JNCIS-ENT Multiple Select — 40 Questions

Question 1

Which of the following are valid IS-IS PDU types? (Choose THREE)

Accepted Answer

IIH PDU. IS-IS defines three core PDU categories, and options A, B, and C map directly onto them. A: IIH (Intermediate System-to-Intermediate System Hello) PDUs are the valid IS-IS hello packets used to discover and maintain adjacencies on broadcast and point-to-point links, with LAN and P2P variants. B: LSP (Link State PDU) is the valid IS-IS packet that carries link-state information and is flooded to build the link-state database, analogous to an OSPF LSA. C: CSNP (Complete Sequence Number PDU) is a valid IS-IS PDU used to describe the complete set of LSPs in a database, sent by the DIS on broadcast networks and used for database synchronization. Options D and E are not IS-IS PDU types: IS-IS hellos are not acknowledged with a separate 'Hello ACK PDU' (acknowledgment is implicit via receipt of a subsequent IIH), and there is no 'Routing Update PDU' in IS-IS—routing information is distributed through LSPs, CSNPs, and PSNPs.

Answer

Hello ACK PDU

Answer

Routing Update PDU

Question 2

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct. Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 3

Which TWO actions occur when a Junos BGP routing policy includes the 'next policy' action? (Choose two)

Accepted Answer

Evaluation of the current policy terminates immediately.. Option A is correct because the 'next policy' action terminates evaluation of the current policy immediately, so no further terms within that policy are processed. Option B is correct because, after stopping the current policy, Junos proceeds to evaluate the next independent policy in the chain (the next policy referenced in the import/export chain), allowing subsequent policies to make the final accept/reject decision. Option C is incorrect because 'next policy' does not itself accept or install a route; acceptance requires an explicit 'accept' action or a default policy decision. Option D is incorrect because 'next policy' does not reject or drop the route; rejection is performed by a 'reject' action. Option E is incorrect because jumping to the next term within the same policy block is not what 'next policy' does; that would be the behavior of 'next term'.

Answer

The route is immediately accepted and installed in the routing table.

Answer

The route is rejected and dropped.

Answer

Evaluation jumps to the next term within the same policy block.

Question 4

Which TWO options represent valid benefits of configuring Link Aggregation Groups (LAG)? (Choose two)

Accepted Answer

Increased aggregate bandwidth between connected networking devices.. Option A is correct because a Link Aggregation Group bundles multiple physical interfaces into a single logical link, so the combined throughput of the member links provides increased aggregate bandwidth between the connected devices. Option D is correct because LAG monitors member link health and, if one physical member link fails, traffic is automatically redistributed across the remaining active links, providing redundancy and failover without losing the logical interface. Option B is incorrect because BGP peer state synchronization is handled by BGP itself (e.g., via TCP sessions and route reflectors), not by LAG. Option C is incorrect because Junos OS upgrades are performed through software management procedures, not through link aggregation. Option E is incorrect because LAG does not eliminate the need for Spanning Tree Protocol in all cases; STP may still be required to prevent loops in topologies with redundant paths outside the LAG.

Answer

Synchronization of BGP routing daemon state between separate routers.

Answer

Automatic upgrade of Junos OS across peer devices.

Answer

Elimination of the need for Spanning Tree Protocol across all VLANs.

Question 5

Which THREE criteria are evaluated by Junos when electing the primary Routing Engine in an EX Series Virtual Chassis? (Choose three)

Accepted Answer

Switch uptime or boot order sequence if priorities are identical.. Junos elects the primary Routing Engine in an EX Series Virtual Chassis using a defined set of criteria, and option D is correct because the configured routing-engine mastership priority (set with 'set virtual-chassis member X mastership-priority') is the first and most significant factor—the member with the highest priority wins. Option A is correct because when mastership priorities are equal, the switch with the longer uptime (earlier boot order) becomes primary, ensuring a stable and deterministic election. Option C is correct because if both priority and uptime are identical, the base MAC address of the switch is used as a final deterministic tie-breaker, with the lower MAC address typically winning. Option B is incorrect because VRRP router ID on VLAN 1 is a Layer 3 redundancy mechanism unrelated to Virtual Chassis RE election. Option E is incorrect because the number of active LACP links is not a criterion in the Virtual Chassis primary election process.

Answer

The VRRP router ID configured on VLAN 1.

Answer

The number of active LACP links connected to member 0.

Question 6

Which TWO statements are correct regarding the operation of MSTP instance 0 (CIST)? (Choose two.)

