JNCIS-ENT Practice Test 3 — 25 Questions

Question 1

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Accepted Answer

Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.. Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network. Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Answer

Disabling all Layer 2 learning on the translation interface.

Answer

Enabling OSPFv3 routing directly on the customer edge interface unit 0.

Question 2

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

Accepted Answer

Traffic policing by dropping packets exceeding the configured bandwidth threshold. Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Answer

Input queue buffering and tail-drop avoidance

Answer

Rate limiting via TCP window size adjustments

Answer

Traffic shaping with weighted random early detection (WRED)

Question 3

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses the DHCP snooping binding database to build its IP-to-MAC-to-port-to-VLAN binding table, then filters traffic on untrusted ports by dropping any packet whose source IP/MAC does not match an entry in that database (or a statically configured binding). Dynamic ARP Inspection (C) is also correct because DAI validates ARP packets on untrusted ports by comparing the sender IP and sender MAC against the DHCP snooping binding database, dropping ARP packets that do not match a valid binding (with static ARP ACLs as an optional supplement). Storm Control (B) is not correct because it is a hardware-based traffic rate limiter that monitors broadcast, multicast, or unknown unicast frames per port and does not consult any DHCP snooping bindings. Port Security MAC-Limit (D) is not correct because it restricts the number of source MAC addresses learned on a port using the MAC address table, independent of DHCP snooping bindings. MACsec Key Agreement (E) is not correct because MKA is part of IEEE 802.1X-2010 MACsec and negotiates session keys between link peers using EAPOL-MKA frames, with no dependency on the DHCP snooping binding database.

Answer

Storm Control rate-limiting

Answer

Port Security MAC-Limit

Answer

MACsec Key Agreement (MKA)

Question 4

An operator executes the 'show ospf database' command on a Junos device and notices multiple Type 2 Network LSAs. Under which specific network topology condition are Type 2 LSAs generated?

Accepted Answer

Multi-access broadcast segments with an active Designated Router. Type 2 Network LSAs are generated by the Designated Router (DR) on multi-access broadcast segments (e.g., Ethernet) to represent the subnet and list all routers attached to that segment. The DR originates the Network LSA, which includes the DR's interface IP address and the Router IDs of all OSPF routers on the segment. This LSA is only produced when a DR is elected, which occurs on broadcast or NBMA networks where multiple routers share the same subnet. Thus, option D correctly identifies the condition.

Answer

Stub areas filtering out external LSA advertisements

Answer

Virtual links traversing a non-backbone transit area

Answer

Point-to-point links between two directly connected routers

Question 5

An engineer configures a LAG between an EX4300 switch and a server. The server uses static LAG mode (no LACP). How must the Junos switch interface be configured to successfully form the bundle?

Accepted Answer

Omit the LACP protocol configuration under the aggregated-ether-options stanza, operating in static mode.. When connecting to a device that does not support LACP, you must configure the Junos aggregated interface without LACP (manual/static mode).

Answer

Configure VRRP on the ae0 interface to manage the static bundle.

Answer

Configure LACP passive mode on the EX4300 switch.

Answer

Enable Graceful Restart on the physical ports.

Question 6

Which TWO features help protect an RSTP topology from unauthorized switches or misconfigurations on access ports? (Choose two.)

Accepted Answer

Root protection. Root protection (Option C) is correct because when enabled on a port, it forces that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing an unauthorized or misconfigured switch on an access port from becoming the root bridge and hijacking the spanning-tree topology. BPDU guard (Option E) is correct because it err-disables a port immediately upon receiving any BPDU, which stops rogue switches or misconfigured devices from participating in RSTP on access ports that should only connect to end hosts. Bridge priority adjustment (Option A) only influences which switch becomes root and does not defend against unauthorized switches on access ports. Hello timer scaling (Option B) merely changes how often BPDUs are sent and does not provide protection. Forward delay timer optimization (Option D) tunes STP convergence timing and likewise offers no security against rogue or misconfigured access-port devices.

