JNCIS-ENT Practice Test 19 — 15 Questions

Question 1

You are configuring an EX Series switch and want to set the forward delay timer to 15 seconds. Which command is used?

Accepted Answer

set protocols rstp forward-delay 15. On Junos EX Series switches, RSTP is configured under the [edit protocols rstp] hierarchy, and the forward-delay timer is set with 'set protocols rstp forward-delay 15'. This command sets the RSTP forward delay to 15 seconds, controlling how long a port stays in the Listening and Learning states before transitioning to Forwarding.

Answer

set bridge forward-delay 15

Answer

set spanning-tree forward-delay 15

Answer

set protocols rstp delay 15

Question 2

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

Accepted Answer

They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).. For a GRE tunnel terminating in a routing instance (VRF), the tunnel source and destination addresses must be routable within the routing table associated with the underlying transport interface. This is typically the master routing instance or a specific VRF that has reachability to the tunnel endpoints. The tunnel itself can be in a different VRF, but the transport must be resolvable.

Answer

They must be part of the same subnet as the tunnel payload addresses.

Answer

They must be resolved via BGP inet-vpn routes only.

Answer

They must be configured as loopback addresses in the destination VRF exclusively.

Question 3

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

Accepted Answer

MACsec Key Agreement (MKA) protocol. Junos MACsec uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X-2010, as the default key agreement protocol. MKA runs over the point-to-point link, elects a Key Server, and uses the Connectivity Association Key (CAK) to derive the Secure Association Key (SAK) that encrypts traffic.

Answer

Internet Key Exchange version 2 (IKEv2)

Answer

Secure Session Protocol (SSP)

Answer

802.1AE Dynamic Key Distribution (AKD)

Question 4

An engineer configures a Virtual Chassis using EX4300 switches. To ensure member IDs are assigned consistently even if physical positions change, how should the administrator provision the member IDs?

Accepted Answer

Pre-provision member serial numbers to specific member IDs using the 'request virtual-chassis assign' or configuration statements.. Junos allows pre-provisioning Virtual Chassis member serial numbers to specific member IDs to maintain predictable topologies.

Answer

Rely on automatic plug-and-play assignment, which permanently locks member IDs based on initial boot order.

Answer

Disable GRES so that member IDs do not synchronize across the stack.

Answer

Configure the MAC address of each switch under the [edit chassis vrrp] hierarchy.

Question 5

Which TWO parameters are mandatory when configuring a basic GRE tunnel interface in Junos? (Choose two)

Accepted Answer

Tunnel destination IP address. Option B (Tunnel destination IP address) is mandatory because a GRE tunnel interface must know the remote endpoint to encapsulate and forward packets to; in Junos this is configured with the tunnel destination statement under the gr- interface. Option C (Tunnel source IP address) is also mandatory because the local tunnel endpoint must be identified so return traffic and the outer IP header use a reachable, routable source address, configured via the tunnel source statement. Together, source and destination define the two endpoints of the point-to-point GRE tunnel and are the minimum required parameters. Option A (GRE keepalive interval timer) is optional, as keepalives are not required for basic GRE operation and can be omitted. Option D (Routing protocol authentication key) is unrelated to GRE tunnel interface configuration and belongs to routing protocol security. Option E (IPsec security association profile) is not required for basic GRE, since GRE itself provides no encryption and IPsec would only be added for secure GRE scenarios.

Answer

GRE keepalive interval timer

Answer

Routing protocol authentication key

Answer

IPsec security association profile

Question 6

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

Accepted Answer

No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.. IP-IP tunnels (ip-x/x/x interfaces on Junos) encapsulate only unicast IP packets inside an outer IP header, per RFC 2003. They do not carry the Ethernet-like or multicast/broadcast semantics that PIM requires to form adjacencies and exchange hello messages. GRE, by contrast, supports multicast and broadcast encapsulation, which is why PIM and other multicast routing protocols can run over GRE but not over IP-IP.

Answer

Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.

Answer

No, because Junos prohibits all routing protocols over IP-IP interfaces.

Answer

Yes, but only if IGMP version 3 is explicitly configured.

Question 7

You have a Level 1/Level 2 router connecting two areas. How does it advertise itself to Level 1 routers?

Accepted Answer

It advertises a default route using the ATT bit.. A Level 1/Level 2 (L1/L2) router attaches the ATT (Attached) bit to the IS-IS LSP it floods into the Level 1 area, signaling to L1 routers that it can reach other areas. L1 routers then install a default route (0/0) pointing toward the nearest L1/L2 router that has the ATT bit set, allowing them to reach destinations outside their area without needing the full L2 topology.

Answer

It requires a manual default-route configuration on all L1 routers.

Answer

It floods the entire Level 2 LSDB into the Level 1 area.

Answer

It sends a specific inter-area TLV to all neighbors.

Question 8

You are performing a pre-check for an ISSU on an MX series router. You execute 'request system software in-service check' and the system reports an error indicating that graceful restart or NSR is not properly configured for active routing protocols. How do you resolve this?

Accepted Answer

Configure Nonstop Active Routing (NSR) or Graceful Restart for all active interior and exterior routing protocols before re-running the check.. ISSU on MX routers requires that graceful restart (GR) or nonstop active routing (NSR) be configured for all active routing protocols so that protocol state is preserved across the Routing Engine switchover. The in-service check explicitly validates this; the fix is to enable NSR or GR for the relevant IGPs and BGP before re-running the check. Without it, ISSU cannot proceed safely.

Answer

Manually restart the routing protocol daemon (rpd) on both Routing Engines simultaneously.

Answer

Disable GRES to bypass protocol state verification checks.

