JNCIS-ENT Layer 2 Security Practice Test 2 — 15 Questions

Question 1

Which THREE actions can be configured as a response to a Dynamic ARP Inspection (DAI) violation on an EX Series switch? (Choose three)

Accepted Answer

Logging the violation event via syslog. On Juniper EX Series switches, DAI inspects ARP packets on untrusted interfaces and, upon detecting a violation, can perform three configurable actions: logging the event via syslog (Option A), incrementing DAI drop counters (Option D), and dropping the violating ARP packet (Option E). Option A is correct because DAI can generate a syslog message for each violation, which is useful for auditing and troubleshooting. Option D is correct because the switch maintains DAI statistics and increments drop counters for each violating packet, allowing monitoring via operational commands. Option E is correct because the primary enforcement action is to discard the offending ARP packet, preventing ARP spoofing or poisoning. Option B is not a DAI response action; interface shutdown would require separate mechanisms such as MAC limiting or error-disable, not DAI itself. Option C is incorrect because DAI inspection occurs in hardware or on the line card, not by redirecting violating packets to the Routing Engine CPU for inspection.

Answer

Automatically shutting down the offending interface

Answer

Redirecting violating ARP packets to the Routing Engine CPU for inspection

Question 2

Which TWO commands are valid Junos operational commands used to verify secure access port features? (Choose two)

Accepted Answer

show ethernet-switching dhcp-snooping binding. Option A, `show ethernet-switching dhcp-snooping binding`, is correct because DHCP snooping is a secure access port feature on Junos EX switches, and this operational command displays the snooped DHCP bindings (IP-to-MAC-to-interface mappings) that the switch builds and uses to validate traffic. Option B, `show ethernet-switching secure-access-port ip-source-guard interface`, is correct because IP source guard is another secure access port feature, and this command verifies the IP source guard bindings/entries on a given interface to confirm that only legitimate source IP/MAC pairs are permitted. The unmarked options do not belong: `show bridge-domain secure-access status` is not a valid Junos operational command for this purpose, `show arp-inspection database` is not the correct Junos syntax for verifying DAI (the relevant command is `show ethernet-switching arp-inspection`), and `show security port-security summary` is not a valid Junos secure access port verification command.

Answer

show bridge-domain secure-access status

Answer

show arp-inspection database

Answer

show security port-security summary

Question 3

Which TWO conditions must be met for Dynamic ARP Inspection (DAI) to successfully forward an ARP request or reply packet on an access port? (Choose two)

Accepted Answer

The incoming interface is explicitly configured as a trusted interface for DAI.. Dynamic ARP Inspection validates ARP packets on untrusted access ports by checking them against trusted sources of IP-to-MAC bindings. Option B is correct because an interface explicitly configured as trusted with the ip arp inspection trust command bypasses DAI validation entirely, so ARP packets arriving on it are forwarded without inspection. Option D is correct because on untrusted ports DAI compares the sender's IP and MAC against the DHCP snooping binding database (or a configured ARP access-list/static binding), and only matching packets are permitted. Option A is not one of the two required conditions because the system static ARP table is not the DAI validation source; DAI uses the DHCP snooping binding database, ARP ACLs, and ip source binding entries. Option C is irrelevant because port security MAC limits on trunk ports have no bearing on DAI forwarding decisions. Option E is incorrect because a gratuitous ARP with a broadcast destination is not a requirement for DAI to forward a packet.

Answer

The packet matches an entry in the system static ARP table.

Answer

Port security MAC-limit has not been reached on any adjacent trunk port.

Answer

The ARP packet contains a valid gratuitous broadcast destination MAC address.

Question 4

An administrator implements MACsec to secure links between switches. Which THREE operational tasks or verifications are relevant when troubleshooting MACsec and MKA? (Choose three)

Accepted Answer

Verifying MKA peer connectivity state using 'show macsec connections'.. Option B is correct because 'show macsec connections' (or equivalent platform command) displays the MKA peer connectivity state, including whether the CAK/CKN authentication has succeeded and the secure channel is established. Option D is correct because MACsec's MKA requires both peers to share identical CAK (Connectivity Association Key) and CKN (Connectivity Association Key Name) values; a mismatch prevents the secure association from forming. Option E is correct because monitoring encryption and decryption packet error counters (e.g., via interface MACsec statistics) reveals integrity check failures, replay drops, or cipher mismatches that indicate a broken or misconfigured secure channel. Option A is incorrect because MACsec frames use EtherType 0x88E5, and a Layer 2 firewall filter that blocks this EtherType would intentionally drop MACsec traffic rather than being a valid troubleshooting verification. Option C is incorrect because DHCP binding tables track IP-to-MAC address leases and have no role in MACsec key distribution, which is handled by MKA using the CAK/CKN.

