Juniper JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Exam Practice Test

In enterprise networks utilizing Junos OS, IBGP (Internal BGP) route flapping is frequently caused by recursive routing failures within the underlying IGP (Interior Gateway Protocol) , such as OSPF or IS-IS.

Recursive Next-Hop Resolution: Unlike EBGP, where the neighbor is typically directly connected, IBGP neighbors are often several hops away. Consequently, an IBGP route ' s protocol next-hop is usually a loopback IP address that requires a recursive lookup to resolve. The router must consult its unicast routing table (typically inet.0 or inet.3) to find a physical path to that next-hop.

The Flapping Mechanism: A " flap " occurs when a route is repeatedly withdrawn and readvertised. If the IGP path used to resolve the BGP next-hop becomes unstable or if the BGP route itself is inadvertently used to resolve its own next-hop (a recursive loop), the BGP next-hop becomes unreachable.

Impact on Routing Table: When the next-hop cannot be resolved, the BGP route is considered invalid and is withdrawn from the routing table. Once the route is withdrawn, the original IGP path to the next-hop often becomes valid again, causing the BGP route to be readvertised . This cycle of withdrawal and readvertisement creates the instability known as flapping.

Why other options are incorrect: Packet misordering (Option A) and community tagging (Option B) may affect performance or policy but do not cause a route to be withdrawn and readvertised in this cyclical manner. While update intervals (Option C) control how quickly changes are sent, they are not the root cause of the reachability failure that triggers the flap itself.

In BGP path selection, the Local Preference attribute is one of the most common ways to influence outbound traffic from an Autonomous System (AS). It is a well-known discretionary attribute that is propagated throughout the AS to tell internal routers which path is preferred for a specific destination.

Priority Rule: In the BGP selection algorithm, a higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.

Influencing Outbound Traffic (Option A): To ensure that Provider A is always preferred, you would apply an import policy on R1 (the router connected to Provider A) to set the local preference of all received routes to a value higher than the default (e.g., 200). Since 200 > 100, R3 and R4 will prefer the path via R1.

Alternative Method (Option C): Conversely, you can achieve the same result by applying an import policy on R2 (the router connected to Provider B) to set the local preference to a value lower than the default (e.g., 50). Since the routes from R1 remain at the default of 100, and 100 > 50, the path via R1 (Provider A) is preferred.

Why B and D are incorrect: Setting a higher local preference on R2 (Option B) would make Provider B the preferred exit point. Setting a lower local preference on R1 (Option D) would make Provider A the least preferred exit point.

When 802.1X server fail fallback is enabled with the vlan-name feature, the switch provides a specific survival mechanism for both existing and new sessions when the RADIUS server becomes unreachable.

Existing Clients (Statement B): Clients that have already successfully authenticated are unaffected by the server ' s unavailability in the short term. They maintain their current network access until their specific re-authentication timer expires. Only then will the switch attempt to contact the server again and trigger the fallback action if the server remains down.

New Clients (Statement D): For any new device attempting to connect while the RADIUS server is down, the switch cannot perform a standard authentication. Under the vlan-name fallback configuration, these new clients are automatically placed into the specified fallback VLAN and granted access based on the local policy defined for that VLAN.

Why others are incorrect: Statement A is incorrect because disconnecting active users would cause unnecessary service disruption. Statement C is incorrect because new clients cannot " request " a VLAN during the 802.1X handshake; the switch assigns it based on the fallback configuration.

In this scenario, router1 (AS 65001) is attempting to establish an External BGP (EBGP) peering with router2 (AS 65002) using their loopback (lo0) interface addresses (192.168.1.1 and 172.16.1.1).

According to the Junos OS 24.4 documentation on BGP peering sessions:

EBGP TTL Default: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. This assumes the peer is directly connected on a shared physical subnet.

Loopback Peering Challenge: When peering between loopback addresses, the destination IP is not on the same subnet as the physical ingress interface. Even if the routers are directly connected physically, the router treats the loopback interface as an additional " hop " . With a TTL of 1, the BGP packet expires before it can be processed by the peer ' s routing engine.

