32 questions · Ethernet Switching And Spanning Tree topic · All types, answers revealed
In a private VLAN, isolated ports can communicate only with promiscuous ports, not with each other. Assigning customer ports to the isolated VLAN enforces host isolation while still allowing traffic through the shared promiscuous gateway.
Why this answer
Isolated VLAN ports can only communicate with promiscuous ports.
You are configuring MACsec (Media Access Control Security) on an EX Series switch interface to secure Layer 2 links between two enterprise buildings. Which requirement is mandatory for MACsec to establish a secure session successfully between the two switches?
MACsec uses the Connectivity Association Key to authenticate peers and derive session keys, and both ends must negotiate the same cipher suite. Mismatched keys or ciphers cause the secure association to fail, so identical CAKs and matching suites are mandatory.
Why this answer
MACsec requires pre-shared keys (PSK) or MKA (MACsec Key Agreement) with matching connectivity association keys (CAK) and cipher suites.
You want to configure voice VLAN functionality on a Juniper EX switch so that IP phones automatically place voice traffic into VLAN 50 while passing PC data through unchanged. Which feature should you configure?
LLDP-MED provides network policy advertisement, allowing IP phones to discover the voice VLAN.
Why this answer
Voice VLAN feature on EX switches automatically assigns voice traffic from known MAC OUIs to the designated voice VLAN.
You are configuring Ethernet switching on an EX4300 switch and need to implement storm control to prevent broadcast, multicast, and unknown unicast traffic from overwhelming access links. Where is storm-control applied in the Junos configuration hierarchy?
Storm control is configured under the ethernet-switching family at the unit level, applying thresholds per logical interface. This placement lets the EX4300 rate-limit broadcast, multicast, and unknown unicast flooding on the access port before it overwhelms the link.
Why this answer
Storm control is applied under 'interfaces <interface-name> unit 0 family ethernet-switching storm-control'.
Which TWO operational commands are valid for troubleshooting VSTP on Juniper EX switches? (Choose two)
Displays VSTP status per VLAN.
Why this answer
show vstp and show vstp vlan are valid operational commands for VSTP.
An engineer is deploying VSTP (VLAN Spanning Tree Protocol) on a Juniper EX Series switch in a network that also includes RSTP bridges. The engineer wants to ensure that VSTP BPDUs are properly handled and that the network converges quickly. Which statement about VSTP operation is correct?
VSTP is an enhancement of RSTP that runs per VLAN. It uses RSTP BPDU format but tags them with VLAN information, allowing interoperability with RSTP bridges. When a VSTP switch connects to an RSTP bridge, it can fall back to sending standard RSTP BPDUs for the native VLAN or use VLAN-tagged BPDUs. This compatibility ensures smooth integration in mixed environments, which is the correct behavior.
Why this answer
VSTP runs a separate spanning-tree instance for each VLAN, using RSTP BPDU format. It can interoperate with RSTP bridges by sending standard RSTP BPDUs on a per-VLAN basis, often using 802.1Q tags to identify the VLAN. This allows a VSTP-enabled switch to participate in an RSTP network while maintaining per-VLAN topologies.
The correct statement highlights this interoperability, which is essential for mixed-vendor or mixed-protocol environments.
You are configuring RSTP on a Juniper EX Series switch. You need to ensure that the switch can quickly converge in case of a link failure. Which two statements are correct about RSTP edge ports and their configuration? (Choose two.)
This command correctly configures an interface as an RSTP edge port. Edge ports are connected to end devices and do not receive BPDUs. They transition directly to forwarding state, bypassing the listening and learning states, which speeds up convergence when a device is connected.
Why this answer
RSTP edge ports are configured per interface with the 'edge' keyword. They transition immediately to forwarding, improving convergence for end devices. If an edge port receives a BPDU, it loses its edge status and becomes a normal RSTP port, ensuring loop prevention.
These behaviors are key to RSTP's fast convergence and network stability.
Exam trap
The trap here is assuming edge ports are enabled by default or can be configured globally; they must be explicitly set per interface, and they lose edge status upon receiving a BPDU.
In a Juniper Virtual Chassis scaling deployment comprising 10 EX4600 switches, how are control and management planes structured across member switches to maintain high availability and failover resilience?
In a Virtual Chassis, two members are elected as Master and Backup Routing Engines, running the control and management planes, while the remaining eight switches operate as line cards forwarding traffic. This centralised RE model provides the failover resilience required.
Why this answer
A Virtual Chassis designates a Routing Engine (RE) Master and Backup across designated members, while all switches participate in the distributed forwarding plane.
You are configuring MAC limiting on an EX Series switch interface to restrict the maximum number of learned MAC addresses to 10. What happens when the 11th unique MAC address attempts to communicate through the interface?
Exceeding the MAC limit triggers the configured action, typically dropping new source MACs and logging.
