JNCIS-ENT Layer 2 Security Practice Test 4 — 15 Questions

Question 1

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

Accepted Answer

Packets from violating MAC addresses are dropped, and a syslog message/counter is generated while valid traffic continues.. The 'restrict' action causes the switch to drop packets from unauthorized source MAC addresses and increment violation counters, but the port remains up and forwarding for valid MACs.

Answer

The interface immediately shuts down and generates an SNMP trap.

Answer

The violating MAC address is automatically added to a static ARP inspection deny list.

Answer

The switch drops all traffic on the interface until the violation timer expires.

Question 2

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

Accepted Answer

Configure the interface connected to the default gateway as a trusted interface for DAI.. Dynamic ARP Inspection (DAI) validates ARP packets by comparing them against the DHCP snooping binding database, and by default all interfaces are untrusted. Since the default gateway uses a statically configured IP address, no DHCP snooping binding exists for it, so its ARP packets would be dropped on an untrusted interface. Configuring the interface connected to the gateway as trusted bypasses DAI inspection for that port, allowing legitimate ARP traffic from the gateway to pass. This is the standard Juniper configuration using 'set ethernet-switching-options secure-access-port interface ge-0/0/1.0 arp-inspection trust'.

Answer

Enable DHCP snooping on the core router's interface.

Answer

Configure a static DHCP binding for the gateway IP on the access switch.

Answer

Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.

Question 3

An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?

Accepted Answer

The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.. MACsec encapsulation adds overhead (ICV and security headers) to the Ethernet frame, increasing its size. If the transport provider network or physical interface MTU is not increased to accommodate this overhead, frames are dropped.

Answer

The MKA key exchange failed due to MTU handshake validation timeouts.

Answer

Dynamic ARP Inspection is dropping fragmented Ethernet frames.

Answer

The cipher suite GCM-AES-256 compresses frames beyond the minimum frame size limit.

Question 4

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

Accepted Answer

Traffic policing by dropping packets exceeding the configured bandwidth threshold. Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Answer

Input queue buffering and tail-drop avoidance

Answer

Rate limiting via TCP window size adjustments

Answer

Traffic shaping with weighted random early detection (WRED)

Question 5

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses the DHCP snooping binding database to build its IP-to-MAC-to-port-to-VLAN binding table, then filters traffic on untrusted ports by dropping any packet whose source IP/MAC does not match an entry in that database (or a statically configured binding). Dynamic ARP Inspection (C) is also correct because DAI validates ARP packets on untrusted ports by comparing the sender IP and sender MAC against the DHCP snooping binding database, dropping ARP packets that do not match a valid binding (with static ARP ACLs as an optional supplement). Storm Control (B) is not correct because it is a hardware-based traffic rate limiter that monitors broadcast, multicast, or unknown unicast frames per port and does not consult any DHCP snooping bindings. Port Security MAC-Limit (D) is not correct because it restricts the number of source MAC addresses learned on a port using the MAC address table, independent of DHCP snooping bindings. MACsec Key Agreement (E) is not correct because MKA is part of IEEE 802.1X-2010 MACsec and negotiates session keys between link peers using EAPOL-MKA frames, with no dependency on the DHCP snooping binding database.

Answer

Storm Control rate-limiting

Answer

Port Security MAC-Limit

Answer

MACsec Key Agreement (MKA)

Question 6

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

Accepted Answer

They are configured under the 'family ethernet-switching' match criteria context.. Option A is correct because Layer 2 firewall filters on EX Series switches are configured within the 'family ethernet-switching' context, which provides the match conditions for Layer 2 fields such as MAC addresses and EtherType. Option C is correct because these filters can match on source and destination MAC addresses and EtherType values, which are fundamental Layer 2 header fields. Option D is correct because Layer 2 filters can be applied to physical switch ports (interfaces) or to VLANs, allowing filtering at the ingress port or across a VLAN. Option B is incorrect because applying filters to logical Layer 3 interfaces (irb or vlan interfaces) using 'family inet' is for Layer 3 filters, not Layer 2. Option E is incorrect because firewall filters evaluate match conditions before any routing lookup occurs; routing lookups happen after a packet is permitted and forwarded.

Answer

They are applied to logical Layer 3 routing interfaces (irb or vlan interfaces) using family inet.

Answer

They execute routing lookups prior to evaluating packet match conditions.

Question 7

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct. Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 8

Which TWO statements are true regarding IP Source Guard? (Choose two)

Accepted Answer

It prevents IP spoofing attacks by filtering traffic based on binding databases.. Option D is correct because IP Source Guard (IPSG) is an anti-spoofing feature that filters ingress traffic by comparing each packet's source IP (and often MAC) against a trusted binding table, dropping any packet whose source address does not match an entry, thereby preventing IP spoofing attacks. Option E is correct because on Juniper devices IPSG builds its binding table from the DHCP snooping database (populated by snooped DHCP ACK/lease bindings), so client source IP addresses are validated against dynamically learned DHCP bindings; static bindings can also be added, but the primary mechanism relies on DHCP snooping. Option A is incorrect because IPSG is configured at the interface/access-port level (e.g., 'ip-source-guard' under the interface or VLAN/forwarding-options hierarchy), not under the routing-instances protocol hierarchy. Option B is incorrect because IPSG performs filtering and validation, not encryption; AES-256 encryption is unrelated to this feature. Option C is incorrect because IPSG does not monitor or rate-limit broadcast ARP storms; ARP storm control and related protections are separate features (e.g., ARP policing/storm control), not IP Source Guard.