The Multihop Solution (Option D): To allow this session to form, you must configure the multihop statement under the BGP neighbor hierarchy. This tells Junos to increase the TTL (the default becomes 64 when multihop is enabled) and allows the session to establish even though the peer ' s address is not directly connected.

Target Neighbor: The neighbor address specified in the configuration on router1 must be the remote loopback address of router2 (172.16.1.1).

Option A (Multipath) is incorrect because it is used for load balancing across multiple active BGP paths, not for initial session establishment.

Options B and C are incorrect because they reference physical interface addresses (10.10.20.1 or 10.10.10.1) which are not the addresses being used for the loopback-based BGP session.

This scenario describes a specific use case where a switch port is shared by multiple devices (e.g., via a downstream unmanaged switch), and you want to simplify the authentication process.

Single Supplicant Mode (Option A): In this mode, the switch requires only the first device that connects to the port to successfully authenticate via 802.1X. Once that first device is authorized, the switch " opens " the port for all traffic. This means all subsequent devices attached to that same downstream switch are permitted to access the network without undergoing their own authentication.

Other Modes:

Single-secure supplicant (C): Only allows the first authenticated device; all others are blocked.

Multiple supplicant (D): Requires every device to authenticate individually.

MAC RADIUS (B): This is an authentication method, not a port-control mode.

Junos OS 24.4 provides several server-failover options for 802.1X authentication to maintain network availability when the RADIUS server is unreachable.

Fallback Behavior (Option D): The use-cache fallback action allows the switch to consult its local cache of previously authenticated MAC addresses.

If a device was already authorized and its information is in the cache, the switch will continue to permit access based on those cached credentials.

However, if a new device (not in the cache) attempts to connect while the server is down, the switch cannot verify its credentials and will deny the access attempt. This matches the specific requirement to permit authorized devices while denying new ones.

Other Fallback Options:

permit (Option C): This would allow all devices (even new ones) to access the network, typically in a restricted " guest " or " bypass " VLAN.

deny (Option A): This would drop all traffic from all devices on the port if the server is unreachable.

vlan-name (Option B): This moves authenticated or unauthenticated users into a specific fallback VLAN.

In Junos OS Class of Service (CoS), a scheduler is the mechanism used to assign resources to the various egress queues on an interface. Specifically, when utilizing a modified deficit round-robin (MDRR) or weighted round-robin algorithm to service these queues, the scheduler ' s behavior is defined by two primary variables:

Transmit Rate (Option A): This variable defines the minimum guaranteed bandwidth for a queue. In the context of a deficit round-robin algorithm, the transmit rate serves as the weight for the queue. Queues with higher transmit rates receive a larger " quantum " of data they can send during each round-robin cycle compared to queues with lower rates.

Buffer Size (Option C): This variable defines the amount of memory (buffer space) allocated to the queue. It ensures that the queue can hold a certain amount of delayed traffic during periods of congestion to prevent immediate packet drops. The buffer size can be configured as a percentage of the total interface buffer or as a temporal value.

Why other options are incorrect:

Layer 2 and Layer 3 fields (Options B & D): These fields are utilized by classifiers (Behavior Aggregate or Multifield) to identify and group traffic into forwarding classes. They are used before the scheduling process begins and do not define the resource allocation of the scheduler itself.

In a standard campus deployment on Juniper EX Series switches involving VoIP phones and 802.1X authentication, understanding the default behavior of Junos OS 24.4 is critical:

Voice VLAN (Option A): By default, an access port belongs to a single VLAN (the native or data VLAN). For an IP phone to operate correctly on the same physical port as a PC, a Voice VLAN must be explicitly configured and associated with the interface. This allows the switch to segregate voice traffic (usually tagged) from data traffic (untagged).

802.1X Configuration (Option D): Access ports do not have 802.1X authentication enabled by default. To enforce network access control for the client PCs, you must manually enable and configure the dot1x protocol on all relevant interfaces.

PoE Default (Option B): On EX Series switches that support PoE (like P or MP models), PoE is enabled by default on all PoE-capable ports. Therefore, additional configuration is generally not required unless you need to change power priorities or management modes.

