Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) JNCIS-ENT Questions 76–150 | Page 2/7

MCQhard

You want to configure load balancing across four distinct next-hops. By default, how many paths will Junos install into the forwarding table for ECMP if you configure a load-balancing policy without specifying path limits?

A.Exactly 4 paths

B.Up to 16 paths

C.Up to 64 paths

D.Only 1 path (no load balancing)

AnswerB

Junos supports up to 16 ECMP paths by default.

Why this answer

By default, Junos supports up to 16 equal-cost paths (ECMP) for traffic forwarding, though this can be tuned.

Full explanation →

MCQhard

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

A.Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.

B.No, because Junos prohibits all routing protocols over IP-IP interfaces.

C.No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.

D.Yes, but only if IGMP version 3 is explicitly configured.

AnswerC

IP-IP tunnels only encapsulate unicast IPv4 packets, making multicast protocols like PIM unusable over IP-IP.

Why this answer

Unlike GRE, standard IP-IP encapsulation does not support broadcast or multicast traffic natively because IP-IP is strictly point-to-point unicast encapsulation without multicast destination mapping capabilities.

Full explanation →

MCQhard

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

A.family inet

B.family inet6

C.family iso

D.family mpls

AnswerB

When carrying IPv6 traffic through the GRE tunnel, the family under the tunnel unit must be inet6.

Why this answer

Even when carrying IPv6 payload traffic, the core tunnel interface family depends on whether the payload is inet6, while the tunnel source/destination addresses handle the IPv4 transport.

Full explanation →

MCQeasy

You have two routers connected via a point-to-point link. You need to ensure they form an IS-IS adjacency. Which configuration is required?

A.Configure a DIS priority on the interface.

B.Configure the interface as point-to-point and enable IS-IS on both routers.

C.Disable the wide-metrics setting on both ends.

D.Configure a unique System ID for both routers.

AnswerB

Point-to-point links do not require a DIS election and form adjacencies simply by being enabled.

Why this answer

On point-to-point links, IS-IS will form an adjacency regardless of the level match, provided the interface is enabled in the correct protocol hierarchy.

Full explanation →

MCQmedium

You have a Level 1/Level 2 router connecting two areas. How does it advertise itself to Level 1 routers?

A.It requires a manual default-route configuration on all L1 routers.

B.It floods the entire Level 2 LSDB into the Level 1 area.

C.It sends a specific inter-area TLV to all neighbors.

D.It advertises a default route using the ATT bit.

AnswerD

The ATT (Attached) bit is used to signal the presence of an inter-area path.

Why this answer

A Level 1/2 router sets the ATT bit in its Level 1 LSPs, signaling to Level 1 routers that it is an exit point to other areas.

Full explanation →

MCQeasy

Which command displays the status of Virtual Chassis member switches, their roles, and their serial numbers on an EX series switch?

A.show lacp statistics

B.show vrrp summary

C.show virtual-chassis

D.show chassis hardware

AnswerC, D

show virtual-chassis displays the member ID, role, serial number, and status of each switch in the stack.

Why this answer

The 'show virtual-chassis' command is the primary operational command to view member status, roles (Master/Backup/Linecard), and IDs.

Full explanation →

MCQhard

You are performing a pre-check for an ISSU on an MX series router. You execute 'request system software in-service check' and the system reports an error indicating that graceful restart or NSR is not properly configured for active routing protocols. How do you resolve this?

A.Manually restart the routing protocol daemon (rpd) on both Routing Engines simultaneously.

B.Configure Nonstop Active Routing (NSR) or Graceful Restart for all active interior and exterior routing protocols before re-running the check.

C.Disable GRES to bypass protocol state verification checks.

D.Set the virtual-chassis mastership-priority to 255 on both routing engines.

AnswerB

ISSU requires routing protocols to be capable of surviving control plane restarts via NSR or Graceful Restart helper/restart mechanisms.

Why this answer

ISSU requires that either NSR or Graceful Restart is enabled for all running routing protocols to prevent loss of state during the control plane upgrade.

Full explanation →

MCQhard

You are troubleshooting a Virtual Chassis where member 0 has failed completely. The replacement switch arrives. Before inserting it into the running Virtual Chassis ring, what critical precaution must be taken regarding Junos OS software versions?

A.Ensure the replacement switch is running the exact same major and minor version of Junos OS as the existing Virtual Chassis master.

B.Disable LACP on all aggregated links across the stack.

C.Format the flash memory of the existing master switch before inserting the replacement.

D.Change the root password of the replacement switch to match the backup routing engine.

AnswerA

Junos Virtual Chassis requires identical software versions across all member switches to ensure compatible daemon communication and feature parity.

Why this answer

All member switches in a Junos Virtual Chassis must run the exact same version of Junos OS to prevent version mismatch errors and split-stack issues.

Full explanation →

Multi-Selectmedium

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Select 3 answers

A.MACsec Key Agreement (MKA)

B.Dynamic ARP Inspection (DAI)

C.DHCP Snooping

D.IP Source Guard

E.Spanning Tree Root Protection

AnswersB, C, D

DAI is a core secure access port feature.

Why this answer

Secure access port features include DHCP snooping, Dynamic ARP Inspection, and IP Source Guard. Port security is also part of secure access features. Let's select three standard ones.

Full explanation →

MCQeasy

An administrator is configuring Graceful Restart on a pair of Juniper MX series routers running OSPF. What is the primary purpose of Graceful Restart in this scenario?

A.To instantly drop all adjacencies and force an immediate full SPF recalculation across the network.

B.To ensure uninterrupted data packet forwarding while the control plane routing protocol restarts.

C.To automatically upgrade Junos OS images without rebooting the forwarding plane.

D.To synchronize firewall filter counters between primary and backup Routing Engines.

AnswerB

Graceful Restart keeps forwarding tables populated using helper mode on neighbors while the control engine recovers.

Why this answer

Graceful Restart allows a routing platform to continue forwarding packets along known routes while its control plane is restarting, avoiding routing churn.

Full explanation →

Multi-Selecteasy

An administrator needs to verify the VLAN configuration and port mappings on a Junos EX Series switch. Which TWO operational commands provide this information? (Choose two.)

Select 2 answers

A.show ethernet-switching vlans

B.show vlans extensive

C.show vlans

D.show interfaces switching-table

E.show bridge-table

AnswersB, C

Correct. Provides detailed VLAN parameters including private VLANs and encapsulation details.

Why this answer

VLAN details and membership are verified using 'show vlans' and 'show vlans extensive'.

Full explanation →

MCQeasy

Which command allows an administrator to view the OSPF link-state database (LSDB) summary on a Junos device?

A.show ospf neighbor

B.show route protocol ospf

C.show ospf database

D.show ospf interface

AnswerC

Correct. This command displays the LSDB entries on a Junos router.

Why this answer

The command 'show ospf database' displays the OSPF link-state database entries, categorized by LSA type, on a Junos device.

Full explanation →

MCQeasy

An administrator needs to view the MAC address learning table on an EX Series switch to verify which switchport a specific server is connected to. Which operational command should be used?

A.show mac-address-table

B.show ethernet-switching table

C.show vlans mac-table

D.show bridge-domain mac-table

AnswerB

Correct. This command displays the Layer 2 forwarding database on Junos EX switches.

Why this answer

The command 'show ethernet-switching table' displays the MAC addresses learned by the Junos switch along with their associated VLANs and ports.

Full explanation →

Multi-Selectmedium

Which of the following are valid IS-IS interface types? (Choose TWO)

Select 2 answers

A.mesh

B.star

C.point-to-point

D.broadcast

E.passive

AnswersC, D

Standard for serial/P2P media.

Why this answer

Junos supports both broadcast and point-to-point interface types for IS-IS.

Full explanation →

Multi-Selecteasy

Which TWO packet types are utilized during the OSPF database synchronization process after neighbor adjacencies are established? (Choose two)

Select 2 answers

A.Link-State Acknowledgment (LSAck) packets

B.Routing Information Protocol (RIP) updates

C.Database Description (DBD) packets

D.Hello packets

E.Link-State Request (LSR) packets

AnswersC, E

Correct. DBD packets summarize LSDB headers during synchronization.

Why this answer

Once adjacencies move past the 2-Way state, Database Description (DBD) and Link-State Request (LSR) packets are used to synchronize the link-state databases between neighbors.

Full explanation →

MCQhard

You are troubleshooting a split-brain condition in an EX4300 Virtual Chassis where both partitions have elected a primary Routing Engine. Which feature can be configured to detect this condition and shut down downstream ports on the non-designated partition to prevent duplicate packet forwarding?

A.Setting LACP mode to active on the stacking ports.

B.Virtual Chassis split-detection or auxiliary management connection mechanisms that evaluate reachability between partitions to disable the non-primary partition.

C.Enabling GRES on both partitions simultaneously.

D.Configuring VRRP with a priority of 255 on all member interfaces.

AnswerB

Split-detection mechanisms or tie-breaker configurations prevent dual-primary states by shutting down interfaces on the isolated partition.

Why this answer

Dual-Routing Engine Advanced Support (DREAS) or specifically configured mechanisms like MAC-sec / split-detection scripts help, but let's look at Juniper's specific Virtual Chassis split-brain mitigation: Junos supports mechanisms such as MAC pinning or specifically configured split detection algorithms, or let's examine standard Juniper terminology. Wait, Junos Virtual Chassis uses Virtual Chassis Automatic Partition Detection or dedicated split-brain detection features. Let's see which option accurately names a valid approach.

Full explanation →

MCQmedium

An administrator implements an inbound policy to discard BGP routes matching a specific community. Which action statement is required in the policy term?

A.then drop;

B.then reject;

C.then next term;

D.then discard;

AnswerB

The 'reject' action discards the route and stops evaluating subsequent policy terms.

Why this answer

To discard routes in a Junos routing policy, the 'reject' action is used.

Full explanation →

MCQeasy

An administrator is troubleshooting an OSPF adjacency issue on an interface connecting two Juniper vMX routers. Both routers are stuck in the 2-Way state on a broadcast segment. Which configuration parameter must match on both routers for the adjacency to progress beyond 2-Way?

A.The interface metric must be identical

B.The interface priority must be set to zero on both nodes

C.The router-id must be identical on both routers

D.The hello-interval and dead-interval timers must match

AnswerD

OSPF requires hello and dead intervals to match on an interface for neighbors to establish an adjacency.

Why this answer

On broadcast networks, OSPF routers elected as DR and BDR form adjacencies with all routers, while DROther routers form adjacencies only with the DR and BDR. However, basic OSPF interface parameters like Hello and Dead intervals, area ID, and authentication must match for any adjacency to form. Specifically, the Hello and Dead timers must match across the link.

Full explanation →

MCQhard

You are troubleshooting an OSPF network where an NSSA area is connected to the backbone via an ABR. External routes are being injected into the NSSA by an ASBR. Which router is responsible for translating Type 7 LSAs into Type 5 LSAs before flooding them into the backbone area?

A.The NSSA ABR

B.The ASBR that originally injected the external route

C.Any internal router residing within the NSSA backbone

D.The designated router (DR) of the NSSA segment

AnswerA

The ABR connected to the NSSA performs the translation of Type 7 LSAs to Type 5 LSAs.

