Courseiva

CCNA Layer 2 Authentication And Access Control Questions

27 questions · Layer 2 Authentication And Access Control · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

Which THREE statements describe the behavior of critical authentication (fallback) when a RADIUS server becomes unreachable on an EX Series switch? (Choose three)

Select 3 answers
A.The switch moves authenticating clients into a designated critical VLAN or applies a critical profile.
B.The local switch user database is permanently deleted to save memory during server failure.
C.Critical authentication can be configured separately for 802.1X and MAC RADIUS authentication methods.
D.Clients that are already successfully authenticated are immediately disconnected and forced to re-authenticate.
E.The switch continues to probe the primary RADIUS servers at configured intervals to detect recovery.
AnswersA, C, E

When the RADIUS server is unreachable, the switch places newly authenticating supplicants into a designated critical VLAN or applies a critical profile, preserving network access rather than denying it. This satisfies the stem's fallback requirement, since critical authentication specifically handles server-unreachable conditions on EX Series switches.

Why this answer

Option A is correct because when critical authentication (fallback) is triggered by an unreachable RADIUS server, the EX Series switch places newly authenticating supplicants into a preconfigured critical VLAN (or applies a critical profile), granting limited access until the server is reachable again. Option C is correct because Juniper EX switches allow critical authentication to be configured independently for 802.1X and MAC RADIUS authentication, so each method can have its own critical VLAN/profile settings. Option E is correct because the switch periodically re-probes the primary RADIUS servers at configured intervals (via the server-reject/retry timers) so it can detect recovery and move clients back to normal authenticated state.

Option B is wrong because the local user database is never deleted during RADIUS failure; it is retained and used only if local authentication fallback is configured. Option D is wrong because already-authenticated clients are not immediately disconnected when the RADIUS server becomes unreachable; they remain authenticated until reauthentication or session timeout.

Practice this question →
2
MCQmedium

You are deploying 802.1X on an EX4300 access port facing a conference room. The security team wants to prevent a user from unplugging an authenticated IP phone and plugging in an unauthorized laptop on the same port. You configure MACsec on the port. Which statement describes the security benefit that MACsec provides in this scenario?

A.MACsec establishes a secure channel using MKA and only devices with valid keys can transmit or receive frames, preventing unauthorized device insertion.
B.MACsec enforces 802.1X authentication by redirecting unauthenticated devices to a captive portal before granting access.
C.MACsec encrypts all traffic on the link, but unauthenticated devices can still pass traffic if they present valid MAC addresses.
D.MACsec limits the number of MAC addresses learned on the port to one, blocking any additional devices.
AnswerA

MACsec uses the MACsec Key Agreement (MKA) protocol to negotiate secure associations and keys between the switch and an authenticated supplicant. Once MACsec is enabled on the port, only devices possessing the correct connectivity association key can encrypt and decrypt frames, so an unauthorized laptop cannot pass traffic even if it spoofs a MAC address.

Why this answer

MACsec on Juniper EX Series switches provides hop-by-hop encryption and integrity using the MACsec Key Agreement protocol. Only devices that possess the correct connectivity association key can participate in the secure channel, so an unauthorized laptop plugged into the port cannot send or receive traffic even if it spoofs a MAC address. This directly addresses the conference room threat of device substitution.

Exam trap

The trap here is assuming that MACsec alone performs authentication or redirection, when it actually secures the link only after a device has been authenticated and keyed.

Practice this question →
3
MCQeasy

Which statement is true regarding the behavior of the supplicant mode 'single' on an EX Series switch port?

A.Only one supplicant is allowed on the port; if a second device connects, it is blocked or unauthenticated.
B.It allows up to 256 MAC addresses to authenticate simultaneously via MAC RADIUS.
C.Multiple supplicants are allowed, but they must all share the same VLAN and credentials.
D.It enables multi-domain authentication for voice and data devices.
AnswerA

In single supplicant mode, the port permits only the first authenticated device; any second MAC address is denied access, remaining unauthenticated. This satisfies the stem's constraint by enforcing one-to-one authentication, unlike multiple mode which allows several hosts behind one port.

Why this answer

Single-supplicant mode allows only a single authenticated client on the port. If a hub or IP phone with a PC is connected, only one device passes authentication.

