JNCIS-ENT Practice Questions

Question 1

Which of the following are valid IS-IS PDU types? (Choose THREE)

Accepted Answer

IIH PDU. IS-IS defines three core PDU categories, and options A, B, and C map directly onto them. A: IIH (Intermediate System-to-Intermediate System Hello) PDUs are the valid IS-IS hello packets used to discover and maintain adjacencies on broadcast and point-to-point links, with LAN and P2P variants. B: LSP (Link State PDU) is the valid IS-IS packet that carries link-state information and is flooded to build the link-state database, analogous to an OSPF LSA. C: CSNP (Complete Sequence Number PDU) is a valid IS-IS PDU used to describe the complete set of LSPs in a database, sent by the DIS on broadcast networks and used for database synchronization. Options D and E are not IS-IS PDU types: IS-IS hellos are not acknowledged with a separate 'Hello ACK PDU' (acknowledgment is implicit via receipt of a subsequent IIH), and there is no 'Routing Update PDU' in IS-IS—routing information is distributed through LSPs, CSNPs, and PSNPs.

Answer

Hello ACK PDU

Answer

Routing Update PDU

Question 2

An administrator implements filter-based forwarding and applies a firewall filter on the ingress interface. However, traffic matching the filter is dropped rather than routed to the alternate routing instance. Upon investigation, what is the most likely cause of this issue?

Accepted Answer

The destination IP address does not have a matching route in the alternate routing instance's table.. Filter-based forwarding (FBF) works by matching traffic with a firewall filter and then using a 'routing-instance' action to steer it into an alternate routing table. If the alternate routing instance has no route for the destination IP, the packet cannot be forwarded and is dropped, which matches the symptom described.

Answer

The ingress interface is configured as a trunk port.

Answer

The firewall filter term lacks a 'count' action statement.

Answer

The routing instance type is set to virtual-router instead of forwarding.

Question 3

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Accepted Answer

Connectivity Association Key (CAK). To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct. Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Answer

Maximum Transmission Unit (MTU) size set to exactly 1500 bytes

Answer

IP address subnet allocation on the physical transit ports

Question 4

A network engineer wants to verify IS-IS link-state database entries, specifically checking for TLVs that carry extended IP reachability information with wide metrics. Which Junos operational command should be used?

Accepted Answer

show isis database detail. To view the IS-IS link-state database with detailed TLV and metric information on Junos devices, the command 'show isis database detail' is used.

Answer

show isis adjacency extensive

Answer

show ospf database

Answer

show route protocols isis

Question 5

A Junos router is configured as a BGP route reflector. It learns a route from a client and reflects it to a non-client and another client. Which attribute does the route reflector modify or add to prevent routing loops?

Accepted Answer

ORIGINATOR_ID and CLUSTER_LIST. When a route reflector reflects a route, it adds the ORIGINATOR_ID (the router ID of the route's originator) and CLUSTER_LIST (a list of cluster IDs the route has traversed) to prevent routing loops. If a route reflector receives a route with its own router ID in ORIGINATOR_ID or its cluster ID in CLUSTER_LIST, it discards the route.

Answer

MED and NEXT_HOP

Answer

AS_PATH and LOCAL_PREF

Answer

COMMUNITY and ATOMIC_AGGREGATE

Question 6

You are troubleshooting a connectivity issue between an EX4300 switch access port and an end-host. The port is configured as an access port for VLAN 100, but the host cannot communicate. You run 'show ethernet-switching interface ge-0/0/1' and notice the port status is down/down. Which underlying reason most likely explains this state?

Accepted Answer

The physical cable is disconnected or the transceiver is faulty.. A port status of down/down in Junos means the physical layer is not operational — the link itself has no signal. This is distinct from a logical or configuration problem, which would typically show up/down or down/up. A disconnected cable, faulty transceiver, or bad port are the classic causes of down/down. VLAN or BPDU issues would not produce a down/down state because they operate above the physical layer.

Answer

The native VLAN ID does not match the upstream trunk switch.

Answer

BPDU protection has disabled the port due to a loop.

Answer

The VLAN 100 has not been created under the [edit vlans] hierarchy.

Question 7

Which TWO actions occur when a Junos BGP routing policy includes the 'next policy' action? (Choose two)

Accepted Answer

Evaluation of the current policy terminates immediately.. Option A is correct because the 'next policy' action terminates evaluation of the current policy immediately, so no further terms within that policy are processed. Option B is correct because, after stopping the current policy, Junos proceeds to evaluate the next independent policy in the chain (the next policy referenced in the import/export chain), allowing subsequent policies to make the final accept/reject decision. Option C is incorrect because 'next policy' does not itself accept or install a route; acceptance requires an explicit 'accept' action or a default policy decision. Option D is incorrect because 'next policy' does not reject or drop the route; rejection is performed by a 'reject' action. Option E is incorrect because jumping to the next term within the same policy block is not what 'next policy' does; that would be the behavior of 'next term'.

Answer

The route is immediately accepted and installed in the routing table.

Answer

The route is rejected and dropped.

Answer

Evaluation jumps to the next term within the same policy block.

Question 8

What is the purpose of the 'lsp-lifetime' command?

