Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) JNCIS-ENT Questions 1–75 | Page 1/7

MCQmedium

You notice that an EX Series switch is experiencing frequent topology changes, causing intermittent packet drops across VLANs. Which command helps identify which specific interface is generating the topology changes?

A.show spanning-tree bridge detail

B.show interfaces diagnostics optics

C.show rstp topology-changes

D.show spanning-tree statistics

AnswerD

Per-interface topology change counters help identify unstable links causing TC floods.

Why this answer

The command 'show spanning-tree statistics' displays topology change counts per interface, enabling administrators to isolate the unstable port.

Full explanation →

Multi-Selectmedium

Which TWO statements are true regarding aggregate routes in Junos OS? (Choose two)

Select 2 answers

A.Aggregate routes have a default preference of 130 in Junos.

B.Aggregate routes have a default preference of 130.

C.An aggregate route automatically forwards traffic even if no contributing routes exist.

D.Aggregate routes require a physical interface to be specified as the next-hop.

E.Aggregate routes can be used to summarize multiple static or dynamic routes into a single advertisement.

AnswersB, E

The default preference for aggregate routes in Junos is indeed 130.

Why this answer

Aggregate routes summarize more-specific routes and do not forward traffic themselves unless paired with discard/reject or resolved via contributing routes.

Full explanation →

Multi-Selecteasy

Which TWO statements describe characteristics of port security in Junos OS? (Choose two)

Select 2 answers

A.It requires MACsec encryption to be active on the port before enforcing limits.

B.Configurable violation actions include drop, restrict, and shutdown.

C.It inspects DHCP lease transactions to build IP-to-MAC binding databases.

D.It can limit the number of learned MAC addresses on a specific interface.

E.It automatically enables 802.1X supplicant authentication on access ports.

AnswersB, D

These are the three standard violation actions available in Junos port security.

Why this answer

Port security allows limiting MAC addresses and taking actions like drop, restrict, or shutdown upon violation.

Full explanation →

MCQmedium

How do you configure an interface to be point-to-point when using IS-IS?

A.set protocols isis interface-type point-to-point

B.set interfaces <name> unit 0 family iso point-to-point

C.set protocols isis link-type p2p

D.set protocols isis interface <name> point-to-point

AnswerD

This is the correct Junos CLI path.

Why this answer

You use the 'set protocols isis interface <name> point-to-point' command to force point-to-point mode.

Full explanation →

MCQhard

An enterprise network requires QinQ tunneling where the outer tag EtherType must be explicitly set to 0x88a8 (802.1ad) instead of the standard 0x8100. Where is the custom outer TPID configured on a Junos EX Series switch?

A.set interfaces ge-0/0/0 unit 0 family ethernet-switching outer-tpid 88a8

B.set ethernet-switching-options tpid 88a8

C.set vlans vlan-id 100 tpid 0x88a8

D.set protocols dot1ad tp-id 88a8

AnswerA

Correct. The outer-tpid is configured on the interface handling the QinQ tunnel.

Why this answer

Custom outer tag protocol identifiers (TPID) for QinQ are configured under the [edit interfaces <interface-name> unit 0 family ethernet-switching outer-tpid] or similar interface/switching options hierarchy.

Full explanation →

Multi-Selecthard

When configuring a routing instance of type 'virtual-router', which THREE characteristics apply? (Choose three)

Select 3 answers

A.It requires MPLS label distribution protocols to function.

B.Interfaces can be assigned directly to the virtual-router instance.

C.It supports dynamic interior routing protocols like OSPF and IS-IS.

D.Route leaking between virtual-router and inet.0 is strictly prohibited by Junos architecture.

E.It maintains independent routing tables separate from inet.0.

AnswersB, C, E

Interfaces are bound directly into the routing-instances hierarchy.

Why this answer

Virtual routers have independent routing tables, support dynamic routing protocols, and operate separately from inet.0.

Full explanation →

Multi-Selectmedium

Which THREE parameters are included when calculating the MST region configuration digest? (Choose three.)

Select 3 answers

A.VLAN-to-instance mapping table

B.Configuration name

C.Root bridge MAC address

D.Bridge priority value

E.Revision number

AnswersA, B, E

VLAN allocations to MST instances dictate the digest hash.

Why this answer

The MST configuration digest is an MD5 hash calculated from the region configuration name, the revision number, and the complete VLAN-to-instance mapping table.

Full explanation →

MCQeasy

An administrator wants to modify the Local Preference attribute for all routes received from a specific external BGP peer. Where must this policy be applied in Junos?

A.Import policy applied to the eBGP neighbor or group

B.Export policy applied to the eBGP group

C.Forwarding plane firewall filter

D.Global system-level static route policy

AnswerA

Import policies applied to eBGP peers can set local-preference since it is an iBGP attribute applied upon entry.

Why this answer

Inbound routing policies on Junos affect attributes like Local Preference before path selection occurs.

Full explanation →

MCQmedium

An administrator is configuring a new point-to-point link between two Junos routers running IS-IS. By default, how does IS-IS handle adjacency establishment on a point-to-point link compared to a broadcast link?

A.It uses a 3-way handshake TLV in IIH packets and bypasses the DIS election process entirely.

B.It relies strictly on CSNPs sent every 10 seconds to establish the adjacency.

C.It requires manual mapping of neighbor system IDs using static ARP bindings.

D.It initiates a DIS election using priority values identical to broadcast segments.

AnswerA

Point-to-point links do not require a DIS. They use the 3-way handshake mechanism to ensure reliable adjacency formation.

Why this answer

On point-to-point links, IS-IS uses the 3-way handshake extension (RFC 5303) via IIH packets to verify bidirectional connectivity without holding a DIS election.

Full explanation →

MCQmedium

You need to verify that load balancing is functioning properly across your core interfaces and wish to see the specific hash buckets assigned in the forwarding table. Which command should you execute?

