Juniper JN0-352 Enterprise Routing and Switching, Specialist (JNCIS-ENT) Exam Practice Test

Junos firewall filters evaluate terms sequentially from top to bottom, and a term is only terminal for a packet if its then clause contains an explicit terminating action such as accept, discard, reject, or next term without a match. The count and log actions used in track-icmp are non-terminating; they update statistics and generate a log entry but do not stop evaluation, so a matching ICMP packet falls through to the next term after being counted. The second term, allow-tcp-established, matches only TCP packets carrying the ACK or RST flags as defined by the tcp-established keyword; an ICMP echo request does not satisfy protocol tcp, so this term is skipped entirely and does not accept the packet. Evaluation therefore reaches the implicit catch-all term block-rest, which has no from conditions and matches every remaining packet, incrementing blocked-counter and discarding it. The net effect for the described ICMP ping is that icmp-counter is incremented by the first term, the packet is neither accepted nor rejected by the second term, and blocked-counter is incremented immediately before the packet is silently discarded by the final term. This layered-term behavior, where counting is independent of the accept/discard decision, is a frequently tested nuance of Junos firewall filter processing logic. Reference topics: Junos Enterprise Switching – Layer 2 Security and Firewall Filters, Filter Term Evaluation Order.

The Junos BGP path selection algorithm proceeds through a strict, ordered sequence of comparison steps, and once next-hop reachability and route preference (administrative distance) have been confirmed as equal, local preference is the very first BGP-specific path attribute evaluated in the decision process. A route carrying a higher local preference value is always chosen over a competing route to the same prefix with a lower local preference, and this comparison takes absolute precedence over every subsequent attribute in the algorithm; if local preference values differ between candidate paths, the selection process concludes at this step without ever needing to examine AS path length, origin type, or MED at all. Only when two or more competing paths share an identical local preference value does the algorithm proceed to its third step, comparing AS path length and preferring the shortest, and only after a further tie does it move on to origin type (preferring IGP-origin over EGP-origin, and EGP-origin over incomplete), followed by MED comparison (preferring the lowest value, and only among routes learned from the same neighboring AS by default). Because local preference is evaluated strictly before all three of the other listed attributes, it is the attribute BGP consults first among the choices given, making it the deciding factor in scenarios such as this exhibit where multiple autonomous systems advertise competing paths toward the same 192.168.1.0/24 prefix. Reference topics: Junos Enterprise Routing – BGP, Understanding BGP Path Selection Order.

On EX Series switches, aggregated Ethernet (ae) interfaces do not exist by default; before any ae interface can be created, referenced, or brought into service, an administrator must first reserve the desired number of aggregated Ethernet device slots by configuring set chassis aggregated-devices ethernet device-count number at the [edit chassis] hierarchy. This statement allocates the internal resources needed for that many ae interfaces to exist as valid, configurable objects; until it is committed, any interface-level configuration referencing ae0 (such as the aggregated-ether-options and family ethernet-switching stanzas shown in the exhibit) is accepted syntactically by the CLI but never actually instantiates a live ae0 device, which is exactly why show interfaces ae0.0 returns 'device ae0 not found' despite the interface appearing fully configured. Increasing the device-count to at least 1 (or higher, to cover the number of LAG bundles planned) immediately resolves this and allows ae0 to appear as an operational interface once its member links are also associated with it. This is a foundational and frequently overlooked prerequisite step in LAG deployment on Juniper switches. There is no separate licensing requirement for aggregated Ethernet functionality on EX Series switches, a reboot is not needed since the chassis statement takes effect upon commit, and the LACP mode (active versus passive) is unrelated to whether the ae interface object itself exists in the first place. Reference topics: Junos Enterprise Switching – Link Aggregation, Configuring the Aggregated Ethernet Device Count.

The BGP finite state machine defined in RFC 4271 progresses through Idle, Connect, Active, OpenSent, OpenConfirm, and finally Established. The Active state is entered either directly after Idle, when the local router begins retrying a TCP connection setup toward the configured peer, or after a previous Connect attempt has failed and the ConnectRetry timer has expired, prompting the router to keep trying to complete the underlying TCP three-way handshake. Seeing a peer parked in Active therefore means the local device has a fully valid neighbor configuration and is persistently attempting to reach the remote address on TCP port 179, but the handshake is not succeeding — common root causes include a firewall or ACL blocking TCP 179 between the two endpoints, an unreachable or incorrect peer IP address, the remote BGP process not running or not listening, or an asymmetric routing path preventing the SYN/ACK from returning. It does not indicate a misconfiguration on the local box in the sense of a missing statement (that would typically leave the session as Idle), nor does it indicate an established, functioning session exchanging UPDATE messages (that state is Established), and it is not a deliberately idle/disabled condition, which Junos reports plainly as Idle. Recognizing Active as 'trying to connect' rather than 'connected' is essential for correct BGP troubleshooting sequencing. Reference topics: Junos Enterprise Routing – BGP Fundamentals, BGP Finite State Machine and Session Verification.

