JNCIS-ENT Practice Test 16 — 15 Questions

Question 1

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

Accepted Answer

Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.. In a GRE over IPsec configuration, traffic is first encapsulated in GRE, and then the resulting GRE packets are protected by IPsec VPN policies. This means the GRE header is added first, and then IPsec encrypts the entire GRE packet. This structure allows dynamic routing protocols to run over GRE while being secured by IPsec.

Answer

GRE and IPsec operate simultaneously as a single unified protocol without nested headers.

Answer

IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.

Answer

IPsec replaces the GRE header entirely while maintaining GRE interface numbers.

Question 2

An administrator configures filter-based forwarding. The firewall filter uses the action 'then routing-instance custom-vr'. Where must the custom-vr routing instance be defined for the filter to accept this configuration without committing errors?

Accepted Answer

Under the [edit routing-instances] hierarchy.. Filter-based forwarding (FBF) requires the target routing instance to exist under the [edit routing-instances] hierarchy before a firewall filter can reference it with the 'then routing-instance' action. Junos validates this reference at commit time, so if custom-vr is not defined as a routing instance, the commit fails with an error. The routing instance is typically of type 'forwarding' or 'virtual-router', and the filter action simply directs matching packets into that instance's forwarding table.

Answer

Under the [edit system FBF] hierarchy.

Answer

Under the [edit interfaces interface-name unit 0 family inet] hierarchy.

Answer

Under the [edit firewall family inet filter] hierarchy.

Question 3

When configuring MSTP, how is the regional maximum hop count enforced across switches within the same MST region?

Accepted Answer

BPDUs carry a hop count that is decremented by each bridge; when it reaches zero, the BPDU is dropped.. In MSTP, the regional maximum hop count is enforced by the hop count field in BPDUs. The regional root sends BPDUs with a hop count equal to the maximum hop count (default 20). Each bridge that receives the BPDU decrements the hop count by one before forwarding it. When the hop count reaches zero, the BPDU is dropped, preventing loops and limiting the network diameter within the MST region.

Answer

The regional root periodically floods drop-commands if the network diameter exceeds the limit.

Answer

Switches drop any incoming BPDUs that exceed the statically configured Max Age timer.

Answer

Ports exceeding the hop count are automatically placed into the error-disabled state.

Question 4

What is the primary function of the BGP OPEN message?

Accepted Answer

To establish a peering session and negotiate capabilities such as ASNs and timers.. The OPEN message is the first message sent after a TCP connection is established, used to negotiate BGP parameters such as ASN, hold time, and router ID.

Answer

To advertise reachability and path attributes for network prefixes.

Answer

To maintain the connection state and verify liveliness at regular intervals.

Answer

To signal fatal errors and immediately terminate the BGP session.

Question 5

Which THREE statements regarding IP-IP tunnels on Junos devices are accurate? (Choose three)

Accepted Answer

IP-IP encapsulation uses IP protocol number 4.. Option A is correct because IP-in-IP encapsulation is identified by IP protocol number 4 in the outer IP header, which is the standard assigned value for IP-IP tunneling. Option D is correct because IP-IP tunnels are point-to-point unicast tunnels and do not natively carry multicast or broadcast traffic without additional mechanisms such as GRE or multicast tunneling configurations. Option E is correct because IP-IP tunneling works by prepending a new outer IP header to the original IP packet, encapsulating the entire original packet as the payload. Option B is incorrect because the 4-byte key field is a feature of GRE headers, not IP-IP headers, which have no key field. Option C is incorrect because IP-IP tunnels provide no encryption or hardware encryption by default; they are plain encapsulation and would require IPsec to secure the traffic.

Answer

IP-IP tunnels require a mandatory 4-byte key field in the header.

Answer

IP-IP tunnels provide built-in hardware encryption by default.

Question 6

An administrator is configuring OSPF on a Junos device and notices that two routers on a broadcast segment are stuck in the 2-Way state. What is the most likely cause of this behavior on a broadcast network?

