JNCIS-ENT Practice Test 7 — 10 Questions

Question 1

You are troubleshooting an OSPF network where an ASBR is injecting external routes. Routers in other areas need to reach this ASBR. Which LSA type provides the reachability information to the ASBR itself?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Type 4 (ASBR Summary LSA). Type 4 (ASBR Summary LSA) is generated by the ABR to advertise the reachability of an ASBR to routers in other areas. Since Type 5 LSAs are flooded throughout the OSPF domain but do not contain the ASBR's router ID reachability information, routers in non-backbone areas need a Type 4 LSA to know how to reach the ASBR that originated the Type 5 LSAs.

Answer

Type 2 (Network LSA)

Answer

Type 7 (NSSA External LSA)

Answer

Type 5 (AS-external LSA)

Question 2

Why would you set an interface to 'passive' in IS-IS?

Accepted Answer

To include the network in the LSP without forming an adjacency.. Setting an interface to passive in IS-IS instructs the router to advertise the interface's connected subnet into its LSP (Link State PDU) without sending or processing IIH (IS-IS Hello) packets on that interface. This means no adjacency is formed over the link, but the prefix is still reachable via the router's own LSP. It is commonly used on interfaces facing stub networks or hosts where forming an adjacency is unnecessary or undesirable.

Answer

To speed up the DIS election process.

Answer

To force the interface to be a point-to-point link.

Answer

To enable authentication on that interface.

Question 3

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

Accepted Answer

Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.. The most likely cause is missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface. The tunnel itself is up (since Router A can ping Router B's tunnel IP), but traffic from behind Router A to behind Router B requires routes to the remote subnets via the tunnel. Without these routes, packets are dropped or sent elsewhere.

Answer

The GRE tunnel source IP address is configured incorrectly.

Answer

The physical interface MTU is set too high.

Answer

The gr- interface family inet address is missing.

Question 4

You need to ensure that BGP sessions fail over within sub-second intervals if a link degrades or goes down. Which protocol should you integrate with BGP on your Junos router?

Accepted Answer

BFD (Bidirectional Forwarding Detection). BFD (Bidirectional Forwarding Detection) provides fast failure detection that can trigger BGP session teardown within milliseconds.

Answer

STP (Spanning Tree Protocol)

Answer

LDP (Label Distribution Protocol)

Answer

OSPF

Question 5

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

Accepted Answer

OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.. OSPF sends hello packets to the multicast address 224.0.0.5 (AllSPFRouters) using IP protocol 89. For OSPF to form an adjacency over a GRE tunnel, the tunnel must properly forward multicast traffic and not filter protocol 89. If the underlying network or tunnel configuration blocks multicast or protocol 89, hellos are not received, and the adjacency fails. Unicast pings succeed because they are unicast IP packets, not multicast, and may use a different protocol (ICMP), so they do not test the multicast forwarding path or protocol 89 filtering. Thus, the most likely cause is that multicast hellos are not being delivered.

Answer

The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.

Answer

Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.

Answer

GRE tunnels do not support routing protocols such as OSPF under any circumstances.

Question 6

You are troubleshooting an OSPF network and notice that a router's OSPF state is stuck in 'ExStart'. What is the most common reason for this adjacency state issue?

Accepted Answer

An MTU mismatch between the neighboring OSPF interfaces. OSPF adjacency stuck in ExStart is almost always caused by an MTU mismatch between the two neighbors. During ExStart, routers exchange DBD packets to elect a master/slave and agree on the initial sequence number; if the interface MTUs differ, the larger DBD packets are dropped, and the routers keep retransmitting without progressing to Exchange. This is the classic ExStart/Exchange hang.

Answer

Duplicate OSPF router IDs in the network

Answer

Different authentication passwords on the links

Answer

A mismatch in the OSPF area ID configuration

Question 7

When configuring MSTP, what purpose does the regional configuration digest serve?

Accepted Answer

It allows neighboring switches to verify if they belong to the same MST region.. The MSTP regional configuration digest is a hash value computed from the MST region's configuration (name, revision level, and VLAN-to-instance mapping). It is included in BPDUs so that neighboring switches can verify whether they are in the same MST region. If the digest does not match, the switches consider themselves in different regions, and the boundary ports operate as if connecting to different MST regions.

Answer

It encrypts the BPDU payload to prevent tampering by unauthorized access switches.

Answer

It acts as a dynamic bridge priority modifier for internal instance root selection.

Answer

It determines the Designated Master Bridge within the CIST instance.

Question 8

You need to modify the bridge priority of an EX Series switch running RSTP to ensure it becomes the root bridge. Which configuration command correctly sets the bridge priority to 4096?

Accepted Answer

set protocols rstp bridge-priority 4096. On Juniper EX Series switches, RSTP is configured under the [edit protocols rstp] hierarchy. The bridge priority is set using the 'bridge-priority' command, so the correct full command is 'set protocols rstp bridge-priority 4096'. This value is used in the bridge ID and must be a multiple of 4096 (ranging from 0 to 61440). Setting it to 4096 makes the switch highly likely to become the root bridge, assuming no other switch has a lower priority.

Answer

set spanning-tree priority 4096

Answer

set protocols rstp priority 4096

Answer

set bridge-priority 4096

Question 9

Which TWO commands are used to verify link aggregation and LACP operational status on a Juniper switch? (Choose two)

Accepted Answer

show interfaces ae0. Option C, 'show interfaces ae0', is correct because the aggregated Ethernet (ae) interface is the logical bundle created by link aggregation, and this command displays its operational status, member links, and whether the bundle is up. Option D, 'show lacp interface', is correct because it directly reports LACP protocol state per member interface, including actor/partner state flags (such as whether the link is collecting and distributing) and LACP operational status. Option A, 'show virtual-chassis', is unrelated since it displays Virtual Chassis topology and member roles, not link aggregation. Option B, 'show vrrp detail', concerns VRRP redundancy state and has nothing to do with LACP or aggregation. Option E, 'show chassis routing-engine', reports Routing Engine status and resources, not link aggregation or LACP.

Answer

show virtual-chassis

Answer

show vrrp detail

Answer

show chassis routing-engine

Question 10

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Accepted Answer

Enable MACsec on the physical interface.. Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session. Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

Answer

Configure the interface as a trusted port for Dynamic ARP Inspection.

Answer

Enable DHCP snooping on the transit VLAN.