Practice this question →
4
MCQeasy

You are enabling 802.1X on an EX Series switch. You want to allow a PC that does not support 802.1X to access the network after a user opens a web browser and authenticates. Which feature should you configure on the switch?

A.Guest VLAN
B.RADIUS Change of Authorization (CoA)
C.Captive portal authentication
D.MAC RADIUS authentication
AnswerC

Captive portal authentication is designed for devices that do not support 802.1X. When such a device connects, the switch redirects its HTTP/HTTPS traffic to a web portal where the user can enter credentials. After successful authentication, the device is granted network access. This matches the scenario of a user opening a browser and authenticating.

Why this answer

Captive portal authentication is the correct feature for allowing non-802.1X devices to authenticate via a web browser. It redirects the user's HTTP traffic to a portal where they enter credentials. After successful authentication, the switch grants access.

This is ideal for guest users or devices without 802.1X supplicants.

Exam trap

The trap here is confusing guest VLAN with captive portal; guest VLAN provides access without authentication, while captive portal requires web-based login.

Practice this question →
5
MCQeasy

Which command allows an administrator to verify the active supplicant states and authentication status on a specific EX Series switch interface?

A.show ethernet-switching table dot1x
B.show access security clients
C.show radius-server authentication statistics
D.show dot1x interface
AnswerD

The 'show dot1x interface' command displays 802.1X supplicant state and authentication status per interface on EX Series switches. It directly satisfies the requirement to verify active supplicant states on a specific interface, unlike global dot1x commands that omit per-interface detail.

Why this answer

The 'show dot1x interface' command displays detailed information about 802.1X states on switch ports.

Practice this question →
6
MCQeasy

What is the default authentication order when authentication is enabled on an EX Series switch interface without explicit ordering configuration?

A.captive-portal
B.dot1x
C.local database
D.mac-radius
AnswerB

Correct. Dot1x is the default primary method when order is omitted.

Why this answer

By default, if authentication order is not specified, dot1x is evaluated first.

Practice this question →
7
Multi-Selectmedium

Which TWO actions occur when an 802.1X supplicant fails authentication and a guest VLAN is configured on the EX Series switch port? (Choose two)

Select 2 answers
A.The switch assigns the interface to the specified guest VLAN.
B.The client retains access to network resources restricted by the guest VLAN boundaries.
C.The switch sends a RADIUS accounting stop packet for the failed session.
D.The switch permanently disables the physical port until a manual reset is issued.
E.The supplicant is automatically migrated to the critical authentication server group.
AnswersA, B

On authentication failure, the port is moved into the configured guest VLAN, giving the supplicant restricted network access rather than dropping the connection entirely. This satisfies the stem's guest VLAN requirement, since the EX Series switch reassigns the interface to that VLAN and re-initiates authentication when the supplicant retries.

Why this answer

Option A is correct because on EX Series switches, when an 802.1X supplicant fails authentication and a guest VLAN is configured on the port, the switch places the interface into that guest VLAN, allowing limited access instead of blocking the port. Option B is correct because the client is then confined to the guest VLAN's Layer 2/Layer 3 boundaries, so it can reach only the resources permitted within that VLAN (typically Internet-only or remediation services) and nothing in the protected corporate VLANs. Option C is incorrect because a failed authentication does not generate a RADIUS accounting stop packet; accounting start/stop messages are tied to an authenticated session's lifecycle, not to a rejected supplicant.

Option D is incorrect because the port is not permanently disabled; it is dynamically moved to the guest VLAN, and the port remains enabled for future authentication attempts. Option E is incorrect because critical authentication (critical VLAN) applies when RADIUS servers are unreachable, not when a supplicant fails authentication, and there is no automatic migration to a 'critical authentication server group.'

Practice this question →
8
MCQhard

An EX4300 switch is configured with captive portal authentication. Unauthenticated users are successfully redirected when attempting HTTP traffic, but HTTPS traffic fails to redirect properly and instead shows a certificate warning or connection timeout in the user's browser. What is the fundamental reason for this behavior with standard captive portal implementations?

A.Standard captive portal redirects rely on intercepting unencrypted HTTP traffic; intercepting HTTPS without SSL proxy causes certificate mismatch errors.
B.HTTPS traffic is blocked by default firewall filters and is excluded from the captive portal bypass list.
C.The captive portal server only listens on TCP port 80 and drops all incoming TCP port 443 SYN packets.
D.The captive portal profile lacks a valid SSL certificate for HTTPS traffic decryption.
AnswerA

Captive portal interception works by hijacking plaintext HTTP requests and returning a redirect. HTTPS is encrypted end-to-end, so the switch cannot read or rewrite the request; presenting its own certificate triggers a mismatch warning or silent timeout in the browser.

Why this answer

Standard Layer 2 captive portal implementations intercept HTTP traffic via destination NAT or HTTP redirection. HTTPS traffic cannot be intercepted without a Man-in-the-Middle (MITM) proxy and SSL decryption because the TLS handshake fails due to certificate mismatch.

Practice this question →
9
Multi-Selectmedium

Which TWO statements are correct regarding the behavior and configuration of multi-supplicant mode on EX Series switches? (Choose two)

Select 2 answers
A.It restricts the port to operating exclusively as an access trunk port.
B.It requires all connected devices to use identical EAP methods and credentials.
C.Each authenticated client on the port can be placed into its own dynamic VLAN via RADIUS.
D.It is mutually exclusive with MAC RADIUS fallback configurations.
E.It allows multiple supplicants to authenticate independently on the same physical port.
AnswersC, E

In multi-supplicant mode, 802.1X authenticates each supplicant independently, and the RADIUS Access-Accept can return a VLAN attribute per client. The switch then assigns each authenticated client to its own dynamic VLAN on the same port.

Why this answer

Option E is correct because multi-supplicant mode on EX Series switches is specifically designed to allow multiple endpoints (supplicants) connected to the same physical interface to authenticate independently, each running its own 802.1X session rather than sharing a single port-based session. Option C is correct because in multi-supplicant mode each authenticated client can receive its own authorization attributes from RADIUS, including a dynamic VLAN assignment (typically via Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes), so clients on the same port can be placed into different VLANs. Option A is incorrect because multi-supplicant mode does not force the port into access trunk mode; the port remains an access port (or can be configured with other supported modes), and the statement misuses the term 'access trunk port.' Option B is incorrect because supplicants on the port are independent and may use different EAP methods and credentials; there is no requirement that they be identical.

Option D is incorrect because multi-supplicant mode is not mutually exclusive with MAC RADIUS fallback; MAC RADIUS authentication can be configured alongside 802.1X to handle devices that do not support supplicant software.

Practice this question →
10
MCQhard

An EX Series switch is configured with 802.1X and MAC RADIUS. A client device connects that does not support 802.1X. The switch attempts 802.1X, times out, and successfully falls back to MAC RADIUS. However, the administrator notices a significant delay (several seconds) before the MAC RADIUS request is sent to the server. What parameter should be tuned to reduce this delay?

A.Reduce the 'supp-timeout' and 'max-retries' parameters under the 802.1X interface configuration.
B.Increase the 'server-timeout' parameter in the access-profile configuration.
C.Disable EAPOL-start message generation on the switch port.
D.Enable fast-reauth under the system authentication options.
AnswerA

Reducing `supp-timeout` and `max-retries` shortens the 802.1X EAPOL retransmission window before fallback triggers. The delay stems from the switch waiting through the full supplicant timeout multiplied by retry count; lowering both parameters accelerates the transition to MAC RADIUS authentication for non-802.1X clients.

Why this answer

The delay occurs because the switch first attempts 802.1X authentication, which times out after a period determined by the 'supp-timeout' (supplicant timeout) and 'max-retries' parameters. These control how long the switch waits for an EAPOL response from the client and how many retries it sends before giving up and falling back to MAC RADIUS. Reducing these values shortens the 802.1X attempt phase, allowing the switch to move to MAC RADIUS faster.

Thus, tuning 'supp-timeout' and 'max-retries' directly addresses the observed delay.

Exam trap

JNCIP-ENT often tests the distinction between timers in the 802.1X authentication process, confusing supplicant timeout (client response) with server timeout (RADIUS response) or other features like fast-reauth.

How to eliminate wrong answers

Option B is wrong because 'server-timeout' in the access-profile controls how long the switch waits for a response from the RADIUS server after sending a request, not the initial 802.1X supplicant timeout; increasing it would worsen delays if the server is slow, but here the delay is before the MAC RADIUS request is sent. Option C is wrong because disabling EAPOL-start would prevent the switch from initiating 802.1X, potentially skipping the fallback mechanism or causing other issues; it does not tune the timeout. Option D is wrong because fast-reauth is for expediting re-authentication of already authenticated clients, not for reducing the initial fallback delay from 802.1X to MAC RADIUS.