IEEE 802.3ad LACP defines two distinct negotiation modes, active and passive, and the standard's fundamental requirement for successful negotiation is that at least one end of the point-to-point link must be configured in active mode; an actively configured device initiates LACPDU transmission on its own, while a passively configured device waits and only responds once it receives an LACPDU from its peer. If both ends of the bundle were left in passive mode simultaneously, neither side would ever initiate the exchange, and no negotiation — and therefore no functioning aggregated bundle — would ever occur; at least one active participant is therefore mandatory, though having both sides active (active-active) is also fully valid and is in fact the most common production deployment. Junos does not enable LACP automatically on aggregated Ethernet interfaces; unlike some competing platforms, LACP must be explicitly configured under the aggregated-ether-options lacp hierarchy, and specifying no LACP configuration at all results in a 'static' LAG that relies purely on physical link-state rather than any protocol negotiation — there is no implicit default active mode. There is likewise no requirement to configure differing LACP system priority values between the two peer switches; system priority is used only to determine which side of the link controls port selection during negotiation and has no bearing on whether the bundle can form. Both sides being mandatorily active is a stricter requirement than the actual standard specifies. Reference topics: Junos Enterprise Switching – Link Aggregation, LACP Active and Passive Mode Negotiation.

A link aggregation group bundles multiple physical Ethernet links into a single logical interface (an ae interface) specifically to provide both increased aggregate bandwidth and link-level redundancy. By default, the aeX interface remains operationally up as long as at least one member link within the bundle remains active and passing traffic; the LAG does not require every member link to be functional to continue operating. When one of the four 1-GbE member links in this scenario fails, LACP (if in use) or the underlying link-status monitoring detects the failure, removes that specific link from the active forwarding set, and redistributes traffic hashing across the three remaining healthy member links automatically and without operator intervention. End devices and upper-layer protocols continue to see a single, continuously up ae interface throughout this process, experiencing only a proportional reduction in available aggregate bandwidth rather than any interruption in connectivity. This default behavior is precisely why LAG is a foundational building block for resilient EX Series switch interconnects in enterprise and data center designs, since it allows individual optic, cable, or transceiver failures to be absorbed transparently. None of the distractor behaviors — full administrative shutdown of the bundle, forwarding limited to broadcast traffic only, or a temporary disabling of all member links during renegotiation — reflect actual Junos LAG behavior, which is designed explicitly to avoid any such disruption. Reference topics: Junos Enterprise Switching – Layer 2 Switching, Link Aggregation Group Resiliency.

Layer 2 MAC learning on an EX Series switch, as on any standard Ethernet bridge, is a passive, frame-driven process rather than an active polling or query-based mechanism. Every time a frame arrives on any interface, the switch inspects the frame's source MAC address field and, if that address is not already present in the Ethernet switching (bridge) table for the associated VLAN, creates a new dynamic entry recording the source MAC address, the VLAN it was learned on, and the specific ingress interface through which the frame arrived. Junos also stamps each learned entry with an aging timestamp, which is refreshed every time a subsequent frame from that same source MAC is received; entries that receive no refreshing traffic within the configured MAC aging interval (300 seconds by default) are eventually purged from the table to keep it current and to reclaim table space from hosts that have moved or gone offline. This source-address-driven, per-frame learning process happens continuously and automatically with no dependency on spanning-tree state changes — although a topology change notification can trigger accelerated aging of the table to flush potentially stale entries faster, learning itself is not gated by or contingent upon such an event occurring. The switch never learns addresses from the destination field of a frame, since the destination address, if already known, is used purely for the forwarding lookup decision, not for populating new table entries. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Source MAC Learning and Table Aging.

