Knowledge + Practice

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 1–75

320 questions total · 5 pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 5

1

MCQmedium

You have an EX Series switch running RSTP. You want to configure a port connected to a printer to immediately transition to forwarding without going through the learning state. Which configuration statement should you use?

A.set protocols rstp interface ge-0/0/10 priority 0

B.set protocols rstp interface ge-0/0/10 cost 0

C.set protocols rstp interface ge-0/0/10 no-root-port

D.set protocols rstp interface ge-0/0/10 edge

AnswerD

The 'edge' configuration designates the port as an edge port, which means it connects to an end device and can immediately transition to forwarding upon link up, bypassing the learning state. This is ideal for a printer. In Junos, this is configured under the RSTP protocol hierarchy for the specific interface.

Why this answer

Configuring the port as an edge port with 'set protocols rstp interface ge-0/0/10 edge' allows it to bypass the learning state and immediately forward traffic when the link comes up. This is appropriate for devices like printers that do not participate in spanning tree. Other options do not achieve immediate transition and some are invalid commands.

Exam trap

The trap here is confusing port priority or cost with edge port configuration; only the edge setting enables immediate forwarding for end devices.

Full explanation →

2

MCQmedium

You are configuring VRRP on an EX4300 switch acting as the master for VLAN 100. You want the master to immediately relinquish its role if its uplink toward the core fails, so that the backup can take over without waiting for the default VRRP advertisement timer to expire. Which VRRP feature should you configure?

A.Authentication using a simple text password shared by the VRRP group

B.A shorter VRRP advertisement interval of 1 second on all group members

C.Interface tracking with a decrement value on the uplink interface

D.Preempt mode with a zero preemption hold time

AnswerC

Interface tracking monitors the state of a specified interface. When the tracked uplink goes down, the master reduces its priority by the configured decrement. If the resulting priority falls below the backup's, the backup preempts immediately, rather than waiting for advertisement timeouts. This is the standard Junos mechanism to trigger rapid VRRP failover based on an interface other than the VRRP interface itself.

Why this answer

Interface tracking ties the VRRP master's priority to the health of another interface, such as the uplink to the core. When that interface goes down, the priority is decremented; if it drops below the backup's priority, the backup immediately preempts. This produces fast, deterministic failover based on the actual failure condition instead of waiting for advertisement timeouts.

Exam trap

The trap here is assuming that shortening the advertisement interval or enabling preempt alone produces immediate uplink-triggered failover, when only interface tracking changes the master's priority in response to the uplink going down.

Full explanation →

3

MCQeasy

A network administrator is configuring IS-IS on a Juniper router. They want to ensure that the router participates in both Level 1 and Level 2 routing. Which configuration statement is correct?

A.By default, IS-IS is enabled for both Level 1 and Level 2 on Juniper routers.

B.set protocols isis level 1 disable; set protocols isis level 2 disable

C.set protocols isis level 2 disable

D.set protocols isis level 1 disable

AnswerA

On Juniper routers, when you enable IS-IS on an interface, the router operates as a Level 1/2 router by default, participating in both Level 1 and Level 2 routing. No additional configuration is needed to enable both levels. The 'level 1 disable' or 'level 2 disable' commands are used to restrict to a single level. Therefore, the correct answer is that both levels are enabled by default.

Why this answer

On Juniper routers, IS-IS is enabled for both Level 1 and Level 2 by default when you configure IS-IS on an interface. To restrict the router to a single level, you use the 'level 1 disable' or 'level 2 disable' commands. Since the requirement is to participate in both levels, no additional configuration is needed; the default behavior already satisfies the requirement.

Exam trap

The trap here is thinking that you must explicitly enable both levels; in reality, Juniper enables both by default, and you only need to disable one if you want single-level operation.

Full explanation →

4

Multi-Selecthard

When configuring a routing instance of type 'virtual-router', which THREE characteristics apply? (Choose three)

Select 3 answers

A.It requires MPLS label distribution protocols to function.

B.Interfaces can be assigned directly to the virtual-router instance.

C.It supports dynamic interior routing protocols like OSPF and IS-IS.

D.Route leaking between virtual-router and inet.0 is strictly prohibited by Junos architecture.

E.It maintains independent routing tables separate from inet.0.

AnswersB, C, E

Physical or logical interfaces are bound to the virtual-router instance under its interface stanza, so traffic entering them is resolved against that instance's tables. This satisfies the stem's requirement, unlike other instance types that cannot own interfaces directly.

Why this answer

Option B is correct because a virtual-router routing instance in Junos is a true separate routing domain, so you assign physical or logical interfaces directly to it (for example, with 'set routing-instances <name> interface ge-0/0/0.0'), and those interfaces then use the instance's own routing table. Option C is correct because a virtual-router instance runs its own routing protocol process and can run dynamic IGPs such as OSPF and IS-IS within that instance, independently of the master instance. Option E is correct because the defining feature of a virtual-router instance is that it maintains its own independent routing table (named <instance-name>.inet.0) that is separate from the main inet.0 table.

Option A is not required, since a virtual-router instance is a pure Layer 3 routing separation and does not need MPLS label distribution protocols such as LDP or RSVP to function. Option D is false because Junos does not strictly prohibit route leaking between a virtual-router instance and inet.0; routes can be exchanged using rib-groups or instance-import/instance-export policies, so the statement is technically inaccurate.

Exam trap

JNCIS-ENT often tests the distinction between virtual-router and VRF instances; candidates incorrectly assume virtual-router requires MPLS or that route leaking is impossible.

Full explanation →

5

Multi-Selectmedium

Which THREE parameters are included when calculating the MST region configuration digest? (Choose three.)

Select 3 answers

A.VLAN-to-instance mapping table

B.Configuration name

C.Root bridge MAC address

D.Bridge priority value

E.Revision number

AnswersA, B, E

The VLAN-to-instance mapping table forms part of the MST region configuration digest, since the digest must reflect exactly which VLANs each MSTI carries. Changing any VLAN-to-instance assignment alters the digest, causing neighbouring switches to treat the region as different and preventing them from sharing a common spanning-tree topology.

Why this answer

The MST region configuration digest is an MD5 hash computed over the region's configuration attributes, and it includes the VLAN-to-instance mapping table (A), the configuration name (B), and the revision number (E) — these three define the region's identity and ensure all switches agree on the same MST region. The VLAN-to-instance mapping (A) determines which VLANs belong to which MST instances, the configuration name (B) is the alphanumeric region identifier, and the revision number (E) is the 16-bit value that must match across all switches in the region. The root bridge MAC address (C) and bridge priority value (D) are not part of the digest; they are per-instance spanning-tree parameters used for root election and topology calculation, not region configuration attributes.

Exam trap

JNCIS-ENT often tests the misconception that bridge priority or MAC address affect the MST region digest — candidates confuse the digest parameters with the bridge ID fields used for root election.

Full explanation →

6

MCQeasy

An administrator wants to modify the Local Preference attribute for all routes received from a specific external BGP peer. Where must this policy be applied in Junos?

A.Import policy applied to the eBGP neighbor or group

B.Export policy applied to the eBGP group

C.Forwarding plane firewall filter

D.Global system-level static route policy

AnswerA

Local Preference is a well-known discretionary attribute evaluated during inbound processing, so an import policy bound to the eBGP neighbour or group modifies it before best-path selection. Export policy would affect the peer's decision, not the local router's.

Why this answer

Inbound routing policies on Junos affect attributes like Local Preference before path selection occurs.

Full explanation →

7

MCQmedium

An administrator is configuring a new point-to-point link between two Junos routers running IS-IS. By default, how does IS-IS handle adjacency establishment on a point-to-point link compared to a broadcast link?

A.It uses a 3-way handshake TLV in IIH packets and bypasses the DIS election process entirely.

B.It relies strictly on CSNPs sent every 10 seconds to establish the adjacency.

C.It requires manual mapping of neighbor system IDs using static ARP bindings.

D.It initiates a DIS election using priority values identical to broadcast segments.

AnswerA

On point-to-point links, IS-IS establishes adjacencies using the three-way handshake TLV carried in IIH PDUs, confirming bidirectional connectivity before the adjacency reaches Up. Because the link is point-to-point, no DIS election occurs — that process applies only to broadcast links, satisfying the stem's comparison of the two link types.

Why this answer

On point-to-point (P2P) IS-IS links, adjacency is established using a 3-way handshake via the Point-to-Point Three-Way Adjacency TLV (TLV 240) carried in IIH packets, which confirms bidirectional communication before the adjacency reaches Up state. Because there is no multi-access segment, there is no DIS election — that process only exists on broadcast (LAN) interfaces where a pseudonode is needed.

Exam trap

The trap here is confusing the roles of IIH, CSNP, and PSNP PDUs — candidates often assume CSNPs establish adjacencies, when in fact they only synchronize the LSDB after the adjacency is already Up.

How to eliminate wrong answers

Option B is wrong because CSNPs are used to synchronize the link-state database after adjacency formation, not to establish the adjacency itself, and they are not sent on a fixed 10-second timer for that purpose. Option C is wrong because IS-IS runs directly over the data link layer (CLNS/OSI) and does not use ARP or static neighbor mappings — that is an IPv4/Ethernet concept. Option D is wrong because DIS election only occurs on broadcast multi-access segments; P2P links have exactly two endpoints and therefore no DIS is elected.

Full explanation →

8

Multi-Selectmedium

Which TWO characteristics describe eBGP compared to iBGP? (Choose two)

Select 2 answers

A.Automatic route reflection enabled by default

B.Must reside within the same Autonomous System

C.Peers reside in different Autonomous Systems

D.Default TTL of 1

E.Default Local Preference of 200

AnswersC, D

eBGP sessions form between routers whose peers sit in different Autonomous Systems, with the AS number in the OPEN message differing. This contrasts with iBGP, where both peers belong to the same AS, satisfying the characteristic being tested.

Why this answer

Option C is correct because eBGP (External BGP) is specifically designed to exchange routing information between routers in different Autonomous Systems, whereas iBGP peers must be within the same AS. Option D is correct because eBGP sessions between directly connected external peers use a default IP TTL of 1 (multihop eBGP requires explicitly raising the TTL with the ebgp-multihop command), while iBGP sessions default to TTL 255. Option A is incorrect because route reflection is an iBGP mechanism (used to avoid the full-mesh requirement) and is not enabled by default on eBGP.

Option B is incorrect because residing within the same Autonomous System describes iBGP, not eBGP. Option E is incorrect because the default Local Preference in BGP is 100, not 200, and this value is not a distinguishing eBGP-versus-iBGP characteristic.

Full explanation →

9

Multi-Selecthard

An enterprise network design requires implementing private VLANs (PVLANs) on an EX Series switch. Which THREE components or port types are characteristic of a private VLAN architecture? (Choose three.)

Select 3 answers

A.Community ports that can communicate with other ports in the same community and promiscuous ports.

B.Isolated ports that can only communicate with promiscuous ports.

C.Promiscuous ports that can communicate with all ports across both primary and secondary VLANs.

D.Routing instance interfaces (RIB-only) that automatically disable Layer 2 bridging.

E.Fully meshed trunk ports that bypass all isolation rules for inter-VLAN routing.

AnswersA, B, C

Community ports form a secondary VLAN grouping where members exchange traffic with each other and with promiscuous ports, but not with isolated ports. This partial isolation satisfies the PVLAN requirement for controlled communication within a defined community.

Why this answer

In a private VLAN architecture on EX Series switches, community ports (option A) are secondary-VLAN member ports that may communicate with other ports in the same community VLAN and with promiscuous ports, but not with isolated ports or other communities. Isolated ports (option B) belong to an isolated secondary VLAN and can communicate only with promiscuous ports, providing the strictest Layer 2 isolation among host ports. Promiscuous ports (option C) are members of the primary VLAN and can communicate with all ports across both the primary VLAN and its associated secondary VLANs, typically serving as the gateway or uplink port.

Option D is incorrect because RIB-only routing instance interfaces are a Layer 3 routing construct unrelated to PVLAN port roles and do not define PVLAN behavior. Option E is incorrect because PVLANs do not use fully meshed trunk ports to bypass isolation; trunk ports simply carry the primary and secondary VLAN tags while preserving the PVLAN isolation rules.

Exam trap

JNCIS-ENT often tests whether candidates confuse PVLAN port roles with regular VLAN or trunk concepts — the distractor about 'trunk ports bypassing isolation' tempts those who don't understand that isolation is enforced regardless of tagging.

Full explanation →

10

MCQeasy

What is the OSPF router ID format used by Junos OS when initializing the OSPF routing process if no explicit router ID is configured?

