its MAC address table, but does not yet forward user data frames. Option D (Forwarding) is correct because it is the fully operational state in which the port learns MAC addresses and forwards data frames. Option A (Blocking) is not correct because Blocking is a legacy 802.1D STP state that RSTP replaced with Discarding, and Option E (Listening) is not correct because Listening was also an 802.1D-only state eliminated in RSTP and folded into Discarding.

Answer

Blocking

Answer

Listening

Question 15

An engineer is troubleshooting a BGP session between two routers and notices that the connection is stuck in the Active state. What does the Active state indicate about the BGP finite state machine?

Accepted Answer

The TCP connection attempt is ongoing or has failed, and the router is actively trying to establish a TCP session with the peer.. In the Active state, the local router has initiated a TCP connection to the peer, but the TCP handshake has not yet completed successfully or has failed. This usually points to routing, firewall, or port 179 issues.

Answer

The local router has successfully completed the TCP handshake and is waiting for an Open message.

Answer

BGP has exchanged Open messages and is currently negotiating capability parameters.

Answer

The BGP session is fully operational and exchanging Keepalive messages.