A.show system switchover status

B.show forwarding-options hash-results

C.show route forwarding-table destination 192.168.1.1

D.show pfe statistics load-balance

AnswerC

This displays the forwarding table entry for the destination, detailing all active load-balanced next-hops.

Why this answer

The show route forwarding-table destination command displays the next-hops and whether multiple equal-cost paths (load balancing) are active for a destination.

Full explanation →

Multi-Selectmedium

Which TWO characteristics describe eBGP compared to iBGP? (Choose two)

Select 2 answers

A.Automatic route reflection enabled by default

B.Must reside within the same Autonomous System

C.Peers reside in different Autonomous Systems

D.Default TTL of 1

E.Default Local Preference of 200

AnswersC, D

eBGP connects different ASes.

Why this answer

eBGP peers are typically in different Autonomous Systems and have a default TTL of 1, whereas iBGP peers are in the same AS and have a default TTL of 255.

Full explanation →

MCQmedium

An administrator is configuring eBGP between two Junos devices and notices the session is stuck in the Active state. The direct connection is up, and ping succeeds. Which Junos configuration parameter is most likely missing to resolve this issue?

A.set protocols bgp group ebgp type internal

B.set protocols bgp group ebgp multihop

C.set protocols bgp group ebgp peer-as 65002 multipath

D.set protocols bgp group ebgp local-address 192.168.1.1

AnswerB

The multihop statement increases the TTL allowing eBGP sessions to establish over non-directly connected interfaces like loopbacks.

Why this answer

When establishing eBGP, Junos defaults to expecting the peer to be directly connected with a TTL of 1. If connecting via loopback interfaces or a multi-hop path, the multihop statement is required.

Full explanation →

MCQhard

An administrator configures an aggregate route for 172.16.0.0/16. However, no contributing routes are present in the routing table. What is the default behavior of this aggregate route in Junos OS?

A.It is installed in the routing table with a reject discard next-hop.

B.It installs into the routing table with a next-hop pointing to the local loopback.

C.It floods a default route to all routing instances.

D.It is suppressed and will not be installed in the routing table.

AnswerD

Without contributing routes, an aggregate route is inactive and omitted from the routing table.

Why this answer

An aggregate route in Junos requires at least one contributing (more specific) route to be active in the routing table before it is installed in the routing table and advertised.

Full explanation →

MCQeasy

An administrator wants to check the total number of active VLANs currently configured on a Junos EX Series switch. Which operational command should be used?

A.show ethernet-switching vlan

B.show vlans

C.show vlans summary

D.show bridge-domains

AnswerB

Correct. This command displays all configured VLANs on the device.

Why this answer

The 'show vlans' command provides an overview of all configured VLANs, their associated interfaces, and VLAN IDs.

Full explanation →

MCQhard

An administrator is configuring MSTP on a Junos device and needs to map VLANs 10 through 20 to MST instance 2. Which configuration hierarchy is required to achieve this?

A.set vlans vlan-range 10-20 mst-instance 2

B.set protocols msti instance-id 2 vlan-list 10-20

C.set protocols rstp instance 2 vlan 10-20

D.set protocols mstp configuration region-name Corp revision 1 instance 2 vlan 10-20

AnswerD

This command correctly maps VLANs 10 through 20 to instance 2 within the specified MST configuration block.

Why this answer

In Junos, MSTP region configuration parameters including VLAN mappings are defined under protocols mstp configuration.

Full explanation →

Multi-Selecthard

An enterprise network design requires implementing private VLANs (PVLANs) on an EX Series switch. Which THREE components or port types are characteristic of a private VLAN architecture? (Choose three.)

Select 3 answers

A.Community ports that can communicate with other ports in the same community and promiscuous ports.

B.Isolated ports that can only communicate with promiscuous ports.

C.Promiscuous ports that can communicate with all ports across both primary and secondary VLANs.

D.Routing instance interfaces (RIB-only) that automatically disable Layer 2 bridging.

E.Fully meshed trunk ports that bypass all isolation rules for inter-VLAN routing.

AnswersA, B, C

Correct. Community VLAN ports can talk within their community and to promiscuous ports.

Why this answer

Private VLANs use primary VLANs, secondary isolated/community VLANs, and promiscuous ports for gateway connectivity.

Full explanation →

MCQmedium

You are configuring multiple VLANs on an EX Series switch and wish to set the aging time for learned MAC addresses to 600 seconds. Where is this parameter configured?

A.[edit vlans default ageing-timer 600]

B.[edit protocols l2-learning aging-time 600]

C.[edit system mac-address-table aging-time 600]

D.[edit ethernet-switching-options mac-table aging-time 600]

AnswerD

Correct. Ethernet-switching options govern MAC table aging behavior globally on EX switches.

Why this answer

MAC table aging time in Junos is configured under the [edit bridge-options] or [edit ethernet-switching-options] hierarchy depending on the platform.

Full explanation →

MCQeasy

What is the OSPF router ID format used by Junos OS when initializing the OSPF routing process if no explicit router ID is configured?

A.A 48-bit MAC address

B.An integer value between 1 and 65535

C.A 128-bit IPv6 address

D.A 32-bit IPv4 address format (dotted quad)

AnswerD

Correct. OSPF router IDs are 32-bit values represented as IPv4 addresses.

Why this answer

OSPF router IDs are formatted as a 32-bit dotted-quad number, identical in structure to an IPv4 address.

Full explanation →

Multi-Selecthard

Which factors influence the DIS election on a broadcast link? (Choose TWO)

Select 2 answers

A.System ID

B.SNPA (MAC) address

C.Interface priority

D.Area Address

E.LSP sequence number

AnswersB, C

Secondary tie-breaker.

Why this answer

The DIS is determined by the configured priority and, as a tie-breaker, the SNPA (MAC) address.

Full explanation →

MCQmedium

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

A.OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.

B.OSPF authentication must be disabled globally before running over GRE.

C.GRE tunnels do not support OSPF routing protocol traffic.