A.A 48-bit MAC address

B.An integer value between 1 and 65535

C.A 128-bit IPv6 address

D.A 32-bit IPv4 address format (dotted quad)

AnswerD

Without an explicit router ID, Junos OS selects the highest loopback interface address, or the highest physical interface address if no loopback exists, and expresses it as a 32-bit dotted-quad IPv4 address. OSPFv3 still uses this same 32-bit format.

Why this answer

OSPF router IDs are formatted as a 32-bit dotted-quad number, identical in structure to an IPv4 address.

Full explanation →

11

MCQmedium

What happens if you have an area address mismatch in a Level 1 adjacency?

A.The adjacency will fail to form.

B.The DIS will override the mismatch.

C.The adjacency will form but no routes will be exchanged.

D.The router will automatically adopt the neighbor's area address.

AnswerA

An area address mismatch prevents Level 1 adjacency formation because IS-IS requires both routers to share at least one common area address before establishing a Level 1 link. Without this overlap, the routers cannot exchange Level 1 link-state PDUs, so the adjacency remains down, satisfying the stem's constraint.

Why this answer

Level 1 adjacencies require the routers to share at least one area address.

Full explanation →

12

Multi-Selecthard

Which THREE actions occur when a Junos router with GRES and NSR enabled performs a manual Routing Engine switchover while running OSPF and BGP? (Choose three)

Select 3 answers

A.OSPF and BGP daemon states synchronized via NSR allow routing sessions to remain established without neighbor drop.

B.External routing peers see no change in adjacency state and do not trigger route recalculations.

C.The backup Routing Engine assumes control plane mastership without resetting the packet forwarding engine.

D.All physical interfaces are reset and re-initialized, causing a 30-second traffic blackout.

E.All VRRP virtual gateway IPs revert to their physical interface fallback addresses.

AnswersA, B, C

NSR synchronises OSPF and BGP daemon state to the backup Routing Engine continuously, so protocol adjacencies survive the switchover without renegotiation. This satisfies the stem's requirement that routing sessions remain established and neighbours are not dropped.

Why this answer

Option A is correct because NSR (Nonstop Routing) synchronizes OSPF and BGP daemon state (adjacencies, databases, and session information) from the master to the backup Routing Engine, so protocol sessions stay up across the switchover without neighbors dropping. Option B is correct because, with sessions preserved by NSR, external OSPF and BGP peers observe no adjacency state change and therefore do not flap or trigger route recalculation. Option C is correct because GRES (Graceful Routing Engine Switchover) lets the backup Routing Engine take over control-plane mastership while the Packet Forwarding Engine keeps forwarding using its existing state, avoiding a forwarding reset.

Option D is wrong because GRES/NSR specifically avoid resetting the PFE and interfaces, so there is no 30-second blackout. Option E is wrong because VRRP virtual IPs are not reverted to physical interface addresses during a Routing Engine switchover; VRRP mastership is unaffected by GRES/NSR.

Full explanation →

13

Multi-Selecthard

Which THREE statements describe the role and function of the BGP Router ID? (Choose three)

Select 3 answers

A.It automatically replaces the AS_PATH attribute if missing.

B.It is exchanged during the BGP OPEN message negotiation phase.

C.It is used as a final tie-breaker in the BGP path selection algorithm.

D.It must be identical across all routers within the same Autonomous System.

E.It is a 32-bit identifier represented in dotted-quad notation.

AnswersB, C, E

The Router ID is carried in the BGP OPEN message, allowing peers to identify each other during session establishment. This satisfies the negotiation-phase constraint: each speaker advertises its Router ID before the session reaches Established, so both peers learn the other's identifier as part of capability exchange rather than through later UPDATE messages.

Why this answer

Option B is correct because the BGP Router ID is carried in the BGP OPEN message as part of session establishment, allowing peers to identify each other during negotiation. Option C is correct because when all other path attributes are equal, BGP uses the lowest Router ID as the final tie-breaker in the best-path selection algorithm. Option E is correct because the Router ID is a 32-bit value written in dotted-quad notation, just like an IPv4 address.

Option A is wrong because the AS_PATH attribute is generated and propagated by BGP itself and is never replaced by the Router ID. Option D is wrong because Router IDs must be unique within an Autonomous System, not identical across all routers.

Full explanation →

14

MCQhard

You are troubleshooting an OSPF network on Junos devices. A router in area 1 is not receiving external routes from an ASBR in area 0. The ABR connecting the areas is correctly configured. You suspect a problem with LSA flooding. Which LSA type is used by the ASBR to advertise external routes, and what is its flooding scope?

A.Type 3 LSA, flooded between areas but not within an area.

B.Type 5 LSA, flooded throughout the entire OSPF domain except stub areas.

C.Type 7 LSA, flooded only within an NSSA.

D.Type 4 LSA, flooded only within the area where the ASBR resides.

AnswerB

Type 5 LSAs are generated by ASBRs to advertise external routes. They are flooded throughout all areas except stub, totally stubby, and NSSA areas. In this scenario, area 1 is a standard area, so Type 5 LSAs should be flooded into it by the ABR. The ABR generates Type 4 LSAs to advertise the ASBR, and Type 5 LSAs are propagated. If not received, check area type or filtering.

Why this answer

OSPF external routes are advertised by ASBRs using Type 5 LSAs. These LSAs have domain-wide flooding scope, meaning they are propagated through all areas except stub, totally stubby, and NSSA areas. In the scenario, area 1 is a normal area, so the ABR should flood Type 5 LSAs into it.

If external routes are missing, possible causes include area type misconfiguration, LSA filtering, or the ABR not generating Type 4 LSAs for the ASBR.

Exam trap

The trap here is confusing Type 4 LSAs (which advertise the ASBR) with Type 5 LSAs (which advertise the external routes themselves).

Full explanation →

15

MCQmedium

During troubleshooting of a flapping BGP session, you notice BGP Notification messages being sent. Which BGP message type is responsible for tearing down a session due to an error condition?

A.KEEPALIVE

B.UPDATE

C.OPEN

D.NOTIFICATION

AnswerD

The NOTIFICATION message carries error codes and subcodes, and its receipt causes the peer to tear down the BGP session. Unlike OPEN, UPDATE or KEEPALIVE, it is the message type explicitly used to signal an error condition and terminate the adjacency.

Why this answer

The Notification message is sent when an error is detected, causing the BGP connection to close immediately.

Full explanation →

16

Multi-Selecthard

Which TWO factors must be carefully managed when running OSPF over a GRE tunnel interface on Junos devices? (Choose two.)

Select 2 answers

A.Mandatory activation of BGP multipath routing on the physical transit interface.

B.Interface MTU settings to account for the additional GRE header size and prevent packet drops or fragmentation issues.

C.Configuring MPLS Label Distribution Protocol (LDP) directly on the gr- interface.

D.OSPF network type configuration (such as point-to-point) to ensure proper adjacency formation without requiring a designated router.

E.Enabling proprietary Junos Layer 2 bridging protocols over the gr- interface.

AnswersB, D

GRE encapsulation consumes bytes from the payload budget, so the tunnel interface MTU must be lowered to match the physical path MTU minus GRE overhead; otherwise OSPF hello packets and LSAs exceed the path MTU and are dropped or fragmented.

Why this answer

Option B is correct because a GRE tunnel adds an outer IP header (typically 24 bytes for GRE + IPv4, or more with additional options), which reduces the effective payload MTU on the gr- interface; if the tunnel interface MTU is not lowered accordingly (e.g., to 1476 or less) or TCP MSS clamping is not applied, OSPF hello packets and other traffic can be dropped or fragmented, breaking adjacency. Option D is correct because OSPF over a GRE tunnel is normally configured with the point-to-point network type, since a point-to-point link does not require DR/BDR election and avoids the multicast/unicast adjacency issues that can arise on a broadcast-type tunnel; this ensures reliable adjacency formation between the two tunnel endpoints. Option A is not required because BGP multipath on the physical transit interface is unrelated to running OSPF over GRE and is not a prerequisite for OSPF adjacency.

Option C is incorrect because LDP is an MPLS label distribution protocol and is not configured on a gr- interface to run OSPF. Option E is incorrect because proprietary Junos Layer 2 bridging protocols are not used to run OSPF over GRE.

Exam trap

The trap is assuming OSPF over GRE requires additional protocols like BGP or MPLS — candidates may overcomplicate the design and pick options A or C, missing the fundamental MTU and network-type considerations.

Full explanation →

17

MCQhard

A Juniper router is configured with a BGP peer group that includes multiple neighbors. You want to apply a policy to all neighbors in the group that sets the next-hop to a specific address for all routes received from them. Which configuration statement should you use?

A.Configure the next-hop self statement under the group.

B.Apply an import policy under the group configuration that sets the next-hop to the desired address.

C.Apply an export policy under each neighbor that sets the next-hop to the desired address.

D.Use a routing instance to rewrite the next-hop for all BGP routes.

AnswerB

Applying an import policy at the group level affects all neighbors in that group. The policy can match routes and set the next-hop attribute. This is the correct approach because it ensures consistency and reduces configuration redundancy. The next-hop is set before the route is installed in the routing table, influencing BGP path selection.

Why this answer

To modify the next-hop for routes received from all neighbors in a BGP group, you apply an import policy at the group level. This policy can match the desired routes and set the next-hop attribute. This approach is efficient and ensures that all neighbors in the group are affected consistently.

Export policies and next-hop self are used for outbound advertisements, not for modifying received routes.

Exam trap

The trap here is confusing import and export policies, or assuming that next-hop self can set an arbitrary address, when it actually sets the next-hop to the local router's address and is used on export.

Full explanation →

18

MCQeasy

What is the primary function of the RSTP port role known as the 'Backup' port?

A.It forwards traffic when the primary trunk fails without triggering a topology change.

B.It acts as a backup for the root port towards the root bridge.

C.It acts as a backup for a designated port on the same segment.

D.It is an operational state used exclusively during edge port transitions.

AnswerC

A Backup port receives BPDUs from its own designated bridge on a shared segment, so it stays discarding while that designated port forwards. It provides rapid failover only if the designated port fails, unlike an Alternate port, which backs up a root port.

Why this answer

An RSTP Backup port is a discarding port that provides a backup path to a designated port on the same shared segment. It exists only on shared (multi-access) segments where a switch has multiple ports connected to the same LAN, and it can quickly transition to forwarding if the designated port on that segment fails.

Exam trap

JNCIS-ENT often tests the distinction between Alternate and Backup port roles — the trap is confusing 'backup for the root port' (Alternate) with 'backup for a designated port on the same segment' (Backup).

How to eliminate wrong answers

Option A is wrong because a port that forwards when a trunk fails without a topology change describes an Alternate port (backup to the root port), not a Backup port. Option B is wrong because backing up the root port is the role of the Alternate port — the Backup port backs up a designated port, not the root port. Option D is wrong because 'edge port transitions' relate to Edge ports (PortFast equivalents) and their immediate forwarding behaviour, not to the Backup port role.

Full explanation →

19

MCQmedium

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

A.Applied to the routing-instance forwarding table.

B.Applied globally under system services l2-firewall.

C.Applied to the input of an interface or VLAN under family ethernet-switching.

D.Applied to the output of the VLAN interface under family inet.

AnswerC

Layer 2 firewall filters on EX Series switches match frame fields such as source MAC and must be applied under family ethernet-switching, either at the interface input or VLAN input, so the filter processes inbound frames before forwarding decisions.

Why this answer

Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Full explanation →

20

MCQeasy

What is the purpose of the 'lsp-generation-interval'?

A.To limit the frequency of LSP updates.

B.To set the hello interval.

C.To define the authentication key rotation.

D.To set the time for database aging.

AnswerA

The `lsp-generation-interval` timer throttles how often a router regenerates and floods its own link-state PDUs, batching rapid topology changes into a single update. This satisfies the stem's requirement by limiting update frequency, reducing CPU load and flooding overhead while still propagating changes within the configured delay.

Why this answer

The 'lsp-generation-interval' controls how often a router can generate new LSPs (Link State PDUs) in IS-IS. It sets a minimum interval between consecutive LSP generations, thereby limiting the frequency of LSP updates and reducing flooding and SPF churn.

Exam trap

The trap is confusing 'lsp-generation-interval' with 'lsp-refresh-interval' or 'hello-interval'. The generation interval specifically limits how often new LSPs are generated due to changes, not periodic refreshes.

How to eliminate wrong answers

Option B is wrong because the hello interval is configured separately with 'hello-interval'. Option C is wrong because authentication key rotation is not controlled by lsp-generation-interval; it is part of authentication configuration. Option D is wrong because database aging is controlled by 'max-lsp-lifetime' and 'lsp-refresh-interval', not lsp-generation-interval.

Full explanation →

21

MCQhard

An operator configures RSTP across multiple EX Series switches. A rogue switch running legacy STP is connected to an RSTP switch. How does the RSTP switch handle interaction with the legacy STP switch?

A.The port receiving legacy BPDUs is immediately placed into a permanent error-disabled state.

B.The legacy STP BPDUs are dropped and logged as protocol violations.

C.The entire switch converts its spanning tree mode to legacy STP.

D.The RSTP switch falls back to legacy STP behavior on that specific interface.

AnswerD

RSTP detects legacy STP BPDUs on the link and operates in STP compatibility mode per port, transmitting and interpreting 802.1D BPDUs rather than RSTP's version. Other interfaces retain full RSTP, so degradation is scoped to that specific interface only.

Why this answer

RSTP (IEEE 802.1w) is backward compatible with legacy STP (802.1D). When an RSTP switch receives legacy STP BPDUs on a port, it detects the neighbor as an STP bridge and falls back to legacy STP behavior on that specific interface only. The rest of the RSTP domain continues to operate in RSTP mode, ensuring interoperability without disrupting the entire network.

Exam trap

JNCIS-ENT often tests the misconception that RSTP and STP cannot interoperate, leading candidates to choose answers that involve disabling ports or converting the entire switch, rather than the correct per-interface fallback.

How to eliminate wrong answers

Option A is wrong because RSTP does not error-disable a port upon receiving legacy BPDUs; it only does so for BPDU guard violations, not for standard STP interoperability. Option B is wrong because RSTP does not drop legacy BPDUs; it processes them to maintain loop-free topology. Option C is wrong because the entire switch does not convert to legacy STP; only the specific interface falls back, preserving RSTP benefits elsewhere.

Full explanation →

22

MCQhard

An administrator configures a GRE tunnel with a tunnel key enabled for security segmentation between two sites. The tunnel comes up, but traffic fails to pass. Debugging reveals that packets are dropped because the receiving router rejects the packets. What is the most probable configuration mismatch?

A.The tunnel key value configured on one router does not match the tunnel key value configured on the remote peer router.

B.The tunnel source address is using a loopback interface instead of a physical interface.

C.The physical interface MTU is set too high on the ingress router.

D.The GRE tunnel interface family inet is missing the primary address.

AnswerA

GRE tunnel keys are carried in the GRE header and validated on receipt. If the local and remote key values differ, the receiving router discards the encapsulated packets, so the tunnel shows up but no payload traffic passes. Matching keys on both peers resolves the drop.

Why this answer

GRE tunnel keys are used to multiplex multiple GRE tunnels between the same pair of endpoints, and both ends must be configured with the same key value for the receiver to accept the encapsulated packets. If the keys mismatch, the receiving router drops the packets because it cannot match them to the expected tunnel, even though the tunnel interface itself shows as up. This is the classic cause of 'tunnel up but traffic fails' with GRE keys.

Exam trap

JNCIS-ENT often tests 'tunnel up but no traffic' scenarios — candidates chase MTU or routing issues, but the specific mention of 'tunnel key enabled' points directly to a key mismatch as the intended answer.

How to eliminate wrong answers

Option B is wrong because using a loopback as the tunnel source is a common and valid design for redundancy — it does not cause packet drops by itself. Option C is wrong because an MTU that is too high typically causes fragmentation or PMTUD issues, not outright rejection of packets by the receiving router. Option D is wrong because a missing primary address on the tunnel interface would prevent the tunnel from coming up or routing traffic, but the question states the tunnel is up, so this is not the cause.

Full explanation →

23

MCQmedium

You need to ensure that traffic entering interface ge-0/0/1 is forced into a specific forwarding routing instance named 'corp-fwd', regardless of the destination IP address in the packet header. Which configuration steps must you perform?

A.Create a forwarding instance, write a firewall filter with 'then routing-instance corp-fwd', and apply the filter as input on ge-0/0/1.

B.Create a virtual-router instance and apply a static default route pointing to ge-0/0/1.

C.Configure a routing policy with 'then export corp-fwd' and apply it under protocols.

D.Enable proxy-ARP on ge-0/0/1 and assign the corp-fwd routing instance to the physical port.

AnswerA

A firewall filter with the `then routing-instance corp-fwd` action performs policy-based routing, redirecting matched packets into the named forwarding instance before the normal destination lookup occurs. Applying it as an input filter on ge-0/0/1 satisfies the stem's requirement to force all ingress traffic into corp-fwd regardless of destination IP.

Why this answer

To force traffic from an interface into a specific forwarding routing instance regardless of destination, you create a forwarding instance (type 'forwarding'), define a firewall filter with the action 'then routing-instance corp-fwd', and apply that filter as an input filter on ge-0/0/1. This is the standard Junos method for policy-based routing into a forwarding instance, often used for service chaining or VRF selection.

Exam trap

JNCIS-ENT often tests the difference between forwarding instances and virtual-router instances — candidates confuse the two and pick answers involving virtual routers or routing policies, which do not achieve filter-based forwarding.

How to eliminate wrong answers

Option B is wrong because a virtual-router instance with a static default route pointing to ge-0/0/1 does not force ingress traffic into that instance — it only affects egress routing decisions within the instance. Option C is wrong because routing policies with 'then export' are used for route export between protocols or instances, not for classifying ingress traffic into a routing instance. Option D is wrong because proxy-ARP and assigning a routing instance to a physical port are not valid mechanisms for per-interface traffic steering — routing instances are associated with interfaces via configuration, but not in the way described, and proxy-ARP is unrelated.

Full explanation →

24

Multi-Selectmedium

Which of the following are true regarding the IS-IS 'hello-interval'? (Choose TWO)

Select 2 answers

A.It is used to calculate the SPF interval.

B.It determines how often Hello PDUs are sent.

C.It is always 10 seconds.

D.It affects the adjacency hold time.

E.It is only used on point-to-point links.

AnswersB, D

The hello-interval timer defines the periodic rate at which IS-IS Hello PDUs are transmitted on an interface. Shortening or lengthening it directly changes how frequently neighbours hear from the router, matching the statement that it determines Hello PDU send frequency.

Why this answer

Option B is correct because the IS-IS hello-interval directly controls the frequency with which a router transmits IS-IS Hello PDUs (IIHs) on an interface, which is its fundamental purpose. Option D is correct because the adjacency hold time is derived from the hello-interval multiplied by the hello-multiplier (by default, hold time = hello-interval × 3), so changing the hello-interval changes how long a neighbor waits before declaring the adjacency down. Option A is wrong because the SPF interval is governed by separate SPF timers (e.g., spf-interval), not the hello-interval.

Option C is wrong because the default hello-interval varies by interface type and network type (for example, 10 seconds on broadcast and 3 seconds on point-to-point by default on many platforms), so it is not always 10 seconds. Option E is wrong because Hello PDUs and the hello-interval apply to both broadcast and point-to-point links, not only point-to-point.

Exam trap

JNCIS-ENT often tests the relationship between hello-interval and hold time, and candidates may incorrectly assume hello-interval directly sets the SPF timer or is fixed at 10 seconds, overlooking that it varies by network type and affects adjacency hold time via the multiplier.

Full explanation →

25

MCQhard

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

A.GRE and IPsec operate simultaneously as a single unified protocol without nested headers.

B.IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.

C.IPsec replaces the GRE header entirely while maintaining GRE interface numbers.

D.Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.

AnswerD

GRE first encapsulates the payload, producing outer GRE packets; IPsec VPN policies then encrypt and authenticate those GRE packets as tunnel traffic. This layered order satisfies the requirement to secure GRE traffic, unlike transport mode, which would protect only the inner payload and leave GRE headers exposed.

Why this answer

In a GRE over IPsec configuration, traffic is first encapsulated in GRE, and then the resulting GRE packets are protected by IPsec VPN policies. This means the GRE header is added first, and then IPsec encrypts the entire GRE packet. This structure allows dynamic routing protocols to run over GRE while being secured by IPsec.

Exam trap

The trap is the order of encapsulation; candidates may think IPsec wraps first, but GRE must encapsulate before IPsec to allow multicast and routing protocols over the tunnel.

How to eliminate wrong answers

Option A is wrong because GRE and IPsec are separate protocols; they do not merge into a single unified protocol. Option B is wrong because IPsec does not encapsulate first; GRE encapsulation occurs before IPsec encryption. Option C is wrong because IPsec does not replace the GRE header; both headers are present in the final packet.

Full explanation →

26

MCQeasy

During an audit of an IS-IS routing network, an engineer examines the Type-Length-Value (TLV) structures used in IS-IS PDUs. Which TLV is specifically responsible for carrying IPv4 internal and external reachability information when using wide metrics?

A.TLV 135

B.TLV 128

C.TLV 1

D.TLV 2

AnswerA

TLV 135 carries IPv4 internal and external reachability information as extended IP reachability entries, supporting wide metric values beyond the 6-bit limit. It is the correct TLV for advertising IPv4 prefixes when wide metrics are enabled in IS-IS.

Why this answer

TLV 135 is specifically used in IS-IS to carry IPv4 internal and external reachability information when wide metrics are enabled. It supports extended IP reachability with wider metric values.

Exam trap

JNCIS-ENT often tests the specific TLV numbers for IS-IS. Candidates may confuse TLV 135 with TLV 128 or 130, especially when wide metrics are mentioned. Remember that TLV 135 is for extended IP reachability with wide metrics.

How to eliminate wrong answers

Option B is wrong because TLV 128 carries IPv4 internal reachability with narrow metrics (6-bit metric). Option C is wrong because TLV 1 carries area addresses, not reachability. Option D is wrong because TLV 2 carries IS neighbors, not IP prefixes.

Full explanation →

27

MCQmedium

You are reviewing the configuration of an EX Series switch and notice that interface ge-0/0/15 is configured with 'interface-mode access' but has no explicit 'vlan members' statement defined. Which VLAN does the interface default to?

A.VLAN 0 (null VLAN)

B.The port remains shut down until a VLAN is explicitly assigned.

C.VLAN 1 (default VLAN)

D.It drops all traffic until a VLAN membership is added.

AnswerC

On Juniper EX Series switches, an access interface without an explicit `vlan members` statement defaults to the default VLAN, which is VLAN 1. This satisfies the stem's constraint of no VLAN membership being defined, so untagged traffic on ge-0/0/15 is associated with VLAN 1.

Why this answer

On Juniper EX Series switches, when an interface is configured with 'interface-mode access' and no explicit 'vlan members' statement is present, the interface automatically becomes a member of the default VLAN, which is VLAN ID 1. This default VLAN is created by the system and is named 'default'. The interface will forward untagged traffic into VLAN 1, allowing connectivity without additional configuration.

Exam trap

JNCIS-ENT often tests the assumption that an access port without a VLAN assignment will be non-functional or placed in a null VLAN, but the correct behavior is that it defaults to VLAN 1.

How to eliminate wrong answers

Option A is wrong because VLAN 0 is not a valid user VLAN on Juniper EX switches; it is reserved for internal use (e.g., priority tagging) and cannot be assigned to access ports. Option B is wrong because the port does not remain shut down; it becomes operational and is placed in the default VLAN. Option D is wrong because the interface does not drop all traffic; it actively forwards traffic in VLAN 1, the default VLAN.

Full explanation →

28

MCQhard

You have configured a qualified next-hop for a static route to 10.1.1.0/24 with a primary next-hop of 192.168.1.1 and a qualified next-hop of 192.168.1.2. Both next-hops are reachable. Under what condition will the qualified next-hop be used?

A.When the primary next-hop is reachable but the interface is congested.

B.When the primary next-hop fails or is unreachable.

C.When the primary next-hop is reachable and the qualified next-hop has a lower metric.

D.When the primary next-hop is reachable but has a higher preference.

AnswerB

A qualified next-hop serves as a backup path. It is only used when the primary next-hop becomes unreachable, as determined by the routing table's next-hop resolution. This provides redundancy without requiring multiple static routes. The qualified next-hop remains inactive until the primary fails.

Why this answer

A qualified next-hop provides a backup path for a static route. It is only installed in the forwarding table when the primary next-hop becomes unreachable. This allows for redundancy without configuring multiple static routes with different preferences.

The primary next-hop is always preferred when it is reachable.

Exam trap

The trap here is thinking that qualified next-hops are chosen based on preference or metric, when they are purely backup next-hops activated only on primary failure.

