Layer 2 Security

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

You are implementing MACsec on an EX Series switch to secure a point-to-point link between two data centers. The link uses a 10 Gigabit Ethernet interface. You want to ensure that only encrypted traffic is accepted and that unencrypted frames are dropped. Which configuration parameter must be set on the interface?

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

You are configuring port security on an EX Series switch. The security policy states that when a MAC limit is exceeded on an access port, the port should be shut down and remain down until manually re-enabled by an administrator. Which configuration action accomplishes this requirement?

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

Which statement accurately describes port security MAC-limit behavior?

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

You are deploying a new access switch in a campus network. The security policy requires that all ARP packets received on untrusted access ports be validated against the DHCP snooping database, and that any ARP packet with an invalid IP-to-MAC binding be dropped and logged. You configure DHCP snooping on VLAN 100 and enable the appropriate feature on the untrusted ports. Which Junos OS feature must you enable to meet the policy requirement?

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

An administrator wants to protect against MAC flooding attacks on an EX Series switch access port. The port should learn a maximum of 5 MAC addresses and drop frames with unknown source MAC addresses after that limit is reached. Which feature should be configured?

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

An administrator configures a Layer 2 firewall filter to drop all ARP packets with a specific invalid sender hardware address. The filter is applied to a VLAN interface. What special consideration must be taken when applying Layer 2 filters to VLANs in Junos?

You are asked to implement a Layer 2 security feature that prevents a user from connecting a small unmanaged switch to an access port and generating traffic from multiple MAC addresses. The solution should limit the number of MAC addresses learned on the port to one. Which Junos OS feature should you configure?

An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?

Which TWO statements are true regarding IP Source Guard? (Choose two)

An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Which statement is true regarding the behavior of storm control when the traffic rate exceeds the configured threshold?

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

Which Junos configuration hierarchy is used to configure secure access port features such as DHCP snooping and Dynamic ARP Inspection?

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?