OSPF's Designated Router election, as defined in RFC 2328 and implemented unchanged in Junos, is explicitly non-preemptive. Router priority is used only at the moment an election actually takes place — that is, when no DR or BDR currently exists on the segment. Once a DR and BDR have been elected and are functioning, a router with a numerically higher priority that joins the segment afterward does not trigger a new election and does not displace the incumbent DR or BDR, no matter how much higher its priority value is. In this scenario, R2 (priority 150) and R3 (priority 100) were already elected DR and BDR respectively while R1 was offline. When R1, whose priority of 200 would have made it the preferred DR had it been present during the original election, returns to the segment, it simply forms a full adjacency with the existing DR and BDR and takes on the DROther role like R4, without any re-election occurring. This design choice exists specifically to prevent unnecessary and disruptive Network LSA regeneration and adjacency churn every time a high-priority router reboots or rejoins a stable broadcast network. The only ways R1 could become DR going forward are if the current DR fails (promoting the BDR to DR and triggering a new BDR election) or if the entire segment's OSPF process is restarted, forcing a fresh election from a clean state. Reference topics: Junos Enterprise Routing – OSPF, Designated Router Election and Non-Preemption.

In this configuration, R1's physical interface address (10.10.10.1) is different from the VRRP virtual IP address (10.100.100.1), meaning R1 is operating as a non-owner VRRP master — it did not originate the virtual address as one of its own real interface addresses. By default, Junos VRRP masters that do not own the virtual address will forward transit traffic destined through that address but will not process or respond to traffic addressed directly to the VIP itself, such as ICMP echo requests, Telnet, or SSH sessions aimed at 10.100.100.1. This is deliberate default behavior intended to prevent ambiguity about which physical device is answering on behalf of a shared virtual identity. To allow the master to accept and respond to packets whose destination is the virtual address itself, the accept-data statement must be explicitly configured under the vrrp-group hierarchy. Once enabled, the elected master will process locally destined traffic sent to the VIP, resolving exactly the symptom described. The track option is used for interface or route-based priority adjustment to influence mastership, advertise-interval tunes the frequency of VRRP hello advertisements, and no-preempt prevents a higher-priority router from reclaiming mastership once a lower-priority router has taken over — none of these affect whether the master processes traffic destined to the VIP. Reference topics: Junos Enterprise Routing – High Availability, VRRP accept-data Behavior.

The metric that OSPF assigns to a destination is visible from two complementary vantage points in Junos. The show route protocol ospf command displays the main routing table filtered to OSPF-learned prefixes, and each entry shows the computed cost alongside the next hop, exactly as it was installed after SPF calculation. The show ospf route command (which accepts filters such as intra-area, inter-area, and extern) presents the OSPF-specific routing table, organized by route type, and explicitly lists the metric column for every intra-area, inter-area, and external route the local router has calculated. Together these two commands give both the RIB-level and the protocol-level view of route cost. By contrast, show ospf database extensive dumps the raw link-state advertisements, where metrics appear only as link-level values buried inside Router or Network LSAs rather than as a resolved route cost, so it is not the direct tool for viewing a route's metric. show ospf interface reports interface operational state, area, and DR/BDR information but does not present a cost or metric field at all in its standard output. Candidates should be comfortable distinguishing the RIB-oriented and protocol-table-oriented verification commands, since JNCIS-ENT scenarios frequently test whether a candidate reaches for the correct show command layer during troubleshooting. Reference topics: Junos Enterprise Routing – OSPF Operation and Verification, Monitoring OSPF.

Because Server A resides in VLAN 10 and Server B resides in VLAN 20, traffic between them cannot remain a purely Layer 2 switched flow; it must be routed between the two VLANs, which on Switch 1 means the packet traverses the switch's internal routing engine (via an IRB interface) between the ingress and egress switching stages. Junos processes firewall filters along this path in a strict, layered order that mirrors the packet's actual journey through the device. First, any filter applied at the physical ingress port level (Rx-Port) is evaluated as the frame first arrives on ge-0/0/10. Next, any filter applied to the ingress VLAN (Rx-VLAN, i.e., VLAN 10) is evaluated as the frame is classified into its source broadcast domain. Because the destination subnet requires routing, the packet is then handed to the routing engine, where any input/ingress routed filter (Rx-Router) applied to the receiving IRB interface is evaluated next, followed by any output/egress routed filter (Tx-Router) applied as the now-routed packet is handed from the routing engine back out toward VLAN 20. Finally, the packet passes through any egress VLAN filter (Tx-VLAN, for VLAN 20) and then the egress physical port filter (Tx-Port) on ge-0/0/20 immediately before transmission to Server B. This complete six-stage sequence — Rx-Port, Rx-VLAN, Rx-Router, Tx-Router, Tx-VLAN, Tx-Port — reflects every filter-evaluation checkpoint a routed, inter-VLAN packet passes through on an EX Series Layer 3 switch. Reference topics: Junos Enterprise Switching – Layer 2 Switching and Firewall Filter Processing Order for Routed VLAN Traffic.

