How should I use these Layer 2 Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Layer 2 Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Layer 2 Security domain.

JNCIS-ENT · topic practice

Layer 2 Security practice questions

Practise Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) Layer 2 Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Layer 2 Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Layer 2 Security

Layer 2 Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Layer 2 Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Layer 2 Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Layer 2 Security explanation →

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

Trap 1: set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2

MAC limits are defined under switch-options or ethernet-switching-options, not directly under family ethernet-switching unit 0.

Trap 2: set ethernet-switching-options secure-access-port interface…

This syntax does not match the valid Junos secure-access-port options.

Trap 3: set protocols l2-security interface ge-0/0/1 mac-limit 2

There is no l2-security protocols hierarchy in Junos OS for interface-level mac-limits.

Study all Layer 2 Security common traps →

A
set switch-options interface ge-0/0/1.0 mac-limit limit 2
This statement correctly sets the MAC limit to two on the specified interface under switch-options.
B
set interfaces ge-0/0/1 unit 0 family ethernet-switching mac-limit 2
Why wrong: MAC limits are defined under switch-options or ethernet-switching-options, not directly under family ethernet-switching unit 0.
C
set ethernet-switching-options secure-access-port interface ge-0/0/1 maximum-mac-count 2
Why wrong: This syntax does not match the valid Junos secure-access-port options.
D
set protocols l2-security interface ge-0/0/1 mac-limit 2
Why wrong: There is no l2-security protocols hierarchy in Junos OS for interface-level mac-limits.

Layer 2 Security practice questions

What to know about Layer 2 Security

Common Layer 2 Security exam traps

Layer 2 Security questions

An administrator needs to configure port security on an access switch running Junos OS to limit the number of learned MAC addresses on interface ge-0/0/1 to a maximum of two. Which configuration statement accomplishes this?

You are configuring a Layer 2 firewall filter to count packets originating from an unauthorized server MAC address '00:11:22:33:44:55'. Which filter term structure correctly matches this MAC address?

Which TWO traffic types are monitored and controlled by default when storm control is applied to an interface on an EX Series switch? (Choose two)

Which TWO methods can be used to recover an EX Series switch interface that has been shut down due to a port security violation? (Choose two)

Which TWO parameters can be configured when setting up storm control on an EX Series switch? (Choose two)

An engineer configures storm control on an EX Series switch to protect against broadcast floods. The configuration uses a bandwidth-percentage rate limit of 20%. Which traffic types are targeted by default when storm control is applied to an interface?

Which command allows an administrator to verify storm control statistics and drop counts on an EX Series switch interface?

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

An administrator configures MACsec with pre-shared keys (PSK) between two EX Series switches. After applying the configuration, the secure channel fails to establish. Which operational command should be used to troubleshoot the MKA session state and connectivity?

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

Which Junos configuration command enables Dynamic ARP Inspection (DAI) for a specific VLAN named 'VLAN10'?

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

You want to configure IP Source Guard on interface ge-0/0/5 to verify both IP and MAC addresses against the binding table. Which configuration statement is required?

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

Track your progress over time

Start a Layer 2 Security only practice session

Related JNCIS-ENT topic practice pages

Spanning Tree practice questions

OSPF practice questions

High Availability practice questions

IS IS practice questions

Protocol Independent Routing practice questions

Tunnels practice questions

Layer 2 Switching And VLANs practice questions

Layer 2 Security practice questions

BGP practice questions

JNCIS-ENT fundamentals practice questions

JNCIS-ENT scenario practice questions

JNCIS-ENT troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid