JNCIS-ENT Layer 2 Security — Timed 20 Questions

Question 1

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

20 minute time limit — choose an answer to begin.

Accepted Answer

Broadcast, unknown unicast, and multicast traffic.. On Juniper EX Series switches, the default storm control configuration targets broadcast, unknown unicast, and multicast (BUM) traffic. When you apply a storm control profile with a bandwidth-percentage of 20%, all three traffic types are policed by default unless you explicitly override them. This is because the default action for storm control includes all BUM traffic, and the bandwidth limit applies to each type individually or collectively depending on configuration. The correct answer is therefore D.

Answer

Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

Answer

Broadcast and multicast traffic only, excluding unknown unicast.

Answer

Broadcast traffic only

Question 2

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

Accepted Answer

show ethernet-switching storm-control interface ge-0/0/1. The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Answer

show storm-control statistics interface ge-0/0/1

Answer

show bridge storm-control interface ge-0/0/1

Answer

show interfaces extensive ge-0/0/1 | match storm

Question 3

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

Accepted Answer

show macsec connections. On Junos EX Series switches, MACsec operational state — including the MKA (MACsec Key Agreement) session, CAK/ICK derivation, and secure channel status — is viewed with 'show macsec connections'. This command reports whether the MKA session is up, which peer is the key server, and whether the secure association (SA) is established, making it the correct troubleshooting tool when a PSK-based secure channel fails.

Answer

show ethernet-switching macsec interface

Answer

show protocols mka sessions

Answer

show security macsec status

Question 4

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

Accepted Answer

set switch-options interface ge-0/0/1.0 mac-limit limit 2. The correct hierarchy for configuring port security MAC limits on a specific interface is 'set switch-options interface ge-0/0/1.0 mac-limit limit 2'.

Answer

set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2

Answer

set ethernet-switching-options secure-access-port interface ge-0/0/1 maximum-mac-count 2

Answer

set protocols l2-security interface ge-0/0/1 mac-limit 2

Question 5

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

Accepted Answer

set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection. DAI is enabled under ethernet-switching-options secure-access-port vlan for the specific VLAN name.

Answer

set protocols arp-inspection vlan VLAN10

Answer

set vlans VLAN10 dynamic-arp-inspection

Answer

set interfaces vlan unit 10 family inet arp-inspection

Question 6

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

Accepted Answer

set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify. IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Answer

set switch-options interface ge-0/0/5 ip-source-guard-mode strict

Answer

set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

Answer

set protocols ip-source-guard interface ge-0/0/5 enable

Question 7

An administrator configures a Layer 2 firewall filter to match on EtherType 0x88cc (LLDP) and discard those frames on an access port. However, LLDP packets are still reaching adjacent connected devices. Why?

Accepted Answer

LLDP frames are processed by the control plane or hardware before ingress port firewall evaluation.. On Junos, LLDP is a control-plane protocol whose frames are intercepted by the Packet Forwarding Engine and punted to the Routing Engine before user-configured ingress firewall filters on the access port are evaluated. Because LLDP termination happens in hardware/control-plane processing, a Layer 2 filter matching EtherType 0x88cc never sees the frames, so they continue to reach neighbors. To actually block LLDP you must disable it per-interface with 'set protocols lldp interface <name> disable' rather than relying on a firewall filter.

Answer

LLDP uses a multicast destination MAC address that bypasses MAC-filtering rules.

Answer

Layer 2 firewall filters cannot match on EtherType fields in Junos.

Answer

The filter was applied to the output instead of the input direction.

Question 8

You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?

Accepted Answer

from source-mac-address 00:11:22:33:44:55. Layer 2 filter terms match source MAC addresses using 'from source-mac-address 00:11:22:33:44:55'.

Answer

from mac-source-address 00:11:22:33:44:55

Answer

fromethernet-source 00:11:22:33:44:55

Answer

match src-mac 00:11:22:33:44:55

Question 9

You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?

Accepted Answer

Option-82 checks are enabled, and the incoming client request fails validation rules.. When DHCP snooping is enabled with Option-82 (DHCP relay agent information option) validation, the switch inspects incoming DHCP requests on untrusted ports and drops any that fail the validation rules — for example, a request that already contains Option-82 when it should not, or a malformed Option-82 field. This is a security feature to prevent spoofed relay agents. The drop occurs because the client request violates the configured Option-82 checks, not because of MAC learning or DAI.

Answer

The client's MAC address is not yet learned in the switch's Ethernet switching table.

Answer

DHCP snooping drops all DHCP messages on untrusted ports by design.

