How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

JNCIP-ENT · topic practice

Scenario practice questions

Practise Juniper Networks Enterprise Routing and Switching, Professional (JNCIP-ENT, JN0-650) (JNCIP-ENT) Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

6 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

6 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Scenario explanation →

You are troubleshooting a scenario where multi-field classifiers and behavior aggregate classifiers are both configured on the same ingress interface. In what order does Junos process classification?

Trap 1: Junos rejects configurations where both BA and MF classifiers are…

Junos permits both classifier types on one interface and resolves them by precedence, so the configuration is accepted. It is tempting because some platforms restrict combining classifier types, but on Junos the documented behaviour is ordered evaluation, not rejection.

Trap 2: Both classifiers are executed simultaneously in hardware without…

Junos applies a defined precedence between the two classifier types rather than running them concurrently; hardware evaluates them in a fixed sequence. It is tempting because both classifiers do operate in hardware, but that shared execution plane does not mean simultaneous, order-independent processing.

Trap 3: Multi-field classification is evaluated first, followed by behavior…

Junos evaluates the behaviour aggregate classifier first, then the multi-field classifier, so this reverses the documented order. It is tempting because multi-field classifiers are more granular and appear logically prior, but granularity does not determine processing sequence on ingress.

Study all Scenario common traps →

A
Junos rejects configurations where both BA and MF classifiers are applied to the same interface
Why it fails: Junos permits both classifier types on one interface and resolves them by precedence, so the configuration is accepted. It is tempting because some platforms restrict combining classifier types, but on Junos the documented behaviour is ordered evaluation, not rejection.
B
Both classifiers are executed simultaneously in hardware without precedence
Why it fails: Junos applies a defined precedence between the two classifier types rather than running them concurrently; hardware evaluates them in a fixed sequence. It is tempting because both classifiers do operate in hardware, but that shared execution plane does not mean simultaneous, order-independent processing.
C
Behavior aggregate classification is evaluated first, and multi-field classification can override the result
Junos applies behaviour aggregate classifiers first, then multi-field classifiers, which can override the BA result. This ordering satisfies the stem's scenario of both classifier types on one ingress interface, letting MF classification take precedence for finer-grained matching.
D
Multi-field classification is evaluated first, followed by behavior aggregate classification
Why it fails: Junos evaluates the behaviour aggregate classifier first, then the multi-field classifier, so this reverses the documented order. It is tempting because multi-field classifiers are more granular and appear logically prior, but granularity does not determine processing sequence on ingress.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full VPN explanation →

You are deploying an EVPN-VXLAN fabric with a pair of Juniper EX Series switches acting as leaf devices for a dual-homed server. The server is connected to both leaf switches using a LAG with LACP, and you want to achieve All-Active multihoming so that both leaf switches can forward traffic to and from the server simultaneously. Which statement correctly describes the role of the Designated Forwarder (DF) in this scenario?

Trap 1: The DF election designates one leaf switch to handle all traffic…

This describes a standby model, not EVPN All-Active multihoming. In All-Active, both leaf switches actively forward known unicast traffic, and the DF only controls BUM traffic. The other switch is not on standby; it participates in forwarding. Therefore, this statement misrepresents the DF role.

Trap 2: The DF election is not required for All-Active multihoming because…

Without DF election, both leaf switches would forward BUM traffic, leading to duplicate packets and potential loops. The DF election is essential in All-Active multihoming to designate a single forwarder for BUM traffic. Thus, this statement is false; DF election is always required for multihomed Ethernet segments.

Trap 3: The DF election ensures that only one leaf switch is active for all…

This describes Single-Active multihoming, where only one PE forwards all traffic. In All-Active multihoming, both leaf switches can forward known unicast traffic, providing active-active forwarding. The DF only restricts BUM traffic, not known unicast. Therefore, this statement is incorrect for the All-Active scenario.