Answer

Ensuring Layer 2 firewall filters are blocking MACsec EtherType 0x88E5.

Answer

Inspecting DHCP binding tables to verify MACsec key distribution.

Question 5

Which TWO options are valid violation actions available for port security configurations in Junos OS? (Choose two)

Accepted Answer

restrict. In Junos OS port security, the two supported violation actions are restrict and shutdown, configured under the interface's port-security stanza. Option D (restrict) is correct because it drops frames from MAC addresses that exceed the configured limit while optionally generating an SNMP trap or log entry, without taking the interface down. Option E (shutdown) is correct because it disables the interface (placing it in a down state) when a violation occurs, requiring manual intervention or errdisable recovery to restore it. Option A (isolate) is not a valid Junos port-security violation action; isolation is not an available keyword for this feature. Option B (rate-limit) is not a violation action but rather a traffic policing mechanism used elsewhere in Junos configuration. Option C (quarantine) is also not a valid Junos port-security violation action; no such keyword exists for this purpose.

Answer

isolate

Answer

rate-limit

Answer

quarantine

Question 6

Which TWO parameters can be configured when setting up storm control on an EX Series switch interface? (Choose two)

Accepted Answer

Absolute bandwidth rate in kilobits or megabits per second. Storm control on EX Series switches lets you set the traffic threshold either as an absolute bandwidth rate in kilobits or megabits per second (option A) or as a bandwidth percentage of the total port capacity (option D); both are valid ways to define the storm-control level in the [edit interfaces ge-x/y/z unit 0 family ethernet-switching storm-control] hierarchy. Option A is correct because the CLI accepts values such as 'storm-control bandwidth 10000' (kbps) or higher units, directly capping the allowed rate. Option D is correct because 'storm-control bandwidth percentage 5' expresses the threshold relative to the physical interface's line rate, which is useful when the same policy is applied across ports of different speeds. Options B, C, and E are incorrect: WRED drop-probability curves are congestion-avoidance features configured under CoS/scheduler settings, not storm control; TCP window scaling is a host/endpoint TCP stack parameter unrelated to switch storm control; and MTU enforcement is a frame-size setting configured separately (e.g., 'mtu' or 'family ethernet-switching' MTU), not a storm-control parameter.

Answer

Explicit packet drop probability curve using WRED profiles

Answer

Maximum TCP window scaling factor

Answer

Maximum frame byte size limit for MTU enforcement

Question 7

Which TWO methods can be used to recover an EX Series switch interface that has been shut down due to a port security violation? (Choose two)

Accepted Answer

Disabling and re-enabling the physical interface using CLI configuration changes. Ports shut down by port security can be recovered using the 'clear ethernet-switching security-violation' command or by manually toggling interface admin state (disable/enable).

Answer

Clearing the DHCP snooping binding database cache

Answer

Executing 'clear interfaces statistics' for the affected port

Question 8

An administrator notices that a rogue DHCP server on access port ge-0/0/1.0 is handing out incorrect IP addresses to clients on a Juniper Networks EX Series switch running Junos OS. Which configuration statement enables DHCP snooping and correctly trusts the uplink interface ge-0/0/24.0 connected to the legitimate core switch?

Accepted Answer

set vlans Data vlan-id 10 interface ge-0/0/1.0 and set protocols dhcp-snooping vlan Data interface ge-0/0/24.0 trusted. DHCP snooping drops DHCP messages from untrusted ports if they originate from server-side messages. To allow valid server responses, the interface connected to the legitimate DHCP server must be explicitly configured as trusted.

Answer

set protocols dhcp-snooping vlan default interface ge-0/0/1.0 untrusted and set protocols dhcp-snooping vlan default interface ge-0/0/24.0 trusted

Answer

set security dhcp-snooping interface ge-0/0/1.0 mode block and set security dhcp-snooping interface ge-0/0/24.0 mode permit

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1.0 dhcp-snooping and set ethernet-switching-options secure-access-port interface ge-0/0/24.0 trusted

Question 9

You are configuring MACsec on a link between two EX Series switches to secure data in transit. Which operational command verifies that the MACsec secure channels are established and operational?

Accepted Answer

show macsec connections. The correct operational command to verify MACsec secure channels on Junos EX Series switches is 'show macsec connections'. This command displays the status of MACsec sessions, including the secure channel and secure association states. The other commands either do not exist or are not the standard way to verify MACsec operational status on EX platforms.