Why this answer

In an OSPF Not-So-Stubby Area (NSSA), the NSSA Area Border Router (ABR) with the highest Router ID (or the configured translator) translates Type 7 LSAs received from the ASBR into Type 5 LSAs for propagation into the OSPF backbone and other standard areas.

Full explanation →

Multi-Selecteasy

Which TWO commands are valid Junos operational commands used to verify secure access port features? (Choose two)

Select 2 answers

A.show ethernet-switching dhcp-snooping binding

B.show ethernet-switching secure-access-port ip-source-guard interface

C.show bridge-domain secure-access status

D.show arp-inspection database

E.show security port-security summary

AnswersA, B

This command displays active DHCP bindings.

Why this answer

Valid operational commands include showing DHCP snooping bindings and IP Source Guard status.

Full explanation →

Multi-Selecthard

Which TWO configuration statements are required when configuring a trunk port on an EX Series switch to allow specific VLANs while blocking others? (Choose two.)

Select 2 answers

A.set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk

B.set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ vlan-10 vlan-20 ]

C.set interfaces ge-0/0/0 unit 0 family ethernet-switching encapsulation access

D.set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode hybrid

E.set protocols l2-learning trunk-vlan-restriction

AnswersA, B

This command sets the port operating mode to trunk.

Why this answer

Trunk ports require setting the interface mode to trunk and explicitly defining the allowed member VLANs using vlan members.

Full explanation →

MCQhard

You are configuring multi-topology IS-IS. What does this allow?

A.Load balancing over different physical paths.

B.Creating multiple areas within a single instance.

C.Increasing the maximum MTU.

D.Running separate topologies for different address families.

AnswerD

This is the core purpose of multi-topology.

Why this answer

Multi-topology IS-IS allows for separate routing topologies for different protocol families (e.g., IPv4 and IPv6).

Full explanation →

Multi-Selecthard

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

Select 3 answers

A.MACsec pre-shared keys configured on all access ports

B.Dynamic ARP Inspection enabled on the specific VLAN

C.Configured static ARP inspection bindings for every client

D.Trusted ports configured on uplinks toward DHCP servers or core routers

E.DHCP snooping enabled on the respective VLAN

AnswersB, D, E

DAI must be explicitly enabled per VLAN to intercept and validate ARP packets.

Why this answer

DAI depends on active VLAN mapping, DHCP snooping bindings to validate ARP packets, and trusted uplink interfaces to allow legitimate gateway ARP traffic.

Full explanation →

MCQmedium

How does a router determine its System ID?

A.It is learned via ARP.

B.It is automatically derived from the MAC address.

C.It is manually configured.

D.It is assigned by the DIS.

AnswerC

The administrator defines this value.

Why this answer

The System ID is manually configured in the 'set protocols isis system-id' hierarchy.

Full explanation →

100

Multi-Selecthard

Which THREE path attributes are classified as 'well-known mandatory'? (Choose three)

Select 3 answers

A.MED

B.NEXT_HOP

C.ORIGIN

D.AS_PATH

E.LOCAL_PREF

AnswersB, C, D

NEXT_HOP is a well-known mandatory attribute.

Why this answer

The well-known mandatory attributes in BGP are ORIGIN, AS_PATH, and NEXT_HOP. Local Preference is well-known discretionary, and MED is optional non-transitive.

Full explanation →

101

MCQeasy

An administrator configures a BGP policy to reject routes with an AS_PATH containing a specific AS number. Which match condition in a Junos routing policy is used to evaluate the AS_PATH?

A.pref

B.metric

C.as-path

D.community

AnswerC

The as-path match condition references a named as-path object containing regular expressions.

Why this answer

In Junos, the as-path match condition evaluates routes against a defined as-path regular expression.

Full explanation →

102

MCQmedium

An engineer configures a static route pointing to an interface rather than an IP address. What potential issue can occur with interface-based static routes on multi-access Ethernet networks in Junos OS?

A.The packet forwarding engine will crash due to unresolvable MAC addresses.

B.The static route will immediately enter a hidden state due to missing next-hop IP.

C.BGP will automatically re-advertise the interface route into external ASNs.

D.The router will generate an ARP request for every destination IP, potentially exhausting ARP cache.

AnswerD

Interface routes on Ethernet cause the router to treat all destination IPs as directly connected, leading to excessive ARP traffic.

Why this answer

On multi-access networks (like Ethernet), pointing a static route directly to an interface causes the router to ARP for every destination IP address it receives, potentially exhausting ARP tables (Proxy ARP behavior or ARP storm).

Full explanation →

103

MCQmedium

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

A.The interface automatically recovers after a default hold-down timer of 300 seconds.

B.The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.

C.The interface drops violating packets but remains operationally up until manually disabled.

D.The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

AnswerB

Correct. The shutdown violation action puts the port in a disabled state requiring administrator intervention.

Why this answer

When an interface is shut down due to a port security violation, it enters a disabled state. It remains down until explicitly re-enabled using 'clear ethernet-switching security-violation' or by toggling the interface status.

Full explanation →

104

Multi-Selectmedium

Which THREE characteristics distinguish GRE tunnels from IP-IP tunnels on Junos devices? (Choose three)

Select 3 answers

A.IP-IP tunnels require a specialized Routing Engine hardware card.

B.GRE supports optional features like checksums and keys.

C.GRE uses IP protocol number 47 in the outer header.

D.GRE supports encapsulation of multicast and broadcast traffic.

E.IP-IP tunnels inherently encrypt all transmitted data payloads.

AnswersB, C, D

GRE headers can include optional fields such as checksum and key identification.

Why this answer

GRE supports multicast, has an optional checksum/key, and protocol type field, whereas IP-IP is simpler, supports protocol 4, and lacks multicast support.

Full explanation →

105

Multi-Selecthard

Which THREE characteristics are true regarding Junos aggregate routes? (Choose three)

Select 3 answers

A.They automatically drop matching traffic by installing a discard next-hop when no contributing routes exist.

B.They require at least one active, more-specific contributing route to become active.

C.They can include component routes from any routing protocol or static configuration.

D.They are assigned a default route preference of 130.

E.They dynamically adjust their prefix length based on the subnet mask of the primary physical interface.

AnswersB, C, D

An aggregate route is inactive without contributing routes.

Why this answer

Aggregate routes summarize multiple routes, are assigned a default preference of 130, and remain inactive unless at least one more-specific contributing route is present in the routing table.

Full explanation →

106

MCQmedium

What does the 'show isis statistics' command reveal?

A.The number of received and transmitted PDUs.

B.The current SPF calculation time.

C.The database size in bytes.

D.The adjacency hold-time.

AnswerA

It shows PDU counts by type.

Why this answer

This command displays the number of PDUs sent and received by the IS-IS process.

Full explanation →

107

MCQmedium

You need to configure filter-based forwarding (FBF) to route traffic from a specific subnet (192.168.1.0/24) through an alternate next-hop gateway. Which components are required to implement this successfully?

A.A static route pointing to the alternate gateway with a preference of 1.

B.A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the ingress interface.

C.An export routing policy with a load-balance action applied globally.

D.A firewall filter with a routing-instance action, a custom routing instance, and application of the filter to the egress interface.

AnswerB

FBF requires matching traffic via a firewall filter on ingress, directing it to a specific routing-instance using the routing-instance action.

Why this answer

Filter-based forwarding requires a firewall filter matching the traffic, a routing instance containing a custom routing table, and applying the filter to the ingress interface.

Full explanation →

108

Multi-Selectmedium

Which TWO commands can be used to inspect static routes or verify their status in Junos OS? (Choose two)

Select 2 answers

A.show forwarding-table static

B.show static-routes active

C.show route table inet.0 static

D.show route protocol static

E.show interfaces static

AnswersC, D

Displays static routes within the inet.0 routing table.

Why this answer

The show route protocol static and show route table inet.0 static commands are standard ways to inspect static routes.

Full explanation →

109

Multi-Selecthard

An administrator is troubleshooting an aggregate route that is missing from the routing table. Which THREE conditions could cause an aggregate route to remain inactive? (Choose three)

Select 3 answers

A.All contributing routes have been suppressed or withdrawn.

B.No more-specific (contributing) routes are present in the routing table.

C.BGP split-horizon rule is preventing advertisement.

D.The aggregate route has been explicitly deactivated in the configuration.

E.The router's CPU utilization exceeds 90%.

AnswersA, B, D

If contributing routes disappear, the aggregate route becomes inactive.

Why this answer

Aggregate routes require active contributing routes, lack of suppression, and valid configuration under routing-options.

Full explanation →

110

MCQeasy

Which OSPF packet type is used to acknowledge the receipt of Link-State Updates (LSUs) to ensure reliable flooding?

A.Database Description (Type 2)

B.Link-State Request (Type 3)

C.Hello (Type 1)

D.Link-State Acknowledgment (Type 5)

AnswerD

Correct. LSAck packets provide reliability for OSPF flooding.

Why this answer

Link-State Acknowledgment (LSAck) packets (Packet Type 5) explicitly acknowledge receipt of LSUs to maintain reliable database synchronization.

Full explanation →

111

Multi-Selectmedium

Which TWO actions occur during OSPF link-state database flooding on a Junos routing device? (Choose two)

Select 2 answers

A.The router converts the link-state database into BGP path attributes.

B.The router immediately deletes all static routes from the routing table.

C.The router resets all active neighbor adjacencies across the entire device.

D.The router updates its link-state database (LSDB) with the received LSA and acknowledges it.

E.The router floods the LSA out all other OSPF-enabled interfaces belonging to that area.

AnswersD, E

Correct. LSDBs are updated and acknowledged via LSAcks.

Why this answer

When an LSA update is received, the router adds or updates it in its LSDB, schedules an SPF calculation (or runs incremental SPF), and floods the LSA out all other participating OSPF interfaces.

Full explanation →

112

MCQhard

An engineer needs to prevent Type 4 and Type 5 LSAs from entering a specific OSPF area while still allowing external routes to be summarized via default routing. Which area type should be configured?

A.Standard OSPF Area

B.Not-So-Stubby Area (NSSA)

C.Totally Stubby Area

D.Standard Stub Area

AnswerC

Correct. A totally stubby area blocks Type 3, 4, and 5 LSAs and uses a default route for external destinations.

Why this answer

A Totally Stubby Area blocks Type 3, Type 4, and Type 5 LSAs, and automatically injects a default route (Type 3) into the area to reach destinations outside the area.

Full explanation →

113

MCQmedium

You are configuring an OSPF interface on a Junos router and want to ensure that the interface never participates in DR/BDR election, always acting as a point-to-point connection. Which interface type should you explicitly configure?

A.set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 interface-type p2p

B.set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 passive

C.set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 point-to-multipoint

D.set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 no-dr-election

AnswerA

Correct. The interface-type p2p command forces point-to-point behavior and disables DR/BDR elections.

Why this answer

In Junos, setting the OSPF interface type to 'point-to-point' forces the protocol to treat the link as point-to-point, bypassing the DR/BDR election process entirely even if underlying media is broadcast.

Full explanation →

114

MCQmedium

You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?

A.The client's MAC address is not yet learned in the switch's Ethernet switching table.

B.Option-82 checks are enabled, and the incoming client request fails validation rules.

C.DHCP snooping drops all DHCP messages on untrusted ports by design.