Full explanation →

29

MCQeasy

During the examination of IS-IS packet captures on a multi-access LAN interface, an engineer notices a specific PDU type being transmitted periodically by the Designated Intermediate System (DIS) to maintain synchronized link-state databases. Which PDU type performs this function?

A.Partial Sequence Numbers PDU (PSNP)

B.Complete Sequence Numbers PDU (CSNP)

C.Intermediate System Hello (IIH)

D.Level 1 Link State PDU (LSP)

AnswerB

The DIS multicasts Complete Sequence Numbers PDUs every ten seconds on a multi-access LAN, listing every link-state PDU in its database so neighbours can compare and request anything missing. This satisfies the stem's requirement for the PDU that maintains synchronised link-state databases, whereas partial sequence numbers PDUs only describe a subset.

Why this answer

On a multi-access LAN, the DIS periodically sends Complete Sequence Numbers PDUs (CSNPs) to synchronize link-state databases. CSNPs contain a complete list of LSP IDs and sequence numbers, allowing routers to detect missing or outdated LSPs and request them via PSNPs. This periodic CSNP flooding is the DIS's primary database synchronization mechanism.

Exam trap

The trap is confusing CSNP with PSNP — candidates must remember CSNP is the complete list sent periodically by the DIS, while PSNP is the partial list used for requests and acknowledgments.

How to eliminate wrong answers

Option A is wrong because PSNPs are used to request specific missing LSPs or acknowledge receipt; they are not periodically transmitted by the DIS for full database synchronization. Option C is wrong because IIHs are hello PDUs used for adjacency maintenance, not database synchronization. Option D is wrong because LSPs carry link-state information but are not the periodic synchronization PDU sent by the DIS; they are flooded when changes occur.

Full explanation →

30

MCQmedium

What is the purpose of the BGP Keepalive message and what is its default interval in Junos?

A.To maintain the session; sent every 30 seconds by default.

B.To report session errors; sent immediately upon failure.

C.To negotiate capabilities; sent every 60 seconds.

D.To update routing tables; sent every 5 seconds.

AnswerA

BGP Keepalive messages sustain established peering sessions by confirming the peer remains reachable, resetting the Hold Timer before it expires. Junos defaults to a 30-second Keepalive interval, with a 90-second Hold Timer, satisfying the stem's requirement for both the message's purpose and its default interval.

Why this answer

BGP KEEPALIVE messages are sent periodically to confirm that the peer session is still alive and to reset the Hold Timer, preventing the session from being torn down. In Junos (and per RFC 4271), the default Keepalive interval is 30 seconds, with a default Hold Time of 90 seconds — exactly three times the Keepalive interval. If three consecutive Keepalives are missed, the Hold Timer expires and the session resets.

Exam trap

The trap is mixing up BGP message types — candidates confuse KEEPALIVE (liveness, 30s default) with NOTIFICATION (errors) or OPEN (capabilities), and often misremember the 30/90 second default timer relationship.

How to eliminate wrong answers

Option B is wrong because session errors are reported via NOTIFICATION messages, not KEEPALIVE — NOTIFICATION is sent immediately when an error is detected to tear down the session with a specific error code. Option C is wrong because capability negotiation is performed by the OPEN message using Optional Parameters (e.g., MP-BGP, route refresh, 4-byte AS), and the 60-second figure is incorrect for Keepalive. Option D is wrong because routing table updates are carried in UPDATE messages, and 5 seconds is not a BGP timer default — it more closely resembles an IGP hello interval (OSPF hello is 10s, IS-IS is 10s).

Full explanation →

31

MCQhard

You are implementing MACsec on an EX Series switch to secure a point-to-point link between two data centers. The link uses a 10 Gigabit Ethernet interface. You want to ensure that only encrypted traffic is accepted and that unencrypted frames are dropped. Which configuration parameter must be set on the interface?

A.Set the MACsec security mode to 'should-secure'.

B.Set the MACsec security mode to 'must-secure'.

C.Enable MACsec with the 'no-encrypt' option.

D.Configure MACsec with a pre-shared key (PSK) and set the 'replay-protection' window to 0.

AnswerB

The 'must-secure' mode enforces that all traffic on the interface must be encrypted with MACsec. If an unencrypted frame is received, it is dropped. This ensures that only secured traffic is accepted, meeting the requirement. The other modes, such as 'should-secure' or 'clear', do not enforce encryption and would allow unencrypted frames.

Why this answer

MACsec security modes determine how encryption is enforced. The 'must-secure' mode requires all traffic to be encrypted and drops any unencrypted frames. 'should-secure' allows unencrypted traffic if MACsec is not established, and 'no-encrypt' disables encryption. Therefore, 'must-secure' is the only mode that ensures only encrypted traffic is accepted, meeting the scenario's requirement.

Exam trap

The trap here is assuming that any MACsec configuration automatically drops unencrypted frames, when only the 'must-secure' mode enforces this behavior.

Full explanation →

32

Multi-Selectmedium

Which TWO features characterize OSPFv3 compared to OSPFv2? (Choose two)

Select 2 answers

A.OSPFv3 exclusively uses MD5 authentication embedded in the OSPF packet header.

B.OSPFv3 router IDs remain 32-bit unsigned integers, formatted identically to IPv4 addresses.

C.OSPFv3 eliminates the need for Area 0 in multi-area topologies.

D.OSPFv3 uses IPv6 link-local addresses for neighbor discovery and adjacency establishment.

E.OSPFv3 requires manual static routing for all inter-area paths.

AnswersB, D

OSPFv3 retains the 32-bit dotted-quad router ID format inherited from OSPFv2, even though it runs over IPv6. This satisfies the stem's requirement for a shared characteristic, since the router ID is not derived from the IPv6 addressing scheme.

Why this answer

Option B is correct because OSPFv3, like OSPFv2, still uses a 32-bit unsigned router ID that is written in dotted-decimal IPv4 format, even though OSPFv3 runs over IPv6; the router ID is not an IPv6 address. Option D is correct because OSPFv3 forms adjacencies and sends hello packets using IPv6 link-local addresses (fe80::/10) on each interface, which is a key operational difference from OSPFv2's use of interface IPv4 addresses. Option A is incorrect because OSPFv3 does not exclusively use MD5 in the OSPF header; it relies on IPv6 IPsec (AH/ESP) for authentication, and later RFCs also define OSPFv3 authentication trailer options.

Option C is incorrect because OSPFv3 still requires a backbone area, Area 0, for multi-area topologies just like OSPFv2. Option E is incorrect because OSPFv3 dynamically learns inter-area routes through LSAs and the SPF calculation; it does not require manual static routes for inter-area paths.

Exam trap

JNCIS-ENT often tests the misconception that OSPFv3 eliminates Area 0 or uses IPv4-style authentication — candidates assume IPv6 support changes the fundamental OSPF architecture, when router IDs and the backbone area remain unchanged.

Full explanation →

33

Multi-Selectmedium

Which of the following are true regarding IS-IS authentication? (Choose TWO)

Select 2 answers

A.It is mandatory for all IS-IS deployments.

B.It can only be configured for the entire area.

C.It secures the PDUs exchanged between neighbors.

D.It can be configured per interface.

E.It encrypts the entire link traffic.

AnswersC, D

IS-IS authentication applies a cryptographic checksum to Hello, LSP, CSNP and PSNP PDUs, so a receiving router verifies each PDU originated from a trusted neighbour. This secures the PDUs exchanged between neighbours, satisfying the question's requirement.

Why this answer

IS-IS authentication is used to secure the PDUs exchanged between neighbors, such as Hello PDUs, LSPs, and SNPs, which is why option C is correct. It can also be configured at different levels, including per interface, which makes option D correct. IS-IS authentication is not mandatory for all deployments, so option A is incorrect.

It is not limited to the entire area, since it can be applied at the interface, area, or domain level, so option B is incorrect. It does not encrypt the entire link traffic; it only authenticates routing protocol PDUs, so option E is incorrect.

Full explanation →

34

Multi-Selecthard

Which THREE conditions can cause a Virtual Chassis primary Routing Engine election or switchover to occur unexpectedly? (Choose three)

Select 3 answers

A.Manual modification of member priority values followed by a mastership switchover command or reboot.

B.Configuring VRRP preemption on a VLAN interface.

C.Failure or disconnection of stacking cables resulting in a split-brain condition or topology restructuring.

D.A mismatch in LACP timeout intervals on aggregated Ethernet interfaces.

E.A hardware crash or kernel panic on the current primary Routing Engine switch.

AnswersA, C, E

Altering member priority values changes the election weight each member carries, so a subsequent reboot or mastership switchover command triggers a fresh election in which the newly favoured member can seize primary role. This directly satisfies the stem's unexpected switchover condition, since the election outcome shifts without any hardware fault.

Why this answer

Option A is correct because Virtual Chassis primary RE election is influenced by the member priority value; changing priorities and then issuing a mastership switchover command or rebooting forces a new election that can unexpectedly move mastership. Option C is correct because Virtual Chassis relies on the stacking/VCP links for control and election communication; a cable failure or disconnection can split the fabric, trigger a new election, or cause topology restructuring that changes which member becomes primary. Option E is correct because a hardware crash or kernel panic on the current primary Routing Engine switch causes the backup RE to take over mastership, resulting in an unexpected switchover.

Option B is not correct because VRRP preemption affects VRRP master election on a VLAN interface, not Virtual Chassis primary Routing Engine election. Option D is not correct because LACP timeout interval mismatches affect link aggregation behavior and can cause LACP bundling issues, but they do not directly trigger Virtual Chassis primary RE election or switchover.

Full explanation →

35

MCQmedium

You are configuring an EX Series switch and want to set the forward delay timer to 15 seconds. Which command is used?

A.set protocols rstp forward-delay 15

B.set bridge forward-delay 15

C.set spanning-tree forward-delay 15

D.set protocols rstp delay 15

AnswerA

The RSTP forward-delay timer is configured under the spanning-tree protocol hierarchy, so `set protocols rstp forward-delay 15` satisfies the stem's requirement of 15 seconds on the EX Series switch. RSTP retains a configurable forward-delay value even though its rapid transition mechanism usually bypasses the listening and learning waiting periods.

Why this answer

On Junos EX Series switches, RSTP is configured under the [edit protocols rstp] hierarchy, and the forward-delay timer is set with 'set protocols rstp forward-delay 15'. This command sets the RSTP forward delay to 15 seconds, controlling how long a port stays in the Listening and Learning states before transitioning to Forwarding.

Exam trap

JNCIS-ENT often tests Junos-specific CLI syntax — candidates familiar with Cisco or generic STP commands pick 'spanning-tree' or 'bridge' hierarchies that do not exist in Junos, where the correct hierarchy is 'protocols rstp'.

How to eliminate wrong answers

Option B is wrong because 'set bridge forward-delay 15' is not valid Junos syntax — Junos does not use a 'bridge' hierarchy for spanning-tree configuration on EX switches. Option C is wrong because 'set spanning-tree forward-delay 15' is not a Junos command; spanning-tree parameters are configured under 'protocols rstp' or 'protocols mstp', not a top-level 'spanning-tree' hierarchy. Option D is wrong because 'set protocols rstp delay 15' uses an incorrect keyword — the correct keyword is 'forward-delay', not 'delay'.

Full explanation →

36

MCQhard

An enterprise network runs MSTP. Instance 0 is always reserved for which specific purpose?

A.The Internal Regional Boundary instance (IRBI)

B.The Designated Root Backup instance (DRB)

C.The Common and Internal Spanning Tree (CIST) instance

D.The Vlan-to-Instance Mapping table (VIM)

AnswerC

MSTP reserves instance 0 for the Common and Internal Spanning Tree, which carries all VLANs not explicitly mapped elsewhere and interoperates with other spanning-tree regions. This satisfies the stem's constraint that instance 0 has a fixed, reserved purpose rather than user-defined VLAN mapping.

Why this answer

In MSTP, Instance 0 is always reserved for the Common and Internal Spanning Tree (CIST). The CIST is the spanning tree that connects all MST regions and also includes the IST (Internal Spanning Tree) within a region. Therefore, option C is correct.

Exam trap

JNCIS-ENT often tests MSTP terminology; candidates might confuse Instance 0 with other reserved instances or think it's for a specific VLAN range, but it's always the CIST.

How to eliminate wrong answers

Option A is wrong because 'Internal Regional Boundary instance (IRBI)' is not a standard term in MSTP; the correct term is IST (Internal Spanning Tree) which is part of the CIST. Option B is wrong because 'Designated Root Backup instance (DRB)' is not a valid MSTP concept. Option D is wrong because 'Vlan-to-Instance Mapping table (VIM)' is not an instance; it's a mapping configuration, and Instance 0 is not reserved for that purpose.

