JNCIS-ENT Practice Test 24 — 15 Questions

Question 1

You have an EX Series switch running RSTP. You notice that a port connected to a server is flapping between forwarding and discarding states. The server NIC is configured for teaming but is not sending BPDUs. You have configured the port as an edge port using 'set protocols rstp interface ge-0/0/5 edge'. However, the port still flaps. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The physical link is flapping, causing RSTP to transition the port.. The most likely cause is a flapping physical link. Edge port configuration prevents RSTP from expecting BPDUs, but it does not prevent state changes due to link up/down events. If the link is unstable, the port will transition between discarding and forwarding. Checking interface statistics for link flaps would confirm. Other options are less likely because edge is supported, and the server is not sending BPDUs.

Answer

The edge port configuration is not supported on EX Series switches running RSTP.

Answer

The server is sending BPDUs, causing the edge port to revert to a non-edge port.

Answer

The port is configured as an edge port but is receiving BPDUs from another switch on the same segment.

Question 2

You are configuring port security on an EX Series switch. The security policy states that when a MAC limit is exceeded on an access port, the port should be shut down and remain down until manually re-enabled by an administrator. Which configuration action accomplishes this requirement?

Accepted Answer

Configure the interface with 'mac-limit limit 1 action shutdown'.. The 'action shutdown' parameter in the MAC limit configuration causes the interface to be disabled when the configured limit is exceeded. The port remains in a shut down state until an administrator manually intervenes, which aligns with the requirement to keep the port down until manually re-enabled.

Answer

Configure the interface with 'mac-limit limit 1 action none'.

Answer

Configure the interface with 'mac-limit limit 1 action log'.

Answer

Configure the interface with 'mac-limit limit 1 action drop'.

Question 3

You are troubleshooting an OSPF network on Junos devices. A router in area 1 is not receiving external routes from an ASBR in area 0. The ABR connecting the areas is correctly configured. You suspect a problem with LSA flooding. Which LSA type is used by the ASBR to advertise external routes, and what is its flooding scope?

Accepted Answer

Type 5 LSA, flooded throughout the entire OSPF domain except stub areas.. OSPF external routes are advertised by ASBRs using Type 5 LSAs. These LSAs have domain-wide flooding scope, meaning they are propagated through all areas except stub, totally stubby, and NSSA areas. In the scenario, area 1 is a normal area, so the ABR should flood Type 5 LSAs into it. If external routes are missing, possible causes include area type misconfiguration, LSA filtering, or the ABR not generating Type 4 LSAs for the ASBR.

Answer

Type 3 LSA, flooded between areas but not within an area.

Answer

Type 7 LSA, flooded only within an NSSA.

Answer

Type 4 LSA, flooded only within the area where the ASBR resides.

Question 4

You have an EX Series switch running RSTP. You want to configure a port connected to a printer to immediately transition to forwarding without going through the learning state. Which configuration statement should you use?

Accepted Answer

set protocols rstp interface ge-0/0/10 edge. Configuring the port as an edge port with 'set protocols rstp interface ge-0/0/10 edge' allows it to bypass the learning state and immediately forward traffic when the link comes up. This is appropriate for devices like printers that do not participate in spanning tree. Other options do not achieve immediate transition and some are invalid commands.

Answer

set protocols rstp interface ge-0/0/10 priority 0

Answer

set protocols rstp interface ge-0/0/10 cost 0

Answer

set protocols rstp interface ge-0/0/10 no-root-port

Question 5

You are deploying a new access switch in a campus network. The security policy requires that all ARP packets received on untrusted access ports be validated against the DHCP snooping database, and that any ARP packet with an invalid IP-to-MAC binding be dropped and logged. You configure DHCP snooping on VLAN 100 and enable the appropriate feature on the untrusted ports. Which Junos OS feature must you enable to meet the policy requirement?

Accepted Answer

Dynamic ARP Inspection (DAI). Dynamic ARP Inspection is the Junos OS feature designed to validate ARP packets on untrusted access ports by comparing the sender's IP and MAC addresses against the DHCP snooping binding database. When a mismatch occurs, the packet is dropped and logged, directly enforcing the security policy described.

Answer

IP Source Guard

Answer

MAC limiting

Answer

Storm control

Question 6

You are configuring a Private VLAN (PVLAN) on an EX Series switch to isolate hosts within a DMZ segment while allowing them to reach a shared gateway. Which TWO statements correctly describe the behavior of PVLAN port types in this scenario? (Choose two.)

Accepted Answer

Promiscuous ports can communicate with all isolated and community ports, and they typically connect to the gateway or router.. In a PVLAN, promiscuous ports communicate with all isolated and community ports, making them suitable for gateway connections, while community ports communicate with each other and with promiscuous ports but not with isolated ports. Isolated ports communicate only with promiscuous ports. These rules provide granular isolation within a single VLAN, which is ideal for DMZ segments where hosts must reach a shared gateway but not each other.

Answer

Isolated ports can communicate with promiscuous ports and with other isolated ports on the same switch.

Answer

Promiscuous ports can only communicate with isolated ports and not with community ports.

Answer

Isolated ports can communicate with each other and with community ports within the same PVLAN.

Question 7

An EX4300 switch is configured with a trunk port that carries VLAN 10 and VLAN 20. The trunk is connected to a third-party switch that uses a native VLAN of 1 for untagged traffic. You notice that untagged frames from the third-party switch are being dropped on the EX4300. Which configuration change resolves this issue?

Accepted Answer

Configure 'native-vlan-id 1' on the EX4300 trunk port and ensure VLAN 1 is created.. Untagged frames on a trunk are assigned to the native VLAN. The third-party switch uses native VLAN 1, so the EX4300 trunk must be configured with 'native-vlan-id 1' and VLAN 1 must exist. This allows the EX4300 to classify untagged frames into VLAN 1 instead of dropping them. Matching native VLAN IDs on both ends is essential for untagged traffic to traverse the trunk.

Answer

Configure 'vlan members 1' on the EX4300 trunk port in addition to VLAN 10 and VLAN 20.

Answer

Configure 'native-vlan-id 10' on the EX4300 trunk port to match the first VLAN in the trunk.

Answer

Configure 'interface-mode access' on the EX4300 trunk port and assign it to VLAN 1.

Question 8

You are asked to implement a Layer 2 security feature that prevents a user from connecting a small unmanaged switch to an access port and generating traffic from multiple MAC addresses. The solution should limit the number of MAC addresses learned on the port to one. Which Junos OS feature should you configure?

Accepted Answer

MAC limiting. MAC limiting is the Junos OS feature that restricts the number of source MAC addresses that can be learned on an interface. By setting the limit to one, the switch will only allow one MAC address, preventing a user from connecting a switch and using multiple devices on that port.

Answer

DHCP snooping

Answer

Dynamic ARP Inspection

Answer

Storm control

Question 9

An administrator wants to protect against MAC flooding attacks on an EX Series switch access port. The port should learn a maximum of 5 MAC addresses and drop frames with unknown source MAC addresses after that limit is reached. Which feature should be configured?

Accepted Answer

Port security. Port security is the Junos OS feature that restricts the number of MAC addresses that can be learned on an interface. By setting a maximum, the switch drops frames with source MAC addresses beyond the limit, mitigating MAC flooding attacks. Storm control, MACsec, and DHCP snooping serve different purposes and do not provide this specific MAC limiting capability. Port security is configured under the interface with 'mac-limit'.

Answer

Storm control

Answer

DHCP snooping

Answer

MACsec

Question 10

A Juniper router is configured with a BGP peer group that includes multiple neighbors. You want to apply a policy to all neighbors in the group that sets the next-hop to a specific address for all routes received from them. Which configuration statement should you use?

Accepted Answer

Apply an import policy under the group configuration that sets the next-hop to the desired address.. To modify the next-hop for routes received from all neighbors in a BGP group, you apply an import policy at the group level. This policy can match the desired routes and set the next-hop attribute. This approach is efficient and ensures that all neighbors in the group are affected consistently. Export policies and next-hop self are used for outbound advertisements, not for modifying received routes.

Answer

Configure the next-hop self statement under the group.

Answer

Apply an export policy under each neighbor that sets the next-hop to the desired address.

Answer

Use a routing instance to rewrite the next-hop for all BGP routes.

