JNCIS-ENT Practice Test 17 — 15 Questions

Question 1

Which TWO tools or commands can be used on Junos to verify the operational packet flow through a tunnel interface? (Choose two)

Accepted Answer

show interfaces gr-0/0/0 extensive. Option B, `show interfaces gr-0/0/0 extensive`, is correct because the extensive output for a tunnel interface includes operational and traffic statistics such as input/output packets, bytes, errors, and tunnel-specific counters, which directly confirm whether packets are flowing through the gr-0/0/0 tunnel. Option C, `monitor traffic interface gr-0/0/0`, is correct because it captures live packets traversing the tunnel interface, providing real-time verification of the operational packet flow. Option A, `show chassis alarms`, only reports hardware and system alarm conditions and does not show tunnel packet flow. Option D, `request system snapshot`, creates a backup copy of the file system and has nothing to do with verifying traffic. Option E, `show route summary`, displays routing table prefix counts and protocol summaries, not per-interface packet flow through a tunnel.

Answer

show chassis alarms

Answer

request system snapshot

Answer

show route summary

Question 2

Which TWO actions must be performed when configuring a functional GRE tunnel between two Junos devices over an intermediate IP network? (Choose two.)

Accepted Answer

Configure the tunnel source IP address under the gr- interface hierarchy.. Options B and C are correct because a GRE tunnel interface on Junos requires both a source and a destination address to define the tunnel endpoints: the source is configured with 'set interfaces gr-0/0/0 tunnel source ' and the destination with 'set interfaces gr-0/0/0 tunnel destination ', which are mandatory for the tunnel to encapsulate and forward traffic. Option A is incorrect because family mpls is only needed if MPLS is being run over the tunnel, not for a basic functional GRE tunnel. Option D is incorrect because family iso is used for IS-IS, which is unrelated to establishing a GRE tunnel. Option E is incorrect because a static route to the gr- interface as next-hop for all internet traffic is a routing design choice, not a requirement for the tunnel itself to function.

Answer

Enable family mpls on the gr- interface.

Answer

Enable family iso on the physical transit interface.

Answer

Configure a static route pointing directly to the gr- interface as the next-hop for all internet traffic.

Question 3

An administrator has configured a GRE tunnel between two SRX Series devices. Traffic originating from behind the local security zone destined for the tunnel interface is being dropped by default security policies. Which action must be taken to ensure transit traffic can enter the GRE tunnel?

Accepted Answer

Configure a security policy from the internal zone to the zone containing the gr- interface allowing all traffic.. On SRX Series devices in flow mode, all transit traffic — including traffic destined to a tunnel interface — is subject to security policy evaluation. The gr- interface belongs to a security zone, and traffic from the internal zone to that tunnel zone must be explicitly permitted by a security policy. Without this policy, the default deny-all policy drops the traffic before it can be encapsulated and sent through the GRE tunnel.

Answer

Disable flow-based mode globally on the SRX Series device.

Answer

Enable proxy-arp on the physical interface.

Answer

Add the gr- interface to the junos-default security zone.

Question 4

Which statement best describes the behavior of a local route in Junos OS?

Accepted Answer

They represent IP addresses assigned directly to the router's local interfaces.. A local route in Junos OS represents the IP addresses assigned directly to the router's local interfaces. These routes are automatically installed in the routing table with a next-hop of the local interface and are used for traffic destined to the router itself. They are not learned from neighbors or manually configured as static routes.

Answer

They are static routes learned from neighbor routers via CDP.

Answer

They are manual loopback routes configured by network administrators.

Answer

They are generated automatically whenever a BGP session drops.

Question 5

Which TWO statements accurately describe the behavior of the BGP AS_PATH attribute? (Choose two)

Accepted Answer

It is a well-known mandatory attribute.. Option B is correct because AS_PATH is classified as a well-known mandatory BGP attribute, meaning every BGP UPDATE that carries reachable NLRI must include it, and all BGP-speaking routers must recognize and process it. Option C is correct because when a router advertises a route to an external BGP (eBGP) peer, it prepends its own local AS number to the AS_PATH, which is the core loop-prevention and path-length mechanism of BGP. Option A is wrong because AS_PATH is not stripped at confederation boundaries; confederation sub-AS numbers are carried in a separate AS_CONFED_SEQUENCE/AS_CONFED_SET segment, and the attribute itself is preserved. Option D is wrong because updates sent to internal BGP (iBGP) peers do not modify AS_PATH — the local AS is only prepended on eBGP advertisements. Option E is wrong because AS_PATH is not an optional non-transitive attribute; that description fits attributes like MED, and AS_PATH is well-known mandatory rather than used for internal metrics.

Answer

It is automatically stripped when crossing a confederation boundary.

Answer

It is modified when an update is sent to an iBGP peer.

Answer

It is an optional non-transitive attribute used for internal metrics.

Question 6

You are configuring OSPF on a Junos device and notice that Type 3 LSAs are not being generated or propagated into a specific area. When examining the configuration under protocols ospf, you see that the area is defined with the no-summaries parameter. Which area type has been configured?

Accepted Answer

Totally Stubby Area. In Junos OS, the 'no-summaries' parameter under 'set protocols ospf area' defines a Stub area as a totally stubby area, which suppresses Type 3 summary LSAs from being injected into the area by the ABR.