Full explanation →

37

MCQeasy

An engineer needs to configure a static IPv4 route on a Juniper Networks MX Series router pointing traffic destined for 192.168.100.0/24 to next-hop 10.0.0.1. Which configuration accomplishes this task?

A.set routing-instances default static route 192.168.100.0/24 next-hop 10.0.0.1

B.set protocols static route 192.168.100.0/24 next-hop 10.0.0.1

C.set interfaces fxp0 unit 0 family inet static-route 192.168.100.0/24 next-hop 10.0.0.1

D.set routing-options static route 192.168.100.0/24 next-hop 10.0.0.1

AnswerD

The `routing-options static route` hierarchy defines IPv4 static routes in Junos, with `next-hop 10.0.0.1` satisfying the stem's requirement to forward 192.168.100.0/24 traffic to that gateway. This syntax is valid on MX Series routers and installs the route into the inet.0 table, matching the destination prefix and next-hop exactly as specified.

Why this answer

In Junos, static routes are configured under the [edit routing-options] hierarchy, not under protocols or interfaces. The correct syntax is 'set routing-options static route <prefix> next-hop <address>', which installs the route into the inet.0 routing table for IPv4. This is the standard, documented method for defining a static IPv4 route on any Juniper device, including MX Series routers.

Exam trap

JNCIS-ENT often tests hierarchy memorization — candidates confuse 'protocols' (used for routing protocols like OSPF, BGP, IS-IS) with 'routing-options' (used for static routes, preferences, and router-level settings).

How to eliminate wrong answers

Option A is wrong because 'routing-instances default static route' is not valid Junos syntax — static routes are not configured under a routing-instance named 'default' in that manner, and 'default' is not a user-defined routing instance. Option B is wrong because 'protocols static' does not exist in Junos; static routes live under 'routing-options', not 'protocols'. Option C is wrong because static routes cannot be configured under an interface's 'family inet' stanza — that hierarchy is for interface addressing and related interface-level parameters, not route entries.

Full explanation →

38

MCQhard

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

A.Enable DHCP snooping on the core router's interface.

B.Configure a static DHCP binding for the gateway IP on the access switch.

C.Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.

D.Configure the interface connected to the default gateway as a trusted interface for DAI.

AnswerD

Dynamic ARP Inspection drops ARP packets arriving on untrusted interfaces unless they match the DHCP snooping binding database. A statically addressed gateway has no binding entry, so its interface must be marked trusted to permit its ARP traffic.

Why this answer

Dynamic ARP Inspection (DAI) validates ARP packets by comparing them against the DHCP snooping binding database, and by default all interfaces are untrusted. Since the default gateway uses a statically configured IP address, no DHCP snooping binding exists for it, so its ARP packets would be dropped on an untrusted interface. Configuring the interface connected to the gateway as trusted bypasses DAI inspection for that port, allowing legitimate ARP traffic from the gateway to pass.

This is the standard Juniper configuration using 'set ethernet-switching-options secure-access-port interface ge-0/0/1.0 arp-inspection trust'.

Exam trap

JNCIS-ENT often tests the misconception that DAI can validate statically configured devices via static bindings or firewall filters, when in fact the only way to allow their ARP traffic is to configure the interface as trusted.

How to eliminate wrong answers

Option A is wrong because DHCP snooping is not configured on the core router's interface; it is a Layer 2 switch feature that builds the binding database on the access switch, and enabling it on a router interface is neither possible nor relevant to trusting the gateway's ARP. Option B is wrong because a static DHCP binding for the gateway IP would require the gateway to use DHCP, but it uses a static IP, and DAI does not use static bindings for statically configured hosts; instead, the interface must be trusted. Option C is wrong because a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC does not integrate with DAI's trust model; DAI operates independently of firewall filters, and such a filter would not prevent DAI from dropping the packets if the interface is untrusted.

Full explanation →

39

MCQhard

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

A.They must be part of the same subnet as the tunnel payload addresses.

B.They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).

C.They must be resolved via BGP inet-vpn routes only.

D.They must be configured as loopback addresses in the destination VRF exclusively.

AnswerB

GRE encapsulates the payload, then forwards the resulting packet using the outer header, so tunnel endpoints must resolve in the transport table. This satisfies the stem's constraint: the source and destination addresses must be routable in the routing table associated with the underlying transport interface.

Why this answer

For a GRE tunnel terminating in a routing instance (VRF), the tunnel source and destination addresses must be routable within the routing table associated with the underlying transport interface. This is typically the master routing instance or a specific VRF that has reachability to the tunnel endpoints. The tunnel itself can be in a different VRF, but the transport must be resolvable.

Exam trap

JNCIS-ENT often tests the separation of transport and tunnel routing instances; candidates may incorrectly assume that tunnel endpoints must be in the same VRF as the tunnel interface or that they require BGP VPN routes.

How to eliminate wrong answers

Option A is wrong because tunnel source/destination addresses do not need to be in the same subnet as payload addresses; they only need to be reachable. Option C is wrong because BGP inet-vpn routes are not the only way to resolve tunnel endpoints; any routing protocol or static route can provide reachability. Option D is wrong because loopback addresses in the destination VRF are not required; the addresses just need to be routable in the transport routing table.

Full explanation →

40

MCQmedium

You are configuring authentication for OSPF on a Junos router using MD5. Where must the MD5 key ID and password be defined in the configuration hierarchy?

A.[edit protocols ospf area <area> interface <interface> authentication md5]

B.[edit protocols bgp group <group> authentication-key]

C.[edit routing-options autonomous-system]

D.[edit system authentication-order]

AnswerA

Junos applies OSPF MD5 authentication per interface, defined under the interface stanza within the area hierarchy. Placing the key ID and password at [edit protocols ospf area <area> interface <interface> authentication md5] satisfies the stem's requirement for where MD5 credentials are configured.

Why this answer

On Junos, OSPF MD5 authentication is configured at the interface level under the OSPF area hierarchy. The correct path is [edit protocols ospf area <area> interface <interface> authentication md5], where you specify the key ID and password. This binds the authentication to the specific OSPF interface, which is required because OSPF authentication is per-interface, not global.

Exam trap

JNCIS-ENT often tests the confusion between OSPF and BGP authentication hierarchies, or between routing protocol authentication and user login authentication-order.

How to eliminate wrong answers

Option B is wrong because [edit protocols bgp group <group> authentication-key] configures BGP authentication, not OSPF — it's a different protocol entirely. Option C is wrong because [edit routing-options autonomous-system] sets the AS number for BGP, unrelated to OSPF authentication. Option D is wrong because [edit system authentication-order] controls the order of authentication methods for user login (e.g., RADIUS, TACACS+, local), not routing protocol authentication.

Full explanation →

41

MCQeasy

Which command is used to verify the IS-IS adjacency state on a Junos device?

A.show isis interface

B.show isis database

C.show isis adjacency

D.show protocols isis neighbors

AnswerC

`show isis adjacency` displays each IS-IS neighbour with its interface, state (Up, Initialising, Down), hold time and remaining lifetime, directly satisfying the stem's requirement to verify adjacency state on a Junos device. It reads the adjacency database maintained by the IS-IS process, unlike route or interface commands.

Why this answer

The command 'show isis adjacency' on Junos devices displays the IS-IS adjacency table, including the system ID of each neighbor, the interface, the adjacency state (e.g., Up, Down, Init), and other details like hold time and priority. This is the direct and standard way to verify IS-IS adjacency state. Other commands provide different IS-IS information, such as interface configuration or link-state database contents.

Exam trap

JNCIS-ENT often tests the distinction between commands that show IS-IS interface details, database contents, and adjacency states, so candidates must remember that 'show isis adjacency' is the specific command for verifying neighbor states.

How to eliminate wrong answers

Option A is wrong because 'show isis interface' displays IS-IS interface configuration and status (e.g., circuit type, hello interval, metric), not adjacency state. Option B is wrong because 'show isis database' shows the IS-IS link-state database (LSPs), which is unrelated to adjacency verification. Option D is wrong because 'show protocols isis neighbors' is not a valid Junos command; the correct syntax for neighbors is 'show isis adjacency'.

Full explanation →

42

MCQmedium

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

A.Internet Key Exchange version 2 (IKEv2)

B.Secure Session Protocol (SSP)

C.802.1AE Dynamic Key Distribution (AKD)

D.MACsec Key Agreement (MKA) protocol

AnswerD

Junos MACsec uses the MACsec Key Agreement protocol, defined in IEEE 802.1X-2010, to elect a key server and negotiate secure associations and encryption keys between peers. MKA is the default dynamic key-management mechanism, satisfying the EX4300 link-securing requirement.

Why this answer

Junos MACsec uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X-2010, as the default key agreement protocol. MKA runs over the point-to-point link, elects a Key Server, and uses the Connectivity Association Key (CAK) to derive the Secure Association Key (SAK) that encrypts traffic.

Exam trap

JNCIS-ENT often tests the confusion between Layer 3 key-exchange protocols (IKEv2 for IPsec) and the Layer 2 MACsec key agreement protocol (MKA), causing candidates to select IKEv2 by analogy.

How to eliminate wrong answers

Option A is wrong because IKEv2 is the key-exchange protocol used by IPsec VPNs at Layer 3, not by MACsec, which operates at Layer 2. Option B is wrong because 'Secure Session Protocol' is not a real standardized key agreement protocol for MACsec. Option C is wrong because '802.1AE Dynamic Key Distribution (AKD)' is a fabricated name — 802.1AE is the MACsec frame format standard, but it does not define a key distribution protocol; that role belongs to MKA under 802.1X.

Full explanation →

43

MCQhard

An engineer is preparing to perform an In-Service Software Upgrade (ISSU) on a pair of dual-RE MX240 routers. Which condition must be met to ensure the ISSU succeeds without dropping traffic?

A.The backup Routing Engine must be physically removed from the chassis during the upgrade.

B.All physical interfaces must be manually disabled prior to issuing the request system software in-service command.

C.Graceful Route Engine Switchover (GRES) and Nonstop Active Routing (NSR) must be enabled and functioning.

D.All routing protocols must be migrated from OSPF to IS-IS before starting ISSU.

AnswerC

ISSU on dual-RE MX240 routers requires GRES and NSR to be enabled and functioning, satisfying the stem's no-traffic-loss constraint. GRES preserves forwarding state across RE switchover, while NSR keeps routing protocol adjacencies and sessions intact, so neither control-plane nor data-plane traffic is dropped during the upgrade.

Why this answer

ISSU requires specific hardware compatibility (matching RE models, line card types), GRES and NSR configured and operating, and a supported Junos image path.

Full explanation →

44

MCQmedium

An engineer configures a Virtual Chassis using EX4300 switches. To ensure member IDs are assigned consistently even if physical positions change, how should the administrator provision the member IDs?

A.Rely on automatic plug-and-play assignment, which permanently locks member IDs based on initial boot order.

B.Disable GRES so that member IDs do not synchronize across the stack.

C.Configure the MAC address of each switch under the [edit chassis vrrp] hierarchy.

D.Pre-provision member serial numbers to specific member IDs using the 'request virtual-chassis assign' or configuration statements.

AnswerD

Binding member IDs to serial numbers via 'request virtual-chassis assign' or configuration statements decouples the ID from physical slot position, so each switch keeps its assigned member ID even when cabled into a different location within the Virtual Chassis.

Why this answer

Junos allows pre-provisioning Virtual Chassis member serial numbers to specific member IDs to maintain predictable topologies.

Full explanation →

45

Multi-Selecteasy

Which TWO parameters are mandatory when configuring a basic GRE tunnel interface in Junos? (Choose two)

Select 2 answers

A.GRE keepalive interval timer

B.Tunnel destination IP address

C.Tunnel source IP address

D.Routing protocol authentication key

E.IPsec security association profile

AnswersB, C

A GRE tunnel requires the destination address to identify the remote tunnel endpoint, encapsulating the original packet inside a new IP header. Junos mandates both source and destination for the tunnel interface to come up, since the destination defines where encapsulated traffic is sent. Without it, the tunnel interface remains down.

Why this answer

Option B (Tunnel destination IP address) is mandatory because a GRE tunnel interface must know the remote endpoint to encapsulate and forward packets to; in Junos this is configured with the tunnel destination statement under the gr- interface. Option C (Tunnel source IP address) is also mandatory because the local tunnel endpoint must be identified so return traffic and the outer IP header use a reachable, routable source address, configured via the tunnel source statement. Together, source and destination define the two endpoints of the point-to-point GRE tunnel and are the minimum required parameters.

