JNCIS-ENT Practice Test 20 — 15 Questions

Question 1

Which THREE characteristics distinguish GRE tunnels from IP-IP tunnels on Junos devices? (Choose three)

Accepted Answer

GRE supports optional features like checksums and keys.. Option B is correct because GRE headers include optional fields such as Checksum and Key that IP-IP (IP protocol 4) headers do not provide, allowing integrity verification and tunnel identification. Option C is correct because GRE is identified by IP protocol number 47 in the outer IP header, whereas IP-IP uses protocol number 4. Option D is correct because GRE can carry multicast and broadcast traffic by encapsulating it in a unicast GRE packet, while IP-IP is limited to unicast IP payloads. Option A is wrong because IP-IP tunnels are a software feature on Junos and do not require a specialized Routing Engine hardware card. Option E is wrong because IP-IP provides encapsulation only and does not inherently encrypt payloads; encryption would require IPsec.

Answer

IP-IP tunnels require a specialized Routing Engine hardware card.

Answer

IP-IP tunnels inherently encrypt all transmitted data payloads.

Question 2

You need to configure filter-based forwarding (FBF) to route traffic from a specific subnet (192.168.1.0/24) through an alternate next-hop gateway. Which components are required to implement this successfully?

Accepted Answer

A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the ingress interface.. Filter-based forwarding in Junos requires three elements working together: a stateless firewall filter that matches the traffic and applies a 'routing-instance' action, a custom routing instance (typically type forwarding) containing the alternate next-hop route, and the filter applied as an input filter on the ingress interface where the traffic arrives. The routing-instance action causes matched packets to be looked up in that instance's table instead of the main inet.0 table.

Answer

A static route pointing to the alternate gateway with a preference of 1.

Answer

An export routing policy with a load-balance action applied globally.

Answer

A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the egress interface.

Question 3

Which OSPF packet type is used to acknowledge the receipt of Link-State Updates (LSUs) to ensure reliable flooding?

Accepted Answer

Link-State Acknowledgment (Type 5). OSPF uses Link-State Acknowledgment (Type 5) packets to explicitly acknowledge the receipt of Link-State Update (LSU) packets, ensuring reliable flooding of LSAs. When a router receives an LSU, it sends an LSAck to confirm receipt; if not acknowledged, the LSU is retransmitted. This mechanism guarantees that all routers in an area receive LSAs reliably.

Answer

Database Description (Type 2)

Answer

Link-State Request (Type 3)

Answer

Hello (Type 1)

Question 4

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

Accepted Answer

Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.. Input drops incrementing rapidly on an IP-IP tunnel interface typically indicate that packets are being dropped due to MTU issues. When a packet exceeds the tunnel interface MTU and has the Don't Fragment (DF) bit set, the router cannot fragment it and must drop it, often sending an ICMP 'fragmentation needed' message. This is a common cause of input drops on tunnel interfaces.

Answer

The security policies are blocking the return traffic.

Answer

OSPF hello packets are malformed.

Answer

The tunnel destination IP address is unreachable via the routing table.

Question 5

Which TWO OSPF packet types are used for reliable flooding and direct acknowledgment of Link State Advertisements? (Choose two.)

Accepted Answer

Link State Update (LSU) packets. Option D (Link State Update (LSU) packets) is correct because LSU packets carry the actual LSAs during OSPF flooding; a router sends LSUs to neighbors to reliably propagate link-state information throughout an area. Option E (Link State Acknowledgment (LSAck) packets) is correct because LSAcks provide the explicit, direct acknowledgment of received LSAs, which is the mechanism that makes OSPF flooding reliable. Together, LSU and LSAck implement reliable flooding: LSU delivers LSAs and LSAck confirms receipt. Option A (DBD packets) is used during database exchange to summarize the link-state database and establish master/slave sequencing, not for flooding LSAs or acknowledging them. Option B (Hello packets) discovers and maintains neighbors and elects DR/BDR, but does not carry LSAs or acknowledge them. Option C (LSR packets) requests specific LSAs that a router is missing after comparing databases, so it is not part of reliable flooding or direct acknowledgment.