Practice this question →
11
MCQmedium

You are troubleshooting an EX Series switch where 802.1X authentication is failing for all users. The RADIUS server is reachable and the shared secret matches. Users report that authentication never completes and the switch logs show EAPOL exchanges starting but no Access-Request being sent. Which Junos command should you use to view the current 802.1X authentication state and counters on the interface?

A.show interfaces ge-0/0/10 extensive
B.show network-access aaa statistics radius
C.show ethernet-switching table
D.show dot1x interface ge-0/0/10 detail
AnswerD

This operational command displays the 802.1X authenticator state for the interface, including EAPOL counters, the current role, and whether the port is in authenticated or held state. It helps determine whether the switch is sending EAPOL frames and waiting for supplicant responses, which matches the symptom of EAPOL starting but no RADIUS request being generated.

Why this answer

When EAPOL exchanges begin but no RADIUS Access-Request is generated, the issue lies in the authenticator-supplicant interaction rather than the RADIUS path. The 802.1X operational command for an interface provides EAPOL counters and state, revealing whether the switch is waiting for a supplicant response or has transitioned to an authenticated or held state. This directly addresses the observed symptom.

Exam trap

The trap here is reaching for RADIUS statistics commands when the failure occurs before any RADIUS request is sent, so the RADIUS counters would be empty and unhelpful.

Practice this question →
12
MCQmedium

You are configuring an EX Series switch to authenticate users via 802.1X. The RADIUS server returns a Filter-Id attribute of 'student-acl' in the Access-Accept. You want the switch to apply a firewall filter named 'student-acl' to the authenticated user's traffic. Which configuration is required on the switch?

A.Define a firewall filter named student-acl and reference it under the 802.1X authenticator interface configuration
B.Enable MAC RADIUS authentication and rely on the Filter-Id returned for the MAC address
C.Create a CoA client configuration to push the filter to the switch
D.Configure a static MAC address entry for the user and bind the filter to that entry
AnswerA

For the switch to apply a filter based on the RADIUS Filter-Id attribute, the filter must exist in the Junos configuration and be associated with the 802.1X authentication process. The authenticator interface configuration or access profile must reference the filter, allowing the switch to map the returned Filter-Id to the locally defined filter and apply it to the supplicant's traffic.

Why this answer

When RADIUS returns a Filter-Id, the switch must have a corresponding firewall filter defined locally and must be configured to apply it to the authenticated session. This is done by referencing the filter in the 802.1X authenticator interface configuration or access profile, enabling dynamic application based on the RADIUS response. Static MAC binding and CoA are not required for this initial assignment.

Exam trap

The trap here is thinking that CoA is needed to apply a Filter-Id, when the filter is applied during the initial authentication based on the Access-Accept if the filter is locally defined and referenced.

Practice this question →
13
MCQeasy

What is the primary function of the RADIUS server attribute 'Tunnel-Medium-Type' (Attribute 65) when received during an 802.1X authentication exchange on an EX Series switch?

A.It defines the VLAN ID or VLAN name to which the authenticated client port should be dynamically assigned.
B.It determines the encryption cipher used between the switch and the RADIUS server.
C.It specifies the physical transport media type for the tunnel, such as 802 (Ethernet) for VLAN assignment.
D.It indicates the authentication protocol (PAP, CHAP, EAP) being used in the tunnel.
AnswerC

Tunnel-Medium-Type (Attribute 65) defines the link-layer transport of the tunnel, using values such as 802 for Ethernet, and must accompany Tunnel-Type and Tunnel-Private-Group-ID for dynamic VLAN assignment. On EX Series switches, this triple lets the RADIUS server direct the supplicant into the correct VLAN after 802.1X succeeds.

Why this answer

Tunnel-Medium-Type specifies the media type of the tunnel, which for VLAN assignments in Junos is typically set to 802 (Ethernet).

Practice this question →
14
MCQeasy

An enterprise network administrator needs to configure 802.1X authentication on EX Series switches. Which statement is correct regarding the default behavior of the supplicant timeout timer?