Option A (GRE keepalive interval timer) is optional, as keepalives are not required for basic GRE operation and can be omitted. Option D (Routing protocol authentication key) is unrelated to GRE tunnel interface configuration and belongs to routing protocol security. Option E (IPsec security association profile) is not required for basic GRE, since GRE itself provides no encryption and IPsec would only be added for secure GRE scenarios.

Exam trap

The trap here is confusing optional tunnel features (keepalives, IPsec, authentication) with the two truly mandatory parameters — source and destination — that define the tunnel endpoints.

Full explanation →

46

MCQmedium

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

A.AES-CBC-128

B.SHA-256-HMAC

C.GCM-AES-128

D.GCM-AES-256

AnswerC

Enabling MACsec on an EX4300 interface without naming a cipher suite applies GCM-AES-128 by default, satisfying the stem's no-explicit-suite constraint. This 128-bit Galois/Counter Mode AES suite provides both confidentiality and integrity, and remains the baseline Junos selects unless a stronger suite is specified.

Why this answer

When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Full explanation →

47

MCQeasy

When configuring a Link Aggregation Group (LAG) on a Juniper switch, what is the naming convention used for the aggregated interface in the Junos CLI?

A.lag0, lag1, lag2, etc.

B.eth-trunk0, eth-trunk1, etc.

C.ae0, ae1, ae2, etc.

D.bond0, bond1, bond2, etc.

AnswerC

Junos names aggregated Ethernet bundles ae0, ae1, ae2 and so on, so the LAG interface is referenced as ae0 in configuration and show commands. This satisfies the stem's request for the Junos CLI naming convention for the aggregated interface.

Why this answer

Junos uses the 'aeX' naming convention (Aggregated Ethernet) for LAG interfaces.

Full explanation →

48

MCQhard

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

A.Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.

B.No, because Junos prohibits all routing protocols over IP-IP interfaces.

C.No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.

D.Yes, but only if IGMP version 3 is explicitly configured.

AnswerC

IP-IP encapsulates only unicast IP payloads, adding an outer IP header with no support for multicast or broadcast addressing. GRE carries a protocol type field and supports multicast, so PIM cannot run over IP-IP but can over GRE.

Why this answer

IP-IP tunnels (ip-x/x/x interfaces on Junos) encapsulate only unicast IP packets inside an outer IP header, per RFC 2003. They do not carry the Ethernet-like or multicast/broadcast semantics that PIM requires to form adjacencies and exchange hello messages. GRE, by contrast, supports multicast and broadcast encapsulation, which is why PIM and other multicast routing protocols can run over GRE but not over IP-IP.

Exam trap

JNCIS-ENT often tests the assumption that 'a tunnel is a tunnel' — candidates forget that IP-IP is unicast-only while GRE supports multicast/broadcast, and pick the 'yes, just enable PIM' answer.

How to eliminate wrong answers

Option A is wrong because PIM sparse-mode cannot form adjacencies over an ip-0/0/0 interface — the tunnel simply cannot transport the multicast hellos and join/prune messages PIM needs. Option B is wrong because Junos does not prohibit all routing protocols over IP-IP; unicast protocols like OSPF, IS-IS, and BGP can run over IP-IP tunnels — only multicast-dependent protocols cannot. Option D is wrong because IGMP version 3 is a host-to-router protocol for group membership and has no bearing on whether the IP-IP tunnel can encapsulate multicast traffic in the first place.

Full explanation →

49

MCQhard

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

A.family inet

B.family inet6

C.family iso

D.family mpls

AnswerB

GRE over IPv4 encapsulates the IPv6 payload, so the tunnel's logical unit must carry the inner protocol. Configuring family inet6 on gr-0/0/0/0 assigns the IPv6 address and enables IPv6 processing across the tunnel, satisfying the requirement to pass IPv6 traffic over the IPv4 transport.

Why this answer

The GRE tunnel is being used to carry IPv6 traffic, so the logical unit must be configured with family inet6 to process IPv6 packets. The transport is IPv4, but that is handled by the tunnel's source/destination addresses configured under the tunnel parameters, not by the unit's family. Configuring family inet6 on the gr- interface unit enables IPv6 forwarding, addressing, and protocol processing inside the tunnel.

Exam trap

JNCIS-ENT often tests the distinction between the tunnel transport family and the payload family, tricking candidates into selecting family inet simply because the outer transport is IPv4.

How to eliminate wrong answers

Option A is wrong because family inet would configure the unit to process IPv4 payloads, not the IPv6 traffic the tunnel is meant to carry. Option C is wrong because family iso is used for IS-IS routing over OSI CLNP, which is unrelated to carrying IPv6 over GRE. Option D is wrong because family mpls is used for MPLS label switching over the interface, not for IPv6 payload forwarding.

Full explanation →

50

MCQmedium

You have a Level 1/Level 2 router connecting two areas. How does it advertise itself to Level 1 routers?

A.It requires a manual default-route configuration on all L1 routers.

B.It floods the entire Level 2 LSDB into the Level 1 area.

C.It sends a specific inter-area TLV to all neighbors.

D.It advertises a default route using the ATT bit.

AnswerD

A Level 1/Level 2 router sets the ATT (Attached) bit in its Level 1 LSPs. Level 1 routers interpret this bit as indicating the router is attached to another area and install a default route towards it, avoiding a full Level 2 database.

Why this answer

A Level 1/Level 2 (L1/L2) router attaches the ATT (Attached) bit to the IS-IS LSP it floods into the Level 1 area, signaling to L1 routers that it can reach other areas. L1 routers then install a default route (0/0) pointing toward the nearest L1/L2 router that has the ATT bit set, allowing them to reach destinations outside their area without needing the full L2 topology.

Exam trap

The trap is assuming L1/L2 routers leak L2 routes into L1 — they do not; they only set the ATT bit, and L1 routers generate a default route themselves based on that bit.

How to eliminate wrong answers

Option A is wrong because manual default-route configuration is not required — the ATT bit mechanism provides automatic default routing for L1 routers. Option B is wrong because flooding the entire L2 LSDB into the L1 area would defeat the purpose of area separation and is not how IS-IS operates; L1 and L2 maintain separate link-state databases. Option C is wrong because there is no separate 'inter-area TLV' used for this purpose — the ATT bit is a flag within the existing IS-IS LSP, not a distinct TLV type for inter-area advertisement.

Full explanation →

51

MCQhard

You are performing a pre-check for an ISSU on an MX series router. You execute 'request system software in-service check' and the system reports an error indicating that graceful restart or NSR is not properly configured for active routing protocols. How do you resolve this?

A.Manually restart the routing protocol daemon (rpd) on both Routing Engines simultaneously.

B.Configure Nonstop Active Routing (NSR) or Graceful Restart for all active interior and exterior routing protocols before re-running the check.

C.Disable GRES to bypass protocol state verification checks.

D.Set the virtual-chassis mastership-priority to 255 on both routing engines.

AnswerB

ISSU requires graceful restart or NSR so routing protocols maintain forwarding state across the software upgrade. Enabling NSR or graceful restart on all active interior and exterior protocols satisfies the pre-check constraint, allowing the in-service check to pass before proceeding.

Why this answer

ISSU on MX routers requires that graceful restart (GR) or nonstop active routing (NSR) be configured for all active routing protocols so that protocol state is preserved across the Routing Engine switchover. The in-service check explicitly validates this; the fix is to enable NSR or GR for the relevant IGPs and BGP before re-running the check. Without it, ISSU cannot proceed safely.

Exam trap

JNCIS-ENT often tests that ISSU prerequisites include NSR/GR for all active protocols — candidates mistakenly think disabling GRES or restarting rpd is a valid workaround.

How to eliminate wrong answers

Option A is wrong because manually restarting rpd on both Routing Engines simultaneously would cause a full protocol restart and outage — the opposite of ISSU's goal. Option C is wrong because disabling GRES bypasses the very mechanism ISSU relies on for stateful switchover; it does not resolve the check failure. Option D is wrong because virtual-chassis mastership-priority is irrelevant on an MX router (MX uses RE mastership, not VC) and does not address protocol state preservation.

Full explanation →

52

MCQhard

You are troubleshooting a Virtual Chassis where member 0 has failed completely. The replacement switch arrives. Before inserting it into the running Virtual Chassis ring, what critical precaution must be taken regarding Junos OS software versions?

A.Ensure the replacement switch is running the exact same major and minor version of Junos OS as the existing Virtual Chassis master.

B.Disable LACP on all aggregated links across the stack.

C.Format the flash memory of the existing master switch before inserting the replacement.

D.Change the root password of the replacement switch to match the backup routing engine.

AnswerA

Virtual Chassis members must run identical Junos OS major and minor versions; mismatched software prevents the replacement from joining the fabric or causes protocol errors. Verifying the version matches the master before insertion satisfies this compatibility requirement.

Why this answer

A Virtual Chassis requires all member switches to run compatible Junos OS versions — specifically the same major and minor release — before the new member joins the fabric. If the replacement switch runs a different release, it may fail to join, cause mastership election issues, or destabilize the entire VC. The safe practice is to match the master's Junos version before insertion.

Exam trap

The trap is assuming any Junos version will work in a Virtual Chassis; candidates must remember that major and minor versions must match, and unrelated features like LACP or root passwords are distractors.

How to eliminate wrong answers

Option B is wrong because LACP on aggregated links is unrelated to Virtual Chassis membership and does not need to be disabled for a new member to join. Option C is wrong because formatting the existing master's flash would destroy the running configuration and crash the VC — a catastrophic action, not a precaution. Option D is wrong because matching root passwords has no effect on VC formation; authentication for VC is handled by the internal VC protocol, not the root password.

Full explanation →

53

MCQmedium

You are a network administrator for a company using Juniper EX Series switches. You have an iBGP session between two routers in the same AS. You notice that routes learned from one iBGP peer are not being advertised to another iBGP peer. What is the default behavior of iBGP that explains this?

A.The AS path loop prevention detects the local AS and discards the route.

B.The next-hop attribute is not changed, so the route is considered invalid.

C.iBGP requires a full mesh, so routes are only advertised to eBGP peers.

D.iBGP split horizon: routes learned from an iBGP peer are not advertised to other iBGP peers.

AnswerD

By default, iBGP enforces split horizon, meaning a route learned from an iBGP peer is not advertised to another iBGP peer. This prevents routing loops within the AS. To allow propagation, you must configure either a full mesh, route reflectors, or confederations.

Why this answer

iBGP split horizon is the default behavior that prevents a route learned from one iBGP peer from being advertised to another iBGP peer. This is designed to prevent routing loops within an AS. To allow route propagation, you must use a full mesh, route reflectors, or confederations.

Exam trap

The trap here is assuming that iBGP automatically propagates routes to all peers, when in fact split horizon prevents this without additional configuration.

Full explanation →

54

MCQmedium

You are configuring IS-IS on a Juniper router and want to verify the adjacency state with a neighbor. You issue the command 'show isis adjacency'. The output shows the neighbor's system ID, interface, and state as 'Up'. However, you notice that the 'Holdtime' field is decreasing. What does this indicate?

A.The neighbor is not sending hellos, and the adjacency will soon go down.

B.There is an authentication mismatch causing the holdtime to decrease.

C.The interface is flapping, causing the holdtime to decrement.

D.The adjacency is stable and hellos are being received.

AnswerD

The 'Holdtime' field in the 'show isis adjacency' output indicates the remaining time before the adjacency is declared down if no hello is received. A decreasing holdtime means that hellos are being received and the timer is being refreshed. As long as hellos continue to arrive, the holdtime will reset to its maximum value. Therefore, a decreasing holdtime is normal and indicates a stable adjacency.

Why this answer

In IS-IS, the holdtime is the amount of time a router waits for a hello before declaring the adjacency down. The holdtime is reset each time a hello is received. In the 'show isis adjacency' output, the holdtime value decreases as time passes since the last hello, but it will reset when the next hello arrives.

This is normal behavior for an 'Up' adjacency. Therefore, a decreasing holdtime indicates that hellos are being received and the adjacency is stable.

Exam trap

The trap here is interpreting a decreasing holdtime as a sign of trouble, when it is actually a normal indicator of an active hello exchange.

Full explanation →

55

Multi-Selectmedium

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Select 3 answers

A.MACsec Key Agreement (MKA)

B.Dynamic ARP Inspection (DAI)

C.DHCP Snooping

D.IP Source Guard

E.Spanning Tree Root Protection

AnswersB, C, D

Dynamic ARP Inspection validates ARP packets against trusted DHCP snooping bindings, discarding spoofed replies. It belongs to the secure access port suite because it protects the access edge from ARP poisoning, satisfying the stem's requirement for features bundled under that Junos OS security framework.

