JNCIS-ENT Layer 2 Switching And VLANs Practice Test 4 — 15 Questions

Question 1

You are troubleshooting a connectivity issue between an EX4300 switch access port and an end-host. The port is configured as an access port for VLAN 100, but the host cannot communicate. You run 'show ethernet-switching interface ge-0/0/1' and notice the port status is down/down. Which underlying reason most likely explains this state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The physical cable is disconnected or the transceiver is faulty.. A port status of down/down in Junos means the physical layer is not operational — the link itself has no signal. This is distinct from a logical or configuration problem, which would typically show up/down or down/up. A disconnected cable, faulty transceiver, or bad port are the classic causes of down/down. VLAN or BPDU issues would not produce a down/down state because they operate above the physical layer.

Answer

The native VLAN ID does not match the upstream trunk switch.

Answer

BPDU protection has disabled the port due to a loop.

Answer

The VLAN 100 has not been created under the [edit vlans] hierarchy.

Question 2

An enterprise network uses private VLANs. A server connected to an isolated port needs to send traffic out of the primary VLAN. Which statement accurately describes how traffic forwarding operates for an isolated port in Junos?

Accepted Answer

Traffic from an isolated port can only be forwarded to the designated promiscuous port.. In a private VLAN (PVLAN) configuration, an isolated port can only communicate with the promiscuous port. Traffic from an isolated port is forwarded to the promiscuous port, which then routes or bridges it to the primary VLAN. Isolated ports cannot communicate with each other or with community ports, ensuring strict Layer 2 isolation.

Answer

Traffic from an isolated port can reach other isolated ports within the same secondary VLAN.

Answer

Isolated ports can communicate freely with community ports, but not other isolated ports.

Answer

Traffic from an isolated port is dropped unless a Layer 3 firewall filter explicitly permits it.

Question 3

An administrator configures a new VLAN ID 300 on an EX Series switch but forgets to assign any interfaces to it. What is the operational status of this VLAN?

Accepted Answer

The VLAN remains inactive in the switching table until an interface or IRB is associated with it.. In Junos on EX Series switches, a VLAN that is configured but has no interfaces or IRB associated with it remains inactive in the switching table. The VLAN exists in the configuration but does not become operational until at least one interface or IRB is assigned to it.

Answer

The switch assigns all unused ports to VLAN 300 by default.

Answer

The switch generates a critical alarm preventing further configuration.

Answer

The switch automatically deletes the VLAN after 5 minutes if no ports are assigned.

Question 4

An administrator runs 'show vlans' and notices that a particular VLAN has the status 'Active' but no interfaces listed under it. What does this indicate?

Accepted Answer

The VLAN is defined in the configuration and has an active IRB interface or routing instance, but no physical switch ports assigned.. An active VLAN without interfaces means the VLAN is defined in the database and associated with an IRB (Layer 3 interface) or routing instance, but no physical switch ports are members.

Answer

The VLAN has been disabled by Spanning Tree Protocol.

Answer

The switch memory is full and cannot display interface memberships.

Answer

The VLAN configuration has a syntax error.

Question 5

An administrator needs to delete an entire VLAN configuration named 'guest' along with its VLAN ID and associated properties. Which configuration command should be executed?

Accepted Answer

delete vlans guest. The correct command to delete an entire VLAN configuration, including its VLAN ID and associated properties, is 'delete vlans guest'. In Junos, the 'delete' command removes the specified configuration hierarchy or identifier from the candidate configuration. When applied to 'vlans guest', it removes the entire VLAN definition named 'guest' from the configuration. This is the standard way to remove a VLAN in Junos.

Answer

clear vlans guest

Answer

destroy vlans guest

Answer

remove vlans guest

Question 6

You are reviewing the configuration of an EX Series switch and notice that interface ge-0/0/15 is configured with 'interface-mode access' but has no explicit 'vlan members' statement defined. Which VLAN does the interface default to?

Accepted Answer

VLAN 1 (default VLAN). On Juniper EX Series switches, when an interface is configured with 'interface-mode access' and no explicit 'vlan members' statement is present, the interface automatically becomes a member of the default VLAN, which is VLAN ID 1. This default VLAN is created by the system and is named 'default'. The interface will forward untagged traffic into VLAN 1, allowing connectivity without additional configuration.

Answer

VLAN 0 (null VLAN)

Answer

The port remains shut down until a VLAN is explicitly assigned.

Answer

It drops all traffic until a VLAN membership is added.

Question 7

An administrator is configuring VLANs on a Junos EX Series switch. Which TWO tasks must be performed to successfully assign a physical interface as an access port for a newly created VLAN? (Choose two.)

