CCNA Layer 2 Security Questions

Multi-Selecteasy

Which TWO statements describe characteristics of port security in Junos OS? (Choose two)

Select 2 answers

A.It requires MACsec encryption to be active on the port before enforcing limits.

B.Configurable violation actions include drop, restrict, and shutdown.

C.It inspects DHCP lease transactions to build IP-to-MAC binding databases.

D.It can limit the number of learned MAC addresses on a specific interface.

E.It automatically enables 802.1X supplicant authentication on access ports.

AnswersB, D

These are the three standard violation actions available in Junos port security.

Why this answer

Port security allows limiting MAC addresses and taking actions like drop, restrict, or shutdown upon violation.

Practice this question →

Multi-Selectmedium

Which TWO traffic types are monitored and controlled by default when storm control is applied to an interface on an EX Series switch? (Choose two)

Select 3 answers

A.Multicast traffic

B.Unknown unicast traffic

C.BPDU control frames generated by Spanning Tree Protocol

D.Known unicast traffic destined for active MAC addresses

E.Broadcast traffic

AnswersA, B, E

Multicast traffic is monitored and policed by storm control by default.

Why this answer

Storm control targets broadcast, unknown unicast, and multicast traffic by default.

Practice this question →

Multi-Selectmedium

Which THREE actions can be configured as a response to a Dynamic ARP Inspection (DAI) violation on an EX Series switch? (Choose three)

Select 3 answers

A.Logging the violation event via syslog

B.Automatically shutting down the offending interface

C.Redirecting violating ARP packets to the Routing Engine CPU for inspection

D.Incrementing DAI drop counters

E.Dropping the violating ARP packet

AnswersA, D, E

DAI can be configured to log violations for auditing and troubleshooting.

Why this answer

DAI violation actions typically include dropping the packet, logging the event, and optionally shutting down the port depending on platform capabilities and configuration options. Let's verify valid Junos DAI actions: log, drop. Wait, DAI drops invalid packets by default and can log them.

Let's review standard Junos DAI behavior and options. DAI drops violating ARP packets and can log them. Port security supports shutdown/restrict/drop.

DAI specifically supports dropping packets and logging. Let's select the correct options.

Practice this question →

MCQmedium

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

A.Applied to the routing-instance forwarding table.

B.Applied globally under system services l2-firewall.

C.Applied to the input of an interface or VLAN under family ethernet-switching.

D.Applied to the output of the VLAN interface under family inet.

AnswerC

Layer 2 filters operate on family ethernet-switching and are typically applied to ingress interfaces or VLANs.

Why this answer

Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Practice this question →

MCQmedium

You are configuring MACsec on a link between two EX Series switches to secure data in transit. Which operational command verifies that the MACsec secure channels are established and operational?

A.show layer2-security macsec summary

B.show macsec connections

C.show ethernet-switching macsec interface

D.show security macsec status

AnswerB

This is the correct operational command to check active MACsec sessions and parameters.

Why this answer

The 'show macsec connections' command displays the status of MACsec secure channels, including connectivity association keys (CAK) and security associations (SA).

Practice this question →

MCQmedium

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

A.set switch-options interface ge-0/0/5 ip-source-guard-mode strict

B.set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify

C.set interfaces ge-0/0/5 family ethernet-switching ip-source-guard verify-source

D.set protocols ip-source-guard interface ge-0/0/5 enable

AnswerB

This statement correctly enables IP Source Guard with IP and MAC verification on the specified interface.

Why this answer

IP Source Guard with IP and MAC verification is enabled using 'set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify'.

Practice this question →

MCQhard

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

A.Enable DHCP snooping on the core router's interface.

B.Configure a static DHCP binding for the gateway IP on the access switch.

C.Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.

D.Configure the interface connected to the default gateway as a trusted interface for DAI.

AnswerD

Since routers don't acquire IPs via DHCP snooping, the uplink port facing the gateway must be explicitly trusted for DAI to permit its ARP replies.

Why this answer

The switch port connecting to the router or the router's IP binding must be explicitly trusted or added to a static ARP inspection log/ACL since routers do not participate in DHCP snooping.

