Juniper JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Exam Practice Test

When 802.1X server fail fallback is enabled with the vlan-name feature, the switch provides a specific survival mechanism for both existing and new sessions when the RADIUS server becomes unreachable.

Existing Clients (Statement B): Clients that have already successfully authenticated are unaffected by the server's unavailability in the short term. They maintain their current network access until their specific re-authentication timer expires. Only then will the switch attempt to contact the server again and trigger the fallback action if the server remains down.

New Clients (Statement D): For any new device attempting to connect while the RADIUS server is down, the switch cannot perform a standard authentication. Under the vlan-name fallback configuration, these new clients are automatically placed into the specified fallback VLAN and granted access based on the local policy defined for that VLAN.

Why others are incorrect: Statement A is incorrect because disconnecting active users would cause unnecessary service disruption. Statement C is incorrect because new clients cannot "request" a VLAN during the 802.1X handshake; the switch assigns it based on the fallback configuration.

Junos OS uses specific routing tables for handling multicast traffic to ensure loop prevention through Reverse Path Forwarding (RPF) checks:

Multicast RPF (Option C): The inet.0 table is the default unicast routing table. In most standard multicast deployments, Protocol Independent Multicast (PIM) performs its RPF checks against this table to determine the upstream interface toward the multicast source.

Topology Differences (Option A): The inet.2 table is specifically designed for multicast RPF lookups when the multicast forwarding topology differs from the unicast forwarding topology. This is common in environments using Multiprotocol BGP (MBGP) where you might want multicast traffic to follow a different path than standard data traffic.

inet.1 Role (Option B): The inet.1 table is the multicast forwarding cache. It stores (S,G) and (*,G) entries for actual packet forwarding. Routing protocols like MBGP or IS-IS do not place routes directly into inet.1; instead, PIM uses information from inet.0 or inet.2 to populate inet.1.

IS-IS and OSPFv3 (Option D): These protocols place their IPv4/IPv6 unicast routes into inet.0 or inet6.0. They do not place routes into inet.2 "directly" unless specific RIB-group configurations or address families are enabled to share those routes for multicast RPF purposes.

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.

For maintenance scenarios where a router must remain operational but should not be used as a transit path for OSPF traffic, Junos OS uses the overload functionality.

OSPF Overload (Option B): When you enable overload under protocols ospf, the router advertises its own Link-State Advertisements (LSAs) with a maximum metric (65535) for all of its transit links.

Traffic Diversion: Because OSPF uses the Shortest Path First (SPF) algorithm to find the lowest-cost path, other routers in the network will see the overloaded router as an extremely high-cost path. They will calculate alternate routes, effectively moving transit traffic off the router while still allowing management traffic directed to the router's own interfaces.

Timeout Options: You can configure this to be permanent or set a timeout so that the router automatically resumes normal metric advertisements after a set period.

The exhibit shows the output of the command show route protocol bgp on router R1 for the prefix 172.16.10.1/32. To determine the correct characteristics of this route, we analyze the specific BGP attributes and next-hop information provided in the routing table entry:

Multipath Parameter (Option B): The routing table shows two distinct paths for the prefix 172.16.10.1/32. The first path has two next hops (192.168.10.1 and 192.168.20.1) and is marked with the plus symbol (+) and the asterisk (*), indicating it is both an active and the best route. The presence of multiple next hops being used simultaneously for a single BGP path is a clear indication that the multipath parameter is enabled in the BGP configuration. In Junos OS, BGP multipath allows the installation of multiple equal-cost BGP paths into the forwarding table to facilitate load balancing.

Available Next Hops (Option C): The output explicitly lists two functional next hops for the active path: 192.168.10.1 via ge-1/0/0.2 and 192.168.20.1 via ge-1/0/1.3. Both show an outgoing interface, confirming that this route has two next hops available for traffic forwarding.

IBGP vs. EBGP (Option A): The BGP routes shown have an AS path of 200 I. This indicates the routes were learned from an external Autonomous System (AS 200). Furthermore, the protocol preference is 170. In Junos OS, the default preference for External BGP (EBGP) is 170, whereas the default preference for Internal BGP (IBGP) is 200. Therefore, this configuration is for EBGP, not IBGP.

Hidden Next Hops (Option D): The summary line at the top of the exhibit mentions that there are "2 hidden" routes in the inet.0 table. However, these hidden routes are not the next hops for the 172.16.10.1/32 prefix. A hidden route is a prefix that was rejected by policy or has an unreachable next hop; it is not a "hidden next hop" belonging to an active route.