Why this answer

The secure access port feature suite in Junos OS is designed to protect the access layer from Layer 2 attacks, and it comprises Dynamic ARP Inspection (DAI), DHCP Snooping, and IP Source Guard. Option B (Dynamic ARP Inspection) is correct because DAI validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and MITM attacks on access ports. Option C (DHCP Snooping) is correct because it builds and maintains the trusted binding table of IP-to-MAC mappings and blocks rogue DHCP servers, serving as the foundation for DAI and IP Source Guard.

Option D (IP Source Guard) is correct because it uses the DHCP snooping database to filter traffic and prevent IP/MAC spoofing on untrusted access ports. Option A (MACsec Key Agreement) is not part of this suite; MKA is a Layer 2 encryption key management protocol for MACsec, a separate security feature. Option E (Spanning Tree Root Protection) is a Layer 2 loop-prevention STP enhancement, not a secure access port feature.

Full explanation →

56

MCQeasy

An administrator is configuring Graceful Restart on a pair of Juniper MX series routers running OSPF. What is the primary purpose of Graceful Restart in this scenario?

A.To instantly drop all adjacencies and force an immediate full SPF recalculation across the network.

B.To ensure uninterrupted data packet forwarding while the control plane routing protocol restarts.

C.To automatically upgrade Junos OS images without rebooting the forwarding plane.

D.To synchronize firewall filter counters between primary and backup Routing Engines.

AnswerB

Graceful Restart preserves forwarding entries in the data plane while the OSPF control plane restarts, so traffic continues flowing. This satisfies the stem's requirement of uninterrupted packet forwarding during the routing protocol restart on the MX routers.

Why this answer

Graceful Restart (GR) in OSPF allows a router to restart its control plane (routing protocol process) while the forwarding plane continues to forward packets uninterrupted. The router signals its neighbors that it is restarting, and they continue to advertise the restarting router's links as if it were still up, preventing a full SPF recalculation and traffic loss. This ensures uninterrupted data forwarding during the restart.

Exam trap

The trap is confusing Graceful Restart with other high-availability features like NSR or ISSU; candidates might think GR involves rebooting both REs or dropping adjacencies, but it specifically maintains forwarding while the control plane restarts.

How to eliminate wrong answers

Option A is wrong because Graceful Restart does not drop adjacencies; it maintains them during the restart to avoid SPF recalculation. Option C is wrong because Graceful Restart is not about upgrading Junos OS images; it is about protocol restart. Option D is wrong because synchronizing firewall filter counters is unrelated to Graceful Restart; that is a function of stateful firewall synchronization or RE redundancy.

Full explanation →

57

MCQeasy

Which command allows an administrator to view the OSPF link-state database (LSDB) summary on a Junos device?

A.show ospf neighbor

B.show route protocol ospf

C.show ospf database

D.show ospf interface

AnswerC

The 'show ospf database' operational command queries the router's link-state advertisements, displaying the LSDB contents and summary per area and LSA type. It directly satisfies the requirement to view the OSPF link-state database summary on a Junos device.

Why this answer

The command 'show ospf database' displays the OSPF link-state database (LSDB) summary, including all LSAs (Router, Network, Summary, External) and their details. This is the correct command to view the LSDB on a Junos device.

Exam trap

The trap is confusing commands that show OSPF neighbors, routes, or interfaces with the command that shows the LSDB; candidates must remember that 'show ospf database' is specifically for the LSDB.

How to eliminate wrong answers

Option A is wrong because 'show ospf neighbor' displays OSPF neighbor adjacencies, not the LSDB. Option B is wrong because 'show route protocol ospf' shows routes learned via OSPF in the routing table, not the LSDB. Option D is wrong because 'show ospf interface' displays OSPF interface parameters (area, cost, state), not the LSDB.

Full explanation →

58

MCQeasy

An administrator needs to view the MAC address learning table on an EX Series switch to verify which switchport a specific server is connected to. Which operational command should be used?

A.show mac-address-table

B.show ethernet-switching table

C.show vlans mac-table

D.show bridge-domain mac-table

AnswerB

The show ethernet-switching table command displays learned MAC addresses with their associated VLAN and switchport, letting the administrator confirm which port the server attaches to. This satisfies the requirement to view the MAC learning table.

Why this answer

On Juniper EX Series switches, the MAC address learning table is exposed through the ethernet-switching subsystem, so the correct operational command is 'show ethernet-switching table'. This command displays learned MAC addresses, their associated VLANs, and the egress switchport, allowing the administrator to map a server's MAC to the exact interface it is connected to.

Exam trap

JNCIS-ENT often tests candidates who carry Cisco IOS muscle memory into Junos, so the trap is picking 'show mac-address-table' — a valid Cisco command that simply does not exist on Junos EX switches.

How to eliminate wrong answers

Option A is wrong because 'show mac-address-table' is Cisco IOS syntax and is not a valid Junos operational command on EX Series switches. Option C is wrong because 'show vlans mac-table' is not a valid Junos command; VLAN information is viewed with 'show vlans' but MAC entries are not exposed through that syntax. Option D is wrong because 'show bridge-domain mac-table' is not a valid Junos command — bridge domains are an MX/ACX construct and the syntax does not apply to EX ethernet-switching tables.

Full explanation →

59

Multi-Selectmedium

Which of the following are valid IS-IS interface types? (Choose TWO)

Select 2 answers

A.mesh

B.star

C.point-to-point

D.broadcast

E.passive

AnswersC, D

Point-to-point is a valid IS-IS interface type, satisfying the stem's requirement for genuine interface types. IS-IS recognises broadcast, point-to-point, and passive interfaces; point-to-point forms adjacencies between exactly two routers without electing a Designated Intermediate System, unlike broadcast links. This makes it a legitimate answer alongside broadcast.

Why this answer

In IS-IS, the two valid interface (circuit) types are point-to-point and broadcast, so options C and D are correct. A point-to-point interface (C) is used on links such as serial or point-to-point Ethernet subinterfaces, where IS-IS forms an adjacency without a DIS election and uses the Point-to-Point Three-Way Handshake (RFC 5303). A broadcast interface (D) is used on multi-access media like Ethernet, where IS-IS elects a Designated Intermediate System (DIS) and uses Level 1/Level 2 LAN IIHs.

The other options are not IS-IS interface types: mesh (A) and star (B) describe topology shapes, not IS-IS circuit types, and passive (E) is an interface state/configuration (passive-interface) that suppresses adjacency formation, not a valid IS-IS interface type.

Full explanation →

60

Multi-Selectmedium

An engineer is configuring a static route with multiple qualified next hops to provide load balancing and redundancy. Which TWO statements are true regarding qualified next hops in Junos? (Choose two.)

Select 2 answers

A.Qualified next hops can have different preferences, and the one with the lowest preference is preferred.

B.Qualified next hops can only be used with IPv6 routes.

C.Qualified next hops can be used to load-balance traffic across multiple next hops when they have the same preference.

D.Qualified next hops automatically create a condition that must be met for the route to be active.

E.Qualified next hops must be directly connected to the router.

AnswersA, C

Qualified next hops allow you to assign a preference value to each next hop. The next hop with the lowest preference value is preferred and installed in the routing table. If that next hop becomes unreachable, the next hop with the next lowest preference is used. This provides backup path functionality.

Why this answer

Qualified next hops allow multiple next hops with preferences. They can be used for backup (different preferences) or load balancing (same preference). They are not limited to directly connected next hops and work for both IPv4 and IPv6.

Conditions are separate and must be explicitly configured.

Exam trap

The trap here is confusing qualified next hops with conditions, or assuming they are limited to directly connected next hops.

Full explanation →

61

MCQhard

You are troubleshooting an OSPF network where an NSSA area is connected to the backbone via an ABR. External routes are being injected into the NSSA by an ASBR. Which router is responsible for translating Type 7 LSAs into Type 5 LSAs before flooding them into the backbone area?

A.The NSSA ABR

B.The ASBR that originally injected the external route

C.Any internal router residing within the NSSA backbone

D.The designated router (DR) of the NSSA segment

AnswerA

The NSSA ABR performs Type 7 to Type 5 translation, converting LSAs originated by the ASBR inside the not-so-stubby area before flooding them into the backbone. The ASBR originates Type 7 LSAs but does not translate them.

Why this answer

In OSPF NSSA, external routes are injected as Type 7 LSAs by the ASBR. The NSSA ABR is responsible for translating Type 7 LSAs into Type 5 LSAs before flooding them into the backbone area (Area 0), because Type 7 LSAs are only flooded within the NSSA. This translation allows external routes to be propagated to the rest of the OSPF domain.

Exam trap

JNCIS-ENT often tests the specific router responsible for Type 7-to-Type 5 translation — candidates frequently pick the ASBR instead of the NSSA ABR.

How to eliminate wrong answers

Option B is wrong because the ASBR originates Type 7 LSAs but does not perform the Type 7-to-Type 5 translation — that is the ABR's role. Option C is wrong because internal routers within the NSSA do not translate LSAs; only the ABR at the NSSA boundary does. Option D is wrong because the DR is responsible for flooding LSAs on a segment, not for translating Type 7 to Type 5.

Full explanation →

62

MCQhard

You are configuring multi-topology IS-IS. What does this allow?

A.Load balancing over different physical paths.

B.Creating multiple areas within a single instance.

C.Increasing the maximum MTU.

D.Running separate topologies for different address families.

AnswerD

Multi-topology IS-IS runs independent link-state topologies per address family, so IPv4 and IPv6 can use different paths. This satisfies the scenario's requirement to separate topologies for different address families, rather than forcing both to share one common topology.

Why this answer

Multi-topology IS-IS allows for separate routing topologies for different protocol families (e.g., IPv4 and IPv6).

Full explanation →

63

Multi-Selecthard

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

Select 3 answers

A.MACsec pre-shared keys configured on all access ports

B.Dynamic ARP Inspection enabled on the specific VLAN

C.Configured static ARP inspection bindings for every client

D.Trusted ports configured on uplinks toward DHCP servers or core routers

E.DHCP snooping enabled on the respective VLAN

AnswersB, D, E

Dynamic ARP Inspection must be enabled on the specific VLAN to be active; it validates ARP packets against the DHCP snooping binding database for that VLAN. Without VLAN-level enablement, DAI does not inspect traffic, so this component is required.

Why this answer

Dynamic ARP Inspection on EX Series switches requires three things to work: DAI must be enabled on the specific VLAN (option B), because the inspection policy is applied per-VLAN and ARP packets are validated only on VLANs where DAI is explicitly turned on. Trusted ports must be configured on uplinks toward DHCP servers or core routers (option D), since DAI drops ARP packets on untrusted ports that fail validation, while trusted ports bypass inspection so legitimate infrastructure ARP traffic is not blocked. DHCP snooping must be enabled on the respective VLAN (option E), because DAI relies on the DHCP snooping binding database to validate ARP packet IP-to-MAC mappings; without it, DAI has no trusted binding source and will drop valid ARP traffic.

Option A is incorrect because MACsec is a Layer 2 encryption protocol unrelated to DAI operation. Option C is incorrect because static ARP inspection bindings are not required for every client; DAI uses dynamic DHCP snooping bindings, and static bindings are only optional for hosts with static IPs.

Full explanation →

64

MCQmedium

You are configuring port security on an EX Series switch. The security policy states that when a MAC limit is exceeded on an access port, the port should be shut down and remain down until manually re-enabled by an administrator. Which configuration action accomplishes this requirement?

A.Configure the interface with 'mac-limit limit 1 action none'.

B.Configure the interface with 'mac-limit limit 1 action log'.

C.Configure the interface with 'mac-limit limit 1 action drop'.

D.Configure the interface with 'mac-limit limit 1 action shutdown'.

AnswerD

The 'action shutdown' option causes the interface to be disabled when the MAC limit is exceeded. The port remains shut down until an administrator manually clears the error or re-enables the interface, exactly matching the security policy requirement.

Why this answer

The 'action shutdown' parameter in the MAC limit configuration causes the interface to be disabled when the configured limit is exceeded. The port remains in a shut down state until an administrator manually intervenes, which aligns with the requirement to keep the port down until manually re-enabled.

Exam trap

The trap here is confusing the 'drop' action with 'shutdown', as 'drop' only discards violating traffic without disabling the port.

Full explanation →

65

MCQeasy

An administrator configures a BGP policy to reject routes with an AS_PATH containing a specific AS number. Which match condition in a Junos routing policy is used to evaluate the AS_PATH?

