Juniper JN0-460 JNCIS-MistAI-Wired Exam Practice Test

InEVPN-VXLAN,BUM (Broadcast, Unknown unicast, and Multicast)traffic is handled differently than unicast traffic. EVPN provides two main forwarding mechanisms to distribute BUM traffic betweenVTEPs(VXLAN Tunnel Endpoints):

“BUM traffic in EVPN-VXLAN fabrics is replicated using eitheringress replicationorunderlay multicast(PIM-based). Both methods ensure that broadcast and unknown unicast frames reach all remote VTEPs within the same VXLAN segment.”

Option A:Incorrect — static routes are unrelated to BUM forwarding.

Option B:Incorrect — BGP is thecontrol plane, not a data-plane forwarding method.

Option C:Correct—Ingress replicationreplicates BUM packets to all remote VTEPs in the same VNI using unicast tunnels.

Option D:Correct—Underlay replication (multicast)uses multicast groups in the IP underlay to distribute BUM frames efficiently.

According to Juniper Networks' software licensing documentation, Juniper utilizes a tiered subscription model for its Junos OS features on EX and QFX Series switches, specifically designed to align with different network use cases. This model is categorized into three main tiers: Standard, Advanced, and Premium. While basic Layer 2 and Layer 3 functions are included in the base or Standard tiers, advanced fabric technologies are reserved for the highest tier.

The Premium License is explicitly required to enable the full EVPN-VXLAN protocol stack on Juniper switches within a campus or data center fabric. As detailed in the Juniper Licensing User Guide, the Premium license serves as a superset that includes all functionality from the Standard and Advanced tiers, while specifically unlocking the advanced routing and virtualization features necessary for modern fabrics. Specifically, this license entitles the user to configure and run Multiprotocol BGP (MP-BGP) with the EVPN address family—which acts as the control plane—and the VXLAN encapsulation required for the data plane.

In a Juniper Mist Wired Assurance environment, there is a clear distinction between the cloud-based management subscription and the local Junos OS license. While the Wired Assurance subscription provides the AI-driven visibility, SLE monitoring, and automation capabilities through the Mist cloud, the Junos OS Premium license is a prerequisite on the physical hardware to execute the EVPN-VXLAN commands and maintain compliance with Juniper's End User License Agreement (EULA). For instance, on platforms like the EX4650 or QFX5120, attempting to commit a configuration involving EVPN without the appropriate Premium Feature License (PFL) will result in system warnings and protocol limitations, as these features are considered "high-value" software capabilities intended for complex, multitenant campus environments.

Wired Assurance in Mist Cloud provides automated configuration for Juniper EX Series switches. The automation is built on open APIs and supports programmable workflows, which allow seamless integration with external systems and reduce manual configuration errors.

“Wired Assurance leverages 100% open APIs, enabling integration with third-party automation and orchestration tools. Combined with programmable workflows, this provides a consistent and scalable automation framework for switch deployment and management.”

Option A (100% open APIs): Correct — APIs enable automation and external integration.

Option C (programmable workflows): Correct — workflows automate repetitive tasks and provisioning.

Option B (client SLEs): Incorrect — this is part of user experience monitoring, not automation.

Option D (switch insights): Incorrect — this relates to telemetry and visibility, not automation.

When a switch is successfully onboarded into Mist Cloud but shows“Unassigned,”it means the device has been claimed into the organization but hasnot yet been assigned to a specific site.

“After claiming switches into an organization, you must assign each switch to a site for it to transition from Unassigned to Connected state and begin receiving configuration and telemetry updates.”

Option A:Incorrect — rescanning is not needed once the device is claimed.

Option B:Incorrect — reboots are unnecessary for assignment recognition.

Option C:Incorrect — these commands are for connectivity troubleshooting, not site assignment.

Option D:Correct— assigning each switch to itsintended siteenables full Mist management and connectivity state.

InJuniper Mist Cloud, configuration hierarchy includesorganization-level templates,site-level configurations, andindividual switch configuration. Site and organization levels provide shared settings, while per-device details such as hostname or role are set individually.

