JNCIS-ENT Practice Test 21 — 15 Questions

Question 1

Which command is used on a Junos device to clear the OSPF database and force a re-synchronization with neighbors?

Accepted Answer

clear ospf database. The 'clear ospf database' command clears the OSPF link-state database and forces the router to re-synchronize with its neighbors by re-exchanging LSAs. This is used to recover from database corruption or to force a refresh. It does not reset the OSPF process itself.

Answer

restart ospf-protocol

Answer

clear ospf neighbor

Answer

reset routing-protocol ospf

Question 2

Which TWO commands are valid Junos configuration hierarchy paths for setting up RSTP? (Choose two.)

Accepted Answer

set protocols rstp bridge-priority 4096. Option C is correct because under the Junos RSTP hierarchy, the bridge priority is configured with 'set protocols rstp bridge-priority 4096', which sets the bridge priority value used in RSTP root election. Option D is correct because 'set protocols rstp interface ge-0/0/1.0 edge' is a valid Junos RSTP interface-level command that marks the specified interface as an edge port, allowing it to transition immediately to forwarding. Option A is not valid because 'bridge rstp mode rapid-pvst' is not a Junos configuration path and mixes Cisco-style syntax. Option B is not valid because 'set protocols stp rstp-version true' is not a Junos command; RSTP is enabled under 'protocols rstp', not via an 'rstp-version' boolean under 'protocols stp'. Option E is not valid because 'set spanning-tree rstp enable' is not Junos syntax; Junos uses the 'protocols rstp' hierarchy rather than a 'spanning-tree' stanza.

Answer

set bridge rstp mode rapid-pvst

Answer

set protocols stp rstp-version true

Answer

set spanning-tree rstp enable

Question 3

An administrator notices that CPU utilization on the Routing Engine spikes when a high volume of transit traffic is directed through a locally terminated GRE tunnel on an MX router without inline services configured. What is the cause?

Accepted Answer

Tunnel encapsulation/decapsulation is falling back to Routing Engine CPU processing due to missing inline services PIC configuration.. On MX routers, GRE tunnel encapsulation and decapsulation are normally handled by inline services (such as the MS-MPC or MS-DPC) in hardware. Without inline services configured, the RE (Routing Engine) must perform the encapsulation/decapsulation in software, which drives up CPU utilization when transit traffic is tunneled.

Answer

GRE keepalives are transmitting every 1 millisecond.

Answer

IP-IP tunnels require software processing, whereas GRE is always hardware-switched.

Answer

The firewall filter logging feature is active on all tunnel interfaces.

Question 4

Which CLI command is used to manually initiate a Routing Engine switchover on an MX series router configured with GRES?

Accepted Answer

request chassis routing-engine master switch. The 'request chassis routing-engine master switch' command forces a manual switchover from the primary to the backup Routing Engine.

Answer

restart routing-engine backup

Answer

request system reboot backup

Answer

set chassis routing-engine switchover

Question 5

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

Accepted Answer

Configure the filter action as 'discard' for the broadcast term.. Option C is correct because a Layer 2 firewall filter term that should silently drop broadcast traffic must use the 'discard' action, which drops the matching frames without sending any ICMP or TCP reset response. Option D is correct because Layer 2 firewall filters on switches are defined and applied under the 'family ethernet-switching' hierarchy, not under 'family inet', which is for Layer 3 IPv4 filters. Option E is correct because broadcast Ethernet frames are identified by the destination MAC address ff:ff:ff:ff:ff:ff, so a match condition on that address is required to select broadcast packets while leaving unicast frames unmatched and permitted. Option A is incorrect because router-advertisement snooping is an IPv6/ND feature unrelated to matching and dropping Layer 2 broadcast frames. Option B is incorrect because applying the filter under 'family inet' would make it an IPv4 Layer 3 filter, which cannot match Ethernet MAC addresses or operate on an access VLAN's Layer 2 traffic.

Answer

Enable active router-advertisement snooping to support the filter.