Practice this question →

MCQmedium

You need to apply a Layer 2 firewall filter named 'block-rogue-mac' to inbound traffic on all access ports of an EX2300 switch. Under which hierarchy level must the filter be bound?

A.set security firewall filter block-rogue-mac interface ge-0/0/0.0

B.set protocols firewall family bridge interface ge-0/0/0.0 input block-rogue-mac

C.set interfaces ge-0/0/0 unit 0 family bridge filter input block-rogue-mac

D.set vlans default firewall input block-rogue-mac

AnswerC

Bridge family filters are bound to interface logical units under the family bridge stanza.

Why this answer

Layer 2 (bridge) filters in Junos are applied under the VLAN configuration or interface configuration depending on architecture, but for bridge filters inspecting switching interfaces, they are typically applied under 'interfaces <name> unit 0 family bridge filter input'.

Practice this question →

MCQmedium

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

A.Internet Key Exchange version 2 (IKEv2)

B.Secure Session Protocol (SSP)

C.802.1AE Dynamic Key Distribution (AKD)

D.MACsec Key Agreement (MKA) protocol

AnswerD

MKA is the standard protocol used by MACsec for peer discovery and key management.

Why this answer

MACsec in Junos uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X, to discover peers and manage cryptographic keys.

Practice this question →

MCQmedium

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

A.AES-CBC-128

B.SHA-256-HMAC

C.GCM-AES-128

D.GCM-AES-256

AnswerC

GCM-AES-128 is the default cipher suite for Junos MACsec.

Why this answer

When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Practice this question →

Multi-Selectmedium

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Select 3 answers

A.MACsec Key Agreement (MKA)

B.Dynamic ARP Inspection (DAI)

C.DHCP Snooping

D.IP Source Guard

E.Spanning Tree Root Protection

AnswersB, C, D

DAI is a core secure access port feature.

Why this answer

Secure access port features include DHCP snooping, Dynamic ARP Inspection, and IP Source Guard. Port security is also part of secure access features. Let's select three standard ones.

Practice this question →

Multi-Selecteasy

Which TWO commands are valid Junos operational commands used to verify secure access port features? (Choose two)

Select 2 answers

A.show ethernet-switching dhcp-snooping binding

B.show ethernet-switching secure-access-port ip-source-guard interface

C.show bridge-domain secure-access status

D.show arp-inspection database

E.show security port-security summary

AnswersA, B

This command displays active DHCP bindings.

Why this answer

Valid operational commands include showing DHCP snooping bindings and IP Source Guard status.

Practice this question →

Multi-Selecthard

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

Select 3 answers

A.MACsec pre-shared keys configured on all access ports

B.Dynamic ARP Inspection enabled on the specific VLAN

C.Configured static ARP inspection bindings for every client

D.Trusted ports configured on uplinks toward DHCP servers or core routers

E.DHCP snooping enabled on the respective VLAN

AnswersB, D, E

DAI must be explicitly enabled per VLAN to intercept and validate ARP packets.

Why this answer

DAI depends on active VLAN mapping, DHCP snooping bindings to validate ARP packets, and trusted uplink interfaces to allow legitimate gateway ARP traffic.

Practice this question →

MCQmedium

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

A.The interface automatically recovers after a default hold-down timer of 300 seconds.

B.The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.

C.The interface drops violating packets but remains operationally up until manually disabled.

D.The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

AnswerB

Correct. The shutdown violation action puts the port in a disabled state requiring administrator intervention.

Why this answer

When an interface is shut down due to a port security violation, it enters a disabled state. It remains down until explicitly re-enabled using 'clear ethernet-switching security-violation' or by toggling the interface status.

Practice this question →

MCQmedium

You have enabled DHCP snooping on an access switch. During troubleshooting, you notice that DHCP Request messages from clients are being dropped on untrusted switch ports. Why is this occurring?

A.The client's MAC address is not yet learned in the switch's Ethernet switching table.

B.Option-82 checks are enabled, and the incoming client request fails validation rules.

C.DHCP snooping drops all DHCP messages on untrusted ports by design.

