Courseiva

CCNA Layer 2 Switching And VLANs Questions

20 questions · Layer 2 Switching And VLANs · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

An enterprise network design requires implementing private VLANs (PVLANs) on an EX Series switch. Which THREE components or port types are characteristic of a private VLAN architecture? (Choose three.)

Select 3 answers
A.Community ports that can communicate with other ports in the same community and promiscuous ports.
B.Isolated ports that can only communicate with promiscuous ports.
C.Promiscuous ports that can communicate with all ports across both primary and secondary VLANs.
D.Routing instance interfaces (RIB-only) that automatically disable Layer 2 bridging.
E.Fully meshed trunk ports that bypass all isolation rules for inter-VLAN routing.
AnswersA, B, C

Community ports form a secondary VLAN grouping where members exchange traffic with each other and with promiscuous ports, but not with isolated ports. This partial isolation satisfies the PVLAN requirement for controlled communication within a defined community.

Why this answer

In a private VLAN architecture on EX Series switches, community ports (option A) are secondary-VLAN member ports that may communicate with other ports in the same community VLAN and with promiscuous ports, but not with isolated ports or other communities. Isolated ports (option B) belong to an isolated secondary VLAN and can communicate only with promiscuous ports, providing the strictest Layer 2 isolation among host ports. Promiscuous ports (option C) are members of the primary VLAN and can communicate with all ports across both the primary VLAN and its associated secondary VLANs, typically serving as the gateway or uplink port.

Option D is incorrect because RIB-only routing instance interfaces are a Layer 3 routing construct unrelated to PVLAN port roles and do not define PVLAN behavior. Option E is incorrect because PVLANs do not use fully meshed trunk ports to bypass isolation; trunk ports simply carry the primary and secondary VLAN tags while preserving the PVLAN isolation rules.

Exam trap

JNCIS-ENT often tests whether candidates confuse PVLAN port roles with regular VLAN or trunk concepts — the distractor about 'trunk ports bypassing isolation' tempts those who don't understand that isolation is enforced regardless of tagging.

Practice this question →
2
MCQmedium

You are reviewing the configuration of an EX Series switch and notice that interface ge-0/0/15 is configured with 'interface-mode access' but has no explicit 'vlan members' statement defined. Which VLAN does the interface default to?

A.VLAN 0 (null VLAN)
B.The port remains shut down until a VLAN is explicitly assigned.
C.VLAN 1 (default VLAN)
D.It drops all traffic until a VLAN membership is added.
AnswerC

On Juniper EX Series switches, an access interface without an explicit `vlan members` statement defaults to the default VLAN, which is VLAN 1. This satisfies the stem's constraint of no VLAN membership being defined, so untagged traffic on ge-0/0/15 is associated with VLAN 1.

Why this answer

On Juniper EX Series switches, when an interface is configured with 'interface-mode access' and no explicit 'vlan members' statement is present, the interface automatically becomes a member of the default VLAN, which is VLAN ID 1. This default VLAN is created by the system and is named 'default'. The interface will forward untagged traffic into VLAN 1, allowing connectivity without additional configuration.

Exam trap

JNCIS-ENT often tests the assumption that an access port without a VLAN assignment will be non-functional or placed in a null VLAN, but the correct behavior is that it defaults to VLAN 1.

How to eliminate wrong answers

Option A is wrong because VLAN 0 is not a valid user VLAN on Juniper EX switches; it is reserved for internal use (e.g., priority tagging) and cannot be assigned to access ports. Option B is wrong because the port does not remain shut down; it becomes operational and is placed in the default VLAN. Option D is wrong because the interface does not drop all traffic; it actively forwards traffic in VLAN 1, the default VLAN.

Practice this question →
3
MCQeasy

An administrator needs to view the MAC address learning table on an EX Series switch to verify which switchport a specific server is connected to. Which operational command should be used?

A.show mac-address-table
B.show ethernet-switching table
C.show vlans mac-table
D.show bridge-domain mac-table
AnswerB

The show ethernet-switching table command displays learned MAC addresses with their associated VLAN and switchport, letting the administrator confirm which port the server attaches to. This satisfies the requirement to view the MAC learning table.

