JNCIS-ENT Practice Questions 1 — 50 Questions

Question 1

Which of the following are valid IS-IS PDU types? (Choose THREE)

Accepted Answer

IIH PDU. IS-IS defines three core PDU categories, and options A, B, and C map directly onto them. A: IIH (Intermediate System-to-Intermediate System Hello) PDUs are the valid IS-IS hello packets used to discover and maintain adjacencies on broadcast and point-to-point links, with LAN and P2P variants. B: LSP (Link State PDU) is the valid IS-IS packet that carries link-state information and is flooded to build the link-state database, analogous to an OSPF LSA. C: CSNP (Complete Sequence Number PDU) is a valid IS-IS PDU used to describe the complete set of LSPs in a database, sent by the DIS on broadcast networks and used for database synchronization. Options D and E are not IS-IS PDU types: IS-IS hellos are not acknowledged with a separate 'Hello ACK PDU' (acknowledgment is implicit via receipt of a subsequent IIH), and there is no 'Routing Update PDU' in IS-IS—routing information is distributed through LSPs, CSNPs, and PSNPs.

Answer

Hello ACK PDU

Answer

Routing Update PDU

Question 2

An administrator implements filter-based forwarding and applies a firewall filter on the ingress interface. However, traffic matching the filter is dropped rather than routed to the alternate routing instance. Upon investigation, what is the most likely cause of this issue?

Accepted Answer

The destination IP address does not have a matching route in the alternate routing instance's table.. Filter-based forwarding (FBF) works by matching traffic with a firewall filter and then using a 'routing-instance' action to steer it into an alternate routing table. If the alternate routing instance has no route for the destination IP, the packet cannot be forwarded and is dropped, which matches the symptom described.

Answer

The ingress interface is configured as a trunk port.

Answer

The firewall filter term lacks a 'count' action statement.

Answer

The routing instance type is set to virtual-router instead of forwarding.

Question 3

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct. Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 4

A network engineer wants to verify IS-IS link-state database entries, specifically checking for TLVs that carry extended IP reachability information with wide metrics. Which Junos operational command should be used?

Accepted Answer

show isis database detail. To view the IS-IS link-state database with detailed TLV and metric information on Junos devices, the command 'show isis database detail' is used.

Answer

show isis adjacency extensive

Answer

show ospf database

Answer

show route protocols isis

Question 5

A Junos router is configured as a BGP route reflector. It learns a route from a client and reflects it to a non-client and another client. Which attribute does the route reflector modify or add to prevent routing loops?

Accepted Answer

ORIGINATOR_ID and CLUSTER_LIST. When a route reflector reflects a route, it adds the ORIGINATOR_ID (the router ID of the route's originator) and CLUSTER_LIST (a list of cluster IDs the route has traversed) to prevent routing loops. If a route reflector receives a route with its own router ID in ORIGINATOR_ID or its cluster ID in CLUSTER_LIST, it discards the route.

Answer

MED and NEXT_HOP

Answer

AS_PATH and LOCAL_PREF

Answer

COMMUNITY and ATOMIC_AGGREGATE

Question 6

You are troubleshooting a connectivity issue between an EX4300 switch access port and an end-host. The port is configured as an access port for VLAN 100, but the host cannot communicate. You run 'show ethernet-switching interface ge-0/0/1' and notice the port status is down/down. Which underlying reason most likely explains this state?

Accepted Answer

The physical cable is disconnected or the transceiver is faulty.. A port status of down/down in Junos means the physical layer is not operational — the link itself has no signal. This is distinct from a logical or configuration problem, which would typically show up/down or down/up. A disconnected cable, faulty transceiver, or bad port are the classic causes of down/down. VLAN or BPDU issues would not produce a down/down state because they operate above the physical layer.

Answer

The native VLAN ID does not match the upstream trunk switch.

Answer

BPDU protection has disabled the port due to a loop.

Answer

The VLAN 100 has not been created under the [edit vlans] hierarchy.

Question 7

Which TWO actions occur when a Junos BGP routing policy includes the 'next policy' action? (Choose two)

Accepted Answer

Evaluation of the current policy terminates immediately.. Option A is correct because the 'next policy' action terminates evaluation of the current policy immediately, so no further terms within that policy are processed. Option B is correct because, after stopping the current policy, Junos proceeds to evaluate the next independent policy in the chain (the next policy referenced in the import/export chain), allowing subsequent policies to make the final accept/reject decision. Option C is incorrect because 'next policy' does not itself accept or install a route; acceptance requires an explicit 'accept' action or a default policy decision. Option D is incorrect because 'next policy' does not reject or drop the route; rejection is performed by a 'reject' action. Option E is incorrect because jumping to the next term within the same policy block is not what 'next policy' does; that would be the behavior of 'next term'.

Answer

The route is immediately accepted and installed in the routing table.

Answer

The route is rejected and dropped.

Answer

Evaluation jumps to the next term within the same policy block.

Question 8

What is the purpose of the 'lsp-lifetime' command?

Accepted Answer

To set the duration for which an LSP is valid.. The 'lsp-lifetime' command sets the duration after which an LSP is considered invalid if not refreshed.

Answer

To define how often the DIS sends Hellos.

Answer

To limit the number of LSPs in the database.

Answer

To set how long the adjacency stays up.

Question 9

What is the effect of changing the reference bandwidth in IS-IS?

Accepted Answer

It has no effect on IS-IS.. Changing the reference bandwidth in IS-IS has no effect because IS-IS does not use a reference bandwidth to calculate metrics. Unlike OSPF, where the reference bandwidth is used to compute interface cost, IS-IS uses narrow metrics (default) or wide metrics, and the metric values are configured manually or derived from interface types. The reference bandwidth concept is specific to OSPF.

Answer

It automatically recalculates all interface metrics.

Answer

It increases the hello interval.

Answer

It forces all links to use narrow metrics.

Question 10

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

Accepted Answer

Packets from violating MAC addresses are dropped, and a syslog message/counter is generated while valid traffic continues.. The 'restrict' action causes the switch to drop packets from unauthorized source MAC addresses and increment violation counters, but the port remains up and forwarding for valid MACs.

Answer

The interface immediately shuts down and generates an SNMP trap.

Answer

The violating MAC address is automatically added to a static ARP inspection deny list.

Answer

The switch drops all traffic on the interface until the violation timer expires.

Question 11

Which TWO options represent valid benefits of configuring Link Aggregation Groups (LAG)? (Choose two)

Accepted Answer

Increased aggregate bandwidth between connected networking devices.. Option A is correct because a Link Aggregation Group bundles multiple physical interfaces into a single logical link, so the combined throughput of the member links provides increased aggregate bandwidth between the connected devices. Option D is correct because LAG monitors member link health and, if one physical member link fails, traffic is automatically redistributed across the remaining active links, providing redundancy and failover without losing the logical interface. Option B is incorrect because BGP peer state synchronization is handled by BGP itself (e.g., via TCP sessions and route reflectors), not by LAG. Option C is incorrect because Junos OS upgrades are performed through software management procedures, not through link aggregation. Option E is incorrect because LAG does not eliminate the need for Spanning Tree Protocol in all cases; STP may still be required to prevent loops in topologies with redundant paths outside the LAG.

Answer

Synchronization of BGP routing daemon state between separate routers.

Answer

Automatic upgrade of Junos OS across peer devices.

Answer

Elimination of the need for Spanning Tree Protocol across all VLANs.

Question 12

A network administrator needs to modify the Local Preference path attribute for all routes received from a specific external BGP peer using a routing policy on Junos. Under which configuration hierarchy should the routing policy be applied?

Accepted Answer

protocols bgp group neighbor import. To modify Local Preference for routes received from a specific eBGP peer, the routing policy must be applied as an import policy on that neighbor or group under 'protocols bgp group neighbor import '. Import policies are evaluated on inbound updates, which is where Local Preference is typically set for eBGP-learned routes.

Answer

policy-options policy-statement term then export

Answer

routing-options rib inet.0 static

Answer

protocols ospf area

Question 13

You want to ensure that a static route is only installed in the routing table when a specific tracked object or ping test succeeds. Which Junos feature should you pair with the static route?

Accepted Answer

RPM (Real-time Performance Monitoring) with static route tracking. RPM (Real-time Performance Monitoring) in Junos allows you to configure probes that periodically test reachability of a target (e.g., via ICMP ping) and track the results. When you associate a static route with an RPM probe using the `track` option, the route is only installed in the routing table if the probe succeeds. This provides conditional route installation based on real-time performance monitoring, ensuring the static route is active only when the tracked object is reachable.

Answer

OSPF sham-links

Answer

Keepalive timers on static routes

Answer

BFD synchronized static routes

Question 14

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

Accepted Answer

To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.. A Junos tunnel interface provides a virtual point-to-point Layer 3 link that can carry routing protocol adjacencies across a transport network that may not support multicast or is disjointed. This allows routing protocols like OSPF or BGP to form neighbors over the tunnel, treating it as a direct connection.

Answer

To act as a physical layer 2 bridge for VLAN extension without IP addresses.

Answer

To encrypt all transit traffic by default using hardware-based AES-256.

Answer

To replace physical interfaces for standard local area network connections.