Answer

Dynamic ARP Inspection is blocking the DHCP request packets.

Question 10

Which operational command displays the status of MACsec connections and associated security association parameters on an EX Series switch?

Accepted Answer

show macsec connections. The command 'show macsec connection' shows active connections and parameters.

Answer

show ethernet-switching macsec

Answer

show protocols mka status

Answer

show security macsec associations

Question 11

You are troubleshooting IP Source Guard on an EX Series switch. You want to see which interfaces have IP Source Guard enabled and their operational state. Which operational command should you use?

Accepted Answer

show ethernet-switching secure-access-port ip-source-guard interface. The command 'show ethernet-switching secure-access-port ip-source-guard' displays IP Source Guard interface statuses.

Answer

show bridge ip-source-guard

Answer

show ip-source-guard interfaces

Answer

show interfaces ip-source-guard brief

Question 12

You are configuring storm control on an EX Series switch and want to specify the rate limit in absolute bandwidth (kilobits per second) rather than a percentage. Which statement achieves this?

Accepted Answer

set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m. Absolute rate limits in storm control are configured using the 'bandwidth' option, such as 'set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m'.

Answer

set protocols storm-control interface ge-0/0/2 speed 10m

Answer

set switch-options storm-control ge-0/0/2 kbps 10000

Answer

set interfaces ge-0/0/2 storm-control rate 10000kbps

Question 13

Which TWO statements describe characteristics of port security in Junos OS? (Choose two)

Accepted Answer

Configurable violation actions include drop, restrict, and shutdown.. Option B is correct because Junos port security supports configurable violation actions such as drop (silently discard offending frames), restrict (drop and log/raise an alarm), and shutdown (err-disable the interface), giving administrators control over how to respond to MAC limit violations. Option D is correct because the core function of port security is to cap the number of source MAC addresses learned on a given interface, protecting against MAC flooding and unauthorized device attachment. Option A is incorrect because MACsec encryption is an independent Layer 2 security feature and is not a prerequisite for port security to enforce MAC limits. Option C is incorrect because DHCP snooping, not port security, inspects DHCP lease transactions to build IP-to-MAC binding tables. Option E is incorrect because 802.1X supplicant authentication is a separate access-control mechanism and is not automatically enabled by port security.

Answer

It requires MACsec encryption to be active on the port before enforcing limits.

Answer

It inspects DHCP lease transactions to build IP-to-MAC binding databases.

Answer

It automatically enables 802.1X supplicant authentication on access ports.

Question 14

Which TWO traffic types are monitored and controlled by default when storm control is applied to an interface on an EX Series switch? (Choose two)

Accepted Answer

Multicast traffic. Storm control targets broadcast, unknown unicast, and multicast traffic by default.

Answer

BPDU control frames generated by Spanning Tree Protocol

Answer

Known unicast traffic destined for active MAC addresses

Question 15

An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?

Accepted Answer

Configure a static IP source entry in the secure-access-port binding table for the server.. Static ARP inspection entries or static IP source bindings can be configured to allow non-DHCP clients through DAI without trusting the entire port.

Answer

Add the server's MAC address to the switch's static MAC-table using 'set bridge-domains'.

Answer

Create a Layer 2 firewall filter permitting ARP packets with action 'accept-and-trust'.

Answer

Configure an explicit static ARP entry under 'set protocols arp static'.

Question 16

Which THREE actions can be configured as a response to a Dynamic ARP Inspection (DAI) violation on an EX Series switch? (Choose three)

Accepted Answer

Logging the violation event via syslog. On Juniper EX Series switches, DAI inspects ARP packets on untrusted interfaces and, upon detecting a violation, can perform three configurable actions: logging the event via syslog (Option A), incrementing DAI drop counters (Option D), and dropping the violating ARP packet (Option E). Option A is correct because DAI can generate a syslog message for each violation, which is useful for auditing and troubleshooting. Option D is correct because the switch maintains DAI statistics and increments drop counters for each violating packet, allowing monitoring via operational commands. Option E is correct because the primary enforcement action is to discard the offending ARP packet, preventing ARP spoofing or poisoning. Option B is not a DAI response action; interface shutdown would require separate mechanisms such as MAC limiting or error-disable, not DAI itself. Option C is incorrect because DAI inspection occurs in hardware or on the line card, not by redirecting violating packets to the Routing Engine CPU for inspection.