D.The tunnel interface must be added to a security zone even on routing devices.

AnswerA

GRE interfaces often require explicit point-to-point network type definition for OSPF to form adjacencies correctly.

Why this answer

OSPF defaults to broadcast network type for multi-access interfaces. GRE tunnels on Junos default to a point-to-point or point-to-multipoint behavior depending on configuration, but often require explicit OSPF network-type point-to-point configuration if mismatched with the remote end.

Full explanation →

MCQmedium

What happens if you have an area address mismatch in a Level 1 adjacency?

A.The adjacency will fail to form.

B.The DIS will override the mismatch.

C.The adjacency will form but no routes will be exchanged.

D.The router will automatically adopt the neighbor's area address.

AnswerA

Area address matching is a hard requirement for L1.

Why this answer

Level 1 adjacencies require the routers to share at least one area address.

Full explanation →

MCQhard

A Junos router receives four identical routes via BGP. Reviewing the routing table, path selection picked route 3. Route 1 has a lower MED, Route 2 has a higher Local Preference, Route 4 is from an eBGP peer while Route 3 is iBGP. Assuming standard default path selection, why was Route 3 chosen over Route 4?

A.Route 3 had a lower router ID than Route 4.

B.Route 3 had a lower MED value.

C.Junos prefers iBGP paths over eBGP paths during the tie-breaking steps.

D.Route 3 was received from a peer with a lower peer IP address.

AnswerC

Junos path selection prefers internal paths over external paths if all prior metrics are identical.

Why this answer

In Junos BGP path selection, after comparing local preference, AS path length, origin type, and MED, Junos prefers internal (iBGP) paths over external (eBGP) paths, provided all other tie-breakers are equal.

Full explanation →

Multi-Selecthard

Which THREE actions occur when a Junos router with GRES and NSR enabled performs a manual Routing Engine switchover while running OSPF and BGP? (Choose three)

Select 3 answers

A.OSPF and BGP daemon states synchronized via NSR allow routing sessions to remain established without neighbor drop.

B.External routing peers see no change in adjacency state and do not trigger route recalculations.

C.The backup Routing Engine assumes control plane mastership without resetting the packet forwarding engine.

D.All physical interfaces are reset and re-initialized, causing a 30-second traffic blackout.

E.All VRRP virtual gateway IPs revert to their physical interface fallback addresses.

AnswersA, B, C

NSR prevents protocol session drops by keeping protocol state synchronized on the backup RE.

Why this answer

Control plane state is preserved by NSR, forwarding continues uninterrupted via GRES, and external/internal neighbors do not detect adjacency drops.

Full explanation →

Multi-Selecthard

Which THREE statements describe the role and function of the BGP Router ID? (Choose three)

Select 3 answers

A.It automatically replaces the AS_PATH attribute if missing.

B.It is exchanged during the BGP OPEN message negotiation phase.

C.It is used as a final tie-breaker in the BGP path selection algorithm.

D.It must be identical across all routers within the same Autonomous System.

E.It is a 32-bit identifier represented in dotted-quad notation.

AnswersB, C, E

The router ID is communicated in the OPEN message.

Why this answer

The Router ID is a 32-bit identifier chosen during startup, used as a tie-breaker in BGP path selection, and included in OPEN messages.

Full explanation →

MCQmedium

You are configuring a trunk port on an EX Series switch and need to specify that untagged frames received on this port should be placed into VLAN 10. Which command accomplishes this?

A.set vlans vlan-id 10 native-port ge-0/0/10

B.set interfaces ge-0/0/10 unit 0 family ethernet-switching untagged-vlan 10

C.set interfaces ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk native-vlan-id 10

D.set interfaces ge-0/0/10 unit 0 family ethernet-switching default-vlan 10

AnswerC

Correct. The native-vlan-id parameter handles untagged frames on trunk interfaces.

Why this answer

The native VLAN on an EX switch trunk port is configured using the 'native-vlan-id' statement under the interface ethernet-switching hierarchy.

Full explanation →

MCQmedium

During troubleshooting of a flapping BGP session, you notice BGP Notification messages being sent. Which BGP message type is responsible for tearing down a session due to an error condition?

A.KEEPALIVE

B.UPDATE

C.OPEN

D.NOTIFICATION

AnswerD

NOTIFICATION messages are sent to report errors and immediately tear down the BGP peering session.

Why this answer

The Notification message is sent when an error is detected, causing the BGP connection to close immediately.

Full explanation →

MCQeasy

When verifying RSTP operation on a Junos switch, which operational command should you use to view the bridge identifier, root bridge identifier, and local port states?

A.show rstp bridge

B.show rstp statistics interface

C.show bridgestp detail

D.show spanning-tree summary

AnswerA

show rstp bridge displays the bridge identifier, root bridge details, and timers.

Why this answer

The command 'show rstp bridge' provides detailed bridge-level statistics and state information for RSTP on Juniper devices.

Full explanation →

Multi-Selecthard

Which TWO factors must be carefully managed when running OSPF over a GRE tunnel interface on Junos devices? (Choose two.)

Select 2 answers

A.Mandatory activation of BGP multipath routing on the physical transit interface.

B.Interface MTU settings to account for the additional GRE header size and prevent packet drops or fragmentation issues.

C.Configuring MPLS Label Distribution Protocol (LDP) directly on the gr- interface.

D.OSPF network type configuration (such as point-to-point) to ensure proper adjacency formation without requiring a designated router.

E.Enabling proprietary Junos Layer 2 bridging protocols over the gr- interface.

AnswersB, D

Account for the added GRE header by adjusting interface MTU or TCP MSS to prevent packet drops.

Why this answer

Running OSPF over GRE requires managing MTU/fragmentation to avoid dropped packets and configuring the OSPF network type appropriately (such as point-to-point) since GRE does not natively support broadcast or standard multi-access LAN semantics without special mapping.