Switch A is already fixed as the root bridge in this topology (priority 0), so the outcome being engineered here is not about root bridge election at all, but about which of Switch C's two available paths toward that already-established root — the direct C-to-A link, or the indirect C-to-B-to-A path — RSTP selects as the lower-cost, primary path. RSTP's path-cost calculation for any non-root switch sums the port costs of every link along a candidate path to the root and always selects whichever candidate path has the lowest total accumulated cost as that switch's active root path, placing the corresponding local port into the forwarding root port role while any higher-cost alternative path is placed into a non-forwarding (alternate) role. To force Switch C to prefer routing through Switch B rather than connecting to Switch A directly, the administrator must make the direct C-to-A link's cost higher than the combined cost of the C-to-B link plus the B-to-A link added together, so that the indirect, two-hop path through Switch B mathematically totals to a lower cumulative cost than the single direct hop, causing RSTP's cost comparison to favor the indirect path as primary. Setting Switch B's priority (to either 1 or 0) is irrelevant here, since Switch B is not a root bridge candidate in this scenario and priority manipulation would only affect a root bridge election, not path cost preference between a fixed root and a downstream switch. Lowering the direct link's cost, the inverse of the correct answer, would instead reinforce the direct path rather than override it. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Path Cost and Root Port Selection.

RSTP, as defined in IEEE 802.1w, introduces explicit, well-defined port roles that go beyond legacy 802.1D STP's simpler root/designated/blocking model, and the alternate port role is one of RSTP's key refinements. An alternate port is a port that receives BPDUs from a bridge other than the one through which the local switch's actual root port reaches the root bridge — in other words, it represents a second, redundant path toward the root bridge learned from a different upstream bridge than the one currently providing the best (root port) path. Because the existing root port already provides the lowest-cost, actively used path to the root, the alternate port is deliberately held in the discarding (non-forwarding) state during normal, stable operation, functioning purely as a pre-computed, ready-to-use backup; critically, RSTP's major performance advantage over legacy STP is that if the current root port fails, the switch can transition its alternate port directly and almost instantly into the forwarding root port role without needing to pass through the lengthy listening and learning timer-based states that classic STP required, since the alternate port's suitability as a backup was already continuously verified through ongoing BPDU reception. It is not simply 'not receiving BPDUs' (an alternate port receives BPDUs continuously, just inferior ones relative to the current root port), it is not itself the least-cost path (that describes the root port), and it does not forward based on designated-port overload, which is not a concept that exists in RSTP's port-role logic at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Port Roles: Alternate and Backup Ports.

BGP employs two distinct loop-prevention mechanisms depending on whether peers are external or internal to the same autonomous system. Between external peers (EBGP), loop prevention relies on the AS path attribute: every time a route crosses an AS boundary, the local AS number is prepended to the path, and a router rejects any incoming route whose AS path already contains its own AS number, since that would indicate the route has looped back around. Between internal peers (IBGP) within the same AS, however, the AS path attribute never changes, because IBGP does not add AS numbers as routes are readvertised internally — meaning AS path alone cannot detect an internal loop. Instead, IBGP enforces a strict split-horizon-style rule: a router that learns a route via IBGP must never readvertise that route to another IBGP peer. This rule guarantees that every IBGP speaker within the AS must be directly peered with every other IBGP speaker (a logical full mesh) in order for all routers to receive all routes, since no IBGP router will relay IBGP-learned routes onward on another router's behalf. This full-mesh requirement is precisely why techniques such as route reflection and confederations were later developed — they preserve the same loop-prevention guarantee while relaxing the physical full-mesh peering burden. VRRP and BFD serve entirely unrelated purposes (gateway redundancy and fast failure detection, respectively) and play no role in BGP loop prevention. Reference topics: Junos Enterprise Routing – BGP, IBGP Split-Horizon and the Full-Mesh Requirement.