LLDP Default (Option C): Standard LLDP is typically enabled by default in the factory configuration of most EX Series switches to facilitate neighbor discovery. While LLDP-MED is used for VoIP, the core requirement for " deploying " the described environment highlights the manual steps of VLAN and security setup rather than protocol discovery which often runs out-of-the-box.

OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.

Virtual Links (Option C): According to OSPF standards (both v2 and v3), virtual links cannot pass through stub areas. A virtual link must transit a " transit area, " which must be a standard (non-stub) area with a full routing table.

Totally Stubby Areas (Option D): A stub area (which blocks Type 5 External LSAs) can be further restricted into a totally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.

Incorrect Statements: Option A is incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR. Option B is incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.

In an EVPN-VXLAN architecture, the interaction between the control plane (EVPN) and the data plane (VXLAN) is defined by specific functional components:

VTEP (VXLAN Tunnel End Point): These are the entities responsible for the encapsulation and de-encapsulation of Layer 2 Ethernet frames into Layer 3 UDP/IP packets. A VTEP can be a physical switch (like a QFX or EX series) or a software-based entity. When traffic enters the fabric, the ingress VTEP wraps it in a VXLAN header; the egress VTEP removes this header before delivering it to the destination host. (Option B)

VNI (Virtual Network Identifier): The VNI is a 24-bit field in the VXLAN header that allows for up to 16 million unique identifiers. It is used to identify specific broadcast domains (or VLANs) within the overlay network. Each VNI effectively represents a virtualized Layer 2 segment that is stretched across the Layer 3 underlay. (Option D)

Incorrect statements: Option A is incorrect because VNIs are identifiers, not the " engine " that performs encapsulation—that is the VTEP ' s job. Option C is incorrect because VTEPs identify the endpoints of a tunnel, not the individual broadcast domains themselves.

In a three-stage EVPN-VXLAN fabric (Spine-Leaf architecture) where leaf devices perform the gateway services (Edge-Routed Bridging or ERB):

VTEP Functionality (Option B): Leaf devices act as VXLAN Tunnel End Points (VTEPs). They are responsible for encapsulating Ethernet frames from locally connected hosts into VXLAN packets for transport across the IP fabric and de-encapsulating incoming VXLAN packets.

Fabric Support (Option C): In a standard Juniper IP fabric design, both the leaf and spine devices are typically expected to support VXLAN and EVPN capabilities. While spines in an ERB design might only perform IP forwarding in the underlay, they often participate in the BGP control plane (as Route Reflectors) or provide the ability to transition to Centrally-Routed Bridging (CRB) where spines would act as gateways.

Incorrect Options: Option A is incorrect because the entire fabric infrastructure must be " VXLAN aware " in terms of MTU settings and routing capability to support the overlay. Option D is incorrect because in an ERB design, the spine devices are high-speed transit nodes and do not terminate VXLAN tunnels; only the edge (leaf) devices act as VTEPs.

OSPFv2 (IPv4) and OSPFv3 (IPv6) share many fundamental concepts, such as the SPF algorithm and the use of areas, but they have distinct differences in how they handle prefix information and LSA headers in Junos OS.

Backbone Requirement (Option C): Both OSPFv2 and OSPFv3 utilize a hierarchical structure. In both versions, all areas must connect to a central Area 0 (the backbone) to allow for inter-area routing. If an area is not physically connected to Area 0, a virtual link must be established.

Flooding Scope (Option D): One of the significant architectural changes in OSPFv3 is the inclusion of the flooding scope directly into the LSA header. In OSPFv3, the LS Type field is expanded to 16 bits, where the top three bits define the flooding scope (e.g., Link-local, Area, or AS scope). This allows routers to understand how far an LSA should be propagated without needing to understand the specific LSA type itself.

LSA Prefix Information (Option A): This statement is misleading. In OSPFv2, Router and Network LSAs (Type 1 and 2) carry both topology and prefix information. However, a key design goal of OSPFv3 was to separate topology from prefix information. In OSPFv3, Type 1 and 2 LSAs only describe the topology, while prefixes are carried in new LSA types: Intra-Area-Prefix-LSAs (Type 9) and Link-LSAs (Type 8).