A.It dictates how long the switch waits before failing over to MAC RADIUS authentication.
B.It determines how long an authenticated client can remain idle before being disconnected.
C.It defines the duration the switch waits for an EAP-Request/Identity frame response before retransmitting.
D.It specifies the interval before the switch drops the entire RADIUS authentication session.
AnswerC

The supplicant timeout timer governs the interval the authenticator waits for an EAP-Response/Identity from the supplicant before retransmitting the EAP-Request/Identity. This satisfies the stem's constraint on default 802.1X timer behaviour, since the switch acts as authenticator and retransmits to the supplicant when no reply arrives.

Why this answer

In Junos 802.1X, the supplicant timeout timer defines how long the switch waits for a response to an EAP-Request/Identity frame before retransmitting it. This timer is part of the EAPOL handshake and ensures the switch does not wait indefinitely for a supplicant that is slow or unresponsive. It is not related to MAC RADIUS failover, idle disconnect, or RADIUS session teardown.

Exam trap

The trap is confusing the supplicant timeout with other 802.1X timers like idle-timeout, reauthentication, or RADIUS dead-time — candidates must know that supplicant timeout specifically governs EAP-Request/Identity retransmission.

How to eliminate wrong answers

Option A is wrong because failover to MAC RADIUS is controlled by the 'mac-radius' configuration and fallback timers, not the supplicant timeout. Option B is wrong because idle disconnect is governed by the 'idle-timeout' or session timeout, not the supplicant timeout. Option D is wrong because dropping the RADIUS session is controlled by RADIUS dead timers and reauthentication intervals, not the supplicant timeout.

Practice this question →
15
Multi-Selectmedium

Which TWO statements are correct regarding captive portal redirection behavior on EX Series switches? (Choose two)

Select 2 answers
A.Clients can be granted pre-authentication access to specific IP addresses using a walled garden or bypass list.
B.Captive portal redirection requires the client to run a proprietary Juniper client software agent.
C.HTTPS traffic is automatically decrypted and redirected without client browser certificate errors.
D.Unauthenticated HTTP traffic is intercepted and redirected to the captive portal login URL.
E.Redirection is achieved by modifying the client's local operating system registry settings via DHCP.
AnswersA, D

A walled garden or bypass list lets unauthenticated clients reach specified IP addresses before captive portal authentication completes, satisfying the requirement for pre-authentication access to permitted resources. Traffic to all other destinations remains intercepted and redirected to the portal, so granular exceptions are enforced without granting full network access prematurely.

Why this answer

Option A is correct because EX Series captive portal supports a walled garden (bypass list) that allows unauthenticated clients to reach specific IP addresses or domains—such as DNS, DHCP, or authentication servers—before they log in. Option D is correct because the switch intercepts unauthenticated HTTP requests and redirects them to the captive portal login URL, which is the core mechanism of captive portal redirection. Option B is incorrect because captive portal authentication is browser-based and does not require any proprietary Juniper client agent.

Option C is incorrect because HTTPS traffic is not decrypted or redirected; certificate errors would occur if interception were attempted, so HTTPS is typically blocked or bypassed rather than transparently redirected. Option E is incorrect because redirection is performed by the switch intercepting HTTP traffic, not by modifying client OS registry settings via DHCP.

Practice this question →
16
MCQeasy

Which statement accurately describes the function of the 'server-timeout' setting within a Juniper access profile?

A.It determines the maximum duration a client session can remain active before forced re-authentication.
B.It defines how long the switch waits for a reply from the RADIUS server before failing over to the next server.
C.It dictates the interval at which the switch sends RADIUS accounting interim updates.
D.It specifies the idle timeout period for disconnected supplicants.
AnswerB

The server-timeout value sets the interval the switch waits for a RADIUS reply before declaring that server unresponsive and moving to the next configured server. This satisfies the failover requirement: a slow or dead RADIUS server cannot stall authentication indefinitely, because the switch retries the next server once the timeout expires.

Why this answer

The server-timeout setting determines how long the switch waits for a response from a RADIUS server before trying the next server in the server group.

Practice this question →
17
MCQmedium

You are configuring captive portal on an EX Series switch. Users must be redirected to an external web server for authentication. You have configured the captive portal profile with the redirect URL. However, users are not being redirected and can access the Internet without authentication. Which configuration issue is most likely?

