Courseiva

CCNA Networking Fundamentals Questions

22 questions · Networking Fundamentals · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A host in VLAN 10 can ping a host in VLAN 20 without a default gateway configured. What feature is likely enabled on the router that interconnects the VLANs?

A.VLAN translation is configured on the trunk
B.Proxy ARP
C.IP routing is enabled on the router
D.Dynamic ARP Inspection
AnswerB

Proxy ARP enables the router to reply to ARP requests for IP addresses that are actually in other subnets, providing its own MAC address as the next hop. This makes the host believe the remote host is directly reachable, so it sends frames to the router, which then routes them to VLAN 20. This gives the host a path to the remote subnet without requiring a default gateway configuration, which is exactly why it works here.

Why this answer

Proxy ARP allows a router to respond to ARP requests on behalf of hosts in different subnets. When a host in VLAN 10 sends an ARP request for a host in VLAN 20, the router responds with its own MAC address if it has a route to the destination. This enables the host to send traffic to the router, which then forwards it to the destination VLAN, even without a default gateway configured on the host.

Exam trap

The trap here is that candidates often assume IP routing alone is sufficient for inter-VLAN communication, forgetting that hosts must have a default gateway or use proxy ARP to send traffic outside their local subnet.

How to eliminate wrong answers

Option A is wrong because VLAN translation modifies VLAN IDs on trunk links and does not enable inter-VLAN communication without a default gateway; it simply maps one VLAN tag to another. Option C is wrong because IP routing is a prerequisite for any inter-VLAN communication, but it alone does not allow a host to reach a different subnet without a default gateway—the host must still know where to send packets. Option D is wrong because Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets to prevent spoofing; it does not facilitate routing or proxy ARP responses.

Practice this question →
2
MCQmedium

Which field in an Ethernet frame is used by a switch to learn which source MAC address belongs to which port?

A.Ethertype field
B.Destination MAC address
C.VLAN ID field
D.Source MAC address
AnswerD

The switch learns that the source MAC address is reachable out of the port on which the frame arrived, creating or updating a MAC address table entry. This is the fundamental operation of transparent bridging: the switch records the association between the source MAC address, ingress port, and VLAN ID. Once learned, the entry is used to forward future frames destined to that MAC address only to the correct port, rather than flooding. Thus, the source MAC address is the field that triggers and drives MAC learning in an Ethernet switch.

Why this answer

A switch learns MAC address-to-port mappings by examining the source MAC address field of incoming Ethernet frames. When a frame arrives on a port, the switch records the source MAC address and associates it with that port in its MAC address table, enabling future frames destined for that MAC to be forwarded only to the correct port.

Exam trap

The trap here is that candidates often confuse the role of the destination MAC address (used for forwarding decisions) with the source MAC address (used for learning), especially when they recall that switches forward frames based on destination MAC, but forget that learning is done from the source MAC.

How to eliminate wrong answers

Option A is wrong because the Ethertype field indicates the upper-layer protocol (e.g., IPv4 or IPv6) encapsulated in the frame, not the source or destination MAC address, and is not used for MAC learning. Option B is wrong because the destination MAC address is used by the switch to look up the forwarding decision (which port to send the frame out of) after the MAC address table is built, not to learn which port a source MAC belongs to. Option C is wrong because the VLAN ID field (part of the 802.1Q tag) identifies the VLAN membership of the frame, but MAC learning is performed per VLAN using the source MAC address, not the VLAN ID itself.

Practice this question →
3
MCQmedium

You are troubleshooting a network connectivity issue at a medium-sized company that uses Juniper EX4300 switches. Users in VLAN 100 (10.10.100.0/24) report that they cannot access a server in VLAN 200 (10.10.200.0/24). The switch has IRB interfaces configured for both VLANs and is acting as the default gateway. The IRB interfaces are up and have correct IP addresses. The server and users have correct IP configurations. 'show arp' on the switch shows incomplete entries for some hosts in VLAN 100. 'show ethernet-switching table' shows MAC addresses for users are present on the correct access ports. However, pings from the switch to a user in VLAN 100 fail. What is the most likely issue?

A.Spanning Tree Protocol is blocking the user ports.
B.A static MAC address entry for the server is missing.
C.The switch cannot resolve ARP requests because the user's host is not responding.
D.The IRB interface for VLAN 100 is not configured with a proxy ARP.
AnswerC

When a switch's ARP table shows an entry as 'incomplete', it means the switch has sent ARP requests for that IP address but has not received any ARP reply. This occurs when the target host is down, has the wrong IP address, or is configured with a firewall that silently drops ARP probes. The user's host is not responding to the ARP requests, so the switch cannot determine the MAC address needed to forward frames, breaking connectivity even though the host may be physically connected.

Why this answer

The 'incomplete' entries in the 'show arp' output indicate that the switch sent ARP requests for hosts in VLAN 100 but received no replies. Since the switch is the default gateway, it must resolve the Layer 2 MAC address of each host to forward traffic. If a user's host is not responding to ARP (e.g., due to a firewall, misconfiguration, or the host being offline), the switch cannot complete the ARP cache entry, causing pings from the switch to fail and potentially disrupting inter-VLAN routing.