Processing (Option B): OSPFv2 is processed " per-subnet " because it forms adjacencies based on IPv4 subnets. OSPFv3 is processed " per-link " , meaning it forms adjacencies between interfaces on the same physical link regardless of whether they share a common IPv6 prefix.

The exhibit illustrates an Autonomous System (AS 65512) receiving the same prefix ($203.0.113.0/24$) from two different neighbors, ISP A and ISP B. To influence outbound traffic from AS 65512 so that ISP A is preferred, you must manipulate the BGP Local Preference attribute.BGP Path Selection and Local Preference: Local preference is the first attribute evaluated by BGP after checking if the next hop is reachable. A higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.Applying the Preference (Option B): By applying an import policy on router R1 to set a local preference higher than 100 (e.g., 200) for routes from ISP A, R1, R2, and R3 will all prefer the path through R1 to reach ISP A.Applying the Preference (Option C): Alternatively, you can achieve the same result by applying an import policy on R2 to set a local preference lower than 100 (e.g., 50) for routes from ISP B. Since the routes from R1 remain at the default of 100, the path through ISP A (100) will be preferred over ISP B (50).Why A and D are incorrect: Setting a lower preference for ISP A (Option A) or a higher preference for ISP B (Option D) would result in ISP B being preferred for outbound traffic, which is the opposite of the requirement.

The exhibit shows a multicast network running PIM Sparse Mode where R2 is configured as a local Rendezvous Point (RP). However, the non-RP routers (like R5) show no learned RP in their show pim rps output. To resolve this using standard protocols for dynamic RP discovery, you must implement a mechanism that automates the distribution of RP information across the PIM domain.

Bootstrap Router (BSR) (Option B): BSR is the industry-standard (RFC 5059) mechanism for dynamically electing an RP and distributing that information throughout a PIM-SM domain.

It uses two roles: Candidate-RPs (C-RPs), which announce their desire to be an RP, and Candidate-BSRs (C-BSRs), which collect these announcements and flood them to all other routers in the network via PIM bootstrap messages.

BSR is a " standard protocol " as it is part of the PIMv2 specification. Once configured on R2 (as C-RP) and potentially R1 or R2 (as C-BSR), all other routers will dynamically learn that R2 is the RP for the specified group ranges.

Auto-RP (Option D): While this also provides dynamic RP discovery, it is a proprietary Cisco protocol. Although Junos supports it for interoperability, the question specifically asks for " standard protocols only, " making BSR the preferred choice.

MSDP (Option A): Multicast Source Discovery Protocol (MSDP) is used to share information about active sources between different PIM domains or for Anycast-RP. It does not handle the initial discovery of an RP within a single domain for standard PIM-SM operations.

Anycast RP (Option C): This is a technique used for RP redundancy and load balancing. While it can use BSR or MSDP for synchronization, it is a design architecture rather than a standalone " standard protocol " for the basic dynamic discovery of an RP in the manner requested here.

Configuration Example for BSR in Junos OS 24.4: To enable this, you would add the following to the RP (R2):

set protocols pim rp bootstrap-discovery

set protocols pim rp candidate-rp 10.222.1.2 group-ranges 224.0.0.0/4

set protocols pim rp candidate-bsr 10.222.1.2

OSPF (Open Shortest Path First) is a standards-based Link-State Interior Gateway Protocol (IGP) implemented within Junos OS 24.4:

Intra-AS Routing: OSPF is designed to distribute routing information and perform neighbor discovery within a single Autonomous System (AS). It divides the AS into areas to localize Link-State Advertisements (LSAs) and reduce the size of the Link-State Database (LSDB) on each router. (Option B)

Algorithm: OSPF uses the Shortest Path First (SPF) or Dijkstra algorithm, not a distance vector algorithm (which would be RIP or BGP). This makes Option A incorrect.

Directly Connected Routes: In Junos OS, you must explicitly configure an interface under the [edit protocols ospf] hierarchy to include it in the OSPF process. Once an interface is added, its prefix is automatically advertised to neighbors via Router (Type 1) LSAs. This makes Option C technically inaccurate in the context of interfaces participating in the protocol.

Scope: Protocols used between multiple autonomous systems are External Gateway Protocols (EGPs), such as BGP. This makes Option D incorrect.

