JNCIS-ENT Hard Questions — 25 Difficult Questions

Question 1

An administrator implements filter-based forwarding and applies a firewall filter on the ingress interface. However, traffic matching the filter is dropped rather than routed to the alternate routing instance. Upon investigation, what is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The destination IP address does not have a matching route in the alternate routing instance's table.. Filter-based forwarding (FBF) works by matching traffic with a firewall filter and then using a 'routing-instance' action to steer it into an alternate routing table. If the alternate routing instance has no route for the destination IP, the packet cannot be forwarded and is dropped, which matches the symptom described.

Answer

The ingress interface is configured as a trunk port.

Answer

The firewall filter term lacks a 'count' action statement.

Answer

The routing instance type is set to virtual-router instead of forwarding.

Question 2

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct. Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 3

A Junos router is configured as a BGP route reflector. It learns a route from a client and reflects it to a non-client and another client. Which attribute does the route reflector modify or add to prevent routing loops?

Accepted Answer

ORIGINATOR_ID and CLUSTER_LIST. When a route reflector reflects a route, it adds the ORIGINATOR_ID (the router ID of the route's originator) and CLUSTER_LIST (a list of cluster IDs the route has traversed) to prevent routing loops. If a route reflector receives a route with its own router ID in ORIGINATOR_ID or its cluster ID in CLUSTER_LIST, it discards the route.

Answer

MED and NEXT_HOP

Answer

AS_PATH and LOCAL_PREF

Answer

COMMUNITY and ATOMIC_AGGREGATE

Question 4

What is the purpose of the 'lsp-lifetime' command?

Accepted Answer

To set the duration for which an LSP is valid.. The 'lsp-lifetime' command sets the duration after which an LSP is considered invalid if not refreshed.

Answer

To define how often the DIS sends Hellos.

Answer

To limit the number of LSPs in the database.

Answer

To set how long the adjacency stays up.

Question 5

When calculating OSPF path costs in a network containing high-speed links (such as 10Gbps and 40Gbps interfaces), what default reference bandwidth does Junos use, and what configuration adjustment is typically required to differentiate costs accurately?

Accepted Answer

100 Mbps default; reference bandwidth must be increased to accurately cost high-speed links.. Junos OSPF uses a default reference bandwidth of 100 Mbps, so any interface at 100 Mbps or faster gets a cost of 1, making 1G, 10G, and 40G links indistinguishable. To differentiate high-speed links, the reference bandwidth must be increased (e.g., to 10G or higher) using the reference-bandwidth statement under protocols ospf.

Answer

100 Gbps default; reference bandwidth must be decreased for legacy interfaces.

Answer

10 Gbps default; no adjustment is needed for modern networks.

Answer

1 Gbps default; interfaces above 1 Gbps are automatically assigned fractional costs.

Question 6

Which TWO statements are correct regarding the operation of MSTP instance 0 (CIST)? (Choose two.)

Accepted Answer

It handles any VLANs that are not explicitly mapped to another user-defined MST instance.. Option A is correct because MSTP instance 0, the CIST, carries all VLANs that are not explicitly mapped to a user-defined MST instance (MSTI); these unmapped VLANs default to the CIST and are forwarded along the CIST topology. Option D is correct because instance 0 is by definition the Common and Internal Spanning Tree (CIST), which provides the single spanning-tree topology that interconnects all MST regions and also interoperates with external SST/RSTP regions. The unmarked options are wrong: B is false because the CIST does interact with external RSTP switches by treating each external region as a virtual bridge and running RSTP-based interoperation at region boundaries; C is false because MSTP uses the standard 802.1D hop-count limit of 20 (not 1) for the CIST; and E is false because root protection (root guard) can be configured on CIST/instance-0 ports to prevent them from becoming root ports.

Answer

It operates independently without any interaction with external RSTP switches.

Answer

It is limited strictly to a maximum hop count of 1.

Answer

It prohibits the use of root protection on instance 0 ports.

Question 7

An administrator configures a static route with a next-hop that points to an indirect (recursive) address. What condition must be met for this static route to become active in the inet.0 routing table?

