JNCIS-ENT Layer 2 Security Practice Test 3 — 15 Questions

Question 1

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

Accepted Answer

Configure the interface as a trusted interface for DHCP snooping.. DHCP snooping classifies switch ports as trusted or untrusted. Only trusted ports are permitted to forward DHCP server messages (OFFER, ACK); untrusted ports drop them. Therefore the uplink toward the legitimate DHCP server must be marked trusted so its replies are allowed, while user-facing ports remain untrusted and block rogue servers.

Answer

Configure the interface as a trunk port.

Answer

Apply an ingress firewall filter blocking UDP port 67.

Answer

Enable IP Source Guard on the uplink interface.

Question 2

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

Accepted Answer

DHCP Snooping. DHCP snooping must be enabled on the access switch to build the DHCP snooping binding database, which maps client IP addresses to MAC addresses, VLANs, and interfaces. This database is populated by snooping DHCP ACK messages as clients obtain leases. Without DHCP snooping enabled, the binding table remains empty, and features like Dynamic ARP Inspection and IP Source Guard cannot function.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security MAC-Limit

Question 3

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

Accepted Answer

MACsec Key Agreement (MKA) protocol. Junos MACsec uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X-2010, as the default key agreement protocol. MKA runs over the point-to-point link, elects a Key Server, and uses the Connectivity Association Key (CAK) to derive the Secure Association Key (SAK) that encrypts traffic.

Answer

Internet Key Exchange version 2 (IKEv2)

Answer

Secure Session Protocol (SSP)

Answer

802.1AE Dynamic Key Distribution (AKD)

Question 4

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Accepted Answer

DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.. IP Source Guard (IPSG) relies on the DHCP snooping binding table to validate source IP and MAC addresses on untrusted ports. If DHCP snooping is not enabled on the VLAN, the binding table is not populated, so IPSG has no entries to permit and drops all traffic. The root cause is that DHCP snooping was not enabled on the corresponding VLAN.

Answer

IP Source Guard requires static ARP inspection to be enabled simultaneously.

Answer

The client's MAC address is in the port security violation log.

Answer

IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

Question 5

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

Accepted Answer

Applied to the input of an interface or VLAN under family ethernet-switching.. Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Answer

Applied to the routing-instance forwarding table.

Answer

Applied globally under system services l2-firewall.

Answer

Applied to the output of the VLAN interface under family inet.

Question 6

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

Accepted Answer

The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.. Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Answer

The static client is using an IP address outside the DHCP pool range.

Answer

The client's MAC address violates the port security maximum limit.

Answer

DAI requires all interfaces to be trusted on the VLAN.

Question 7

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

Accepted Answer

show ethernet-switching dhcp-snooping binding. The operational command to view DHCP snooping bindings is 'show ethernet-switching dhcp-snooping binding'.

Answer

show dhcp-snooping binding

Answer

show system dhcp-snooping database

Answer

show bridge dhcp bindings

Question 8

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

Accepted Answer

clear ethernet-switching security-violation. Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Answer

reset interface security-violations

Answer

clear bridge security-counters

Answer

clear arp-inspection statistics

Question 9

An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?

Accepted Answer

Configure IEEE 802.1X with multiple supplicants or MAC Authentication Bypass (MAB).. IEEE 802.1X with multiple supplicants (or MAC Authentication Bypass for non-802.1X devices) allows multiple authenticated MAC addresses to share a single switch port, which is exactly the scenario of an IP phone with a PC daisy-chained behind it. The phone authenticates via 802.1X (or MAB), and the PC authenticates separately, each getting its own authorization. This is the secure, standards-based way to support multiple devices on one port without simply raising the MAC limit.

Answer

Enable DHCP snooping with static ARP inspection override.

Answer

Increase the mac-limit to 2 and enable dynamic MAC learning persistence.

Answer

Configure storm control with a multi-device profile.

Question 10

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

Accepted Answer

GCM-AES-128. When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Answer

AES-CBC-128

Answer

SHA-256-HMAC

Answer

GCM-AES-256

Question 11

Which statement is true regarding the behavior of storm control when the traffic rate exceeds the configured threshold?

Accepted Answer

Excess traffic exceeding the threshold is dropped by the switch hardware.. When storm control thresholds are exceeded, Junos drops the excess traffic matching the storm control criteria until the rate drops below the threshold.

Answer

Traffic is rate-shaped and buffered in the output queue until congestion clears.

Answer

The interface is immediately shut down and placed in an error-disabled state.

Answer

The switch sends SNMP traps and forwards the traffic with a low-priority CoS marking.

Question 12

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Accepted Answer

A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.. Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Answer

The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

Answer

The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

Answer

DHCP snooping is blocking the MACsec control frames on the transit link.

Question 13

Which Junos configuration hierarchy is used to configure secure access port features such as DHCP snooping and Dynamic ARP Inspection?

Accepted Answer

set ethernet-switching-options secure-access-port. In Junos, secure access port features like DHCP snooping, Dynamic ARP Inspection (DAI), and IP source guard are configured under the [edit ethernet-switching-options secure-access-port] hierarchy. This is the correct location for these Layer 2 security features on EX Series switches. The command 'set ethernet-switching-options secure-access-port' enables the configuration stanza where you can then specify VLANs, interfaces, and other parameters for DHCP snooping and DAI.

Answer

set protocols l2-security

Answer

set system security layer2

Answer

set switch-options port-security

Question 14

An administrator configures a Layer 2 firewall filter to drop all ARP packets with a specific invalid sender hardware address. The filter is applied to a VLAN interface. What special consideration must be taken when applying Layer 2 filters to VLANs in Junos?

Accepted Answer

Layer 2 filters on VLANs evaluate traffic across all member ports belonging to that VLAN instance.. In Junos, when a Layer 2 firewall filter is applied to a VLAN, it evaluates traffic across all member ports of that VLAN instance, not just a single physical interface. This is because the VLAN is a logical Layer 2 broadcast domain, and the filter operates at the VLAN level, inspecting frames as they traverse the VLAN's forwarding path. This behavior is critical when filtering protocols like ARP, which are broadcast within the VLAN.

Answer

Layer 2 filters applied to VLANs require family inet to inspect ARP payloads.

Answer

Layer 2 filters cannot be applied to VLANs; they must be applied to physical interfaces only.

Answer

VLAN-based Layer 2 filters only process egress traffic leaving the VLAN trunk ports.

Question 15

Which statement accurately describes port security MAC-limit behavior?

Accepted Answer

It restricts the maximum number of MAC addresses that can be learned on a secure interface.. Port security MAC-limit restricts the maximum number of MAC addresses learned on a secure interface.

Answer

It statically assigns all learned MAC addresses to the switch configuration file automatically.

Answer

It defines the maximum bandwidth a single MAC address can consume on a port.

Answer

It prevents MAC address spoofing by validating IP bindings against DHCP tables.