Exam trap

The trap here is that candidates may confuse a Layer 2 issue (like STP blocking or missing MAC entries) with a Layer 3 issue (ARP resolution failure), overlooking that 'incomplete' ARP entries directly point to a host not responding to ARP requests.

How to eliminate wrong answers

Option A is wrong because Spanning Tree Protocol (STP) blocking a port would prevent all traffic, including ARP replies, but the 'show ethernet-switching table' shows MAC addresses on the correct access ports, indicating STP is not blocking those ports. Option B is wrong because a missing static MAC address entry for the server would affect reachability to the server, not the switch's ability to ping a user in VLAN 100; the issue is with ARP resolution for local hosts, not the server. Option D is wrong because proxy ARP is used to allow hosts in one subnet to resolve MAC addresses for hosts in another subnet when the switch is not the default gateway; here, the switch is the default gateway with IRB interfaces, so proxy ARP is not required for the switch to resolve its own ARP requests.

Practice this question →
4
MCQmedium

You are troubleshooting an OSPF adjacency issue between two Juniper MX series routers, R1 and R2, both running Junos 18.2. They are directly connected via a Gigabit Ethernet link. R1's interface ge-0/0/0 is configured with IP 192.168.1.1/24, and R2's ge-0/0/0 is configured with IP 192.168.1.2/24. Both interfaces are in OSPF area 0.0.0.0. The physical connectivity is confirmed up, and both interfaces are administratively enabled. You have checked that the hello and dead intervals match (hello 10, dead 40), the area IDs are identical, and the subnet masks are /24. No firewall filters are blocking OSPF. The OSPF configuration on R1 includes 'authentication-type md5' and 'authentication-key juniper123' under the interface. On R2, the configuration also includes 'authentication-type md5' but the key is 'juniper321'. Both routers have loopback addresses as router IDs: 1.1.1.1 for R1 and 2.2.2.2 for R2. No explicit OSPF network type is set, so the default is broadcast. Despite these configurations, the OSPF adjacency state on both routers remains in INIT. What is the most likely cause of this issue?

A.The interface MTU size is mismatched.
B.The OSPF network type is mismatched.
C.The OSPF authentication keys do not match.
D.The router IDs are not properly configured.
AnswerC

When MD5 authentication keys differ, each router silently drops the other's Hello packets after the keyed digest fails verification. Because the local router never receives a valid Hello containing its own router ID, the neighbor state cannot advance from INIT to 2-Way. The adjacency therefore remains stuck in INIT, even though the Hello packets arrive at the interface, making this the misconfiguration exactly consistent with the symptoms.

Why this answer

OSPF authentication keys must match exactly for the adjacency to form. R1 uses key 'juniper123' while R2 uses 'juniper321', causing the MD5 digest computed on each Hello packet to differ. Since OSPF authentication is validated per-packet, mismatched keys prevent the routers from moving past the INIT state.

Exam trap

The trap here is that candidates often overlook authentication key consistency because they focus on matching hello/dead intervals and area IDs, assuming authentication is correctly configured if the type matches.

How to eliminate wrong answers

Option A is wrong because an MTU mismatch would typically cause the adjacency to stall in EXSTART/EXCHANGE state, not INIT, and both interfaces are Gigabit Ethernet with default MTU 1500. Option B is wrong because both interfaces use the default OSPF network type 'broadcast' (no explicit type set), so there is no mismatch. Option D is wrong because the router IDs (1.1.1.1 and 2.2.2.2) are valid and properly configured; mismatched router IDs do not prevent the INIT state, as OSPF uses router IDs only after the 2-Way state.

Practice this question →
5
MCQhard

Refer to the exhibit. The OSPF neighbor adjacency repeatedly goes up and down on R1. What is a likely cause?

A.The physical link is flapping
B.MTU mismatch between the two routers
C.OSPF authentication is misconfigured
D.The routers are in different OSPF areas
AnswerB

MTU mismatch is the correct answer because OSPF uses Database Description (DBD) packets to exchange link-state summaries, and these packets can exceed the interface MTU. When a router receives a DBD packet larger than its configured MTU, it silently drops the packet, causing the neighbor to remain stuck or repeatedly restart the ExStart/Exchange process. The router that is the slave in the exchange will detect the mismatch via the MTU field in the DBD packet and cycle back to ExStart, which produces the repeated adjacency behavior shown in the exhibit.

Why this answer

An MTU mismatch between OSPF neighbors can cause the adjacency to flap because OSPF includes the interface MTU in the Database Description (DBD) packets. If the MTU values do not match, the receiving router will reject the DBD packet, preventing the exchange of LSAs and causing the neighbor state to reset. This is a common cause of repeated up/down OSPF adjacencies even when the physical link is stable.

Exam trap

The trap here is that candidates often assume physical link flapping (Option A) is the cause, but OSPF adjacency flapping can occur with a stable link due to Layer 3 mismatches like MTU, which is a subtle but classic JNCIA-JUNOS exam topic.