Study all Scenario common traps →

A
The DF election designates one leaf switch to handle all traffic for the server, while the other remains on standby until a failure occurs.
Why it fails: This describes a standby model, not EVPN All-Active multihoming. In All-Active, both leaf switches actively forward known unicast traffic, and the DF only controls BUM traffic. The other switch is not on standby; it participates in forwarding. Therefore, this statement misrepresents the DF role.
B
The DF election ensures that only one of the two leaf switches forwards broadcast, unknown unicast, and multicast (BUM) traffic to the server, while both can forward known unicast traffic.
In All-Active multihoming, the DF election per Ethernet segment ensures that only one PE (the DF) forwards BUM traffic to the multihomed device, preventing duplicate packets. However, known unicast traffic can be forwarded by any PE that has the MAC address in its EVPN table, allowing load balancing. This is the correct behavior for EVPN All-Active multihoming on Junos.
C
The DF election is not required for All-Active multihoming because both leaf switches can forward BUM traffic without causing duplicates.
Why it fails: Without DF election, both leaf switches would forward BUM traffic, leading to duplicate packets and potential loops. The DF election is essential in All-Active multihoming to designate a single forwarder for BUM traffic. Thus, this statement is false; DF election is always required for multihomed Ethernet segments.
D
The DF election ensures that only one leaf switch is active for all traffic types, including known unicast, to the server.
Why it fails: This describes Single-Active multihoming, where only one PE forwards all traffic. In All-Active multihoming, both leaf switches can forward known unicast traffic, providing active-active forwarding. The DF only restricts BUM traffic, not known unicast. Therefore, this statement is incorrect for the All-Active scenario.

Full breakdown with real-world context →

Question 3mediummultiple choice

Review the full OSPF breakdown →

You manage a Juniper Networks enterprise network using OSPF. Router R1 and Router R2 are connected via a point-to-point link. R1 is configured with the interface ge-0/0/0.0 in area 0 with a hello interval of 10 seconds and a dead interval of 40 seconds. R2 has the same interface in area 0 but with a hello interval of 30 seconds and a dead interval of 120 seconds. After configuration, the OSPF adjacency does not form. Which action will resolve the issue?

Trap 1: Change the OSPF router ID on R1 to be higher than R2's router ID.

Router ID is used for DR/BDR election on broadcast networks and for identifying the router in the OSPF domain. On a point-to-point link, there is no DR/BDR election, and router ID does not affect adjacency formation. The adjacency failure is caused by mismatched hello and dead intervals, not router IDs.

Trap 2: Change the network type on R1 to non-broadcast.

The network type affects how OSPF packets are sent (e.g., multicast vs. unicast) and whether DR/BDR election occurs. On a point-to-point link, the network type is typically p2p, and changing it to non-broadcast would not resolve the timer mismatch. The adjacency failure is due to timer mismatches, not network type.

Trap 3: Change the OSPF area on R1 to area 1.

OSPF areas must match for routers to form an adjacency on a given link. However, in this scenario, both routers are already in area 0, so changing the area on R1 would actually prevent the adjacency from forming. The issue is the mismatched hello and dead intervals, not the area ID.

Study all Scenario common traps →

A
Change the OSPF router ID on R1 to be higher than R2's router ID.
Why it fails: Router ID is used for DR/BDR election on broadcast networks and for identifying the router in the OSPF domain. On a point-to-point link, there is no DR/BDR election, and router ID does not affect adjacency formation. The adjacency failure is caused by mismatched hello and dead intervals, not router IDs.
B
Change the network type on R1 to non-broadcast.
Why it fails: The network type affects how OSPF packets are sent (e.g., multicast vs. unicast) and whether DR/BDR election occurs. On a point-to-point link, the network type is typically p2p, and changing it to non-broadcast would not resolve the timer mismatch. The adjacency failure is due to timer mismatches, not network type.
C
Change the OSPF area on R1 to area 1.
Why it fails: OSPF areas must match for routers to form an adjacency on a given link. However, in this scenario, both routers are already in area 0, so changing the area on R1 would actually prevent the adjacency from forming. The issue is the mismatched hello and dead intervals, not the area ID.
D
Change the hello interval on R1 to 30 seconds and the dead interval to 120 seconds.
OSPF requires that the hello and dead intervals match on both routers for an adjacency to form. In this scenario, R1 has hello 10 and dead 40, while R2 has hello 30 and dead 120. Changing R1 to match R2's timers will allow the routers to establish the adjacency. This is a common configuration requirement in OSPF.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full VPN explanation →

Which specific EVPN route type is responsible for carrying IP prefix routes, often used for inter-subnet forwarding in an IP-VRF-to-EVPN integration scenario?

Trap 1: Route Type 3

Route Type 3 carries Inclusive Multicast Ethernet Tag routes, which build the BUM flooding tree per EVI; it advertises no IP prefix information, so inter-subnet forwarding in an IP-VRF cannot rely on it. It is tempting because Type 3 is genuinely required for multicast and broadcast replication within an EVPN instance.