When a peer incorrectly floods your router with an excessive number of routes, it can exhaust system resources and crash the routing engine.

Prefix-Limit (Option B): The prefix-limit (or accepted-prefix-limit) parameter is the primary defense against such "route leaks".

You can set a maximum threshold for the number of prefixes allowed from a specific BGP neighbor or group.

When the limit is reached, Junos can be configured to either just log a warning or tear down the BGP session entirely (using the teardown keyword) to protect the router.

This prevents the "hundreds of thousand routes" from ever being fully processed or installed into the main routing table.

Damping (Option A): Damping is used to suppress unstable, "flapping" routes, but it does not limit the total volume of stable routes received.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, "headless" devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.

In External BGP (EBGP), there is a default safety mechanism that requires the peer's next hop to be on a directly connected network.

TTL Constraint: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. If the next hop is not directly connected (e.g., when peering via loopback interfaces or across a multi-hop path), the packet will expire before reaching the destination, causing the route to be discarded or the session to fail.

The Multihop Solution (Option B): To override this behavior, you must configure the multihop statement under the BGP neighbor or group hierarchy. This allows the BGP session to establish by increasing the TTL (typically to 64 or a user-defined value) and bypasses the "directly connected" check.

Incorrect Options: Option A (accept-remote-nexthop) is used in internal BGP or specific routing-instance scenarios to resolve next hops that aren't in the local routing table, but it doesn't solve the EBGP TTL/direct-connection requirement. Option C (advertise-inactive) allows BGP to advertise routes that are not the best path in the routing table, which is irrelevant to next-hop reachability. Option D (multipath) is used for load-sharing across multiple paths.

In a standard Layer 2 switch environment without specific multicast optimizations, multicast traffic is treated similarly to broadcast traffic and is flooded out of all ports within a VLAN (except the port where it was received). This is inefficient as it consumes unnecessary bandwidth on ports where no receivers are present.

To optimize this, IGMP Snooping is the standard solution.

How it works: The switch "snoops" or monitors IGMP (Internet Group Management Protocol) messages between hosts and routers.

Result: When a receiver sends an IGMP Membership Report (Join) for a specific multicast group, the switch records which port that request came from. It then builds a Layer 2 multicast forwarding table so that traffic for that group is only forwarded to the specific ports that have active listeners.

Junos OS 24.4 Configuration: On modern Juniper switches, you enable this globally or per VLAN using the set protocols igmp-snooping vlan command.

Option A (Promiscuous mode) is used for monitoring or specific security configurations (like Private VLANs) and would not limit multicast flooding. Option B (Spanning Tree) manages loop prevention and does not differentiate between traffic types for forwarding optimization. Option D (IRB interface) is used for Layer 3 routing between VLANs but does not inherently provide Layer 2 multicast optimization within a single VLAN.

To simplify VLAN management and automate the creation and pruning of VLANs across a network, Juniper utilizes the Multiple VLAN Registration Protocol (MVRP).

MVRP on Trunk Interfaces (Option C): MVRP is the IEEE 802.1ak standard that replaces the older, proprietary GVRP. It is designed to run on trunk interfaces between switches.

Dynamic Creation: When a VLAN is added to one switch, MVRP advertises its existence to neighboring switches. If those switches need to reach that VLAN, they can dynamically create it in their database.

Pruning: If a switch no longer has any active ports or downstream neighbors interested in a specific VLAN, it stops advertising that VLAN on its trunks. This "prunes" the VLAN traffic from those links, saving bandwidth.

Incorrect Options: Option A and B are incorrect because GVRP is legacy and no longer the recommended protocol for modern Junos deployments. Option D is incorrect because MVRP is meant for inter-switch trunk links to manage the fabric, not for edge access ports where VLAN membership is usually static.

OSPF (Open Shortest Path First) is a standards-based Link-State Interior Gateway Protocol (IGP) implemented within Junos OS 24.4:

Intra-AS Routing: OSPF is designed to distribute routing information and perform neighbor discovery within a single Autonomous System (AS). It divides the AS into areas to localize Link-State Advertisements (LSAs) and reduce the size of the Link-State Database (LSDB) on each router. (Option B)

Algorithm: OSPF uses the Shortest Path First (SPF) or Dijkstra algorithm, not a distance vector algorithm (which would be RIP or BGP). This makes Option A incorrect.

