JNCIS-ENT Practice Exam 2 — 20 Questions

Question 1

While reviewing BGP updates, you notice an attribute type code of 3 with a value representing an IP address. Which well-known mandatory path attribute is this?

Accepted Answer

NEXT_HOP. Attribute type code 3 corresponds to NEXT_HOP, which is a well-known mandatory attribute indicating the IP address of the router used to reach the destination.

Answer

AS_PATH

Answer

ORIGIN

Answer

LOCAL_PREF

Question 2

During troubleshooting of a flapping BGP session, you notice BGP Notification messages being sent. Which BGP message type is responsible for tearing down a session due to an error condition?

Accepted Answer

NOTIFICATION. The Notification message is sent when an error is detected, causing the BGP connection to close immediately.

Answer

KEEPALIVE

Answer

UPDATE

Answer

OPEN

Question 3

An engineer is configuring a trunk port on an EX Series switch and needs to ensure that untagged and priority-tagged frames are handled correctly. Which TWO configuration actions are required? (Choose two.)

Accepted Answer

Set the interface mode to trunk under the ethernet-switching family hierarchy.. Option A is correct because on EX Series switches the port must be placed into trunk mode under the ethernet-switching family hierarchy (set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk) so that it can carry multiple VLANs and process tagged frames. Option E is correct because the native-vlan-id statement defines which VLAN handles untagged and priority-tagged frames arriving on the trunk, ensuring those frames are mapped to the intended VLAN. Option B is incorrect because a Layer 2 trunk port does not require Layer 3 routing on unit 0; routing would be configured on an IRB (VLAN) interface instead. Option C is incorrect because CCC and VPLS encapsulations are used for circuit cross-connect and VPLS Layer 2 VPN services, not for standard 802.1Q trunking. Option D is incorrect because disabling MAC learning is not required or recommended for a trunk port and would not prevent native VLAN loops.

Answer

Enable Layer 3 routing directly on the physical trunk interface unit 0.

Answer

Configure the interface encapsulation as CCC or VPLS.

Answer

Disable MAC learning on the trunk interface to prevent native VLAN loops.

Question 4

An operator executes the command 'show bridge mac-table' on an EX Series switch running Junos OS. Which information is displayed in the output of this command?

Accepted Answer

Learned MAC addresses, associated VLAN names/IDs, and corresponding interface names.. The show bridge mac-table command on EX Series switches displays the Layer 2 MAC address table, including learned MAC addresses, their associated VLANs, and the interfaces on which they were learned. This is the primary command for verifying MAC learning and forwarding behavior.

Answer

Physical transceiver optical power levels and interface error counters.

Answer

Spanning tree root bridge priorities and designated port roles.

Answer

The IP addresses corresponding to each dynamic MAC address via ARP resolution.

Question 5

In an OSPF NSSA configuration on a Junos device, which router is specifically responsible for translating Type 7 LSAs into Type 5 LSAs when propagating routes out of the NSSA into the backbone?

Accepted Answer

The NSSA ABR with the highest router ID. In an OSPF NSSA, Type 7 LSAs are generated by the ASBR for external routes. The NSSA ABR is responsible for translating Type 7 LSAs into Type 5 LSAs when propagating them into the backbone area. If multiple ABRs exist, the one with the highest router ID is elected as the translator to avoid duplicate translation.

Answer

The OSPF Designated Router (DR) on the NSSA segment

Answer

The ASBR that originated the external route

Answer

Any internal NSSA router running Junos OS

Question 6

Which protocol number is used in the outer IP header for an IP-IP tunnel?

Accepted Answer

4. IP-IP tunneling (RFC 2003) encapsulates an inner IP packet inside an outer IP header with the protocol field set to 4, which is the IANA-assigned protocol number for IP-in-IP encapsulation. This is distinct from GRE (protocol 47), TCP (6), and UDP (17), making 4 the correct answer for IP-IP tunnels.

Answer

47

Answer

6

Answer

17

Question 7

An engineer configures an aggregate route for 172.16.0.0/16 on a Junos device. However, the aggregate route is not active in the routing table. What is the primary requirement for an aggregate route to become active?

Accepted Answer

At least one more-specific contributing route must exist in the routing table.. A Junos aggregate route becomes active only when at least one more-specific contributing route exists in the routing table. The aggregate is generated as a discard route (or with a configured next-hop) and is installed only if a longer-prefix route covered by the aggregate is present.