How to eliminate wrong answers

Option A is wrong because a physical link flapping would typically cause interface state changes and error counters to increment, but the question specifies the OSPF adjacency goes up and down while the physical link may remain stable; MTU mismatch can cause this without link flapping. Option C is wrong because if OSPF authentication were misconfigured, the adjacency would fail to form entirely or remain in a state like EXSTART/EXCHANGE, not repeatedly go up and down. Option D is wrong because OSPF routers in different areas cannot form a neighbor adjacency at all; they would remain stuck in the INIT or 2-WAY state, not repeatedly transition up and down.

Practice this question →
6
MCQeasy

A network administrator is configuring a new subnet for servers that must not communicate with each other directly but must be able to reach a default gateway. Which type of route should be configured on the servers?

A.Host route for the gateway
B.Default route pointing to the gateway
C.Dynamic route via OSPF
D.Static route to each other server
AnswerB

A default route (0.0.0.0/0) is the least-specific route and matches all packets whose destination has no other matching entry in the routing table. In Junos, configuring a static default route with next-hop pointing to the gateway is the standard way to give a server off-subnet reachability. This is exactly what a default gateway does for a host.

Why this answer

A default route (0.0.0.0/0) pointing to the gateway is correct because it allows servers to reach any external destination (including the gateway) without requiring explicit routes to each other. Since the servers must not communicate directly, they should not have routes to each other's subnets; the default route ensures all non-local traffic is forwarded to the gateway, which can then enforce isolation policies.

Exam trap

The trap here is that candidates often confuse a default route with a host route, thinking a specific route to the gateway is sufficient, but a default route is required to reach all external destinations beyond the local subnet.

How to eliminate wrong answers

Option A is wrong because a host route for the gateway (e.g., a /32 route to the gateway's IP) would only allow the server to reach that single IP address, not any other external destinations; it does not provide a path to the default gateway for general traffic. Option C is wrong because dynamic routing via OSPF would require the servers to participate in OSPF, which is unnecessary and complex for simple hosts; OSPF is designed for routers, not end devices, and would introduce overhead and potential security risks. Option D is wrong because a static route to each other server would explicitly allow direct communication between servers, violating the requirement that they must not communicate with each other directly.

Practice this question →
7
MCQhard

A network engineer is troubleshooting OSPF adjacencies between two Juniper routers. The routers are directly connected and have matching OSPF configurations except for the router IDs. Router A has router-id 10.0.0.1, Router B has router-id 10.0.0.2. The adjacency remains in the EXSTART state. What is the most likely cause?

A.The MTU on the interface is mismatched.
B.The router IDs are not the same.
C.The area ID is not configured.
D.The hello and dead intervals are mismatched.
AnswerA

An MTU mismatch is a classic cause of OSPF adjacency being stuck in the EXSTART state. During the Database Description (DD) packet exchange, OSPF embeds the interface MTU in the DD header. If one interface has a larger MTU and sends a DD packet that exceeds the neighbor's MTU, the receiving router will drop the packet. Since the neighbor never receives the DD packet, the routers cannot complete the master/slave negotiation, and the adjacency remains permanently in EXSTART rather than progressing to FULL.

Why this answer

The EXSTART state indicates that the routers have progressed past the 2-Way state and are attempting to exchange Database Description (DBD) packets. A common cause for getting stuck in EXSTART is an MTU mismatch, because OSPF uses the interface MTU to determine the maximum size of DBD packets. If Router A's MTU is larger than Router B's, Router B will drop the oversized DBD packet and the adjacency will remain in EXSTART.

Exam trap

The trap here is that candidates often assume mismatched hello/dead intervals are the cause of any adjacency problem, but those issues manifest earlier (at the 2-Way state), while EXSTART specifically points to MTU or DBD packet exchange problems.

How to eliminate wrong answers

Option B is wrong because OSPF requires router IDs to be unique within an OSPF domain; having different router IDs (10.0.0.1 and 10.0.0.2) is correct and does not prevent adjacency formation. Option C is wrong because if the area ID were not configured, the routers would not even reach the EXSTART state; they would fail at the 2-Way or Init state due to mismatched area IDs in Hello packets. Option D is wrong because mismatched hello/dead intervals would cause the adjacency to stall at the 2-Way state (or prevent reaching 2-Way), not at EXSTART, as these parameters are checked in Hello packets before neighbor state progression.

Practice this question →
8
MCQmedium

A network engineer is troubleshooting connectivity between two directly connected Juniper routers. The interface on Router A shows 'up' but no packets are being received from Router B. Which command should the engineer use on Router A to check if the interface is expecting to receive a specific encapsulation type?

A.show interfaces extensive
B.show interfaces terse
C.show configuration interfaces
D.monitor traffic interface
AnswerA

The 'show interfaces extensive' command is essential because it reveals the actual data-link encapsulation currently in use on the interface, along with detailed physical and protocol state information. This allows the engineer to confirm whether both routers are configured with matching encapsulation types (e.g., PPP, HDLC, or Frame Relay). It also provides error counters and keepalive statistics, which can expose framing mismatches or negotiation failures. Without this operational view, a layer-1 connectivity issue could be mistakenly attributed to configuration when the real cause is an encapsulation mismatch.

