JNCIS-ENT Practice Test 2 — 25 Questions

Question 1

Which protocol number is used in the outer IP header for an IP-IP tunnel?

Accepted Answer

4. IP-IP tunneling (RFC 2003) encapsulates an inner IP packet inside an outer IP header with the protocol field set to 4, which is the IANA-assigned protocol number for IP-in-IP encapsulation. This is distinct from GRE (protocol 47), TCP (6), and UDP (17), making 4 the correct answer for IP-IP tunnels.

Answer

47

Answer

6

Answer

17

Question 2

An engineer configures an aggregate route for 172.16.0.0/16 on a Junos device. However, the aggregate route is not active in the routing table. What is the primary requirement for an aggregate route to become active?

Accepted Answer

At least one more-specific contributing route must exist in the routing table.. A Junos aggregate route becomes active only when at least one more-specific contributing route exists in the routing table. The aggregate is generated as a discard route (or with a configured next-hop) and is installed only if a longer-prefix route covered by the aggregate is present.

Answer

An explicit static route matching the aggregate prefix must be configured.

Answer

A discard policy must be explicitly defined under the aggregate route definition.

Answer

The aggregate route must be redistributed using BGP or OSPF.

Question 3

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Accepted Answer

DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.. IP Source Guard (IPSG) relies on the DHCP snooping binding table to validate source IP and MAC addresses on untrusted ports. If DHCP snooping is not enabled on the VLAN, the binding table is not populated, so IPSG has no entries to permit and drops all traffic. The root cause is that DHCP snooping was not enabled on the corresponding VLAN.

Answer

IP Source Guard requires static ARP inspection to be enabled simultaneously.

Answer

The client's MAC address is in the port security violation log.

Answer

IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

Question 4

An administrator is configuring VLANs on a Junos EX Series switch. Which TWO tasks must be performed to successfully assign a physical interface as an access port for a newly created VLAN? (Choose two.)

Accepted Answer

Configure the interface mode as access under [edit interfaces unit 0 family ethernet-switching].. Option E is correct because a VLAN must first exist in the configuration before an interface can be assigned to it; on Junos EX switches you create it under [edit vlans] with a name and a vlan-id (e.g., set vlans SALES vlan-id 100). Option D is correct because the physical port is made an access port by setting the interface mode to access under [edit interfaces unit 0 family ethernet-switching], which places untagged traffic from that port into the specified VLAN. Spanning tree (option A) is not required to make a VLAN active, and it is enabled by default on EX switches anyway. Option B is wrong because an access port carries Layer 2 traffic in family ethernet-switching; assigning family inet and an IP address is for a routed/Layer 3 interface, not a switched access port. Option C is wrong because trunk mode with native-vlan-id is used for carrying multiple VLANs (802.1Q tagging), not for assigning a single access VLAN to a physical interface.

Answer

Enable spanning-tree protocol globally for the access VLAN to become active.

Answer

Configure the interface family as inet and assign an IP address.

Answer

Configure the interface as a trunk port with native-vlan-id enabled.

Question 5

While examining an RSTP topology, you notice that a designated port has suddenly stopped receiving BPDUs from its upstream neighbor, causing the port to transition into a discarding state to prevent potential loops. Which feature is actively providing this protection?

Accepted Answer

Loop protection. Loop protection is the RSTP feature designed to prevent loops on designated ports that stop receiving BPDUs from their upstream neighbor. When a designated port no longer receives BPDUs, it would normally age out and potentially cause a loop; loop protection detects this condition and places the port into a discarding state (or blocks it) to prevent the loop. This matches the scenario exactly.

