Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) JNCIS-ENT Questions 151–225 | Page 3/7

151

Multi-Selectmedium

Which THREE factors should be considered when planning MTU size for traffic traversing a GRE tunnel? (Choose three)

Select 3 answers

A.Adjusting TCP MSS or tunnel interface MTU helps prevent packet fragmentation and drop issues.

B.The GRE header adds additional byte overhead to every encapsulated packet.

C.GRE tunnels automatically expand physical interface MTU sizes to accommodate overhead.

D.IP-IP headers are larger than GRE headers, requiring larger MTU adjustments.

E.If the Don't Fragment (DF) bit is set and the packet exceeds the path MTU, it will be dropped if fragmentation cannot occur.

AnswersA, B, E

Lowering interface MTU or adjusting TCP MSS prevents MTU-related packet drops.

Why this answer

GRE adds overhead, DF bit behavior matters, and fragmenting or adjusting MSS avoids drops.

Full explanation →

152

MCQhard

An MX Series router is configured with BGP Multipath. Two paths have identical Local Preference, AS path length, origin, and MED. Which additional configuration statement is required under protocols bgp to enable multipath load balancing across these iBGP paths?

A.set protocols bgp group internal type external

B.set protocols bgp multipath relaxation

C.set routing-options forwarding-table export load-balance

D.set protocols bgp group internal multihop

AnswerB

The relaxation statement allows iBGP multipath even if the AS path lengths differ slightly, or enables it for iBGP.

Why this answer

By default, multipath is only for eBGP. To enable iBGP multipath, the 'as-path-multipath relaxation' or 'ibgp multipath' statement must be used.

Full explanation →

153

MCQmedium

An administrator needs to restrict MAC learning on a specific access port (ge-0/0/5) on an EX Series switch to a maximum of 2 learned MAC addresses to prevent MAC flooding attacks. Where is this limit configured in Junos?

A.set forwarding-options storm-control interface ge-0/0/5 mac-limit 2

B.set protocols l2-learning global-max-mac-count 2 interface ge-0/0/5

C.set bridge-domains vlan-data interface ge-0/0/5 mac-limit 2

D.set interfaces ge-0/0/5 unit 0 family ethernet-switching port-security max-mac-count 2

AnswerD

Max MAC count is configured under port-security on the specific ethernet-switching interface.

Why this answer

MAC limit is configured under the interface-specific ethernet-switching-options hierarchy within the bridge-domains or vlans configuration, or directly under the interface if using port security.

Full explanation →

154

MCQeasy

An administrator configures a new VLAN ID 300 on an EX Series switch but forgets to assign any interfaces to it. What is the operational status of this VLAN?

A.The switch assigns all unused ports to VLAN 300 by default.

B.The VLAN remains inactive in the switching table until an interface or IRB is associated with it.

C.The switch generates a critical alarm preventing further configuration.

D.The switch automatically deletes the VLAN after 5 minutes if no ports are assigned.

AnswerB

Correct. Unassigned VLANs do not actively forward traffic or learn MAC addresses.

Why this answer

In Junos, a VLAN exists as a configuration object as soon as it is created, but remains inactive or has no active ports until interfaces are assigned.

Full explanation →

155

MCQmedium

You need to limit the number of dynamic MAC addresses learned on access interface ge-0/0/5 to a maximum of 10 to prevent MAC flooding attacks. Which configuration accomplishes this?

A.set interfaces ge-0/0/5 unit 0 family ethernet-switching mac-limit 10

B.set switch-options interface ge-0/0/5 maximum-mac 10

C.set protocols port-security interface ge-0/0/5 max-mac-addresses 10

D.set vlans finance storm-control-limit mac 10

AnswerA

Correct. The mac-limit statement restricts the number of learned MAC addresses on the port.

Why this answer

MAC limit is configured under the interface-specific ethernet-switching options or secure-access-port settings.

Full explanation →

156

Multi-Selectmedium

Which TWO BGP message types are responsible for maintaining session state or reporting errors without carrying routing information? (Choose two)

Select 2 answers

A.OPEN

B.KEEPALIVE

C.UPDATE

D.QUERY

E.NOTIFICATION

AnswersB, E

KEEPALIVE confirms session liveness periodically.

Why this answer

KEEPALIVE maintains the session state, and NOTIFICATION reports fatal errors and tears down the session. UPDATE carries routing information, and OPEN establishes the session.

Full explanation →

157

MCQeasy

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

A.reset interface security-violations

B.clear bridge security-counters

C.clear ethernet-switching security-violation

D.clear arp-inspection statistics

AnswerC

This command clears all port security, DAI, and IP Source Guard violations and counters.

Why this answer

Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Full explanation →

158

Multi-Selecthard

Which TWO mechanisms are utilized by RSTP to achieve rapid convergence compared to legacy 802.1D STP? (Choose two.)

Select 2 answers

A.Proposal-agreement handshake mechanism

B.Mandatory 15-second listening timer enforcement

C.Centralized root bridge polling

D.Support for point-to-point link synchronization

E.Periodic topology change broadcasting by root bridges

AnswersA, D

The proposal-agreement handshake allows immediate downstream state transitions.

Why this answer

RSTP achieves rapid convergence through the proposal-agreement handshake and the explicit support of point-to-point full-duplex links.

Full explanation →

159

MCQeasy

Which command is used on a Junos device to clear the OSPF database and force a re-synchronization with neighbors?

A.restart ospf-protocol

B.clear ospf neighbor

C.clear ospf database

D.reset routing-protocol ospf

AnswerC

Correct. This command clears and resets the OSPF database.

Why this answer

The 'clear ospf database' command clears and refreshes the OSPF link-state database on a Junos device.

