JNCIS-ENT Layer 2 Security — 20 Questions

Question 1

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

set switch-options interface ge-0/0/1.0 mac-limit limit 2. The correct hierarchy for configuring port security MAC limits on a specific interface is 'set switch-options interface ge-0/0/1.0 mac-limit limit 2'.

Answer

set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1 maximum-mac-count 2

Answer

set protocols l2-security interface ge-0/0/1 mac-limit 2

Question 2

You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?

Accepted Answer

from source-mac-address 00:11:22:33:44:55. Layer 2 filter terms match source MAC addresses using 'from source-mac-address 00:11:22:33:44:55'.

Answer

from mac-source-address 00:11:22:33:44:55

Answer

fromethernet-source 00:11:22:33:44:55

Answer

match src-mac 00:11:22:33:44:55

Question 3

Which TWO traffic types are monitored and controlled by default when storm control is applied to an interface on an EX Series switch? (Choose two)

Accepted Answer

Multicast traffic. Storm control targets broadcast, unknown unicast, and multicast traffic by default.

Answer

BPDU control frames generated by Spanning Tree Protocol

Answer

Known unicast traffic destined for active MAC addresses

Question 4

Which TWO methods can be used to recover an EX Series switch interface that has been shut down due to a port security violation? (Choose two)

Accepted Answer

Disabling and re-enabling the physical interface using CLI configuration changes. Ports shut down by port security can be recovered using the 'clear ethernet-switching security-violation' command or by manually toggling interface admin state (disable/enable).

Answer

Clearing the DHCP snooping binding database cache

Answer

Executing 'clear interfaces statistics' for the affected port

Question 5

An administrator notices that a rogue DHCP server on access port ge-0/0/1.0 is handing out incorrect IP addresses to clients on a Juniper Networks EX Series switch running Junos OS. Which configuration statement enables DHCP snooping and correctly trusts the uplink interface ge-0/0/24.0 connected to the legitimate core switch?

Accepted Answer

set vlans Data vlan-id 10 interface ge-0/0/1.0 and set protocols dhcp-snooping vlan Data interface ge-0/0/24.0 trusted. DHCP snooping drops DHCP messages from untrusted ports if they originate from server-side messages. To allow valid server responses, the interface connected to the legitimate DHCP server must be explicitly configured as trusted.

Answer

set protocols dhcp-snooping vlan default interface ge-0/0/1.0 untrusted and set protocols dhcp-snooping vlan default interface ge-0/0/24.0 trusted

Answer

set security dhcp-snooping interface ge-0/0/1.0 mode block and set security dhcp-snooping interface ge-0/0/24.0 mode permit

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1.0 dhcp-snooping and set ethernet-switching-options secure-access-port interface ge-0/0/24.0 trusted

Question 6

Which TWO parameters can be configured when setting up storm control on an EX Series switch? (Choose two)

Accepted Answer

Maximum allowed MAC address count. Storm control in Junos allows specifying bandwidth thresholds using either a percentage of total link bandwidth or a specific bit-rate (bps).

Answer

DHCP lease time expiration limit

Answer

MACsec cryptographic key length

Question 7

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

Accepted Answer

Broadcast, unknown unicast, and multicast traffic.. By default, Junos storm control monitors and limits broadcast, unknown unicast, and multicast traffic collectively when configured on an interface unless restricted.

Answer

Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

Answer

Broadcast and multicast traffic only, excluding unknown unicast.

Answer

Broadcast traffic only

Question 8

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

Accepted Answer

show ethernet-switching storm-control interface ge-0/0/1. The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Answer

show storm-control statistics interface ge-0/0/1

Answer

show bridge storm-control interface ge-0/0/1

Answer

show interfaces extensive ge-0/0/1 | match storm

Question 9

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

Accepted Answer

The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.. When an interface is shut down due to a port security violation, it enters a disabled state. It remains down until explicitly re-enabled using 'clear ethernet-switching security-violation' or by toggling the interface status.

Answer

The interface automatically recovers after a default hold-down timer of 300 seconds.

Answer

The interface drops violating packets but remains operationally up until manually disabled.

Answer

The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

Question 10

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

Accepted Answer

Configure the interface as a trusted interface for DHCP snooping.. Ports facing legitimate DHCP servers must be designated as trusted using 'set ethernet-switching-options secure-access-port vlan dhcp-snooping interface trusted'.

Answer

Configure the interface as a trunk port.

Answer

Apply an ingress firewall filter blocking UDP port 67.

Answer

Enable IP Source Guard on the uplink interface.

Question 11

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

Accepted Answer

show macsec connections. To view MACsec and MKA operational status, session states, and connectivity associations, the command 'show macsec connections' is used.

Answer

show ethernet-switching macsec interface

Answer

show protocols mka sessions

Answer

show security macsec status

Question 12

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

Accepted Answer

DHCP Snooping. DHCP snooping must be enabled on the VLAN or switch to intercept DHCP messages and build the binding database.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security MAC-Limit

Question 13

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

Accepted Answer

MACsec Key Agreement (MKA) protocol. MACsec in Junos uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X, to discover peers and manage cryptographic keys.

Answer

Internet Key Exchange version 2 (IKEv2)

Answer

Secure Session Protocol (SSP)

Answer

802.1AE Dynamic Key Distribution (AKD)

Question 14

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

Accepted Answer

set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection. DAI is enabled under ethernet-switching-options secure-access-port vlan for the specific VLAN name.

Answer

set protocols arp-inspection vlan VLAN10

Answer

set vlans VLAN10 dynamic-arp-inspection

Answer

set interfaces vlan unit 10 family inet arp-inspection

Question 15

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Accepted Answer

DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.. IP Source Guard relies entirely on the DHCP snooping binding database. If the DHCP snooping feature is not enabled on that specific VLAN, no database entries are created, causing IP Source Guard to drop traffic.

Answer

IP Source Guard requires static ARP inspection to be enabled simultaneously.

Answer

The client's MAC address is in the port security violation log.

Answer

IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

Question 16

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

Accepted Answer

Applied to the input of an interface or VLAN under family ethernet-switching.. Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Answer

Applied to the routing-instance forwarding table.

Answer

Applied globally under system services l2-firewall.

Answer

Applied to the output of the VLAN interface under family inet.

Question 17

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

Accepted Answer

The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.. Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Answer

The static client is using an IP address outside the DHCP pool range.

Answer

The client's MAC address violates the port security maximum limit.

Answer

DAI requires all interfaces to be trusted on the VLAN.

Question 18

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

Accepted Answer

show ethernet-switching dhcp-snooping binding. The operational command to view DHCP snooping bindings is 'show ethernet-switching dhcp-snooping binding'.

Answer

show dhcp-snooping binding

Answer

show system dhcp-snooping database

Answer

show bridge dhcp bindings

Question 19

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

Accepted Answer

set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify. IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Answer

set switch-options interface ge-0/0/5 ip-source-guard-mode strict

Answer

set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

Answer

set protocols ip-source-guard interface ge-0/0/5 enable

Question 20

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

Accepted Answer

clear ethernet-switching security-violation. Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Answer

reset interface security-violations

Answer

clear bridge security-counters

Answer

clear arp-inspection statistics