Accepted Answer

The routers are neither the DR nor the BDR on a multi-access network.. On a broadcast multi-access network, OSPF routers that are neither the DR nor the BDR form Full adjacencies only with the DR and BDR, and remain in 2-Way with each other. This is normal OSPF behavior designed to reduce LSA flooding, so two routers stuck in 2-Way are most likely both DROthers.

Answer

There is a mismatch in the OSPF hello interval configuration.

Answer

Authentication keys differ between the neighboring interfaces.

Answer

The area type is incorrectly configured as a totally stubby area.

Question 7

An engineer must inspect the BGP state and verify the received prefix counts from a specific neighbor on an MX Series router. Which operational command should be used?

Accepted Answer

show bgp neighbor 10.1.1.1. The command 'show bgp neighbor 10.1.1.1' displays detailed BGP session information for the specified neighbor, including state, received prefix counts, and other statistics. It is the correct command to inspect a specific neighbor.

Answer

show ospf neighbor

Answer

show route protocol bgp

Answer

show bgp summary

Question 8

An administrator is configuring a new EX Series switch running Junos OS and needs to assign an access port to VLAN finance. Which configuration hierarchy is used to assign an interface to a specific VLAN?

Accepted Answer

[edit interfaces unit 0 family ethernet-switching]. In Junos OS, access and trunk interface properties for Layer 2 switching are configured under the [edit interfaces unit 0 family ethernet-switching] hierarchy.

Answer

[edit vlans finance]

Answer

[edit bridge-domains finance]

Answer

[edit protocols l2-learning]

Question 9

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

Accepted Answer

47. The official protocol number assigned to GRE (Generic Routing Encapsulation) in the outer IP header is 47, as defined by IANA. This number is used in the IP protocol field to indicate that the payload is a GRE packet. Therefore, option C is correct.

Answer

50

Answer

4

Answer

89

Question 10

Which THREE parameters are typically verified when troubleshooting a missing MAC address entry in the bridge table of a Juniper switch? (Choose three.)

Accepted Answer

Configured maximum MAC address limits or port-security restrictions. Option B is correct because a MAC address will not be learned or retained in the bridge table if the port has hit its configured MAC limit (e.g., 'mac-limit') or if port security (e.g., 'mac-move-limit' or allowed-MAC restrictions) is blocking or dropping the source MAC. Option C is correct because the ingress port must be a member of the same VLAN as the traffic; if the port is not in the correct VLAN (or is in a different VLAN), the frame is not learned into that VLAN's bridge table entry. Option E is correct because a bridge table entry requires the physical interface to be up and operational; if the link is down or the interface is disabled, no MAC addresses can be learned on that port. Option A is incorrect because BGP AS path settings are Layer 3 routing attributes and have no bearing on Layer 2 MAC learning in the bridge table. Option D is incorrect because routing protocol adjacencies in the default VRF relate to Layer 3 reachability, not to populating the Layer 2 bridge table.

Answer

BGP AS path settings on core interfaces

Answer

Routing protocol adjacencies in the default VRF

Question 11

Which THREE factors should be considered when planning MTU size for traffic traversing a GRE tunnel? (Choose three)

Accepted Answer

Adjusting TCP MSS or tunnel interface MTU helps prevent packet fragmentation and drop issues.. Option A is correct because lowering the tunnel interface MTU or clamping TCP MSS (e.g., ip tcp adjust-mss) prevents encapsulated packets from exceeding the physical path MTU, avoiding fragmentation and drops. Option B is correct because GRE adds a 4-byte GRE header plus a new 20-byte outer IP header (24 bytes total, more with options), which reduces the effective payload MTU inside the tunnel. Option E is correct because when the DF bit is set and a packet exceeds the path MTU, routers cannot fragment it and will drop it, typically returning an ICMP 'fragmentation needed' message. Option C is wrong because GRE does not automatically enlarge the physical interface MTU; MTU must be manually adjusted on the tunnel interface. Option D is wrong because IP-IP (IP-in-IP) headers are 20 bytes, which is smaller than GRE's 24-byte overhead, not larger.

Answer

GRE tunnels automatically expand physical interface MTU sizes to accommodate overhead.

Answer

IP-IP headers are larger than GRE headers, requiring larger MTU adjustments.

Question 12

Which TWO commands can be used to view spanning tree information on a Juniper EX Series switch? (Choose two.)

Accepted Answer

show spanning-tree interface. Option B, 'show spanning-tree interface', is correct because on Juniper EX Series switches running Junos, this operational command displays per-interface spanning-tree information such as role, state, port cost, and edge/point-to-point settings for the specified interface. Option C, 'show spanning-tree bridge', is correct because it displays bridge-level spanning-tree parameters, including the bridge ID, root bridge information, timers, and topology change counters. These two commands are the standard Junos CLI forms for inspecting STP/RSTP/MSTP on EX switches. Option A is not a valid Junos command; the 'show bridge' hierarchy is not used for spanning tree on EX. Option D is invalid because 'show rstp summary' is not a Junos operational command. Option E is invalid because 'show protocols spanning-tree summary' is not a Junos command; 'show protocols' is used for routing protocol status, not spanning tree.

Answer

show bridge spanning-tree status

Answer

show rstp summary

Answer

show protocols spanning-tree summary

Question 13

Which THREE statements are true regarding IP-IP encapsulation in Junos OS? (Choose three.)

Accepted Answer

IP-IP tunnels encapsulate an IP packet directly inside another IP packet without adding a GRE header.. Option A is correct because IP-IP (IP-in-IP) tunneling, as defined in RFC 2003, simply wraps an original IP packet inside a new outer IP header with protocol number 4, without inserting a GRE header. Option B is correct because GRE adds at least 4 bytes of GRE header (plus optional fields) on top of the outer IP header, whereas IP-IP adds only the outer IP header, resulting in lower overhead. Option E is correct because in Junos OS, IP-IP tunnel interfaces are configured with names beginning with the ip- prefix (for example, ip-0/0/0), distinguishing them from gr- (GRE) and other tunnel interface types. Option C is not correct because IP-IP encapsulation only carries IP payloads; multi-protocol payloads like AppleTalk or IPX require GRE, which supports a protocol type field. Option D is not correct because IP-IP tunnels are software-based logical interfaces and do not require any specialized physical line card with hardware cryptographic engines.

Answer

IP-IP tunnels natively support multi-protocol payloads such as AppleTalk and IPX.

Answer

IP-IP tunnels require a specialized physical line card with built-in hardware cryptographic engines.

Question 14

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

Accepted Answer

The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.. Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Answer

The static client is using an IP address outside the DHCP pool range.

Answer

The client's MAC address violates the port security maximum limit.

Answer

DAI requires all interfaces to be trusted on the VLAN.

Question 15

Which TWO characteristics describe the behavior and properties of Level 1 and Level 2 routing in IS-IS? (Choose two)

Accepted Answer

Level 2 routers form the backbone and can route traffic between different IS-IS areas.. Option C is correct because Level 2 routers form the IS-IS backbone and are responsible for inter-area routing, forwarding traffic between different Level 1 areas via the backbone. Option E is correct because Level 1 routing is intra-area routing, and all routers in the same Level 1 area must share a common area address to form adjacencies and exchange Level 1 LSPs. Option A is wrong because Level 1 and Level 2 routers can coexist on the same device or link, and Level 1-2 routers connect Level 1 areas to the Level 2 backbone. Option B is wrong because IS-IS does not use an Area 0 backbone concept like OSPF; the Level 2 backbone is formed by Level 2 and Level 1-2 routers, not a designated Area 0. Option D is wrong because IS-IS supports wide metrics (with TLVs 22, 135, etc.) and is not limited to narrow metrics.

Answer

Level 1 routers are strictly prohibited from connecting to Level 2 routers under any circumstances.

Answer

Level 1 routing requires the explicit configuration of a designated Area 0 backbone.

Answer

Level 2 routers do not support wide metrics and only operate with narrow metrics.