D.Dynamic ARP Inspection is blocking the DHCP request packets.

AnswerB

If option-82 insertion or validation is misconfigured, DHCP requests from clients can be dropped.

Why this answer

DHCP snooping permits DHCP Discover and Request messages on untrusted ports to allow clients to obtain IP addresses, provided the server replies pass through trusted ports. However, if requests are dropped, verify if rate-limiting or option-82 checks are causing drops. Wait, let's re-evaluate: DHCP Request messages from clients are normally permitted on untrusted ports.

If they are dropped, it might be due to a specific option-82 validation failure. Let's check option options.

Practice this question →

MCQeasy

Which statement accurately describes port security MAC-limit behavior?

A.It statically assigns all learned MAC addresses to the switch configuration file automatically.

B.It defines the maximum bandwidth a single MAC address can consume on a port.

C.It prevents MAC address spoofing by validating IP bindings against DHCP tables.

D.It restricts the maximum number of MAC addresses that can be learned on a secure interface.

AnswerD

MAC-limit caps the total number of unique source MAC addresses learned on the interface.

Why this answer

Port security MAC-limit restricts the maximum number of MAC addresses learned on a secure interface.

Practice this question →

MCQeasy

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

A.show storm-control statistics interface ge-0/0/1

B.show ethernet-switching storm-control interface ge-0/0/1

C.show bridge storm-control interface ge-0/0/1

D.show interfaces extensive ge-0/0/1 | match storm

AnswerB

This command correctly displays storm control metrics and drop counts for the specified interface.

Why this answer

The correct operational command to check storm control status and dropped packet counters on interfaces is 'show ethernet-switching storm-control interface'.

Practice this question →

MCQhard

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

A.The static client is using an IP address outside the DHCP pool range.

B.The client's MAC address violates the port security maximum limit.

C.DAI requires all interfaces to be trusted on the VLAN.

D.The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.

AnswerD

Static clients do not generate DHCP bindings, requiring static IP source entries or static ARP inspection entries for DAI to permit their ARP packets.

Why this answer

Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Practice this question →

MCQmedium

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

A.Configure the interface as a trusted interface for DHCP snooping.

B.Configure the interface as a trunk port.

C.Apply an ingress firewall filter blocking UDP port 67.

D.Enable IP Source Guard on the uplink interface.

AnswerA

Trusted interfaces allow DHCP server replies (Offers and Acknowledgments), whereas untrusted ports drop them.

Why this answer

Ports facing legitimate DHCP servers must be designated as trusted using 'set ethernet-switching-options secure-access-port vlan <name> dhcp-snooping interface <name> trusted'.

Practice this question →

MCQeasy

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

A.reset interface security-violations

B.clear bridge security-counters

C.clear ethernet-switching security-violation

D.clear arp-inspection statistics

AnswerC

This command clears all port security, DAI, and IP Source Guard violations and counters.

Why this answer

Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Practice this question →

Multi-Selecthard

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

Select 3 answers

A.They are configured under the 'family ethernet-switching' match criteria context.

B.They are applied to logical Layer 3 routing interfaces (irb or vlan interfaces) using family inet.

C.They can match on source and destination MAC addresses as well as EtherType fields.

D.They can be applied to physical switch ports or entire VLANs.

E.They execute routing lookups prior to evaluating packet match conditions.

AnswersA, C, D

Layer 2 filters require the family ethernet-switching context.

Why this answer

Layer 2 filters use family ethernet-switching, can match on MAC addresses and EtherTypes, and are applied to interfaces or VLANs.

Practice this question →

Multi-Selecthard

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

Select 3 answers

A.Enable active router-advertisement snooping to support the filter.

B.Apply the filter under the 'family inet' routing protocol hierarchy.

C.Configure the filter action as 'discard' for the broadcast term.

D.Define the filter under 'family ethernet-switching'.

E.Use a match condition for destination MAC address broadcast 'ff:ff:ff:ff:ff:ff'.

AnswersC, D, E

The discard action drops the matching broadcast traffic.

Why this answer

Implementing this filter requires defining the family ethernet-switching context, writing a term matching broadcast destination MAC addresses with action discard, and applying the filter to the VLAN or interface.

Practice this question →

Multi-Selectmedium

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Select 3 answers

A.It requires IP Source Guard to be enabled before the binding table can be populated.

B.It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.

C.Ports facing DHCP servers must be explicitly configured as trusted.

D.Untrusted ports drop DHCP server response messages (Offer and ACK).

E.It operates exclusively by analyzing static ARP entries configured by administrators.

AnswersB, C, D

DHCP snooping tracks these parameters to build the secure binding database.

Why this answer

DHCP snooping builds a binding table, blocks rogue servers on untrusted ports, and inspects DHCP messages.

Practice this question →

MCQeasy

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

A.Traffic policing by dropping packets exceeding the configured bandwidth threshold

B.Input queue buffering and tail-drop avoidance

C.Rate limiting via TCP window size adjustments

D.Traffic shaping with weighted random early detection (WRED)

AnswerA

Storm control acts as a policer, dropping traffic that breaches the threshold.

Why this answer

Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Practice this question →

MCQeasy

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

A.MACsec

B.Dynamic ARP Inspection

C.Port security

D.Storm control

AnswerD

Storm control monitors traffic levels and drops excess broadcast, multicast, or unknown unicast traffic.

Why this answer

Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Practice this question →

MCQhard

You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?

A.The uplink port connecting to the default gateway is missing the 'set protocols arp-inspection trust' statement.

B.Clients are using statically assigned IP addresses that do not exist in the DHCP snooping binding database.

C.MAC limiting has tripped on the access port, causing ARP packets to be discarded.

D.The ARP inspection rate-limit has been exceeded on the access ports.

AnswerB

Static IP addresses bypass DHCP, meaning no entry is created in the DHCP snooping database, causing DAI to drop their ARP packets as invalid.

Why this answer

DAI relies on the DHCP snooping database to validate ARP bindings. If a client uses a static IP address or if the DHCP binding has expired/not been learned, DAI drops the ARP reply/request because it cannot match the IP-to-MAC binding in the DHCP snooping database.

Practice this question →

MCQeasy

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

A.Source MAC address

B.Destination IP address

C.ICMP type code

D.TCP port number

AnswerA

Bridge family filters evaluate Layer 2 fields like source and destination MAC addresses.

Why this answer

Layer 2 firewall filters in Junos can match fields such as source MAC address, destination MAC address, VLAN ID, and EtherType.

Practice this question →

MCQhard

An administrator configures a Layer 2 firewall filter to match on EtherType 0x88cc (LLDP) and discard those frames on an access port. However, LLDP packets are still reaching adjacent connected devices. Why?

A.LLDP uses a multicast destination MAC address that bypasses MAC-filtering rules.

B.Layer 2 firewall filters cannot match on EtherType fields in Junos.

C.LLDP frames are processed by the control plane or hardware before ingress port firewall evaluation.

D.The filter was applied to the output instead of the input direction.

AnswerC

Control traffic like LLDP is often intercepted or processed by hardware/CPU daemons prior to standard user-defined Layer 2 ingress filtering on certain platforms.

Why this answer

Bridge Protocol Data Units (BPDUs), LLDP, and LACP are typically processed by control plane daemons or hardware exceptions before ingress Layer 2 firewall filters can evaluate them on standard access ports.

Practice this question →

MCQmedium

You are troubleshooting IP Source Guard on an EX Series switch. You want to see which interfaces have IP Source Guard enabled and their operational state. Which operational command should you use?

A.show bridge ip-source-guard

B.show ethernet-switching secure-access-port ip-source-guard interface

C.show ip-source-guard interfaces

D.show interfaces ip-source-guard brief

AnswerB

This command correctly displays IP Source Guard configuration and operational state per interface.

Why this answer

The command 'show ethernet-switching secure-access-port ip-source-guard' displays IP Source Guard interface statuses.

Practice this question →

MCQhard

An access port on an EX Series switch is configured with port security to allow a maximum of 2 MAC addresses. When a 3rd device is connected, the port immediately shuts down. Which action statement under 'ethernet-switching-options secure-access-port' achieves this behavior?

A.set ethernet-switching-options secure-access-port interface ge-0/0/2.0 violation-action shutdown

B.set switch-options interface ge-0/0/2.0 mac-limit action block-and-shutdown

C.set protocols port-security interface ge-0/0/2.0 action disable-port

D.set interfaces ge-0/0/2.0 unit 0 family ethernet-switching port-security limit-action error-disable

AnswerA

The 'violation-action shutdown' command disables the port when the MAC limit is exceeded.

Why this answer

In Junos port security configuration, violation actions include drop, shutdown, and restrict. Setting the violation action to 'shutdown' disables the interface upon a limit breach.

Practice this question →

MCQhard

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

A.show macsec connections

B.show ethernet-switching macsec interface

C.show protocols mka sessions

D.show security macsec status

AnswerA

The 'show macsec connections' command provides detailed MKA session and MACsec link status.

Why this answer

To view MACsec and MKA operational status, session states, and connectivity associations, the command 'show macsec connections' is used.

Practice this question →

MCQeasy

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

A.show ethernet-switching dhcp-snooping binding

B.show dhcp-snooping binding

C.show system dhcp-snooping database

D.show bridge dhcp bindings

AnswerA

This is the correct operational command to view DHCP snooping bindings.

Why this answer

The operational command to view DHCP snooping bindings is 'show ethernet-switching dhcp-snooping binding'.

Practice this question →

Multi-Selecthard

Which TWO conditions must be met for Dynamic ARP Inspection (DAI) to successfully forward an ARP request or reply packet on an access port? (Choose two)

Select 2 answers

A.The packet matches an entry in the system static ARP table.

B.The incoming interface is explicitly configured as a trusted interface for DAI.

C.Port security MAC-limit has not been reached on any adjacent trunk port.

D.The sender's IP and MAC address match an entry in the DHCP snooping binding database.

E.The ARP packet contains a valid gratuitous broadcast destination MAC address.

AnswersB, D

Trusted interfaces bypass binding checks and forward ARP packets freely.

Why this answer

DAI forwards packets if the interface is trusted OR if the sender IP-to-MAC binding matches an entry in the DHCP snooping database.

Practice this question →

MCQhard

An administrator configures a Layer 2 firewall filter to drop all ARP packets with a specific invalid sender hardware address. The filter is applied to a VLAN interface. What special consideration must be taken when applying Layer 2 filters to VLANs in Junos?

A.Layer 2 filters applied to VLANs require family inet to inspect ARP payloads.

B.Layer 2 filters on VLANs evaluate traffic across all member ports belonging to that VLAN instance.

C.Layer 2 filters cannot be applied to VLANs; they must be applied to physical interfaces only.

D.VLAN-based Layer 2 filters only process egress traffic leaving the VLAN trunk ports.

AnswerB

Applying a Layer 2 filter to a VLAN affects all ingress traffic on all physical ports associated with that VLAN.

Why this answer

Layer 2 firewall filters applied to VLANs filter traffic across all member ports of that VLAN and must be defined using family ethernet-switching.

Practice this question →

Multi-Selectmedium

Which TWO methods can be used to recover an EX Series switch interface that has been shut down due to a port security violation? (Choose two)

Select 3 answers

A.Clearing the DHCP snooping binding database cache

B.Executing 'clear interfaces statistics' for the affected port

C.Disabling and re-enabling the physical interface using CLI configuration changes

D.Executing the 'clear ethernet-switching security-violation' operational command

E.Restarting the chassis daemon (chassisd) on the switch

AnswersC, D, E

Bouncing the interface state resets the port security shutdown status.

Why this answer

Ports shut down by port security can be recovered using the 'clear ethernet-switching security-violation' command or by manually toggling interface admin state (disable/enable).

Practice this question →

MCQhard

An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?

A.Enable DHCP snooping with static ARP inspection override.

B.Increase the mac-limit to 2 and enable dynamic MAC learning persistence.

C.Configure IEEE 802.1X with multiple supplicants or MAC Authentication Bypass (MAB).

D.Configure storm control with a multi-device profile.

AnswerC

Configuring 802.1X and MAB allows multiple authorized devices (phone and PC) to be learned securely on the same access port.

Why this answer

To allow multiple devices behind a single port (like a VoIP phone and PC) while maintaining port security, MAC-radius or voice VLAN with dynamic MAC limit adjustments, or setting the mac-limit higher with IEEE 802.1X / MAC Authentication Bypass (MAB) is used.

Practice this question →

Multi-Selecthard

An administrator implements MACsec to secure links between switches. Which THREE operational tasks or verifications are relevant when troubleshooting MACsec and MKA? (Choose three)

Select 3 answers

A.Ensuring Layer 2 firewall filters are blocking MACsec EtherType 0x88E5.

B.Verifying MKA peer connectivity state using 'show macsec connections'.

C.Inspecting DHCP binding tables to verify MACsec key distribution.

D.Verifying that pre-shared key (CAK and CKN) configurations match on both peer switches.

E.Checking encryption and decryption packet error counters.

AnswersB, D, E

This command shows active MKA sessions and peer connectivity.

Why this answer

Troubleshooting MACsec involves checking MKA session status, connectivity associations, and encryption/decryption statistics.

Practice this question →

Multi-Selecteasy

Which TWO statements are true regarding IP Source Guard? (Choose two)

Select 2 answers

A.It is configured under the routing-instances protocol hierarchy.

B.It automatically encrypts all user data packets using AES-256.

C.It functions by monitoring and rate-limiting broadcast ARP traffic storms.

D.It prevents IP spoofing attacks by filtering traffic based on binding databases.

E.It relies on the DHCP snooping database to validate client source IP addresses.

AnswersD, E

IP Source Guard drops packets where source IP addresses do not match binding table records.

Why this answer

IP Source Guard drops traffic with unauthorized source IPs and relies on DHCP snooping bindings.

Practice this question →

MCQhard

An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?

A.The MKA key exchange failed due to MTU handshake validation timeouts.

B.Dynamic ARP Inspection is dropping fragmented Ethernet frames.

C.The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.

D.The cipher suite GCM-AES-256 compresses frames beyond the minimum frame size limit.

AnswerC

MACsec adds encryption overhead to frames, requiring MTU to be adjusted upwards (e.g., to 1532 or higher) across the transit path.

Why this answer

MACsec encapsulation adds overhead (ICV and security headers) to the Ethernet frame, increasing its size. If the transport provider network or physical interface MTU is not increased to accommodate this overhead, frames are dropped.

Practice this question →

Multi-Selecthard

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Select 3 answers

A.Connectivity Association Key (CAK)

B.Connectivity Key Name (CKN)

C.Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

D.Cipher suite configuration

E.IP address subnet allocation on the physical transit ports

AnswersA, B, D

Peers must share the identical CAK to derive encryption keys.

Why this answer

MACsec PSK establishment requires matching connectivity association keys (CAK), connectivity key names (CKN), and cipher suite compatibility.

Practice this question →

MCQeasy

Which statement is true regarding the behavior of storm control when the traffic rate exceeds the configured threshold?

A.Excess traffic exceeding the threshold is dropped by the switch hardware.

B.Traffic is rate-shaped and buffered in the output queue until congestion clears.

C.The interface is immediately shut down and placed in an error-disabled state.

D.The switch sends SNMP traps and forwards the traffic with a low-priority CoS marking.

AnswerA

Storm control drops traffic that exceeds the defined rate limit until levels subside.

Why this answer

When storm control thresholds are exceeded, Junos drops the excess traffic matching the storm control criteria until the rate drops below the threshold.

Practice this question →

MCQmedium

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

A.Packets from violating MAC addresses are dropped, and a syslog message/counter is generated while valid traffic continues.

B.The interface immediately shuts down and generates an SNMP trap.

C.The violating MAC address is automatically added to a static ARP inspection deny list.

D.The switch drops all traffic on the interface until the violation timer expires.

AnswerA

The 'restrict' action drops violating traffic and logs/counts the event without disabling the port.

Why this answer

The 'restrict' action causes the switch to drop packets from unauthorized source MAC addresses and increment violation counters, but the port remains up and forwarding for valid MACs.

Practice this question →

MCQeasy

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

A.set protocols arp-inspection vlan VLAN10

B.set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection

C.set vlans VLAN10 dynamic-arp-inspection

D.set interfaces vlan unit 10 family inet arp-inspection

AnswerB

This command correctly enables DAI on the specified VLAN under secure-access-port.

Why this answer

DAI is enabled under ethernet-switching-options secure-access-port vlan for the specific VLAN name.

Practice this question →

MCQeasy

Which operational command displays the status of MACsec connections and associated security association parameters on an EX Series switch?

A.show ethernet-switching macsec

B.show protocols mka status

C.show security macsec associations

D.show macsec connections

AnswerD

This command shows MACsec connections, status, and SA parameters.

Why this answer

The command 'show macsec connection' shows active connections and parameters.

Practice this question →

MCQeasy

Which Junos configuration hierarchy is used to configure secure access port features such as DHCP snooping and Dynamic ARP Inspection?

A.set ethernet-switching-options secure-access-port

B.set protocols l2-security

C.set system security layer2

D.set switch-options port-security

AnswerA

This is the correct configuration hierarchy for secure access port features in Junos.

Why this answer

Secure access port features are configured under the 'ethernet-switching-options secure-access-port' hierarchy.

Practice this question →

Multi-Selectmedium

Which TWO parameters can be configured when setting up storm control on an EX Series switch? (Choose two)

Select 3 answers

A.DHCP lease time expiration limit

B.Maximum allowed MAC address count

C.MACsec cryptographic key length

D.Bit-rate limit in bits per second (bps)

E.Bandwidth percentage threshold

AnswersB, D, E

Wait, maximum allowed MAC address count is port security, not storm control. Let's look at option C.

Why this answer

Storm control in Junos allows specifying bandwidth thresholds using either a percentage of total link bandwidth or a specific bit-rate (bps).

Practice this question →

MCQhard

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

A.IP Source Guard requires static ARP inspection to be enabled simultaneously.

B.The client's MAC address is in the port security violation log.

C.DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.

D.IP Source Guard only supports static IP bindings, not DHCP-derived bindings.

AnswerC

Without DHCP snooping active on the VLAN, the binding table remains empty, and IP Source Guard drops all traffic from non-static source IPs.

Why this answer

IP Source Guard relies entirely on the DHCP snooping binding database. If the DHCP snooping feature is not enabled on that specific VLAN, no database entries are created, causing IP Source Guard to drop traffic.

Practice this question →

Multi-Selecteasy

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Select 2 answers

A.Multicast traffic rate exceeding the configured threshold

B.Unicast traffic destined for known active MAC addresses exceeding average utilization

C.CPU control plane queue utilization exceeding 90%

D.Broadcast traffic rate exceeding the configured threshold

E.BPDU control frames exceeding Spanning Tree hello timers

AnswersA, D

Exceeding the multicast rate limit triggers drops.

Why this answer

Storm control triggers drops when broadcast or multicast traffic rates exceed configured thresholds.

Practice this question →

Multi-Selectmedium

Which TWO parameters can be configured when setting up storm control on an EX Series switch interface? (Choose two)

Select 2 answers

A.Absolute bandwidth rate in kilobits or megabits per second

B.Explicit packet drop probability curve using WRED profiles

C.Maximum TCP window scaling factor

D.Bandwidth percentage of total port capacity

E.Maximum frame byte size limit for MTU enforcement

AnswersA, D

Absolute bit rates can be configured using the bandwidth parameter.

Why this answer

Storm control can be configured using bandwidth percentage or absolute bandwidth rates.

Practice this question →

MCQhard

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

A.The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.

B.The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.

C.A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.

D.DHCP snooping is blocking the MACsec control frames on the transit link.

AnswerC

If pre-shared keys or key names do not match, the MKA peers cannot derive identical encryption session keys, leading to decryption failures.

Why this answer

Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Practice this question →

Multi-Selecteasy

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Select 2 answers

A.IP Source Guard

B.Storm Control rate-limiting

C.Dynamic ARP Inspection (DAI)

D.Port Security MAC-Limit

E.MACsec Key Agreement (MKA)

AnswersA, C

IP Source Guard relies on the DHCP snooping table to verify client source IPs.

Why this answer

Dynamic ARP Inspection and IP Source Guard both rely on the DHCP snooping binding database for validation.

Practice this question →

MCQhard

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

A.Broadcast traffic and explicit Layer 2 control frames like BPDU and LACP.

B.Broadcast and multicast traffic only, excluding unknown unicast.

C.Broadcast traffic only

D.Broadcast, unknown unicast, and multicast traffic.

AnswerD

By default, storm control applies to broadcast, unknown unicast, and multicast traffic.

Why this answer

By default, Junos storm control monitors and limits broadcast, unknown unicast, and multicast traffic collectively when configured on an interface unless restricted.

Practice this question →

Multi-Selecthard

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Select 3 answers

A.Enable MACsec on the physical interface.

B.Configure the interface as a trusted port for Dynamic ARP Inspection.

C.Configure matching Connectivity Association Key (CAK) and Connectivity Key Name (CKN).

D.Enable DHCP snooping on the transit VLAN.

E.Configure security association parameters or cipher suites if deviating from defaults.

AnswersA, C, E

MACsec must be explicitly enabled on the target interfaces.

Why this answer

Configuring MACsec with PSK requires enabling MACsec on the interface, defining connectivity association keys (CAK) and key names (CKN), and selecting the cipher suite or interface parameters.

Practice this question →

Multi-Selecthard

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Select 3 answers

A.DHCP snooping

B.MAC address limiting and persistent learning

C.OSPFv3 authentication

D.MACsec point-to-point encryption

E.Dynamic ARP Inspection

AnswersA, B, E

DHCP snooping is integrated into the secure access port framework.

Why this answer

Secure access port features encompass port security (MAC limiting), DHCP snooping, and Dynamic ARP Inspection (DAI).

Practice this question →

MCQhard

An administrator implements Dynamic ARP Inspection (DAI) on an EX Series switch. Legitimate ARP replies from a static server are being dropped. Rather than making the entire port trusted, how can the administrator permit this specific static server's ARP traffic?

A.Add the server's MAC address to the switch's static MAC-table using 'set bridge-domains'.

B.Create a Layer 2 firewall filter permitting ARP packets with action 'accept-and-trust'.

C.Configure an explicit static ARP entry under 'set protocols arp static'.

D.Configure a static IP source entry in the secure-access-port binding table for the server.

AnswerD

Adding a static binding entry in the secure-access-port database allows DAI and IP Source Guard to validate the static host without trusting the port.

Why this answer

Static ARP inspection entries or static IP source bindings can be configured to allow non-DHCP clients through DAI without trusting the entire port.

Practice this question →

Multi-Selecteasy

Which TWO options are valid violation actions available for port security configurations in Junos OS? (Choose two)

Select 2 answers

A.isolate

B.rate-limit

C.quarantine

D.restrict

E.shutdown

AnswersD, E

Restrict drops violating traffic and increments counters while keeping the port up.

Why this answer

Junos port security supports drop, restrict, and shutdown violation actions.

Practice this question →

MCQeasy

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

A.Dynamic ARP Inspection

B.IP Source Guard

C.DHCP Snooping

D.Port Security MAC-Limit

AnswerC

DHCP snooping listens to DHCP transactions to build the binding database.

Why this answer

DHCP snooping must be enabled on the VLAN or switch to intercept DHCP messages and build the binding database.

Practice this question →

MCQmedium

You are configuring storm control on an EX Series switch and want to specify the rate limit in absolute bandwidth (kilobits per second) rather than a percentage. Which statement achieves this?

A.set protocols storm-control interface ge-0/0/2 speed 10m

B.set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m

C.set switch-options storm-control ge-0/0/2 kbps 10000

D.set interfaces ge-0/0/2 storm-control rate 10000kbps

AnswerB

This command configures an absolute bandwidth limit of 10 Mbps for storm control on the interface.

Why this answer

Absolute rate limits in storm control are configured using the 'bandwidth' option, such as 'set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m'.

Practice this question →