Accepted Answer

Configure the interface mode as access under [edit interfaces unit 0 family ethernet-switching].. Option E is correct because a VLAN must first exist in the configuration before an interface can be assigned to it; on Junos EX switches you create it under [edit vlans] with a name and a vlan-id (e.g., set vlans SALES vlan-id 100). Option D is correct because the physical port is made an access port by setting the interface mode to access under [edit interfaces unit 0 family ethernet-switching], which places untagged traffic from that port into the specified VLAN. Spanning tree (option A) is not required to make a VLAN active, and it is enabled by default on EX switches anyway. Option B is wrong because an access port carries Layer 2 traffic in family ethernet-switching; assigning family inet and an IP address is for a routed/Layer 3 interface, not a switched access port. Option C is wrong because trunk mode with native-vlan-id is used for carrying multiple VLANs (802.1Q tagging), not for assigning a single access VLAN to a physical interface.

Answer

Enable spanning-tree protocol globally for the access VLAN to become active.

Answer

Configure the interface family as inet and assign an IP address.

Answer

Configure the interface as a trunk port with native-vlan-id enabled.

Question 8

An engineer is configuring a trunk port on an EX Series switch and needs to ensure that untagged and priority-tagged frames are handled correctly. Which TWO configuration actions are required? (Choose two.)

Accepted Answer

Set the interface mode to trunk under the ethernet-switching family hierarchy.. Option A is correct because on EX Series switches the port must be placed into trunk mode under the ethernet-switching family hierarchy (set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk) so that it can carry multiple VLANs and process tagged frames. Option E is correct because the native-vlan-id statement defines which VLAN handles untagged and priority-tagged frames arriving on the trunk, ensuring those frames are mapped to the intended VLAN. Option B is incorrect because a Layer 2 trunk port does not require Layer 3 routing on unit 0; routing would be configured on an IRB (VLAN) interface instead. Option C is incorrect because CCC and VPLS encapsulations are used for circuit cross-connect and VPLS Layer 2 VPN services, not for standard 802.1Q trunking. Option D is incorrect because disabling MAC learning is not required or recommended for a trunk port and would not prevent native VLAN loops.

Answer

Enable Layer 3 routing directly on the physical trunk interface unit 0.

Answer

Configure the interface encapsulation as CCC or VPLS.

Answer

Disable MAC learning on the trunk interface to prevent native VLAN loops.

Question 9

An enterprise network design requires implementing private VLANs (PVLANs) on an EX Series switch. Which THREE components or port types are characteristic of a private VLAN architecture? (Choose three.)

Accepted Answer

Community ports that can communicate with other ports in the same community and promiscuous ports.. In a private VLAN architecture on EX Series switches, community ports (option A) are secondary-VLAN member ports that may communicate with other ports in the same community VLAN and with promiscuous ports, but not with isolated ports or other communities. Isolated ports (option B) belong to an isolated secondary VLAN and can communicate only with promiscuous ports, providing the strictest Layer 2 isolation among host ports. Promiscuous ports (option C) are members of the primary VLAN and can communicate with all ports across both the primary VLAN and its associated secondary VLANs, typically serving as the gateway or uplink port. Option D is incorrect because RIB-only routing instance interfaces are a Layer 3 routing construct unrelated to PVLAN port roles and do not define PVLAN behavior. Option E is incorrect because PVLANs do not use fully meshed trunk ports to bypass isolation; trunk ports simply carry the primary and secondary VLAN tags while preserving the PVLAN isolation rules.

Answer

Routing instance interfaces (RIB-only) that automatically disable Layer 2 bridging.

Answer

Fully meshed trunk ports that bypass all isolation rules for inter-VLAN routing.

Question 10

You are troubleshooting a Layer 2 connectivity problem where a trunk port is dropping tagged traffic for VLAN 50. Which TWO configuration checks should be performed? (Choose two.)

Accepted Answer

Verify that VLAN 50 is included in the trunk port's member list (or not excluded via 'except').. Option B is correct because on a trunk port, tagged traffic for a VLAN is only forwarded if that VLAN is explicitly listed as a member (e.g., under 'vlan members' or 'vlan members all' with 'except' not excluding it); if VLAN 50 is missing from the member list or excluded via 'except', its tagged frames are dropped. Option E is correct because the VLAN must first exist under the [edit vlans] hierarchy with a valid vlan-id (and typically a matching 802.1Q tag) before it can be assigned to a trunk interface; a missing or misconfigured vlan-id means the switch cannot map the tagged frames to VLAN 50. Option A is incorrect because a Layer 2 trunk interface does not require an IPv4 address in family inet to forward tagged traffic, and adding one is irrelevant to VLAN 50 connectivity. Option C is incorrect because spanning-tree bridge priority affects root bridge election, not whether tagged VLAN 50 traffic is accepted on a trunk. Option D is incorrect because setting the port to access mode would strip tags and place the port in a single VLAN, which is the opposite of what a trunk carrying VLAN 50 requires.

Answer

Verify that the physical interface has an IPv4 address assigned in family inet.

Answer

Verify that spanning-tree bridge priority is set to 0.

Answer

Verify that the port mode is set to access.

Question 11

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Accepted Answer

Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.. Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network. Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Answer

Disabling all Layer 2 learning on the translation interface.

Answer

Enabling OSPFv3 routing directly on the customer edge interface unit 0.

Question 12

An engineer is deploying Private VLANs on an EX Series switch and needs to verify proper operational status and traffic isolation. Which THREE tasks or verification checks should be performed? (Choose three.)

Accepted Answer

Run 'show vlans extensive' to inspect PVLAN port mappings and roles.. Option B is correct because on EX Series switches the 'show vlans extensive' command displays the PVLAN configuration details, including which ports are mapped as promiscuous, isolated, or community members, making it the right verification step for operational status. Option C is correct because a Private VLAN requires the primary VLAN to be explicitly associated with its secondary isolated and community VLANs; without this association, traffic cannot be properly mapped and isolation behavior fails. Option D is correct because the defining behavior of an isolated PVLAN port is that it can communicate only with the promiscuous port (and its uplink), so testing that isolated ports reach only the designated promiscuous port verifies correct traffic isolation. Option A is incorrect because isolated ports must NOT be able to send traffic to other isolated ports within the same secondary VLAN — that would indicate a misconfiguration. Option E is incorrect because routing instances operate at Layer 3 and would not enable Layer 2 inter-isolated communication; PVLAN isolation is a Layer 2 construct and isolated ports are intentionally prevented from communicating with each other.

Answer

Verify that isolated ports can successfully send traffic to other isolated ports within the same secondary VLAN.

Answer

Configure routing instances on all isolated ports to enable inter-isolated communication at Layer 2.

Question 13

An operator executes the command 'show bridge mac-table' on an EX Series switch running Junos OS. Which information is displayed in the output of this command?

Accepted Answer

Learned MAC addresses, associated VLAN names/IDs, and corresponding interface names.. The show bridge mac-table command on EX Series switches displays the Layer 2 MAC address table, including learned MAC addresses, their associated VLANs, and the interfaces on which they were learned. This is the primary command for verifying MAC learning and forwarding behavior.

Answer

Physical transceiver optical power levels and interface error counters.

Answer

Spanning tree root bridge priorities and designated port roles.

Answer

The IP addresses corresponding to each dynamic MAC address via ARP resolution.

Question 14

Which THREE parameters are typically verified when troubleshooting a missing MAC address entry in the bridge table of a Juniper switch? (Choose three.)

Accepted Answer

Configured maximum MAC address limits or port-security restrictions. Option B is correct because a MAC address will not be learned or retained in the bridge table if the port has hit its configured MAC limit (e.g., 'mac-limit') or if port security (e.g., 'mac-move-limit' or allowed-MAC restrictions) is blocking or dropping the source MAC. Option C is correct because the ingress port must be a member of the same VLAN as the traffic; if the port is not in the correct VLAN (or is in a different VLAN), the frame is not learned into that VLAN's bridge table entry. Option E is correct because a bridge table entry requires the physical interface to be up and operational; if the link is down or the interface is disabled, no MAC addresses can be learned on that port. Option A is incorrect because BGP AS path settings are Layer 3 routing attributes and have no bearing on Layer 2 MAC learning in the bridge table. Option D is incorrect because routing protocol adjacencies in the default VRF relate to Layer 3 reachability, not to populating the Layer 2 bridge table.

Answer

BGP AS path settings on core interfaces

Answer

Routing protocol adjacencies in the default VRF

Question 15

When configuring Private VLANs (PVLANs) on Juniper EX Series switches, which TWO types of ports are defined within the architecture? (Choose two.)

Accepted Answer

Promiscuous port. In Juniper EX Series PVLAN architecture, a promiscuous port (option B) is the port that connects to a router or gateway and can communicate with all isolated and community VLAN ports, serving as the shared upstream exit point for the secondary VLANs. Option C, the host port (Isolated or Community), is also correct because PVLANs define host-facing ports as either isolated (which can only talk to the promiscuous port) or community (which can talk to the promiscuous port and other members of the same community). These two port roles are the fundamental building blocks of PVLANs on EX switches, alongside the primary/secondary VLAN constructs. The remaining options are not PVLAN port types: a root bridge port (A) is an STP concept, a core uplink port (D) is a generic topology term, and a trunk access port (E) is not a defined PVLAN port role.

Answer

Root bridge port

Answer

Core uplink port

Answer

Trunk access port