JNCIS-ENT Layer 2 Security — 10 Questions

Question 1

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broadcast, unknown unicast, and multicast traffic.. On Juniper EX Series switches, the default storm control configuration targets broadcast, unknown unicast, and multicast (BUM) traffic. When you apply a storm control profile with a bandwidth-percentage of 20%, all three traffic types are policed by default unless you explicitly override them. This is because the default action for storm control includes all BUM traffic, and the bandwidth limit applies to each type individually or collectively depending on configuration. The correct answer is therefore D.

Answer

Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

Answer

Broadcast and multicast traffic only, excluding unknown unicast.

Answer

Broadcast traffic only

Question 2

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

Accepted Answer

show ethernet-switching storm-control interface ge-0/0/1. The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Answer

show storm-control statistics interface ge-0/0/1

Answer

show bridge storm-control interface ge-0/0/1

Answer

show interfaces extensive ge-0/0/1 | match storm

Question 3

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

Accepted Answer

show macsec connections. On Junos EX Series switches, MACsec operational state — including the MKA (MACsec Key Agreement) session, CAK/ICK derivation, and secure channel status — is viewed with 'show macsec connections'. This command reports whether the MKA session is up, which peer is the key server, and whether the secure association (SA) is established, making it the correct troubleshooting tool when a PSK-based secure channel fails.

Answer

show ethernet-switching macsec interface

Answer

show protocols mka sessions

Answer

show security macsec status

Question 4

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

Accepted Answer

set switch-options interface ge-0/0/1.0 mac-limit limit 2. The correct hierarchy for configuring port security MAC limits on a specific interface is 'set switch-options interface ge-0/0/1.0 mac-limit limit 2'.

Answer

set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1 maximum-mac-count 2

Answer

set protocols l2-security interface ge-0/0/1 mac-limit 2

Question 5

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

Accepted Answer

set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection. DAI is enabled under ethernet-switching-options secure-access-port vlan for the specific VLAN name.

Answer

set protocols arp-inspection vlan VLAN10

Answer

set vlans VLAN10 dynamic-arp-inspection

Answer

set interfaces vlan unit 10 family inet arp-inspection

Question 6

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

Accepted Answer

set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify. IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Answer

set switch-options interface ge-0/0/5 ip-source-guard-mode strict

Answer

set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

Answer

set protocols ip-source-guard interface ge-0/0/5 enable

Question 7

An administrator configures a Layer 2 firewall filter to match on EtherType 0x88cc (LLDP) and discard those frames on an access port. However, LLDP packets are still reaching adjacent connected devices. Why?

Accepted Answer

LLDP frames are processed by the control plane or hardware before ingress port firewall evaluation.. On Junos, LLDP is a control-plane protocol whose frames are intercepted by the Packet Forwarding Engine and punted to the Routing Engine before user-configured ingress firewall filters on the access port are evaluated. Because LLDP termination happens in hardware/control-plane processing, a Layer 2 filter matching EtherType 0x88cc never sees the frames, so they continue to reach neighbors. To actually block LLDP you must disable it per-interface with 'set protocols lldp interface <name> disable' rather than relying on a firewall filter.

Answer

LLDP uses a multicast destination MAC address that bypasses MAC-filtering rules.

Answer

Layer 2 firewall filters cannot match on EtherType fields in Junos.

Answer

The filter was applied to the output instead of the input direction.

Question 8

You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?

Accepted Answer

from source-mac-address 00:11:22:33:44:55. Layer 2 filter terms match source MAC addresses using 'from source-mac-address 00:11:22:33:44:55'.

Answer

from mac-source-address 00:11:22:33:44:55

Answer

fromethernet-source 00:11:22:33:44:55

Answer

match src-mac 00:11:22:33:44:55

Question 9

You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?

Accepted Answer

Option-82 checks are enabled, and the incoming client request fails validation rules.. When DHCP snooping is enabled with Option-82 (DHCP relay agent information option) validation, the switch inspects incoming DHCP requests on untrusted ports and drops any that fail the validation rules — for example, a request that already contains Option-82 when it should not, or a malformed Option-82 field. This is a security feature to prevent spoofed relay agents. The drop occurs because the client request violates the configured Option-82 checks, not because of MAC learning or DAI.

Answer

The client's MAC address is not yet learned in the switch's Ethernet switching table.

Answer

DHCP snooping drops all DHCP messages on untrusted ports by design.

Answer

Dynamic ARP Inspection is blocking the DHCP request packets.

Question 10

Which operational command displays the status of MACsec connections and associated security association parameters on an EX Series switch?

Accepted Answer

show macsec connections. The command 'show macsec connection' shows active connections and parameters.

Answer

show ethernet-switching macsec

Answer

show protocols mka status

Answer

show security macsec associations