Full explanation →

160

MCQmedium

You are configuring VRRP between two EX4600 switches to provide a default gateway for a VLAN. To ensure that the switch with the higher physical interface capacity assumes the master role, what parameter should you adjust?

A.Decrease the VRRP advertisement interval on the backup switch.

B.Set the virtual router identifier (VRID) to a lower integer value on the preferred switch.

C.Disable the VRRP preempt feature on both routers.

D.Increase the VRRP priority value on the preferred switch's interface.

AnswerD

The router with the highest VRRP priority (default 100) becomes the master.

Why this answer

VRRP master selection is determined by priority. The router with the highest priority becomes the master. You can also configure track-interface commands to lower priority if link failures occur.

Full explanation →

161

MCQhard

An engineer has configured a static route to the 192.168.100.0/24 network via 10.0.1.1. However, the route is not installing into the forwarding table because the recursive next-hop cannot be resolved. Which Junos command should the engineer use to verify the resolution status of the recursive next hop?

A.show route resolution

B.show route protocol static detail

C.show route forwarding-table destination 10.0.1.1

D.show system route summary

AnswerB

This command provides detailed path attributes, next-hop states, and resolution metrics for static routes.

Why this answer

The show route protocol static detail command displays detailed information about static routes, including the active next-hop and whether recursive resolution has succeeded.

Full explanation →

162

MCQmedium

When a topology change occurs in an RSTP network, how are MAC address forwarding table entries affected across the switches?

A.MAC addresses are relearned only after the root bridge sends a direct clearing command.

B.MAC address entries are retained until the standard 300-second aging timer expires.

C.MAC address tables are completely cleared for all ports, including edge ports.

D.MAC address table entries associated with non-edge ports are flushed immediately.

AnswerD

RSTP flushes dynamic MAC entries to quickly adapt to the new topology without waiting for aging timers.

Why this answer

Unlike legacy STP, RSTP immediately flushes MAC address entries associated with non-edge ports on receiving a topology change notification, speeding up convergence.

Full explanation →

163

Multi-Selecteasy

Which TWO states are valid OSPF operational adjacency states seen in Junos operational outputs? (Choose two)

Select 2 answers

A.2-Way

B.Listen

C.Connected

D.Full

E.Active

AnswersA, D

Correct. 2-Way indicates bidirectional communication has been established.

Why this answer

Valid OSPF states include Down, Init, 2-Way, ExStart, Exchange, Loading, and Full.

Full explanation →

164

MCQeasy

An administrator wants to verify that GRES is operating correctly on an MX series router with dual Routing Engines. Which operational command should be used?

A.show system backup-router

B.show virtual-chassis gres

C.show chassis routing-engine

D.show gres statistics

AnswerC

This command displays master/backup status, CPU, memory, and whether GRES is enabled and synchronized.

Why this answer

The command 'show chassis routing-engine' shows the status of both routing engines, their synchronization state, and GRES status.

Full explanation →

165

MCQeasy

What is the primary purpose of the Hello timer in RSTP?

A.It sets the interval between topology change notifications.

B.It determines the maximum time a switch waits before declaring a neighbor dead.

C.It defines the duration of the listening and learning states during convergence.

D.It dictates how often configuration BPDUs are generated and sent by the root bridge.

AnswerD

The Hello timer controls the interval between transmitted BPDUs.

Why this answer

The Hello timer defines how often a bridge generates and sends configuration BPDUs. In RSTP, it is typically set to 2 seconds by default.

Full explanation →

166

Multi-Selectmedium

Which THREE conditions must be met to successfully execute an In-Service Software Upgrade (ISSU) on a dual-RE Juniper routing platform? (Choose three)

Select 3 answers

A.Both Routing Engines must be fully populated with identical hardware models and supported Junos images.

B.Graceful Routing Engine Switchover (GRES) must be enabled and synchronized.

C.All physical interfaces must be manually placed in a disabled state prior to upgrade.

D.VRRP preemption must be disabled on all routing interfaces.

E.Nonstop Active Routing (NSR) or Graceful Restart must be configured for active routing protocols.

AnswersA, B, E

Compatible hardware and software paths are required for a successful ISSU.

Why this answer

ISSU requires GRES enabled, NSR or graceful restart configured, and matching hardware/software paths.

Full explanation →

167

MCQeasy

What is the primary function of the OSPF Designated Router (DR) on a broadcast network segment?

A.To translate Type 7 LSAs into Type 5 LSAs for the backbone

B.To authenticate OSPF hello packets across interfaces

C.To act as the sole exit gateway for all external traffic in the AS

D.To minimize the number of adjacencies and LSA flooding traffic on a multi-access segment

AnswerD

Correct. The DR and BDR limit adjacency bloat and reduce flooding traffic on broadcast/NBMA networks.

Why this answer

The DR reduces network traffic and LSA flooding overhead by acting as a central focal point for exchanging routing information and generating the Network LSA (Type 2) on multi-access segments.

Full explanation →

168

Multi-Selecteasy

Which TWO commands are valid Junos configuration hierarchy paths for setting up RSTP? (Choose two.)

Select 2 answers

A.set bridge rstp mode rapid-pvst

B.set protocols stp rstp-version true

C.set protocols rstp bridge-priority 4096

D.set protocols rstp interface ge-0/0/1.0 edge

E.set spanning-tree rstp enable

AnswersC, D

Valid command to set bridge priority under protocols rstp.

Why this answer

RSTP configuration in Junos is performed under 'protocols rstp' hierarchy.

Full explanation →

169

MCQmedium

You are configuring a trunk port on an EX Series switch and need to explicitly define the allowed VLAN list as VLANs 10, 20, and 30. Which configuration statement is correct?