Answer

An explicit static route matching the aggregate prefix must be configured.

Answer

A discard policy must be explicitly defined under the aggregate route definition.

Answer

The aggregate route must be redistributed using BGP or OSPF.

Question 8

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Accepted Answer

DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.. IP Source Guard (IPSG) relies on the DHCP snooping binding table to validate source IP and MAC addresses on untrusted ports. If DHCP snooping is not enabled on the VLAN, the binding table is not populated, so IPSG has no entries to permit and drops all traffic. The root cause is that DHCP snooping was not enabled on the corresponding VLAN.

Answer

IP Source Guard requires static ARP inspection to be enabled simultaneously.

Answer

The client's MAC address is in the port security violation log.

Answer

IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

Question 9

An administrator is configuring VLANs on a Junos EX Series switch. Which TWO tasks must be performed to successfully assign a physical interface as an access port for a newly created VLAN? (Choose two.)

Accepted Answer

Configure the interface mode as access under [edit interfaces unit 0 family ethernet-switching].. Option E is correct because a VLAN must first exist in the configuration before an interface can be assigned to it; on Junos EX switches you create it under [edit vlans] with a name and a vlan-id (e.g., set vlans SALES vlan-id 100). Option D is correct because the physical port is made an access port by setting the interface mode to access under [edit interfaces unit 0 family ethernet-switching], which places untagged traffic from that port into the specified VLAN. Spanning tree (option A) is not required to make a VLAN active, and it is enabled by default on EX switches anyway. Option B is wrong because an access port carries Layer 2 traffic in family ethernet-switching; assigning family inet and an IP address is for a routed/Layer 3 interface, not a switched access port. Option C is wrong because trunk mode with native-vlan-id is used for carrying multiple VLANs (802.1Q tagging), not for assigning a single access VLAN to a physical interface.

Answer

Enable spanning-tree protocol globally for the access VLAN to become active.

Answer

Configure the interface family as inet and assign an IP address.

Answer

Configure the interface as a trunk port with native-vlan-id enabled.

Question 10

While examining an RSTP topology, you notice that a designated port has suddenly stopped receiving BPDUs from its upstream neighbor, causing the port to transition into a discarding state to prevent potential loops. Which feature is actively providing this protection?

Accepted Answer

Loop protection. Loop protection is the RSTP feature designed to prevent loops on designated ports that stop receiving BPDUs from their upstream neighbor. When a designated port no longer receives BPDUs, it would normally age out and potentially cause a loop; loop protection detects this condition and places the port into a discarding state (or blocks it) to prevent the loop. This matches the scenario exactly.

Answer

Root protection

Answer

BPDU guard

Answer

TC protection

Question 11

An engineer is configuring static routes in Junos OS and wants to ensure high availability. Which TWO features can be implemented with static routes to achieve path redundancy? (Choose two)

Accepted Answer

Qualified next-hop with varying preference values. Option A (Qualified next-hop with varying preference values) is correct because Junos static routes support multiple qualified next-hops, each with its own preference; if the primary next-hop fails, the route with the next-lower preference becomes active, providing path redundancy. Option D (Recursive next-hop tracking via RPM or routing table lookups) is correct because a static route can resolve its next-hop recursively, and RPM (Real-time Performance Monitoring) probes or routing-table lookups can detect when the resolved next-hop becomes unreachable, allowing the route to be withdrawn or replaced. Option B (IGMP snooping) is a Layer 2 multicast optimization and does not provide static-route path redundancy. Option C (OSPF area stubbing) is a dynamic routing design technique for reducing LSAs, not a static-route feature. Option E (BGP AS-path prepending) is a BGP path-manipulation tool and cannot be applied to plain static routes.

Answer

IGMP snooping on static interfaces

Answer

OSPF area stubbing

Answer

BGP AS-path prepending on static routes

Question 12

Which operational command displays the configured member IDs, priorities, and roles in an EX Series Virtual Chassis?

Accepted Answer

show virtual-chassis. The 'show virtual-chassis' command displays member IDs, roles, priorities, and serial numbers.

Answer

show lacp aggregated-devices

Answer

show chassis alarms

Answer

show vrrp mastership

Question 13

Which command allows you to inspect the active forwarding table entries and verify next-hops on a Junos router?

Accepted Answer

show route forwarding-table. 'show route forwarding-table' displays the active forwarding table entries that the Packet Forwarding Engine (PFE) actually uses to forward packets, including next-hop information. This is the command that verifies what the router is really doing at the forwarding plane, not just what the routing protocol advertised.