Answer

Database Description (DBD) packets

Answer

Hello packets

Answer

Link State Request (LSR) packets

Question 6

You are configuring a virtual router routing instance on a Juniper device to isolate traffic for a specific department. Which routing-instance type should you select?

Accepted Answer

virtual-router. A virtual-router routing instance creates a separate routing table (RIBs) and forwarding table (FIBs) for the instance, effectively giving the department its own logical router with independent interfaces, routing protocols, and policies. This is the correct type when you need full Layer 3 isolation with separate routing domains on the same physical device.

Answer

l2vpn

Answer

forwarding

Answer

no-forwarding

Question 7

What type of LSA is generated by an OSPF Area Border Router (ABR) to advertise networks from one area to another area?

Accepted Answer

Type 3 (Summary LSA). Type 3 Summary LSAs are generated by ABRs to advertise inter-area routes — networks from one area injected into another. The ABR originates a Type 3 LSA for each prefix it knows from a different area, allowing routers in the receiving area to reach those destinations without running SPF for the source area's topology.

Answer

Type 2 (Network LSA)

Answer

Type 1 (Router LSA)

Answer

Type 5 (AS-external LSA)

Question 8

An engineer wants to configure Nonstop Active Routing (NSR) alongside GRES on an MX204 router running OSPF. What is the primary operational benefit of enabling NSR compared to running GRES alone?

Accepted Answer

NSR synchronizes protocol daemon states between Routing Engines, preventing neighbors from detecting a control plane switchover.. GRES preserves forwarding state during a switchover, but routing protocols must restart and re-converge unless NSR is running, which synchronizes routing protocol states between REs.

Answer

NSR automatically configures VRRP tracking on all local VLAN interfaces.

Answer

NSR allows software upgrades to be performed without ever rebooting either Routing Engine.

Answer

NSR replaces LACP negotiation with static member pinning during link failures.

Question 9

You are configuring an IP-IP tunnel on a Junos routing platform. Which statement correctly identifies how IP-IP encapsulation differs from GRE encapsulation?

Accepted Answer

IP-IP encapsulates an IP packet inside another IP packet with an outer IP header and no extra transport header, whereas GRE includes a GRE header.. IP-IP tunneling (RFC 2003) prepends only an outer IPv4 header to the original packet, with protocol number 4 indicating IP-in-IP. GRE (RFC 2784/2890) inserts a GRE header between the outer IP header and the payload, adding fields like protocol type, checksum, key, and sequence number. This makes GRE more feature-rich but with more overhead (typically 24 bytes vs 20 for IP-IP).

Answer

IP-IP encapsulation includes a 4-byte protocol header while GRE includes routing and key fields.

Answer

IP-IP requires a logical tunnel (lt-) interface to function properly.

Answer

GRE supports only IPv4 payloads while IP-IP supports both IPv4 and IPv6.

Question 10

You are configuring Filter-Based Forwarding (FBF) on an interface. You apply a firewall filter that matches specific source addresses and uses 'then routing-instance' as an action. What must be configured in that target routing instance to ensure return traffic is handled correctly?

Accepted Answer

A default route pointing back to the core gateway within that routing instance's routing table.. When using Filter-Based Forwarding (FBF) to direct traffic to a specific routing instance, the target routing instance must have a route back to the source to handle return traffic. Typically, a default route pointing back to the core gateway within that routing instance's routing table ensures that return traffic is sent back correctly. Without such a route, return traffic may be dropped or misrouted.

Answer

A static ARP entry for every device on the network.

Answer

An RSVP LSP bridging the source and destination instances.

Answer

A BGP peering session with the loopback address.

Question 11

An engineer needs to configure a Link Aggregation Group (LAG) between two Juniper EX4300 switches to provide redundant uplinks to a core router. Which statements regarding the LACP configuration requirements on the EX4300 switch must be met?

Accepted Answer

The member interfaces must have matching speed, duplex, and LACP mode configuration.. On Juniper EX switches, all physical member links of an aggregated Ethernet (ae) interface must be configured identically in terms of speed, duplex, and LACP mode (active/passive) for the bundle to come up. If any member link negotiates a different speed/duplex or is placed in a mismatched LACP mode, that link is excluded from the LAG and may remain in a down or standby state. This consistency requirement ensures the LACP state machine can form a single logical link with a stable operational key across all member ports.

