An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?
An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?
An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?
You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?
An administrator configures a Layer 2 firewall filter to match on EtherType 0x88cc (LLDP) and discard those frames on an access port. However, LLDP packets are still reaching adjacent connected devices. Why?
You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?
You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?
You are troubleshooting IP Source Guard on an EX Series switch. You want to see which interfaces have IP Source Guard enabled and their operational state. Which operational command should you use?
You are configuring storm control on an EX Series switch and want to specify the rate limit in absolute bandwidth (kilobits per second) rather than a percentage. Which statement achieves this?
An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?
Which TWO conditions must be met for Dynamic ARP Inspection (DAI) to successfully forward an ARP request or reply packet on an access port? (Choose two)
An administrator implements MACsec to secure links between switches. Which THREE operational tasks or verifications are relevant when troubleshooting MACsec and MKA? (Choose three)
An administrator notices that a rogue DHCP server on access port ge-0/0/1.0 is handing out incorrect IP addresses to clients on a Juniper Networks EX Series switch running Junos OS. Which configuration statement enables DHCP snooping and correctly trusts the uplink interface ge-0/0/24.0 connected to the legitimate core switch?
You are configuring MACsec on a link between two EX Series switches to secure data in transit. Which operational command verifies that the MACsec secure channels are established and operational?
An access port on an EX Series switch is configured with port security to allow a maximum of 2 MAC addresses. When a 3rd device is connected, the port immediately shuts down. Which action statement under 'ethernet-switching-options secure-access-port' achieves this behavior?
You need to apply a Layer 2 firewall filter named 'block-rogue-mac' to inbound traffic on all access ports of an EX2300 switch. Under which hierarchy level must the filter be bound?
You are configuring a Layer 2 firewall filter on an EX Series switch to prevent IP spoofing on an access port. You want to ensure that only traffic from the DHCP-assigned IP address is permitted, while all other IP traffic is dropped. Which action should you take in the filter term?
An administrator is troubleshooting a DHCP snooping issue on an EX Series switch. Clients on VLAN 10 are not receiving IP addresses from the legitimate DHCP server connected to port ge-0/0/24. The switch is configured with DHCP snooping enabled on VLAN 10, and ge-0/0/24 is configured as a trusted port. Which action should be taken to resolve the problem?
You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?
You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?
Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?
You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?
An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?
You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?
An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?
An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?
You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?
An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?
An administrator configures a Layer 2 firewall filter to drop all ARP packets with a specific invalid sender hardware address. The filter is applied to a VLAN interface. What special consideration must be taken when applying Layer 2 filters to VLANs in Junos?
You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?
An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?
An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?
When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)
Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)
An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)
An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)
An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?
You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?
You are deploying a new access switch in a campus network. The security policy requires that all ARP packets received on untrusted access ports be validated against the DHCP snooping database, and that any ARP packet with an invalid IP-to-MAC binding be dropped and logged. You configure DHCP snooping on VLAN 100 and enable the appropriate feature on the untrusted ports. Which Junos OS feature must you enable to meet the policy requirement?
You are configuring port security on an EX Series switch. The security policy states that when a MAC limit is exceeded on an access port, the port should be shut down and remain down until manually re-enabled by an administrator. Which configuration action accomplishes this requirement?
You are asked to implement a Layer 2 security feature that prevents a user from connecting a small unmanaged switch to an access port and generating traffic from multiple MAC addresses. The solution should limit the number of MAC addresses learned on the port to one. Which Junos OS feature should you configure?
An administrator wants to protect against MAC flooding attacks on an EX Series switch access port. The port should learn a maximum of 5 MAC addresses and drop frames with unknown source MAC addresses after that limit is reached. Which feature should be configured?
You are implementing MACsec on an EX Series switch to secure a point-to-point link between two data centers. The link uses a 10 Gigabit Ethernet interface. You want to ensure that only encrypted traffic is accepted and that unencrypted frames are dropped. Which configuration parameter must be set on the interface?