Full explanation →

Multi-Selectmedium

Which THREE actions can be configured as a response to a Dynamic ARP Inspection (DAI) violation on an EX Series switch? (Choose three)

Select 3 answers

A.Logging the violation event via syslog

B.Automatically shutting down the offending interface

C.Redirecting violating ARP packets to the Routing Engine CPU for inspection

D.Incrementing DAI drop counters

E.Dropping the violating ARP packet

AnswersA, D, E

DAI can be configured to log violations for auditing and troubleshooting.

Why this answer

DAI violation actions typically include dropping the packet, logging the event, and optionally shutting down the port depending on platform capabilities and configuration options. Let's verify valid Junos DAI actions: log, drop. Wait, DAI drops invalid packets by default and can log them.

Let's review standard Junos DAI behavior and options. DAI drops violating ARP packets and can log them. Port security supports shutdown/restrict/drop.

DAI specifically supports dropping packets and logging. Let's select the correct options.

Full explanation →

MCQeasy

What is the primary function of the RSTP port role known as the 'Backup' port?

A.It forwards traffic when the primary trunk fails without triggering a topology change.

B.It acts as a backup for the root port towards the root bridge.

C.It acts as a backup for a designated port on the same segment.

D.It is an operational state used exclusively during edge port transitions.

AnswerC

Backup ports exist on segments where the local bridge already has a designated port.

Why this answer

A backup port provides a redundant path to a segment and is a backup for a designated port, receiving superior BPDUs from its own bridge on the same segment.

Full explanation →

MCQmedium

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

A.Applied to the routing-instance forwarding table.

B.Applied globally under system services l2-firewall.

C.Applied to the input of an interface or VLAN under family ethernet-switching.

D.Applied to the output of the VLAN interface under family inet.

AnswerC

Layer 2 filters operate on family ethernet-switching and are typically applied to ingress interfaces or VLANs.

Why this answer

Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Full explanation →

MCQeasy

What is the purpose of the 'lsp-generation-interval'?

A.To limit the frequency of LSP updates.

B.To set the hello interval.

C.To define the authentication key rotation.

D.To set the time for database aging.

AnswerA

It prevents excessive updates during flapping.

Why this answer

This command controls how frequently the router generates a new LSP following a topology change.

Full explanation →

MCQhard

You are troubleshooting a Virtual Chassis formed by four EX4300 switches. The primary Routing Engine (RE) unexpectedly rebooted. Upon recovery, you notice that a different member switch has taken over the role of primary. How can you prevent this specific member from becoming the primary RE in the future?

A.Disable Graceful Routing Engine Switchover (GRES) on the backup routing engine.

B.Modify the routing-engine mastership-priority value on the preferred member switch to be higher than the others.

C.Enable preemption globally on all members in the virtual-chassis configuration.

D.Configure the non-preferred switch with a routing-engine user account restriction.

AnswerB

Configuring a higher priority value (up to 255) ensures that specific member is selected as primary.

Why this answer

Member priorities within a Junos Virtual Chassis determine which switch assumes the primary or backup role. Adjusting the virtual-chassis member priority ensures deterministic primary selection.

Full explanation →

MCQhard

An operator configures RSTP across multiple EX Series switches. A rogue switch running legacy STP is connected to an RSTP switch. How does the RSTP switch handle interaction with the legacy STP switch?

A.The port receiving legacy BPDUs is immediately placed into a permanent error-disabled state.

B.The legacy STP BPDUs are dropped and logged as protocol violations.

C.The entire switch converts its spanning tree mode to legacy STP.

D.The RSTP switch falls back to legacy STP behavior on that specific interface.

AnswerD

Per-port protocol migration allows interoperability by downgrading to 802.1D on ports receiving legacy BPDUs.

Why this answer

RSTP switches have a migration mechanism that automatically detects legacy STP BPDUs on a per-port basis and falls back to running legacy 802.1D STP behavior on that specific port.

Full explanation →

MCQhard

An administrator configures a GRE tunnel with a tunnel key enabled for security segmentation between two sites. The tunnel comes up, but traffic fails to pass. Debugging reveals that packets are dropped because the receiving router rejects the packets. What is the most probable configuration mismatch?

A.The tunnel key value configured on one router does not match the tunnel key value configured on the remote peer router.

B.The tunnel source address is using a loopback interface instead of a physical interface.

C.The physical interface MTU is set too high on the ingress router.

D.The GRE tunnel interface family inet is missing the primary address.

AnswerA

GRE tunnel keys act as a simple password/identifier; a mismatch results in packet drops at the receiver.

Why this answer

If a tunnel key is configured, both ends must match the key exactly; a mismatch causes the receiver to drop the packets.

Full explanation →

MCQmedium

You need to ensure that traffic entering interface ge-0/0/1 is forced into a specific forwarding routing instance named 'corp-fwd', regardless of the destination IP address in the packet header. Which configuration steps must you perform?

A.Create a forwarding instance, write a firewall filter with 'then routing-instance corp-fwd', and apply the filter as input on ge-0/0/1.

B.Create a virtual-router instance and apply a static default route pointing to ge-0/0/1.

C.Configure a routing policy with 'then export corp-fwd' and apply it under protocols.

D.Enable proxy-ARP on ge-0/0/1 and assign the corp-fwd routing instance to the physical port.

AnswerA

This is the correct three-step workflow for configuring Filter-Based Forwarding in Junos.

Why this answer

Implementing FBF requires creating a forwarding instance, defining a firewall filter that matches the traffic and directs it to that instance, and applying the filter to the ingress interface.

Full explanation →

Multi-Selecthard

When troubleshooting a BGP routing loop or unexpected route suppression, which THREE Junos operational commands provide visibility into BGP path attributes and decision processes? (Choose three)

Select 3 answers

A.show ldp database

B.show route extensive

C.show bgp neighbor

D.show route protocol bgp

E.show ospf interface

AnswersB, C, D

Show route extensive reveals detailed path attributes, AS_PATH, MED, and route preference details.