A.set vlans members ge-0/0/4 [ 10 20 30 ]

B.set interfaces ge-0/0/4 unit 0 family ethernet-switching trunk-vlan 10,20,30

C.set interfaces ge-0/0/4 unit 0 family ethernet-switching interface-mode trunk vlan members [ 10 20 30 ]

D.set interfaces ge-0/0/4 unit 0 family ethernet-switching interface-mode trunk allowed-vlans 10 20 30

AnswerC

Correct. Brackets enclose the list of member VLANs on a trunk port.

Why this answer

Explicit VLAN lists on trunk ports use square brackets or comma separation under the vlan members statement.

Full explanation →

170

Multi-Selecthard

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

Select 3 answers

A.They are configured under the 'family ethernet-switching' match criteria context.

B.They are applied to logical Layer 3 routing interfaces (irb or vlan interfaces) using family inet.

C.They can match on source and destination MAC addresses as well as EtherType fields.

D.They can be applied to physical switch ports or entire VLANs.

E.They execute routing lookups prior to evaluating packet match conditions.

AnswersA, C, D

Layer 2 filters require the family ethernet-switching context.

Why this answer

Layer 2 filters use family ethernet-switching, can match on MAC addresses and EtherTypes, and are applied to interfaces or VLANs.

Full explanation →

171

Multi-Selectmedium

Which TWO actions occur when a packet matches a static route configured with the 'reject' parameter? (Choose two)

Select 2 answers

A.The packet is silently dropped without any notification.

B.The packet is forwarded to the default gateway.

C.An ICMP destination unreachable message is sent back to the packet source.

D.The route is installed into the forwarding table.

E.The packet is tagged with an MPLS label.

AnswersC, D

Reject returns an ICMP unreachable message.

Why this answer

Reject installs the route into the forwarding table and ensures packets matching it generate an ICMP unreachable message while being dropped.

Full explanation →

172

MCQhard

An administrator notices that CPU utilization on the Routing Engine spikes when a high volume of transit traffic is directed through a locally terminated GRE tunnel on an MX router without inline services configured. What is the cause?

A.GRE keepalives are transmitting every 1 millisecond.

B.IP-IP tunnels require software processing, whereas GRE is always hardware-switched.

C.The firewall filter logging feature is active on all tunnel interfaces.

D.Tunnel encapsulation/decapsulation is falling back to Routing Engine CPU processing due to missing inline services PIC configuration.

AnswerD

Without hardware-based tunnel services enabled on capable FPCs/PICs, GRE processing can impact the Routing Engine CPU.

Why this answer

Without inline services or appropriate PIC support configured for tunnel services, packet processing for encapsulation and decapsulation may fallback to software processing on the Routing Engine or non-optimized paths.

Full explanation →

173

Multi-Selecteasy

An administrator wants to examine Layer 2 switching status and MAC learning tables on an EX Series switch. Which TWO operational commands can be used to gather this information? (Choose two.)

Select 2 answers

A.show vlans summary

B.show bridge-domain forwarding-table

C.show ethernet-switching interface

D.show ip route bridge

E.show ethernet-switching table

AnswersC, E

Correct. Displays ethernet-switching interface operational states and modes.

Why this answer

MAC tables and interface switching states are reviewed using 'show ethernet-switching table' and 'show ethernet-switching interface'.

Full explanation →

174

MCQhard

An administrator configures filter-based forwarding. The firewall filter uses the action 'then routing-instance custom-vr'. Where must the custom-vr routing instance be defined for the filter to accept this configuration without committing errors?

A.Under the [edit system FBF] hierarchy.

B.Under the [edit interfaces interface-name unit 0 family inet] hierarchy.

C.Under the [edit routing-instances] hierarchy.

D.Under the [edit firewall family inet filter] hierarchy.

AnswerC

Junos requires all custom routing instances to be declared under routing-instances before being referenced in policies or filters.

Why this answer

Any routing instance referenced in a firewall filter action must be explicitly defined under the top-level 'routing-instances' hierarchy.

Full explanation →

175

MCQeasy

An administrator needs to modify the name of an existing VLAN from 'sales' to 'retail' without changing its VLAN ID 40. Which command accomplishes this?

A.edit vlans sales vlan-name retail

B.change vlans sales name retail

C.set vlans retail vlan-id 40

D.rename vlans sales to retail

AnswerD

Correct. The rename command updates the configuration identifier while preserving child statements.

Why this answer

In Junos, renaming a configuration object is performed using the 'rename' command in configuration mode.

Full explanation →

176

Multi-Selecthard

Which THREE statements are true regarding the Designated Intermediate System (DIS) election and its operational differences compared to OSPF's Designated Router (DR) election? (Choose three)

Select 3 answers

A.The IS-IS DIS election is non-preemptive; if a router with a higher priority comes online later, it does not take over until the current DIS fails or is restarted.

B.In the event of a priority tie during DIS election, the router with the higher interface MAC address (or higher system ID depending on media) wins the tie-breaker.

C.IS-IS DIS election requires all routers on the segment to have identical area addresses regardless of whether they are Level 1 or Level 2.

D.Unlike OSPF, IS-IS does not have a separate Backup Designated Router (BDR) role; instead, routers keep track of priorities for a backup DIS implicitly.

E.The DIS is responsible for flooding individual LSPs using unicast packets exclusively to all neighbors.

AnswersA, B, D

DIS election is strictly non-preemptive to maintain network stability.

Why this answer

IS-IS DIS election is non-preemptive (unlike OSPF, which is also non-preemptive by default unless changed, but IS-IS never preempts even if a higher priority router joins later), supports backup DIS implicitly via priority, and uses higher priority and then higher MAC address as a tie-breaker.