Accepted Answer

It handles any VLANs that are not explicitly mapped to another user-defined MST instance.. Option A is correct because MSTP instance 0, the CIST, carries all VLANs that are not explicitly mapped to a user-defined MST instance (MSTI); these unmapped VLANs default to the CIST and are forwarded along the CIST topology. Option D is correct because instance 0 is by definition the Common and Internal Spanning Tree (CIST), which provides the single spanning-tree topology that interconnects all MST regions and also interoperates with external SST/RSTP regions. The unmarked options are wrong: B is false because the CIST does interact with external RSTP switches by treating each external region as a virtual bridge and running RSTP-based interoperation at region boundaries; C is false because MSTP uses the standard 802.1D hop-count limit of 20 (not 1) for the CIST; and E is false because root protection (root guard) can be configured on CIST/instance-0 ports to prevent them from becoming root ports.

Answer

It operates independently without any interaction with external RSTP switches.

Answer

It is limited strictly to a maximum hop count of 1.

Answer

It prohibits the use of root protection on instance 0 ports.

Question 7

An engineer is configuring a trunk port on an EX Series switch and needs to ensure that untagged and priority-tagged frames are handled correctly. Which TWO configuration actions are required? (Choose two.)

Accepted Answer

Set the interface mode to trunk under the ethernet-switching family hierarchy.. Option A is correct because on EX Series switches the port must be placed into trunk mode under the ethernet-switching family hierarchy (set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk) so that it can carry multiple VLANs and process tagged frames. Option E is correct because the native-vlan-id statement defines which VLAN handles untagged and priority-tagged frames arriving on the trunk, ensuring those frames are mapped to the intended VLAN. Option B is incorrect because a Layer 2 trunk port does not require Layer 3 routing on unit 0; routing would be configured on an IRB (VLAN) interface instead. Option C is incorrect because CCC and VPLS encapsulations are used for circuit cross-connect and VPLS Layer 2 VPN services, not for standard 802.1Q trunking. Option D is incorrect because disabling MAC learning is not required or recommended for a trunk port and would not prevent native VLAN loops.

Answer

Enable Layer 3 routing directly on the physical trunk interface unit 0.

Answer

Configure the interface encapsulation as CCC or VPLS.

Answer

Disable MAC learning on the trunk interface to prevent native VLAN loops.

Question 8

An administrator is configuring VLANs on a Junos EX Series switch. Which TWO tasks must be performed to successfully assign a physical interface as an access port for a newly created VLAN? (Choose two.)

Accepted Answer

Configure the interface mode as access under [edit interfaces unit 0 family ethernet-switching].. Option E is correct because a VLAN must first exist in the configuration before an interface can be assigned to it; on Junos EX switches you create it under [edit vlans] with a name and a vlan-id (e.g., set vlans SALES vlan-id 100). Option D is correct because the physical port is made an access port by setting the interface mode to access under [edit interfaces unit 0 family ethernet-switching], which places untagged traffic from that port into the specified VLAN. Spanning tree (option A) is not required to make a VLAN active, and it is enabled by default on EX switches anyway. Option B is wrong because an access port carries Layer 2 traffic in family ethernet-switching; assigning family inet and an IP address is for a routed/Layer 3 interface, not a switched access port. Option C is wrong because trunk mode with native-vlan-id is used for carrying multiple VLANs (802.1Q tagging), not for assigning a single access VLAN to a physical interface.

Answer

Enable spanning-tree protocol globally for the access VLAN to become active.

Answer

Configure the interface family as inet and assign an IP address.

Answer

Configure the interface as a trunk port with native-vlan-id enabled.

Question 9

An engineer is configuring static routes in Junos OS and wants to ensure high availability. Which TWO features can be implemented with static routes to achieve path redundancy? (Choose two)

Accepted Answer

Qualified next-hop with varying preference values. Option A (Qualified next-hop with varying preference values) is correct because Junos static routes support multiple qualified next-hops, each with its own preference; if the primary next-hop fails, the route with the next-lower preference becomes active, providing path redundancy. Option D (Recursive next-hop tracking via RPM or routing table lookups) is correct because a static route can resolve its next-hop recursively, and RPM (Real-time Performance Monitoring) probes or routing-table lookups can detect when the resolved next-hop becomes unreachable, allowing the route to be withdrawn or replaced. Option B (IGMP snooping) is a Layer 2 multicast optimization and does not provide static-route path redundancy. Option C (OSPF area stubbing) is a dynamic routing design technique for reducing LSAs, not a static-route feature. Option E (BGP AS-path prepending) is a BGP path-manipulation tool and cannot be applied to plain static routes.