Why this answer

Detailed route inspection and BGP neighbor debugging commands include 'show route extensive', 'show bgp neighbor', and 'show route protocol bgp'.

Full explanation →

Multi-Selectmedium

Which of the following are true regarding the IS-IS 'hello-interval'? (Choose TWO)

Select 2 answers

A.It is used to calculate the SPF interval.

B.It determines how often Hello PDUs are sent.

C.It is always 10 seconds.

D.It affects the adjacency hold time.

E.It is only used on point-to-point links.

AnswersB, D

This defines the timer.

Why this answer

The hello-interval controls how often Hellos are sent and directly impacts how quickly an adjacency times out.

Full explanation →

MCQhard

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

A.GRE and IPsec operate simultaneously as a single unified protocol without nested headers.

B.IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.

C.IPsec replaces the GRE header entirely while maintaining GRE interface numbers.

D.Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.

AnswerD

GRE over IPsec tunnels route traffic through the GRE interface first, and IPsec crypto maps or security policies encrypt the outer GRE packets.

Why this answer

GRE over IPsec involves encapsulating traffic in GRE first, and then applying IPsec protection to the GRE packets by referencing the tunnel or transport zones/policies.

Full explanation →

MCQeasy

During an audit of an IS-IS routing network, an engineer examines the Type-Length-Value (TLV) structures used in IS-IS PDUs. Which TLV is specifically responsible for carrying IPv4 internal and external reachability information when using wide metrics?

A.TLV 135

B.TLV 128

C.TLV 1

D.TLV 2

AnswerA

TLV 135 carries extended IP reachability information, supporting wide metrics and sub-TLV attributes.

Why this answer

In IS-IS, TLV 135 (Extended IP Reachability) is used to carry IPv4 prefixes when wide metrics are enabled, replacing the older narrow metric TLV 128.

Full explanation →

MCQmedium

You are reviewing the configuration of an EX Series switch and notice that interface ge-0/0/15 is configured with 'interface-mode access' but has no explicit 'vlan members' statement defined. Which VLAN does the interface default to?

A.VLAN 0 (null VLAN)

B.The port remains shut down until a VLAN is explicitly assigned.

C.VLAN 1 (default VLAN)

D.It drops all traffic until a VLAN membership is added.

AnswerC

Correct. Unassigned access ports default to the 'default' VLAN.

Why this answer

In Junos OS, if an access port does not have an explicit vlan members statement, it defaults to VLAN 'default', which typically corresponds to VLAN ID 1.

Full explanation →

Multi-Selectmedium

When configuring load balancing on a Juniper Networks router, which TWO actions or components are necessary to achieve functional per-flow load balancing across multiple paths? (Choose two)

Select 2 answers

A.A routing policy containing the 'load-balance' action statement.

B.Application of the export policy under 'set routing-options forwarding-table export'.

C.Setting the routing-instance type to 'forwarding'.

D.Enabling MPLS encapsulation on all core interfaces.

E.A firewall filter applied to every interface running BGP.

AnswersA, B

A policy defining the load-balance action is required.

Why this answer

To achieve load balancing, you must create a routing policy that includes the 'load-balance' action and apply that policy to the forwarding table using 'set routing-options forwarding-table export <policy-name>'.

Full explanation →

MCQmedium

Which TLV is used to carry IP prefixes in IS-IS?

A.TLV 128

B.TLV 10

C.TLV 22

D.TLV 1

AnswerA

TLV 128 (IP Reachability) carries prefix info.

Why this answer

TLV 128 and 135 are used for IP reachability information.

Full explanation →

MCQmedium

You are configuring MACsec on a link between two EX Series switches to secure data in transit. Which operational command verifies that the MACsec secure channels are established and operational?

A.show layer2-security macsec summary

B.show macsec connections

C.show ethernet-switching macsec interface

D.show security macsec status

AnswerB

This is the correct operational command to check active MACsec sessions and parameters.

Why this answer

The 'show macsec connections' command displays the status of MACsec secure channels, including connectivity association keys (CAK) and security associations (SA).

Full explanation →

MCQeasy

During the examination of IS-IS packet captures on a multi-access LAN interface, an engineer notices a specific PDU type being transmitted periodically by the Designated Intermediate System (DIS) to maintain synchronized link-state databases. Which PDU type performs this function?

A.Partial Sequence Numbers PDU (PSNP)

B.Complete Sequence Numbers PDU (CSNP)

C.Intermediate System Hello (IIH)

D.Level 1 Link State PDU (LSP)

AnswerB

CSNPs contain the complete list of all LSPs in the router's database and are sent periodically by the DIS on broadcast networks.

Why this answer

The Complete Sequence Numbers PDU (CSNP) is sent periodically by the DIS on a multi-access network to list all the link-state database entries present on the router, ensuring all routers maintain database synchronization.

Full explanation →

MCQmedium

A network operator needs to peer two routers in different Autonomous Systems that are not directly connected. Security policy mandates that TTL security checks be bypassed. Which command satisfies this requirement for the BGP session?

A.set protocols bgp group ebgp hold-time 180

B.set protocols bgp group ebgp multihop ttl 255

C.set protocols bgp group ebgp passive

D.set protocols bgp group ebgp disable-ttl-drop

AnswerB

Configuring multihop sets an appropriate TTL for non-directly connected eBGP sessions.

Why this answer

TTL security can be bypassed or adjusted using multihop or adjusting the ttl value directly.

Full explanation →

MCQhard

You are configuring Q-in-Q tunneling (VLAN stacking) on an EX Series switch where customer traffic with VLANs 10 through 20 needs to be encapsulated into a service provider VLAN 100. Which configuration correctly applies the provider VLAN tag to incoming customer VLANs on a trunk interface?