Answer

Apply the filter under the 'family inet' routing protocol hierarchy.

Question 6

While examining a BGP routing table, you notice a route with an ORIGIN attribute set to 'Incomplete'. What does this indicate about the origin of the route?

Accepted Answer

The route was injected into BGP via redistribution (e.g., from static or IGP).. BGP origin types are IGP (0), EGP (1), and Incomplete (2). Incomplete means the route origin is unknown, typically redistributed from an IGP or static route.

Answer

The route was learned via eBGP from an unknown AS.

Answer

The BGP update packet was corrupted in transit.

Answer

The route is an aggregate route without specific components.

Question 7

An enterprise network uses private VLANs. A server connected to an isolated port needs to send traffic out of the primary VLAN. Which statement accurately describes how traffic forwarding operates for an isolated port in Junos?

Accepted Answer

Traffic from an isolated port can only be forwarded to the designated promiscuous port.. In a private VLAN (PVLAN) configuration, an isolated port can only communicate with the promiscuous port. Traffic from an isolated port is forwarded to the promiscuous port, which then routes or bridges it to the primary VLAN. Isolated ports cannot communicate with each other or with community ports, ensuring strict Layer 2 isolation.

Answer

Traffic from an isolated port can reach other isolated ports within the same secondary VLAN.

Answer

Isolated ports can communicate freely with community ports, but not other isolated ports.

Answer

Traffic from an isolated port is dropped unless a Layer 3 firewall filter explicitly permits it.

Question 8

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Accepted Answer

It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.. Option B is correct because DHCP snooping builds and maintains a binding table by snooping DHCP DISCOVER/REQUEST and OFFER/ACK exchanges, recording the client MAC address, leased IP address, VLAN, and the ingress switch port (interface) for each binding. Option C is correct because switch ports that connect toward legitimate DHCP servers (or uplinks toward them) must be manually configured as trusted; otherwise their server messages would be filtered. Option D is correct because on untrusted ports DHCP snooping drops server-to-client messages such as DHCPOFFER and DHCPACK (and NAK), preventing rogue DHCP servers from handing out addresses to clients. Option A is not correct because IP Source Guard depends on the DHCP snooping binding table, not the reverse — snooping populates the table independently, and IP Source Guard is not a prerequisite. Option E is not correct because DHCP snooping works by inspecting live DHCP packet flows, not by analyzing static ARP entries.

Answer

It requires IP Source Guard to be enabled before the binding table can be populated.

Answer

It operates exclusively by analyzing static ARP entries configured by administrators.

Question 9

An administrator is configuring VRRP on an EX4300 switch and wants to ensure that when the primary router recovers from a failure, it immediately reclaims the master role from the backup router. Which VRRP configuration parameter controls this behavior?

Accepted Answer

The preemption parameter (enabled by default), which allows a higher-priority router to preempt the current master.. Preemption is enabled by default in Junos VRRP, allowing a higher-priority router to take over when it comes back online.

Answer

The tracking decrement value set to zero.

Answer

The virtual-mac-address configuration statement.

Answer

The advertisement interval timer set to 1 millisecond.

Question 10

You are troubleshooting an aggregate route that is not being advertised to BGP peers. You verify that contributing routes are active in the routing table. What command should you use to check if the aggregate route itself is successfully generated and active in the local routing table?

Accepted Answer

show route protocol aggregate. The command 'show route protocol aggregate' displays all routes in the routing table that were learned via the aggregate protocol. This allows you to verify if the aggregate route is active and installed. If the aggregate is not shown, it means it is not active, likely due to no contributing routes. The other commands are either invalid or do not show the aggregate route in the local routing table.

Answer

show route summary aggregate

Answer

show bgp aggregate-routes

Answer

show routing-options aggregate detail

Question 11

An administrator configures root protection on a designated port. If that port subsequently receives a superior BPDU from another switch, what exact state does the port transition into?

Accepted Answer

Root-inconsistent (discarding) state. When root protection is configured on a designated port and that port receives a superior BPDU, the port is placed into the root-inconsistent (discarding) state rather than being error-disabled. This prevents the port from becoming a root port and preserves the intended root bridge placement.