Why this answer

The 'show interfaces extensive' command displays detailed interface information, including the encapsulation type configured on the interface. If Router A expects a specific encapsulation (e.g., PPP, HDLC, or Ethernet) that does not match what Router B is sending, the interface will show 'up' but will not receive packets. This command allows the engineer to verify the configured encapsulation type.

Option B is incorrect because 'show interfaces terse' provides a concise summary (name, status, protocol, and address) but does not include encapsulation details.

Exam trap

Candidates often assume 'show interfaces terse' includes encapsulation details, but it only provides a quick summary. The 'extensive' option is needed for encapsulation type.

How to eliminate wrong answers

Option A is wrong because 'show interfaces extensive' provides detailed interface statistics and error counters but does not explicitly highlight the encapsulation type in a concise manner; it is more useful for deep packet-level troubleshooting rather than checking encapsulation expectations. Option C is wrong because 'show configuration interfaces' displays the configuration stanza for interfaces, which includes encapsulation settings, but it shows the intended configuration rather than the operational state; the interface could be 'up' with a mismatched encapsulation if the configuration was committed incorrectly or if the peer is misconfigured. Option D is wrong because 'monitor traffic interface' captures live packet headers on the interface, which can help identify encapsulation mismatches by showing malformed frames, but it is a real-time diagnostic tool that does not directly display the configured encapsulation type; it is more appropriate for advanced troubleshooting after verifying the configuration.

Practice this question →
9
MCQeasy

Refer to the exhibit. A frame with destination MAC 00:0c:29:2a:3b:4d arrives on interface ge-0/0/0. What action will the switch take?

A.Flood the frame to all ports except ge-0/0/0
B.Forward the frame out of ge-0/0/2 only
C.Drop the frame because the VLAN does not match
D.Forward the frame out of both ge-0/0/1 and ge-0/0/2
AnswerB

This is the correct behavior because Junos performs a lookup of the destination MAC address in the Layer 2 forwarding table. The entry for 00:0c:29... lists ge-0/0/2 as the egress interface in VLAN 10, so the frame is forwarded out of that single port. Known unicast frames are switched to exactly one port, as determined by the MAC table.

Why this answer

The switch learns MAC addresses and their associated VLANs from incoming frames. Since the destination MAC 00:0c:29:2a:3b:4d is already in the MAC address table and mapped to interface ge-0/0/2 within the same VLAN, the switch forwards the frame only out of ge-0/0/2. This is the fundamental behavior of transparent bridging: unicast frames are forwarded only to the port where the destination MAC was last seen.

Exam trap

The trap here is that candidates often assume a switch always floods unknown unicast frames, but the question explicitly provides a known destination MAC, so the correct action is unicast forwarding, not flooding.

How to eliminate wrong answers

Option A is wrong because flooding occurs only when the destination MAC is unknown (not in the MAC table) or is a broadcast/multicast address; here the MAC is known. Option C is wrong because the frame arrives on ge-0/0/0, which is an access port in the same VLAN as ge-0/0/2, so the VLAN matches; the switch does not drop the frame due to VLAN mismatch. Option D is wrong because the switch does not forward a known unicast frame out of multiple ports; it uses the single port from the MAC table, not both ge-0/0/1 and ge-0/0/2.

Practice this question →
10
MCQhard

A network engineer sees an unknown unicast flood on a Juniper EX switch. Which mechanism is most effective at reducing such floods?

A.Enable storm control for unknown unicast traffic.
B.Configure static MAC addresses for all endpoints.
C.Increase the MAC address table aging time.
D.Disable MAC learning on trunk interfaces.
AnswerA

Storm control on Junos allows you to define a threshold for unknown unicast traffic, either as a percentage of interface bandwidth or as packets per second. When the unknown unicast flood exceeds that threshold, the switch drops excess traffic or shuts down the affected interface until it recovers, preventing the flood from saturating the network. This is a practical, policy-based mitigation because it does not require knowing every endpoint and can be applied per interface and per VLAN.

Why this answer

Unknown unicast flooding occurs when a switch does not have a MAC address entry for a destination, causing it to flood the frame out of all ports in the VLAN except the ingress port. Storm control for unknown unicast traffic (set using `set ethernet-switching-options storm-control interface <interface> unknown-unicast`) directly limits the rate of such flooded traffic, preventing excessive bandwidth consumption. This is the most effective mechanism because it specifically targets and rate-limits unknown unicast floods without altering MAC learning or aging behavior.

Exam trap

The trap here is that candidates often confuse storm control (which rate-limits flooded traffic) with broadcast suppression or MAC learning controls, and may incorrectly think that increasing aging time or disabling MAC learning will reduce flooding, when in fact those actions either have no effect or worsen the problem.

How to eliminate wrong answers

Option B is wrong because configuring static MAC addresses for all endpoints is not scalable in a dynamic network and does not dynamically reduce flooding; it only prevents flooding for those specific statically defined addresses. Option C is wrong because increasing the MAC address table aging time can actually increase the likelihood of stale entries and does not reduce unknown unicast floods; it may even exacerbate flooding by delaying the removal of outdated entries. Option D is wrong because disabling MAC learning on trunk interfaces would prevent the switch from learning MAC addresses on those links, which would increase unknown unicast flooding rather than reduce it, as the switch would have fewer learned entries.