A.pref

B.metric

C.as-path

D.community

AnswerC

The `as-path` match condition evaluates a route's AS_PATH attribute against a regular expression, directly satisfying the requirement to reject routes containing a specific AS number. Junos applies this condition within a policy term, so any path whose AS sequence matches the expression is filtered before advertisement or installation.

Why this answer

In Junos, the as-path match condition evaluates routes against a defined as-path regular expression.

Full explanation →

66

MCQmedium

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

A.The interface automatically recovers after a default hold-down timer of 300 seconds.

B.The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.

C.The interface drops violating packets but remains operationally up until manually disabled.

D.The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

AnswerB

A violation triggers the configured shutdown, placing the interface in a disabled state that persists until an administrator intervenes. Restoration requires clearing the port security error via the clear ethernet-switching port-error command, or administratively disabling then re-enabling the interface. This satisfies the stem's requirement for the default operational state and recovery method.

Why this answer

When port security is configured with 'action-on-violation shutdown' on an EX switch, a violation causes the interface to be disabled (err-disabled). It does not automatically recover; the administrator must manually clear the violation using 'clear ethernet-switching port-error' or by disabling and re-enabling the interface. This is the documented default behavior for shutdown action.

Exam trap

The trap is assuming automatic recovery after a hold-down timer — Junos port security shutdown requires manual intervention, unlike some other vendors' err-disable recovery features.

How to eliminate wrong answers

Option A is wrong because there is no default 300-second hold-down timer for port security violations on EX switches — recovery is manual, not automatic. Option C is wrong because 'action-on-violation shutdown' disables the interface entirely, not just drops violating packets while staying up. Option D is wrong because the interface does not transition to a blocked state with periodic MAC table flushes — it is simply disabled until manually cleared.

Full explanation →

67

Multi-Selectmedium

Which THREE characteristics distinguish GRE tunnels from IP-IP tunnels on Junos devices? (Choose three)

Select 3 answers

A.IP-IP tunnels require a specialized Routing Engine hardware card.

B.GRE supports optional features like checksums and keys.

C.GRE uses IP protocol number 47 in the outer header.

D.GRE supports encapsulation of multicast and broadcast traffic.

E.IP-IP tunnels inherently encrypt all transmitted data payloads.

AnswersB, C, D

GRE's header carries optional fields, including checksum and key, that IP-IP lacks entirely. This satisfies the stem's requirement to distinguish the two encapsulation types: IP-IP adds only a bare outer IP header, offering no such optional verification or identification fields.

Why this answer

Option B is correct because GRE headers include optional fields such as Checksum and Key that IP-IP (IP protocol 4) headers do not provide, allowing integrity verification and tunnel identification. Option C is correct because GRE is identified by IP protocol number 47 in the outer IP header, whereas IP-IP uses protocol number 4. Option D is correct because GRE can carry multicast and broadcast traffic by encapsulating it in a unicast GRE packet, while IP-IP is limited to unicast IP payloads.

Option A is wrong because IP-IP tunnels are a software feature on Junos and do not require a specialized Routing Engine hardware card. Option E is wrong because IP-IP provides encapsulation only and does not inherently encrypt payloads; encryption would require IPsec.

Exam trap

JNCIS-ENT often tests the distinction between GRE and IP-IP by emphasizing GRE's optional features and protocol number, while candidates may incorrectly assume IP-IP provides encryption or requires special hardware.

Full explanation →

68

MCQmedium

While reviewing OSPF logs on a Junos device, you notice frequent adjacency flaps. You suspect a mismatch in the OSPF timer configurations. Which two timers must match identically on adjacent OSPF interfaces for an adjacency to form?

A.Hello interval and Dead interval

B.Reference bandwidth and Cost metric

C.SPF delay timer and Hold timer

D.Retransmit interval and Poll interval

AnswerA

OSPF neighbours exchange Hello packets at the Hello interval; the Dead interval is the silence period before declaring the neighbour down. Both values must match identically on adjacent interfaces, otherwise the router tears down the adjacency, producing exactly the frequent flaps observed in the logs.

Why this answer

OSPF Hello and Dead intervals are critical parameters that must match identically on connected interfaces; otherwise, hello packets are rejected or dead timers expire prematurely.

Full explanation →

69

MCQmedium

What does the 'show isis statistics' command reveal?

A.The number of received and transmitted PDUs.

B.The current SPF calculation time.

C.The database size in bytes.

D.The adjacency hold-time.

AnswerA

The `show isis statistics` command on Junos devices reports per-PDU-type counters, including the number of received and transmitted IS-IS protocol data units such as hellos, link-state PDUs and sequence-number PDUs. This directly satisfies the stem's requirement, revealing PDU receive and transmit counts rather than adjacency state or routing table entries.

Why this answer

This command displays the number of PDUs sent and received by the IS-IS process.

Full explanation →

70

MCQmedium

You are configuring Multiple Spanning Tree Protocol (MSTP) across multiple EX Series switches in your enterprise network. Which three parameters must be identical across all switches to ensure they belong to the same MST region?

A.Bridge priority, root identifier, and Hello timer

B.Configuration name, revision number, and VLAN-to-instance mapping

C.Forward delay, max age, and region password

D.MAC address, system ID extension, and MST digest

AnswerB

MSTP region membership is defined by three identical attributes: the configuration name, the revision number, and the VLAN-to-instance mapping table. Any mismatch in these causes switches to belong to different regions, breaking the intended single spanning-tree topology across the EX Series estate.

Why this answer

MST region configuration requires identical configuration name, revision number, and VLAN-to-instance mapping.

Full explanation →

71

MCQmedium

You need to configure filter-based forwarding (FBF) to route traffic from a specific subnet (192.168.1.0/24) through an alternate next-hop gateway. Which components are required to implement this successfully?

A.A static route pointing to the alternate gateway with a preference of 1.

B.A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the ingress interface.

C.An export routing policy with a load-balance action applied globally.

D.A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the egress interface.

AnswerB

Filter-based forwarding requires exactly these three elements: a stateless firewall filter matching the source subnet, a routing-instance action redirecting matched traffic, and filter application on the ingress interface. The custom routing instance holds the alternate next-hop, satisfying the requirement to divert 192.168.1.0/24 away from the default forwarding table.

Why this answer

Filter-based forwarding in Junos requires three elements working together: a stateless firewall filter that matches the traffic and applies a 'routing-instance' action, a custom routing instance (typically type forwarding) containing the alternate next-hop route, and the filter applied as an input filter on the ingress interface where the traffic arrives. The routing-instance action causes matched packets to be looked up in that instance's table instead of the main inet.0 table.

Exam trap

The trap is the direction of filter application — candidates who have only seen firewall filters as security tools often assume egress application, but FBF must intercept traffic before the forwarding lookup, i.e., on ingress.

How to eliminate wrong answers

Option A is wrong because a static route with preference 1 in the main table would affect all traffic to that destination, not selectively redirect the 192.168.1.0/24 subnet, and preference alone provides no match criteria. Option C is wrong because an export policy with load-balance has nothing to do with FBF — export policies control what routes are advertised into a protocol, not how transit packets are forwarded. Option D is wrong because applying the filter to the egress interface is too late: the forwarding decision has already been made using the main table, so the routing-instance action would never take effect.

Full explanation →

72

MCQeasy

Which OSPF packet type is used to acknowledge the receipt of Link-State Updates (LSUs) to ensure reliable flooding?

A.Database Description (Type 2)

B.Link-State Request (Type 3)

C.Hello (Type 1)

D.Link-State Acknowledgment (Type 5)

AnswerD

Link-State Acknowledgment (Type 5) packets explicitly acknowledge received LSUs, providing the reliability OSPF requires for flooding. Unlike implicit acknowledgement via echoed LSAs, Type 5 packets confirm receipt directly, satisfying the stem's demand for reliable flooding over unreliable transport.

Why this answer

OSPF uses Link-State Acknowledgment (Type 5) packets to explicitly acknowledge the receipt of Link-State Update (LSU) packets, ensuring reliable flooding of LSAs. When a router receives an LSU, it sends an LSAck to confirm receipt; if not acknowledged, the LSU is retransmitted. This mechanism guarantees that all routers in an area receive LSAs reliably.

Exam trap

JNCIS-ENT often tests the distinction between OSPF packet types and their specific roles, especially confusing acknowledgment packets with request or update packets.

How to eliminate wrong answers

Option A is wrong because Database Description (Type 2) packets are used to summarize the link-state database during adjacency formation, not to acknowledge LSUs. Option B is wrong because Link-State Request (Type 3) packets are used to request specific LSAs that are missing or outdated, not to acknowledge receipt. Option C is wrong because Hello (Type 1) packets are used for neighbor discovery and maintaining adjacency, not for acknowledging LSAs.

Full explanation →

73

Multi-Selectmedium

Which TWO actions occur during OSPF link-state database flooding on a Junos routing device? (Choose two)

Select 2 answers

A.The router converts the link-state database into BGP path attributes.

B.The router immediately deletes all static routes from the routing table.

C.The router resets all active neighbor adjacencies across the entire device.

D.The router updates its link-state database (LSDB) with the received LSA and acknowledges it.

E.The router floods the LSA out all other OSPF-enabled interfaces belonging to that area.

AnswersD, E

On receipt of an LSA, the Junos device installs it into its link-state database and returns a Link-State Acknowledgment, ensuring reliable flooding. This satisfies the flooding action of updating the LSDB while confirming receipt to the sender.

Why this answer

Option D is correct because when a Junos router receives an LSA during OSPF flooding, it installs the LSA into its link-state database (LSDB), runs the SPF algorithm if the topology changed, and sends a Link State Acknowledgment back to the sender to confirm reliable receipt. Option E is correct because OSPF flooding requires the router to forward (flood) the received LSA out all other OSPF-enabled interfaces in the same area, excluding the interface on which the LSA was received, so that every router in the area maintains an identical LSDB. Option A is wrong because OSPF LSAs are never converted into BGP path attributes; OSPF and BGP are separate protocols with independent databases and attributes.

Option B is wrong because flooding an LSA does not cause static routes to be deleted from the routing table. Option C is wrong because OSPF flooding does not reset all neighbor adjacencies on the device; adjacencies remain up and only the LSDB is updated and the LSA is re-flooded.

Exam trap

The trap is confusing flooding with adjacency resets or route redistribution — candidates may think flooding triggers neighbor resets or BGP updates, but flooding is strictly an OSPF LSDB synchronization mechanism.

Full explanation →

74

MCQeasy

Which statement accurately describes port security MAC-limit behavior?

A.It statically assigns all learned MAC addresses to the switch configuration file automatically.

B.It defines the maximum bandwidth a single MAC address can consume on a port.

C.It prevents MAC address spoofing by validating IP bindings against DHCP tables.

D.It restricts the maximum number of MAC addresses that can be learned on a secure interface.

AnswerD

The MAC-limit parameter caps how many source MAC addresses a secure interface may learn, dropping or logging frames beyond the configured threshold. This directly satisfies the stem's requirement by binding learned entries to a defined maximum, preventing MAC flooding attacks on access ports.

Why this answer

Port security MAC-limit restricts the maximum number of MAC addresses learned on a secure interface.

Full explanation →

75

MCQmedium

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

A.mt-

B.ip-

C.gr-

D.st-

AnswerB

Junos reserves the ip- prefix for IP-IP tunnel interfaces, created as ip-0/0/0, distinct from gr- (GRE) and gre-. Configuring the tunnel logical unit under this interface type satisfies the requirement to build an IP-IP tunnel in the CLI.

Why this answer

In Junos, IP-IP tunnels are configured on interfaces with the 'ip-' prefix (e.g., ip-0/0/0). This naming convention distinguishes IP-IP tunnels from other tunnel types like GRE (gr-), multicast tunnels (mt-), and generic routing encapsulations. The 'ip-' interface is specifically designated for IP-in-IP encapsulation as defined in RFC 2003.

Exam trap

JNCIS-ENT often tests the specific interface prefix for each tunnel type; candidates frequently confuse 'ip-' with 'gr-' or 'mt-' because they don't memorize the Junos naming conventions.

How to eliminate wrong answers

Option A is wrong because 'mt-' interfaces are used for multicast tunnels, not IP-IP tunnels. Option C is wrong because 'gr-' interfaces are used for GRE tunnels, which encapsulate a wider variety of protocols. Option D is wrong because 'st-' interfaces are used for source-and-destination-based tunnels, not IP-IP.

Full explanation →

Page 1 of 5

All pages

Practice JNCIS-ENT by domain

Target a specific domain to shore up weak areas.

IS IS BGP Spanning Tree OSPF High Availability Protocol Independent Routing Tunnels Layer 2 Switching And VLANs Layer 2 Security

See all domains with question counts →