Answer

Automatically shutting down the offending interface

Answer

Redirecting violating ARP packets to the Routing Engine CPU for inspection

Question 17

Which TWO commands are valid Junos operational commands used to verify secure access port features? (Choose two)

Accepted Answer

show ethernet-switching dhcp-snooping binding. Option A, `show ethernet-switching dhcp-snooping binding`, is correct because DHCP snooping is a secure access port feature on Junos EX switches, and this operational command displays the snooped DHCP bindings (IP-to-MAC-to-interface mappings) that the switch builds and uses to validate traffic. Option B, `show ethernet-switching secure-access-port ip-source-guard interface`, is correct because IP source guard is another secure access port feature, and this command verifies the IP source guard bindings/entries on a given interface to confirm that only legitimate source IP/MAC pairs are permitted. The unmarked options do not belong: `show bridge-domain secure-access status` is not a valid Junos operational command for this purpose, `show arp-inspection database` is not the correct Junos syntax for verifying DAI (the relevant command is `show ethernet-switching arp-inspection`), and `show security port-security summary` is not a valid Junos secure access port verification command.

Answer

show bridge-domain secure-access status

Answer

show arp-inspection database

Answer

show security port-security summary

Question 18

Which TWO conditions must be met for Dynamic ARP Inspection (DAI) to successfully forward an ARP request or reply packet on an access port? (Choose two)

Accepted Answer

The incoming interface is explicitly configured as a trusted interface for DAI.. Dynamic ARP Inspection validates ARP packets on untrusted access ports by checking them against trusted sources of IP-to-MAC bindings. Option B is correct because an interface explicitly configured as trusted with the ip arp inspection trust command bypasses DAI validation entirely, so ARP packets arriving on it are forwarded without inspection. Option D is correct because on untrusted ports DAI compares the sender's IP and MAC against the DHCP snooping binding database (or a configured ARP access-list/static binding), and only matching packets are permitted. Option A is not one of the two required conditions because the system static ARP table is not the DAI validation source; DAI uses the DHCP snooping binding database, ARP ACLs, and ip source binding entries. Option C is irrelevant because port security MAC limits on trunk ports have no bearing on DAI forwarding decisions. Option E is incorrect because a gratuitous ARP with a broadcast destination is not a requirement for DAI to forward a packet.

Answer

The packet matches an entry in the system static ARP table.

Answer

Port security MAC-limit has not been reached on any adjacent trunk port.

Answer

The ARP packet contains a valid gratuitous broadcast destination MAC address.

Question 19

An administrator implements MACsec to secure links between switches. Which THREE operational tasks or verifications are relevant when troubleshooting MACsec and MKA? (Choose three)

Accepted Answer

Verifying MKA peer connectivity state using 'show macsec connections'.. Option B is correct because 'show macsec connections' (or equivalent platform command) displays the MKA peer connectivity state, including whether the CAK/CKN authentication has succeeded and the secure channel is established. Option D is correct because MACsec's MKA requires both peers to share identical CAK (Connectivity Association Key) and CKN (Connectivity Association Key Name) values; a mismatch prevents the secure association from forming. Option E is correct because monitoring encryption and decryption packet error counters (e.g., via interface MACsec statistics) reveals integrity check failures, replay drops, or cipher mismatches that indicate a broken or misconfigured secure channel. Option A is incorrect because MACsec frames use EtherType 0x88E5, and a Layer 2 firewall filter that blocks this EtherType would intentionally drop MACsec traffic rather than being a valid troubleshooting verification. Option C is incorrect because DHCP binding tables track IP-to-MAC address leases and have no role in MACsec key distribution, which is handled by MKA using the CAK/CKN.

Answer

Ensuring Layer 2 firewall filters are blocking MACsec EtherType 0x88E5.

Answer

Inspecting DHCP binding tables to verify MACsec key distribution.

Question 20

Which TWO options are valid violation actions available for port security configurations in Junos OS? (Choose two)

Accepted Answer

restrict. In Junos OS port security, the two supported violation actions are restrict and shutdown, configured under the interface's port-security stanza. Option D (restrict) is correct because it drops frames from MAC addresses that exceed the configured limit while optionally generating an SNMP trap or log entry, without taking the interface down. Option E (shutdown) is correct because it disables the interface (placing it in a down state) when a violation occurs, requiring manual intervention or errdisable recovery to restore it. Option A (isolate) is not a valid Junos port-security violation action; isolation is not an available keyword for this feature. Option B (rate-limit) is not a violation action but rather a traffic policing mechanism used elsewhere in Junos configuration. Option C (quarantine) is also not a valid Junos port-security violation action; no such keyword exists for this purpose.

Answer

isolate

Answer

rate-limit

Answer

quarantine