Trap 2: Route Type 2

Route Type 2 carries MAC/IP Advertisement routes for host addresses and their /32 or /128 host prefixes, not arbitrary subnet IP prefixes, so it cannot advertise the IP-VRF prefix routes inter-subnet forwarding requires. It is tempting because Type 2 does carry IP information, but only for individual hosts.

Trap 3: Route Type 1

Route Type 1 carries Ethernet Auto-Discovery routes used for fast convergence and aliasing, and advertises no IP prefix information whatsoever, so it cannot support inter-subnet forwarding in an IP-VRF. It is tempting because Type 1 is fundamental to EVPN multihoming, where it enables per-AC mass withdrawal.

Study all Scenario common traps →

A
Route Type 5
Route Type 5 carries IP prefix routes, enabling inter-subnet forwarding between IP-VRFs across the EVPN fabric. Unlike Types 2 and 3, which advertise MAC/IP and inclusive multicast respectively, Type 5 satisfies the stem's requirement for IP prefix reachability in an IP-VRF-to-EVPN integration.
B
Route Type 3
Why it fails: Route Type 3 carries Inclusive Multicast Ethernet Tag routes, which build the BUM flooding tree per EVI; it advertises no IP prefix information, so inter-subnet forwarding in an IP-VRF cannot rely on it. It is tempting because Type 3 is genuinely required for multicast and broadcast replication within an EVPN instance.
C
Route Type 2
Why it fails: Route Type 2 carries MAC/IP Advertisement routes for host addresses and their /32 or /128 host prefixes, not arbitrary subnet IP prefixes, so it cannot advertise the IP-VRF prefix routes inter-subnet forwarding requires. It is tempting because Type 2 does carry IP information, but only for individual hosts.
D
Route Type 1
Why it fails: Route Type 1 carries Ethernet Auto-Discovery routes used for fast convergence and aliasing, and advertises no IP prefix information whatsoever, so it cannot support inter-subnet forwarding in an IP-VRF. It is tempting because Type 1 is fundamental to EVPN multihoming, where it enables per-AC mass withdrawal.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Scenario explanation →

You are deploying 802.1X on an EX4300 access port facing a conference room. The security team wants to prevent a user from unplugging an authenticated IP phone and plugging in an unauthorized laptop on the same port. You configure MACsec on the port. Which statement describes the security benefit that MACsec provides in this scenario?

Trap 1: MACsec enforces 802.1X authentication by redirecting…

MACsec is a Layer 2 encryption and integrity protocol, not an authentication redirect mechanism. Captive portal and 802.1X handle authentication and redirection; MACsec protects the data plane after authentication. Enabling MACsec alone does not trigger a captive portal, so this option confuses two separate access control features and would not achieve the desired result.

Trap 2: MACsec encrypts all traffic on the link, but unauthenticated…

MACsec does not replace port-based authentication; it protects frames between directly connected MACsec-capable peers. An unauthenticated laptop without a valid secure association key cannot participate in the encrypted channel, so it cannot simply pass traffic by spoofing a MAC address. This option misstates the mechanism and would leave the port vulnerable to unauthorized device insertion.

Trap 3: MACsec limits the number of MAC addresses learned on the port to…

MACsec does not enforce MAC address limits; that is the role of port security features such as MAC limiting. MACsec ensures confidentiality and integrity of frames between authenticated peers. A laptop could still attempt to send frames, but without the correct keys it cannot join the secure channel. This option misidentifies the security control and would not prevent unauthorized access.

Study all Scenario common traps →

A
MACsec establishes a secure channel using MKA and only devices with valid keys can transmit or receive frames, preventing unauthorized device insertion.
MACsec uses the MACsec Key Agreement (MKA) protocol to negotiate secure associations and keys between the switch and an authenticated supplicant. Once MACsec is enabled on the port, only devices possessing the correct connectivity association key can encrypt and decrypt frames, so an unauthorized laptop cannot pass traffic even if it spoofs a MAC address.
B
MACsec enforces 802.1X authentication by redirecting unauthenticated devices to a captive portal before granting access.
Why it fails: MACsec is a Layer 2 encryption and integrity protocol, not an authentication redirect mechanism. Captive portal and 802.1X handle authentication and redirection; MACsec protects the data plane after authentication. Enabling MACsec alone does not trigger a captive portal, so this option confuses two separate access control features and would not achieve the desired result.
C
MACsec encrypts all traffic on the link, but unauthenticated devices can still pass traffic if they present valid MAC addresses.
Why it fails: MACsec does not replace port-based authentication; it protects frames between directly connected MACsec-capable peers. An unauthenticated laptop without a valid secure association key cannot participate in the encrypted channel, so it cannot simply pass traffic by spoofing a MAC address. This option misstates the mechanism and would leave the port vulnerable to unauthorized device insertion.
D
MACsec limits the number of MAC addresses learned on the port to one, blocking any additional devices.
Why it fails: MACsec does not enforce MAC address limits; that is the role of port security features such as MAC limiting. MACsec ensures confidentiality and integrity of frames between authenticated peers. A laptop could still attempt to send frames, but without the correct keys it cannot join the secure channel. This option misidentifies the security control and would not prevent unauthorized access.

