JNCIS-ENT Practice Test 22 — 15 Questions

Question 1

In a multi-access network, which PDU is responsible for the DIS election?

Accepted Answer

IIH PDU. The IIH (IS-IS Hello) PDU contains the priority field used for DIS election on broadcast segments.

Answer

CSNP

Answer

LSP

Answer

PSNP

Question 2

Which TWO parameters are included when a Junos switch calculates the MST configuration digest? (Choose two.)

Accepted Answer

Revision number. The MST configuration digest is an MD5 hash computed from the MST configuration identifier, which consists of exactly three elements: the configuration name, the revision level (revision number), and the VLAN-to-MSTI mapping table. Option B, the revision number, is correct because it is one of the three components fed into the digest calculation. Option D, the configuration name, is also correct because the 32-character configuration name is likewise part of the MST configuration identifier hashed into the digest. Options A, C, and E are incorrect: bridge priority of Instance 0, the system MAC address, and the hello timer interval are not part of the MST configuration identifier and therefore are not included in the digest computation.

Answer

Bridge priority of Instance 0

Answer

System MAC address

Answer

Hello timer interval

Question 3

You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?

Accepted Answer

Clients are using statically assigned IP addresses that do not exist in the DHCP snooping binding database.. Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding database. An 'invalid-ip' drop means the source IP in the ARP packet does not match any entry in the binding table for that MAC/VLAN/interface. This occurs when clients use statically assigned IP addresses that were never learned via DHCP snooping, so no binding exists and DAI drops the ARP as untrusted.

Answer

The uplink port connecting to the default gateway is missing the 'set protocols arp-inspection trust' statement.

Answer

MAC limiting has tripped on the access port, causing ARP packets to be discarded.

Answer

The ARP inspection rate-limit has been exceeded on the access ports.

Question 4

When troubleshooting a non-functional GRE tunnel on a Junos device, which TWO operational commands or verification steps are most effective for diagnosing the root cause? (Choose two)

Accepted Answer

Verify that the routing table has an active path to the remote tunnel destination IP address.. Option A is correct because a GRE tunnel cannot come up unless the transport (underlay) network provides a reachable route to the remote tunnel endpoint; verifying an active path to the remote tunnel destination IP in the routing table (e.g., via 'show route <remote-endpoint>') confirms the tunnel source can reach the tunnel destination, which is a prerequisite for GRE encapsulation to succeed. Option D is correct because 'show interfaces gr-0/0/0 extensive' reveals the tunnel interface's operational state, error counters, input/output drops, and the configured source/destination addresses, allowing you to confirm the tunnel endpoints are correctly configured and whether traffic is being dropped or encapsulated improperly. Option B is incorrect because 'clear gre statistics' merely resets counters and does not restart any encapsulation engine, so it does not diagnose the root cause. Option C is incorrect because GRE is a stateless, non-resource-reserving protocol and does not use RSVP bandwidth reservations, which apply to MPLS TE tunnels. Option E is incorrect because BGP AS paths are unrelated to GRE tunnel IDs, and no such matching requirement exists for GRE tunnel operation.

Answer

Execute 'clear gre statistics' to restart the tunnel encapsulation engine.

Answer

Check that the RSVP bandwidth reservation is set to 100% on the tunnel interface.

Answer

Verify that the BGP AS path matches the tunnel ID.

Question 5

Which THREE actions occur when a BGP speaker receives a Notification message from a peer? (Choose three.)

Accepted Answer

The TCP connection associated with the BGP session is closed.. When a BGP speaker receives a Notification message, it treats this as a fatal error condition for the session. Option C is correct because the BGP speaker closes the underlying TCP connection (port 179) that carries the BGP session, since the Notification signals an unrecoverable error. Option D is correct because the BGP Finite State Machine transitions the session to the Idle state after the TCP connection is torn down, where it waits for the ConnectRetry timer before attempting to re-establish. Option E is correct because all routes previously learned from that specific peer are withdrawn and removed from the BGP routing table (Adj-RIB-In and Loc-RIB), since the peer is no longer considered a valid source. Option A is incorrect because Keepalive messages are only sent periodically (default 60 seconds) to maintain an established session, not to acknowledge errors; Notifications themselves terminate the session. Option B is incorrect because re-establishment does not happen automatically or immediately—the router must wait for the ConnectRetry timer (default 120 seconds) before attempting a new TCP connection.

