JNCIP-ENT Layer 2 Authentication And Access Control Practice Question
Which TWO conditions must be satisfied for an EX Series switch to successfully process a RADIUS Change of Authorization (CoA) request? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS server must be configured as a dynamic client or CoA must be enabled on the switch access profile.
RADIUS CoA requires the switch to have dynamic-clients or CoA enabled in the access profile/RADIUS server configuration, and the switch must share the correct pre-shared secret with the RADIUS server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The client must be actively running a captive portal browser session.
Why it's wrong here
Incorrect. CoA applies to 802.1X and MAC RADIUS sessions as well.
- ✓
The RADIUS server must be configured as a dynamic client or CoA must be enabled on the switch access profile.
Why this is correct
Correct. CoA requires explicit configuration to accept dynamic requests.
- ✗
RADIUS accounting must be disabled globally across the entire switch.
Why it's wrong here
Incorrect. Accounting has no bearing on CoA reception.
- ✗
The switch port must be configured in access trunk mode with static VLAN pinning.
Why it's wrong here
Incorrect. Port mode does not govern CoA processing.
- ✓
The pre-shared secret configured on the RADIUS server for CoA must match the shared secret configured on the switch.
Why this is correct
Correct. Shared secrets must match for message authentication.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
This JNCIP-ENT question is part of Courseiva's 336-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIP-ENT practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIP-ENT exam.