Answer

Bridge priority adjustment

Answer

Hello timer scaling

Answer

Forward delay timer optimization

Question 7

Which TCP port is used by BGP to establish communication between peers?

Accepted Answer

TCP 179. BGP operates over TCP port 179.

Answer

UDP 520

Answer

TCP 80

Answer

TCP 500

Question 8

Which Junos configuration statement defines the destination address of a GRE tunnel?

Accepted Answer

destination . On Junos, the GRE tunnel destination is configured with the 'destination ' statement under the tunnel interface unit hierarchy, for example 'set interfaces gr-0/0/0 unit 0 tunnel destination 203.0.113.2'. This statement specifies the remote endpoint IP address to which the GRE-encapsulated packets are sent.

Answer

remote-endpoint <ip-address>

Answer

peer-address <ip-address>

Answer

tunnel-destination <ip-address>

Question 9

Which CLI command displays the operational status and roles of all members in a Juniper EX Series Virtual Chassis?

Accepted Answer

show virtual-chassis. The 'show virtual-chassis' command displays the role (Master, Backup, Linecard) of each member.

Answer

show chassis vcp

Answer

show lacp virtual-chassis

Answer

show vrrp chassis

Question 10

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

Accepted Answer

Storm control. Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Answer

MACsec

Answer

Dynamic ARP Inspection

Answer

Port security

Question 11

You are troubleshooting an OSPF network where an ASBR is injecting external routes. Routers in other areas need to reach this ASBR. Which LSA type provides the reachability information to the ASBR itself?

Accepted Answer

Type 4 (ASBR Summary LSA). Type 4 (ASBR Summary LSA) is generated by the ABR to advertise the reachability of an ASBR to routers in other areas. Since Type 5 LSAs are flooded throughout the OSPF domain but do not contain the ASBR's router ID reachability information, routers in non-backbone areas need a Type 4 LSA to know how to reach the ASBR that originated the Type 5 LSAs.

Answer

Type 2 (Network LSA)

Answer

Type 7 (NSSA External LSA)

Answer

Type 5 (AS-external LSA)

Question 12

Why would you set an interface to 'passive' in IS-IS?

Accepted Answer

To include the network in the LSP without forming an adjacency.. Setting an interface to passive in IS-IS instructs the router to advertise the interface's connected subnet into its LSP (Link State PDU) without sending or processing IIH (IS-IS Hello) packets on that interface. This means no adjacency is formed over the link, but the prefix is still reachable via the router's own LSP. It is commonly used on interfaces facing stub networks or hosts where forming an adjacency is unnecessary or undesirable.

Answer

To speed up the DIS election process.

Answer

To force the interface to be a point-to-point link.

Answer

To enable authentication on that interface.

Question 13

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

Accepted Answer

Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.. The most likely cause is missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface. The tunnel itself is up (since Router A can ping Router B's tunnel IP), but traffic from behind Router A to behind Router B requires routes to the remote subnets via the tunnel. Without these routes, packets are dropped or sent elsewhere.

Answer

The GRE tunnel source IP address is configured incorrectly.

Answer

The physical interface MTU is set too high.

Answer

The gr- interface family inet address is missing.

Question 14

You need to ensure that BGP sessions fail over within sub-second intervals if a link degrades or goes down. Which protocol should you integrate with BGP on your Junos router?

Accepted Answer

BFD (Bidirectional Forwarding Detection). BFD (Bidirectional Forwarding Detection) provides fast failure detection that can trigger BGP session teardown within milliseconds.

