JNCIS-ENT Practice Test 5 — 25 Questions

Question 1

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

Accepted Answer

show ethernet-switching storm-control interface ge-0/0/1. The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Answer

show storm-control statistics interface ge-0/0/1

Answer

show bridge storm-control interface ge-0/0/1

Answer

show interfaces extensive ge-0/0/1 | match storm

Question 2

You are observing that your IS-IS routers are not synchronizing their databases. You check the CSNP settings. What is the role of the CSNP on a broadcast segment?

Accepted Answer

To provide a summary of the entire database to neighbors.. CSNPs (Complete Sequence Number PDUs) are sent by the DIS to ensure all routers have the same Link State Database.

Answer

To acknowledge individual LSPs.

Answer

To initiate the DIS election.

Answer

To request specific missing LSPs.

Question 3

What happens if you have an area address mismatch in a Level 1 adjacency?

Accepted Answer

The adjacency will fail to form.. Level 1 adjacencies require the routers to share at least one area address.

Answer

The DIS will override the mismatch.

Answer

The adjacency will form but no routes will be exchanged.

Answer

The router will automatically adopt the neighbor's area address.

Question 4

Which of the following are valid IS-IS PDU types? (Choose THREE)

Accepted Answer

IIH PDU. The four PDU types are IIH, LSP, CSNP, and PSNP.

Answer

Hello ACK PDU

Answer

Routing Update PDU

Question 5

Which of the following is a valid IS-IS PDU type?

Accepted Answer

Link State PDU. IIH, LSP, CSNP, and PSNP are the four standard IS-IS PDU types.

Answer

Routing Update PDU

Answer

Database Description PDU

Answer

Hello PDU

Question 6

Which of the following are true regarding IS-IS Level 1/Level 2 routers? (Choose TWO)

Accepted Answer

They maintain both a Level 1 and a Level 2 database.. L1/L2 routers act as bridges between areas and must maintain both databases.

Answer

They are always the DIS for the segment.

Answer

They only form Level 1 adjacencies.

Answer

They do not perform SPF calculations.

Question 7

What are valid ways to configure IS-IS on a Junos interface? (Choose TWO)

Accepted Answer

set interfaces ge-0/0/0.0 protocols isis. You can enable IS-IS under the 'protocols isis interface' hierarchy or by adding the interface to the hierarchy directly.

Answer

set routing-options isis interface ge-0/0/0.0

Answer

set interfaces ge-0/0/0.0 isis enable

Answer

set protocols isis enable ge-0/0/0.0

Question 8

Which of the following are true about pseudonode LSPs? (Choose THREE)

Accepted Answer

They represent the broadcast segment in the LSDB.. Pseudonode LSPs are generated by the DIS, represent the broadcast segment, and effectively reduce the number of LSPs in the LSDB.

Answer

They are used in point-to-point links.

Answer

They are flooded by all routers.

Question 9

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

Accepted Answer

The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.. Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Answer

The static client is using an IP address outside the DHCP pool range.

Answer

The client's MAC address violates the port security maximum limit.

Answer

DAI requires all interfaces to be trusted on the VLAN.

Question 10

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

Accepted Answer

clear ethernet-switching security-violation. Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Answer

reset interface security-violations

Answer

clear bridge security-counters

Answer

clear arp-inspection statistics

Question 11

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Accepted Answer

It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.. DHCP snooping builds a binding table, blocks rogue servers on untrusted ports, and inspects DHCP messages.

Answer

It requires IP Source Guard to be enabled before the binding table can be populated.

Answer

It operates exclusively by analyzing static ARP entries configured by administrators.

Question 12

Which operational command displays the status of MACsec connections and associated security association parameters on an EX Series switch?

Accepted Answer

show macsec connections. The command 'show macsec connection' shows active connections and parameters.

Answer

show ethernet-switching macsec

Answer

show protocols mka status

Answer

show security macsec associations

Question 13

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). MACsec PSK establishment requires matching connectivity association keys (CAK), connectivity key names (CKN), and cipher suite compatibility.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 14

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

Accepted Answer

GCM-AES-128. When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Answer

AES-CBC-128

Answer

SHA-256-HMAC

Answer

GCM-AES-256

Question 15

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

Accepted Answer

Traffic policing by dropping packets exceeding the configured bandwidth threshold. Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Answer

Input queue buffering and tail-drop avoidance

Answer

Rate limiting via TCP window size adjustments

Answer

Traffic shaping with weighted random early detection (WRED)

Question 16

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

Accepted Answer

Source MAC address. Layer 2 firewall filters in Junos can match fields such as source MAC address, destination MAC address, VLAN ID, and EtherType.

Answer

Destination IP address

Answer

ICMP type code

Answer

TCP port number

Question 17

Which statement is true regarding the behavior of storm control when the traffic rate exceeds the configured threshold?

Accepted Answer

Excess traffic exceeding the threshold is dropped by the switch hardware.. When storm control thresholds are exceeded, Junos drops the excess traffic matching the storm control criteria until the rate drops below the threshold.

Answer

Traffic is rate-shaped and buffered in the output queue until congestion clears.

Answer

The interface is immediately shut down and placed in an error-disabled state.

Answer

The switch sends SNMP traps and forwards the traffic with a low-priority CoS marking.

Question 18

You are troubleshooting IP Source Guard on an EX Series switch. You want to see which interfaces have IP Source Guard enabled and their operational state. Which operational command should you use?

Accepted Answer

show ethernet-switching secure-access-port ip-source-guard interface. The command 'show ethernet-switching secure-access-port ip-source-guard' displays IP Source Guard interface statuses.

Answer

show bridge ip-source-guard

Answer

show ip-source-guard interfaces

Answer

show interfaces ip-source-guard brief

Question 19

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Accepted Answer

IP Source Guard. Dynamic ARP Inspection and IP Source Guard both rely on the DHCP snooping binding database for validation.

Answer

Storm Control rate-limiting

Answer

Port Security MAC-Limit

Answer

MACsec Key Agreement (MKA)

Question 20

An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?

Accepted Answer

Configure a static IP source entry in the secure-access-port binding table for the server.. Static ARP inspection entries or static IP source bindings can be configured to allow non-DHCP clients through DAI without trusting the entire port.

Answer

Add the server's MAC address to the switch's static MAC-table using 'set bridge-domains'.

Answer

Create a Layer 2 firewall filter permitting ARP packets with action 'accept-and-trust'.

Answer

Configure an explicit static ARP entry under 'set protocols arp static'.