Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 301–320

Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session.

Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks.

OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Option A is correct because, like a standard stub area, an NSSA blocks Type 5 AS-external LSAs from entering the area from the backbone, keeping the area's LSDB free of external routes. Option C is correct because the defining feature of an NSSA is that routers within it can originate external routes as Type 7 NSSA-external LSAs, which is not permitted in a standard stub area. Option D is correct because the NSSA ABR translates those Type 7 LSAs into Type 5 LSAs before flooding them into the backbone, allowing external reachability to propagate beyond the NSSA.

Option B is wrong because NSSA is an area-type attribute and has nothing to do with automatically converting internal links to broadcast point-to-multipoint networks. Option E is wrong because an NSSA can support multiple ABRs; there is no such prohibition.

Option A is correct because FBF requires a firewall filter that matches traffic and uses the 'then routing-instance <name>' action to redirect matching packets into the alternate routing table. Option B is correct because that action must reference a routing instance of type 'forwarding' (or 'virtual-router'), which provides the separate routing table where the redirected traffic is resolved. Option C is correct because the filter must be applied as an input filter on the ingress interface so that packets are classified and redirected before the normal destination lookup occurs.

Option D is incorrect because BGP multipath is a load-balancing feature and is not required for FBF to function. Option E is incorrect because RSVP-TE LSPs are an MPLS traffic-engineering mechanism and are unrelated to the mandatory FBF configuration components.

Option A is correct because a Juniper EX Series Virtual Chassis can be formed by cabling the dedicated Virtual Chassis ports (VCPs) on the switches with the specialized stacking cables designed for those ports, which carry the inter-switch control and data traffic. Option C is also correct because on supported EX platforms you can convert standard network uplink ports (for example 10G or 40G interfaces) into Virtual Chassis ports via configuration, allowing a Virtual Chassis to be built without dedicated VCP hardware. Option B is wrong because serial console rollover cables are for out-of-band management access, not for carrying Virtual Chassis data or stacking traffic.

Option D is wrong because LACP is a link-aggregation protocol for standard Ethernet links and does not create or operate a Virtual Chassis fabric. Option E is wrong because unmanaged Layer 2 hubs on access ports cannot provide the required VCP connectivity or the control-plane communication a Virtual Chassis needs.

RSTP (IEEE 802.1w) defines only three port states: Discarding, Learning, and Forwarding. Option B (Discarding) is correct because RSTP merged the 802.1D Disabled, Blocking, and Listening states into a single Discarding state, in which the port neither learns MAC addresses nor forwards frames but still participates in the topology (e.g., receiving BPDUs). Option C (Learning) is correct because it is retained in RSTP: the port processes BPDUs and populates its MAC address table, but does not yet forward user data frames.

Option D (Forwarding) is correct because it is the fully operational state in which the port learns MAC addresses and forwards data frames. Option A (Blocking) is not correct because Blocking is a legacy 802.1D STP state that RSTP replaced with Discarding, and Option E (Listening) is not correct because Listening was also an 802.1D-only state eliminated in RSTP and folded into Discarding.

Option A is correct because IS-IS Level-2 routing operates as the backbone that interconnects separate Level-1 areas, allowing prefixes from one area to be advertised to others via Level-2 (or Level-1/Level-2) routers. Option E is correct because Level-1 routing is confined within a single area and handles intra-area prefix reachability using Level-1 LSPs and the Level-1 link-state database. Option B is wrong because Level-1 and Level-2 are distinct routing levels with separate link-state databases and different flooding scopes.

Option C is wrong because a pure Level-1 router only knows its own area's topology and must use an attached Level-1/Level-2 router (with the ATT bit set) to reach other areas. Option D is wrong because Level-2 is the inter-area backbone routing level, not a mechanism for local interface management.