Answer

show interfaces extensive

Answer

show pfe traffic

Answer

show routing-engine status

Question 14

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Accepted Answer

Multicast traffic rate exceeding the configured threshold. Storm control on a switch interface monitors Layer 2 traffic rates and drops frames when a configured threshold is exceeded, and it applies to broadcast, multicast, and unknown unicast traffic. Option A is correct because multicast traffic exceeding the configured threshold is one of the traffic types storm control polices, so it triggers drops. Option D is correct because broadcast traffic exceeding the configured threshold is the classic storm control trigger, suppressing broadcast storms on the interface. Option B is wrong because unicast destined for known active MAC addresses is normal, expected forwarding traffic and is not counted by storm control (only unknown unicast is). Option C is wrong because CPU control plane queue utilization is a control-plane policing concern, not an interface storm control action. Option E is wrong because BPDUs are control frames handled by Spanning Tree, not storm-control-monitored data traffic.

Answer

Unicast traffic destined for known active MAC addresses exceeding average utilization

Answer

CPU control plane queue utilization exceeding 90%

Answer

BPDU control frames exceeding Spanning Tree hello timers

Question 15

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

Accepted Answer

GCM-AES-128. When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Answer

AES-CBC-128

Answer

SHA-256-HMAC

Answer

GCM-AES-256

Question 16

Which Junos command displays detailed information about OSPF neighbor states, including dead timer countdowns and address bindings?

Accepted Answer

show ospf neighbor detail. The command 'show ospf neighbor detail' displays comprehensive information about each OSPF neighbor, including neighbor state (Full, 2-Way, etc.), neighbor ID, interface address, dead timer countdown, and area. This is the go-to command for verifying adjacency health and troubleshooting OSPF neighbor issues on Junos devices.

Answer

show ospf statistics

Answer

show route table inet.0

Answer

show ospf database detail

Question 17

During the establishment of an OSPF adjacency, two routers exchange Database Description (DBD) packets. What is the primary purpose of the DBD packet exchange in the OSPF protocol sequence?

Accepted Answer

To synchronize link-state database summaries between neighbors. The DBD (Database Description) packet exchange is the second stage of OSPF adjacency formation, after Hello packets establish bidirectional communication. Its purpose is to exchange summary headers of each router's link-state database so both routers can determine which LSAs they are missing and need to request via Link-State Request packets. This synchronization ensures both neighbors have an identical view of the topology before entering the Full state.

Answer

To discover directly connected neighbors on a shared segment

Answer

To request specific missing LSAs from a neighbor's database

Answer

To explicitly acknowledge the receipt of specific LSA updates

Question 18

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

Accepted Answer

family inet6. The GRE tunnel is being used to carry IPv6 traffic, so the logical unit must be configured with family inet6 to process IPv6 packets. The transport is IPv4, but that is handled by the tunnel's source/destination addresses configured under the tunnel parameters, not by the unit's family. Configuring family inet6 on the gr- interface unit enables IPv6 forwarding, addressing, and protocol processing inside the tunnel.

Answer

family inet

Answer

family iso

Answer

family mpls

Question 19

What is the default bridge priority value assigned to Juniper EX Series switches when RSTP is enabled?

Accepted Answer

32768. Juniper EX Series switches use the IEEE 802.1D/802.1w default bridge priority of 32768 when RSTP is enabled. Bridge priority is a 16-bit value expressed in increments of 4096, and 32768 is the midpoint of the range, making it the standard default across vendors. The bridge with the lowest priority (and then lowest MAC) becomes root.

Answer

61440

Answer

0

Answer

4096

Question 20

What is the primary benefit of enabling edge port configuration on switch access ports connected to end devices?

Accepted Answer

It allows the port to transition immediately to the forwarding state, avoiding startup delays.. Enabling edge port configuration on switch access ports connected to end devices allows the port to transition immediately to the forwarding state, bypassing the listening and learning states of STP/RSTP. This avoids startup delays (up to 30 seconds with classic STP) and improves convergence for end-user devices. Edge ports are also known as PortFast in Cisco terminology.

Answer

It forces the port to operate exclusively in full-duplex mode.

Answer

It increases the interface bandwidth by disabling spanning tree calculations entirely.

Answer

It enables automatic detection of unauthorized rogue bridges on access links.