JNCIS-ENT Practice Exam 3 — 20 Questions

Question 1

An administrator needs to create a VLAN named 'voice' with a VLAN ID of 50 on a Junos EX Series switch. Which configuration path achieves this?

Accepted Answer

set vlans voice vlan-id 50. On Junos EX Series switches, VLANs are configured under the [edit vlans] hierarchy with the syntax 'set vlans vlan-id '. This creates a VLAN named 'voice' with VLAN ID 50, which can then be associated with access or trunk interfaces.

Answer

set ethernet-switching-options vlans voice id 50

Answer

set bridge-domains voice vlan-id 50

Answer

set interfaces vlan unit 50 name voice

Question 2

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed information about the GRE tunnel interface, including the configured source and destination addresses. The 'extensive' option provides additional parameters beyond the basic interface status, such as tunnel source, destination, and other GRE-specific settings. This is the standard Junos command to verify tunnel configuration parameters on a specific interface.

Answer

show route protocol gre

Answer

show system tunnel-info

Answer

show chassis hardware

Question 3

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Accepted Answer

A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.. Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Answer

The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

Answer

The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

Answer

DHCP snooping is blocking the MACsec control frames on the transit link.

Question 4

What is the role of the Root Port in an RSTP topology?

Accepted Answer

It provides the lowest-cost path from a non-root switch to the root bridge.. The Root Port in RSTP is the port on a non-root switch that provides the lowest-cost path to the root bridge. It is the port through which the switch sends traffic toward the root and receives traffic from the root. Each non-root switch has exactly one root port, which is elected based on path cost, sender bridge ID, sender port ID, and local port ID.

Answer

It forwards traffic between two different MST regions.

Answer

It connects the root bridge to all downstream non-root switches.

Answer

It serves as the backup forwarding path when the designated port fails.

Question 5

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Accepted Answer

DHCP snooping. DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks. OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Answer

OSPFv3 authentication

Answer

MACsec point-to-point encryption

Question 6

When configuring a routing instance of type 'virtual-router', what is required to allow communication between the virtual router instance and the default routing instance?

Accepted Answer

Configure leaking routes between instances using rib-groups or routing policies.. To allow communication between a virtual-router routing instance and the default routing instance, you must configure route leaking using rib-groups or routing policies. Virtual routers have separate routing tables, so routes are not shared by default. Rib-groups can copy routes from one table to another, or routing policies can export/import routes between instances.

Answer

Connect a physical cable between two ports on the router (cable-patch).

Answer

Configure static routes with identical preferences in both instances.

Answer

Disable firewall filters on all loopback interfaces.

Question 7

You are troubleshooting an OSPF adjacency issue between two Juniper EX Series switches. One switch logs an error stating 'OSPF packet received with mismatched area ID'. Where in the Junos CLI should you check and correct this parameter?

Accepted Answer

[edit protocols ospf area interface ]. The OSPF area ID is configured per interface under '[edit protocols ospf area interface ]'. If two routers have mismatched area IDs on the same link, the adjacency will not form and the 'mismatched area ID' error is logged. Correcting the area ID on the interface under the correct area hierarchy resolves the issue.

Answer

[edit system services ospf]

Answer

[edit protocols ospf area <area-id> stub]

Answer

[edit routing-options router-id <ip-address>]

Question 8

Which THREE attributes are optional transitive BGP path attributes? (Choose three)

Accepted Answer

AS4_PATH. AS4_PATH (A) is an optional transitive attribute defined in RFC 6793 that carries 4-byte AS path information for backward compatibility with 2-byte AS speakers, and it is propagated to other ASes. AGGREGATOR (B) is an optional transitive attribute (type code 7) that records the AS and router ID of the device that performed route aggregation, and it is passed along to BGP peers. COMMUNITY (D) is an optional transitive attribute (type code 8) used to tag routes with community values that are propagated across AS boundaries. MED (C) is an optional nontransitive attribute, so it is not propagated beyond the neighboring AS, and LOCAL_PREF (E) is a well-known discretionary attribute used only within a single AS, so neither qualifies as optional transitive.

Answer

MED

Answer

LOCAL_PREF

Question 9

Which TWO statements describe characteristics of BGP path attributes? (Choose two.)

Accepted Answer

Well-known mandatory attributes must be recognized by all BGP implementations and included in every Update message containing path information.. Option C is correct because well-known mandatory attributes, by definition in BGP (RFC 4271), must be recognized by every BGP implementation and must appear in every UPDATE message that carries reachable NLRI/path information. Option E is correct because AS_PATH is one of the three well-known mandatory attributes (along with NEXT_HOP and ORIGIN), and it is present in every UPDATE advertising a route. Option A is wrong because Local Preference is a well-known discretionary attribute, not one exchanged across eBGP peers — it is typically propagated only within an AS via iBGP. Option B is wrong because MED is an optional non-transitive attribute, not well-known mandatory, and it influences inter-AS route selection only when explicitly configured. Option D is wrong because optional transitive attributes that are unrecognized are still passed along to other peers (with the partial bit set), not discarded.

Answer

Local Preference is a well-known discretionary attribute that is exchanged across eBGP peers.

Answer

MED is a well-known mandatory attribute used for inter-AS route selection.

Answer

Optional transitive attributes are ignored by BGP speakers that do not recognize them and are never passed along to other peers.

Question 10

Which TWO attributes distinguish direct routes from static routes in Junos OS? (Choose two)

Accepted Answer

Direct routes represent subnets attached to active local interfaces.. Option B is correct because direct routes in Junos OS are automatically installed in the routing table for the subnets configured on active local interfaces, representing directly connected networks. Option E is correct because Junos assigns direct routes a default preference of 0, while static routes carry a default preference of 5, making direct routes more preferred when both exist for the same prefix. Option A is wrong because static routes are manually configured, not automatically created when an interface comes up; that behavior describes direct/interface routes. Option C is wrong because direct routes do not require manual configuration under routing-options; they are derived from interface addresses, whereas static routes are configured under routing-options. Option D is wrong because static routes can use recursive next-hops, resolving the next-hop through another route in the routing table.