Question 15

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

Accepted Answer

Source MAC address. Layer 2 firewall filters in Junos can match fields such as source MAC address, destination MAC address, VLAN ID, and EtherType.

Answer

Destination IP address

Answer

ICMP type code

Answer

TCP port number

Question 16

Which OSPF packet type is responsible for discovering neighbors and maintaining adjacencies on a Junos device?

Accepted Answer

Hello (Type 1). OSPF Hello packets (Type 1) are responsible for neighbor discovery and maintaining adjacencies. They are sent periodically on OSPF-enabled interfaces, and they carry parameters like router ID, area ID, hello/dead intervals, and neighbor lists. If Hellos stop arriving within the dead interval, the adjacency is torn down.

Answer

Link-State Update (Type 4)

Answer

Link-State Request (Type 3)

Answer

Database Description (Type 2)

Question 17

When calculating OSPF path costs in a network containing high-speed links (such as 10Gbps and 40Gbps interfaces), what default reference bandwidth does Junos use, and what configuration adjustment is typically required to differentiate costs accurately?

Accepted Answer

100 Mbps default; reference bandwidth must be increased to accurately cost high-speed links.. Junos OSPF uses a default reference bandwidth of 100 Mbps, so any interface at 100 Mbps or faster gets a cost of 1, making 1G, 10G, and 40G links indistinguishable. To differentiate high-speed links, the reference bandwidth must be increased (e.g., to 10G or higher) using the reference-bandwidth statement under protocols ospf.

Answer

100 Gbps default; reference bandwidth must be decreased for legacy interfaces.

Answer

10 Gbps default; no adjustment is needed for modern networks.

Answer

1 Gbps default; interfaces above 1 Gbps are automatically assigned fractional costs.

Question 18

Which THREE criteria are evaluated by Junos when electing the primary Routing Engine in an EX Series Virtual Chassis? (Choose three)

Accepted Answer

Switch uptime or boot order sequence if priorities are identical.. Junos elects the primary Routing Engine in an EX Series Virtual Chassis using a defined set of criteria, and option D is correct because the configured routing-engine mastership priority (set with 'set virtual-chassis member X mastership-priority') is the first and most significant factor—the member with the highest priority wins. Option A is correct because when mastership priorities are equal, the switch with the longer uptime (earlier boot order) becomes primary, ensuring a stable and deterministic election. Option C is correct because if both priority and uptime are identical, the base MAC address of the switch is used as a final deterministic tie-breaker, with the lower MAC address typically winning. Option B is incorrect because VRRP router ID on VLAN 1 is a Layer 3 redundancy mechanism unrelated to Virtual Chassis RE election. Option E is incorrect because the number of active LACP links is not a criterion in the Virtual Chassis primary election process.

Answer

The VRRP router ID configured on VLAN 1.

Answer

The number of active LACP links connected to member 0.

Question 19

Which TWO statements are correct regarding the operation of MSTP instance 0 (CIST)? (Choose two.)

Accepted Answer

It handles any VLANs that are not explicitly mapped to another user-defined MST instance.. Option A is correct because MSTP instance 0, the CIST, carries all VLANs that are not explicitly mapped to a user-defined MST instance (MSTI); these unmapped VLANs default to the CIST and are forwarded along the CIST topology. Option D is correct because instance 0 is by definition the Common and Internal Spanning Tree (CIST), which provides the single spanning-tree topology that interconnects all MST regions and also interoperates with external SST/RSTP regions. The unmarked options are wrong: B is false because the CIST does interact with external RSTP switches by treating each external region as a virtual bridge and running RSTP-based interoperation at region boundaries; C is false because MSTP uses the standard 802.1D hop-count limit of 20 (not 1) for the CIST; and E is false because root protection (root guard) can be configured on CIST/instance-0 ports to prevent them from becoming root ports.

Answer

It operates independently without any interaction with external RSTP switches.

Answer

It is limited strictly to a maximum hop count of 1.

Answer

It prohibits the use of root protection on instance 0 ports.

Question 20

An administrator configures a static route with a next-hop that points to an indirect (recursive) address. What condition must be met for this static route to become active in the inet.0 routing table?

Accepted Answer

A more direct route to the next-hop IP must already exist and be active in inet.0.. For a static route with an indirect (recursive) next-hop to become active in inet.0, the router must already have an active route to that next-hop IP in inet.0. This is the definition of recursive resolution: the next-hop must be reachable via another route in the same routing table. Without this, the static route remains hidden.

Answer

The static route preference must be set lower than 1.

Answer

The next-hop IP must be directly connected to a physical interface on the local router.

Answer

BGP multipath must be enabled under routing-options.