Directly Connected Routes: In Junos OS, you must explicitly configure an interface under the [edit protocols ospf] hierarchy to include it in the OSPF process. Once an interface is added, its prefix is automatically advertised to neighbors via Router (Type 1) LSAs. This makes Option C technically inaccurate in the context of interfaces participating in the protocol.

Scope: Protocols used between multiple autonomous systems are External Gateway Protocols (EGPs), such as BGP. This makes Option D incorrect.

In Junos OS Class of Service (CoS) processing, there is a specific order of operation for packet classification.

Precedence of Multifield (MF) Classifiers: When both a Behavior Aggregate (BA) classifier and a Multifield (MF) classifier are applied to an interface, the MF classifier takes precedence.

Processing Order:

The BA classifier (e.g., DSCP or 802.1p) inspects the packet header and assigns an initial forwarding class and loss priority.

The MF classifier (which looks at multiple fields like source/destination IP and port) is processed later in the pipeline.

The "Final Word": Because the MF classifier is evaluated later, its results overwrite any previous assignments made by the BA classifier. Therefore, if a packet matches both, the MF classifier determines the final forwarding class assignment.

In Junos OS 24.4, the no-loss forwarding class is used for traffic that requires lossless delivery, such as iSCSI or FCoE, typically in a Data Center Bridging (DCB) environment.

Priority-Based Flow Control (Option C): To guarantee "no-loss" behavior, the switch must support and use Priority-based Flow Control (PFC). PFC allows the switch to send "pause" frames for a specific priority (forwarding class) to prevent buffer overflow and packet drops without affecting other traffic on the same link.

Forwarding Class Sets (Option B): In enhanced Layer 2 software (ELS) versions used by modern QFX and EX series switches, lossless traffic must be managed within forwarding class sets (also known as priority groups). This grouping is necessary to apply specific DCB properties, such as PFC and specific bandwidth guarantees, to the lossless traffic class.

Why A and D are incorrect: Default scheduler maps and default drop profiles do not provide the specialized buffer management or lossless signaling required for this class. Lossless traffic specifically requires the suppression of tail drops rather than standard drop profiles.

The exhibit illustrates a standard end-to-end Class of Service (CoS) path consisting of an edge router (R1) and core/intermediate routers (R2 and R3).

Edge Classification (Option B): The scenario specifies that video traffic enters the network without any class-of-service markings. Because there are no DSCP or 802.1p bits to inspect, the ingress router (R1) cannot use simple Behavior Aggregate (BA) classification. Instead, it must use Multifield (MF) classification. MF classification allows the router to look deeper into the packet (Source/Destination IP, Protocol, Port numbers) to identify the video stream and assign it to a specific forwarding class. * Core Classification (Option D): Once R1 has identified the traffic, it will typically apply a rewrite rule on its egress interface to mark the packets with a specific CoS value (like a DSCP code). Consequently, the downstream routers (R2 and R3) do not need to perform expensive deep-packet inspection again. They can use Behavior Aggregate (BA) classification, which simply looks at the markings in the packet header to determine the appropriate forwarding priority.

Option A and C: These are incorrect because BA classification is impossible on unmarked ingress traffic, and performing MF classification in the core is inefficient and not a recommended Juniper design practice for high-speed transit.

The exhibit shows a multicast network running PIM Sparse Mode where R2 is configured as a local Rendezvous Point (RP). However, the non-RP routers (like R5) show no learned RP in their show pim rps output. To resolve this using standard protocols for dynamic RP discovery, you must implement a mechanism that automates the distribution of RP information across the PIM domain.

Bootstrap Router (BSR) (Option B): BSR is the industry-standard (RFC 5059) mechanism for dynamically electing an RP and distributing that information throughout a PIM-SM domain.

It uses two roles: Candidate-RPs (C-RPs), which announce their desire to be an RP, and Candidate-BSRs (C-BSRs), which collect these announcements and flood them to all other routers in the network via PIM bootstrap messages.

BSR is a "standard protocol" as it is part of the PIMv2 specification. Once configured on R2 (as C-RP) and potentially R1 or R2 (as C-BSR), all other routers will dynamically learn that R2 is the RP for the specified group ranges.

Auto-RP (Option D): While this also provides dynamic RP discovery, it is a proprietary Cisco protocol. Although Junos supports it for interoperability, the question specifically asks for "standard protocols only," making BSR the preferred choice.