Answer

Root protection

Answer

BPDU guard

Answer

TC protection

Question 6

An engineer is configuring static routes in Junos OS and wants to ensure high availability. Which TWO features can be implemented with static routes to achieve path redundancy? (Choose two)

Accepted Answer

Qualified next-hop with varying preference values. Option A (Qualified next-hop with varying preference values) is correct because Junos static routes support multiple qualified next-hops, each with its own preference; if the primary next-hop fails, the route with the next-lower preference becomes active, providing path redundancy. Option D (Recursive next-hop tracking via RPM or routing table lookups) is correct because a static route can resolve its next-hop recursively, and RPM (Real-time Performance Monitoring) probes or routing-table lookups can detect when the resolved next-hop becomes unreachable, allowing the route to be withdrawn or replaced. Option B (IGMP snooping) is a Layer 2 multicast optimization and does not provide static-route path redundancy. Option C (OSPF area stubbing) is a dynamic routing design technique for reducing LSAs, not a static-route feature. Option E (BGP AS-path prepending) is a BGP path-manipulation tool and cannot be applied to plain static routes.

Answer

IGMP snooping on static interfaces

Answer

OSPF area stubbing

Answer

BGP AS-path prepending on static routes

Question 7

Which operational command displays the configured member IDs, priorities, and roles in an EX Series Virtual Chassis?

Accepted Answer

show virtual-chassis. The 'show virtual-chassis' command displays member IDs, roles, priorities, and serial numbers.

Answer

show lacp aggregated-devices

Answer

show chassis alarms

Answer

show vrrp mastership

Question 8

Which command allows you to inspect the active forwarding table entries and verify next-hops on a Junos router?

Accepted Answer

show route forwarding-table. 'show route forwarding-table' displays the active forwarding table entries that the Packet Forwarding Engine (PFE) actually uses to forward packets, including next-hop information. This is the command that verifies what the router is really doing at the forwarding plane, not just what the routing protocol advertised.

Answer

show interfaces extensive

Answer

show pfe traffic

Answer

show routing-engine status

Question 9

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Accepted Answer

Multicast traffic rate exceeding the configured threshold. Storm control on a switch interface monitors Layer 2 traffic rates and drops frames when a configured threshold is exceeded, and it applies to broadcast, multicast, and unknown unicast traffic. Option A is correct because multicast traffic exceeding the configured threshold is one of the traffic types storm control polices, so it triggers drops. Option D is correct because broadcast traffic exceeding the configured threshold is the classic storm control trigger, suppressing broadcast storms on the interface. Option B is wrong because unicast destined for known active MAC addresses is normal, expected forwarding traffic and is not counted by storm control (only unknown unicast is). Option C is wrong because CPU control plane queue utilization is a control-plane policing concern, not an interface storm control action. Option E is wrong because BPDUs are control frames handled by Spanning Tree, not storm-control-monitored data traffic.

Answer

Unicast traffic destined for known active MAC addresses exceeding average utilization

Answer

CPU control plane queue utilization exceeding 90%

Answer

BPDU control frames exceeding Spanning Tree hello timers

Question 10

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

Accepted Answer

GCM-AES-128. When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Answer

AES-CBC-128

Answer

SHA-256-HMAC

Answer

GCM-AES-256

Question 11

Which Junos command displays detailed information about OSPF neighbor states, including dead timer countdowns and address bindings?

Accepted Answer

show ospf neighbor detail. The command 'show ospf neighbor detail' displays comprehensive information about each OSPF neighbor, including neighbor state (Full, 2-Way, etc.), neighbor ID, interface address, dead timer countdown, and area. This is the go-to command for verifying adjacency health and troubleshooting OSPF neighbor issues on Junos devices.

Answer

show ospf statistics

Answer

show route table inet.0

Answer

show ospf database detail

Question 12

During the establishment of an OSPF adjacency, two routers exchange Database Description (DBD) packets. What is the primary purpose of the DBD packet exchange in the OSPF protocol sequence?

Accepted Answer

To synchronize link-state database summaries between neighbors. The DBD (Database Description) packet exchange is the second stage of OSPF adjacency formation, after Hello packets establish bidirectional communication. Its purpose is to exchange summary headers of each router's link-state database so both routers can determine which LSAs they are missing and need to request via Link-State Request packets. This synchronization ensures both neighbors have an identical view of the topology before entering the Full state.

Answer

To discover directly connected neighbors on a shared segment

Answer

To request specific missing LSAs from a neighbor's database

Answer

To explicitly acknowledge the receipt of specific LSA updates

Question 13

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

Accepted Answer

family inet6. The GRE tunnel is being used to carry IPv6 traffic, so the logical unit must be configured with family inet6 to process IPv6 packets. The transport is IPv4, but that is handled by the tunnel's source/destination addresses configured under the tunnel parameters, not by the unit's family. Configuring family inet6 on the gr- interface unit enables IPv6 forwarding, addressing, and protocol processing inside the tunnel.

Answer

family inet

Answer

family iso

Answer

family mpls

Question 14

What is the default bridge priority value assigned to Juniper EX Series switches when RSTP is enabled?

Accepted Answer

32768. Juniper EX Series switches use the IEEE 802.1D/802.1w default bridge priority of 32768 when RSTP is enabled. Bridge priority is a 16-bit value expressed in increments of 4096, and 32768 is the midpoint of the range, making it the standard default across vendors. The bridge with the lowest priority (and then lowest MAC) becomes root.

Answer

61440

Answer

0

Answer

4096

Question 15

What is the primary benefit of enabling edge port configuration on switch access ports connected to end devices?

Accepted Answer

It allows the port to transition immediately to the forwarding state, avoiding startup delays.. Enabling edge port configuration on switch access ports connected to end devices allows the port to transition immediately to the forwarding state, bypassing the listening and learning states of STP/RSTP. This avoids startup delays (up to 30 seconds with classic STP) and improves convergence for end-user devices. Edge ports are also known as PortFast in Cisco terminology.

Answer

It forces the port to operate exclusively in full-duplex mode.

Answer

It increases the interface bandwidth by disabling spanning tree calculations entirely.

Answer

It enables automatic detection of unauthorized rogue bridges on access links.

Question 16

An administrator needs to create a VLAN named 'voice' with a VLAN ID of 50 on a Junos EX Series switch. Which configuration path achieves this?

Accepted Answer

set vlans voice vlan-id 50. On Junos EX Series switches, VLANs are configured under the [edit vlans] hierarchy with the syntax 'set vlans vlan-id '. This creates a VLAN named 'voice' with VLAN ID 50, which can then be associated with access or trunk interfaces.

Answer

set ethernet-switching-options vlans voice id 50

Answer

set bridge-domains voice vlan-id 50

Answer

set interfaces vlan unit 50 name voice

Question 17

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed information about the GRE tunnel interface, including the configured source and destination addresses. The 'extensive' option provides additional parameters beyond the basic interface status, such as tunnel source, destination, and other GRE-specific settings. This is the standard Junos command to verify tunnel configuration parameters on a specific interface.

Answer

show route protocol gre

Answer

show system tunnel-info

Answer

show chassis hardware

Question 18

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Accepted Answer

A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.. Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Answer

The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

Answer

The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

Answer

DHCP snooping is blocking the MACsec control frames on the transit link.

Question 19

What is the role of the Root Port in an RSTP topology?

Accepted Answer

It provides the lowest-cost path from a non-root switch to the root bridge.. The Root Port in RSTP is the port on a non-root switch that provides the lowest-cost path to the root bridge. It is the port through which the switch sends traffic toward the root and receives traffic from the root. Each non-root switch has exactly one root port, which is elected based on path cost, sender bridge ID, sender port ID, and local port ID.

Answer

It forwards traffic between two different MST regions.

Answer

It connects the root bridge to all downstream non-root switches.

Answer

It serves as the backup forwarding path when the designated port fails.

Question 20

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Accepted Answer

DHCP snooping. DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks. OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Answer

OSPFv3 authentication

Answer

MACsec point-to-point encryption