D.Dynamic ARP Inspection is blocking the DHCP request packets.

AnswerB

If option-82 insertion or validation is misconfigured, DHCP requests from clients can be dropped.

Why this answer

DHCP snooping permits DHCP Discover and Request messages on untrusted ports to allow clients to obtain IP addresses, provided the server replies pass through trusted ports. However, if requests are dropped, verify if rate-limiting or option-82 checks are causing drops. Wait, let's re-evaluate: DHCP Request messages from clients are normally permitted on untrusted ports.

If they are dropped, it might be due to a specific option-82 validation failure. Let's check option options.

Full explanation →

115

MCQeasy

Which command allows you to view the IS-IS database summary?

A.show isis statistics

B.show isis database

C.show isis route

D.show isis summary

AnswerB

This displays the contents of the database.

Why this answer

The 'show isis database' command shows the LSPs currently in the database.

Full explanation →

116

MCQhard

When configuring load balancing on a Junos device, you want to include Layer 4 source and destination ports in the hash calculation to achieve finer-grained load distribution. Which configuration statement achieves this under the forwarding-options hierarchy?

A.set forwarding-options hash-key layer-3 layer-4

B.set system services load-balancing ports

C.set routing-options forwarding-table export load-balance-policy

D.set protocols ospf ecmp-hash-ports

AnswerA

Enabling layer-3 and layer-4 hash keys ensures that TCP/UDP ports are factored into the ECMP hashing.

Why this answer

The hash-key options under forwarding-options allow administrators to include Layer 3 and Layer 4 header fields in the load-balancing hash algorithm.

Full explanation →

117

MCQeasy

Which statement accurately describes port security MAC-limit behavior?

A.It statically assigns all learned MAC addresses to the switch configuration file automatically.

B.It defines the maximum bandwidth a single MAC address can consume on a port.

C.It prevents MAC address spoofing by validating IP bindings against DHCP tables.

D.It restricts the maximum number of MAC addresses that can be learned on a secure interface.

AnswerD

MAC-limit caps the total number of unique source MAC addresses learned on the interface.

Why this answer

Port security MAC-limit restricts the maximum number of MAC addresses learned on a secure interface.

Full explanation →

118

MCQeasy

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

A.show storm-control statistics interface ge-0/0/1

B.show ethernet-switching storm-control interface ge-0/0/1

C.show bridge storm-control interface ge-0/0/1

D.show interfaces extensive ge-0/0/1 | match storm

AnswerB

This command correctly displays storm control metrics and drop counts for the specified interface.

Why this answer

The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Full explanation →

119

Multi-Selectmedium

Which TWO actions can be performed using Junos routing policies applied to BGP? (Choose two)

Select 2 answers

A.Accepting or rejecting routes based on AS_PATH regular expressions.

B.Changing the TCP port used for BGP session establishment from 179 to another port.

C.Directly modifying the physical interface speed when BGP flaps.

D.Encrypting BGP payload data using policy-based IPsec keys.

E.Modifying the Local Preference attribute on incoming eBGP routes.

AnswersA, E

Routing policies match AS_PATH and accept or reject routes accordingly.

Why this answer

Routing policies can modify path attributes such as local preference and MED, as well as accept or reject routes.

Full explanation →

120

MCQmedium

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

A.mt-

B.ip-

C.gr-

D.st-

AnswerB

ip- is the correct prefix for IP-IP tunnel interfaces in Junos OS.

Why this answer

IP-IP tunnels use the ip- interface prefix.

Full explanation →

121

MCQhard

An engineer configures Selective QinQ on an EX Series switch. Incoming customer frames tagged with VLAN 10 must be mapped to outer VLAN 500, while frames tagged with VLAN 20 must be mapped to outer VLAN 600. Which configuration component is required to achieve this granular mapping?

A.Layer 3 firewall filters with rewriting actions on the access port

B.Static MAC address binding with Q-in-Q encapsulation rules

C.Global native-vlan-id translation tables

D.Flexible VLAN Tagging (flexible-vlan-tagging) with input-vlan-map configuration

AnswerD

Correct. Flexible VLAN tagging and input-vlan-map / output-vlan-map statements provide selective Q-in-Q mapping.

Why this answer

Selective QinQ requires using VLAN translation profiles or stacked VLAN mapping rules under the interface or VLAN mapping hierarchy.

Full explanation →

122

MCQmedium

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

A.The security policies are blocking the return traffic.

B.Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.

C.OSPF hello packets are malformed.

D.The tunnel destination IP address is unreachable via the routing table.

AnswerB

IP-IP encapsulation adds overhead. If packets exceed MTU and DF is set, they are dropped, incrementing input drops.

Why this answer

Input drops on tunnel interfaces frequently occur due to MTU mismatches where incoming encapsulated packets exceed the tunnel interface or physical interface capability and cannot be fragmented because the DF bit is set.

Full explanation →

123

Multi-Selecteasy

Which TWO OSPF packet types are used for reliable flooding and direct acknowledgment of Link State Advertisements? (Choose two.)

Select 2 answers

A.Database Description (DBD) packets

B.Hello packets

C.Link State Request (LSR) packets

D.Link State Update (LSU) packets

E.Link State Acknowledgment (LSAck) packets

AnswersD, E

LSU packets flood LSAs reliably across the network.

Why this answer

OSPF uses LSU (Link State Update) packets, which contain actual LSAs, and LSAck (Link State Acknowledgment) packets to confirm receipt, ensuring reliable flooding across the network.

Full explanation →

124

MCQhard

Which BGP message type is responsible for negotiating session parameters, including autonomous system numbers, hold times, and BGP identifiers during session establishment?