Accepted Answer

A more direct route to the next-hop IP must already exist and be active in inet.0.. For a static route with an indirect (recursive) next-hop to become active in inet.0, the router must already have an active route to that next-hop IP in inet.0. This is the definition of recursive resolution: the next-hop must be reachable via another route in the same routing table. Without this, the static route remains hidden.

Answer

The static route preference must be set lower than 1.

Answer

The next-hop IP must be directly connected to a physical interface on the local router.

Answer

BGP multipath must be enabled under routing-options.

Question 8

While reviewing BGP updates, you notice an attribute type code of 3 with a value representing an IP address. Which well-known mandatory path attribute is this?

Accepted Answer

NEXT_HOP. Attribute type code 3 corresponds to NEXT_HOP, which is a well-known mandatory attribute indicating the IP address of the router used to reach the destination.

Answer

AS_PATH

Answer

ORIGIN

Answer

LOCAL_PREF

Question 9

In an OSPF NSSA configuration on a Junos device, which router is specifically responsible for translating Type 7 LSAs into Type 5 LSAs when propagating routes out of the NSSA into the backbone?

Accepted Answer

The NSSA ABR with the highest router ID. In an OSPF NSSA, Type 7 LSAs are generated by the ASBR for external routes. The NSSA ABR is responsible for translating Type 7 LSAs into Type 5 LSAs when propagating them into the backbone area. If multiple ABRs exist, the one with the highest router ID is elected as the translator to avoid duplicate translation.

Answer

The OSPF Designated Router (DR) on the NSSA segment

Answer

The ASBR that originated the external route

Answer

Any internal NSSA router running Junos OS

Question 10

When troubleshooting a non-functional IP-IP or GRE tunnel on a Junos routing device, which TWO diagnostic steps or commands are commonly utilized? (Choose two.)

Accepted Answer

Use show interfaces gr-0/0/0 to verify that the physical and logical link states are up and packet counters are incrementing.. Option C is correct because `show interfaces gr-0/0/0` (or the equivalent `ip-` interface for IP-IP tunnels) is the standard Junos command to verify that the tunnel interface's physical and logical link states are Up and that input/output packet counters are incrementing, which directly confirms whether traffic is actually traversing the tunnel. Option E is correct because GRE/IP-IP tunnels add encapsulation overhead, so using `ping` with the do-not-fragment (DF) bit set and appropriately sized payloads is a common technique to detect path MTU and fragmentation problems that can silently break tunnel traffic. Option A is not appropriate because rebooting the device is a disruptive, last-resort action and does not constitute a targeted diagnostic step for tunnel troubleshooting. Option B is not appropriate because `clear ip-ip statistics` merely resets counters rather than diagnosing the fault, and clearing counters can actually destroy useful evidence. Option D is not appropriate because `show chassis routing-engine` reports overall control plane CPU and memory on the Routing Engine and does not specifically inspect tunnel encapsulation modules or diagnose tunnel forwarding issues.

Answer

Execute request system reboot immediately to restart tunnel daemon processing.

Answer

Use clear ip-ip statistics to reset tunnel counters.

Answer

Run show chassis routing-engine to check control plane memory utilization of tunnel encapsulation modules.

Question 11

An engineer configures an aggregate route for 172.16.0.0/16 on a Junos device. However, the aggregate route is not active in the routing table. What is the primary requirement for an aggregate route to become active?

Accepted Answer

At least one more-specific contributing route must exist in the routing table.. A Junos aggregate route becomes active only when at least one more-specific contributing route exists in the routing table. The aggregate is generated as a discard route (or with a configured next-hop) and is installed only if a longer-prefix route covered by the aggregate is present.

Answer

An explicit static route matching the aggregate prefix must be configured.

Answer

A discard policy must be explicitly defined under the aggregate route definition.

Answer

The aggregate route must be redistributed using BGP or OSPF.

Question 12

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Accepted Answer

DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.. IP Source Guard (IPSG) relies on the DHCP snooping binding table to validate source IP and MAC addresses on untrusted ports. If DHCP snooping is not enabled on the VLAN, the binding table is not populated, so IPSG has no entries to permit and drops all traffic. The root cause is that DHCP snooping was not enabled on the corresponding VLAN.