Why this answer

On Juniper EX Series switches, the MAC address learning table is exposed through the ethernet-switching subsystem, so the correct operational command is 'show ethernet-switching table'. This command displays learned MAC addresses, their associated VLANs, and the egress switchport, allowing the administrator to map a server's MAC to the exact interface it is connected to.

Exam trap

JNCIS-ENT often tests candidates who carry Cisco IOS muscle memory into Junos, so the trap is picking 'show mac-address-table' — a valid Cisco command that simply does not exist on Junos EX switches.

How to eliminate wrong answers

Option A is wrong because 'show mac-address-table' is Cisco IOS syntax and is not a valid Junos operational command on EX Series switches. Option C is wrong because 'show vlans mac-table' is not a valid Junos command; VLAN information is viewed with 'show vlans' but MAC entries are not exposed through that syntax. Option D is wrong because 'show bridge-domain mac-table' is not a valid Junos command — bridge domains are an MX/ACX construct and the syntax does not apply to EX ethernet-switching tables.

Practice this question →
4
Multi-Selectmedium

You are configuring a Private VLAN (PVLAN) on an EX Series switch to isolate hosts within a DMZ segment while allowing them to reach a shared gateway. Which TWO statements correctly describe the behavior of PVLAN port types in this scenario? (Choose two.)

Select 2 answers
A.Isolated ports can communicate with promiscuous ports and with other isolated ports on the same switch.
B.Promiscuous ports can only communicate with isolated ports and not with community ports.
C.Isolated ports can communicate with each other and with community ports within the same PVLAN.
D.Promiscuous ports can communicate with all isolated and community ports, and they typically connect to the gateway or router.
E.Community ports can communicate with other ports in the same community and with promiscuous ports, but not with isolated ports.
AnswersD, E

Promiscuous ports are designed to communicate with all ports in the PVLAN, including isolated and community ports. In a DMZ, the router or gateway connects to a promiscuous port so that isolated hosts can reach the gateway while remaining unable to communicate directly with each other. This behavior is fundamental to PVLAN operation and satisfies the requirement of shared gateway access.

Why this answer

In a PVLAN, promiscuous ports communicate with all isolated and community ports, making them suitable for gateway connections, while community ports communicate with each other and with promiscuous ports but not with isolated ports. Isolated ports communicate only with promiscuous ports. These rules provide granular isolation within a single VLAN, which is ideal for DMZ segments where hosts must reach a shared gateway but not each other.

Exam trap

The trap here is assuming that isolated ports can talk to each other simply because they share the same VLAN, when PVLAN isolation explicitly prevents that communication.

Practice this question →
5
Multi-Selecthard

When configuring Private VLANs (PVLANs) on Juniper EX Series switches, which TWO types of ports are defined within the architecture? (Choose two.)

Select 2 answers
A.Root bridge port
B.Promiscuous port
C.Host port (Isolated or Community)
D.Core uplink port
E.Trunk access port
AnswersB, C

A promiscuous port carries the primary VLAN and communicates with every isolated and community port, plus external networks such as the router or firewall. This satisfies the stem's requirement for one of the two defined PVLAN port types on Juniper EX Series switches, alongside isolated and community ports.

Why this answer

In Juniper EX Series PVLAN architecture, a promiscuous port (option B) is the port that connects to a router or gateway and can communicate with all isolated and community VLAN ports, serving as the shared upstream exit point for the secondary VLANs. Option C, the host port (Isolated or Community), is also correct because PVLANs define host-facing ports as either isolated (which can only talk to the promiscuous port) or community (which can talk to the promiscuous port and other members of the same community). These two port roles are the fundamental building blocks of PVLANs on EX switches, alongside the primary/secondary VLAN constructs.

The remaining options are not PVLAN port types: a root bridge port (A) is an STP concept, a core uplink port (D) is a generic topology term, and a trunk access port (E) is not a defined PVLAN port role.

Exam trap

JNCIS-ENT often tests the distinction between promiscuous, isolated, and community ports — candidates frequently forget that 'isolated' and 'community' are both host port subtypes, not separate top-level categories.

Practice this question →
6
MCQeasy

An administrator configures a new VLAN ID 300 on an EX Series switch but forgets to assign any interfaces to it. What is the operational status of this VLAN?

A.The switch assigns all unused ports to VLAN 300 by default.
B.The VLAN remains inactive in the switching table until an interface or IRB is associated with it.
C.The switch generates a critical alarm preventing further configuration.
D.The switch automatically deletes the VLAN after 5 minutes if no ports are assigned.
AnswerB

A VLAN with no member interfaces or IRB retains its configuration but stays inactive, so it never enters the active switching table. Junos activates a VLAN only once at least one access, trunk, or IRB interface is bound to it, satisfying the stem's forgotten-assignment constraint.

Why this answer

In Junos on EX Series switches, a VLAN that is configured but has no interfaces or IRB associated with it remains inactive in the switching table. The VLAN exists in the configuration but does not become operational until at least one interface or IRB is assigned to it.

Exam trap

JNCIS-ENT often tests the operational state of unassigned VLANs — candidates assume that a configured VLAN is immediately active or that it causes an error, but the correct behavior is that it remains inactive until an interface or IRB is associated with it.

How to eliminate wrong answers

Option A is wrong because EX switches do not automatically assign unused ports to a newly created VLAN — VLAN membership must be explicitly configured on each interface. Option C is wrong because an unassigned VLAN does not generate a critical alarm; it is a normal configuration state and does not prevent further configuration. Option D is wrong because Junos does not automatically delete VLANs after a timeout — VLANs persist in the configuration until explicitly removed by an administrator.

Practice this question →
7
MCQhard

An enterprise network uses private VLANs. A server connected to an isolated port needs to send traffic out of the primary VLAN. Which statement accurately describes how traffic forwarding operates for an isolated port in Junos?

A.Traffic from an isolated port can reach other isolated ports within the same secondary VLAN.
B.Isolated ports can communicate freely with community ports, but not other isolated ports.
C.Traffic from an isolated port can only be forwarded to the designated promiscuous port.
D.Traffic from an isolated port is dropped unless a Layer 3 firewall filter explicitly permits it.
AnswerC

Isolated ports have no Layer 2 connectivity to each other or to community ports; their only permitted destination is the promiscuous port, which forwards traffic out of the primary VLAN. This satisfies the isolation constraint while still allowing server traffic to reach the gateway.

Why this answer

In a private VLAN (PVLAN) configuration, an isolated port can only communicate with the promiscuous port. Traffic from an isolated port is forwarded to the promiscuous port, which then routes or bridges it to the primary VLAN. Isolated ports cannot communicate with each other or with community ports, ensuring strict Layer 2 isolation.

Exam trap

The trap here is confusing isolated ports with community ports; candidates often think isolated ports can talk to each other or to community ports, but they can only talk to the promiscuous port.

How to eliminate wrong answers

Option A is wrong because isolated ports cannot communicate with other isolated ports within the same secondary VLAN; that would defeat the purpose of isolation. Option B is wrong because isolated ports cannot communicate with community ports either; only promiscuous ports can communicate with all ports. Option D is wrong because traffic from an isolated port is not dropped by default; it is forwarded to the promiscuous port, and firewall filters are not required for basic PVLAN operation.

Practice this question →
8
MCQeasy

An administrator runs 'show vlans' and notices that a particular VLAN has the status 'Active' but no interfaces listed under it. What does this indicate?

A.The VLAN is defined in the configuration and has an active IRB interface or routing instance, but no physical switch ports assigned.
B.The VLAN has been disabled by Spanning Tree Protocol.
C.The switch memory is full and cannot display interface memberships.
D.The VLAN configuration has a syntax error.
AnswerA

A VLAN shows Active when it exists in configuration and is bound to an active Layer 3 interface, such as an IRB or routing instance, even without member ports. The absence of listed interfaces confirms no access or trunk ports are assigned, satisfying the stem's condition of an active VLAN with zero member ports.

Why this answer

An active VLAN without interfaces means the VLAN is defined in the database and associated with an IRB (Layer 3 interface) or routing instance, but no physical switch ports are members.

Practice this question →
9
MCQeasy

An operator executes the command 'show bridge mac-table' on an EX Series switch running Junos OS. Which information is displayed in the output of this command?

A.Learned MAC addresses, associated VLAN names/IDs, and corresponding interface names.
B.Physical transceiver optical power levels and interface error counters.
C.Spanning tree root bridge priorities and designated port roles.
D.The IP addresses corresponding to each dynamic MAC address via ARP resolution.
AnswerA

The bridge MAC table maps each learned layer-2 address to the VLAN it was learned in and the egress interface toward that host, which is exactly the forwarding information needed to trace unknown unicast flooding or stale entries on EX Series switches.

Why this answer

The show bridge mac-table command on EX Series switches displays the Layer 2 MAC address table, including learned MAC addresses, their associated VLANs, and the interfaces on which they were learned. This is the primary command for verifying MAC learning and forwarding behavior.

Exam trap

JNCIS-ENT often tests the distinction between show bridge mac-table (Layer 2 MAC-to-interface mapping) and show arp (Layer 3 IP-to-MAC mapping), causing candidates to select the ARP-related answer when asked about the MAC table.

How to eliminate wrong answers

Option B is wrong because transceiver optical power levels and error counters are displayed by commands like show interfaces diagnostics optics and show interfaces extensive, not the MAC table. Option C is wrong because spanning tree root bridge priorities and port roles are shown by show spanning-tree bridge and show spanning-tree interface. Option D is wrong because the MAC table does not include IP addresses; ARP resolution is displayed by show arp, and MAC-to-IP mapping requires correlating separate tables.

Practice this question →
10
Multi-Selecthard

An engineer is deploying Private VLANs on an EX Series switch and needs to verify proper operational status and traffic isolation. Which THREE tasks or verification checks should be performed? (Choose three.)

Select 3 answers
A.Verify that isolated ports can successfully send traffic to other isolated ports within the same secondary VLAN.
B.Run 'show vlans extensive' to inspect PVLAN port mappings and roles.
C.Verify that the primary VLAN is correctly associated with secondary isolated and community VLANs in the configuration.
D.Test connectivity to ensure isolated ports can only reach the designated promiscuous port.
E.Configure routing instances on all isolated ports to enable inter-isolated communication at Layer 2.
AnswersB, C, D

The 'show vlans extensive' command displays PVLAN port roles and mappings, confirming that promiscuous, isolated and community designations match the intended topology. This directly satisfies the stem's requirement to verify operational status and traffic isolation on the EX Series switch.

Why this answer

Option B is correct because on EX Series switches the 'show vlans extensive' command displays the PVLAN configuration details, including which ports are mapped as promiscuous, isolated, or community members, making it the right verification step for operational status. Option C is correct because a Private VLAN requires the primary VLAN to be explicitly associated with its secondary isolated and community VLANs; without this association, traffic cannot be properly mapped and isolation behavior fails. Option D is correct because the defining behavior of an isolated PVLAN port is that it can communicate only with the promiscuous port (and its uplink), so testing that isolated ports reach only the designated promiscuous port verifies correct traffic isolation.

Option A is incorrect because isolated ports must NOT be able to send traffic to other isolated ports within the same secondary VLAN — that would indicate a misconfiguration. Option E is incorrect because routing instances operate at Layer 3 and would not enable Layer 2 inter-isolated communication; PVLAN isolation is a Layer 2 construct and isolated ports are intentionally prevented from communicating with each other.

Exam trap

The trap is selecting verification steps that would actually break isolation (like enabling inter-isolated communication) — candidates must remember that PVLAN isolation is the goal, not connectivity between isolated ports.

Practice this question →
11
MCQeasy

An administrator needs to delete an entire VLAN configuration named 'guest' along with its VLAN ID and associated properties. Which configuration command should be executed?

A.clear vlans guest
B.delete vlans guest
C.destroy vlans guest
D.remove vlans guest
AnswerB

`delete vlans guest` removes the named VLAN and its associated properties in a single operation, satisfying the requirement to delete the entire VLAN configuration rather than merely clearing member interfaces. Junos matches the VLAN by name, so the VLAN ID and all bound properties are discarded together.

Why this answer

The correct command to delete an entire VLAN configuration, including its VLAN ID and associated properties, is 'delete vlans guest'. In Junos, the 'delete' command removes the specified configuration hierarchy or identifier from the candidate configuration. When applied to 'vlans guest', it removes the entire VLAN definition named 'guest' from the configuration.

This is the standard way to remove a VLAN in Junos.

Exam trap

JNCIS-ENT often tests the distinction between operational commands (like 'clear') and configuration commands (like 'delete'), as well as the correct syntax for removing configuration objects in Junos.

How to eliminate wrong answers

Option A is wrong because 'clear vlans guest' is not a valid Junos configuration command; 'clear' is used for operational commands to clear statistics or sessions, not for deleting configuration. Option C is wrong because 'destroy vlans guest' is not a Junos command; 'destroy' is not used in Junos configuration mode for deleting VLANs. Option D is wrong because 'remove vlans guest' is not a valid Junos command; 'remove' is used in Junos for removing a statement from a configuration group or applying a 'remove' action in a load merge operation, but not for deleting a VLAN from the configuration.

Practice this question →
12
Multi-Selectmedium

Which THREE parameters are typically verified when troubleshooting a missing MAC address entry in the bridge table of a Juniper switch? (Choose three.)

Select 3 answers
A.BGP AS path settings on core interfaces
B.Configured maximum MAC address limits or port-security restrictions
C.VLAN membership configuration on the ingress port
D.Routing protocol adjacencies in the default VRF
E.Physical interface link and operational status
AnswersB, C, E

Configured MAC limits and port-security restrictions directly govern whether learned addresses persist in the bridge table. When a port exceeds its maximum-MAC or secure-MAC threshold, the switch stops learning or drops frames, so the entry never appears. Verifying these settings satisfies the stem's missing-entry constraint before investigating other causes.

Why this answer

Option B is correct because a MAC address will not be learned or retained in the bridge table if the port has hit its configured MAC limit (e.g., 'mac-limit') or if port security (e.g., 'mac-move-limit' or allowed-MAC restrictions) is blocking or dropping the source MAC. Option C is correct because the ingress port must be a member of the same VLAN as the traffic; if the port is not in the correct VLAN (or is in a different VLAN), the frame is not learned into that VLAN's bridge table entry. Option E is correct because a bridge table entry requires the physical interface to be up and operational; if the link is down or the interface is disabled, no MAC addresses can be learned on that port.

Option A is incorrect because BGP AS path settings are Layer 3 routing attributes and have no bearing on Layer 2 MAC learning in the bridge table. Option D is incorrect because routing protocol adjacencies in the default VRF relate to Layer 3 reachability, not to populating the Layer 2 bridge table.

Exam trap

The trap is including irrelevant Layer 3 options (BGP, routing adjacencies) to distract candidates. The question specifically asks about MAC address entries, which are Layer 2, so options involving routing protocols are incorrect.

Practice this question →
13
Multi-Selectmedium

You are troubleshooting a Layer 2 connectivity problem where a trunk port is dropping tagged traffic for VLAN 50. Which TWO configuration checks should be performed? (Choose two.)

Select 2 answers
A.Verify that the physical interface has an IPv4 address assigned in family inet.
B.Verify that VLAN 50 is included in the trunk port's member list (or not excluded via 'except').
C.Verify that spanning-tree bridge priority is set to 0.
D.Verify that the port mode is set to access.
E.Verify that VLAN 50 is created under the [edit vlans] hierarchy with a valid vlan-id.
AnswersB, E

A trunk drops tagged frames for VLAN 50 if that VLAN is absent from the allowed member list or removed by an 'except' clause. Verifying membership confirms the trunk permits the tag, satisfying the stem's Layer 2 connectivity constraint before investigating native VLAN or other causes.

Why this answer

Option B is correct because on a trunk port, tagged traffic for a VLAN is only forwarded if that VLAN is explicitly listed as a member (e.g., under 'vlan members' or 'vlan members all' with 'except' not excluding it); if VLAN 50 is missing from the member list or excluded via 'except', its tagged frames are dropped. Option E is correct because the VLAN must first exist under the [edit vlans] hierarchy with a valid vlan-id (and typically a matching 802.1Q tag) before it can be assigned to a trunk interface; a missing or misconfigured vlan-id means the switch cannot map the tagged frames to VLAN 50. Option A is incorrect because a Layer 2 trunk interface does not require an IPv4 address in family inet to forward tagged traffic, and adding one is irrelevant to VLAN 50 connectivity.

Option C is incorrect because spanning-tree bridge priority affects root bridge election, not whether tagged VLAN 50 traffic is accepted on a trunk. Option D is incorrect because setting the port to access mode would strip tags and place the port in a single VLAN, which is the opposite of what a trunk carrying VLAN 50 requires.

Exam trap

JNCIS-ENT often tests whether candidates conflate Layer 3 requirements (IP address) with Layer 2 trunk operation, or forget that a VLAN must be both defined and included in the trunk member list — checking only one of the two conditions leads to a wrong answer.

Practice this question →
14
Multi-Selecteasy

An administrator is configuring VLANs on a Junos EX Series switch. Which TWO tasks must be performed to successfully assign a physical interface as an access port for a newly created VLAN? (Choose two.)

Select 2 answers
A.Enable spanning-tree protocol globally for the access VLAN to become active.
B.Configure the interface family as inet and assign an IP address.
C.Configure the interface as a trunk port with native-vlan-id enabled.
D.Configure the interface mode as access under [edit interfaces <name> unit 0 family ethernet-switching].
E.Create the VLAN under the [edit vlans] hierarchy specifying a vlan-id.
AnswersD, E

Setting the interface mode to access under family ethernet-switching binds the port to a single VLAN untagged, satisfying the requirement to assign a physical interface as an access port. Without this, the port defaults to trunk mode and cannot carry the newly created VLAN's traffic correctly.

Why this answer

Option E is correct because a VLAN must first exist in the configuration before an interface can be assigned to it; on Junos EX switches you create it under [edit vlans] with a name and a vlan-id (e.g., set vlans SALES vlan-id 100). Option D is correct because the physical port is made an access port by setting the interface mode to access under [edit interfaces <name> unit 0 family ethernet-switching], which places untagged traffic from that port into the specified VLAN. Spanning tree (option A) is not required to make a VLAN active, and it is enabled by default on EX switches anyway.

Option B is wrong because an access port carries Layer 2 traffic in family ethernet-switching; assigning family inet and an IP address is for a routed/Layer 3 interface, not a switched access port. Option C is wrong because trunk mode with native-vlan-id is used for carrying multiple VLANs (802.1Q tagging), not for assigning a single access VLAN to a physical interface.

Practice this question →
15
MCQeasy

An administrator is configuring a new EX Series switch running Junos OS and needs to assign an access port to VLAN finance. Which configuration hierarchy is used to assign an interface to a specific VLAN?

A.[edit vlans finance]
B.[edit interfaces <interface-name> unit 0 family ethernet-switching]
C.[edit bridge-domains finance]
D.[edit protocols l2-learning]
AnswerB

Access VLAN membership is assigned under the interface's unit 0 family ethernet-switching hierarchy, where the vlan member statement names the target VLAN. This is the Junos hierarchy that binds a switched port to VLAN finance, satisfying the access port requirement.

Why this answer

In Junos OS, access and trunk interface properties for Layer 2 switching are configured under the [edit interfaces <interface-name> unit 0 family ethernet-switching] hierarchy.

Practice this question →
16
MCQmedium

You are troubleshooting a connectivity issue between an EX4300 switch access port and an end-host. The port is configured as an access port for VLAN 100, but the host cannot communicate. You run 'show ethernet-switching interface ge-0/0/1' and notice the port status is down/down. Which underlying reason most likely explains this state?

A.The native VLAN ID does not match the upstream trunk switch.
B.BPDU protection has disabled the port due to a loop.
C.The VLAN 100 has not been created under the [edit vlans] hierarchy.
D.The physical cable is disconnected or the transceiver is faulty.
AnswerD

down/down means the physical link is not established: the switch sees no signal from the host. The usual causes are a disconnected or damaged cable, a faulty or incompatible SFP transceiver, or a host network interface that is disabled or broken. Check the port and host LEDs, try a known-good cable or optic, and use 'show interfaces ge-0/0/1 extensive' or the optics diagnostics command to inspect link details.

Why this answer

A port status of down/down in Junos means the physical layer is not operational — the link itself has no signal. This is distinct from a logical or configuration problem, which would typically show up/down or down/up. A disconnected cable, faulty transceiver, or bad port are the classic causes of down/down.

VLAN or BPDU issues would not produce a down/down state because they operate above the physical layer.

Exam trap

The trap here is conflating logical misconfiguration (VLAN not created, native VLAN mismatch) with a physical-layer failure — candidates often assume a config error causes down/down, but down/down is almost always a Layer 1 problem.

How to eliminate wrong answers

Option A is wrong because a native VLAN mismatch on a trunk would cause VLAN hopping or traffic leakage, not a down/down physical state — the link would still be up. Option B is wrong because BPDU protection (bpdu-block-on-edge) places the port in a blocking or disabled state but the interface itself remains physically up, showing up/down or err-disabled, not down/down. Option C is wrong because a missing VLAN under [edit vlans] causes the port to be unable to forward traffic in that VLAN, but the physical link stays up — the symptom would be up/down or traffic not passing, not down/down.

Practice this question →
17
Multi-Selectmedium

An engineer is configuring a trunk port on an EX Series switch and needs to ensure that untagged and priority-tagged frames are handled correctly. Which TWO configuration actions are required? (Choose two.)

Select 2 answers
A.Set the interface mode to trunk under the ethernet-switching family hierarchy.
B.Enable Layer 3 routing directly on the physical trunk interface unit 0.
C.Configure the interface encapsulation as CCC or VPLS.
D.Disable MAC learning on the trunk interface to prevent native VLAN loops.
E.Configure the native-vlan-id statement to specify which VLAN receives untagged frames.
AnswersA, E

Setting the interface mode to trunk under the ethernet-switching family enables 802.1Q encapsulation, which is what allows the port to carry multiple VLANs and correctly process untagged and priority-tagged frames. Without this mode, the interface defaults to access behaviour and cannot satisfy the trunking requirement.

Why this answer

Option A is correct because on EX Series switches the port must be placed into trunk mode under the ethernet-switching family hierarchy (set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk) so that it can carry multiple VLANs and process tagged frames. Option E is correct because the native-vlan-id statement defines which VLAN handles untagged and priority-tagged frames arriving on the trunk, ensuring those frames are mapped to the intended VLAN. Option B is incorrect because a Layer 2 trunk port does not require Layer 3 routing on unit 0; routing would be configured on an IRB (VLAN) interface instead.

Option C is incorrect because CCC and VPLS encapsulations are used for circuit cross-connect and VPLS Layer 2 VPN services, not for standard 802.1Q trunking. Option D is incorrect because disabling MAC learning is not required or recommended for a trunk port and would not prevent native VLAN loops.

Exam trap

JNCIS-ENT often tests trunk port configuration, and candidates may forget that the native VLAN must be explicitly configured to handle untagged frames, or they may confuse trunk mode with access mode.

Practice this question →
18
MCQhard

An EX4300 switch is configured with a trunk port that carries VLAN 10 and VLAN 20. The trunk is connected to a third-party switch that uses a native VLAN of 1 for untagged traffic. You notice that untagged frames from the third-party switch are being dropped on the EX4300. Which configuration change resolves this issue?

A.Configure 'vlan members 1' on the EX4300 trunk port in addition to VLAN 10 and VLAN 20.
B.Configure 'native-vlan-id 1' on the EX4300 trunk port and ensure VLAN 1 is created.
C.Configure 'native-vlan-id 10' on the EX4300 trunk port to match the first VLAN in the trunk.
D.Configure 'interface-mode access' on the EX4300 trunk port and assign it to VLAN 1.
AnswerB

The third-party switch sends untagged frames on its native VLAN 1. The EX4300 trunk port must be configured with 'native-vlan-id 1' so that untagged frames are classified into VLAN 1. Without this, untagged frames are dropped because the trunk port expects tagged frames for VLAN 10 and 20. Creating VLAN 1 on the EX4300 is also necessary for the frames to be bridged, making this the correct fix.

Why this answer

Untagged frames on a trunk are assigned to the native VLAN. The third-party switch uses native VLAN 1, so the EX4300 trunk must be configured with 'native-vlan-id 1' and VLAN 1 must exist. This allows the EX4300 to classify untagged frames into VLAN 1 instead of dropping them.

Matching native VLAN IDs on both ends is essential for untagged traffic to traverse the trunk.

Exam trap

The trap here is adding the native VLAN as a tagged member instead of configuring 'native-vlan-id', which is what actually classifies untagged frames.

Practice this question →
19
MCQeasy

An administrator needs to create a VLAN named 'voice' with a VLAN ID of 50 on a Junos EX Series switch. Which configuration path achieves this?

A.set vlans voice vlan-id 50
B.set ethernet-switching-options vlans voice id 50
C.set bridge-domains voice vlan-id 50
D.set interfaces vlan unit 50 name voice
AnswerA

Junos stores VLAN membership under the [vlans] hierarchy, where the VLAN name is the identifier and vlan-id assigns the 802.1Q tag. Setting 'voice' with vlan-id 50 creates the required VLAN and binds it to tag 50, satisfying the named-VLAN-with-ID-50 constraint.

Why this answer

On Junos EX Series switches, VLANs are configured under the [edit vlans] hierarchy with the syntax 'set vlans <name> vlan-id <id>'. This creates a VLAN named 'voice' with VLAN ID 50, which can then be associated with access or trunk interfaces.

Exam trap

JNCIS-ENT often tests the exact Junos hierarchy for VLAN creation, and candidates confuse it with bridge-domains (MX), ethernet-switching-options (non-ELS legacy), or interface-level VLAN configuration.

How to eliminate wrong answers

Option B is wrong because 'ethernet-switching-options vlans' is not a valid configuration path for creating VLANs — ethernet-switching-options handles storm control, port security, and similar features, not VLAN definitions. Option C is wrong because 'bridge-domains' is used for Layer 2 bridging on MX series routers, not for EX Series switch VLANs. Option D is wrong because 'interfaces vlan unit 50 name voice' is not valid syntax — VLAN interfaces are configured as 'set interfaces vlan unit 50 family inet address ...' and the VLAN itself must be defined under [edit vlans].

Practice this question →
20
Multi-Selecthard

An administrator is configuring Selective QinQ on an EX Series switch using VLAN translation. Which THREE components are required to successfully rewrite inner and outer VLAN tags? (Choose three.)

Select 3 answers
A.Disabling all Layer 2 learning on the translation interface.
B.Enabling OSPFv3 routing directly on the customer edge interface unit 0.
C.Ensuring upstream transit ports are configured as trunks carrying the outer service VLAN.
D.Configuring input-vlan-map and output-vlan-map rules to push/pop or swap tags.
E.Enabling flexible-vlan-tagging on the edge interface.
AnswersC, D, E

Selective QinQ pushes an outer service VLAN tag, so every upstream transit port must be a trunk permitting that outer VLAN or the tagged frames are dropped. This satisfies the question's requirement that transit ports carry the outer service VLAN.

Why this answer

Selective QinQ with VLAN translation on EX Series requires the edge interface to be placed in flexible-vlan-tagging mode (E), which allows the interface to transmit and receive frames with two VLAN tags (inner customer tag plus outer service tag) rather than the default single-tag behavior. The actual tag rewrite is performed by the input-vlan-map and output-vlan-map statements (D), which define the push, pop, or swap operations that add or remove the outer service VLAN tag on ingress and egress. For the rewritten frames to reach their destination, the upstream transit ports must be configured as trunks that carry the outer service VLAN (C), so the QinQ-encapsulated traffic is forwarded across the provider network.

Option A is incorrect because disabling all Layer 2 learning is not a requirement for VLAN translation and would break normal bridging behavior. Option B is incorrect because OSPFv3 is an IPv6 routing protocol and has nothing to do with Layer 2 QinQ tag rewriting on a customer edge interface.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Layer 2 Switching And VLANs questions.

Start 20-question session