A.The 'authentication-order' is set to 'radius' instead of ' captive-portal'.
B.The 'interface-mode' is set to trunk instead of access.
C.The captive portal profile is not applied to the interface.
D.The 'redirect-url' is not configured under the captive portal profile.
AnswerC

For captive portal to function, the captive portal profile must be applied to the interface using the 'captive-portal' statement under the interface configuration. Without this, the switch does not intercept HTTP requests or redirect users, allowing them to bypass authentication.

Why this answer

Captive portal requires the profile to be applied to the interface. Without this, the switch does not intercept HTTP traffic and redirect users to the authentication page. The redirect URL alone is insufficient; the profile must be bound to the interface to activate the feature.

Exam trap

The trap here is focusing on the redirect URL or authentication order, while overlooking that the captive portal profile must be explicitly applied to the interface to take effect.

Practice this question →
18
Multi-Selecthard

You are deploying 802.1X on an EX Series switch and want to ensure that when a supplicant fails authentication, it is placed into a VLAN that provides limited access to a remediation server. Which TWO Junos configuration elements are required to support this behavior? (Choose two.)

Select 2 answers
A.Configure the guest VLAN and ensure the interface is in multiple supplicant mode
B.Configure a guest VLAN under the 802.1X authenticator interface settings
C.Enable MAC RADIUS authentication as the primary method
D.Configure a VLAN that provides access to the remediation server and reference it as the guest VLAN
E.Configure the guest VLAN and set the authentication order to include 802.1X
AnswersB, D

The guest VLAN feature assigns unauthenticated or failed supplicants to a designated VLAN, providing limited network access. It is the mechanism that places failed clients into a restricted segment where they can reach remediation resources. Without configuring a guest VLAN, failed authentication typically results in the port being held or blocked without VLAN reassignment.

Why this answer

To place failed supplicants into a remediation VLAN, the switch must have a guest VLAN configured under the 802.1X interface settings, and that guest VLAN must correspond to an actual VLAN that provides the intended limited access. These two elements together enable the behavior; other settings such as MAC RADIUS or multiple supplicant mode are not required for guest VLAN assignment.

Exam trap

The trap here is assuming that enabling MAC RADIUS or multiple supplicant mode is necessary for guest VLAN behavior, when guest VLAN only requires the VLAN definition and its reference in the 802.1X configuration.

Practice this question →
19
Multi-Selectmedium

Which TWO options are valid configurable parameters under an access profile in Junos OS? (Choose two)

Select 2 answers
A.radius-server-group
B.virtual-router-instance
C.ethernet-switching-options
D.storm-control
E.accounting
AnswersA, E

Under a Junos access profile, radius-server-group binds the profile to a named RADIUS server group, satisfying the requirement for a configurable authentication parameter. The access profile references this group so 802.1X supplicants are authenticated against the specified RADIUS servers, making it a valid configurable option.

Why this answer

Option A (radius-server-group) is correct because an access profile in Junos OS can reference a RADIUS server group to authenticate users, configured with the set access profile <name> radius-server-group <group> statement. Option E (accounting) is correct because access profiles support accounting parameters such as accounting-order and accounting-stop-on-access-deny to control how user accounting records are generated. Option B (virtual-router-instance) is not a valid access profile parameter; it is a routing-instance type configured under routing-instances.

Option C (ethernet-switching-options) is a switching configuration hierarchy, not an access profile parameter. Option D (storm-control) is configured under ethernet-switching-options or interface hierarchies, not within an access profile.

Practice this question →
20
MCQeasy

Which RADIUS attribute is commonly used to assign a specific session timeout value to an 802.1X authenticated client on an EX Series switch?

A.Idle-Timeout (Attribute 28)
B.Tunnel-Client-End-Id (Attribute 66)
C.Termination-Action (Attribute 29)
D.Session-Timeout (Attribute 27)
AnswerD

Session-Timeout (Attribute 27) carries the maximum session duration in seconds, which the EX Series switch enforces by terminating the 802.1X client session once the value elapses. This directly satisfies the stem's requirement to assign a specific session timeout per authenticated client, rather than relying on switch-local defaults.

Why this answer

RADIUS Attribute 27 (Session-Timeout) specifies the maximum number of seconds of service to be provided to the user.

Practice this question →
21
MCQhard

You are deploying 802.1X on an EX Series switch. The security team requires that if the RADIUS server is unreachable during authentication, endpoints that were previously authenticated on a port must not lose network access, but new endpoints must be denied. Which action should you configure under the authenticator's interface to meet this requirement?

A.Configure the interface with the statement server-fail permit, which allows all traffic on the port when the RADIUS server is unreachable.
B.Configure the interface with the statement server-fail keep, which maintains existing authenticated sessions while denying new supplicants when the RADIUS server is unreachable.
C.Configure the interface with the statement server-reject-vlan, which places the port into a restricted VLAN when RADIUS rejects authentication.
D.Configure the interface with the statement mac-radius, which enables MAC RADIUS authentication as a fallback mechanism when the RADIUS server is unreachable.
AnswerB

server-fail keep is designed to maintain previously authenticated sessions on the port when the RADIUS server becomes unreachable. New supplicants are denied access because no authentication decision can be made. This exactly matches the security team's requirement of preserving existing access while blocking new endpoints during a RADIUS outage.

Why this answer

When the RADIUS server is unreachable, the switch must decide how to handle the port. The server-fail keep setting preserves already-authenticated sessions and rejects new authentication attempts, which aligns with the requirement to maintain existing access while denying new endpoints. Other server-fail options either permit all traffic or affect different failure conditions.

Exam trap

The trap here is confusing server-fail keep with server-fail permit, where permit allows all traffic including new unauthenticated endpoints during a RADIUS outage.

Practice this question →
22
Multi-Selecthard

Which THREE parameters must be configured when implementing captive portal on an EX Series switch? (Choose three)

Select 3 answers
A.A captive portal profile specifying redirection URLs and authentication parameters.
B.A global RADIUS accounting policy with interim-interval set to zero.
C.Interface or VLAN bindings linking the captive portal service to specific ports.
D.A static NAT pool for translating client IP addresses to the captive portal server IP.
E.An access profile defining the authentication server group.
AnswersA, C, E

A captive portal profile is mandatory because it defines the redirect URL, authentication parameters and session behaviour applied to unauthenticated clients. Without it, the switch has no policy to intercept HTTP requests and present the login page.

Why this answer

Option A is correct because a captive portal profile is the core configuration object that defines the redirection URL (the web page clients are sent to), the authentication parameters, and the associated access profile used to authenticate users. Option C is correct because the captive portal service must be bound to specific interfaces or VLANs so the switch knows which ingress traffic triggers the portal interception and redirection. Option E is correct because an access profile defines the authentication server group (RADIUS/LDAP) and the authentication order that the captive portal uses to validate user credentials.

Option B is incorrect because a global RADIUS accounting policy with interim-interval set to zero is not required for captive portal; accounting is optional and unrelated to portal redirection. Option D is incorrect because captive portal on EX Series switches does not require a static NAT pool to translate client IPs to the portal server IP; redirection is handled by the switch's captive portal mechanism, not NAT.

Practice this question →
23
MCQhard

An enterprise network uses 802.1X authentication with dynamic VLAN assignment on EX Series switches. A client authenticates, and the RADIUS server returns both a VLAN name and a set of dynamic firewall filter names via RADIUS attributes (Filter-Id). When the client connects, the VLAN assignment works perfectly, but the firewall filters are not applied to the interface. What is the most likely cause?

A.The dynamic filter must be defined inside the global access profile instead of being returned by RADIUS.
B.The named firewall filters were not pre-configured and committed locally on the EX Series switch.
C.RADIUS Filter-Id attributes are not supported on EX Series switches for dynamic firewall application.
D.Dynamic filter assignment requires MAC RADIUS and is not supported with 802.1X.
AnswerB

RADIUS Filter-Id attributes reference filter names, but Junos applies only filters already configured and committed locally. The VLAN name resolved because it existed; the missing filters were never defined on the switch, so nothing could be attached.

Why this answer

For dynamic Filter-Id attributes returned by RADIUS to be applied successfully on an EX Series switch, the named firewall filters must already be pre-configured and committed locally on the switch. If the filter does not exist locally, the application fails.

Practice this question →
24
MCQhard

You are configuring an EX Series switch to support 802.1X authentication with multiple supplicants on a single interface. A hub connects three devices to interface ge-0/0/5. You want each device to be authenticated individually and placed into its assigned VLAN. Which configuration is required to support this?