Full explanation →

177

MCQeasy

Which CLI command is used to manually initiate a Routing Engine switchover on an MX series router configured with GRES?

A.restart routing-engine backup

B.request chassis routing-engine master switch

C.request system reboot backup

D.set chassis routing-engine switchover

AnswerB

This command triggers a controlled switchover to test or invoke GRES.

Why this answer

The 'request chassis routing-engine master switch' command forces a manual switchover from the primary to the backup Routing Engine.

Full explanation →

178

Multi-Selecthard

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

Select 3 answers

A.Enable active router-advertisement snooping to support the filter.

B.Apply the filter under the 'family inet' routing protocol hierarchy.

C.Configure the filter action as 'discard' for the broadcast term.

D.Define the filter under 'family ethernet-switching'.

E.Use a match condition for destination MAC address broadcast 'ff:ff:ff:ff:ff:ff'.

AnswersC, D, E

The discard action drops the matching broadcast traffic.

Why this answer

Implementing this filter requires defining the family ethernet-switching context, writing a term matching broadcast destination MAC addresses with action discard, and applying the filter to the VLAN or interface.

Full explanation →

179

Multi-Selectmedium

Which TWO routing instance types support running dynamic interior routing protocols like OSPF and IS-IS within Junos OS? (Choose two)

Select 2 answers

A.virtual-router

B.no-structural-instance

C.Default (inet.0) instance

D.forwarding

E.l2vpn

AnswersA, C

Virtual-router instances support full routing protocol suites.

Why this answer

The default routing instance and the virtual-router routing instance both support running independent dynamic routing protocols.

Full explanation →

180

MCQhard

An enterprise network uses private VLANs. A server connected to an isolated port needs to send traffic out of the primary VLAN. Which statement accurately describes how traffic forwarding operates for an isolated port in Junos?

A.Traffic from an isolated port can reach other isolated ports within the same secondary VLAN.

B.Isolated ports can communicate freely with community ports, but not other isolated ports.

C.Traffic from an isolated port can only be forwarded to the designated promiscuous port.

D.Traffic from an isolated port is dropped unless a Layer 3 firewall filter explicitly permits it.

AnswerC

Correct. Isolated ports are restricted and can only talk to promiscuous ports.

Why this answer

Isolated ports can only communicate with the promiscuous port; they cannot communicate with other isolated ports or community ports.

Full explanation →

181

MCQhard

While examining a BGP routing table, you notice a route with an ORIGIN attribute set to 'Incomplete'. What does this indicate about the origin of the route?

A.The route was learned via eBGP from an unknown AS.

B.The BGP update packet was corrupted in transit.

C.The route is an aggregate route without specific components.

D.The route was injected into BGP via redistribution (e.g., from static or IGP).

AnswerD

Incomplete origin is typically assigned when routes are redistributed into BGP.

Why this answer

BGP origin types are IGP (0), EGP (1), and Incomplete (2). Incomplete means the route origin is unknown, typically redistributed from an IGP or static route.

Full explanation →

182

MCQeasy

What is the default bridge priority value assigned to Juniper EX Series switches when RSTP is enabled?

A.61440

B.0

C.32768

D.4096

AnswerC

32768 is the IEEE default bridge priority value used across JUNOS routing and switching platforms.

Why this answer

The default bridge priority for JUNOS devices running STP, RSTP, or MSTP is 32768.

Full explanation →

183

MCQhard

When configuring MSTP, how is the regional maximum hop count enforced across switches within the same MST region?

A.The regional root periodically floods drop-commands if the network diameter exceeds the limit.

B.BPDUs carry a hop count that is decremented by each bridge; when it reaches zero, the BPDU is dropped.

C.Switches drop any incoming BPDUs that exceed the statically configured Max Age timer.

D.Ports exceeding the hop count are automatically placed into the error-disabled state.

AnswerB

MSTP uses a hop count mechanism similar to IP TTL to limit BPDU propagation within a region.

Why this answer

Each switch decrements the hop count field in the MSTP BPDU before forwarding it; if the hop count reaches zero, the BPDU is discarded, preventing loops in large MSTP deployments.

Full explanation →

184

Multi-Selectmedium

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Select 3 answers

A.It requires IP Source Guard to be enabled before the binding table can be populated.

B.It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.

C.Ports facing DHCP servers must be explicitly configured as trusted.

D.Untrusted ports drop DHCP server response messages (Offer and ACK).

E.It operates exclusively by analyzing static ARP entries configured by administrators.

AnswersB, C, D

DHCP snooping tracks these parameters to build the secure binding database.

Why this answer

DHCP snooping builds a binding table, blocks rogue servers on untrusted ports, and inspects DHCP messages.

Full explanation →

185

MCQeasy

Which routing-instance type is specifically designed to support Layer 3 VPNs (L3VPNs) utilizing BGP as the-peering protocol and MP-BGP for VPN route distribution?

A.virtual-router

B.forwarding

C.VPLS

D.vrf

AnswerD

The vrf instance type is used for L3VPN implementations, supporting route targets and route distinguishers.

Why this answer

The 'vrf' routing instance type is designed for MPLS Layer 3 VPNs, maintaining a distinct routing and forwarding table for each customer.

Full explanation →

186

MCQhard

An administrator has configured a forwarding-type routing instance to perform filter-based forwarding. Which configuration statement is mandatory under the routing-instances hierarchy to properly define this instance type?

A.set routing-instances dept-fwd routing-options interface ge-0/0/0.0

B.set routing-instances dept-fwd instance-type virtual-router

C.set routing-instances dept-fwd instance-type l3vpn

D.set routing-instances dept-fwd instance-type forwarding

AnswerD

The 'forwarding' instance type is specifically designed for filter-based forwarding (FBF) applications.

Why this answer

A forwarding instance requires the instance-type forwarding statement under the routing-instances definition.

Full explanation →

187

MCQeasy

An engineer is troubleshooting a BGP session between two routers and notices that the connection is stuck in the Active state. What does the Active state indicate about the BGP finite state machine?

A.The TCP connection attempt is ongoing or has failed, and the router is actively trying to establish a TCP session with the peer.

B.The local router has successfully completed the TCP handshake and is waiting for an Open message.

C.BGP has exchanged Open messages and is currently negotiating capability parameters.

D.The BGP session is fully operational and exchanging Keepalive messages.

AnswerA

Correct. In the Active state, the router attempts to initiate a TCP connection to the remote BGP speaker.

Why this answer

In the Active state, the local router has initiated a TCP connection to the peer, but the TCP handshake has not yet completed successfully or has failed. This usually points to routing, firewall, or port 179 issues.

Full explanation →

188

MCQeasy

Which Junos operational mode command is used to verify the operational status and packet statistics of configured GRE tunnel interfaces?

A.show interfaces gr-0/0/0

B.show protocols tunnel status

C.show chassis tunnels

D.show gre tunnel summary

AnswerA

The show interfaces command followed by the specific gr- interface name displays operational details, traffic counters, and link status.

Why this answer

show interfaces gr-0/0/0 or show interfaces terse displays the operational status of GRE interfaces.

Full explanation →

189

MCQeasy

An administrator needs to configure a basic GRE tunnel between two Junos devices across a routed IP network. Which interface family must be enabled on the physical transit interface to allow the GRE encapsulated packets to traverse the network?

A.family mpls

B.family iso

C.family ccc

D.family inet

AnswerD

The transit interface requires family inet to route the outer IP header of the GRE packet.

Why this answer

The physical transit interface must have the inet family enabled to route the outer IP packets containing the GRE encapsulation.

Full explanation →

190

MCQeasy

An administrator runs 'show vlans' and notices that a particular VLAN has the status 'Active' but no interfaces listed under it. What does this indicate?

A.The VLAN is defined in the configuration and has an active IRB interface or routing instance, but no physical switch ports assigned.

B.The VLAN has been disabled by Spanning Tree Protocol.

C.The switch memory is full and cannot display interface memberships.

D.The VLAN configuration has a syntax error.

AnswerA

Correct. An IRB interface can keep a VLAN active even without physical ports.

Why this answer

An active VLAN without interfaces means the VLAN is defined in the database and associated with an IRB (Layer 3 interface) or routing instance, but no physical switch ports are members.

Full explanation →

191

MCQhard

An organization runs MSTP with multiple instances. A packet belonging to a VLAN that is not explicitly mapped to any MST instance is processed in which manner?

A.It is processed by the default RSTP instance running outside MSTP.

B.It is dropped by the switch because unmapped VLANs are considered invalid in MSTP.

C.It is automatically mapped to Instance 0 (the CIST).

D.It floods to all ports regardless of spanning tree port states.

AnswerC

Instance 0 acts as the default catch-all instance for any unmapped VLANs.

Why this answer

Any unmapped VLANs in MSTP are automatically mapped to Instance 0, which is the CIST (Common and Internal Spanning Tree).

Full explanation →

192

MCQeasy

What is the primary function of a Junos routing instance of type 'forwarding'?

A.To terminate BGP sessions from multiple external peers

B.To run multiple independent OSPF instances

C.To provide transparent bridging across WAN circuits

D.To support filter-based forwarding without running routing protocols

AnswerD

Forwarding instances allow packets to be routed based on firewall filter actions using separate forwarding tables.

Why this answer

Forwarding instances are lightweight instances that allow filter-based forwarding without running any independent routing protocols or maintaining separate dynamic routing tables.

Full explanation →

193

MCQhard

A Junos router is configured as a BGP route reflector. It learns a route from a client and reflects it to a non-client and another client. Which attribute does the route reflector modify or add to prevent routing loops?

A.MED and NEXT_HOP

B.AS_PATH and LOCAL_PREF

C.COMMUNITY and ATOMIC_AGGREGATE

D.ORIGINATOR_ID and CLUSTER_LIST

AnswerD

ORIGINATOR_ID and CLUSTER_LIST are added during reflection to detect and prevent loops.

Why this answer

Route reflectors add the ORIGINATOR_ID (to prevent loops back to the originator) and the CLUSTER_LIST (to prevent loops between reflectors).

Full explanation →

194

Multi-Selecteasy

Which TWO statements are true regarding Junos tunnel interface naming conventions? (Choose two)

Select 2 answers

A.GRE tunnel interfaces begin with the prefix 'gr-'.

B.Secure tunnel interfaces (IPsec) begin with the prefix 'gr-'.

C.Logical tunnel interfaces begin with the prefix 'ip-'.

D.IP-IP tunnel interfaces begin with the prefix 'ip-'.

E.All tunnel interfaces must start with the prefix 'xe-'.

AnswersA, D

GRE interfaces are named gr-FPC/PIC/PORT.

Why this answer

GRE tunnels use 'gr-' and IP-IP tunnels use 'ip-' prefixes.

Full explanation →

195

Multi-Selecteasy

Which TWO parameters are typically configured when tuning RSTP timers on Junos EX Series switches? (Choose two.)

Select 2 answers

A.forward-delay-timer-scale

B.edge-port-delay

C.max-age

D.topology-change-interval

E.hello-time

AnswersC, E

Controls BPDU expiration timeout.

Why this answer

Administrators can tune RSTP behavior using timers such as hello-time and max-age under the protocols rstp hierarchy.

Full explanation →

196

MCQeasy

Which CLI command displays detailed information about VRRP groups, including master router status, virtual IP addresses, and advertisement intervals on an EX series switch?