Answer

Static routes are created automatically when an interface comes up.

Answer

Direct routes require manual IP address configuration under routing-options.

Answer

Static routes cannot be used with recursive next-hops.

Question 11

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Accepted Answer

Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.. Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network. Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Answer

Disabling all Layer 2 learning on the translation interface.

Answer

Enabling OSPFv3 routing directly on the customer edge interface unit 0.

Question 12

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

Accepted Answer

Traffic policing by dropping packets exceeding the configured bandwidth threshold. Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Answer

Input queue buffering and tail-drop avoidance

Answer

Rate limiting via TCP window size adjustments

Answer

Traffic shaping with weighted random early detection (WRED)

Question 13

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses the DHCP snooping binding database to build its IP-to-MAC-to-port-to-VLAN binding table, then filters traffic on untrusted ports by dropping any packet whose source IP/MAC does not match an entry in that database (or a statically configured binding). Dynamic ARP Inspection (C) is also correct because DAI validates ARP packets on untrusted ports by comparing the sender IP and sender MAC against the DHCP snooping binding database, dropping ARP packets that do not match a valid binding (with static ARP ACLs as an optional supplement). Storm Control (B) is not correct because it is a hardware-based traffic rate limiter that monitors broadcast, multicast, or unknown unicast frames per port and does not consult any DHCP snooping bindings. Port Security MAC-Limit (D) is not correct because it restricts the number of source MAC addresses learned on a port using the MAC address table, independent of DHCP snooping bindings. MACsec Key Agreement (E) is not correct because MKA is part of IEEE 802.1X-2010 MACsec and negotiates session keys between link peers using EAPOL-MKA frames, with no dependency on the DHCP snooping binding database.

Answer

Storm Control rate-limiting

Answer

Port Security MAC-Limit

Answer

MACsec Key Agreement (MKA)

Question 14

An operator executes the 'show ospf database' command on a Junos device and notices multiple Type 2 Network LSAs. Under which specific network topology condition are Type 2 LSAs generated?

Accepted Answer

Multi-access broadcast segments with an active Designated Router. Type 2 Network LSAs are generated by the Designated Router (DR) on multi-access broadcast segments (e.g., Ethernet) to represent the subnet and list all routers attached to that segment. The DR originates the Network LSA, which includes the DR's interface IP address and the Router IDs of all OSPF routers on the segment. This LSA is only produced when a DR is elected, which occurs on broadcast or NBMA networks where multiple routers share the same subnet. Thus, option D correctly identifies the condition.

Answer

Stub areas filtering out external LSA advertisements

Answer

Virtual links traversing a non-backbone transit area

Answer

Point-to-point links between two directly connected routers

Question 15

An engineer configures a LAG between an EX4300 switch and a server. The server uses static LAG mode (no LACP). How must the Junos switch interface be configured to successfully form the bundle?

Accepted Answer

Omit the LACP protocol configuration under the aggregated-ether-options stanza, operating in static mode.. When connecting to a device that does not support LACP, you must configure the Junos aggregated interface without LACP (manual/static mode).

Answer

Configure VRRP on the ae0 interface to manage the static bundle.

Answer

Configure LACP passive mode on the EX4300 switch.

Answer

Enable Graceful Restart on the physical ports.

Question 16

Which TWO features help protect an RSTP topology from unauthorized switches or misconfigurations on access ports? (Choose two.)

Accepted Answer

Root protection. Root protection (Option C) is correct because when enabled on a port, it forces that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing an unauthorized or misconfigured switch on an access port from becoming the root bridge and hijacking the spanning-tree topology. BPDU guard (Option E) is correct because it err-disables a port immediately upon receiving any BPDU, which stops rogue switches or misconfigured devices from participating in RSTP on access ports that should only connect to end hosts. Bridge priority adjustment (Option A) only influences which switch becomes root and does not defend against unauthorized switches on access ports. Hello timer scaling (Option B) merely changes how often BPDUs are sent and does not provide protection. Forward delay timer optimization (Option D) tunes STP convergence timing and likewise offers no security against rogue or misconfigured access-port devices.

Answer

Bridge priority adjustment

Answer

Hello timer scaling

Answer

Forward delay timer optimization

Question 17

Which TCP port is used by BGP to establish communication between peers?

Accepted Answer

TCP 179. BGP operates over TCP port 179.

Answer

UDP 520

Answer

TCP 80

Answer

TCP 500

Question 18

Which Junos configuration statement defines the destination address of a GRE tunnel?

Accepted Answer

destination . On Junos, the GRE tunnel destination is configured with the 'destination ' statement under the tunnel interface unit hierarchy, for example 'set interfaces gr-0/0/0 unit 0 tunnel destination 203.0.113.2'. This statement specifies the remote endpoint IP address to which the GRE-encapsulated packets are sent.

Answer

remote-endpoint <ip-address>

Answer

peer-address <ip-address>

Answer

tunnel-destination <ip-address>

Question 19

Which CLI command displays the operational status and roles of all members in a Juniper EX Series Virtual Chassis?

Accepted Answer

show virtual-chassis. The 'show virtual-chassis' command displays the role (Master, Backup, Linecard) of each member.

Answer

show chassis vcp

Answer

show lacp virtual-chassis

Answer

show vrrp chassis

Question 20

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

Accepted Answer

Storm control. Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Answer

MACsec

Answer

Dynamic ARP Inspection

Answer

Port security