A.Enable 'single-secure' mode on the interface.
B.Enable 'multi-domain' authentication on the interface.
C.Enable 'MAC RADIUS' authentication on the interface.
D.Enable 'multiple supplicant' mode on the interface.
AnswerD

Multiple supplicant mode allows multiple devices on a single interface to be authenticated individually. Each device undergoes its own 802.1X authentication, and upon success, can be assigned to a specific VLAN via RADIUS attributes. This is exactly what is needed for a hub with three devices. The interface must be configured with 'supplicant multiple' under the 802.1X settings.

Why this answer

To support multiple devices on a single interface with individual 802.1X authentication, you must enable multiple supplicant mode. This allows each device to authenticate separately and receive its own VLAN assignment via RADIUS. Single-secure mode restricts to one device, and multi-domain is for voice and data pairs only.

Exam trap

The trap here is confusing multiple supplicant mode with multi-domain authentication, which only supports two devices (voice and data) on a port.

Practice this question →
25
MCQmedium

You are configuring a captive portal on an EX Series switch. You want to ensure that specific management traffic and critical server subnets are accessible to clients *before* they authenticate through the captive portal. Which configuration feature accomplishes this?

A.RADIUS dynamic authorization profiles with pre-auth attributes.
B.Captive portal firewall exemption filters or walled garden (bypass) configuration.
C.Global access profile authentication-bypass statements.
D.Static MAC bypass configuration under the protocols dot1x hierarchy.
AnswerB

Walled garden or firewall exemption filters let the switch permit pre-authentication traffic to specified destinations, such as DNS, DHCP and critical server subnets, while still forcing all other client traffic through the captive portal authentication process.

Why this answer

Pre-authentication access lists or firewall filters / bypass lists allow traffic to specific destinations before captive portal authentication occurs.

Practice this question →
26
MCQmedium

You are troubleshooting an issue where an 802.1X supplicant on a Windows client fails to connect to an EX Series switch port. The switch logs show 'EAPOL-TIMEOUT' errors. What does this error indicate?

A.The switch did not receive an EAPOL response from the client after sending an EAPOL request.
B.The RADIUS server took too long to validate the client credentials and dropped the session.
C.The switch port's operational mode reverted from access to trunk, dropping EAPOL frames.
D.The client sent an invalid EAP message that failed integrity checks.
AnswerA

EAPOL-TIMEOUT means the switch transmitted an EAPOL request (typically Identity or Request) to the supplicant and received no reply within the retransmission window, so the authenticator times out the session. It does not indicate a credential or RADIUS failure.

Why this answer

An EAPOL-TIMEOUT error indicates that the switch sent an EAPOL packet (such as EAPOL-Request/Identity) but did not receive a response from the client within the timeout window.

Practice this question →
27
Multi-Selectmedium

Which TWO options are valid authentication methods that can be specified in the 'authentication-order' statement on an EX Series switch interface? (Choose two)

Select 2 answers
A.mac-radius
B.kerberos
C.tacacs-plus
D.dot1x
E.ldap-direct
AnswersA, D

MAC-RADIUS combines MAC address authentication with RADIUS, letting the switch authenticate a device by its MAC before any 802.1X supplicant responds. This satisfies the stem's requirement for a valid authentication-order method, since Junos accepts mac-radius alongside dot1x, captive-portal and mac-radius-restrict on EX Series interfaces.

Why this answer

On Juniper EX Series switches, the 'authentication-order' statement under an interface (or globally) accepts authentication methods such as 'dot1x', 'mac-radius', and 'captive-portal'. Option D (dot1x) is correct because IEEE 802.1X is a supported access-control authentication method that can be listed in the authentication order to authenticate supplicants via an AAA server. Option A (mac-radius) is correct because MAC RADIUS authentication is also a supported method, allowing the switch to authenticate a device by its MAC address against a RADIUS server.

Option B (kerberos) is not a valid authentication-order method on EX switches, as Kerberos is not implemented as an interface authentication method there. Option C (tacacs-plus) is not valid because TACACS+ is an AAA protocol used for administrative login/authorization, not a client authentication method in the interface authentication-order list. Option E (ldap-direct) is not valid because EX switches do not support a direct LDAP authentication method in the authentication-order statement; LDAP would be reached through a RADIUS server instead.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Layer 2 Authentication And Access Control questions.

Start 20-question session