A.Notification

B.Open

C.Update

D.Keepalive

AnswerB

Correct. The Open message is sent immediately after establishing a TCP connection to initialize the BGP session and negotiate parameters.

Why this answer

The BGP Open message is the first message sent after a TCP connection is established. It contains parameters such as the BGP version, local AS number, hold time, BGP identifier, and optional parameters (capabilities).

Full explanation →

125

MCQeasy

You are configuring a virtual router routing instance on a Juniper device to isolate traffic for a specific department. Which routing-instance type should you select?

A.l2vpn

B.forwarding

C.no-forwarding

D.virtual-router

AnswerD

The virtual-router instance type provides a completely separate routing table and supports dynamic routing protocols and static routes.

Why this answer

The virtual-router routing instance type is used for complete isolation of routing tables without requiring interface sharing with MPLS VPNs (unlike VRF).

Full explanation →

126

MCQeasy

What type of LSA is generated by an OSPF Area Border Router (ABR) to advertise networks from one area to another area?

A.Type 2 (Network LSA)

B.Type 1 (Router LSA)

C.Type 3 (Summary LSA)

D.Type 5 (AS-external LSA)

AnswerC

Correct. Type 3 LSAs advertise inter-area routes between areas.

Why this answer

Type 3 LSAs (Network Summary LSAs) are generated by ABRs to advertise networks originating in one area to other areas within the OSPF routing domain.

Full explanation →

127

MCQhard

You are configuring a qualified next-hop for a static route in Junos to provide redundancy. Which parameter allows you to specify a secondary next-hop with a different preference value?

A.alternate-path

B.qualified-next-hop

C.secondary-route

D.backup-next-hop

AnswerB

The 'qualified-next-hop' statement lets you define alternate next-hops with custom preferences or metrics.

Why this answer

Qualified next-hops allow administrators to assign specific preferences or metrics to individual next-hops of a static route.

Full explanation →

128

MCQmedium

You need to ensure that an iBGP-learned route is properly advertised to other eBGP peers without triggering routing loops. Which mechanism does BGP use automatically to prevent routing loops within an Autonomous System?

A.MED attribute comparison

B.Local Preference check

C.AS-path loop prevention on eBGP export

D.Cluster list checking

AnswerC

When advertising routes to eBGP peers, the local AS is prepended. If an AS sees its own ASN in the AS_PATH, it drops the update.

Why this answer

iBGP split horizon rule specifies that routes learned from an iBGP peer are not advertised to other iBGP peers, but it requires full mesh, route reflectors, or confederations. For eBGP advertising, AS path is used.

Full explanation →

129

MCQhard

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

A.The static client is using an IP address outside the DHCP pool range.

B.The client's MAC address violates the port security maximum limit.

C.DAI requires all interfaces to be trusted on the VLAN.

D.The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.

AnswerD

Static clients do not generate DHCP bindings, requiring static IP source entries or static ARP inspection entries for DAI to permit their ARP packets.

Why this answer

Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Full explanation →

130

MCQmedium

An engineer wants to configure Nonstop Active Routing (NSR) alongside GRES on an MX204 router running OSPF. What is the primary operational benefit of enabling NSR compared to running GRES alone?

A.NSR automatically configures VRRP tracking on all local VLAN interfaces.

B.NSR allows software upgrades to be performed without ever rebooting either Routing Engine.

C.NSR synchronizes protocol daemon states between Routing Engines, preventing neighbors from detecting a control plane switchover.

D.NSR replaces LACP negotiation with static member pinning during link failures.

AnswerC

NSR keeps the backup RE fully synchronized with protocol states (like OSPF/BGP), so neighbors see zero disruption and no adjacency drops.

Why this answer

GRES preserves forwarding state during a switchover, but routing protocols must restart and re-converge unless NSR is running, which synchronizes routing protocol states between REs.

Full explanation →

131

MCQmedium

You suspect that a network loop has formed due to a misconfigured RSTP topology on your EX Series switches. Which command shows real-time topology change notifications and counts on the switch?

A.show bridge mac-table

B.show spanning-tree interface detail

C.show rstp neighbor

D.show spanning-tree statistics

AnswerD

This command provides counts for topology changes and BPDU packets processed.

Why this answer

The command 'show spanning-tree statistics' displays counters related to topology changes, BPDU transmission, and reception per interface.

Full explanation →

132

Multi-Selectmedium

Which THREE actions are performed by an RSTP switch when a topology change is detected? (Choose three.)

Select 3 answers

A.Starting a TC while timer to flood notifications

B.Sending topology change notifications out of active designated and root ports

C.Electing a new root bridge automatically

D.Resetting all edge ports to the discarding state

E.Clearing dynamic MAC address entries associated with non-edge ports

AnswersA, B, E

A TC while timer controls the duration of notification flooding.

Why this answer

When an RSTP topology change occurs, the switch starts a TC while timer, clears dynamic MAC entries on non-edge ports, and floods TC notifications to active designated and root ports.

Full explanation →

133

MCQmedium

What happens if you have an LSP with an expired lifetime?

A.The router immediately crashes.

B.The LSP is flooded to all neighbors.

C.The LSP is removed from the LSDB.

D.The router re-elects a new DIS.

AnswerC

Expired LSPs are flushed from the database.

Why this answer

When an LSP's remaining lifetime reaches zero, it is purged from the database after a short period.

Full explanation →

134

Multi-Selecteasy

Which TWO troubleshooting commands help identify OSPF route installation issues in the Junos routing table? (Choose two)

Select 2 answers

A.clear ospf database

B.show ospf neighbor detail

C.show ospf database summary

D.show route protocol ospf

E.show route terse

AnswersD, E

Correct. Displays active routing table entries learned via OSPF.