MSDP (Option A): Multicast Source Discovery Protocol (MSDP) is used to share information about active sources between different PIM domains or for Anycast-RP. It does not handle the initial discovery of an RP within a single domain for standard PIM-SM operations.

Anycast RP (Option C): This is a technique used for RP redundancy and load balancing. While it can use BSR or MSDP for synchronization, it is a design architecture rather than a standalone "standard protocol" for the basic dynamic discovery of an RP in the manner requested here.

Configuration Example for BSR in Junos OS 24.4: To enable this, you would add the following to the RP (R2):

set protocols pim rp bootstrap-discovery

set protocols pim rp candidate-rp 10.222.1.2 group-ranges 224.0.0.0/4

set protocols pim rp candidate-bsr 10.222.1.2

To interoperate with Cisco switches running Per-VLAN Spanning Tree Plus (PVST+), Juniper devices must use VLAN Spanning Tree Protocol (VSTP).

PVST+ Compatibility: VSTP is specifically designed to handle the per-VLAN BPDU requirements of Cisco's PVST+. It generates a separate spanning tree instance for each VLAN and uses the same multicast destination MAC address as Cisco devices.

Other Protocols: MSTP (B) is used for grouping VLANs into regions; RSTP (D) is a single-instance protocol (IEEE 802.1w) and is generally incompatible with per-VLAN BPDU requirements without additional configuration.

The exhibit shows router1 (AS 65001) connected to router2 (AS 65002) via two parallel physical links. The show bgp summary output indicates that sessions are established with two neighbors: 10.10.10.1 and 10.10.20.1. Currently, for the second neighbor (10.10.20.1), there are 0 active routes despite having 4 accepted routes, which indicates that BGP has selected only one "best path" via the first neighbor for forwarding.

BGP Best Path Selection: By default, BGP only selects a single best path for any given destination prefix and installs that one path into the forwarding table. In a topology with parallel links to the same AS, this leads to underutilization of available bandwidth.

Multipath Solution (Option B): To enable active routes from both peers and allow for load-balancing (ECMP) across both links, you must enable the multipath feature.

When the multipath statement is configured under the protocols bgp group ext-peers hierarchy, it tells Junos OS to install multiple equal-cost BGP paths into the routing table and subsequent forwarding table.

Since both neighbors belong to the same peer group (ext-peers) and the same AS (65002), configuring multipath at the group level will apply to both sessions, allowing paths from both neighbors to be marked as "active".

Incorrect Options:

Option A: 172.16.1.1 is the loopback address of router2. The exhibit shows peering is currently done using physical interface addresses (10.10.10.1 and 10.10.20.1), so this address is irrelevant to the current active sessions.

Option C: Configuring the neighbor address alone without the multipath parameter will not change the best-path selection behavior.

Option D: 10.10.20.2 is the local interface IP of router1, not the neighbor's IP. BGP multipath must be configured to point to remote peer paths.

Configuration Example for Junos OS 24.4: To implement this, apply the following command: set protocols bgp group ext-peers multipath

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform a recursive lookup to resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C): When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

The inet.3 table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables: * inet.2 (Option A) is used for Multicast RPF checks.

default-switch.evpn.0 (Option B) stores the EVPN routes themselves (MAC/IP), but it is the source of the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D) is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.

Junos OS 24.4 on EX Series switches provides robust support for LLDP (Link Layer Discovery Protocol) and its extension, LLDP-MED (Media Endpoint Discovery).

LLDP-MED Power Negotiation: This feature allows a switch (Power Sourcing Equipment or PSE) and a connected device (Powered Device or PD), such as an IP phone or access point, to negotiate power requirements beyond the standard IEEE 802.3af/at classes. The switch can dynamically allocate the exact amount of power the device needs (in 0.1W increments), which optimizes the power budget of the switch.

LLDP Scope: LLDP is a Link Layer protocol (Layer 2), but it is not restricted to Layer 2 interfaces; it can also operate on Layer 3 interfaces to advertise system identity and capabilities. This makes Option A incorrect.

Link-Local Protocol: LLDP frames use a specific multicast MAC address (01:80:c2:00:00:0e) that is not flooded or forwarded by switches. They are strictly link-local between two directly connected neighbors. This makes Option B incorrect.

Endpoint Focus: LLDP-MED is specifically designed for Media Endpoint Devices (like VoIP phones), providing TLVs for network policy (VLAN/QoS), location identification, and inventory management. Standard LLDP is used for discovering network connectivity devices. This makes Option D incorrect.