Practice this question →
11
MCQmedium

A network administrator notices that traffic between two VLANs is not reaching its destination. The switch has an IRB interface configured with an IP address in each VLAN's subnet. What is the most likely missing configuration?

A.The IRB interface does not have an IP address configured.
B.The VLANs are on different switches.
C.The VLANs are not defined on the switch.
D.The switch ports are not configured for VLAN tagging.
AnswerC

For inter-VLAN routing to work in Junos, each VLAN must first be defined under the [edit vlans] hierarchy so the switch knows which VLAN ID or name to associate with the ports and IRB interface. Without that definition, the IRB interface cannot be logically bound to a broadcast domain, and traffic cannot be forwarded between the two VLAN subnets. The stem confirms the IRB has an IP address, but if the VLANs themselves are not configured, the switch has no way to match incoming frames to a routing instance. This missing VLAN definition is exactly what breaks the traffic flow, making this the correct answer.

Why this answer

The IRB interface provides Layer 3 routing between VLANs, but it requires the VLANs themselves to be defined on the switch. If the VLANs are not defined, the switch cannot associate the IRB interface with the correct broadcast domains, and traffic will not be forwarded between them. Option C correctly identifies this missing configuration.

Exam trap

The trap here is that candidates often assume an IRB interface with an IP address is sufficient for inter-VLAN routing, overlooking the prerequisite that the VLAN must be defined and associated with the IRB in the switch configuration.

How to eliminate wrong answers

Option A is wrong because the question states the IRB interface has an IP address in each VLAN's subnet, so an IP address is already configured. Option B is wrong because IRB interfaces can route between VLANs on the same switch or across different switches if the VLANs are extended via trunk links; the issue is not about switch placement. Option D is wrong because VLAN tagging on switch ports is only relevant for trunk ports carrying multiple VLANs, not for the IRB interface itself, and the problem is about inter-VLAN routing, not port configuration.

Practice this question →
12
MCQeasy

An engineer is troubleshooting a network issue where hosts on the same VLAN cannot communicate with each other. Which configuration element is most likely missing?

A.Spanning Tree Protocol enabled
B.An IRB interface for the VLAN
C.A Layer 3 switchport
D.A default gateway for the VLAN
AnswerA

STP prevents loops, does not affect Layer 3 connectivity.

Why this answer

Hosts on the same VLAN communicate at Layer 2 and do not require any Layer 3 configuration such as an IRB interface or default gateway. The most likely missing configuration is that Spanning Tree Protocol (STP) is not enabled. Without STP, loops can cause broadcast storms and MAC address flapping, preventing communication between hosts in the same VLAN.

Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse the need for a default gateway (Layer 3) with Layer 2 connectivity, assuming hosts on the same VLAN need a gateway to communicate, when in fact they communicate directly via ARP and MAC addresses.

How to eliminate wrong answers

Option A is wrong because Spanning Tree Protocol (STP) prevents loops in redundant topologies but is not required for basic Layer 2 communication within a single VLAN; hosts can communicate without STP enabled. Option C is wrong because a Layer 3 switchport is used for routing between VLANs, not for same-VLAN communication; hosts on the same VLAN communicate at Layer 2, so a Layer 2 switchport is needed. Option D is wrong because a default gateway is only necessary for traffic destined outside the local subnet; hosts on the same VLAN communicate directly via MAC addresses and do not need a default gateway.

Practice this question →
13
MCQhard

An engineer enables Spanning Tree PortFast on a switch port connected to a host. Later, another switch is connected to that same port, causing a loop. What feature could have prevented this?

A.Loop guard
B.BPDU guard
C.Root guard
D.UplinkFast
AnswerB

BPDU guard is the correct companion feature for PortFast because PortFast places a port into the forwarding state immediately, assuming it connects only to an end host. If the port receives any Spanning Tree Protocol BPDU—indicating that a switch or bridge has been connected—BPDU guard immediately error-disables the port, stopping all traffic and preventing a potential bridging loop. This proactive shutdown is far faster than allowing the spanning tree algorithm to recalculate and block the port. By disabling the port on the very first BPDU, BPDU guard enforces the edge-port assumption and provides strong protection against accidental misconfigurations or malicious devices.

Why this answer

BPDU guard is the correct answer because it disables a port configured with PortFast if a BPDU is received, preventing loops when a switch is accidentally connected. In this scenario, PortFast was enabled for a host, but connecting another switch caused BPDUs to be sent, which BPDU guard detects and shuts down the port to break the loop.

Exam trap

The trap here is that candidates confuse BPDU guard with Loop guard, thinking both prevent loops, but Loop guard addresses unidirectional link failures, not the accidental connection of a switch to a PortFast port.