Answer

STP (Spanning Tree Protocol)

Answer

LDP (Label Distribution Protocol)

Answer

OSPF

Question 15

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

Accepted Answer

OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.. OSPF sends hello packets to the multicast address 224.0.0.5 (AllSPFRouters) using IP protocol 89. For OSPF to form an adjacency over a GRE tunnel, the tunnel must properly forward multicast traffic and not filter protocol 89. If the underlying network or tunnel configuration blocks multicast or protocol 89, hellos are not received, and the adjacency fails. Unicast pings succeed because they are unicast IP packets, not multicast, and may use a different protocol (ICMP), so they do not test the multicast forwarding path or protocol 89 filtering. Thus, the most likely cause is that multicast hellos are not being delivered.

Answer

The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.

Answer

Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.

Answer

GRE tunnels do not support routing protocols such as OSPF under any circumstances.

Question 16

You are troubleshooting an OSPF network and notice that a router's OSPF state is stuck in 'ExStart'. What is the most common reason for this adjacency state issue?

Accepted Answer

An MTU mismatch between the neighboring OSPF interfaces. OSPF adjacency stuck in ExStart is almost always caused by an MTU mismatch between the two neighbors. During ExStart, routers exchange DBD packets to elect a master/slave and agree on the initial sequence number; if the interface MTUs differ, the larger DBD packets are dropped, and the routers keep retransmitting without progressing to Exchange. This is the classic ExStart/Exchange hang.

Answer

Duplicate OSPF router IDs in the network

Answer

Different authentication passwords on the links

Answer

A mismatch in the OSPF area ID configuration

Question 17

When configuring MSTP, what purpose does the regional configuration digest serve?

Accepted Answer

It allows neighboring switches to verify if they belong to the same MST region.. The MSTP regional configuration digest is a hash value computed from the MST region's configuration (name, revision level, and VLAN-to-instance mapping). It is included in BPDUs so that neighboring switches can verify whether they are in the same MST region. If the digest does not match, the switches consider themselves in different regions, and the boundary ports operate as if connecting to different MST regions.

Answer

It encrypts the BPDU payload to prevent tampering by unauthorized access switches.

Answer

It acts as a dynamic bridge priority modifier for internal instance root selection.

Answer

It determines the Designated Master Bridge within the CIST instance.

Question 18

You need to modify the bridge priority of an EX Series switch running RSTP to ensure it becomes the root bridge. Which configuration command correctly sets the bridge priority to 4096?

Accepted Answer

set protocols rstp bridge-priority 4096. On Juniper EX Series switches, RSTP is configured under the [edit protocols rstp] hierarchy. The bridge priority is set using the 'bridge-priority' command, so the correct full command is 'set protocols rstp bridge-priority 4096'. This value is used in the bridge ID and must be a multiple of 4096 (ranging from 0 to 61440). Setting it to 4096 makes the switch highly likely to become the root bridge, assuming no other switch has a lower priority.

Answer

set spanning-tree priority 4096

Answer

set protocols rstp priority 4096

Answer

set bridge-priority 4096

Question 19

Which TWO commands are used to verify link aggregation and LACP operational status on a Juniper switch? (Choose two)

Accepted Answer

show interfaces ae0. Option C, 'show interfaces ae0', is correct because the aggregated Ethernet (ae) interface is the logical bundle created by link aggregation, and this command displays its operational status, member links, and whether the bundle is up. Option D, 'show lacp interface', is correct because it directly reports LACP protocol state per member interface, including actor/partner state flags (such as whether the link is collecting and distributing) and LACP operational status. Option A, 'show virtual-chassis', is unrelated since it displays Virtual Chassis topology and member roles, not link aggregation. Option B, 'show vrrp detail', concerns VRRP redundancy state and has nothing to do with LACP or aggregation. Option E, 'show chassis routing-engine', reports Routing Engine status and resources, not link aggregation or LACP.

Answer

show virtual-chassis

Answer

show vrrp detail

Answer

show chassis routing-engine

Question 20

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Accepted Answer

Enable MACsec on the physical interface.. Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session. Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

Answer

Configure the interface as a trusted port for Dynamic ARP Inspection.

Answer

Enable DHCP snooping on the transit VLAN.