Answer

LAG interfaces do not require explicit definition under the chassis stanza.

Answer

LACP multi-chassis mode must be enabled for a single switch LAG.

Answer

LACP heartbeat intervals are strictly hardcoded to 1 second and cannot be modified.

Question 12

You need to ensure that a core switch retains its position as the root bridge even if a new switch with a manually lowered bridge priority is added to the network. Which feature should you configure on the core switch's ports facing the downstream switches?

Accepted Answer

Root protection. Root protection is configured on ports that should not receive superior BPDUs. When enabled on the core switch's downstream ports, it ensures that if a superior BPDU (indicating a new root bridge) is received, the port enters a root-inconsistent state, effectively preventing the core switch from losing its root bridge status. This feature is designed to enforce the root bridge location.

Answer

Loop protection

Answer

BPDU guard

Answer

Edge port configuration

Question 13

When configuring Private VLANs (PVLANs) on Juniper EX Series switches, which TWO types of ports are defined within the architecture? (Choose two.)

Accepted Answer

Promiscuous port. In Juniper EX Series PVLAN architecture, a promiscuous port (option B) is the port that connects to a router or gateway and can communicate with all isolated and community VLAN ports, serving as the shared upstream exit point for the secondary VLANs. Option C, the host port (Isolated or Community), is also correct because PVLANs define host-facing ports as either isolated (which can only talk to the promiscuous port) or community (which can talk to the promiscuous port and other members of the same community). These two port roles are the fundamental building blocks of PVLANs on EX switches, alongside the primary/secondary VLAN constructs. The remaining options are not PVLAN port types: a root bridge port (A) is an STP concept, a core uplink port (D) is a generic topology term, and a trunk access port (E) is not a defined PVLAN port role.

Answer

Root bridge port

Answer

Core uplink port

Answer

Trunk access port

Question 14

Which TWO BGP message types are responsible for maintaining session state or reporting errors without carrying routing information? (Choose two)

Accepted Answer

KEEPALIVE. B. KEEPALIVE is correct because BGP peers exchange KEEPALIVE messages periodically (default 60 seconds, hold time 180 seconds) to confirm the session is still alive and to maintain the established state without carrying any NLRI routing information. E. NOTIFICATION is correct because it is sent when an error condition is detected (for example a hold-timer expiry, bad message header, or unsupported capability), causing the session to be torn down; it reports the error and carries no routing information. A. OPEN is not correct here because, although it establishes the session and negotiates capabilities, it is a session-initiation message rather than a state-maintenance or error-reporting message. C. UPDATE is not correct because UPDATE is precisely the message that carries routing information (NLRI and path attributes). D. QUERY is not correct because QUERY is not a BGP message type; the four BGP message types are OPEN, UPDATE, KEEPALIVE, and NOTIFICATION.

Answer

OPEN

Answer

UPDATE

Answer

QUERY

Question 15

Which TWO mechanisms are utilized by RSTP to achieve rapid convergence compared to legacy 802.1D STP? (Choose two.)

Accepted Answer

Proposal-agreement handshake mechanism. Option A (Proposal-agreement handshake mechanism) is correct because RSTP uses a proposal/agreement exchange on designated ports to rapidly move a port to Forwarding without waiting for the legacy STP timers, allowing quick synchronization between neighboring switches. Option D (Support for point-to-point link synchronization) is correct because RSTP explicitly distinguishes edge, point-to-point, and shared link types; on point-to-point links it can immediately transition ports via the sync process, which is fundamental to its rapid convergence. Option B is incorrect because RSTP does not enforce the legacy 15-second listening timer; it replaces timer-based transitions with handshake-based ones. Option C is incorrect because RSTP does not use centralized root bridge polling; the root bridge is elected via BPDUs as in STP, and convergence is distributed. Option E is incorrect because RSTP does not rely on periodic topology change broadcasts from the root; topology changes are signaled via TC-flag BPDUs and propagated hop-by-hop.

Answer

Mandatory 15-second listening timer enforcement

Answer

Centralized root bridge polling

Answer

Periodic topology change broadcasting by root bridges