A.set interfaces xe-0/0/0 encapsulation ethernet-bridge set interfaces xe-0/0/0 unit 0 family bridge vlan-id-list 10-20

B.set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode access vlan members 100

C.set vlans provider-vlan q-in-q-service set interfaces xe-0/0/0 unit 0 family ethernet-switching vlan members provider-vlan

D.set interfaces xe-0/0/0 flexible-vlan-tagging set interfaces xe-0/0/0 encapsulation q-in-q-tunneling set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode trunk vlan-members 100

AnswerD

Enabling flexible-vlan-tagging and q-in-q-tunneling encapsulation allows the interface to accept tagged frames and map them to the outer VLAN.

Why this answer

In Junos, flexible VLAN tagging is required on the input side to accept tagged customer frames, and the interface encapsulates them into the outer service provider VLAN using interface-mode trunk with member settings.

Full explanation →

MCQmedium

What is the purpose of the BGP Keepalive message and what is its default interval in Junos?

A.To maintain the session; sent every 30 seconds by default.

B.To report session errors; sent immediately upon failure.

C.To negotiate capabilities; sent every 60 seconds.

D.To update routing tables; sent every 5 seconds.

AnswerA

Keepalives keep the session alive and default to every 30 seconds in Junos (derived from a 90-second hold time).

Why this answer

Keepalive messages are sent periodically to maintain the BGP session when no UPDATE messages are sent. Default hold time is 90 seconds, and keepalive is 30 seconds.

Full explanation →

MCQhard

You want to influence the path selection for IS-IS traffic. You decide to change the metric. Which TLV is used to carry wide metrics?

A.TLV 135

B.TLV 22

C.TLV 2

D.TLV 128

AnswerB

TLV 22 is the standard for extended (wide) metrics.

Why this answer

TLV 22 (Extended IS Reachability) is used to carry wide metrics in IS-IS.

Full explanation →

Multi-Selectmedium

Which TWO features characterize OSPFv3 compared to OSPFv2? (Choose two)

Select 2 answers

A.OSPFv3 exclusively uses MD5 authentication embedded in the OSPF packet header.

B.OSPFv3 router IDs remain 32-bit unsigned integers, formatted identically to IPv4 addresses.

C.OSPFv3 eliminates the need for Area 0 in multi-area topologies.

D.OSPFv3 uses IPv6 link-local addresses for neighbor discovery and adjacency establishment.

E.OSPFv3 requires manual static routing for all inter-area paths.

AnswersB, D

Correct. The router ID format is unchanged between OSPFv2 and OSPFv3.

Why this answer

OSPFv3 is designed for IPv6, runs directly over IPv6 using link-local addresses for neighbor discovery, and decouples router IDs from IPv6 addresses (though they remain 32-bit integers).

Full explanation →

Multi-Selectmedium

Which of the following are true regarding IS-IS authentication? (Choose TWO)

Select 2 answers

A.It is mandatory for all IS-IS deployments.

B.It can only be configured for the entire area.

C.It secures the PDUs exchanged between neighbors.

D.It can be configured per interface.

E.It encrypts the entire link traffic.

AnswersC, D

This is the primary benefit.

Why this answer

Authentication can be applied to PDUs (Hello/LSP/SNP) and can be configured globally or per interface.

Full explanation →

MCQmedium

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

A.show route forwarding-table interface gr-0/0/0

B.show gre statistics

C.show interfaces gr-0/0/0 extensive

D.show chassis tencent status

AnswerC

This operational command displays comprehensive statistics and status for the GRE tunnel interface.

Why this answer

The command 'show interfaces gr-0/0/0' provides detailed operational status, traffic counters, and encapsulation details for the GRE interface.

Full explanation →

Multi-Selecthard

Which THREE conditions can cause a Virtual Chassis primary Routing Engine election or switchover to occur unexpectedly? (Choose three)

Select 3 answers

A.Manual modification of member priority values followed by a mastership switchover command or reboot.

B.Configuring VRRP preemption on a VLAN interface.

C.Failure or disconnection of stacking cables resulting in a split-brain condition or topology restructuring.

D.A mismatch in LACP timeout intervals on aggregated Ethernet interfaces.

E.A hardware crash or kernel panic on the current primary Routing Engine switch.

AnswersA, C, E

Changing priorities alters the election outcome upon subsequent reboots or forced switches.

Why this answer

Stacking cable failures, primary RE hardware crashes, or manual mastership changes/priority modifications trigger switchovers.

Full explanation →

Multi-Selecthard

When evaluating the BGP path selection algorithm on a Junos device, which THREE attributes are evaluated BEFORE the router considers the IGP metric to the BGP next hop? (Choose three)

Select 3 answers

A.IGP metric to next hop

B.Router ID

C.Multi-Exit Discriminator (MED)

D.AS path length

E.Local Preference

AnswersC, D, E

MED is evaluated after origin type and before iBGP/eBGP preference.

Why this answer

The path selection order in Junos is: 1. Local Preference, 2. AS Path length, 3.

Origin type, 4. MED, 5. iBGP over eBGP, 6. IGP metric to next hop.

Therefore, local preference, AS path length, and MED are evaluated before the IGP metric.

Full explanation →

MCQmedium

You are configuring an EX Series switch and want to set the forward delay timer to 15 seconds. Which command is used?

A.set protocols rstp forward-delay 15

B.set bridge forward-delay 15

C.set spanning-tree forward-delay 15

D.set protocols rstp delay 15

AnswerA

This command sets the forward delay timer for RSTP state transitions.

Why this answer

The forward delay timer can be configured under protocols rstp or stp using 'set protocols rstp forward-delay <seconds>'.

Full explanation →

MCQhard

An enterprise network runs MSTP. Instance 0 is always reserved for which specific purpose?

A.The Internal Regional Boundary instance (IRBI)

B.The Designated Root Backup instance (DRB)

C.The Common and Internal Spanning Tree (CIST) instance

D.The Vlan-to-Instance Mapping table (VIM)

AnswerC

Instance 0 serves as the CIST instance for MSTP operation and regional management.