Answer

show layer2-security macsec summary

Answer

show ethernet-switching macsec interface

Answer

show security macsec status

Question 10

An access port on an EX Series switch is configured with port security to allow a maximum of 2 MAC addresses. When a 3rd device is connected, the port immediately shuts down. Which action statement under 'ethernet-switching-options secure-access-port' achieves this behavior?

Accepted Answer

set ethernet-switching-options secure-access-port interface ge-0/0/2.0 violation-action shutdown. In Junos port security configuration, violation actions include drop, shutdown, and restrict. Setting the violation action to 'shutdown' disables the interface upon a limit breach.

Answer

set switch-options interface ge-0/0/2.0 mac-limit action block-and-shutdown

Answer

set protocols port-security interface ge-0/0/2.0 action disable-port

Answer

set interfaces ge-0/0/2.0 unit 0 family ethernet-switching port-security limit-action error-disable

Question 11

You need to apply a Layer 2 firewall filter named 'block-rogue-mac' to inbound traffic on all access ports of an EX2300 switch. Under which hierarchy level must the filter be bound?

Accepted Answer

set interfaces ge-0/0/0 unit 0 family bridge filter input block-rogue-mac. Layer 2 (bridge) filters in Junos are applied under the VLAN configuration or interface configuration depending on architecture, but for bridge filters inspecting switching interfaces, they are typically applied under 'interfaces <name> unit 0 family bridge filter input'.

Answer

set security firewall filter block-rogue-mac interface ge-0/0/0.0

Answer

set protocols firewall family bridge interface ge-0/0/0.0 input block-rogue-mac

Answer

set vlans default firewall input block-rogue-mac

Question 12

Which TWO parameters can be configured when setting up storm control on an EX Series switch? (Choose two)

Accepted Answer

Maximum allowed MAC address count. Storm control in Junos allows specifying bandwidth thresholds using either a percentage of total link bandwidth or a specific bit-rate (bps).

Answer

DHCP lease time expiration limit

Answer

MACsec cryptographic key length

Question 13

You are configuring a Layer 2 firewall filter on an EX Series switch to prevent IP spoofing on an access port. You want to ensure that only traffic from the DHCP-assigned IP address is permitted, while all other IP traffic is dropped. Which action should you take in the filter term?

Accepted Answer

Enable IP Source Guard on the access port, which automatically uses the DHCP snooping database to permit only valid IP/MAC pairs.. IP Source Guard is designed to prevent IP spoofing by using the DHCP snooping binding database to validate source IP and MAC addresses. When enabled on an access port, it automatically installs filter terms that permit only traffic matching the learned bindings and drops all other IP traffic. This dynamic behavior eliminates manual filter maintenance and adapts to DHCP changes. The other methods either require static configuration or use invalid match conditions.

Answer

Configure a firewall filter with a 'source-mac-address' match condition to allow only the MAC address learned via DHCP snooping.

Answer

Apply the filter as an input filter on the access port and use the 'ip-source-guard' match condition.

Answer

Apply the filter as an input filter on the access port and use the 'source-address' match condition with the IP address learned from DHCP snooping.

Question 14

An administrator is troubleshooting a DHCP snooping issue on an EX Series switch. Clients on VLAN 10 are not receiving IP addresses from the legitimate DHCP server connected to port ge-0/0/24. The switch is configured with DHCP snooping enabled on VLAN 10, and ge-0/0/24 is configured as a trusted port. Which action should be taken to resolve the problem?

Accepted Answer

Verify that DHCP snooping is enabled on the VLAN and that client ports are untrusted.. DHCP snooping requires that the VLAN be enabled for snooping and that trusted ports are correctly configured. Client ports should remain untrusted to filter DHCP server messages. If clients are not receiving addresses, it could be because DHCP snooping is not enabled on the VLAN or client ports are incorrectly trusted, causing DHCP offers to be dropped. Verifying these settings is the correct troubleshooting step.

Answer

Disable DHCP snooping on the VLAN to allow DHCP traffic to flow.

Answer

Ensure that the DHCP server is connected to a port that is configured as trusted.

Answer

Configure the DHCP server port as untrusted to allow DHCP replies.

Question 15

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

Accepted Answer

The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.. When port security is configured with 'action-on-violation shutdown' on an EX switch, a violation causes the interface to be disabled (err-disabled). It does not automatically recover; the administrator must manually clear the violation using 'clear ethernet-switching port-error' or by disabling and re-enabling the interface. This is the documented default behavior for shutdown action.

Answer

The interface automatically recovers after a default hold-down timer of 300 seconds.

Answer

The interface drops violating packets but remains operationally up until manually disabled.

Answer

The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.