Answer

A Keepalive message is immediately sent in response to acknowledge the error.

Answer

The peer router automatically re-establishes the connection without applying the connect retry timer.

Question 6

You are running BGP between two routers. One router has a 4-byte ASN (e.g., ASN 65536). The remote router only supports 2-byte ASNs. How does BGP handle this compatibility issue?

Accepted Answer

The router uses the reserved AS 23456 (AS_TRANS) in place of the 4-byte ASN for legacy peers.. When a BGP speaker with a 4-byte ASN peers with a legacy 2-byte-only router, BGP uses the reserved AS number 23456 (AS_TRANS) in the AS_PATH for the legacy peer. The 4-byte ASN is carried in a separate AS4_PATH attribute, and the legacy router sees AS_TRANS as a placeholder, preserving compatibility.

Answer

The session fails to open because 4-byte ASNs are strictly incompatible with 2-byte peers.

Answer

The session establishes as iBGP instead of eBGP.

Answer

The 4-byte ASN is truncated to 2 bytes by dropping the most significant bits.

Question 7

When configuring a GRE tunnel on Junos, which two parameters are mandatory under the specific gr- interface hierarchy to establish the tunnel endpoint connectivity?

Accepted Answer

tunnel source and tunnel destination. A GRE tunnel requires at least a source address and a destination address to define the tunnel endpoints.

Answer

tunnel key and tunnel checksum

Answer

tunnel metric and tunnel preference

Answer

tunnel bandwidth and tunnel delay

Question 8

An enterprise network runs OSPF across multiple areas. A Junos routing device receives an LSA with an aging timer approaching MaxAge (3600 seconds). Under what condition does a router purge or flush an LSA from its link-state database?

Accepted Answer

When the LSA reaches 3600 seconds (MaxAge) and is flooded across the area to flush it. An LSA is purged or flushed from the link-state database when it reaches MaxAge (3600 seconds). At that point, the router floods the LSA with the MaxAge timer set across the area to ensure all routers remove it from their databases. This is part of OSPF's aging mechanism to remove stale LSAs.

Answer

When the SPF algorithm recalculates the routing table

Answer

When a hello packet is missed three times consecutively

Answer

When the OSPF dead timer expires on the local interface

Question 9

You are tasked with tuning OSPF convergence times on a Juniper EX Series switch. Which configuration command hierarchy allows you to modify the OSPF Hello and Dead intervals on a specific interface?

Accepted Answer

set protocols ospf area interface hello-interval . On Junos, OSPF interface timers are configured under the '[edit protocols ospf area interface ]' hierarchy. The 'hello-interval' and 'dead-interval' commands modify the Hello and Dead timers for that specific interface, allowing per-interface tuning for faster convergence.

Answer

set routing-options ospf interface interval

Answer

set interfaces unit 0 family inet ospf hello-timer

Answer

set system ospf interface timer hello

Question 10

An engineer configures multiple static routes to the same destination with different preference values. When all paths are up, how does Junos select which route is active in the routing table?

Accepted Answer

The route with the lowest preference value is installed as active.. Junos uses route preference (also called administrative distance) to select the active route when multiple routes to the same destination exist. Lower preference values are preferred, so a static route with preference 5 beats one with preference 10. Only the route with the lowest preference is installed as active in the routing table and subsequently into the forwarding table (unless ECMP conditions apply).

Answer

The route configured last in the candidate configuration file becomes active.

Answer

The route with the highest metric value is preferred.

Answer

All routes are installed into the forwarding table for equal-cost multi-path load balancing.

Question 11

An engineer is deploying Private VLANs on an EX Series switch and needs to verify proper operational status and traffic isolation. Which THREE tasks or verification checks should be performed? (Choose three.)