Answer

Set the virtual-chassis mastership-priority to 255 on both routing engines.

Question 9

You are troubleshooting a Virtual Chassis where member 0 has failed completely. The replacement switch arrives. Before inserting it into the running Virtual Chassis ring, what critical precaution must be taken regarding Junos OS software versions?

Accepted Answer

Ensure the replacement switch is running the exact same major and minor version of Junos OS as the existing Virtual Chassis master.. A Virtual Chassis requires all member switches to run compatible Junos OS versions — specifically the same major and minor release — before the new member joins the fabric. If the replacement switch runs a different release, it may fail to join, cause mastership election issues, or destabilize the entire VC. The safe practice is to match the master's Junos version before insertion.

Answer

Disable LACP on all aggregated links across the stack.

Answer

Format the flash memory of the existing master switch before inserting the replacement.

Answer

Change the root password of the replacement switch to match the backup routing engine.

Question 10

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Accepted Answer

Dynamic ARP Inspection (DAI). The secure access port feature suite in Junos OS is designed to protect the access layer from Layer 2 attacks, and it comprises Dynamic ARP Inspection (DAI), DHCP Snooping, and IP Source Guard. Option B (Dynamic ARP Inspection) is correct because DAI validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and MITM attacks on access ports. Option C (DHCP Snooping) is correct because it builds and maintains the trusted binding table of IP-to-MAC mappings and blocks rogue DHCP servers, serving as the foundation for DAI and IP Source Guard. Option D (IP Source Guard) is correct because it uses the DHCP snooping database to filter traffic and prevent IP/MAC spoofing on untrusted access ports. Option A (MACsec Key Agreement) is not part of this suite; MKA is a Layer 2 encryption key management protocol for MACsec, a separate security feature. Option E (Spanning Tree Root Protection) is a Layer 2 loop-prevention STP enhancement, not a secure access port feature.

Answer

MACsec Key Agreement (MKA)

Answer

Spanning Tree Root Protection

Question 11

An administrator is configuring Graceful Restart on a pair of Juniper MX series routers running OSPF. What is the primary purpose of Graceful Restart in this scenario?

Accepted Answer

To ensure uninterrupted data packet forwarding while the control plane routing protocol restarts.. Graceful Restart (GR) in OSPF allows a router to restart its control plane (routing protocol process) while the forwarding plane continues to forward packets uninterrupted. The router signals its neighbors that it is restarting, and they continue to advertise the restarting router's links as if it were still up, preventing a full SPF recalculation and traffic loss. This ensures uninterrupted data forwarding during the restart.

Answer

To instantly drop all adjacencies and force an immediate full SPF recalculation across the network.

Answer

To automatically upgrade Junos OS images without rebooting the forwarding plane.

Answer

To synchronize firewall filter counters between primary and backup Routing Engines.

Question 12

Which command allows an administrator to view the OSPF link-state database (LSDB) summary on a Junos device?

Accepted Answer

show ospf database. The command 'show ospf database' displays the OSPF link-state database (LSDB) summary, including all LSAs (Router, Network, Summary, External) and their details. This is the correct command to view the LSDB on a Junos device.

Answer

show ospf neighbor

Answer

show route protocol ospf

Answer

show ospf interface

Question 13

An administrator needs to view the MAC address learning table on an EX Series switch to verify which switchport a specific server is connected to. Which operational command should be used?

Accepted Answer

show ethernet-switching table. On Juniper EX Series switches, the MAC address learning table is exposed through the ethernet-switching subsystem, so the correct operational command is 'show ethernet-switching table'. This command displays learned MAC addresses, their associated VLANs, and the egress switchport, allowing the administrator to map a server's MAC to the exact interface it is connected to.

Answer

show mac-address-table

Answer

show vlans mac-table

Answer

show bridge-domain mac-table

Question 14

You are troubleshooting an OSPF network where an NSSA area is connected to the backbone via an ABR. External routes are being injected into the NSSA by an ASBR. Which router is responsible for translating Type 7 LSAs into Type 5 LSAs before flooding them into the backbone area?

Accepted Answer

The NSSA ABR. In OSPF NSSA, external routes are injected as Type 7 LSAs by the ASBR. The NSSA ABR is responsible for translating Type 7 LSAs into Type 5 LSAs before flooding them into the backbone area (Area 0), because Type 7 LSAs are only flooded within the NSSA. This translation allows external routes to be propagated to the rest of the OSPF domain.

Answer

The ASBR that originally injected the external route

Answer

Any internal router residing within the NSSA backbone

Answer

The designated router (DR) of the NSSA segment

Question 15

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

Accepted Answer

Dynamic ARP Inspection enabled on the specific VLAN. Dynamic ARP Inspection on EX Series switches requires three things to work: DAI must be enabled on the specific VLAN (option B), because the inspection policy is applied per-VLAN and ARP packets are validated only on VLANs where DAI is explicitly turned on. Trusted ports must be configured on uplinks toward DHCP servers or core routers (option D), since DAI drops ARP packets on untrusted ports that fail validation, while trusted ports bypass inspection so legitimate infrastructure ARP traffic is not blocked. DHCP snooping must be enabled on the respective VLAN (option E), because DAI relies on the DHCP snooping binding database to validate ARP packet IP-to-MAC mappings; without it, DAI has no trusted binding source and will drop valid ARP traffic. Option A is incorrect because MACsec is a Layer 2 encryption protocol unrelated to DAI operation. Option C is incorrect because static ARP inspection bindings are not required for every client; DAI uses dynamic DHCP snooping bindings, and static bindings are only optional for hosts with static IPs.

Answer

MACsec pre-shared keys configured on all access ports

Answer

Configured static ARP inspection bindings for every client