JNCIS-ENT Practice Test 5 — 25 Questions

Question 1

What is the primary function of a Junos routing instance of type 'forwarding'?

Accepted Answer

To support filter-based forwarding without running routing protocols. A Junos routing instance of type 'forwarding' is used to support filter-based forwarding (FBF) without running routing protocols. It allows traffic to be directed to specific next-hops based on firewall filter match conditions, using a separate routing table (the forwarding instance's table) that contains only static routes or interface routes. This is ideal for policy-based routing scenarios where you don't need a full routing protocol.

Answer

To terminate BGP sessions from multiple external peers

Answer

To run multiple independent OSPF instances

Answer

To provide transparent bridging across WAN circuits

Question 2

Which BGP message type is responsible for negotiating session parameters, including autonomous system numbers, hold times, and BGP identifiers during session establishment?

Accepted Answer

Open. The BGP Open message is the first message sent after a TCP connection is established. It contains parameters such as the BGP version, local AS number, hold time, BGP identifier, and optional parameters (capabilities).

Answer

Notification

Answer

Update

Answer

Keepalive

Question 3

You are configuring Multi-Chassis Link Aggregation (MC-LAG) across two Juniper switches acting as separate control plane devices. Which protocol is used between the peer switches to synchronize state and ensure MAC address table consistency across the MC-LAG domain?

Accepted Answer

Inter-Chassis Control Protocol (ICCP). MC-LAG uses Inter-Chassis Control Protocol (ICCP) to coordinate state, consistency, and status between the two peer switches.

Answer

Open Shortest Path First (OSPF)

Answer

Graceful Routing Engine Switchover (GRES)

Answer

Virtual Router Redundancy Protocol (VRRP)

Question 4

You are configuring authentication for OSPF on a Junos router using MD5. Where must the MD5 key ID and password be defined in the configuration hierarchy?

Accepted Answer

[edit protocols ospf area interface authentication md5]. On Junos, OSPF MD5 authentication is configured at the interface level under the OSPF area hierarchy. The correct path is [edit protocols ospf area interface authentication md5], where you specify the key ID and password. This binds the authentication to the specific OSPF interface, which is required because OSPF authentication is per-interface, not global.

Answer

[edit protocols bgp group <group> authentication-key]

Answer

[edit routing-options autonomous-system]

Answer

[edit system authentication-order]

Question 5

Which TWO statements accurately describe the behavior and characteristics of a routing instance of type 'forwarding'? (Choose two)

Accepted Answer

It is primarily used for filter-based forwarding applications.. Option D is correct because a 'forwarding' routing instance (also called a VRF-lite style instance) is designed for filter-based forwarding (FBF), where firewall filters on the ingress interface classify traffic and direct it into the instance's own routing table to control next-hop selection. Option E is correct because a forwarding-type instance maintains its own separate forwarding/routing table (RIB/FIB) but does not run any dynamic routing protocols such as OSPF, IS-IS, or BGP within it; routes are populated statically or via policy/filter actions. Option A is wrong because a forwarding instance does not automatically create a default route to the loopback interface; any default route must be configured manually or injected by policy. Option B is wrong because running independent OSPF and BGP instances is characteristic of a VRF-type routing instance, not a forwarding instance. Option C is wrong because MP-BGP for VPN label signaling is associated with VRF instances in MPLS L3VPN deployments, not with forwarding instances, which are local to the device and do not use VPN labels.

Answer

It automatically generates a default route pointing to the loopback interface.

Answer

It runs independent OSPF and BGP instances.

Answer

It requires MP-BGP for VPN label signaling.

Question 6

You are configuring a Link Aggregation Group (LAG) with LACP on an EX3400 switch. You want to ensure that the interface bundle drops traffic if fewer than two active member links are operational. Which feature configuration achieves this?

Accepted Answer

Configure 'set interfaces ae0 aggregated-ether-options lacp minimum-links 2'.. On Junos EX switches, the LACP minimum-links feature is configured under the aggregated Ethernet interface using 'set interfaces ae0 aggregated-ether-options lacp minimum-links 2'. This setting ensures that if fewer than two member links are active, the LAG is marked down and traffic is dropped, preventing degraded forwarding.

Answer

Configure 'set protocols lacp minimum-active-ports 2'.

Answer

Configure 'set chassis aggregated-devices ethernet link-threshold 2'.

Answer

Configure 'set switch-options lacp threshold 2'.

Question 7

While reviewing OSPF logs on a Junos device, you notice frequent adjacency flaps. You suspect a mismatch in the OSPF timer configurations. Which two timers must match identically on adjacent OSPF interfaces for an adjacency to form?

Accepted Answer

Hello interval and Dead interval. OSPF Hello and Dead intervals are critical parameters that must match identically on connected interfaces; otherwise, hello packets are rejected or dead timers expire prematurely.

Answer

Reference bandwidth and Cost metric

Answer

SPF delay timer and Hold timer

Answer

Retransmit interval and Poll interval

Question 8

Which interface naming convention is used by Junos OS to identify a generic routing encapsulation (GRE) tunnel interface?

Accepted Answer

gr-. Junos OS uses the 'gr-' prefix to identify GRE tunnel interfaces, for example gr-0/0/0. This naming convention is fixed and is used consistently in configuration and operational commands for GRE tunnels.

Answer

lt-

Answer

st-

Answer

ip-

Question 9

You are configuring Multiple Spanning Tree Protocol (MSTP) across multiple EX Series switches in your enterprise network. Which three parameters must be identical across all switches to ensure they belong to the same MST region?

Accepted Answer

Configuration name, revision number, and VLAN-to-instance mapping. MST region configuration requires identical configuration name, revision number, and VLAN-to-instance mapping.

Answer

Bridge priority, root identifier, and Hello timer

Answer

Forward delay, max age, and region password

Answer

MAC address, system ID extension, and MST digest

Question 10

When configuring a routing instance of type 'virtual-router', which THREE characteristics apply? (Choose three)

Accepted Answer

Interfaces can be assigned directly to the virtual-router instance.. Option B is correct because a virtual-router routing instance in Junos is a true separate routing domain, so you assign physical or logical interfaces directly to it (for example, with 'set routing-instances interface ge-0/0/0.0'), and those interfaces then use the instance's own routing table. Option C is correct because a virtual-router instance runs its own routing protocol process and can run dynamic IGPs such as OSPF and IS-IS within that instance, independently of the master instance. Option E is correct because the defining feature of a virtual-router instance is that it maintains its own independent routing table (named .inet.0) that is separate from the main inet.0 table. Option A is not required, since a virtual-router instance is a pure Layer 3 routing separation and does not need MPLS label distribution protocols such as LDP or RSVP to function. Option D is false because Junos does not strictly prohibit route leaking between a virtual-router instance and inet.0; routes can be exchanged using rib-groups or instance-import/instance-export policies, so the statement is technically inaccurate.

Answer

It requires MPLS label distribution protocols to function.

Answer

Route leaking between virtual-router and inet.0 is strictly prohibited by Junos architecture.

Question 11

You are troubleshooting an issue where an EX4300 Virtual Chassis fails to boot after adding a new switch member. The system console displays errors regarding incompatible Junos images and hardware mismatch on the Virtual Chassis ports. What is the correct procedure to recover and integrate the new member?

Accepted Answer

Isolate the new switch, boot it independently, upgrade/downgrade its Junos OS version to match the master switch, and then connect it to the Virtual Chassis ring.. The EX4300 Virtual Chassis requires all member switches to run the same Junos OS release; a mismatch triggers boot failure and VCP errors. The correct recovery is to isolate the new member, boot it standalone, install the matching Junos image, and only then reconnect it to the Virtual Chassis ring. This ensures the master can synchronize the member without image incompatibility. Option A is the only procedure that directly resolves the root cause.