An integrated routing and bridging interface, configured as irb.x on an EX Series switch, is the mechanism that bridges the Layer 2 and Layer 3 forwarding planes for a given bridge domain or VLAN. By assigning an irb logical unit to a VLAN and configuring an IP address on that unit, the switch gains a routable Layer 3 gateway address that hosts within that VLAN can use as their default gateway, enabling traffic destined for other subnets to be routed off the local broadcast domain. Internally, when a frame destined for the gateway's MAC address arrives on any port belonging to that VLAN, the switch's integrated circuitry hands the packet from the Layer 2 bridging domain to the Layer 3 routing engine associated with the corresponding irb interface, and vice versa for the return path — hence the name 'integrated routing and bridging.' IRB does not eliminate the need for routing instances, which remain a separate mechanism for isolating routing tables; it does not itself perform inter-VLAN switching, since switching still happens strictly within a VLAN's own broadcast domain; and it has no relationship to trunk ports, which remain necessary for carrying multiple tagged VLANs between switches. IRB is the standard method for enabling inter-VLAN routing on a single EX Series switch without an external router. Reference topics: Junos Enterprise Switching – Routing VLANs, Configuring Integrated Routing and Bridging.

Because root bridge election is decided primarily by comparing bridge priority values — with the switch advertising the numerically lowest priority always winning, and MAC address serving only as a fallback tiebreaker when priorities are tied — the only deterministic, reliable way to guarantee that a specific switch is elected root regardless of any other switch's hardware characteristics is to explicitly configure that switch with a lower bridge priority than every other participating switch in the topology. Relying on MAC address alone, as the first distractor suggests, is fundamentally unreliable: MAC addresses are burned in at the factory, cannot be predicted or controlled by the administrator, and any future hardware replacement or newly introduced switch with a numerically lower MAC address could unexpectedly seize the root role since MAC comparison only comes into play at equal priority in the first place, meaning a 'highest MAC' strategy does not even align with how the tiebreak actually favors the lowest value. Port priority and port cost are entirely separate STP parameters that influence which port on a non-root switch is selected as its root port, or which port is selected as designated versus blocking on a given segment; neither parameter has any bearing whatsoever on which switch is elected root bridge for the whole topology, since that decision is made purely from the Bridge ID comparison, independent of any per-port settings. Explicitly and deliberately lowering Switch 1's configured bridge priority is the only correct, industry-standard method. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Guaranteeing Root Bridge Placement via Bridge Priority.

Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to 22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction. The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching – Firewall Filters, Matching on Address, Protocol, and Port Conditions.

The show route advertising-protocol bgp command displays exactly what would be transmitted to a specific BGP neighbor after all configured export routing policy has already been evaluated and applied, meaning any prefixes shown in this output have successfully passed through the export policy chain — confirming the export routing policy has been processed. The command header explicitly states '7 destinations, 7 routes (7 active, ...)' and every listed prefix is preceded by an asterisk, Junos's standard marker for an active route, confirming all seven displayed routes are active in the local routing table. The routing table name shown, XYZ.inet.0, indicates these routes reside in a named routing instance called XYZ rather than the default master routing instance, whose table would instead be labeled simply inet.0; this rules out the statement claiming the routes belong to the default instance. The AS path column shows only the origin code 'I' (IGP) with no AS numbers prepended ahead of it, meaning the AS path is empty, which indicates these prefixes were originated locally within R1's own AS (through redistribution or local origination) rather than having been learned from and passed through an external AS, ruling out that statement as well. Finally, the Nexthop column explicitly shows 'Self' for every route rather than an actual peer or learned address, confirming R1 is rewriting the next-hop attribute to its own address before advertising — a deliberate next-hop-self policy action typically applied toward IBGP peers. Reference topics: Junos Enterprise Routing – BGP, Verifying Advertised Routes and Export Policy Effects.

The destination address 172.16.200.5 falls within the 172.16.0.0/16 aggregate's summarized range but does not fall within either of the two active, more-specific contributing routes actually present in the table — 172.16.10.0/24 and 172.16.99.0/24 — meaning no route more specific than the /16 itself exists to cover it. Under Junos's longest-match forwarding logic, the lookup for 172.16.200.5 therefore resolves to the aggregate route itself, and since aggregate routes are installed by default with a reject next hop rather than any real forwarding path, the router drops the packet and simultaneously generates an ICMP destination-unreachable message back to the originating source, explicitly signaling that no valid path exists for that specific destination even though a covering summary is being advertised. This reject behavior is precisely why aggregate routes are valuable for reducing the number of routes advertised upstream while still providing clear, immediate feedback for traffic aimed at address space within the summary that has no genuine underlying route, rather than silently black-holing it or misdirecting it toward an unrelated contributing route's next hop. The aggregate route itself remains active and installed throughout this process — a gap in contributing coverage does not deactivate the aggregate, since the aggregate's activation depends only on at least one contributing route being active, which is satisfied here by both existing /24 blocks. There is also no default route present in this scenario to fall back upon. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Aggregate Route Reject Behavior for Uncovered Address Space.