Why this answer
By default, MAC limit drop or log actions occur. The standard configurable action when a limit is exceeded includes dropping the packet or shutting down the port.
You are deploying a Juniper EX Series switch as an access layer device in a campus network. The uplink port ge-0/0/1 connects to a distribution switch and is expected to carry traffic for VLANs 10, 20, and 30. You want to prevent the access switch from becoming the root bridge for any of these VLANs and ensure that the uplink is preferred for forwarding. Which configuration should you apply on the access switch?
Setting a high bridge priority (61440) ensures the access switch will not become the root bridge for any VLAN. Configuring the uplink port with a lower path cost makes it the preferred path for forwarding traffic toward the distribution switch. This combination achieves both goals: preventing the access switch from becoming root and ensuring the uplink is used for forwarding.
Why this answer
To prevent the access switch from becoming the root bridge, a high bridge priority such as 61440 is appropriate. To ensure the uplink is preferred for forwarding, a lower path cost on that port is necessary. Together, these settings control both root bridge election and path selection, aligning with best practices for access layer switches in a campus network.
Exam trap
The trap here is assuming that a lower bridge priority is always better, when in fact a higher priority value makes a switch less likely to become the root bridge.
Which THREE features or protocols are used in Juniper enterprise switching environments to prevent Layer 2 bridging loops while avoiding traditional Spanning Tree blocking ports? (Choose three)
Virtual Chassis collapses multiple switches into one logical device with a single control plane, so inter-member links are treated as internal fabric rather than bridged segments. Loop-free forwarding is achieved without Spanning Tree blocking any port.
An administrator implements MSTP (Multiple Spanning Tree Protocol) in a large data center using Juniper switches. Region boundaries must be maintained strictly. Which three parameters must match identically across all switches for them to be considered part of the same MST region?
MSTP region membership requires identical region name, revision number and VLAN-to-instance mapping on every switch. If any of these three parameters differs, the switch belongs to a separate region, so matching all three preserves the strict region boundaries the administrator needs.
Why this answer
MST region configuration requires identical configuration name, revision number, and VLAN-to-instance mapping table.
You are implementing MSTP on a network of Juniper EX Series switches. You need to ensure that the MSTP region is correctly configured and that VLANs are mapped to the appropriate MSTIs. Which two statements are correct about MSTP configuration on Juniper EX switches? (Choose two.)
For switches to be in the same MSTP region, they must have the same region name, revision level, and VLAN-to-MSTI mapping. If the region name differs, the switches will consider themselves in different regions and will not form a single MSTP region, potentially causing loops or suboptimal paths. Therefore, ensuring identical region names is critical for proper MSTP operation.
Why this answer
For MSTP to function correctly, all switches in a region must share the same region name, revision level, and VLAN-to-MSTI mapping. These parameters form the MSTP region identifier. If any of these differ, the switches will not form a single region, leading to potential network issues.
The other statements are incorrect: revision level must be identical, MSTI roots can differ from the CIST root, and while MSTP and VSTP are mutually exclusive, that is not a configuration statement per se.
Exam trap
The trap here is assuming that MSTP region parameters can be partially mismatched, such as different revision levels, while still forming a region, but all three must match exactly.
Which TWO parameters are part of the standard MSTP configuration digest computed across switches in an MST region? (Choose two)
The MSTP configuration digest is a hash of the region's configuration attributes, and the MST configuration name is one of the three hashed parameters. Switches must share identical values for these parameters to belong to the same MST region.
Why this answer
The MST configuration digest includes region name, revision number, and the VLAN-to-instance allocation table.
You are configuring a Juniper EX Series switch to prevent loops in a VSTP environment. An access port connected to an end-user device is receiving BPDUs from an unauthorized switch. You want to automatically disable the port if BPDUs are received. Which feature should you enable on the access port?
BPDU protection (also known as BPDU guard) is designed for edge ports that should not receive BPDUs. When enabled, if a BPDU is received on that port, the port is immediately disabled (err-disabled) to prevent loops. This is the correct feature for the scenario because it directly addresses unauthorized BPDUs on access ports and takes protective action.
Why this answer
BPDU protection is specifically designed to disable edge ports that receive BPDUs, preventing loops caused by unauthorized switches. When enabled on an access port, any BPDU received will cause the port to enter an err-disabled state. This is the standard best practice for end-user ports in a VSTP or RSTP environment.
Root protection and loop protection serve different purposes, and storm control does not address BPDU reception.
Exam trap
The trap here is confusing BPDU protection with root protection or loop protection, which have different behaviors and use cases.
Which TWO actions can be triggered when a MAC address limit is exceeded on a Juniper switch interface configured with MAC limiting? (Choose two)
Drop discards frames from additional MAC addresses once the configured limit is exceeded, while permitting existing learned addresses to continue forwarding. Juniper offers this as the less disruptive action compared with shutting the interface down.