Answer

Configure GRES on the replacement switch using the CLI before connecting stacking cables.

Answer

Disable LACP on all aggregated links across the stack.

Answer

Factory reset all existing switches in the Virtual Chassis via the master console.

Question 12

What is the default preference value for a direct route in Junos OS?

Accepted Answer

0. In Junos OS, the default preference (administrative distance) for a direct route is 0. This is the highest priority among all route types, ensuring that directly connected networks are always preferred over routes learned via dynamic protocols or static configuration. The value 0 reflects that a directly connected interface is the most trusted source of routing information.

Answer

5

Answer

20

Answer

10

Question 13

What action does the 'set protocols rstp max-age <seconds>' command perform on a Juniper switch?

Accepted Answer

It defines how long BPDU information is stored before being considered expired.. The 'max-age' timer in RSTP/MSTP (IEEE 802.1D-2004 / 802.1Q) defines how long a bridge retains received BPDU information before it declares that information stale and ages it out. When the max-age timer expires without receiving a fresh BPDU from the designated bridge, the port transitions and topology information is recalculated. On Juniper switches, 'set protocols rstp max-age <seconds>' tunes this BPDU-aging timer, with a default of 20 seconds and a valid range of 6–40 seconds.

Answer

It sets the maximum time a port can remain in the discarding state during bootup.

Answer

It limits the maximum age of MAC table entries learned via spanning tree.

Answer

It restricts the maximum number of hops an MSTP BPDU can traverse.

Question 14

Which of the following are true about IS-IS Level-1 and Level-2 areas? (Choose TWO)

Accepted Answer

Level 2 is for connecting Level 1 areas.. Option A is correct because IS-IS Level-2 routing operates as the backbone that interconnects separate Level-1 areas, allowing prefixes from one area to be advertised to others via Level-2 (or Level-1/Level-2) routers. Option E is correct because Level-1 routing is confined within a single area and handles intra-area prefix reachability using Level-1 LSPs and the Level-1 link-state database. Option B is wrong because Level-1 and Level-2 are distinct routing levels with separate link-state databases and different flooding scopes. Option C is wrong because a pure Level-1 router only knows its own area's topology and must use an attached Level-1/Level-2 router (with the ATT bit set) to reach other areas. Option D is wrong because Level-2 is the inter-area backbone routing level, not a mechanism for local interface management.

Answer

Level 1 and Level 2 are the same thing.

Answer

Level 1 routers can communicate directly with routers in other areas.

Answer

Level 2 is for local interface management only.

Question 15

Which THREE statements describe the role and function of the BGP Router ID? (Choose three)

Accepted Answer

It is exchanged during the BGP OPEN message negotiation phase.. Option B is correct because the BGP Router ID is carried in the BGP OPEN message as part of session establishment, allowing peers to identify each other during negotiation. Option C is correct because when all other path attributes are equal, BGP uses the lowest Router ID as the final tie-breaker in the best-path selection algorithm. Option E is correct because the Router ID is a 32-bit value written in dotted-quad notation, just like an IPv4 address. Option A is wrong because the AS_PATH attribute is generated and propagated by BGP itself and is never replaced by the Router ID. Option D is wrong because Router IDs must be unique within an Autonomous System, not identical across all routers.

Answer

It automatically replaces the AS_PATH attribute if missing.

Answer

It must be identical across all routers within the same Autonomous System.

Question 16

Which THREE parameters must match across all switches for them to successfully form a single MST region? (Choose three.)

Accepted Answer

VLAN-to-instance mapping table. For switches to form a single MST region, the MST configuration must be identical across all of them, and this is verified by three specific parameters. Option A, the VLAN-to-instance mapping table, must match because it defines which VLANs are mapped to which MST instances (MSTIs), and any difference causes the switches to be in different regions. Option B, the configuration name, is a 32-character alphanumeric string that identifies the MST region and must be identical on all switches. Option C, the revision number, is a 16-bit value that must also match, as it is used together with the configuration name and mapping table to determine region membership. Options D and E are incorrect because bridge priority and hello timer are per-instance or per-port STP parameters that affect root election and BPDU timing, but they are not part of the MST region identifier and do not need to match for region formation.