How to eliminate wrong answers

Option A is wrong because Loop guard is designed to prevent alternate or root ports from becoming designated in the absence of BPDUs (e.g., due to unidirectional link failure), not to block BPDUs on PortFast-enabled ports. Option C is wrong because Root guard enforces the root bridge position by disabling a port if it receives superior BPDUs, but it does not prevent loops from a switch connected to a PortFast port. Option D is wrong because UplinkFast is a Cisco-proprietary feature that accelerates convergence after a direct link failure on access switches, unrelated to protecting PortFast ports from BPDU reception.

Practice this question →
14
MCQeasy

A switch receives a unicast frame with a destination MAC address that is present in its MAC address table. How does the switch process the frame?

A.It sends the frame back to the source port
B.It floods the frame to all ports except the receiving port
C.It drops the frame
D.It forwards the frame only out of the port associated with that MAC address
AnswerD

When a switch receives a unicast frame with a destination MAC address already in its MAC address table, it forwards the frame only out of the port associated with that MAC address. This is the fundamental switching behavior: the MAC table records source MAC addresses and their corresponding ingress ports, and later lookups for known destinations are delivered to that single port. This preserves bandwidth, reduces unnecessary traffic, and ensures the frame reaches only the intended station.

Why this answer

When a switch receives a unicast frame and the destination MAC address is already in its MAC address table, it performs a lookup and forwards the frame only out of the specific port associated with that MAC address. This is the fundamental switching behavior known as 'unicast forwarding' or 'filtering,' which avoids unnecessary flooding and preserves bandwidth.

Exam trap

The trap here is that candidates often confuse the behavior for an unknown unicast (which is flooded) with a known unicast (which is forwarded only to the specific port), leading them to incorrectly select option B.

How to eliminate wrong answers

Option A is wrong because sending the frame back to the source port would create a loop and violate the basic switching principle that a frame is never forwarded out the port it was received on. Option B is wrong because flooding to all ports except the receiving port only occurs when the destination MAC address is unknown (not in the MAC table) or for broadcast/multicast frames, not for a known unicast address. Option C is wrong because the switch does not drop the frame; it has a matching entry in the MAC table and can forward it correctly to the intended destination.

Practice this question →
15
MCQmedium

A router receives a packet with destination IP 10.1.1.100. The routing table contains two entries: a static route to 10.1.1.0/24 via 192.168.1.1, and an OSPF route to 10.1.1.0/25 via 192.168.2.1. Which route will the router use?

A.The router drops the packet due to a routing conflict
B.The OSPF route to 10.1.1.0/25
C.The static route to 10.1.1.0/24
D.Both routes are used for load balancing
AnswerB

The destination address 10.1.1.100 falls inside both the 10.1.1.0/24 and 10.1.1.0/25 networks, but the forwarding decision is based on longest prefix match. Since /25 (255.255.255.128) is more specific than /24 (255.255.255.0), the OSPF route to 10.1.1.0/25 is the selected best route. This holds regardless of the administrative distance ranking of the two protocols because prefix length is evaluated before administrative distance.

Why this answer

The router will use the OSPF route to 10.1.1.0/25 because it has a longer prefix length (/25) than the static route (/24). Juniper Junos uses the most specific (longest) prefix match in the routing table, regardless of administrative distance or protocol preference. The destination IP 10.1.1.100 falls within the 10.1.1.0/25 range (10.1.1.0–10.1.1.127), so the /25 route is more specific and thus preferred.

Exam trap

The trap here is that candidates often assume OSPF routes are always preferred over static routes due to administrative distance, but Junos (and all routers) prioritize the longest prefix match first, so a more specific static route would win over a less specific OSPF route.

How to eliminate wrong answers

Option A is wrong because there is no routing conflict; the router uses the longest prefix match rule, not a tie-breaking mechanism that drops packets. Option C is wrong because the static route to 10.1.1.0/24 is less specific than the OSPF /25 route, so it is not selected for this destination. Option D is wrong because load balancing only occurs when multiple routes have identical prefix lengths and equal preference/metrics; here the prefix lengths differ (/24 vs /25), so only the most specific route is used.

Practice this question →
16
MCQeasy

A host needs to verify that its assigned IP address is not already in use on the network. Which type of packet does the host send?

A.ARP reply with its own MAC address
B.ARP request with target IP set to its own IP
C.Gratuitous ARP reply
D.ARP request with target IP set to the default gateway
AnswerB

The standard DAD probe is an ARP request with the sender IP and protocol address set to 0.0.0.0 and the target IP set to the host's own intended address, broadcast to the local segment. Per RFC 5227, the host then waits to see whether any device answers; if a reply or another ARP announcement arrives, the address is already in use. This is often called an ARP probe, and it explicitly asks the network 'does anyone own this IP?' before the host commits to it.

Why this answer

When a host wants to verify that its assigned IP address is not already in use on the network, it sends an ARP request with the target IP set to its own IP address. This is known as a gratuitous ARP request, and if another host responds with an ARP reply, it indicates an IP address conflict. This process is part of the Duplicate Address Detection (DAD) mechanism, commonly used in IPv4 networks to ensure uniqueness before the address is fully configured.