Answer

IGMP snooping on static interfaces

Answer

OSPF area stubbing

Answer

BGP AS-path prepending on static routes

Question 10

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Accepted Answer

Multicast traffic rate exceeding the configured threshold. Storm control on a switch interface monitors Layer 2 traffic rates and drops frames when a configured threshold is exceeded, and it applies to broadcast, multicast, and unknown unicast traffic. Option A is correct because multicast traffic exceeding the configured threshold is one of the traffic types storm control polices, so it triggers drops. Option D is correct because broadcast traffic exceeding the configured threshold is the classic storm control trigger, suppressing broadcast storms on the interface. Option B is wrong because unicast destined for known active MAC addresses is normal, expected forwarding traffic and is not counted by storm control (only unknown unicast is). Option C is wrong because CPU control plane queue utilization is a control-plane policing concern, not an interface storm control action. Option E is wrong because BPDUs are control frames handled by Spanning Tree, not storm-control-monitored data traffic.

Answer

Unicast traffic destined for known active MAC addresses exceeding average utilization

Answer

CPU control plane queue utilization exceeding 90%

Answer

BPDU control frames exceeding Spanning Tree hello timers

Question 11

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Accepted Answer

DHCP snooping. DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks. OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Answer

OSPFv3 authentication

Answer

MACsec point-to-point encryption

Question 12

Which THREE attributes are optional transitive BGP path attributes? (Choose three)

Accepted Answer

AS4_PATH. AS4_PATH (A) is an optional transitive attribute defined in RFC 6793 that carries 4-byte AS path information for backward compatibility with 2-byte AS speakers, and it is propagated to other ASes. AGGREGATOR (B) is an optional transitive attribute (type code 7) that records the AS and router ID of the device that performed route aggregation, and it is passed along to BGP peers. COMMUNITY (D) is an optional transitive attribute (type code 8) used to tag routes with community values that are propagated across AS boundaries. MED (C) is an optional nontransitive attribute, so it is not propagated beyond the neighboring AS, and LOCAL_PREF (E) is a well-known discretionary attribute used only within a single AS, so neither qualifies as optional transitive.

Answer

MED

Answer

LOCAL_PREF

Question 13

Which TWO statements describe characteristics of BGP path attributes? (Choose two.)

Accepted Answer

Well-known mandatory attributes must be recognized by all BGP implementations and included in every Update message containing path information.. Option C is correct because well-known mandatory attributes, by definition in BGP (RFC 4271), must be recognized by every BGP implementation and must appear in every UPDATE message that carries reachable NLRI/path information. Option E is correct because AS_PATH is one of the three well-known mandatory attributes (along with NEXT_HOP and ORIGIN), and it is present in every UPDATE advertising a route. Option A is wrong because Local Preference is a well-known discretionary attribute, not one exchanged across eBGP peers — it is typically propagated only within an AS via iBGP. Option B is wrong because MED is an optional non-transitive attribute, not well-known mandatory, and it influences inter-AS route selection only when explicitly configured. Option D is wrong because optional transitive attributes that are unrecognized are still passed along to other peers (with the partial bit set), not discarded.

Answer

Local Preference is a well-known discretionary attribute that is exchanged across eBGP peers.

Answer

MED is a well-known mandatory attribute used for inter-AS route selection.

Answer

Optional transitive attributes are ignored by BGP speakers that do not recognize them and are never passed along to other peers.

Question 14

Which TWO attributes distinguish direct routes from static routes in Junos OS? (Choose two)

Accepted Answer

Direct routes represent subnets attached to active local interfaces.. Option B is correct because direct routes in Junos OS are automatically installed in the routing table for the subnets configured on active local interfaces, representing directly connected networks. Option E is correct because Junos assigns direct routes a default preference of 0, while static routes carry a default preference of 5, making direct routes more preferred when both exist for the same prefix. Option A is wrong because static routes are manually configured, not automatically created when an interface comes up; that behavior describes direct/interface routes. Option C is wrong because direct routes do not require manual configuration under routing-options; they are derived from interface addresses, whereas static routes are configured under routing-options. Option D is wrong because static routes can use recursive next-hops, resolving the next-hop through another route in the routing table.

Answer

Static routes are created automatically when an interface comes up.

Answer

Direct routes require manual IP address configuration under routing-options.

Answer

Static routes cannot be used with recursive next-hops.

Question 15

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Accepted Answer

Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.. Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network. Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Answer

Disabling all Layer 2 learning on the translation interface.

Answer

Enabling OSPFv3 routing directly on the customer edge interface unit 0.

Question 16

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses the DHCP snooping binding database to build its IP-to-MAC-to-port-to-VLAN binding table, then filters traffic on untrusted ports by dropping any packet whose source IP/MAC does not match an entry in that database (or a statically configured binding). Dynamic ARP Inspection (C) is also correct because DAI validates ARP packets on untrusted ports by comparing the sender IP and sender MAC against the DHCP snooping binding database, dropping ARP packets that do not match a valid binding (with static ARP ACLs as an optional supplement). Storm Control (B) is not correct because it is a hardware-based traffic rate limiter that monitors broadcast, multicast, or unknown unicast frames per port and does not consult any DHCP snooping bindings. Port Security MAC-Limit (D) is not correct because it restricts the number of source MAC addresses learned on a port using the MAC address table, independent of DHCP snooping bindings. MACsec Key Agreement (E) is not correct because MKA is part of IEEE 802.1X-2010 MACsec and negotiates session keys between link peers using EAPOL-MKA frames, with no dependency on the DHCP snooping binding database.

Answer

Storm Control rate-limiting

Answer

Port Security MAC-Limit

Answer

MACsec Key Agreement (MKA)

Question 17

Which TWO features help protect an RSTP topology from unauthorized switches or misconfigurations on access ports? (Choose two.)

Accepted Answer

Root protection. Root protection (Option C) is correct because when enabled on a port, it forces that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing an unauthorized or misconfigured switch on an access port from becoming the root bridge and hijacking the spanning-tree topology. BPDU guard (Option E) is correct because it err-disables a port immediately upon receiving any BPDU, which stops rogue switches or misconfigured devices from participating in RSTP on access ports that should only connect to end hosts. Bridge priority adjustment (Option A) only influences which switch becomes root and does not defend against unauthorized switches on access ports. Hello timer scaling (Option B) merely changes how often BPDUs are sent and does not provide protection. Forward delay timer optimization (Option D) tunes STP convergence timing and likewise offers no security against rogue or misconfigured access-port devices.

Answer

Bridge priority adjustment

Answer

Hello timer scaling

Answer

Forward delay timer optimization

Question 18

Which TWO commands are used to verify link aggregation and LACP operational status on a Juniper switch? (Choose two)

Accepted Answer

show interfaces ae0. Option C, 'show interfaces ae0', is correct because the aggregated Ethernet (ae) interface is the logical bundle created by link aggregation, and this command displays its operational status, member links, and whether the bundle is up. Option D, 'show lacp interface', is correct because it directly reports LACP protocol state per member interface, including actor/partner state flags (such as whether the link is collecting and distributing) and LACP operational status. Option A, 'show virtual-chassis', is unrelated since it displays Virtual Chassis topology and member roles, not link aggregation. Option B, 'show vrrp detail', concerns VRRP redundancy state and has nothing to do with LACP or aggregation. Option E, 'show chassis routing-engine', reports Routing Engine status and resources, not link aggregation or LACP.

Answer

show virtual-chassis

Answer

show vrrp detail

Answer

show chassis routing-engine

Question 19

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Accepted Answer

Enable MACsec on the physical interface.. Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session. Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

Answer

Configure the interface as a trusted port for Dynamic ARP Inspection.

Answer

Enable DHCP snooping on the transit VLAN.

Question 20

When configuring Filter-Based Forwarding (FBF), which THREE components are absolutely mandatory for successful operation? (Choose three)

Accepted Answer

A firewall filter with 'then routing-instance ' action.. Option A is correct because FBF requires a firewall filter that matches traffic and uses the 'then routing-instance ' action to redirect matching packets into the alternate routing table. Option B is correct because that action must reference a routing instance of type 'forwarding' (or 'virtual-router'), which provides the separate routing table where the redirected traffic is resolved. Option C is correct because the filter must be applied as an input filter on the ingress interface so that packets are classified and redirected before the normal destination lookup occurs. Option D is incorrect because BGP multipath is a load-balancing feature and is not required for FBF to function. Option E is incorrect because RSVP-TE LSPs are an MPLS traffic-engineering mechanism and are unrelated to the mandatory FBF configuration components.

Answer

BGP multipath enabled across all core interfaces.

Answer

An RSVP-TE LSP tunnel configured between the routers.