Answer

It is configured under the routing-instances protocol hierarchy.

Answer

It automatically encrypts all user data packets using AES-256.

Answer

It functions by monitoring and rate-limiting broadcast ARP traffic storms.

Question 9

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Accepted Answer

It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.. Option B is correct because DHCP snooping builds and maintains a binding table by snooping DHCP DISCOVER/REQUEST and OFFER/ACK exchanges, recording the client MAC address, leased IP address, VLAN, and the ingress switch port (interface) for each binding. Option C is correct because switch ports that connect toward legitimate DHCP servers (or uplinks toward them) must be manually configured as trusted; otherwise their server messages would be filtered. Option D is correct because on untrusted ports DHCP snooping drops server-to-client messages such as DHCPOFFER and DHCPACK (and NAK), preventing rogue DHCP servers from handing out addresses to clients. Option A is not correct because IP Source Guard depends on the DHCP snooping binding table, not the reverse — snooping populates the table independently, and IP Source Guard is not a prerequisite. Option E is not correct because DHCP snooping works by inspecting live DHCP packet flows, not by analyzing static ARP entries.

Answer

It requires IP Source Guard to be enabled before the binding table can be populated.

Answer

It operates exclusively by analyzing static ARP entries configured by administrators.

Question 10

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Accepted Answer

Dynamic ARP Inspection (DAI). The secure access port feature suite in Junos OS is designed to protect the access layer from Layer 2 attacks, and it comprises Dynamic ARP Inspection (DAI), DHCP Snooping, and IP Source Guard. Option B (Dynamic ARP Inspection) is correct because DAI validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and MITM attacks on access ports. Option C (DHCP Snooping) is correct because it builds and maintains the trusted binding table of IP-to-MAC mappings and blocks rogue DHCP servers, serving as the foundation for DAI and IP Source Guard. Option D (IP Source Guard) is correct because it uses the DHCP snooping database to filter traffic and prevent IP/MAC spoofing on untrusted access ports. Option A (MACsec Key Agreement) is not part of this suite; MKA is a Layer 2 encryption key management protocol for MACsec, a separate security feature. Option E (Spanning Tree Root Protection) is a Layer 2 loop-prevention STP enhancement, not a secure access port feature.

Answer

MACsec Key Agreement (MKA)

Answer

Spanning Tree Root Protection

Question 11

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

Accepted Answer

Configure the filter action as 'discard' for the broadcast term.. Option C is correct because a Layer 2 firewall filter term that should silently drop broadcast traffic must use the 'discard' action, which drops the matching frames without sending any ICMP or TCP reset response. Option D is correct because Layer 2 firewall filters on switches are defined and applied under the 'family ethernet-switching' hierarchy, not under 'family inet', which is for Layer 3 IPv4 filters. Option E is correct because broadcast Ethernet frames are identified by the destination MAC address ff:ff:ff:ff:ff:ff, so a match condition on that address is required to select broadcast packets while leaving unicast frames unmatched and permitted. Option A is incorrect because router-advertisement snooping is an IPv6/ND feature unrelated to matching and dropping Layer 2 broadcast frames. Option B is incorrect because applying the filter under 'family inet' would make it an IPv4 Layer 3 filter, which cannot match Ethernet MAC addresses or operate on an access VLAN's Layer 2 traffic.

Answer

Enable active router-advertisement snooping to support the filter.

Answer

Apply the filter under the 'family inet' routing protocol hierarchy.

Question 12

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Accepted Answer

Multicast traffic rate exceeding the configured threshold. Storm control on a switch interface monitors Layer 2 traffic rates and drops frames when a configured threshold is exceeded, and it applies to broadcast, multicast, and unknown unicast traffic. Option A is correct because multicast traffic exceeding the configured threshold is one of the traffic types storm control polices, so it triggers drops. Option D is correct because broadcast traffic exceeding the configured threshold is the classic storm control trigger, suppressing broadcast storms on the interface. Option B is wrong because unicast destined for known active MAC addresses is normal, expected forwarding traffic and is not counted by storm control (only unknown unicast is). Option C is wrong because CPU control plane queue utilization is a control-plane policing concern, not an interface storm control action. Option E is wrong because BPDUs are control frames handled by Spanning Tree, not storm-control-monitored data traffic.

Answer

Unicast traffic destined for known active MAC addresses exceeding average utilization

Answer

CPU control plane queue utilization exceeding 90%

Answer

BPDU control frames exceeding Spanning Tree hello timers

Question 13

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Accepted Answer

Enable MACsec on the physical interface.. Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session. Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

Answer

Configure the interface as a trusted port for Dynamic ARP Inspection.

Answer

Enable DHCP snooping on the transit VLAN.

Question 14

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

Accepted Answer

Storm control. Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Answer

MACsec

Answer

Dynamic ARP Inspection

Answer

Port security

Question 15

You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?

Accepted Answer

Clients are using statically assigned IP addresses that do not exist in the DHCP snooping binding database.. Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding database. An 'invalid-ip' drop means the source IP in the ARP packet does not match any entry in the binding table for that MAC/VLAN/interface. This occurs when clients use statically assigned IP addresses that were never learned via DHCP snooping, so no binding exists and DAI drops the ARP as untrusted.

Answer

The uplink port connecting to the default gateway is missing the 'set protocols arp-inspection trust' statement.

Answer

MAC limiting has tripped on the access port, causing ARP packets to be discarded.

Answer

The ARP inspection rate-limit has been exceeded on the access ports.