Why this answer
Configurable actions on MAC limit violation include drop and log, or drop and shutdown (disable) the interface.
VSTP (VLAN Spanning Tree Protocol) is a Juniper feature that runs a separate RSTP instance for each VLAN. This provides per-VLAN spanning-tree topologies, allowing independent convergence and load balancing. It is the correct choice because it combines the rapid convergence of RSTP with per-VLAN instances, exactly matching the requirement.
Why this answer
VSTP is the Juniper implementation that runs RSTP per VLAN, providing a separate spanning-tree instance for each VLAN. This meets the requirement of per-VLAN instances with rapid convergence. RSTP and STP use a single instance for all VLANs, and MSTP maps multiple VLANs to a single instance, so they do not provide one instance per VLAN.
VSTP is the appropriate feature for this design.
Which TWO statements describe the behavior of VSTP (VLAN Spanning Tree Protocol) on Juniper EX Series switches? (Choose two)
VSTP maps each VLAN to a separate spanning-tree instance using IEEE 802.1Q BPDUs, and Juniper implements compatibility with Cisco's PVST+ so the two can share a topology. This interoperability lets EX Series switches participate in mixed-vendor Layer 2 networks.
Why this answer
VSTP runs an independent spanning tree instance per VLAN and interoperates with PVST+.
When configuring advanced Layer 2 tunneling (Q-in-Q) on Juniper EX Series switches, which THREE statements are correct regarding VLAN stacking behavior and limitations? (Choose three)
Because stacked tags add overhead (an extra 4 bytes per tag), core link MTU must be increased to prevent frame fragmentation or drops.
Why this answer
QinQ on Juniper EX switches involves specific encapsulation requirements like flexible-ethernet-services, stacking VLAN tags on ingress and popping on egress, and preserving inner customer VLAN tags transparently.
Voice VLAN allows the switch to automatically place voice traffic into a specified VLAN and apply a priority. Configuring the voice VLAN as 100 with priority 5 and data VLAN as 200 on the access port meets the requirement, as the phone will tag voice packets with the appropriate VLAN and priority.
Why this answer
The voice VLAN feature on Juniper EX Series switches enables automatic assignment of voice traffic to a specific VLAN and can set 802.1p priority. By configuring voice VLAN 100 with priority 5 and data VLAN 200, the switch will recognize VoIP traffic (via LLDP-MED or MAC address) and place it in the correct VLAN with the appropriate priority, ensuring QoS for voice.
Exam trap
The trap here is confusing voice VLAN with other VLAN features like private VLANs or Q-in-Q, which do not provide automatic voice traffic handling and prioritization.
An enterprise network engineer is designing a redundant Layer 2 topology with MSTP across Juniper EX switches. Two switches have identical bridge priorities and MAC addresses that result in a tie for regional root. How does MSTP deterministically break the tie to select the regional root bridge?
MSTP breaks an identical bridge-priority tie by comparing the bridge MAC address, and the numerically lowest value wins the regional root election. This satisfies the stem's constraint: two switches share equal priorities, so the deterministic lowest-MAC comparison elects one regional root and prevents a loop.
Why this answer
Spanning tree tie-breaking checks the bridge priority first, and if tied, compares the lowest MAC address of the switches.
When designing advanced enterprise campus VLAN architectures with Juniper EX Series switches, which TWO considerations are critical for large-scale Layer 2 domains? (Choose two)
Bridge assurance ensures that switches actively send BPDUs on all point-to-point operational ports, preventing loops caused by unidirectional link failures.
DHCP snooping designates trusted ports and filters rogue DHCP server replies, blocking an attacker from handing out a malicious default gateway. This directly prevents DHCP spoofing on Layer 2 access ports, satisfying the scenario's first requirement.
Why this answer
DHCP snooping and Dynamic ARP Inspection (DAI) prevent DHCP spoofing and ARP poisoning respectively.
You are configuring Q-in-Q tunneling on an MX Series router where customer frames arrive with VLAN tag 100, and you need to encapsulate them with a service provider outer VLAN tag 3000 using 'vlan-map'. Where is the VLAN map applied?
The vlan-map is applied at the logical interface unit level, where input and output maps rewrite or push VLAN tags. Configuring it there lets customer tag 100 be encapsulated with the outer service provider tag 3000, achieving Q-in-Q tunnelling on the MX Series.
Why this answer
VLAN maps or rewriting rules are applied on the logical interface (subinterface) inbound or outbound directions.
An enterprise network uses Q-in-Q tunneling over an MX Series provider network. Customer BPDUs must pass transparently across the provider core without being processed by the provider's own VSTP/MSTP instances. Which feature must be enabled on the provider switch access ports to achieve this?
