Hard Difficulty Questions

captive-portal-profile

Why wrong: Incorrect. Captive portal profiles are configured under access hierarchies, not dot1x.

radius-server-group

Why wrong: Incorrect. RADIUS server groups are configured under access-profile, not dot1x interface.

MAC address, revision number, and region name

Why wrong: Base MAC addresses are unique to each hardware device and never match.

Bridge priority, hello time, and max age

Why wrong: Timer and priority values can differ between switches within the same region.

Extended system ID, region name, and forward delay

Why wrong: Forward delay and timers are bridge-specific parameters, not region parameters.

Traffic exceeding 100% is dropped by the Routing Engine

Why wrong: Commit validation catches this before operational traffic handling.

Junos normalizes the percentages proportionally during commit time

Why wrong: Junos does not auto-normalize; it rejects oversubscribed percent allocations.

The excess 10% is automatically assigned to the best-effort queue

Why wrong: Automatic reassignment does not occur for invalid sums.

Behavior aggregate classifiers must be disabled on all egress interfaces

Why wrong: BA classifiers are on ingress and unrelated to priority scheduling.

Buffer sizes must be set to zero for all priority queues

Why wrong: Buffers are still required for bursts.

The scheduler must have a transmit-rate percentage of exactly 100%

Why wrong: transmit-rate is not required to be 100% for priority queues.

BGP Link-State (BGP-LS) topology databases.

Why wrong: BGP-LS is used for exporting topology information to controllers, not for internal next-hop resolution.

Multiprotocol Label Switching (MPLS) label imposition without routing table participation.

Why wrong: MPLS forwarding still requires routing table next-hop resolution or LDP/RSVP label bindings.

Address Resolution Protocol (ARP) directly against the BGP peer IP address.

Why wrong: ARP resolves IP addresses to MAC addresses for direct subnets, not indirect BGP next hops.

Junos rejects configurations where both BA and MF classifiers are applied to the same interface

Why wrong: Both can be applied simultaneously.

Both classifiers are executed simultaneously in hardware without precedence

Why wrong: There is a strict processing order.

Multi-field classification is evaluated first, followed by behavior aggregate classification

Why wrong: BA is evaluated first.

Drop profiles are configured under the forwarding-classes hierarchy

Why wrong: Drop profiles are configured under [edit class-of-service drop-profiles].

Drop profiles drop 100% of packets immediately once the queue fill level reaches the start point

Why wrong: Drop probability increases gradually, not instantly to 100% at the start point.

Drop profiles operate exclusively on Layer 2 control frames

Why wrong: Drop profiles apply to scheduled queues containing general IP/MPLS traffic.

During the initial import processing from EBGP peers before next-hop resolution.

Why wrong: This describes import policy processing, not outbound export prepending.

Before the best path is selected, affecting the local routing table calculation.

Why wrong: Export policies do not affect the local router's best path selection or routing table.

During the route selection algorithm right after MED comparison.

Why wrong: Selection algorithm runs independently of export policies.

Using the lowest MED value among the multipath entries for every packet transmission.

Why wrong: Multipath entries already have equal MEDs, and packet selection uses hashing.

Consulting the BGP Route Reflector cluster list to determine the optimal egress port.

Why wrong: Cluster lists are for loop prevention in route reflection, not packet forwarding hash selection.

Round-robin packet scheduling across all available BGP next hops regardless of flow headers.

Why wrong: Packet-by-packet round-robin causes out-of-order packet delivery and is not used for BGP multipath.

Junos compares MEDs from different ASs when the AS path lengths are completely identical.

Why wrong: Identical AS path length is part of standard tie-breaking, but cross-AS MED comparison still requires the explicit configuration knob.

Junos never compares MEDs from different ASs under any circumstance.

Why wrong: Cross-AS MED comparison is possible when 'always-compare-med' is configured.

Junos compares MEDs from different ASs automatically if the routes share the same IGP metric.

Why wrong: IGP metric does not automatically trigger cross-AS MED comparisons.

as-number:identifier

Why wrong: This is the format for standard BGP communities.

target:as-number:identifier

Why wrong: This is a typical format for BGP VPN route targets (extended communities).

ipv4-address:identifier

Why wrong: This format is used for certain types of extended communities (route origin or target).

Layer 4 classification requires an explicit forwarding-class map under system services

Why wrong: Forwarding classes are mapped directly in the firewall action.

Multi-field classifiers do not support TCP ports in Junos

Why wrong: Multi-field classifiers fully support TCP/UDP ports via firewall filters.

Layer 4 matching is only supported on ingress CoS rewrite rules

Why wrong: Rewrite rules are for egress remarking, not classification.

Confederations eliminate the need for any internal iBGP peering within the member sub-ASes.

Why wrong: Each member sub-AS still requires an iBGP mesh or its own route reflectors internally.

The next-hop IP address is always modified when routes are passed between member sub-ASes within the confederation.

Why wrong: By default, iBGP next-hop behavior is preserved across sub-AS boundaries unless explicitly altered with next-hop-self.

Local Preference is automatically reset to zero whenever a route crosses a sub-AS boundary inside a confederation.

Why wrong: Local Preference is propagated across sub-AS boundaries within a confederation just like standard iBGP.

Layer 2 Protocol Tunneling (L2PT) is automatically enabled for all protocols without additional configuration when QinQ is active.

Why wrong: L2PT must be explicitly configured on customer-facing access/tunnel ports to process and tunnel control traffic like BPDUs or CDP.

QinQ tunneling requires standard access mode encapsulation on all core-facing uplink ports.

Why wrong: Core-facing uplink ports typically use trunk mode encapsulation carrying the stacked provider VLANs.

rewrite-rule

Why wrong: rewrite-rule is configured under interface settings.

bandwidth-limit

Why wrong: bandwidth-limit is a policer parameter.

policer-action

Why wrong: policer-action belongs to firewall policers.

H-QoS eliminates the need for physical interface drop profiles

Why wrong: Drop profiles are still required within child queues.

H-QoS is configured exclusively under the system routing-options hierarchy

Why wrong: H-QoS configuration resides under class-of-service.

H-QoS requires disabling all hardware-based forwarding ASICs

Why wrong: H-QoS runs natively on MPC hardware ASICs.

set protocols ospf area 0.0.0.2 type-3-lsa-block

Why wrong: This command does not exist in Junos OS.

set protocols ospf area 0.0.0.2 stub lsa-filter block-type-3

Why wrong: This is not a valid Junos OSPF configuration statement.

set protocols ospf area 0.0.0.2 filter type-3-lsa

Why wrong: Junos does not use a direct 'filter type-3-lsa' command.

The switch with the highest interface count operational status wins.

Why wrong: Interface count does not influence root bridge selection.

The switch with the higher serial number stored in EEPROM is chosen.

Why wrong: Serial numbers are not part of the IEEE 802.1Q/802.1D bridge election algorithm.

MSTP triggers a randomized tie-breaker algorithm using the system uptime.

Why wrong: Root election is deterministic based on MAC address, never randomized.

Storm control broadcast filtering

Why wrong: Storm control filters traffic volume, not spanning tree states.

MACsec cryptographic validation

Why wrong: MACsec provides link encryption, not spanning tree topology protection.

You must apply an export policy on the ABR blocking Type-4 LSAs.

Why wrong: Area types manage LSA filtering natively; routing policies do not filter Type-4 LSAs directly.

You must use set protocols ospf suppress-fa to remove Type-4 LSAs.

Why wrong: Forwarding address suppression is unrelated to Type-4 LSAs.

You must configure set protocols ospf area <area> stub no-summary-asbr.

Why wrong: This command does not exist.