Why this answer

Instance 0 in MSTP is the Common and Internal Spanning Tree (CIST) instance, which maintains connectivity across the entire bridged network and communicates with legacy STP/RSTP regions.

Full explanation →

MCQhard

An EX Series switch is configured with a private VLAN primary VLAN 10 and secondary isolated VLAN 20. An administrator wants to verify the active private VLAN port associations and mappings. Which operational command displays this information?

A.show private-vlan mapping

B.show ethernet-switching vlan private-vlan

C.show vlans extensive

D.show bridge-options private-vlan

AnswerC

Correct. Detailed and extensive VLAN output displays private VLAN primary and secondary relationships and member ports.

Why this answer

Private VLAN operational state and port mappings are verified using 'show ethernet-switching vlan' or specialized PVLAN operational commands.

Full explanation →

Multi-Selecthard

Which TWO conditions will cause an MSTP boundary port to drop BPDUs or recognize a region separation? (Choose two.)

Select 2 answers

A.A mismatch in the bridge priority of the regional root

B.A mismatch in the local bridge MAC address of the root bridge

C.Exceeding the maximum configured regional hop count

D.Receipt of a legacy 802.1D or RSTP BPDU from outside the region

E.Receipt of a BPDU with a mismatched MST configuration digest

AnswersD, E

Legacy BPDUs indicate connection to a non-MST region.

Why this answer

MSTP boundary ports detect region separation when there is a mismatch in configuration digests or when legacy STP/RSTP BPDUs are received from outside the region.

Full explanation →

MCQeasy

An engineer needs to configure a static IPv4 route on a Juniper Networks MX Series router pointing traffic destined for 192.168.100.0/24 to next-hop 10.0.0.1. Which configuration accomplishes this task?

A.set routing-instances default static route 192.168.100.0/24 next-hop 10.0.0.1

B.set protocols static route 192.168.100.0/24 next-hop 10.0.0.1

C.set interfaces fxp0 unit 0 family inet static-route 192.168.100.0/24 next-hop 10.0.0.1

D.set routing-options static route 192.168.100.0/24 next-hop 10.0.0.1

AnswerD

This is the correct Junos CLI syntax for defining a static IPv4 route.

Why this answer

Static routes in Junos are configured under the routing-options static hierarchy. The correct syntax is set routing-options static route 192.168.100.0/24 next-hop 10.0.0.1.

Full explanation →

MCQmedium

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

A.set switch-options interface ge-0/0/5 ip-source-guard-mode strict

B.set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify

C.set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

D.set protocols ip-source-guard interface ge-0/0/5 enable

AnswerB

This statement correctly enables IP Source Guard with IP and MAC verification on the specified interface.

Why this answer

IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Full explanation →

MCQhard

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

A.Enable DHCP snooping on the core router's interface.

B.Configure a static DHCP binding for the gateway IP on the access switch.

C.Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.

D.Configure the interface connected to the default gateway as a trusted interface for DAI.

AnswerD

Since routers don't acquire IPs via DHCP snooping, the uplink port facing the gateway must be explicitly trusted for DAI to permit its ARP replies.

Why this answer

The switch port connecting to the router or the router's IP binding must be explicitly trusted or added to a static ARP inspection log/ACL since routers do not participate in DHCP snooping.

Full explanation →

MCQhard

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

A.They must be part of the same subnet as the tunnel payload addresses.

B.They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).

C.They must be resolved via BGP inet-vpn routes only.

D.They must be configured as loopback addresses in the destination VRF exclusively.

AnswerB

The physical transport endpoints of the GRE tunnel must be reachable within the respective routing table context.

Why this answer

For a tunnel to establish successfully, its source and destination IP addresses must be resolvable in the routing table of the routing instance that owns or routes the transport path, or the global routing table depending on where the tunnel interface is bound.

Full explanation →

MCQmedium

An engineer configures Nonstop Active Routing (NSR) on an MX series router. What is required for NSR to function properly on BGP peering sessions?

A.Graceful Restart must be disabled globally on all routers.

B.VRRP must be configured on all BGP peering interfaces.

C.LACP fast mode must be enabled on all physical uplinks.

D.GRES must be enabled at the chassis level, and NSR must be explicitly enabled under the BGP protocol hierarchy.

AnswerD

NSR depends on chassis GRES for state synchronization and protocol-level configuration to replicate BGP daemon state to the backup RE.

Why this answer

NSR requires GRES enabled at the chassis level and NSR configured specifically under the routing-options protocols bfgp hierarchy.

Full explanation →

MCQmedium

You need to apply a Layer 2 firewall filter named 'block-rogue-mac' to inbound traffic on all access ports of an EX2300 switch. Under which hierarchy level must the filter be bound?

A.set security firewall filter block-rogue-mac interface ge-0/0/0.0

B.set protocols firewall family bridge interface ge-0/0/0.0 input block-rogue-mac

C.set interfaces ge-0/0/0 unit 0 family bridge filter input block-rogue-mac

D.set vlans default firewall input block-rogue-mac

AnswerC

Bridge family filters are bound to interface logical units under the family bridge stanza.

Why this answer

Layer 2 (bridge) filters in Junos are applied under the VLAN configuration or interface configuration depending on architecture, but for bridge filters inspecting switching interfaces, they are typically applied under 'interfaces <name> unit 0 family bridge filter input'.

Full explanation →

MCQmedium

You are configuring authentication for OSPF on a Junos router using MD5. Where must the MD5 key ID and password be defined in the configuration hierarchy?

A.[edit protocols ospf area <area> interface <interface> authentication md5]

B.[edit protocols bgp group <group> authentication-key]

C.[edit routing-options autonomous-system]

D.[edit system authentication-order]

AnswerA

Correct. MD5 keys are configured under the specific OSPF interface block in Junos.

Why this answer

OSPF MD5 authentication keys in Junos are defined directly under the interface configuration block using the 'authentication-type md5' and 'authentication-key key-id <id> key <password>' statements.