A.show lacp vrrp-status

B.show vrrp detail

C.show spanning-tree vrrp

D.show chassis vrrp

AnswerB

show vrrp detail provides comprehensive output including master state, priority, timers, and tracking status.

Why this answer

The 'show vrrp interface' or 'show vrrp detail' commands provide granular details regarding VRRP instance status.

Full explanation →

197

MCQhard

An OSPF area contains routers running Junos OS where external routes must be imported into the OSPF domain from a BGP core. However, the area must not accept external AS-external LSAs (Type 5) from other areas, but must allow routers within this area to originate external routes themselves. Which area type fulfills this requirement?

A.Backbone Area (Area 0)

B.Totally Stubby Area

C.Standard Stub Area

D.Not-So-Stubby Area (NSSA)

AnswerD

Correct. NSSA allows external routing information to be injected via Type 7 LSAs without accepting Type 5 LSAs.

Why this answer

A Not-So-Stubby Area (NSSA) blocks Type 5 AS-external LSAs from the backbone, but allows locally redistributed external routes to be translated into Type 7 LSAs and flooded within the NSSA.

Full explanation →

198

MCQmedium

Which BGP attribute is classified as 'well-known discretionary'?

A.AS_PATH

B.ORIGIN

C.MED

D.LOCAL_PREF

AnswerD

LOCAL_PREF is well-known discretionary.

Why this answer

Local Preference is a well-known discretionary attribute, meaning all BGP implementations must recognize it, but it does not have to be included in every update.

Full explanation →

199

MCQeasy

An administrator needs to configure a Juniper EX Series switch to participate in an existing Spanning Tree topology without risking the switch becoming the root bridge. Which command should be used to achieve this?

A.set protocols rstp bridge-priority 61440

B.set protocols rstp forward-delay 30

C.set protocols rstp root-protection

D.set protocols rstp disable

AnswerA

Setting the bridge priority to a higher numerical value (such as 61440, default is 32768) ensures the switch loses root bridge elections.

Why this answer

Configuring a bridge priority higher than the current root (e.g., 61440) or setting a lower priority makes it less likely to become root, but the definitive best practice for non-core switches to prevent them from becoming root is manipulating the bridge priority to a high value like 61440.

Full explanation →

200

MCQeasy

Which command displays the configuration of a specific GRE tunnel interface in candidate configuration mode on Junos?

A.display interface gr-0/0/0

B.view gr-0/0/0 configuration

C.get interface gr-0/0/0

D.show interfaces gr-0/0/0

AnswerD

This command displays the interface configuration in both operational and configuration modes.

Why this answer

To view the active or candidate configuration for a specific interface, the 'show interfaces gr-0/0/0' command is used in operational mode, or 'show interfaces gr-0/0/0' within configuration mode.

Full explanation →

201

MCQmedium

An administrator is configuring VRRP on an EX4300 switch and wants to ensure that when the primary router recovers from a failure, it immediately reclaims the master role from the backup router. Which VRRP configuration parameter controls this behavior?

A.The tracking decrement value set to zero.

B.The preemption parameter (enabled by default), which allows a higher-priority router to preempt the current master.

C.The virtual-mac-address configuration statement.

D.The advertisement interval timer set to 1 millisecond.

AnswerB

Preemption ensures that the highest priority router automatically reclaims mastership upon recovery.

Why this answer

Preemption is enabled by default in Junos VRRP, allowing a higher-priority router to take over when it comes back online.

Full explanation →

202

MCQmedium

What is the effect of changing the reference bandwidth in IS-IS?

A.It has no effect on IS-IS.

B.It automatically recalculates all interface metrics.

C.It increases the hello interval.

D.It forces all links to use narrow metrics.

AnswerA

IS-IS relies on explicit metric configuration, not reference bandwidth.

Why this answer

IS-IS does not have a reference bandwidth concept like OSPF; metrics are configured manually or via interface cost.

Full explanation →

203

Multi-Selecthard

An administrator needs to configure an OSPF stub area on a Juniper router. Which THREE characteristics apply to a standard OSPF stub area? (Choose three.)

Select 3 answers

A.Type 3 summary LSAs are blocked from entering the area

B.The ABR injects a default route (0.0.0.0/0) into the area

C.Type 5 AS-external LSAs are blocked from entering the area

D.Virtual links are not permitted to transit through a stub area

E.ASBRs are permitted to reside directly inside the stub area

AnswersB, C, D

Stub ABRs automatically originate a default route to replace external routes.

Why this answer

Standard stub areas block Type 5 AS-external LSAs and Type 4 summary LSAs, using a default route generated by the ABR to reach external destinations instead.

Full explanation →

204

Multi-Selectmedium

Which TWO attributes distinguish direct routes from static routes in Junos OS? (Choose two)

Select 2 answers

A.Static routes are created automatically when an interface comes up.

B.Direct routes represent subnets attached to active local interfaces.

C.Direct routes require manual IP address configuration under routing-options.

D.Static routes cannot be used with recursive next-hops.

E.Direct routes have a default preference of 0, whereas static routes have a default preference of 5.

AnswersB, E

Direct routes are automatically generated for connected interface networks.

Why this answer

Direct routes have a preference of 0 and represent local interface subnets, whereas static routes have a default preference of 5 and are manually configured.

Full explanation →

205

MCQmedium

An EX4300 Virtual Chassis has GRES enabled. During a primary Routing Engine failure, what happens to the backup Routing Engine?

A.The backup Routing Engine reboots both engines to synchronize firmware versions.

B.The Virtual Chassis splits into independent standalone switches.

C.The backup Routing Engine assumes the primary role without disrupting the forwarding plane or resetting packet forwarding tables.