Answer

Bridge priority value

Answer

Hello timer interval

Question 17

Which THREE conditions must be met to successfully execute an In-Service Software Upgrade (ISSU) on a dual-RE Juniper routing platform? (Choose three)

Accepted Answer

Both Routing Engines must be fully populated with identical hardware models and supported Junos images.. Option A is correct because ISSU requires both Routing Engines to be the same hardware model and to run compatible, supported Junos images so that the upgraded RE can take over cleanly. Option B is correct because Graceful Routing Engine Switchover (GRES) must be enabled and synchronized, allowing the backup RE to assume control without resetting the data plane or losing forwarding state. Option E is correct because Nonstop Active Routing (NSR) or Graceful Restart must be configured for the active routing protocols so that routing adjacencies and protocol state survive the RE switchover during the upgrade. Option C is incorrect because ISSU is designed to avoid taking down all physical interfaces; interfaces remain forwarding during the upgrade. Option D is incorrect because VRRP preemption settings are not a prerequisite for ISSU and do not need to be disabled.

Answer

All physical interfaces must be manually placed in a disabled state prior to upgrade.

Answer

VRRP preemption must be disabled on all routing interfaces.

Question 18

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

Accepted Answer

They are configured under the 'family ethernet-switching' match criteria context.. Option A is correct because Layer 2 firewall filters on EX Series switches are configured within the 'family ethernet-switching' context, which provides the match conditions for Layer 2 fields such as MAC addresses and EtherType. Option C is correct because these filters can match on source and destination MAC addresses and EtherType values, which are fundamental Layer 2 header fields. Option D is correct because Layer 2 filters can be applied to physical switch ports (interfaces) or to VLANs, allowing filtering at the ingress port or across a VLAN. Option B is incorrect because applying filters to logical Layer 3 interfaces (irb or vlan interfaces) using 'family inet' is for Layer 3 filters, not Layer 2. Option E is incorrect because firewall filters evaluate match conditions before any routing lookup occurs; routing lookups happen after a packet is permitted and forwarded.

Answer

They are applied to logical Layer 3 routing interfaces (irb or vlan interfaces) using family inet.

Answer

They execute routing lookups prior to evaluating packet match conditions.

Question 19

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

Accepted Answer

The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.. When port security is configured with 'action-on-violation shutdown' on an EX switch, a violation causes the interface to be disabled (err-disabled). It does not automatically recover; the administrator must manually clear the violation using 'clear ethernet-switching port-error' or by disabling and re-enabling the interface. This is the documented default behavior for shutdown action.

Answer

The interface automatically recovers after a default hold-down timer of 300 seconds.

Answer

The interface drops violating packets but remains operationally up until manually disabled.

Answer

The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

Question 20

Which THREE statements describe the function of the Designated Port in RSTP? (Choose three.)

Accepted Answer

It provides the lowest cost path from the segment back toward the root bridge.. Option A is correct because the designated port is the port on a LAN segment that offers the lowest path cost back toward the root bridge, making it the forwarding port for that segment. Option C is correct because the designated port is responsible for sending (forwarding) BPDUs onto its attached LAN segment, which is how RSTP maintains topology information. Option D is correct because RSTP elects exactly one designated port per active LAN segment to avoid loops and ensure consistent forwarding. Option B is incorrect because designated ports normally forward frames and BPDUs, not remain permanently discarding; discarding is a temporary or alternate/backup port state. Option E is incorrect because the primary root port is the port on a non-root bridge closest to the root bridge, which is a different role from the designated port.

Answer

It remains permanently in the discarding state to prevent loops.

Answer

It acts as the primary root port for the local bridge.