Answer

IP Source Guard requires static ARP inspection to be enabled simultaneously.

Answer

The client's MAC address is in the port security violation log.

Answer

IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

Question 13

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

Accepted Answer

family inet6. The GRE tunnel is being used to carry IPv6 traffic, so the logical unit must be configured with family inet6 to process IPv6 packets. The transport is IPv4, but that is handled by the tunnel's source/destination addresses configured under the tunnel parameters, not by the unit's family. Configuring family inet6 on the gr- interface unit enables IPv6 forwarding, addressing, and protocol processing inside the tunnel.

Answer

family inet

Answer

family iso

Answer

family mpls

Question 14

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Accepted Answer

A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.. Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Answer

The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

Answer

The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

Answer

DHCP snooping is blocking the MACsec control frames on the transit link.

Question 15

You configure an aggregate route and want to control which specific attributes or policies are applied when the aggregate is advertised by BGP. Which routing option is used to assign a specific contributing route tag or policy to an aggregate route?

Accepted Answer

set routing-options aggregate route 10.10.0.0/16 metric 100. Aggregate routes can have specific attributes like preference, metric, and tags assigned using the routing-options aggregate hierarchy.

Answer

set routing-instances aggregate-property

Answer

set protocols bgp aggregate-attribute 10.10.0.0/16

Answer

set routing-options aggregate route 10.10.0.0/16 policy

Question 16

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Accepted Answer

DHCP snooping. DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks. OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Answer

OSPFv3 authentication

Answer

MACsec point-to-point encryption

Question 17

Which THREE attributes are optional transitive BGP path attributes? (Choose three)

Accepted Answer

AS4_PATH. AS4_PATH (A) is an optional transitive attribute defined in RFC 6793 that carries 4-byte AS path information for backward compatibility with 2-byte AS speakers, and it is propagated to other ASes. AGGREGATOR (B) is an optional transitive attribute (type code 7) that records the AS and router ID of the device that performed route aggregation, and it is passed along to BGP peers. COMMUNITY (D) is an optional transitive attribute (type code 8) used to tag routes with community values that are propagated across AS boundaries. MED (C) is an optional nontransitive attribute, so it is not propagated beyond the neighboring AS, and LOCAL_PREF (E) is a well-known discretionary attribute used only within a single AS, so neither qualifies as optional transitive.

Answer

MED

Answer

LOCAL_PREF

Question 18

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Accepted Answer

Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.. Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network. Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Answer

Disabling all Layer 2 learning on the translation interface.

Answer

Enabling OSPFv3 routing directly on the customer edge interface unit 0.

Question 19

An operator executes the 'show ospf database' command on a Junos device and notices multiple Type 2 Network LSAs. Under which specific network topology condition are Type 2 LSAs generated?

Accepted Answer

Multi-access broadcast segments with an active Designated Router. Type 2 Network LSAs are generated by the Designated Router (DR) on multi-access broadcast segments (e.g., Ethernet) to represent the subnet and list all routers attached to that segment. The DR originates the Network LSA, which includes the DR's interface IP address and the Router IDs of all OSPF routers on the segment. This LSA is only produced when a DR is elected, which occurs on broadcast or NBMA networks where multiple routers share the same subnet. Thus, option D correctly identifies the condition.

Answer

Stub areas filtering out external LSA advertisements

Answer

Virtual links traversing a non-backbone transit area

Answer

Point-to-point links between two directly connected routers

Question 20

An engineer needs to influence the DIS election on a multi-access broadcast segment running IS-IS on Junos devices. Which configuration parameter and hierarchy should the engineer modify to guarantee a specific router wins the DIS election?

Accepted Answer

Configure 'set protocols isis interface priority ' where a higher value wins.. The DIS election in IS-IS is influenced by the interface priority. Configuring 'set protocols isis interface priority ' with a higher value increases the likelihood of winning the DIS election. The default priority is 64, and the highest priority wins; if tied, the highest MAC address wins.

Answer

Configure 'set protocols isis reference-bandwidth <value>' globally.

Answer

Configure 'set protocols isis lsp-interval <value>' to speed up PDU transmission.

Answer

Configure 'set protocols isis level <1|2> metric ' to lower the interface cost.