JNCIS-ENT Layer 2 Security Practice Test 1 — 15 Questions

Question 1

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broadcast, unknown unicast, and multicast traffic.. On Juniper EX Series switches, the default storm control configuration targets broadcast, unknown unicast, and multicast (BUM) traffic. When you apply a storm control profile with a bandwidth-percentage of 20%, all three traffic types are policed by default unless you explicitly override them. This is because the default action for storm control includes all BUM traffic, and the bandwidth limit applies to each type individually or collectively depending on configuration. The correct answer is therefore D.

Answer

Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

Answer

Broadcast and multicast traffic only, excluding unknown unicast.

Answer

Broadcast traffic only

Question 2

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

Accepted Answer

show ethernet-switching storm-control interface ge-0/0/1. The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Answer

show storm-control statistics interface ge-0/0/1

Answer

show bridge storm-control interface ge-0/0/1

Answer

show interfaces extensive ge-0/0/1 | match storm

Question 3

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

Accepted Answer

show macsec connections. On Junos EX Series switches, MACsec operational state — including the MKA (MACsec Key Agreement) session, CAK/ICK derivation, and secure channel status — is viewed with 'show macsec connections'. This command reports whether the MKA session is up, which peer is the key server, and whether the secure association (SA) is established, making it the correct troubleshooting tool when a PSK-based secure channel fails.

Answer

show ethernet-switching macsec interface

Answer

show protocols mka sessions

Answer

show security macsec status

Question 4

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

Accepted Answer

set switch-options interface ge-0/0/1.0 mac-limit limit 2. The correct hierarchy for configuring port security MAC limits on a specific interface is 'set switch-options interface ge-0/0/1.0 mac-limit limit 2'.

Answer

set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1 maximum-mac-count 2

Answer

set protocols l2-security interface ge-0/0/1 mac-limit 2

Question 5

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

Accepted Answer

set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection. DAI is enabled under ethernet-switching-options secure-access-port vlan for the specific VLAN name.

Answer

set protocols arp-inspection vlan VLAN10

Answer

set vlans VLAN10 dynamic-arp-inspection

Answer

set interfaces vlan unit 10 family inet arp-inspection

Question 6

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

Accepted Answer

set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify. IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Answer

set switch-options interface ge-0/0/5 ip-source-guard-mode strict

Answer

set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

Answer

set protocols ip-source-guard interface ge-0/0/5 enable

Question 7

An administrator configures a Layer 2 firewall filter to match on EtherType 0x88cc (LLDP) and discard those frames on an access port. However, LLDP packets are still reaching adjacent connected devices. Why?

Accepted Answer

LLDP frames are processed by the control plane or hardware before ingress port firewall evaluation.. On Junos, LLDP is a control-plane protocol whose frames are intercepted by the Packet Forwarding Engine and punted to the Routing Engine before user-configured ingress firewall filters on the access port are evaluated. Because LLDP termination happens in hardware/control-plane processing, a Layer 2 filter matching EtherType 0x88cc never sees the frames, so they continue to reach neighbors. To actually block LLDP you must disable it per-interface with 'set protocols lldp interface <name> disable' rather than relying on a firewall filter.

Answer

LLDP uses a multicast destination MAC address that bypasses MAC-filtering rules.

Answer

Layer 2 firewall filters cannot match on EtherType fields in Junos.

Answer

The filter was applied to the output instead of the input direction.

Question 8

You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?

Accepted Answer

from source-mac-address 00:11:22:33:44:55. Layer 2 filter terms match source MAC addresses using 'from source-mac-address 00:11:22:33:44:55'.

Answer

from mac-source-address 00:11:22:33:44:55

Answer

fromethernet-source 00:11:22:33:44:55

Answer

match src-mac 00:11:22:33:44:55

Question 9

You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?

Accepted Answer

Option-82 checks are enabled, and the incoming client request fails validation rules.. When DHCP snooping is enabled with Option-82 (DHCP relay agent information option) validation, the switch inspects incoming DHCP requests on untrusted ports and drops any that fail the validation rules — for example, a request that already contains Option-82 when it should not, or a malformed Option-82 field. This is a security feature to prevent spoofed relay agents. The drop occurs because the client request violates the configured Option-82 checks, not because of MAC learning or DAI.

Answer

The client's MAC address is not yet learned in the switch's Ethernet switching table.

Answer

DHCP snooping drops all DHCP messages on untrusted ports by design.

Answer

Dynamic ARP Inspection is blocking the DHCP request packets.

Question 10

Which operational command displays the status of MACsec connections and associated security association parameters on an EX Series switch?

Accepted Answer

show macsec connections. The command 'show macsec connection' shows active connections and parameters.

Answer

show ethernet-switching macsec

Answer

show protocols mka status

Answer

show security macsec associations

Question 11

You are troubleshooting IP Source Guard on an EX Series switch. You want to see which interfaces have IP Source Guard enabled and their operational state. Which operational command should you use?

Accepted Answer

show ethernet-switching secure-access-port ip-source-guard interface. The command 'show ethernet-switching secure-access-port ip-source-guard' displays IP Source Guard interface statuses.

Answer

show bridge ip-source-guard

Answer

show ip-source-guard interfaces

Answer

show interfaces ip-source-guard brief

Question 12

You are configuring storm control on an EX Series switch and want to specify the rate limit in absolute bandwidth (kilobits per second) rather than a percentage. Which statement achieves this?

Accepted Answer

set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m. Absolute rate limits in storm control are configured using the 'bandwidth' option, such as 'set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m'.

Answer

set protocols storm-control interface ge-0/0/2 speed 10m

Answer

set switch-options storm-control ge-0/0/2 kbps 10000

Answer

set interfaces ge-0/0/2 storm-control rate 10000kbps

Question 13

Which TWO statements describe characteristics of port security in Junos OS? (Choose two)

Accepted Answer

Configurable violation actions include drop, restrict, and shutdown.. Option B is correct because Junos port security supports configurable violation actions such as drop (silently discard offending frames), restrict (drop and log/raise an alarm), and shutdown (err-disable the interface), giving administrators control over how to respond to MAC limit violations. Option D is correct because the core function of port security is to cap the number of source MAC addresses learned on a given interface, protecting against MAC flooding and unauthorized device attachment. Option A is incorrect because MACsec encryption is an independent Layer 2 security feature and is not a prerequisite for port security to enforce MAC limits. Option C is incorrect because DHCP snooping, not port security, inspects DHCP lease transactions to build IP-to-MAC binding tables. Option E is incorrect because 802.1X supplicant authentication is a separate access-control mechanism and is not automatically enabled by port security.

Answer

It requires MACsec encryption to be active on the port before enforcing limits.

Answer

It inspects DHCP lease transactions to build IP-to-MAC binding databases.

Answer

It automatically enables 802.1X supplicant authentication on access ports.

Question 14

Which TWO traffic types are monitored and controlled by default when storm control is applied to an interface on an EX Series switch? (Choose two)

Accepted Answer

Multicast traffic. Storm control targets broadcast, unknown unicast, and multicast traffic by default.

Answer

BPDU control frames generated by Spanning Tree Protocol

Answer

Known unicast traffic destined for active MAC addresses

Question 15

An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?

Accepted Answer

Configure a static IP source entry in the secure-access-port binding table for the server.. Static ARP inspection entries or static IP source bindings can be configured to allow non-DHCP clients through DAI without trusting the entire port.

Answer

Add the server's MAC address to the switch's static MAC-table using 'set bridge-domains'.

Answer

Create a Layer 2 firewall filter permitting ARP packets with action 'accept-and-trust'.

Answer

Configure an explicit static ARP entry under 'set protocols arp static'.