Exam trap

The trap here is that candidates often confuse a gratuitous ARP reply (used to announce an address) with a gratuitous ARP request (used for duplicate address detection), leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because an ARP reply with its own MAC address is a response, not a probe; the host must first send a request to check for conflicts, not assume its address is free. Option C is wrong because a gratuitous ARP reply is typically sent to update other hosts' ARP caches after an address is confirmed, not to detect duplicates; the detection phase uses a gratuitous ARP request (target IP = own IP). Option D is wrong because an ARP request with target IP set to the default gateway is used to resolve the gateway's MAC address for outbound traffic, not to verify the host's own IP address uniqueness.

Practice this question →
17
Drag & Dropmedium

Arrange the steps to configure an IPsec VPN on a Junos SRX in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

IPsec VPN setup involves IKE for key exchange, IPsec for encryption, and binding to an interface.

Practice this question →
18
MCQhard

You are responsible for a Juniper MX router that connects two customer sites over a Layer 3 VPN. The router is configured with BGP for VPN routes and uses MPLS to forward traffic. Recently, the customer reported that traffic from Site A (10.0.1.0/24) to Site B (10.0.2.0/24) is intermittently failing. You check the routing table on the router and see that both routes are present with valid next-hops. However, when you ping from the router's loopback to the remote site's loopback, the ping succeeds. MPLS labels are being assigned and the LSP is up. You also notice that when the failure occurs, the router's BGP session to the remote PE is still established. The failure seems random and lasts a few seconds before recovering. Which troubleshooting step is most likely to identify the root cause?

A.Check the interface error counters for CRC errors or drops.
B.Review the forwarding table for the affected prefixes and check for any discrepancies.
C.Verify the BGP session state and check for route flapping.
D.Check the MPLS label switching table to ensure labels are correctly assigned.
AnswerB

The forwarding table may have stale entries or incorrect label operations causing intermittent forwarding failures.

Why this answer

The issue is intermittent packet loss with valid routes in the routing table but successful pings from the loopback. This points to a forwarding table (FIB) inconsistency, where the control plane (routing table) has the correct next-hop, but the forwarding plane (PFE) may have a stale or incorrect entry for the specific prefixes. Checking the forwarding table with 'show route forwarding-table' will reveal if the next-hop or label information differs from the routing table, which is a classic symptom of a hardware programming issue or a transient PFE problem.

Exam trap

The trap here is that candidates assume a successful ping from the loopback confirms end-to-end forwarding, but the loopback ping uses a different path (e.g., in-band management) and does not test the specific MPLS label path for the customer prefixes, masking the forwarding table discrepancy.

How to eliminate wrong answers

Option A is wrong because CRC errors or interface drops would cause persistent or pattern-based failures, not intermittent failures that last seconds and recover, and the ping from the loopback succeeds, indicating the interface is functional. Option C is wrong because the BGP session is established and not flapping, so route flapping is not the cause; the issue is in the forwarding plane, not the control plane session. Option D is wrong because MPLS labels are correctly assigned and the LSP is up, as confirmed by the successful ping from the loopback, so the label switching table is not the source of the intermittent failure.

Practice this question →
19
MCQhard

A company is deploying an EVPN-VXLAN fabric with Juniper QFX switches. To provide inter-subnet routing, which interface type must be configured?

A.Physical interface with vlan-tagging
B.VXLAN tunnel endpoint (VTEP)
C.IRB interface
D.Loopback interface
AnswerC

An IRB (Integrated Routing and Bridging) interface is a logical, per-VLAN Layer 3 interface that provides the default gateway for hosts within that VLAN in an EVPN-VXLAN fabric. It bridges frames within the VLAN (via the bridging table) and routes packets between VLANs (via the routing table), enabling local inter-VLAN traffic without hair-pinning to an external router. This is exactly the required function: a Layer 3 gateway that is integrated with the VXLAN overlay, making IRB the correct answer.

Why this answer

In an EVPN-VXLAN fabric, Integrated Routing and Bridging (IRB) interfaces are required to provide inter-subnet routing. IRB interfaces act as Layer 3 gateways within the VXLAN overlay, enabling routing between different VLANs/VXLANs by terminating both the bridge domain and the routing instance. Without IRB, traffic cannot be routed between subnets in the EVPN-VXLAN fabric.

Exam trap

The trap here is that candidates often confuse VTEPs (which handle tunneling) with the routing function, mistakenly thinking that configuring a VTEP alone enables inter-subnet routing, when in fact an IRB interface is required to act as the Layer 3 gateway.

How to eliminate wrong answers

Option A is wrong because a physical interface with vlan-tagging is used for trunking multiple VLANs on a single physical port, but it does not provide Layer 3 routing between subnets in an EVPN-VXLAN fabric. Option B is wrong because a VXLAN tunnel endpoint (VTEP) is responsible for encapsulating and decapsulating VXLAN traffic, but it does not perform routing; routing requires a separate logical interface like IRB. Option D is wrong because a loopback interface is a virtual interface used for management, OSPF router ID, or BGP peering, but it cannot serve as a gateway for inter-subnet routing in the overlay.

Practice this question →
20
MCQmedium

A Juniper router is configured with two static routes to the same destination network, both with the same preference. One route has a metric of 5, the other a metric of 10. Which route will be installed in the routing table?