In OSPF, the election of a Designated Router (DR) and a Backup Designated Router (BDR) is mandatory on broadcast and non-broadcast multi-access (NBMA) network types to manage link-state database synchronization efficiently.

The exhibit shows that both device1 and device2 have their OSPF interface priority explicitly set to 0. According to the Junos OS 24.4 OSPF implementation:

Ineligibility (Priority 0): A router with a priority of 0 is strictly ineligible to be elected as a DR or BDR for that segment.

No Election Possible: When every router on a broadcast segment has a priority of 0, the election process cannot complete because there are no eligible candidates to fill the required roles.

State Behavior (Stuck in 2-Way): In OSPF adjacency formation, the 2-Way state indicates that bidirectional communication has been established (each router has seen itself in the other ' s Hello packets). However, to progress to the Exstart and Exchange states on a multi-access network, routers must first identify a DR and BDR.

Result: Since neither router can become the DR, they both wait indefinitely for a third party (with priority > 0) to take the lead. Consequently, the OSPF adjacency will be stuck in the 2-Way state. Adjacencies only reach the Full state with the DR and BDR; routers in a " DROther " role remain in 2-Way with each other.

Option A and D are incorrect because the router ID (IP address) only acts as a tiebreaker if priorities are equal and greater than 0. Option B is incorrect because routers cannot reach the Exstart state (where they negotiate master/slave for database exchange) without first having a DR/BDR elected.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, " headless " devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.

In Junos OS routing policies, the order of evaluation and the impact of terminal actions are critical for predictable control.

Immediate Execution (Option D): When a route-filter contains an explicit action like accept or reject within its block, that action is considered terminal if a match is found.

Evaluation Flow: The policy engine processes terms and conditions from top to bottom. If a prefix matches a route-filter that has an embedded accept action, the policy executes that action immediately and stops further evaluation of that specific term. Consequently, any subsequent then clause in the same term is completely ignored.

Best Practice: To ensure a then clause (which might include modifications like changing a preference or community) is executed, the route-filter should be defined without an internal action, allowing the match to fall through to the term ' s common then statement.

The exhibit shows a custom Behavior Aggregate (BA) classifier named my-classifier for the Differentiated Services Code Point (DSCP) protocol.

Importing Defaults (Statement C): The configuration line import default; is crucial. In Junos OS, when you create a custom classifier, you can use this statement to import the default mapping table for all code points that you have not explicitly defined in the current block. This ensures that only the specific traffic types you care about are customized while the rest follows industry-standard defaults.

Logical Interface Association (Statement A): In the Junos class-of-service hierarchy, classifiers are typically applied to logical interfaces (e.g., ge-0/0/0.0). While they can sometimes be applied at a higher level, the standard practice for enterprise routing and switching is to associate them with the logical unit to provide granular control over subinterfaces or VLAN-tagged traffic.

Why others are incorrect: Statement B is less accurate because the primary binding point in Junos is the unit (logical interface). Statement D is incorrect because the specific classifications defined in the custom block override the defaults; they are not overwritten by them.

Private VLANs (PVLANs) allow for granular port isolation within a single broadcast domain. When extending a PVLAN across multiple switches (S1 to S2), the secondary VLANs (Community or Isolated) must be preserved across the trunk links.

802.1Q Tagging (Option B): For traffic from a Community VLAN (RND) to reach members on a different switch, the Community VLAN must have its own 802.1Q VLAN tag (VLAN ID) associated with it. When a frame from a community port on S1 traverses the trunk to S2, it is tagged with this specific secondary VLAN ID. S2 receives the tagged frame, identifies it as belonging to the RND community, and forwards it to the appropriate community or promiscuous ports.

Why it fails without a tag: If the RND community is only defined locally on S1 without a global VLAN ID, the trunk port will not know how to distinguish that traffic from the Primary VLAN or other communities.

Incorrect Options: Option A is incorrect because the community VLAN must have a different tag than the parent (Primary) VLAN to maintain the internal PVLAN logic. Option C is incorrect because stripping tags would lead to the traffic being merged into the native VLAN or dropped. Option D is incorrect because RND is a community VLAN; changing it to an isolated VLAN would change its behavior (preventing communication between members of that same group).