Why this answer

Commands like 'show route protocol ospf' and 'show route table inet.0' display routes learned and installed by OSPF.

Full explanation →

135

MCQmedium

You are configuring an IP-IP tunnel on a Junos routing platform. Which statement correctly identifies how IP-IP encapsulation differs from GRE encapsulation?

A.IP-IP encapsulation includes a 4-byte protocol header while GRE includes routing and key fields.

B.IP-IP requires a logical tunnel (lt-) interface to function properly.

C.IP-IP encapsulates an IP packet inside another IP packet with an outer IP header and no extra transport header, whereas GRE includes a GRE header.

D.GRE supports only IPv4 payloads while IP-IP supports both IPv4 and IPv6.

AnswerC

IP-IP tunnels wrap the inner IP packet directly in an outer IP header, whereas GRE includes a dedicated GRE header for features like keying and multiple protocols.

Why this answer

IP-IP encapsulation simply encapsulates an IP packet inside another IP packet without any additional headers, whereas GRE adds a specific GRE header.

Full explanation →

136

Multi-Selecthard

Which actions occur during an IS-IS SPF calculation? (Choose THREE)

Select 3 answers

A.Generating new IIH packets.

B.Calculating the shortest path to each destination.

C.Updating the IP routing table (RIB).

D.Building a Shortest Path Tree from the LSDB.

E.Re-electing the DIS.

AnswersB, C, D

Core SPF step.

Why this answer

SPF involves building a tree from the LSDB, calculating the shortest path, and updating the RIB.

Full explanation →

137

MCQmedium

You are configuring Filter-Based Forwarding (FBF) on an interface. You apply a firewall filter that matches specific source addresses and uses 'then routing-instance' as an action. What must be configured in that target routing instance to ensure return traffic is handled correctly?

A.A default route pointing back to the core gateway within that routing instance's routing table.

B.A static ARP entry for every device on the network.

C.An RSVP LSP bridging the source and destination instances.

D.A BGP peering session with the loopback address.

AnswerA

The FBF routing instance must have a valid path to route the packet; otherwise, it will be dropped as a routing black hole.

Why this answer

Filter-based forwarding only intercepts packets leaving an interface. To ensure traffic can route properly within the target instance and return, routes (such as a default route) must be present in that instance's routing table.

Full explanation →

138

MCQhard

An administrator has configured a GRE tunnel between two SRX Series devices. Traffic originating from behind the local security zone destined for the tunnel interface is being dropped by default security policies. Which action must be taken to ensure transit traffic can enter the GRE tunnel?

A.Disable flow-based mode globally on the SRX Series device.

B.Enable proxy-arp on the physical interface.

C.Configure a security policy from the internal zone to the zone containing the gr- interface allowing all traffic.

D.Add the gr- interface to the junos-default security zone.

AnswerC

SRX Series devices require explicit security policies to permit traffic entering or leaving tunnel interfaces associated with security zones.

Why this answer

Security zones and policies must permit traffic from the internal security zone to the zone where the gr- interface resides, or configure appropriate self-traffic/zone policies.

Full explanation →

139

MCQeasy

Which protocol number is used in the outer IP header for an IP-IP tunnel?

A.47

B.6

C.4

D.17

AnswerC

Protocol 4 is the standard assigned protocol number for IP-in-IP encapsulation.

Why this answer

IP-IP encapsulation (Protocol 4) encapsulates IPv4 packets inside IPv4 packets.

Full explanation →

140

MCQmedium

You are configuring a GRE tunnel and want to ensure that integrity checks are performed on the transmitted packets to detect corruption. Which parameter should you add to the tunnel configuration?

A.set interfaces gr-0/0/0 unit 0 tunnel verify-integrity

B.set protocols gre checksum-validation enable

C.set interfaces gr-0/0/0 unit 0 tunnel checksum

D.set interfaces gr-0/0/0 unit 0 family inet encryption aes256

AnswerC

The tunnel checksum command enables the optional GRE checksum field for error detection.

Why this answer

Enabling checksum validation ensures integrity checking of the GRE header and payload.

Full explanation →

141

MCQmedium

An engineer needs to configure a Link Aggregation Group (LAG) between two Juniper EX4300 switches to provide redundant uplinks to a core router. Which statements regarding the LACP configuration requirements on the EX4300 switch must be met?

A.LAG interfaces do not require explicit definition under the chassis stanza.

B.LACP multi-chassis mode must be enabled for a single switch LAG.

C.LACP heartbeat intervals are strictly hardcoded to 1 second and cannot be modified.

D.The member interfaces must have matching speed, duplex, and LACP mode configuration.

AnswerD

All member links in an AE bundle must operate at identical speed and duplex settings, and share matching LACP active/passive modes.

Why this answer

LACP on Junos requires matching system priority, interface speeds, and duplex settings on both ends of the LAG, along with explicit configuration under the 'ae' interface.

Full explanation →

142

MCQmedium

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

A.Configure the interface as a trusted interface for DHCP snooping.

B.Configure the interface as a trunk port.

C.Apply an ingress firewall filter blocking UDP port 67.

D.Enable IP Source Guard on the uplink interface.

AnswerA

Trusted interfaces allow DHCP server replies (Offers and Acknowledgments), whereas untrusted ports drop them.

Why this answer

Ports facing legitimate DHCP servers must be designated as trusted using 'set ethernet-switching-options secure-access-port vlan <name> dhcp-snooping interface <name> trusted'.

Full explanation →

143

Multi-Selecthard

An engineer is configuring a trunk port on an EX Series switch and needs to manage untagged traffic, allowed VLANs, and native VLAN tagging behavior. Which THREE configurations are valid in Junos for a trunk interface? (Choose three.)

Select 3 answers

A.set interfaces ge-0/0/9 unit 0 family ethernet-switching vlan members [ 10 20 30 ]

B.set interfaces ge-0/0/9 unit 0 family ethernet-switching native-vlan-id 10

C.set interfaces ge-0/0/9 unit 0 family ethernet-switching interface-mode trunk

D.set interfaces ge-0/0/9 unit 0 family ethernet-switching trunk-encapsulation dot1q-only

E.set interfaces ge-0/0/9 unit 0 family ethernet-switching access-vlan 10

AnswersA, B, C

Correct. Specifies an explicit allowed member list.

Why this answer

Trunk interface configurations in Junos allow setting trunk mode, native VLAN ID, and explicit or member-all VLAN membership lists.

Full explanation →

144

MCQeasy

Which Junos command displays detailed information about OSPF neighbor states, including dead timer countdowns and address bindings?

A.show ospf neighbor detail

B.show ospf statistics

C.show route table inet.0

D.show ospf database detail

AnswerA

Correct. This command displays detailed information regarding OSPF neighbors.

Why this answer

The command 'show ospf neighbor detail' provides comprehensive operational details about OSPF neighbor relationships, state, timers, and interface bindings.

Full explanation →

145

Multi-Selecthard

An administrator is troubleshooting a BGP peering session that is stuck in the Connect or Active state. Which THREE common causes could explain this issue? (Choose three)

Select 3 answers

A.Route reflection client parameters are misconfigured.

B.TCP port 179 is blocked by a firewall filter.

C.Incorrect neighbor IP address configured under protocols bgp.

D.Incorrect peer AS number configured in the OPEN message parameters.

E.Missing multihop configuration for a non-directly connected eBGP peer.

AnswersB, C, E

Firewalls blocking port 179 prevent TCP connection establishment.

Why this answer

A session stuck in Active/Connect means the TCP session cannot be established. Causes include incorrect peer IP/AS, firewall blocking port 179, or missing multihop/TTL settings.

Full explanation →

146

Multi-Selecthard

Which THREE types of routers can act as an OSPF Autonomous System Boundary Router (ASBR)? (Choose three)

Select 3 answers

A.An Area Border Router (ABR) redistributing BGP routes into OSPF

B.A router operating exclusively in a totally stubby area

C.A non-backbone internal router redistributing connected routes into OSPF

D.A router running only RIP without OSPF enabled

E.A backbone router inside Area 0 redistributing static routes into OSPF

AnswersA, C, E

Correct. An ABR can also act simultaneously as an ASBR.

Why this answer

An ASBR can be an internal router, an ABR, or a router located in the backbone or stub areas, provided it is configured to redistribute external routes from another protocol (like BGP, static, or local direct routes) into OSPF.

Full explanation →

147

Multi-Selecthard

When configuring Private VLANs (PVLANs) on Juniper EX Series switches, which TWO types of ports are defined within the architecture? (Choose two.)

Select 2 answers

A.Root bridge port

B.Promiscuous port

C.Host port (Isolated or Community)

D.Core uplink port

E.Trunk access port

AnswersB, C

Promiscuous ports can communicate with all interfaces in the private VLAN, including isolated and community ports.

Why this answer

Private VLANs use promiscuous ports (connected to routers or default gateways) and host ports (further subdivided into isolated and community ports).

Full explanation →

148

Multi-Selectmedium

Which THREE parameters must match across all switches for them to successfully form a single MST region? (Choose three.)

Select 3 answers

A.VLAN-to-instance mapping table

B.Configuration name

C.Revision number

D.Bridge priority value

E.Hello timer interval

AnswersA, B, C

VLAN allocations to MST instances must be identical across region members.

Why this answer

MST region membership requires matching configuration names, revision numbers, and VLAN-to-instance mapping tables.

Full explanation →

149

MCQmedium

You need to ensure that a core switch retains its position as the root bridge even if a new switch with a manually lowered bridge priority is added to the network. Which feature should you configure on the core switch's ports facing the downstream switches?

A.Loop protection

B.BPDU guard

C.Root protection

D.Edge port configuration

AnswerC

Root protection enforces that the designated root port stays designated, rejecting superior BPDUs.

Why this answer

Root protection prevents a designated port from becoming a root port, ensuring that if a superior BPDU arrives on that port, the port transitions to a root-inconsistent (discarding) state rather than yielding the root role.

Full explanation →

150

MCQmedium

An engineer configures VRRP between two routers. Client traffic destined for the outside network is being dropped intermittently. Investigation reveals that the VRRP master is responding to ARP requests with its physical MAC address instead of the virtual router MAC address. What is the cause of this behavior?

A.The virtual-mac-address option was explicitly disabled, or an incorrect configuration caused the master to use its physical interface MAC address for virtual IP ARP responses.

B.LACP fast mode was enabled on the VLAN interface.

C.GRES was disabled on the backup routing engine.

D.NSR was enabled without configuring BGP Graceful Restart.

AnswerA

Disabling virtual MAC addresses forces the master to answer ARP with its physical MAC, causing MAC table flapping on switches when mastership switches.

Why this answer

By default, VRRP routers respond to ARP requests with the virtual MAC address (00:00:5e:00:01:{VRID}), but certain misconfigurations or lack of virtual-mac-address support can cause issues. Wait, actually, standard Junos VRRP uses virtual MAC addresses. If virtual-mac-address is disabled or if proxy ARP / source NAT behaviors interfere, clients might get confused.

However, let's look at Junos specific VRRP behavior: Junos uses the standard virtual MAC address automatically. If ARP handling is normal, what causes physical MAC usage? In some platforms, if the virtual-mac-address is disabled or if tracking interacts incorrectly, or let's evaluate the options.

Full explanation →

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 76–150