Answer

Not-So-Stubby Area (NSSA)

Answer

Transit Area

Answer

Standard OSPF Area

Question 7

Which routing-instance type is specifically designed to support Layer 3 VPNs (L3VPNs) utilizing BGP as the-peering protocol and MP-BGP for VPN route distribution?

Accepted Answer

vrf. The vrf routing-instance type is specifically designed for Layer 3 VPNs (L3VPNs) that use BGP for peering and MP-BGP for VPN route distribution. It maintains a separate routing table (RIB) and forwarding table (FIB) per instance, enabling overlapping IP addresses across customers. VRF instances support BGP, OSPF, and other routing protocols, and they are the Junos equivalent of a VRF-lite or MPLS L3VPN VRF. The other types serve different purposes: virtual-router is for logical routers with separate routing tables but no VPN route-target support, forwarding is for filter-based forwarding, and VPLS is for Layer 2 VPNs.

Answer

virtual-router

Answer

forwarding

Answer

VPLS

Question 8

An administrator needs to configure a basic GRE tunnel between two Junos devices across a routed IP network. Which interface family must be enabled on the physical transit interface to allow the GRE encapsulated packets to traverse the network?

Accepted Answer

family inet. GRE encapsulated packets are IP packets with protocol number 47, so the physical transit interface must have 'family inet' enabled to forward them across the routed IP network. Without family inet, the interface cannot process IPv4 packets, and the GRE tunnel will not come up. This is the fundamental requirement for GRE over an IP-routed underlay.

Answer

family mpls

Answer

family iso

Answer

family ccc

Question 9

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

Accepted Answer

Configure the interface as a trusted interface for DHCP snooping.. DHCP snooping classifies switch ports as trusted or untrusted. Only trusted ports are permitted to forward DHCP server messages (OFFER, ACK); untrusted ports drop them. Therefore the uplink toward the legitimate DHCP server must be marked trusted so its replies are allowed, while user-facing ports remain untrusted and block rogue servers.

Answer

Configure the interface as a trunk port.

Answer

Apply an ingress firewall filter blocking UDP port 67.

Answer

Enable IP Source Guard on the uplink interface.

Question 10

Which Junos operational mode command is used to verify the operational status and packet statistics of configured GRE tunnel interfaces?

Accepted Answer

show interfaces gr-0/0/0. The 'show interfaces' command in Junos operational mode displays detailed status, counters, and statistics for any interface, including GRE tunnel interfaces named gr-0/0/0. It shows operational state (up/down), traffic counters, errors, and protocol family information. This is the standard way to verify GRE tunnel health and packet flow on Junos devices.

Answer

show protocols tunnel status

Answer

show chassis tunnels

Answer

show gre tunnel summary

Question 11

What does the 'show isis statistics' command reveal?

Accepted Answer

The number of received and transmitted PDUs.. This command displays the number of PDUs sent and received by the IS-IS process.

Answer

The current SPF calculation time.

Answer

The database size in bytes.

Answer

The adjacency hold-time.

Question 12

What is the primary function of the OSPF Designated Router (DR) on a broadcast network segment?

Accepted Answer

To minimize the number of adjacencies and LSA flooding traffic on a multi-access segment. The DR reduces network traffic and LSA flooding overhead by acting as a central focal point for exchanging routing information and generating the Network LSA (Type 2) on multi-access segments.

Answer

To translate Type 7 LSAs into Type 5 LSAs for the backbone

Answer

To authenticate OSPF hello packets across interfaces

Answer

To act as the sole exit gateway for all external traffic in the AS

Question 13

An administrator needs to configure MSTP on a group of EX Series switches. Which three parameters must be identical across all switches in the same MST region?

Accepted Answer

Configuration name, revision number, and VLAN-to-instance mapping. Switches belong to the same MST region only if they share the exact same configuration name, revision number, and VLAN-to-instance mapping.

Answer

MAC address, system ID extension, and MSTP version

Answer

Bridge priority, root identifier, and Hello timer

Answer

Max age, forward delay, and region map digest

Question 14

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

Accepted Answer

ip-. In Junos, IP-IP tunnels are configured on interfaces with the 'ip-' prefix (e.g., ip-0/0/0). This naming convention distinguishes IP-IP tunnels from other tunnel types like GRE (gr-), multicast tunnels (mt-), and generic routing encapsulations. The 'ip-' interface is specifically designated for IP-in-IP encapsulation as defined in RFC 2003.

Answer

mt-

Answer

gr-

Answer

st-

Question 15

When planning an In-Service Software Upgrade (ISSU) on a Juniper routing platform, what is the behavior of the Routing Engines during the execution of the upgrade command?

Accepted Answer

The backup Routing Engine is upgraded, a graceful switchover takes place, and then the newly elected backup Routing Engine is upgraded.. During an In-Service Software Upgrade (ISSU) on Juniper routing platforms, the process upgrades the backup Routing Engine first, then performs a graceful switchover to make it the primary, and finally upgrades the new backup (formerly primary) Routing Engine. This ensures that at least one RE is always available to maintain control plane operations and forwarding, minimizing downtime.

Answer

Both Routing Engines are rebooted simultaneously, relying entirely on OSPF Graceful Restart helper mode.

Answer

The forwarding plane is restarted first, followed by a simultaneous upgrade of the dual REs.

Answer

The primary Routing Engine is wiped and reloaded while data traffic is redirected through the console port.