JNCIS-ENT Practice Test 5 — 10 Questions

Question 1

An administrator needs to create a VLAN named 'voice' with a VLAN ID of 50 on a Junos EX Series switch. Which configuration path achieves this?

Accepted Answer

set vlans voice vlan-id 50. On Junos EX Series switches, VLANs are configured under the [edit vlans] hierarchy with the syntax 'set vlans vlan-id '. This creates a VLAN named 'voice' with VLAN ID 50, which can then be associated with access or trunk interfaces.

Answer

set ethernet-switching-options vlans voice id 50

Answer

set bridge-domains voice vlan-id 50

Answer

set interfaces vlan unit 50 name voice

Question 2

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed information about the GRE tunnel interface, including the configured source and destination addresses. The 'extensive' option provides additional parameters beyond the basic interface status, such as tunnel source, destination, and other GRE-specific settings. This is the standard Junos command to verify tunnel configuration parameters on a specific interface.

Answer

show route protocol gre

Answer

show system tunnel-info

Answer

show chassis hardware

Question 3

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Accepted Answer

A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.. Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Answer

The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

Answer

The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

Answer

DHCP snooping is blocking the MACsec control frames on the transit link.

Question 4

What is the role of the Root Port in an RSTP topology?

Accepted Answer

It provides the lowest-cost path from a non-root switch to the root bridge.. The Root Port in RSTP is the port on a non-root switch that provides the lowest-cost path to the root bridge. It is the port through which the switch sends traffic toward the root and receives traffic from the root. Each non-root switch has exactly one root port, which is elected based on path cost, sender bridge ID, sender port ID, and local port ID.

Answer

It forwards traffic between two different MST regions.

Answer

It connects the root bridge to all downstream non-root switches.

Answer

It serves as the backup forwarding path when the designated port fails.

Question 5

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Accepted Answer

DHCP snooping. DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks. OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Answer

OSPFv3 authentication

Answer

MACsec point-to-point encryption

Question 6

When configuring a routing instance of type 'virtual-router', what is required to allow communication between the virtual router instance and the default routing instance?

Accepted Answer

Configure leaking routes between instances using rib-groups or routing policies.. To allow communication between a virtual-router routing instance and the default routing instance, you must configure route leaking using rib-groups or routing policies. Virtual routers have separate routing tables, so routes are not shared by default. Rib-groups can copy routes from one table to another, or routing policies can export/import routes between instances.

Answer

Connect a physical cable between two ports on the router (cable-patch).

Answer

Configure static routes with identical preferences in both instances.

Answer

Disable firewall filters on all loopback interfaces.

Question 7

You are troubleshooting an OSPF adjacency issue between two Juniper EX Series switches. One switch logs an error stating 'OSPF packet received with mismatched area ID'. Where in the Junos CLI should you check and correct this parameter?

Accepted Answer

[edit protocols ospf area interface ]. The OSPF area ID is configured per interface under '[edit protocols ospf area interface ]'. If two routers have mismatched area IDs on the same link, the adjacency will not form and the 'mismatched area ID' error is logged. Correcting the area ID on the interface under the correct area hierarchy resolves the issue.

Answer

[edit system services ospf]

Answer

[edit protocols ospf area <area-id> stub]

Answer

[edit routing-options router-id <ip-address>]

Question 8

Which THREE attributes are optional transitive BGP path attributes? (Choose three)

Accepted Answer

AS4_PATH. AS4_PATH (A) is an optional transitive attribute defined in RFC 6793 that carries 4-byte AS path information for backward compatibility with 2-byte AS speakers, and it is propagated to other ASes. AGGREGATOR (B) is an optional transitive attribute (type code 7) that records the AS and router ID of the device that performed route aggregation, and it is passed along to BGP peers. COMMUNITY (D) is an optional transitive attribute (type code 8) used to tag routes with community values that are propagated across AS boundaries. MED (C) is an optional nontransitive attribute, so it is not propagated beyond the neighboring AS, and LOCAL_PREF (E) is a well-known discretionary attribute used only within a single AS, so neither qualifies as optional transitive.

Answer

MED

Answer

LOCAL_PREF

Question 9

Which TWO statements describe characteristics of BGP path attributes? (Choose two.)

Accepted Answer

Well-known mandatory attributes must be recognized by all BGP implementations and included in every Update message containing path information.. Option C is correct because well-known mandatory attributes, by definition in BGP (RFC 4271), must be recognized by every BGP implementation and must appear in every UPDATE message that carries reachable NLRI/path information. Option E is correct because AS_PATH is one of the three well-known mandatory attributes (along with NEXT_HOP and ORIGIN), and it is present in every UPDATE advertising a route. Option A is wrong because Local Preference is a well-known discretionary attribute, not one exchanged across eBGP peers — it is typically propagated only within an AS via iBGP. Option B is wrong because MED is an optional non-transitive attribute, not well-known mandatory, and it influences inter-AS route selection only when explicitly configured. Option D is wrong because optional transitive attributes that are unrecognized are still passed along to other peers (with the partial bit set), not discarded.

Answer

Local Preference is a well-known discretionary attribute that is exchanged across eBGP peers.

Answer

MED is a well-known mandatory attribute used for inter-AS route selection.

Answer

Optional transitive attributes are ignored by BGP speakers that do not recognize them and are never passed along to other peers.

Question 10

Which TWO attributes distinguish direct routes from static routes in Junos OS? (Choose two)

Accepted Answer

Direct routes represent subnets attached to active local interfaces.. Option B is correct because direct routes in Junos OS are automatically installed in the routing table for the subnets configured on active local interfaces, representing directly connected networks. Option E is correct because Junos assigns direct routes a default preference of 0, while static routes carry a default preference of 5, making direct routes more preferred when both exist for the same prefix. Option A is wrong because static routes are manually configured, not automatically created when an interface comes up; that behavior describes direct/interface routes. Option C is wrong because direct routes do not require manual configuration under routing-options; they are derived from interface addresses, whereas static routes are configured under routing-options. Option D is wrong because static routes can use recursive next-hops, resolving the next-hop through another route in the routing table.

Answer

Static routes are created automatically when an interface comes up.

Answer

Direct routes require manual IP address configuration under routing-options.

Answer

Static routes cannot be used with recursive next-hops.