Question 11

You are implementing MACsec on an EX Series switch to secure a point-to-point link between two data centers. The link uses a 10 Gigabit Ethernet interface. You want to ensure that only encrypted traffic is accepted and that unencrypted frames are dropped. Which configuration parameter must be set on the interface?

Accepted Answer

Set the MACsec security mode to 'must-secure'.. MACsec security modes determine how encryption is enforced. The 'must-secure' mode requires all traffic to be encrypted and drops any unencrypted frames. 'should-secure' allows unencrypted traffic if MACsec is not established, and 'no-encrypt' disables encryption. Therefore, 'must-secure' is the only mode that ensures only encrypted traffic is accepted, meeting the scenario's requirement.

Answer

Set the MACsec security mode to 'should-secure'.

Answer

Enable MACsec with the 'no-encrypt' option.

Answer

Configure MACsec with a pre-shared key (PSK) and set the 'replay-protection' window to 0.

Question 12

You are troubleshooting an OSPF adjacency issue on a Junos router. The neighbor state is stuck in 'ExStart'. You have verified that the interfaces are up and IP connectivity exists. Which configuration mismatch is most likely causing this problem?

Accepted Answer

MTU mismatch on the interfaces.. The ExStart state is part of the OSPF database exchange process. During this state, routers negotiate who will be the master and the initial DD sequence number. A common cause of getting stuck in ExStart is an MTU mismatch, because the MTU is carried in DBD packets and must match for successful negotiation. Other mismatches like hello interval, area ID, or authentication would prevent the adjacency from reaching ExStart. In Junos, you can use the mtu-ignore option under the OSPF interface to bypass MTU checking.

Answer

Mismatched OSPF area IDs.

Answer

Mismatched OSPF hello intervals.

Answer

Mismatched OSPF authentication passwords.

Question 13

You are configuring IS-IS on a Juniper router and want to verify the adjacency state with a neighbor. You issue the command 'show isis adjacency'. The output shows the neighbor's system ID, interface, and state as 'Up'. However, you notice that the 'Holdtime' field is decreasing. What does this indicate?

Accepted Answer

The adjacency is stable and hellos are being received.. In IS-IS, the holdtime is the amount of time a router waits for a hello before declaring the adjacency down. The holdtime is reset each time a hello is received. In the 'show isis adjacency' output, the holdtime value decreases as time passes since the last hello, but it will reset when the next hello arrives. This is normal behavior for an 'Up' adjacency. Therefore, a decreasing holdtime indicates that hellos are being received and the adjacency is stable.

Answer

The neighbor is not sending hellos, and the adjacency will soon go down.

Answer

There is an authentication mismatch causing the holdtime to decrease.

Answer

The interface is flapping, causing the holdtime to decrement.

Question 14

You are troubleshooting an RSTP network. You notice that a port on an EX Series switch is flapping between Discarding and Forwarding states. You suspect a BPDU inconsistency. Which command would you use to check for BPDU inconsistencies on the switch?

Accepted Answer

show spanning-tree interface detail. The 'show spanning-tree interface detail' command gives comprehensive per-interface information, including BPDU inconsistencies that can cause port state flapping. Other commands provide statistics or general status but lack the specific inconsistency details needed for this troubleshooting scenario.

Answer

show spanning-tree statistics

Answer

show spanning-tree bridge

Answer

show spanning-tree interface

Question 15

You are configuring VRRP on an EX4300 switch acting as the master for VLAN 100. You want the master to immediately relinquish its role if its uplink toward the core fails, so that the backup can take over without waiting for the default VRRP advertisement timer to expire. Which VRRP feature should you configure?

Accepted Answer

Interface tracking with a decrement value on the uplink interface. Interface tracking ties the VRRP master's priority to the health of another interface, such as the uplink to the core. When that interface goes down, the priority is decremented; if it drops below the backup's priority, the backup immediately preempts. This produces fast, deterministic failover based on the actual failure condition instead of waiting for advertisement timeouts.

Answer

Authentication using a simple text password shared by the VRRP group

Answer

A shorter VRRP advertisement interval of 1 second on all group members

Answer

Preempt mode with a zero preemption hold time