Answer

Alternate port state

Answer

Error-disabled state

Answer

Listening state

Question 12

Which TWO port roles are defined in Rapid Spanning Tree Protocol (RSTP) but did not exist in legacy 802.1D STP? (Choose two.)

Accepted Answer

Backup port. RSTP (IEEE 802.1w) introduced two new port roles that did not exist in legacy 802.1D STP: the Alternate port (option E) and the Backup port (option C). An Alternate port is a discarding port that receives superior BPDUs from another bridge and serves as an immediate replacement for the Root port if it fails, while a Backup port is a discarding port that receives superior BPDUs from its own bridge (a redundant connection to the same shared segment) and can immediately replace a Designated port. Both roles enable RSTP's rapid failover by allowing pre-computed, ready-to-use backup paths instead of waiting for STP timers. The other options are not new to RSTP: Root port (B) and Designated port (D) are the two forwarding roles already defined in 802.1D STP, and Master port (A) is a role specific to Multiple Spanning Tree Protocol (MSTP, 802.1s) used on boundary ports toward the Common Spanning Tree region, not a role introduced by RSTP.

Answer

Master port

Answer

Root port

Answer

Designated port

Question 13

You notice that an access switch running RSTP is continually dropping user traffic because a connected end-user device is sending inferior BPDUs that trigger topology changes. Which Juniper feature should you configure on the access ports to protect against this behavior?

Accepted Answer

set protocols rstp interface ge-0/0/1.0 bpdu-protection. BPDU protection is the Juniper RSTP feature designed to shut down (or disable) an edge/access port if it receives a BPDU. Since end-user devices should never send BPDUs, receiving one indicates a rogue switch or misconfigured device. When bpdu-protection is enabled on the access interface, the port is immediately disabled (error-disabled) upon receiving a BPDU, preventing the inferior BPDU from triggering topology changes and disrupting user traffic.

Answer

set protocols rstp interface ge-0/0/1.0 loop-protection

Answer

set protocols rstp interface ge-0/0/1.0 root-protection

Answer

set protocols rstp interface ge-0/0/1.0 no-root-port

Question 14

An EX4300 Virtual Chassis experiences a split-brain condition due to a failure of all stacking cables between members 0/1 and members 2/3. How does Junos handle this scenario by default?

Accepted Answer

Each partition elects its own primary routing engine if dual primary detection is not enabled, leading to potential duplicate IP scenarios.. By default, when a Virtual Chassis splits into two partitions due to stacking cable failure, each partition elects its own primary Routing Engine if dual primary detection is not enabled. This leads to two active primaries, causing potential duplicate IP addresses and network instability. Junos does not automatically shut down interfaces or reboot the entire VC.

Answer

All member switches across both partitions automatically shut down all data interfaces to prevent loops.

Answer

The backup routing engine instantly shuts down its control plane daemon permanently.

Answer

The entire Virtual Chassis reboots simultaneously until stacking cables are re-seated.

Question 15

An EX Series switch running MSTP receives a BPDU from an upstream switch in a different MST region. How does the receiving switch identify the boundary between the two regions?

Accepted Answer

By comparing the received MST configuration digest and region parameters with its own.. MSTP (IEEE 802.1s) identifies region boundaries by comparing the MST Configuration Identifier carried in BPDUs, which consists of the configuration name, revision level, and a 16-byte configuration digest computed via HMAC-MD5 over the VLAN-to-instance mapping. If any of these parameters differ from the local switch's own MST configuration, the receiving switch treats the port as a boundary port and interoperates with the neighbor using CIST (MST instance 0) rather than a shared MSTI. This is why option C is correct — the digest and region parameters are the definitive boundary markers.

Answer

When the incoming BPDU contains an instance count greater than the local switch capacity.

Answer

When the CIST external path cost exceeds the maximum hop count.

Answer

By detecting a mismatch in the system MAC address of the root bridge.