D.All switch members in the Virtual Chassis are forced into factory default mode.

AnswerC

GRES ensures smooth transition of control plane mastership while keeping the Packet Forwarding Engine (PFE) running uninterrupted.

Why this answer

With GRES enabled, the backup Routing Engine assumes the primary role seamlessly without resetting the forwarding plane or dropping data traffic.

Full explanation →

206

MCQeasy

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

A.Traffic policing by dropping packets exceeding the configured bandwidth threshold

B.Input queue buffering and tail-drop avoidance

C.Rate limiting via TCP window size adjustments

D.Traffic shaping with weighted random early detection (WRED)

AnswerA

Storm control acts as a policer, dropping traffic that breaches the threshold.

Why this answer

Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Full explanation →

207

Multi-Selectmedium

What are valid ways to configure IS-IS on a Junos interface? (Choose TWO)

Select 2 answers

A.set interfaces ge-0/0/0.0 protocols isis

B.set protocols isis interface ge-0/0/0.0

C.set routing-options isis interface ge-0/0/0.0

D.set interfaces ge-0/0/0.0 isis enable

E.set protocols isis enable ge-0/0/0.0

AnswersA, B

Alternative valid path.

Why this answer

You can enable IS-IS under the 'protocols isis interface' hierarchy or by adding the interface to the hierarchy directly.

Full explanation →

208

MCQmedium

You are troubleshooting an aggregate route that is not being advertised to BGP peers. You verify that contributing routes are active in the routing table. What command should you use to check if the aggregate route itself is successfully generated and active in the local routing table?

A.show route summary aggregate

B.show bgp aggregate-routes

C.show route protocol aggregate

D.show routing-options aggregate detail

AnswerC

This command shows aggregate routes and verifies whether they are active.

Why this answer

The show route protocol aggregate command displays aggregate routes generated by the router and their active status.

Full explanation →

209

MCQhard

An administrator configures root protection on a designated port. If that port subsequently receives a superior BPDU from another switch, what exact state does the port transition into?

A.Alternate port state

B.Error-disabled state

C.Root-inconsistent (discarding) state

D.Listening state

AnswerC

The port becomes root-inconsistent and stops forwarding traffic until the superior BPDU ceases.

Why this answer

When root protection is violated by receiving a superior BPDU, the port transitions into the root-inconsistent state, placing it in discarding mode to protect the root bridge position.

Full explanation →

210

MCQmedium

Why would you set an interface to 'passive' in IS-IS?

A.To speed up the DIS election process.

B.To force the interface to be a point-to-point link.

C.To enable authentication on that interface.

D.To include the network in the LSP without forming an adjacency.

AnswerD

This is the primary purpose of passive interfaces.

Why this answer

Setting an interface to passive allows the router to advertise the network as reachable without attempting to form an adjacency on that interface.

Full explanation →

211

MCQeasy

Which statement best describes the behavior of a local route in Junos OS?

A.They represent IP addresses assigned directly to the router's local interfaces.

B.They are static routes learned from neighbor routers via CDP.

C.They are manual loopback routes configured by network administrators.

D.They are generated automatically whenever a BGP session drops.

AnswerA

Local routes correspond to the router's own IP addresses and have a preference of 0.

Why this answer

Local routes represent the IP addresses assigned directly to the router's interfaces (such as loopback or physical interface addresses).

Full explanation →

212

MCQmedium

You need to create a virtual router routing instance to isolate traffic for a specific department. Which routing-instance type should you configure in the Junos configuration?

A.forwarding

B.virtual-router

C.no-structural-instance

D.l2vpn

AnswerB

The virtual-router instance type provides full standalone routing capabilities and separate routing tables.

Why this answer

The 'virtual-router' instance type is used for complete routing isolation where the instance runs its own independent routing protocols and tables, similar to a VRF but without VPN-specific MPLS labels.

Full explanation →

213

Multi-Selecteasy

Which TWO features help protect an RSTP topology from unauthorized switches or misconfigurations on access ports? (Choose two.)

Select 2 answers

A.Bridge priority adjustment

B.Hello timer scaling

C.Root protection

D.Forward delay timer optimization

E.BPDU guard

AnswersC, E

Root protection prevents designated ports from accepting superior BPDUs.

Why this answer

BPDU guard and root protection are standard security mechanisms used to protect spanning tree topologies against unauthorized BPDUs and superior root bridge injections.

Full explanation →

214

MCQeasy

Which TCP port is used by BGP to establish communication between peers?

A.UDP 520

B.TCP 179

C.TCP 80

D.TCP 500

AnswerB

BGP uses TCP port 179 for session establishment and communication.

Why this answer

BGP operates over TCP port 179.

Full explanation →

215

MCQhard

An engineer needs to influence the DIS election on a multi-access broadcast segment running IS-IS on Junos devices. Which configuration parameter and hierarchy should the engineer modify to guarantee a specific router wins the DIS election?

A.Configure 'set protocols isis reference-bandwidth <value>' globally.

B.Configure 'set protocols isis lsp-interval <value>' to speed up PDU transmission.

C.Configure 'set protocols isis interface <name> priority <value>' where a higher value wins.

D.Configure 'set protocols isis level <1|2> metric <value>' to lower the interface cost.

AnswerC

The DIS priority ranges from 0 to 127, with the default being 64. The router with the highest priority is elected DIS.

Why this answer

DIS priority in Junos IS-IS is configured under the interface hierarchy using 'set protocols isis interface <interface-name> priority <value>'. Higher priority wins; default is 64, max is 127.

Full explanation →

216

MCQeasy

During the establishment of an OSPF adjacency, two routers exchange Database Description (DBD) packets. What is the primary purpose of the DBD packet exchange in the OSPF protocol sequence?