“Device-specific attributes such as hostname, role, or management IP are configured under the individual switch configuration menu. Templates and site configurations apply globally, while individual configurations override device-level parameters.”

Option A:Incorrect — site configuration applies to all switches at a site, not unique details.

Option B:Incorrect — CLI configuration is not used when switches are managed by Mist Cloud.

Option C:Correct— each switch’s name and role are configured individually underSwitches → Switch Configuration.

Option D:Incorrect — organization templates define global settings, not per-switch names.

According to the provided exhibit, several visual indicators confirm the operational status and compliance of the EX4100-48MP switch within the Juniper Mist dashboard1.

First, the statement that PoE is enabled is verified by multiple sections of the dashboard2. In the Front Panel view, several ports display a green icon representing a wireless access point, and the PoE status indicator in the top right is lit green, indicating the subsystem is active. Furthermore, the Statistics panel shows a "Total Power Draw" of 48.40 W, and the Metrics section displays "100% PoE Compliance," confirming that the switch is successfully delivering Power over Ethernet to connected devices such as the three Mist APs listed in the summary.

Second, the exhibit indicates that the Junos OS version on this switch is not compliant with the other switches in the site5. This is explicitly shown in the Metrics section, where the Version Compliance tile is highlighted in red with a value of 0%6. In the Mist AI-driven interface, a red compliance tile signifies that the current software version running on the device (identified as 23.2R1.13 in the Properties panel) does not match the "Configured Version" or the "Approved Version" set at the Site or Organization level.

The other options are incorrect based on the visual evidence. While Mist APs are connected, the Front Panel shows them connected to 2.5GbE (mGig) ports (ports 0, 2, 8, etc.) and standard 1GbE ports, not specifically just "ge" interfaces in a traditional sense8. Additionally, the 0% Version Compliance score directly contradicts the idea that the switch is compliant with the organization's standards.

According to Juniper Mist documentation, the brownfield adoption process is utilized when bringing existing Juniper switches—which already have a local configuration—under the management of the Mist cloud. This process differs significantly from the greenfield "claiming" method, as it requires manual interaction with the device's management interface to establish the initial connection2.

A critical requirement for this process is that CLI access to the Juniper cloud-ready switch is required3. To initiate adoption, the administrator must log in to the switch via console or SSH and enter a specific set of Junos OS configuration commands provided by the Mist portal. These commands include the necessary parameters for the switch to establish an outbound SSH connection to the Mist cloud, typically using either TCP port 2200 or 443. Without direct CLI access to paste and execute these adoption strings, the switch cannot register itself with the organization's inventory in the dashboard.

Furthermore, because this process involves modifying the switch's local configuration file to add the Mist management parameters, you must perform a commit on the switch after adding the switch adoption commands7. In the Junos operating system, configuration changes reside in a candidate configuration buffer and do not take effect until a commit operation is successfully executed8. Once committed, the switch initiates the connection to Mist9. If the connection is successful, the switch status in the Mist dashboard will transition from "Unassigned" to "Connected," enabling AI-driven telemetry collection and Wired Assurance monitoring. This adoption method allows for a seamless transition of legacy infrastructure into a modern, cloud-managed environment without requiring a factory reset or the presence of a physical QR claim code.

During campus fabric deploymentin Mist AI, switches are onboarded usingclaim codesand must beassigned to the correct siteandonlineso that Mist can push configurations and validate connectivity.

“All switches to be included in a campus fabric must be claimed, online, and assigned to the target site before launching the Campus Fabric wizard. Mist Cloud automatically discovers their roles and builds the topology.”

Option A:Incorrect — switches must be site-assigned before fabric creation.

Option B:Correct— switches must beonlineto receive configurations from Mist.

Option C:Incorrect — offline devices cannot be configured or validated in the fabric wizard.

Option D:Correct— switches must beassigned to the correct sitefor topology creation.

TheMist UI(User Interface) is Juniper’s cloud-based management platform used tomanage both wired and wireless devices, including EX, QFX, and SRX platforms.

It provides centralized visibility, configuration, analytics, and AI-driven insights for the entire enterprise network infrastructure.

WithinWired Assurance, the Mist UI enables device claiming, switch templates, configuration management, and SLE monitoring.

Aport negotiation mismatchoccurs when the local and remote interfaces fail to agree on common speed or duplex settings.

Marvis Wired Assurance automatically detects this by analyzing telemetry from the switch’s physical interfaces.

You can resolve this by ensuringauto-negotiationis enabled on both ends (A) and verifying the peer device supports the802.3 autonegotiation standard(D).

Manually forcing half-duplex or replacing hardware is unnecessary unless the hardware is faulty.

“Marvis Wired Actions correlate interface negotiation errors with LLDP neighbor data to pinpoint mismatched configurations, helping administrators quickly verify speed/duplex compatibility and 802.3 autonegotiation support.”

According to Juniper Networks' documentation on campus fabric and EVPN-VXLAN architectures, a Virtual Routing and Forwarding (VRF) instance—conceptually referred to within the Junos OS as a routing instance—is typically used to provide macro-segmentation by logically separating a single physical network into multiple, isolated virtual networks.2 In the context of a modern campus fabric managed by Juniper Mist, VRFs allow network administrators to create distinct routing domains that maintain their own independent routing and forwarding tables.3

This separation is essential for multitenancy and security.4 For example, an organization might use one VRF for "Corporate_IT" and another for "Guest_WiFi" or "IoT_Devices". Because each VRF operates with its own routing table, traffic belonging to one instance is completely isolated from traffic in another by default; packets cannot travel between VRFs unless an administrator explicitly configures "route leaking" or directs the traffic through a stateful firewall for security inspection. This architectural approach also permits the use of overlapping IP address spaces, as the routing decisions for one tenant do not interfere with the address entries of another.5

In a Juniper Mist-driven campus fabric (such as Core-Distribution or IP Clos), the Mist portal streamlines the creation of these VRF instances as part of the fabric workflow.6 Once a VRF is created, specific VLANs (and their corresponding IRB interfaces) are assigned to it, ensuring that Layer 3 gateways are placed in the correct logical domain. While the underlay network (Option D) is responsible for providing the physical reachability (loopback to loopback) between switches using a protocol like eBGP, the overlay network leverages VRFs to deliver the actual isolated user services.

In theJuniper Mist AI for Wired dashboard, administrators can select one or more switch ports (as shown in the exhibit, e.g., port ge-0/0/25 on an EX4100-48MP). Once configuration changes are made — such as VLAN assignment, port profiles, PoE settings, or administrative state — theSave buttonmust be clicked to confirm and apply those changes to the device.

“When making configuration changes in the Mist switch interface, the Save button must be used to confirm the modifications. Clicking Save applies the selected port settings to the switch through Mist Cloud.”

Option Ais incorrect: saving does not create a backup. Backups and snapshots are handled through Mist’s configuration archive, not via the Save button.

Option Bis incorrect: Save does not reset configuration; instead, it commits changes.

Option Cis incorrect: there is no preview function tied to Save.

Option Dis correct: the Save button is explicitly forapplying configuration changesto the selected switch or port(s).

Creating a new site requires asite nameandtime zone.

Other parameters (like templates or location data) are optional but recommended for proper reporting.

Juniper Mist defines both3-stageand5-stage IP Closarchitectures for campus and data-center fabrics. The5-stage IP Closdesign adds scalability by introducingspineandsuper-spinelayers above the leaf layer, enabling large campus or aggregation environments.

“The 5-stage IP Clos topology extends the 3-stage design by introducing spine and super-spine tiers. It is ideal for large campus environments requiring additional capacity and hierarchical scaling.”

Option A:Incorrect — Clos is a topology, not a routing protocol.

Option B:Incorrect — VXLAN/EVPN encapsulation operates over Clos but does not define it.

Option C:Incorrect — that describes a traditional three-tier campus (core/distribution/access), not a Clos.

Option D:Correct— the5-stage IP Closis a hierarchical, scalable Clos topology withspine and super-spinelayers used in large campus or data-center networks.

According to Juniper Networks' validated designs for campus fabrics, the campus fabric core-distribution with edge-routed bridging (ERB) is the optimal architecture when high volumes of east-west traffic are present and access switches are restricted to Layer 2 operations. In an ERB design, the EVPN-VXLAN fabric extends from the core switches to the distribution switches.1 The critical differentiator is the placement of the default gateways (Integrated Routing and Bridging or IRB interfaces). In the ERB model, these gateways are moved from the core to the distribution layer, which effectively acts as the "edge" of the EVPN fabric.

By placing the Layer 3 gateways at the distribution layer, inter-VLAN (east-west) traffic is routed closer to the endpoints.2 This prevents the "hairpinning" effect found in Centrally-Routed Bridging (CRB) architectures, where traffic must travel all the way to the core layer to be routed between subnets before returning down to the distribution and access layers. This reduction in latency and core-link utilization is essential for modern campus environments with high server-to-server or client-to-client traffic patterns.

Furthermore, this architecture specifically accommodates Layer 2 access switches. In the ERB core-distribution model, the access switches are not part of the EVPN-VXLAN overlay; instead, they connect to the distribution tier using standard Link Aggregation Control Protocol (LACP) or ESI-LAG. This allows organizations to leverage existing legacy or lower-tier access switches that do not support advanced VXLAN capabilities while still benefiting from a robust, scalable EVPN-VXLAN fabric at the distribution and core layers.5 In contrast, while the campus fabric IP Clos also excels at handling east-west traffic, it requires the access switches themselves to perform VXLAN encapsulation/decapsulation (acting as VTEPs), which contradicts the requirement for access switches to operate only at Layer 2.

Juniper Wired Assurance licensingis based on switch port count and supports a range of hardware platforms. Subscriptions are available for12-port,24-port, and48-portmodels across the EX Series portfolio.

“Wired Assurance subscriptions are available for all supported EX Series switches in 12-port, 24-port, and 48-port license options, aligning to switch hardware configurations.”

Option A:Incorrect — 24-port only does not cover all options.

Option B:Incorrect — 12- and 24-port licenses exist, but 48-port is also supported.

Option C:Correct— Mist supports12-, 24-, and 48-portsubscription tiers.

Option D:Incorrect — 12-port alone is incomplete.

EVPN, when used with VXLAN, leveragesBGP MPLS/VXLAN control plane mechanisms. To prevent overlapping IP prefixes between different tenants or sites, EVPN uses aRoute Distinguisher (RD).

“In EVPN-VXLAN, the route distinguisher (RD) makes routes unique when overlapping IP prefixes or MAC addresses are advertised between multiple tenants or sites.”

Option A(designated forwarder) applies to multi-homing in EVPN, not prefix uniqueness.

Option B(Layer 2 gateway) does not prevent IP overlap; it bridges VLANs.

Option D(ESI) is used for identifying multi-homed Ethernet segments, not to differentiate overlapping subnets.

Option C(Route Distinguisher) is correct, as it uniquely identifies routes even if the IP addresses are the same across sites.

The exhibit shows:

L2 gateways (blue dots)positioned at the distribution layer.

L3 gateways (red dots)positioned at thecore layer.

EVPN/VXLAN providing fabric connectivity between layers.

Access switches forwarding traffic into the fabric without acting as gateways.

This directly maps to thecentrally-routed bridging (CRB)model, where:

Bridging occurs at the access/distribution layer.

Routing (L3 gateway) occurs centrally at the core layer.

“In the core-distribution CRB model, Layer 2 gateways are deployed at the distribution switches, and Layer 3 gateways are deployed centrally at the core switches.”

Option A (ERB)is incorrect because ERB places the L3 gateway at the edge/access.

Option B (5-stage IP Clos)is incorrect — that topology has a leaf/spine architecture, not core/distribution.

Option C (3-stage IP Clos)is incorrect — that eliminates the distribution layer.

Option D (CRB)is correct, matching the diagram exactly.

In anEVPN-VXLANarchitecture, theVXLAN Tunnel Endpoint (VTEP)is responsible for encapsulating and de-encapsulating Layer 2 Ethernet frames into VXLAN packets that traverse the IP underlay.

“Each device participating in a VXLAN overlay operates as a VXLAN Tunnel Endpoint (VTEP). The VTEP encapsulates Ethernet frames into VXLAN headers for transmission and de-encapsulates VXLAN packets back into Ethernet frames upon receipt.”

Option A:Incorrect — VLAN is a Layer 2 construct, not responsible for encapsulation.

Option B:Correct— VTEP handles VXLAN encapsulation and de-encapsulation.

Option C:Incorrect — root bridge pertains to STP, not VXLAN.

Option D:Incorrect — WXLAN policy is not a valid networking term in Juniper documentation.

RadSec(RADIUS over TLS) enhances traditional RADIUS authentication security by encapsulating RADIUS messages withinTCP and TLSinstead of UDP.

This ensures encrypted, reliable, and authenticated transmission between network devices (such as Juniper EX switches) and RADIUS servers.

It is often used in modernMist-managed wired networksto securely integrate withAccess Assuranceor external authentication systems.

In Mist,sitesrepresent the physical or logical grouping of devices within an organization.

You create and manage a site configuration under theLocationhierarchy in the Mist UI.

Each site inherits organization-level settings but can override or customize specific configurations such as VLANs, templates, or switch settings.

TheSwitch Insightssection in the Mist dashboard provides detailed switch telemetry, including interface statistics, port utilization, client count, and traffic analysis. It allows administrators to view real-time and historicaltraffic per port, identify top talkers, and detect anomalies.

“The Switch Insights page displays real-time and historical data such as traffic per port, PoE usage, connected clients, and interface errors for every switch managed by Mist.”

Option A:Correct— port-level traffic and utilization metrics are visible in Switch Insights.

Option B:Incorrect — available for all Mist-managed switches (EX and supported QFX).

Option C:Incorrect — displays complete event history, not limited to five events.

Option D:Incorrect — configuration rollback is done via the configuration history section, not Switch Insights.

Within Mist Insights,Client Eventsshow state transitions such asreassociationand IP-level issues likeDHCP Denied.

These help correlate connectivity issues across wired or wireless edge connections.

According toJuniper Mist Wired Assurance documentation, three built-in diagnostic tools available for testing switch functionality areBounce Port,Ping, andCable Test.

Bounce Portallows you to disable and re-enable a port to reset connectivity.

Pingverifies Layer 3 reachability between the switch and target IPs.

Cable Testperforms diagnostics to detect wiring faults, impedance mismatches, or cable lengths.

These tools are accessed directly from theSwitch Testing Toolssection in the Mist dashboard and are available for EX Series and QFX Series switches onboarded to the Mist cloud.

According to Juniper Mist documentation, Wired Service Level Expectations (SLEs) are designed to provide operational visibility into the wired experience by monitoring Juniper EX and QFX Series switches. These SLEs leverage pre-connection and post-connection performance metrics to ensure network reliability and performance.

Pre-connection metrics are specifically focused on the initial phase of a client's journey to join the network. These metrics show the total number and the time required for successful connects and authentication. By tracking 802.1X events and DHCP snooping data, Mist can identify if clients are failing to onboard due to RADIUS issues, authentication timeouts, or failures in the DHCP binding process. This allows administrators to proactively address onboarding hurdles before they impact the broader user base.

Post-connection metrics, conversely, measure the network experience once a client is already "on the wire" and attempting to pass data. These metrics primarily measure throughput and focus on detecting various network errors and operational anomalies. Specifically, post-connection monitoring detects issues such as Spanning Tree Protocol (STP) loops, interface errors, and congestion. Additional post-connection insights include identifying cable issues, negotiation failures, and MTU mismatches that might occur during active data transmission.

In summary, Juniper Mist divides its telemetry into these two distinct categories to simplify troubleshooting. Pre-connection metrics ensure that users can get on the network, while post-connection metrics ensure that the network can sustain their traffic requirements without errors. This combined approach enables the Mist AI-driven Predictive Analytics and Correlation Engine (PACE) to provide a holistic view of the end-user experience, moving beyond traditional "up/down" monitoring to a deeper understanding of the quality of the client experience.