L2PT encapsulates customer Layer 2 protocol frames, including BPDUs, and forwards them transparently across the provider core, so provider VSTP/MSTP instances never process them. This satisfies the requirement that customer BPDUs traverse the Q-in-Q tunnel untouched.
When configuring advanced Q-in-Q tunneling on Juniper MX Series routers, which THREE encapsulation or tagging parameters must be correctly aligned between the customer edge and provider edge interfaces? (Choose three)
VLAN action rules define whether the provider edge pushes, pops or swaps tags as frames traverse the tunnel. Aligning these operations on both sides preserves the customer's inner VLAN while adding the service tag, which is the core mechanism of Q-in-Q forwarding.
Why this answer
Q-in-Q alignment requires matching flexible-vlan-tagging, TPID values (EtherType), and VLAN tag preservation/manipulation rules.
An engineer is configuring a QinQ tunnel where the service provider bridge needs to transparently carry customer control traffic (like STP BPDUs) through the core without processing them. What feature must be enabled on the provider edge access ports?
L2PT encapsulates customer Layer 2 protocol frames, such as STP BPDUs, and forwards them across the provider core as data, preventing provider bridges from processing or blocking them. This preserves the customer's control-plane topology transparently through the QinQ tunnel.
Why this answer
Layer 2 Protocol Tunneling (L2PT) encapsulates customer BPDUs into specific multicast destination MAC addresses at the ingress edge, tunnels them across the provider core, and un-encapsulates them at the egress edge.
When configuring advanced VLAN mapping on a Juniper MX Series router using flexible VLAN tagging, which term describes the action of replacing an incoming inner VLAN tag with a new tag before forwarding into the provider core?
VLAN swap replaces the incoming inner VLAN tag with a different tag before the frame is forwarded into the provider core, preserving the outer tag. This matches the stem's description of substituting the inner tag, distinguishing it from push, pop, or translate operations on the MX Series.
Why this answer
VLAN translation or swapping replaces the incoming tag with a mapped tag.
An engineer is troubleshooting a large-scale enterprise network with multiple MSTP regions connected by a legacy RSTP region. How do boundary switches running MSTP interact with RSTP switches on shared segments?
MSTP boundary ports receive RSTP BPDUs and fall back to RSTP compatibility on that port only, allowing interworking with legacy RSTP switches on shared segments while preserving MSTP operation internally. Compatibility is per-port, not region-wide.
You are designing an enterprise network running Multiple Spanning Tree Protocol (MSTP) across multiple data center switches. To ensure that switches belong to the same MST region, which three parameters must match identically across all switches in that region?
Switches are in the same MST region only when their MST configuration identifier matches exactly: the region name, the revision number, and a digest of the full VLAN-to-instance mapping table, which is carried in BPDUs. One VLAN mapped differently, even an unused one, puts a switch in another region. On Junos, compare 'show spanning-tree mstp configuration' across switches, checking the name, revision and digest.
Why this answer
According to IEEE 802.1s, switches belong to the same MST region if and only if they share the exact same configuration name, revision number, and VLAN-to-instance mapping table.
You need to design a scalable Layer 2 architecture across multiple data center buildings using Juniper switches, avoiding single points of failure while preventing bridging loops. Which scaling mechanism allows Active-Active multihoming without running Spanning Tree Protocol across the core?
MC-LAG with ICCP lets two Juniper devices present one logical LAG to the access layer, giving Active-Active multihoming with no blocked links. ICCP synchronises state between peers, so the core needs no Spanning Tree Protocol to prevent loops.
Why this answer
MC-LAG (Multi-Chassis Link Aggregation Group) or EVPN-VXLAN provides active-active multihoming and eliminates spanning tree loops. Among traditional Layer 2 tools, MC-LAG is the direct multi-chassis active-active solution.
You are troubleshooting a Juniper EX Series switch running RSTP. The network experiences intermittent loops. You suspect that BPDU guard is not functioning as expected on an edge port. Which statement is correct about BPDU guard behavior on EX Series switches?
This is correct. BPDU guard, when enabled on an edge port, disables the port upon receiving a BPDU, placing it in err-disabled state. Junos OS supports automatic recovery from err-disabled state via the 'errdisable recovery' configuration, which can re-enable the port after a timeout.
Why this answer
BPDU guard protects the network by disabling a port that receives a BPDU, which should not happen on an edge port. On EX Series switches, the port goes into err-disabled state. Automatic recovery can be configured using 'errdisable recovery' commands, allowing the port to be re-enabled after a specified time.
This prevents loops while allowing recovery from transient misconfigurations.
Exam trap
The trap here is assuming BPDU guard permanently disables the port or is enabled by default; in reality, it must be configured and can be recovered automatically.
Ready to test yourself?
Try a timed practice session using only Ethernet Switching And Spanning Tree questions.