Full explanation →

MCQeasy

Which command is used to verify the IS-IS adjacency state on a Junos device?

A.show isis interface

B.show isis database

C.show isis adjacency

D.show protocols isis neighbors

AnswerC

This is the correct operational command.

Why this answer

The 'show isis adjacency' command provides the current status of IS-IS neighbors.

Full explanation →

MCQmedium

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

A.Internet Key Exchange version 2 (IKEv2)

B.Secure Session Protocol (SSP)

C.802.1AE Dynamic Key Distribution (AKD)

D.MACsec Key Agreement (MKA) protocol

AnswerD

MKA is the standard protocol used by MACsec for peer discovery and key management.

Why this answer

MACsec in Junos uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X, to discover peers and manage cryptographic keys.

Full explanation →

MCQhard

An engineer is preparing to perform an In-Service Software Upgrade (ISSU) on a pair of dual-RE MX240 routers. Which condition must be met to ensure the ISSU succeeds without dropping traffic?

A.The backup Routing Engine must be physically removed from the chassis during the upgrade.

B.All physical interfaces must be manually disabled prior to issuing the request system software in-service command.

C.Graceful Route Engine Switchover (GRES) and Nonstop Active Routing (NSR) must be enabled and functioning.

D.All routing protocols must be migrated from OSPF to IS-IS before starting ISSU.

AnswerC

ISSU relies heavily on GRES and NSR to maintain routing states across the routing engine reboot during the upgrade process.

Why this answer

ISSU requires specific hardware compatibility (matching RE models, line card types), GRES and NSR configured and operating, and a supported Junos image path.

Full explanation →

MCQmedium

An engineer configures a Virtual Chassis using EX4300 switches. To ensure member IDs are assigned consistently even if physical positions change, how should the administrator provision the member IDs?

A.Rely on automatic plug-and-play assignment, which permanently locks member IDs based on initial boot order.

B.Disable GRES so that member IDs do not synchronize across the stack.

C.Configure the MAC address of each switch under the [edit chassis vrrp] hierarchy.

D.Pre-provision member serial numbers to specific member IDs using the 'request virtual-chassis assign' or configuration statements.

AnswerD

Pre-provisioning binds serial numbers to member IDs, ensuring consistent interface naming across reboots and hardware swaps.

Why this answer

Junos allows pre-provisioning Virtual Chassis member serial numbers to specific member IDs to maintain predictable topologies.

Full explanation →

Multi-Selecteasy

Which TWO parameters are mandatory when configuring a basic GRE tunnel interface in Junos? (Choose two)

Select 2 answers

A.GRE keepalive interval timer

B.Tunnel destination IP address

C.Tunnel source IP address

D.Routing protocol authentication key

E.IPsec security association profile

AnswersB, C

The destination IP address is mandatory to identify the remote tunnel endpoint.

Why this answer

Configuring a GRE tunnel requires defining both the tunnel source IP address and the tunnel destination IP address.

Full explanation →

Multi-Selecthard

When configuring OSPF over a GRE tunnel on Junos, which TWO configurations ensure stable neighbor adjacencies and correct route propagation? (Choose two)

Select 2 answers

A.Disable IP-IP encapsulation on the OSPF routing options.

B.Ensure that the tunnel interface has a valid IP address matching the subnet of the remote tunnel end.

C.Enable BGP graceful restart on the tunnel interface.

D.Set the OSPF dead interval to 1 second globally.

E.Configure the OSPF network type as point-to-point on the tunnel interface.

AnswersB, E

OSPF requires matching subnet connectivity between peers to form adjacencies.

Why this answer

Setting the OSPF network type to point-to-point and ensuring correct subnet assignment/reachability are critical.

Full explanation →

MCQmedium

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

A.AES-CBC-128

B.SHA-256-HMAC

C.GCM-AES-128

D.GCM-AES-256

AnswerC

GCM-AES-128 is the default cipher suite for Junos MACsec.

Why this answer

When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Full explanation →

MCQhard

You are troubleshooting a BGP session failure immediately following a manual Routing Engine switchover on an MX series router configured with GRES and NSR. BGP drops its peering session. What is the most likely reason for the failure?

A.NSR was not enabled under the BGP routing-options protocol hierarchy, causing the protocol daemon state to not synchronize to the backup Routing Engine.

B.The Virtual Chassis stacking cable was disconnected during the switchover.

C.VRRP preemption caused the default gateway IP to shift to the backup engine.

D.The LACP timeout on the aggregated uplink was set to slow mode.

AnswerA

While GRES preserves the forwarding plane, NSR must be explicitly enabled for specific protocols (like BGP or OSPF) to sync control plane states.

Why this answer

If NSR is enabled, protocol state is synced, but if Graceful Restart is misconfigured or helper mode is disabled on the peer, or if backup sync failed, state could be lost.

Full explanation →

MCQhard

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

A.set security flow tcp-mss mss-adjust 1360

B.set interfaces ip-0/0/0 unit 0 family inet mtu 1500

C.set routing-options encapsulation-limit 0

D.Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.

AnswerD

Accounting for the outer IP header by reducing tunnel interface MTU or enabling PMTUD ensures packets fit within the physical interface MTU.

Why this answer

Enabling ip-mtu or adjusting the interface MTU, or utilizing tcp-mss parameters on the routing-options or interfaces hierarchy helps prevent fragmentation issues when encapsulating traffic.

Full explanation →

MCQeasy

When configuring a Link Aggregation Group (LAG) on a Juniper switch, what is the naming convention used for the aggregated interface in the Junos CLI?

A.lag0, lag1, lag2, etc.

B.eth-trunk0, eth-trunk1, etc.

C.ae0, ae1, ae2, etc.

D.bond0, bond1, bond2, etc.

AnswerC

Aggregated Ethernet interfaces are designated with the 'ae' prefix followed by an integer index.

Why this answer

Junos uses the 'aeX' naming convention (Aggregated Ethernet) for LAG interfaces.

Full explanation →

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 1–75