A.Neither route is installed because they conflict
B.The route with metric 5 is installed
C.The route with metric 10 is installed
D.Both routes are installed with equal preference
AnswerB

Lower metric is preferred when preference is equal.

Why this answer

In JUNOS, when multiple static routes to the same destination have the same preference (administrative distance), the route with the lower metric is selected for installation in the routing table. Here, metric 5 is lower than metric 10, so the route with metric 5 is installed. This behavior follows the standard route selection process where preference is evaluated first, then metric (also called cost or next-hop metric) as a tiebreaker.

Exam trap

The trap here is that candidates often confuse metric with preference or assume that both routes will be installed for load balancing, but JUNOS requires equal metrics (and equal preferences) for ECMP, not just equal preferences.

How to eliminate wrong answers

Option A is wrong because static routes to the same destination with different metrics do not conflict; JUNOS can select one based on metric when preference is equal. Option C is wrong because the route with metric 10 is not installed; the lower metric (5) is preferred, not the higher one. Option D is wrong because both routes are not installed with equal preference; only the best metric route is installed, and JUNOS does not install multiple equal-preference static routes to the same destination unless they have equal metrics (and even then, only one is typically active).

Practice this question →
21
MCQhard

You are a network engineer for a large enterprise deploying a new data center using a spine-and-leaf architecture with Juniper QFX5100 switches. The underlay network uses OSPF for loopback reachability, and the overlay uses EBGP for EVPN. The leaf switches are configured as VTEPs (Virtual Tunnel Endpoints). One of the leaf switches, leaf-03, cannot establish OSPF adjacency with its spine switch, spine-01. The interfaces are up/up and the IP addresses are correctly configured. 'show ospf neighbor' on leaf-03 returns nothing. 'show ospf interface' shows the interface is in state DOWN. Both switches are configured with the same OSPF area (0.0.0.0) and the same hello interval (10 seconds). The MTU on both sides is 1500. Authentication is not configured. The spine switch has multiple OSPF neighbors from other leaves. The network is in production and other leaf switches are working fine. What is the most likely cause of the problem?

A.The OSPF network type is not consistent between the two switches.
B.The interface MTU is misconfigured on one side.
C.OSPF is disabled on the interface at the leaf switch.
D.Duplicate router ID on leaf-03 and spine-01.
AnswerC

If OSPF is not enabled on the interface, the OSPF interface state will be down.

Why this answer

The OSPF interface is in state DOWN while the physical interface is up/up, indicating that OSPF is not enabled on that interface. This can happen if OSPF is explicitly disabled under protocol configuration or if the interface is not included in the OSPF configuration. Option A is wrong because network type mismatch would not cause the interface state to be DOWN; adjacency would fail but the interface would remain UP.

Option B is wrong because MTU issues would cause OSPF adjacency problems but the interface state would be UP (not DOWN). Option D is wrong because duplicate router IDs would affect all adjacencies, not just this one, and other leaves are working fine.

Practice this question →
22
MCQmedium

Refer to the exhibit. A host connected to ge-0/0/1 cannot reach a host connected to ge-0/0/2 even though both are in VLAN10. What is the most likely cause?

A.VLAN10 is not defined in the global VLAN configuration.
B.The hosts are configured with IP addresses on different subnets.
C.An IRB interface for VLAN10 is not configured.
D.The interface ge-0/0/2 is configured as a trunk port.
AnswerB

They can't communicate at Layer 2? Actually Layer 2 doesn't care about IP. So this is tricky. Actually within same VLAN, IP subnet must match for Layer 3, but Layer 2 should work. However if hosts are on different subnets, they need a router. But the question says 'cannot reach' - likely they try to ping. If on different subnets, they need default gateway. So the most likely cause is they are on different subnets and no gateway. Alternatively, the switch might have port security. But given typical JNCIA, this is plausible.

Why this answer

Although both hosts are in the same VLAN and can communicate at Layer 2 (MAC addresses), IP communication requires them to be on the same IP subnet. If the hosts have IP addresses on different subnets, they will attempt to use a default gateway for routing. Without a router or IRB interface configured, the traffic cannot be delivered, leading to unreachability.

Exam trap

The trap here is that candidates often assume VLAN membership alone guarantees IP connectivity, overlooking the fact that IP communication requires the hosts to be in the same IP subnet or have a router to forward traffic between subnets.

How to eliminate wrong answers

Option A is wrong because VLAN10 does not need to be globally defined in the VLAN configuration for it to function; VLANs can be created dynamically on trunk ports or by simply assigning interfaces to a VLAN ID. Option C is wrong because an IRB (Integrated Routing and Bridging) interface is only required for Layer 3 routing between VLANs or for the VLAN to have an IP address for management; hosts within the same VLAN can communicate at Layer 2 without any IRB. Option D is wrong because if ge-0/0/2 were configured as a trunk port, it could still carry VLAN10 traffic as long as VLAN10 is allowed on that trunk; the trunk configuration alone does not prevent communication between hosts in the same VLAN.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Networking Fundamentals questions.

Start 20-question session