Accepted Answer

Run 'show vlans extensive' to inspect PVLAN port mappings and roles.. Option B is correct because on EX Series switches the 'show vlans extensive' command displays the PVLAN configuration details, including which ports are mapped as promiscuous, isolated, or community members, making it the right verification step for operational status. Option C is correct because a Private VLAN requires the primary VLAN to be explicitly associated with its secondary isolated and community VLANs; without this association, traffic cannot be properly mapped and isolation behavior fails. Option D is correct because the defining behavior of an isolated PVLAN port is that it can communicate only with the promiscuous port (and its uplink), so testing that isolated ports reach only the designated promiscuous port verifies correct traffic isolation. Option A is incorrect because isolated ports must NOT be able to send traffic to other isolated ports within the same secondary VLAN — that would indicate a misconfiguration. Option E is incorrect because routing instances operate at Layer 3 and would not enable Layer 2 inter-isolated communication; PVLAN isolation is a Layer 2 construct and isolated ports are intentionally prevented from communicating with each other.

Answer

Verify that isolated ports can successfully send traffic to other isolated ports within the same secondary VLAN.

Answer

Configure routing instances on all isolated ports to enable inter-isolated communication at Layer 2.

Question 12

An administrator needs to delete an entire VLAN configuration named 'guest' along with its VLAN ID and associated properties. Which configuration command should be executed?

Accepted Answer

delete vlans guest. The correct command to delete an entire VLAN configuration, including its VLAN ID and associated properties, is 'delete vlans guest'. In Junos, the 'delete' command removes the specified configuration hierarchy or identifier from the candidate configuration. When applied to 'vlans guest', it removes the entire VLAN definition named 'guest' from the configuration. This is the standard way to remove a VLAN in Junos.

Answer

clear vlans guest

Answer

destroy vlans guest

Answer

remove vlans guest

Question 13

You are troubleshooting a VRRP deployment where two EX4600 switches are acting as redundant gateways for several VLANs. Clients on VLAN 10 report intermittent gateway unreachability. You notice that VRRP mastership frequently flips between Switch A and Switch B. What is the most effective way to stabilize VRRP mastership?

Accepted Answer

Review interface error counters, ensure physical link stability, and increase the VRRP advertisement interval if transient congestion is dropping packets.. Frequent VRRP mastership flips are almost always caused by missed advertisements due to physical link instability or transient congestion. Reviewing interface error counters and increasing the VRRP advertisement interval (if congestion is dropping packets) stabilizes mastership without altering priority. This addresses the root cause rather than masking it with unrelated features.

Answer

Configure all member ports in the LAG to use static mode.

Answer

Disable Virtual Chassis on both switches.

Answer

Remove GRES from the routing engine configuration.

Question 14

Which TWO items are required when configuring VRRP on a Juniper router interface? (Choose two)

Accepted Answer

At least one virtual IP address configured to act as the default gateway for clients.. Option A is correct because VRRP requires at least one virtual IP address on the interface, which serves as the shared default gateway that hosts on the subnet point to; the master router owns this VIP and answers ARP for it. Option B is correct because a Virtual Router Identifier (VRID) is mandatory to identify the VRRP group; it is an integer (1–255) configured under the interface's vrrp-group stanza and must match across all routers participating in the same virtual router. Option C is wrong because VRRP is a first-hop redundancy protocol that operates independently of BGP, so no static BGP peering is needed. Option D is wrong because GRES (Graceful Routing Engine Switchover) is an optional high-availability feature for dual Routing Engines and is not a VRRP configuration requirement. Option E is wrong because VRRP can run on a physical interface or any logical interface and does not require an LACP aggregated Ethernet bundle.

Answer

A static BGP peering session to an upstream provider.

Answer

A pre-configured GRES license on the Routing Engine.

Answer

An active LACP aggregated Ethernet bundle.

Question 15

How does an IS-IS router identify the DIS in its hello packets?

Accepted Answer

By the router's System ID followed by a non-zero pseudonode ID.. The DIS is identified by the System ID and a pseudonode number (the 7th byte of the LSP ID).

Answer

By a special flag in the header.

Answer

By the area address.

Answer

By the MAC address only.