Accepted Answer

To set the duration for which an LSP is valid.. The 'lsp-lifetime' command sets the duration after which an LSP is considered invalid if not refreshed.

Answer

To define how often the DIS sends Hellos.

Answer

To limit the number of LSPs in the database.

Answer

To set how long the adjacency stays up.

Question 9

What is the effect of changing the reference bandwidth in IS-IS?

Accepted Answer

It has no effect on IS-IS.. Changing the reference bandwidth in IS-IS has no effect because IS-IS does not use a reference bandwidth to calculate metrics. Unlike OSPF, where the reference bandwidth is used to compute interface cost, IS-IS uses narrow metrics (default) or wide metrics, and the metric values are configured manually or derived from interface types. The reference bandwidth concept is specific to OSPF.

Answer

It automatically recalculates all interface metrics.

Answer

It increases the hello interval.

Answer

It forces all links to use narrow metrics.

Question 10

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

Accepted Answer

Packets from violating MAC addresses are dropped, and a syslog message/counter is generated while valid traffic continues.. The 'restrict' action causes the switch to drop packets from unauthorized source MAC addresses and increment violation counters, but the port remains up and forwarding for valid MACs.

Answer

The interface immediately shuts down and generates an SNMP trap.

Answer

The violating MAC address is automatically added to a static ARP inspection deny list.

Answer

The switch drops all traffic on the interface until the violation timer expires.

Question 11

Which TWO options represent valid benefits of configuring Link Aggregation Groups (LAG)? (Choose two)

Accepted Answer

Increased aggregate bandwidth between connected networking devices.. Option A is correct because a Link Aggregation Group bundles multiple physical interfaces into a single logical link, so the combined throughput of the member links provides increased aggregate bandwidth between the connected devices. Option D is correct because LAG monitors member link health and, if one physical member link fails, traffic is automatically redistributed across the remaining active links, providing redundancy and failover without losing the logical interface. Option B is incorrect because BGP peer state synchronization is handled by BGP itself (e.g., via TCP sessions and route reflectors), not by LAG. Option C is incorrect because Junos OS upgrades are performed through software management procedures, not through link aggregation. Option E is incorrect because LAG does not eliminate the need for Spanning Tree Protocol in all cases; STP may still be required to prevent loops in topologies with redundant paths outside the LAG.

Answer

Synchronization of BGP routing daemon state between separate routers.

Answer

Automatic upgrade of Junos OS across peer devices.

Answer

Elimination of the need for Spanning Tree Protocol across all VLANs.

Question 12

A network administrator needs to modify the Local Preference path attribute for all routes received from a specific external BGP peer using a routing policy on Junos. Under which configuration hierarchy should the routing policy be applied?

Accepted Answer

protocols bgp group neighbor import. To modify Local Preference for routes received from a specific eBGP peer, the routing policy must be applied as an import policy on that neighbor or group under 'protocols bgp group neighbor import '. Import policies are evaluated on inbound updates, which is where Local Preference is typically set for eBGP-learned routes.

Answer

policy-options policy-statement term then export

Answer

routing-options rib inet.0 static

Answer

protocols ospf area

Question 13

You want to ensure that a static route is only installed in the routing table when a specific tracked object or ping test succeeds. Which Junos feature should you pair with the static route?

Accepted Answer

RPM (Real-time Performance Monitoring) with static route tracking. RPM (Real-time Performance Monitoring) in Junos allows you to configure probes that periodically test reachability of a target (e.g., via ICMP ping) and track the results. When you associate a static route with an RPM probe using the `track` option, the route is only installed in the routing table if the probe succeeds. This provides conditional route installation based on real-time performance monitoring, ensuring the static route is active only when the tracked object is reachable.

Answer

OSPF sham-links

Answer

Keepalive timers on static routes

Answer

BFD synchronized static routes

Question 14

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

Accepted Answer

To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.. A Junos tunnel interface provides a virtual point-to-point Layer 3 link that can carry routing protocol adjacencies across a transport network that may not support multicast or is disjointed. This allows routing protocols like OSPF or BGP to form neighbors over the tunnel, treating it as a direct connection.

Answer

To act as a physical layer 2 bridge for VLAN extension without IP addresses.

Answer

To encrypt all transit traffic by default using hardware-based AES-256.

Answer

To replace physical interfaces for standard local area network connections.

Question 15

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

Accepted Answer

Source MAC address. Layer 2 firewall filters in Junos can match fields such as source MAC address, destination MAC address, VLAN ID, and EtherType.

Answer

Destination IP address

Answer

ICMP type code

Answer

TCP port number

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) JNCIS-ENT practice test

Three ways to study

Study JNCIS-ENT by domain

Study JNCIS-ENT by topic

IS IS practice questions

BGP practice questions

Spanning Tree practice questions

OSPF practice questions

High Availability practice questions

Protocol Independent Routing practice questions

Tunnels practice questions

Layer 2 Switching And VLANs practice questions

Layer 2 Security practice questions

JNCIS-ENT fundamentals practice questions

JNCIS-ENT scenario practice questions

JNCIS-ENT troubleshooting practice questions

Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) practice questions