Layer 2 Authentication And Access Control practice questions

You enabled static MAC pinning on the access port, which disables fallback mechanisms.

Why it fails: Incorrect. MAC pinning does not prevent MAC RADIUS execution.

You omitted the mac-radius statement from the global protocols access-profile configuration.

Why it fails: Incorrect. Global profiles do not dictate authentication fallback order.

You configured the supplicant mode as single-supplicant instead of multi-supplicant.

Why it fails: Incorrect. Supplicant mode controls client counts per port, not fallback.

Under [edit system radius-server server-name] using the attribute-format option.

Why it fails: Incorrect. System radius-server parameters do not define MAC formatting.

Under [edit interfaces ge-0/0/1 unit 0 family ethernet-switching] using the mac-radius format command.

Why it fails: Incorrect. Interface level does not configure the string format of MAC RADIUS.

Under [edit access profile profile-name firewall] using the translation map.

Why it fails: Incorrect. Firewall hierarchies do not alter RADIUS request parameters.

Configure 'set access-profile captive-portal multiple-logins per-port'.

Why it fails: Incorrect. Captive portal profiles do not manage dot1x supplicant limits.

Set the port mode to trunk and enable voice-vlan stacking.

Why it fails: Incorrect. Trunk mode alone does not bypass supplicant limits.

Configure the interface with 'set protocols dot1x interface ge-0/0/1 mac-radius multiple-clients'.

Why it fails: Incorrect. This command does not exist in Junos OS.

The default gateway address specified in the captive portal profile is in a different routing instance.

Why it fails: A captive portal profile's default gateway address is used for portal reachability, not for routing authenticated user traffic between instances. It is tempting because routing instances do isolate traffic, but the restriction concerns post-authentication forwarding, which depends on the firewall filter and route entries, not the profile's gateway field.

The user's MAC address was not statically added to the bypass list of the captive portal profile.

Why it fails: Bypass lists exempt specific clients from authentication entirely; they do not grant network access after a successful login. It is tempting because bypass entries do affect captive portal behaviour, but the scenario describes authenticated users being blocked, which points to firewall filter or routing configuration rather than static MAC exemptions.

The captive portal profile lacks a defined redirect URL for the external network gateway.

Why it fails: The redirect URL only determines where unauthenticated users are sent; it plays no part in forwarding authenticated traffic. It is tempting because captive portal configuration centres on that URL, yet post-authentication access depends on firewall filter and routing entries permitting the user's traffic, not the portal page address.

The local fallback profile was not bound to the interface using the 'fallback-profile' command.

Why it fails: Incorrect. Local fallback uses the standard system authentication order.

The local database uses PAP, which strips VLAN assignment attributes from the authentication reply.

Why it fails: Incorrect. PAP vs CHAP does not govern Junos local attribute parsing.

RADIUS accounting was disabled, preventing local attribute synchronization.

Why it fails: Incorrect. Accounting does not affect authorization attributes.

clear ethernet-switching security-table interface ge-0/0/5

Why it fails: Incorrect. Ethernet-switching security tables are cleared via different options.

clear access client-profile ge-0/0/5

Why it fails: Incorrect. Access client-profile is not a valid clear command target.

clear mac-radius statistics interface ge-0/0/5

Why it fails: Incorrect. MAC-radius specific clear commands do not exist in this format.

Under [edit protocols dot1x captive-portal url].

Why it fails: Incorrect. Protocols dot1x does not house captive portal URL configurations.

Under [edit system services web-management captive-portal interface ge-0/0/1 redirect-url].

Why it fails: Incorrect. Web management is for switch management, not user captive portal.

Under [edit forwarding-options captive-portal gateway].

Why it fails: Incorrect. Forwarding options do not configure portal URLs.

Under [edit access profile profile-name radius-options quarantine-vlan].

Why it fails: Incorrect. Access profiles do not configure failure VLANs directly.

Under [edit forwarding-options storm-control profile quarantine].

Why it fails: Incorrect. Storm control is unrelated to authentication failures.

Under [edit vlans quarantine-vlan captive-portal-binding].

Why it fails: Incorrect. Captive portal bindings are separate from MAC RADIUS failure actions.

The switch ignores the RADIUS attribute and keeps the port in its previous static configuration.

Why it fails: Incorrect. It does not silently ignore it; authorization fails or defaults.

The switch dynamically creates the VLAN on the fly using default IEEE 802.1Q parameters.

Why it fails: Incorrect. Junos does not dynamically create unconfigured VLANs via standard RADIUS attributes.

The switch queries the VTP/GVRP server to dynamically learn the VLAN definition.

Why it fails: Incorrect. Junos does not use VTP for dynamic VLAN creation.

[edit protocols dot1x accounting-options]

Why it fails: Incorrect. Dot1x protocol hierarchy does not contain accounting server bindings.

[edit system radius-server accounting]

Why it fails: Incorrect. System radius-server is for global RADIUS server definitions, not access profiles.

[edit access-control accounting-profile]

Why it fails: Incorrect. This is not a valid Junos hierarchy path.

Under [edit access-control interface ge-0/0/1 fallback-vlan].

Why it fails: Incorrect. Fallback-vlan is not the correct command syntax.

Under [edit access profile profile-name guest-vlan].

Why it fails: Incorrect. Access profiles do not map guest VLAN names.

Under [edit vlans vlan-name dot1x-guest-access].

Why it fails: Incorrect. VLAN hierarchies do not configure dot1x guest bindings.

Enable MAC-address translation (MAT) on the Ethernet switching table.

Why it fails: Incorrect. MAT is for Layer 2 packet header rewriting, not RADIUS usernames.

Configure the local user database to normalize MAC addresses automatically.

Why it fails: Incorrect. MAC RADIUS uses external RADIUS servers, not local user databases.

Configure a regex-based rewriting firewall filter on the interface facing the printers.

Why it fails: Incorrect. Firewall filters cannot dynamically rewrite RADIUS authentication packet payloads.

show system captive-portal sessions

Why it fails: Incorrect. This path is invalid.

show ethernet-switching captive-portal table

Why it fails: Incorrect. Ethernet-switching tables do not track captive portal sessions.

show dot1x captive-portal summary

Why it fails: Incorrect. Captive portal is not under protocols dot1x.

You must enable accounting globally using [edit system accounting radius].

Why it fails: Incorrect. Junos access control uses access profiles for RADIUS accounting.

You failed to enable accounting under the [edit protocols dot1x accounting] hierarchy.

Why it fails: Incorrect. Dot1x hierarchy does not handle accounting server bindings.

MAC RADIUS does not support accounting; accounting is exclusive to 802.1X.

Why it fails: Incorrect. MAC RADIUS fully supports accounting.

The supplicant must initiate EAP-TLS with mutual certificate validation.

Why it fails: Incorrect. Any EAP method supported by the supplicant can trigger dynamic VLAN assignment.

The RADIUS server must return the VLAN ID encoded inside a Vendor-Specific Attribute (VSA) using Cisco-AVPair format exclusively.

Why it fails: Incorrect. Standard IETF tunneling attributes are standard across Junos.

show access security clients

Why it fails: Incorrect. This is not a valid Junos command.

traceroute mac-address

Why it fails: Incorrect. Traceroute is for IP routing paths, not MAC RADIUS state checking.

captive-portal-profile

Why it fails: Incorrect. Captive portal profiles are configured under access hierarchies, not dot1x.

radius-server-group

Why it fails: Incorrect. RADIUS server groups are configured under access-profile, not dot1x interface.

The client must be actively running a captive portal browser session.

Why it fails: CoA is triggered by the RADIUS server, not by a browser session, so an active captive portal is irrelevant to processing the request. It is tempting because captive portals commonly use CoA to apply post-authentication policies, and would be correct only where portal-driven reauthorisation is genuinely in play.

RADIUS accounting must be disabled globally across the entire switch.

Why it fails: Accounting and CoA are independent RADIUS functions; disabling accounting removes session tracking that CoA relies on to identify the target session. Accounting is what you would disable only when auditing or billing data is unwanted, not to enable authorisation changes.

The switch port must be configured in access trunk mode with static VLAN pinning.

Why it fails: CoA processing depends on the RADIUS server and switch sharing a dynamic-authorisation configuration, not on port mode. Access trunk mode with static VLAN pinning actually prevents the dynamic VLAN reassignment that CoA delivers; it would suit fixed-port deployments where VLANs never change.

access-profile employee with radius-server 10.1.1.1 secret juniper

Why it fails: The access-profile statement is used to define RADIUS server parameters and authentication order, not to enforce a specific returned attribute value. It does not cause the switch to require Filter-Id=employee, so any successful RADIUS authentication would be accepted regardless of the returned filter.

authentication-profile employee-profile { radius { authentication-server 10.1.1.1; } } and on the interface: dot1x authenticator { }

Why it fails: This configuration only points the switch to a RADIUS server and enables 802.1X on the interface. It does not inspect the Filter-Id attribute or require a specific value. The switch would accept any Access-Accept, even if Filter-Id is absent or different.

authentication-profile employee-profile with radius-attribute filter-id employee

Why it fails: Junos does not support a radius-attribute filter-id statement inside an authentication-profile. Filter-Id enforcement is done by referencing the returned attribute value as a profile name that is mapped to an access profile or a filter. The syntax shown is invalid and would be rejected at commit.

The mac-radius restriction setting on the access interface

Why it fails: Mac-radius restriction controls whether MAC RADIUS authentication is permitted on the interface and whether it can fall back after 802.1X fails. It does not govern EAPOL retransmission timing, so it cannot reduce the 60-second wait for an 802.1X-capable supplicant. It is relevant to fallback behavior, not initial authentication latency.

The server-timeout value under the access profile

Why it fails: Server-timeout defines how long the switch waits for a response from the RADIUS server after sending an Access-Request. Since the scenario states the server responds in under one second, this timer is not the source of the 60-second delay. It governs RADIUS request waiting, not EAPOL probing of the supplicant.

The reauthentication interval configured on the authenticator interface

Why it fails: The reauthentication interval determines how often the switch re-verifies an already authenticated session, typically in seconds or via RADIUS Session-Timeout. It has no bearing on the initial EAPOL exchange delay observed when a client first connects. Adjusting it changes periodic revalidation, not the initial authentication startup time.