Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) JNCIS-ENT Questions 451–506 | Page 7/7

451

Multi-Selecthard

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Select 3 answers

A.Disabling all Layer 2 learning on the translation interface.

B.Enabling OSPFv3 routing directly on the customer edge interface unit 0.

C.Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.

D.Configuring input-vlan-map and output-vlan-map rules to push/pop or swap tags.

E.Enabling flexible-vlan-tagging on the edge interface.

AnswersC, D, E

Correct. Upstream transit requires trunking the mapped outer VLAN.

Why this answer

Selective QinQ translation requires flexible VLAN tagging, input/output vlan mapping profiles, and trunk connectivity for the provider backbone.

Full explanation →

452

Multi-Selecteasy

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Select 2 answers

A.IP Source Guard

B.Storm Control rate-limiting

C.Dynamic ARP Inspection (DAI)

D.Port Security MAC-Limit

E.MACsec Key Agreement (MKA)

AnswersA, C

IP Source Guard relies on the DHCP snooping table to verify client source IPs.

Why this answer

Dynamic ARP Inspection and IP Source Guard both rely on the DHCP snooping binding database for validation.

Full explanation →

453

MCQeasy

Which configuration command enables Graceful Routing Engine Switchover (GRES) globally on a Juniper routing platform?

A.set routing-options gres enable

B.set interfaces redundancy gres

C.set chassis redundancy graceful-switchover

D.set system graceful-restart

AnswerC

This command enables GRES on the chassis, allowing control plane state synchronization to support seamless routing engine failovers.

Why this answer

GRES is enabled under the [edit chassis redundancy graceful-switchover] hierarchy in Junos.

Full explanation →

454

MCQmedium

An engineer configures a LAG between an EX4300 switch and a server. The server uses static LAG mode (no LACP). How must the Junos switch interface be configured to successfully form the bundle?

A.Omit the LACP protocol configuration under the aggregated-ether-options stanza, operating in static mode.

B.Configure VRRP on the ae0 interface to manage the static bundle.

C.Configure LACP passive mode on the EX4300 switch.

D.Enable Graceful Restart on the physical ports.

AnswerA

Without LACP enabled under aggregated-ether-options, the interface operates as a static, non-LACP LAG.

Why this answer

When connecting to a device that does not support LACP, you must configure the Junos aggregated interface without LACP (manual/static mode).

Full explanation →

455

MCQeasy

Which Junos configuration statement defines the destination address of a GRE tunnel?

A.destination <ip-address>

B.remote-endpoint <ip-address>

C.peer-address <ip-address>

D.tunnel-destination <ip-address>

AnswerA

The destination keyword specifies the remote peer IP address for the tunnel.

Why this answer

The destination address is defined using the 'destination' keyword under the tunnel configuration of the gr- interface.

Full explanation →

456

MCQeasy

An administrator wants to gracefully restart a BGP routing daemon without dropping the underlying TCP session or causing traffic loss. Which Junos feature should be enabled?

A.Nonstop Active Routing (NAR)

B.TCP MD5 Signature bypass

C.BGP Bidirectional Forwarding Detection (BFD)

D.BGP Graceful Restart

AnswerD

Graceful Restart enables helper mode and restart capabilities to maintain forwarding during control plane reboots.

Why this answer

Graceful Restart allows a BGP speaker to express its ability to preserve forwarding state while restarting the control plane.

Full explanation →

457

Multi-Selectmedium

Which TWO statements correctly differentiate eBGP from iBGP? (Choose two.)

Select 2 answers

A.iBGP routes have a default administrative distance (preference in Junos) of 20.

B.eBGP routers prepend their own AS number to the AS_PATH attribute when advertising routes.

C.eBGP peers must be directly connected by default, as the IP TTL for eBGP packets is set to 1.

D.The default TTL for iBGP packets is 1, requiring explicit multihop configurations for non-directly connected peers.

E.iBGP routers modify the next-hop attribute to their own interface address by default when advertising routes to iBGP peers.

AnswersB, C

Correct. eBGP adds its own AS number to the AS_PATH, whereas iBGP does not.

Why this answer

eBGP sessions are typically established between routers in different autonomous systems and have a default TTL of 1, whereas iBGP sessions are between routers in the same AS and have a default TTL of 255.

Full explanation →

458

MCQmedium

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

A.The GRE tunnel source IP address is configured incorrectly.

B.Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.

C.The physical interface MTU is set too high.

D.The gr- interface family inet address is missing.

AnswerB

Tunnel endpoint connectivity confirms the link is up, but remote subnets require routing configuration to direct traffic into the tunnel.

Why this answer

If local tunnel endpoints can reach each other, the tunnel itself is up. Failure of transit traffic behind the routers typically points to missing static or dynamic routing entries pointing to the remote subnet across the tunnel.

Full explanation →

459

MCQhard

What is the purpose of the 'lsp-lifetime' command?

A.To define how often the DIS sends Hellos.

B.To set the duration for which an LSP is valid.

C.To limit the number of LSPs in the database.

D.To set how long the adjacency stays up.

AnswerB

This defines the expiration period.

Why this answer

The 'lsp-lifetime' command sets the duration after which an LSP is considered invalid if not refreshed.

Full explanation →

460

Multi-Selecthard

When configuring advanced load balancing under forwarding-options, which THREE hash-key options are available to administrators in Junos OS? (Choose three)

Select 3 answers

A.mpls-label

B.payload-checksum

C.layer-4

D.layer-3

E.layer-2

AnswersC, D, E

Layer-4 port numbers can be included in hash calculations.

Why this answer

Junos hash-key configuration supports options including layer-2, layer-3, and layer-4 fields.

Full explanation →

461

MCQmedium

You notice frequent mastership transitions in a VRRP group configured between two EX4300 switches. The logs indicate that VRRP advertisements are intermittently missing. Which troubleshooting step addresses the underlying cause without changing the master priority?

A.Disable Virtual Chassis on both switches to allow VRRP to function properly.

B.Check physical interface error counters and increase the VRRP advertisement interval if packet drops occur.

C.Remove LACP from all aggregated interfaces connected to the VRRP routers.

D.Configure Nonstop Active Routing (NSR) under the VRRP hierarchy.

AnswerB

Increasing the advertisement interval or checking interface error counters helps accommodate transient network congestion or drops.

Why this answer

Missing advertisements are often caused by packet loss or excessive CPU load on the master. Tuning timers or checking interface drops/queues resolves this.

Full explanation →

462

MCQhard

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

A.The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.

B.OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.

C.Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.

D.GRE tunnels do not support routing protocols such as OSPF under any circumstances.

AnswerB

GRE tunnels pass unicast traffic successfully, but OSPF relies on multicast (224.0.0.5/6) and IP protocol 89, which can be blocked by intermediate firewalls or require specific tunnel mapping.

Why this answer

OSPF multicast traffic needs to be supported across the link, or OSPF network type must be correctly configured (e.g., point-to-point) since GRE does not natively support multicast broadcasts unless configured or handled appropriately, or firewall filters are blocking protocol 89.

Full explanation →

463

MCQmedium

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

A.Static routes pointing directly to each customer default gateway.

B.Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

C.Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.

D.Layer 2 bridging configuration under the gr- interface.

AnswerC

MP-BGP with VPN-IPv4/IPv6 families allows carrying multiple VRF routing tables across a single layer 3 tunnel link.

Why this answer

To transport multiple VRFs across a single tunnel interface, BGP or another routing protocol running over the tunnel must exchange VPN-IPv4/VPN-IPv6 routes, or Logical Systems / Multiprotocol BGP can be utilized.

Full explanation →

464

MCQhard

When configuring MSTP, what purpose does the regional configuration digest serve?

A.It encrypts the BPDU payload to prevent tampering by unauthorized access switches.

B.It allows neighboring switches to verify if they belong to the same MST region.

C.It acts as a dynamic bridge priority modifier for internal instance root selection.

D.It determines the Designated Master Bridge within the CIST instance.

AnswerB

Switches compare the received digest with their own calculated digest to ensure region parameter consistency.

Why this answer

The configuration digest is an MD5 hash calculated from the region name, revision, and VLAN-to-instance mapping, included in BPDUs to verify that neighboring switches share the exact same region configuration.

Full explanation →

465

MCQeasy

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

A.50

B.4

C.47

D.89

AnswerC

Protocol 47 is officially assigned to Generic Routing Encapsulation (GRE).

Why this answer

GRE is designated as IP protocol number 47.

Full explanation →

466

MCQhard

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

A.Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

B.Broadcast and multicast traffic only, excluding unknown unicast.

C.Broadcast traffic only

D.Broadcast, unknown unicast, and multicast traffic.

AnswerD

By default, storm control applies to broadcast, unknown unicast, and multicast traffic.

Why this answer

By default, Junos storm control monitors and limits broadcast, unknown unicast, and multicast traffic collectively when configured on an interface unless restricted.

Full explanation →

467

Multi-Selecteasy

Which TWO commands are used to verify link aggregation and LACP operational status on a Juniper switch? (Choose two)

Select 2 answers

A.show virtual-chassis

B.show vrrp detail

C.show interfaces ae0

D.show lacp interface

E.show chassis routing-engine

AnswersC, D

Displays traffic statistics, error counts, and operational status of the aggregated interface.

Why this answer

To verify LACP and LAG status, administrators use 'show lacp interface' and 'show interfaces ae0'.

Full explanation →

468

MCQmedium

An administrator wants to verify that packets are successfully traversing a GRE tunnel interface. Which operational command displays packet counters specifically incrementing for the GRE encapsulation and decapsulation processes?

A.show interfaces gr-0/0/0

B.Placeholder note for JSON formatting compliance

C.show security flow session interface gr-0/0/0

D.show chassis traffic-counters

E.show gre traffic

AnswerA

This command displays input and output packet/byte counters for the tunnel interface.

Why this answer

Interface statistics command 'show interfaces gr-0/0/0' shows input and output packet and byte counters.

Full explanation →

469

MCQhard

An operator executes the 'show ospf database' command on a Junos device and notices multiple Type 2 Network LSAs. Under which specific network topology condition are Type 2 LSAs generated?

A.Stub areas filtering out external LSA advertisements

B.Virtual links traversing a non-backbone transit area

C.Point-to-point links between two directly connected routers

D.Multi-access broadcast segments with an active Designated Router

AnswerD

Type 2 Network LSAs are generated by the DR for multi-access networks.

Why this answer

Type 2 Network LSAs are generated by the Designated Router (DR) on multi-access broadcast or non-broadcast multi-access (NBMA) networks to describe all routers attached to that specific network segment.

Full explanation →

470

MCQmedium

You are configuring an access port on an EX Series switch and want to ensure that if a MAC address is learned on the port, it persists even after a switch reboot or aging timer expiration. Which configuration attribute achieves this?

A.set interfaces ge-0/0/1 unit 0 family ethernet-switching static-mac-address <mac-address>

B.set vlans finance static-learning enable

C.set interfaces ge-0/0/1 unit 0 family ethernet-switching filter input static-mac

D.set ethernet-switching-options persistent-mac interface ge-0/0/1

AnswerA

Correct. Static MAC addresses can be bound to specific interfaces.

Why this answer

Static MAC addresses can be configured on an interface using the static statement under the interface or ethernet-switching hierarchy.

Full explanation →

471

Multi-Selectmedium

Which TWO BGP attributes are strictly internal to an Autonomous System and are never advertised to external eBGP peers? (Choose two)

Select 2 answers

A.NEXT_HOP

B.ORIGIN

C.ORIGINATOR_ID

D.AS_PATH

E.LOCAL_PREF

AnswersC, E

Originator ID and Cluster List are internal route reflector attributes not sent to eBGP peers.

Why this answer

Local Preference and MED (by default, unless propagated) or internal-only attributes like cluster list are restricted. Specifically, Local Preference is never sent to eBGP peers.

Full explanation →

472

Multi-Selecthard

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Select 3 answers

A.Enable MACsec on the physical interface.

B.Configure the interface as a trusted port for Dynamic ARP Inspection.

C.Configure matching Connectivity Association Key (CAK) and Connectivity Key Name (CKN).

D.Enable DHCP snooping on the transit VLAN.

E.Configure security association parameters or cipher suites if deviating from defaults.

AnswersA, C, E

MACsec must be explicitly enabled on the target interfaces.

Why this answer

Configuring MACsec with PSK requires enabling MACsec on the interface, defining connectivity association keys (CAK) and key names (CKN), and selecting the cipher suite or interface parameters.

Full explanation →

473

MCQmedium

You are troubleshooting a suboptimal spanning tree topology where an EX4300 switch is chosen as the STP Root Bridge despite having a high bridge priority. What command helps verify the current bridge priority and local bridge identifier parameters?

A.show spanning-tree bridge

B.show spanning-tree statistics

C.show spanning-tree interface

D.show spanning-treemstp configuration

AnswerA

This command displays the local bridge parameters including priority and MAC address.

Why this answer

The 'show spanning-tree bridge' command displays the local bridge identifier, bridge priority, and root bridge information, allowing administrators to inspect active STP parameters.

Full explanation →

474

Multi-Selecthard

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Select 3 answers

A.DHCP snooping

B.MAC address limiting and persistent learning

C.OSPFv3 authentication

D.MACsec point-to-point encryption

E.Dynamic ARP Inspection

AnswersA, B, E

DHCP snooping is integrated into the secure access port framework.

Why this answer

Secure access port features encompass port security (MAC limiting), DHCP snooping, and Dynamic ARP Inspection (DAI).

Full explanation →

475

MCQhard

A network administrator troubleshooting an IS-IS adjacency issue notices that two routers are failing to form an adjacency over a point-to-point link. One router has wide metrics enabled globally, while the other router has wide metrics disabled and only supports narrow metrics. Which parameter or feature must be matching or handled for IS-IS link-state PDUs to be successfully processed between these neighbors?

A.The DIS priority must be manually set to identical non-zero values on a point-to-point link.

B.The area addresses configured on both routers must be completely distinct from one another.

C.The metric-style configuration must be compatible (such as enabling wide metrics on both sides or using transition modes) to ensure LSAs containing TLVs 128/130 or 22/135 are understood.

D.The manual system ID must be identical across both routing nodes.

AnswerC

IS-IS uses different TLVs for narrow metrics (TLVs 128 and 130) versus wide metrics (TLVs 22 and 135). Mismatched metric styles prevent proper route calculation and database synchronization.

Why this answer

IS-IS supports narrow metrics (default in older implementations, max weight 63 per link) and wide metrics (supporting up to 2^24-1). If metric styles do not match or if compatibility modes (such as traffic-engineering metrics or metric-style transition settings) are not configured, routers may experience issues exchanging reachability, although point-to-point adjacencies can technically form, routing tables will not converge correctly without metric style alignment or wide-metrics configuration.

Full explanation →

476

Multi-Selecthard

An administrator wants to configure an OSPF Not-So-Stubby Area (NSSA) on a Junos router. Which THREE characteristics distinguish an NSSA from a standard OSPF Stub Area? (Choose three)

Select 3 answers

A.An NSSA blocks incoming Type 5 AS-external LSAs from the backbone area.

B.An NSSA automatically converts all internal links into broadcast point-to-multipoint networks.

C.An NSSA allows local routers to originate external routes using Type 7 LSAs.

D.An NSSA ABR translates Type 7 LSAs into Type 5 LSAs for flooding into the backbone.

E.An NSSA is prohibited from supporting multiple ABRs.

AnswersA, C, D

Correct. Like stub areas, NSSAs block external Type 5 LSAs from outside.

Why this answer

NSSAs allow injection of external routes via Type 7 LSAs, require an NSSA ABR to translate Type 7 to Type 5 LSAs, and block external Type 5 LSAs from the backbone while permitting local external origins.

Full explanation →

477

MCQeasy

You are configuring a Link Aggregation Group (LAG) on an EX series switch. Which statement is correct regarding LACP active mode?

A.The interface will actively transmit LACP packets to initiate and negotiate the aggregation with the peer device.

B.The interface will only respond to LACP packets and never transmit them.

C.Active mode can only be used when connecting Juniper switches to non-Juniper servers.

D.LACP active mode requires static pinning of member links and disables dynamic hash selection.

AnswerA

Active mode means the port initiates LACP negotiations. Passive mode waits for the peer to initiate.

Why this answer

In LACP active mode, the interface actively transmits LACP packets to the remote peer to negotiate the link aggregation.

Full explanation →

478

MCQmedium

You are configuring MSTP and want to assign VLANs 10 through 50 to MST instance 2. Which configuration hierarchy is correct in Junos OS?

A.set bridge-domains domain1 mstp-instance 2 vlan 10-50

B.set protocols mstp configuration-name RegionA revision 1 instance msti2 vlan 10-50

C.set protocols rstp msti 2 vlan-list 10-50

D.set vlans vlan-range 10-50 mstp instance 2

AnswerB

This command correctly specifies the region configuration name, revision, instance name, and associated VLANs.

Why this answer

In Junos OS, MSTP instances and their associated VLAN mappings are defined under the 'protocols mstp' hierarchy.

Full explanation →

479

MCQhard

An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?

A.Add the server's MAC address to the switch's static MAC-table using 'set bridge-domains'.

B.Create a Layer 2 firewall filter permitting ARP packets with action 'accept-and-trust'.

C.Configure an explicit static ARP entry under 'set protocols arp static'.

D.Configure a static IP source entry in the secure-access-port binding table for the server.

AnswerD

Adding a static binding entry in the secure-access-port database allows DAI and IP Source Guard to validate the static host without trusting the port.

Why this answer

Static ARP inspection entries or static IP source bindings can be configured to allow non-DHCP clients through DAI without trusting the entire port.

Full explanation →

480

MCQeasy

By default, what is the Junos routing protocol preference value assigned to static routes?

A.170

B.10

C.150

D.5

AnswerD

Static routes have a default preference of 5 in Junos OS.

Why this answer

Junos OS assigns a default preference of 5 to static routes, making them more preferred than most dynamic interior routing protocols like OSPF.

Full explanation →

481

Multi-Selecthard

When configuring Filter-Based Forwarding (FBF), which THREE components are absolutely mandatory for successful operation? (Choose three)

Select 3 answers

A.A firewall filter with 'then routing-instance <name>' action.

B.A routing instance of type 'forwarding' or 'virtual-router'.

C.Application of the firewall filter as input on the ingress interface.

D.BGP multipath enabled across all core interfaces.

E.An RSVP-TE LSP tunnel configured between the routers.

AnswersA, B, C

The filter action dictates where intercepted traffic is sent.

Why this answer

FBF requires a forwarding instance, a firewall filter with a routing-instance action, and the application of that filter to an interface input.

Full explanation →

482

MCQeasy

Which CLI command displays the packet statistics, errors, and drop counters for a Link Aggregation Group (LAG) named ae0?

A.show interfaces ae0

B.show chassis interface-drops ae0

C.show virtual-chassis interface ae0

D.show lacp statistics ae0

AnswerA

This command displays traffic totals, input/output packet counts, errors, and physical link states for the aggregated interface.

Why this answer

The 'show interfaces ae0' command displays general interface statistics, error counts, and drops for the aggregated interface.

Full explanation →

483

MCQmedium

An administrator wants to prevent unauthorized switches from being connected to user access ports on an EX Series switch. Which feature should be implemented to drop BPDUs received on access ports while keeping the port active for end-user devices?

A.Loop protection (loop-protection)

B.BPDU guard (bpdu-guard) on trunk ports

C.Root protection (root-protection)

D.BPDU protection (bpdu-block)

AnswerD

Configuring bpdu-block on access interfaces drops incoming BPDUs and prevents bridging loops from unauthorized switches.

Why this answer

BPDU protection (bpdu-block) drops incoming BPDUs on access ports to prevent unauthorized switches from altering the spanning tree topology.

Full explanation →

484

Multi-Selecthard

Which THREE potential issues can arise if LACP is misconfigured between a Juniper switch and a connected peer device? (Choose three)

Select 3 answers

A.Traffic loops may occur if static LAG mode is mismatched with LACP active mode on opposite ends.

B.The aggregated interface may go operationally down if active member links drop below the configured minimum-links threshold.

C.GRES will be disabled on the routing engine automatically.

D.Member links may be placed in 'Suspended' or 'Expired' states if LACP protocol handshakes fail.

E.The switch will automatically trigger an In-Service Software Upgrade (ISSU) to fix the mismatch.

AnswersA, B, D

Mismatched static vs dynamic LACP configurations can disrupt bundle formation and cause forwarding anomalies.

Why this answer

LACP misconfigurations can lead to link suspension, flapping due to timeout mismatches, or bundle failure if minimum links aren't met.

Full explanation →

485

MCQeasy

When configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?

A.set interfaces gr-0/0/0 unit 0 tunnel source <ip> destination <ip>

B.set routing-options tunnels source <ip> destination <ip>

C.set protocols gre source <ip> destination <ip>

D.set system tunnel source <ip> destination <ip>

AnswerA

This is the correct Junos CLI syntax for defining GRE tunnel endpoints.

Why this answer

GRE tunnel source and destination addresses are defined under the specific logical tunnel interface configuration hierarchy.

Full explanation →

486

MCQmedium

You are configuring OSPF on a Junos device and need to ensure that the router prefers internal OSPF intra-area paths over inter-area paths, and inter-area paths over external paths. According to OSPF route preference rules, what is the evaluation order?

A.Intra-area > Inter-area > External Type 1 > External Type 2

B.Inter-area > Intra-area > External Type 2 > External Type 1

C.External Type 1 > Intra-area > Inter-area > External Type 2

D.External Type 2 > External Type 1 > Inter-area > Intra-area

AnswerA

Correct. Intra-area routes are preferred over inter-area, which are preferred over external types.

Why this answer

OSPF path preference order is strictly: Intra-area (Type 1/2), Inter-area (Type 3), External Type 1 (E1), and External Type 2 (E2).

Full explanation →

487

MCQeasy

What is the key difference between a 'discard' static route and a 'reject' static route in Junos OS?

A.Discard drops packets silently, whereas reject returns an ICMP unreachable message.

B.Reject installs the route into the forwarding table, while discard does not.

C.Discard is used for IPv4 and reject is exclusively used for IPv6.

D.Discard requires an active next-hop interface, while reject does not.

AnswerA

This accurately describes the operational difference between the two Junos static route termination actions.

Why this answer

Discard drops packets silently, while reject drops packets and returns an ICMP destination unreachable message to the sender.

Full explanation →

488

Multi-Selecteasy

Which TWO options are valid violation actions available for port security configurations in Junos OS? (Choose two)

Select 2 answers

A.isolate

B.rate-limit

C.quarantine

D.restrict

E.shutdown

AnswersD, E

Restrict drops violating traffic and increments counters while keeping the port up.

Why this answer

Junos port security supports drop, restrict, and shutdown violation actions.

Full explanation →

489

Multi-Selectmedium

Which THREE factors must be considered when configuring a Link Aggregation Group (LAG) with LACP on Junos switches? (Choose three)

Select 3 answers

A.A minimum number of active links can be configured to ensure traffic drops if bandwidth falls below a threshold.

B.VRRP must be enabled on every member port for LACP to negotiate successfully.

C.All member links must have identical speed, duplex, and LACP active/passive settings.

D.Aggregated device counts must be defined under the [edit chassis aggregated-devices ethernet] hierarchy.

E.GRES must be enabled on all switches participating in a LAG.

AnswersA, C, D

The 'minimum-links' option drops the aggregated interface if active member count is too low.

Why this answer

LAG configuration requires matching speed/duplex, proper device-count definition under chassis, and matching LACP modes.

Full explanation →

490

Multi-Selecthard

An administrator is reviewing OSPF link-state database entries using the Junos command 'show ospf database'. Which THREE LSA types appear in the output of a standard non-backbone area router? (Choose three)

Select 3 answers

A.Type 1 (Router LSA)

B.Type 3 (Summary LSA)

C.Type 8 (OSPFv3 Inter-Area Prefix LSA)

D.Type 7 (NSSA LSA)

E.Type 5 (AS-external LSA)

AnswersA, B, E

Correct. Present in all areas.

Why this answer

A standard non-backbone area router contains Type 1 (Router), Type 2 (Network if multi-access), Type 3 (Summary), Type 4 (ASBR Summary), and Type 5 (AS-external) LSAs in its database.

Full explanation →

491

MCQeasy

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

A.Dynamic ARP Inspection

B.IP Source Guard

C.DHCP Snooping

D.Port Security MAC-Limit

AnswerC

DHCP snooping listens to DHCP transactions to build the binding database.

Why this answer

DHCP snooping must be enabled on the VLAN or switch to intercept DHCP messages and build the binding database.

Full explanation →

492

MCQhard

You are verifying BGP Graceful Restart helper mode on a Juniper router. A peering router restarts its control plane. What output or verification command confirms that your router is acting as a Graceful Restart helper for the peer?

A.Run 'show chassis routing-engine' to verify that the remote neighbor has updated its local RE priority.

B.Run 'show bgp neighbor' and verify that the 'Graceful Restart' capability is advertised and received, and observe the restart state flags.

C.Run 'show lacp statistics ae0' to see if LACP packets are being suppressed during restart.

D.Run 'show vrrp summary' to check if the BGP neighbor has assumed the master VRRP role.

AnswerB

BGP summary and neighbor detail outputs show negotiated GR capabilities and active helper timers.

Why this answer

Using 'show bgp neighbor' displays the graceful restart capabilities negotiated and whether the peer is currently in restart state.

Full explanation →

493

MCQeasy

Which Junos routing instance type is best suited when you want to run MPLS L3VPNs on a Provider Edge (PE) router?

A.forwarding

B.virtual-router

C.vrf

D.no-structural-instance

AnswerC

The 'vrf' (or vpn) instance type is used for Layer 3 VPNs.

Why this answer

L3VPN routing instances are used on PE routers to maintain customer-specific VRF routing tables and exchange VPN-IPv4 routes via MP-BGP.

Full explanation →

494

MCQhard

A Junos router running OSPF is configured with graceful restart helper mode enabled. What is the primary role of an OSPF graceful restart helper router during a control plane restart of a neighboring router?

A.To translate Type 7 LSAs into Type 5 LSAs during the helper window

B.To maintain neighbor adjacencies and continue forwarding packets without recalculating the SPF tree while the neighbor restarts

C.To purge all LSAs originated by the restarting router from the LSDB

D.To take over the role of Designated Router immediately upon detecting control plane failure

AnswerB

Correct. Helper mode maintains forwarding and holds adjacency state during a peer's restart.

Why this answer

Helper routers continue forwarding traffic based on existing routes and assist the restarting router by maintaining adjacencies and suppressing LSA re-origination until the restarting control plane recovers.

Full explanation →

495

MCQmedium

You have configured multiple static routes to the same destination with different preference values. When does Junos install a static route into the forwarding table (FIB)?

A.Only the static route with the highest preference value is installed into the FIB.

B.Only the static route with the lowest preference value is installed into the FIB.

C.All static routes are installed into the FIB, and traffic is automatically load-balanced across them.

D.All valid static routes are installed into the FIB regardless of preference values.

AnswerB

Junos selects the route with the lowest preference value as the active route and installs it into the FIB.

Why this answer

Only the active route with the lowest preference value among valid routes is installed into the FIB, provided its next-hop is resolvable.

Full explanation →

496

MCQmedium

An administrator configures a Link Aggregation Group (LAG) using LACP between two EX series switches. The link fails to aggregate, and the log shows 'LACP status: Expired'. What does the 'Expired' state indicate?

A.The Virtual Chassis primary routing engine license has expired.

B.The Junos software license for aggregated Ethernet has expired.

C.The GRES synchronization timer has timed out.

D.The local port has stopped receiving LACP packets from the remote peer within the timeout window.

AnswerD

Expired state indicates communication failure with the peer switch regarding LACP heartbeats.

Why this answer

The 'Expired' state in LACP means the local port has stopped receiving LACP packets from the remote peer within the expected timeout period.

Full explanation →

497

MCQhard

During BGP path selection on a Junos device, two paths are received for the same destination prefix. Path A has a MED of 50 received from a peer in AS 65001, and Path B has a MED of 10. Both AS paths have a length of 2. The router is not configured with 'always-compare-med'. Which path will be preferred by default?

A.Path B, because it has a lower MED value of 10 compared to Path A's MED of 50.

B.Path A, because lower MED is only preferred if 'compare-router-id' is enabled.

C.MED will be ignored during path selection because the paths originate from different autonomous systems, and the selection will proceed to subsequent tie-breakers.

D.Path A will be preferred because Junos always favors higher MED values for eBGP paths.

AnswerC

Correct. MED comparison is restricted to routes from the same AS unless 'always-compare-med' is set.

Why this answer

By default, BGP only compares MED (Multi-Exit Discriminator) values for paths originating from the *same* neighboring Autonomous System unless 'always-compare-med' is configured. Since Path A and Path B come from different ASNs, MED is skipped, and the selection process moves to the next criteria.

Full explanation →

498

Multi-Selectmedium

You are troubleshooting a MAC address flapping issue on an EX Series switch. Which TWO operational commands help diagnose the source and frequency of MAC moves? (Choose two.)

Select 2 answers

A.show ethernet-switching table

B.show interfaces diagnostics optics

C.show bridge-domain mac-table

D.show ethernet-switching table extensive

E.show route forwarding-table

AnswersA, D

Correct. Displays learned MAC addresses and their associated ports.

Why this answer

MAC address troubleshooting involves checking the ethernet-switching table and logging/operational displays for MAC moves.

Full explanation →

499

Multi-Selecteasy

Which TWO methods are used to connect switches in a Juniper EX Series Virtual Chassis? (Choose two)

Select 2 answers

A.Dedicated Virtual Chassis ports (VCPs) using specialized stacking cables.

B.Using standard serial console rollover cables for data and stacking traffic.

C.Configuring standard network uplink ports (such as 10G/40G interfaces) to operate as Virtual Chassis ports.

D.Running LACP over independent fiber strands between standalone switches.

E.Connecting standard access ports using unmanaged layer 2 Ethernet hubs.

AnswersA, C

Dedicated VCP ports provide high-speed ring/chain connectivity between members.

Why this answer

EX Series switches use dedicated Virtual Chassis ports (VCPs) or uplink modules configured as VCPs using specialized cables.

Full explanation →

500

MCQhard

An administrator is configuring load balancing across multiple equal-cost paths on an MX Series router. Which statement is correct regarding Junos default load-balancing behavior?

A.You must configure a routing policy with the 'load-balance' action and apply it to 'export' under 'routing-options'.

B.Load balancing requires enabling BGP multipath globally under the system hierarchy.

C.Junos automatically load-balances traffic per packet across all equal-cost paths by default without policy configuration.

D.Load balancing is configured directly within the firewall filter configuration using the 'sample' action.

AnswerA

Load balancing requires a policy that sets the load-balance action, applied via routing-options export.

Why this answer

By default, Junos performs destination-based forwarding (destination IP address). To enable per-packet or per-flow load balancing across multiple paths, explicit configuration using a routing policy with the 'load-balance' action is required.

Full explanation →

501

MCQmedium

An engineer wants to configure a Link Aggregation Group (LAG) to load-balance traffic based on Layer 3 and Layer 4 header fields (source/destination IP and source/destination port) rather than just Layer 2 MAC addresses. How is this achieved in Junos?

A.Configure load-balance profiles under [edit forwarding-options hash-key] specifying inet protocols.

B.Enable LACP multi-chassis hashing under the chassis hierarchy.

C.Configure 'set interfaces ae0 load-balance layer-3-4' directly under the interface stanza.

D.Set the LACP periodic transmission interval to fast.

AnswerA

Configuring hash keys under forwarding-options allows granular control over how LAG and ECMP hash traffic across member links.

Why this answer

Junos allows configuring load-balancing profiles under the forwarding-options hierarchical level to include IP and port hash fields.

Full explanation →

502

Multi-Selectmedium

Which THREE statements are true regarding OSPF Graceful Restart helper mode on Juniper routers? (Choose three)

Select 3 answers

A.It forces the restarting router to immediately drop all data forwarding traffic.

B.It requires manual configuration of VRRP tracking on all loopback interfaces.

C.It helps prevent unnecessary SPF recalculations across the network during transient control plane restarts.

D.Helper mode enables a router to assist a restarting neighbor by maintaining its routing entries during the restart window.

E.Helper mode is enabled by default for OSPF in Junos OS.

AnswersC, D, E

Suppressing adjacency drops avoids network-wide routing churn.

Why this answer

Helper mode allows routers to maintain routing tables while neighbors restart, suppressing routing churn and dropping adjacencies prematurely.

Full explanation →

503

Multi-Selectmedium

Which THREE states are defined in Rapid Spanning Tree Protocol (RSTP)? (Choose three.)

Select 3 answers

A.Blocking

B.Discarding

C.Learning

D.Forwarding

E.Listening

AnswersB, C, D

Discarding replaces blocking, listening, and disabled states in RSTP.

Why this answer

RSTP streamlines operational states into three distinct states: Discarding, Learning, and Forwarding. Legacy states like listening and blocked were combined into discarding.

Full explanation →

504

MCQmedium

You need to configure a static floating route that will only become active if the primary dynamic route learned via OSPF fails. Which configuration parameter must be adjusted to achieve this behavior?

A.as-path prepend

B.local-preference

C.preference

D.metric

AnswerC

Configuring a higher preference value makes the static route less preferred than OSPF, turning it into a floating static route.

Why this answer

Floating static routes rely on a higher preference (administrative distance) than the primary protocol so that they remain inactive until the primary route is removed from the routing table.

Full explanation →

505

Multi-Selectmedium

Which of the following are true about IS-IS Level-1 and Level-2 areas? (Choose TWO)

Select 2 answers

A.Level 2 is for connecting Level 1 areas.

B.Level 1 and Level 2 are the same thing.

C.Level 1 routers can communicate directly with routers in other areas.

D.Level 2 is for local interface management only.

E.Level 1 is for intra-area routing.

AnswersA, E

Correct definition.

Why this answer

Level 1 areas are for intra-area routing, while Level 2 areas connect multiple Level 1 areas.

Full explanation →

506

MCQmedium

You are configuring storm control on an EX Series switch and want to specify the rate limit in absolute bandwidth (kilobits per second) rather than a percentage. Which statement achieves this?

A.set protocols storm-control interface ge-0/0/2 speed 10m

B.set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m

C.set switch-options storm-control ge-0/0/2 kbps 10000

D.set interfaces ge-0/0/2 storm-control rate 10000kbps

AnswerB

This command configures an absolute bandwidth limit of 10 Mbps for storm control on the interface.

Why this answer

Absolute rate limits in storm control are configured using the 'bandwidth' option, such as 'set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m'.

Full explanation →

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 451–506