A.To synchronize link-state database summaries between neighbors

B.To discover directly connected neighbors on a shared segment

C.To request specific missing LSAs from a neighbor's database

D.To explicitly acknowledge the receipt of specific LSA updates

AnswerA

DBD packets provide a summary of the LSDB so routers can identify missing entries.

Why this answer

DBD packets contain a summary of the link-state database (LSDB), listing the headers of each LSA. This allows receiving routers to compare their local LSDBs and request missing or more recent LSAs using Link State Request (LSR) packets.

Full explanation →

217

Multi-Selecthard

Which THREE statements regarding Juniper Virtual Chassis architecture and master election are correct? (Choose three)

Select 3 answers

A.Pre-provisioning member serial numbers ensures consistent member ID assignments regardless of boot order.

B.Split-brain detection automatically shuts down all core routing protocols without administrator intervention.

C.If the primary Routing Engine fails, the backup member assumes the primary role seamlessly if GRES is active.

D.Virtual Chassis ports (VCPs) require LACP active mode configuration on every stacking cable.

E.Mastership priority values range from 0 to 255, with the highest value preferred for the primary role.

AnswersA, C, E

Serial number binding prevents ID shifts when hardware is swapped or rebooted.

Why this answer

Virtual Chassis mastership is determined by priority, preemption can cause takeovers, and pre-provisioning serial numbers ensures stable member IDs.

Full explanation →

218

MCQeasy

An administrator configures an interface as a trunk port on an EX Series switch, but forgets to specify any VLAN members. By default, how does Junos handle VLAN membership on a newly configured trunk port?

A.All VLANs are allowed by default.

B.Only the default native VLAN is allowed.

C.Only VLAN 1 is allowed.

D.No VLANs are allowed, and traffic is entirely dropped.

AnswerA

Correct. Omitting vlan members on a trunk port in Junos allows all configured VLANs.

Why this answer

By default, when a trunk interface mode is configured without explicit members in Junos, all VLANs are allowed.

Full explanation →

219

MCQeasy

Which CLI command displays the operational status and roles of all members in a Juniper EX Series Virtual Chassis?

A.show chassis vcp

B.show lacp virtual-chassis

C.show virtual-chassis

D.show vrrp chassis

AnswerC

show virtual-chassis is the primary command for checking Virtual Chassis membership and roles.

Why this answer

The 'show virtual-chassis' command displays the role (Master, Backup, Linecard) of each member.

Full explanation →

220

Multi-Selectmedium

Which THREE parameters can be configured manually to influence root bridge selection in an RSTP network? (Choose three.)

Select 3 answers

A.Bridge priority increments (multiples of 4096)

B.Interface port cost

C.Configuration revision number

D.Bridge priority

E.MST regional configuration name

AnswersA, B, D

Priority values are adjusted in multiples of 4096.

Why this answer

Root bridge selection is primarily determined by bridge priority and MAC address. In Junos, administrators configure bridge priority, and can influence port/path costs or use MAC address manipulation indirectly. Specifically, bridge priority is the primary direct control.

Let's list valid configuration parameters affecting STP path selection: bridge priority, path cost, and interface cost.

Full explanation →

221

MCQmedium

You observe that an IS-IS adjacency is stuck in 'Initializing'. What is the most likely cause?

A.The system IDs are identical.

B.The interface level is set to Level 1, but the neighbor has no Level 1 area address match.

C.The interface is configured as point-to-point.

D.The MTU size is too small on one link.

AnswerB

Area address mismatch prevents the Level 1 adjacency from fully establishing.

Why this answer

An 'Initializing' state indicates that one side sees the other, but the other side does not see the first, often due to mismatched area addresses or authentication.

Full explanation →

222

MCQeasy

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

A.MACsec

B.Dynamic ARP Inspection

C.Port security

D.Storm control

AnswerD

Storm control monitors traffic levels and drops excess broadcast, multicast, or unknown unicast traffic.

Why this answer

Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Full explanation →

223

MCQmedium

You are configuring an aggregate route and want to ensure that a discard next-hop is automatically applied when there are no contributing routes, preventing routing loops. Which configuration statement should you use under routing-options?

A.set routing-options static route 10.0.0.0/16 drop

B.set routing-options aggregate route 10.0.0.0/16 passive

C.set routing-options aggregate route 10.0.0.0/16 discard

D.set routing-options aggregate route 10.0.0.0/16 reject

AnswerC

The discard keyword instructs Junos to silently drop packets matching the aggregate route when no contributing components are active.

Why this answer

To secure an aggregate route and silently drop traffic when no more-specific routes exist, the discard option is appended to the aggregate route configuration.

Full explanation →

224

Multi-Selecthard

What are the consequences of a mismatch in metric style (narrow vs wide) between IS-IS neighbors? (Choose THREE)

Select 3 answers

A.Partial reachability issues.

B.SPF calculation fails to find all paths.

C.The routers crash immediately.

D.Adjacency may form, but routes will not be accepted.

E.The DIS election will fail.

AnswersA, B, D

Networks are not properly advertised.

Why this answer

Metric mismatch prevents the exchange of reachability info, leads to partial SPF calculation failure, and results in broken reachability.

Full explanation →

225

Multi-Selecthard

Which TWO port roles are defined in Rapid Spanning Tree Protocol (RSTP) but did not exist in legacy 802.1D STP? (Choose two.)

Select 2 answers

A.Master port

B.Root port

C.Backup port

D.Designated port

E.Alternate port

AnswersC, E

Backup ports provide redundant backup paths for designated ports on shared segments.

Why this answer

RSTP introduced the Alternate and Backup port roles to replace the legacy blocking state and accelerate convergence.

Full explanation →

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 151–225