JNCIP-ENT Layer 2 Authentication And Access Control Practice Question
Which THREE attributes or conditions must be met for successful dynamic VLAN assignment via RADIUS during 802.1X authentication on Junos EX Series switches? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS server must return Tunnel-Type (Attribute 64), Tunnel-Medium-Type (Attribute 65), and Tunnel-Private-Group-ID (Attribute 81).
Dynamic VLAN assignment requires the VLAN to exist locally, the RADIUS server to return Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID, and the port to be capable of dynamic VLAN membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The supplicant must initiate EAP-TLS with mutual certificate validation.
Why it's wrong here
Incorrect. Any EAP method supported by the supplicant can trigger dynamic VLAN assignment.
- ✓
The RADIUS server must return Tunnel-Type (Attribute 64), Tunnel-Medium-Type (Attribute 65), and Tunnel-Private-Group-ID (Attribute 81).
Why this is correct
Correct. Standard tunneling attributes are required for VLAN assignment.
- ✓
The VLAN returned by the RADIUS server must already be configured locally on the EX Series switch.
Why this is correct
Correct. Local VLAN existence is mandatory.
- ✗
The RADIUS server must return the VLAN ID encoded inside a Vendor-Specific Attribute (VSA) using Cisco-AVPair format exclusively.
Why it's wrong here
Incorrect. Standard IETF tunneling attributes are standard across Junos.
- ✓
The switch port must be configured to allow dynamic VLANs or be configured as a trunk port capable of hosting the assigned VLAN.
Why this is correct
Correct. Port structure must accommodate the assigned VLAN.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
This JNCIP-ENT question is part of Courseiva's 336-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIP-ENT practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIP-ENT exam.