Full breakdown with real-world context →

Question 6mediummultiple choice

Review the full routing breakdown →

You are configuring Class of Service on an MX Series router. You want to ensure that the best-effort forwarding class receives at least 10 Mbps of bandwidth during congestion on a 1 Gbps interface, but you also want to allow it to use additional bandwidth if other queues are idle. Which scheduler configuration should you apply?

Trap 1: transmit-rate percent 1;

Configuring transmit-rate percent 1 allocates 1% of the interface bandwidth, which equals 10 Mbps on a 1 Gbps interface. However, percent-based rates are relative to the interface speed and do not provide the flexibility to burst beyond the guaranteed rate when other queues are idle. This configuration would strictly limit the queue to 10 Mbps, which is not the desired behavior.

Trap 2: transmit-rate remainder;

Transmit-rate remainder assigns the remaining bandwidth after all other queues have been serviced to their configured rates. It does not guarantee a specific minimum of 10 Mbps for the best-effort queue. This configuration is typically used for low-priority queues and does not ensure the required minimum rate.

Trap 3: shaping-rate 10m;

Shaping-rate 10m limits the maximum bandwidth of the queue to 10 Mbps, which prevents the queue from using additional bandwidth when other queues are idle. This does not meet the requirement of allowing the queue to burst above 10 Mbps during periods of low congestion. Shaping is used to cap the rate, not to guarantee a minimum.

Study all Scenario common traps →

A
transmit-rate percent 1;
Why it fails: Configuring transmit-rate percent 1 allocates 1% of the interface bandwidth, which equals 10 Mbps on a 1 Gbps interface. However, percent-based rates are relative to the interface speed and do not provide the flexibility to burst beyond the guaranteed rate when other queues are idle. This configuration would strictly limit the queue to 10 Mbps, which is not the desired behavior.
B
transmit-rate remainder;
Why it fails: Transmit-rate remainder assigns the remaining bandwidth after all other queues have been serviced to their configured rates. It does not guarantee a specific minimum of 10 Mbps for the best-effort queue. This configuration is typically used for low-priority queues and does not ensure the required minimum rate.
C
transmit-rate 10m;
The transmit-rate 10m configuration sets a guaranteed minimum bandwidth of 10 Mbps for the best-effort queue. When other queues are idle, the scheduler allows this queue to use additional bandwidth up to the interface capacity or the shaping rate, satisfying the requirement to allow bursting. This is the correct way to provide a guaranteed rate with excess sharing.
D
shaping-rate 10m;
Why it fails: Shaping-rate 10m limits the maximum bandwidth of the queue to 10 Mbps, which prevents the queue from using additional bandwidth when other queues are idle. This does not meet the requirement of allowing the queue to burst above 10 Mbps during periods of low congestion. Shaping is used to cap the rate, not to guarantee a minimum.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed JNCIP-ENT session

Frequently asked questions

What does the JNCIP-ENT exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other JNCIP-ENT topics?: Use the topic links above to move to related areas, or go back to the JNCIP-ENT question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the JNCIP-ENT exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed JNCIP-ENT session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All JNCIP-ENT questions Scenario domain overview JNCIP-ENT exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

You are troubleshooting a scenario where multi-field classifiers and behavior aggregate classifiers are both configured on the same ingress interface. In what order does Junos process classification?

Which specific EVPN route type is responsible for carrying IP prefix routes, often used for inter-subnet forwarding in an IP-VRF-to-EVPN integration scenario?

Track your progress over time

Start a Scenario only practice session

Related JNCIP-ENT topic practice pages

Ethernet Switching And Spanning Tree practice questions

BGP Advanced practice questions

EVPN practice questions

Class OF Service practice questions

IP Telephony Features practice questions

Interior Gateway Protocols practice questions

Layer 2 Authentication And Access Control practice questions

IP Multicast practice questions

JNCIP-ENT fundamentals practice questions

JNCIP-ENT scenario practice questions

JNCIP-ENT troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid