Juniper JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Exam Practice Test

In a standard Layer 2 switch environment without specific multicast optimizations, multicast traffic is treated similarly to broadcast traffic and is flooded out of all ports within a VLAN (except the port where it was received). This is inefficient as it consumes unnecessary bandwidth on ports where no receivers are present.

To optimize this, IGMP Snooping is the standard solution.

How it works: The switch "snoops" or monitors IGMP (Internet Group Management Protocol) messages between hosts and routers.

Result: When a receiver sends an IGMP Membership Report (Join) for a specific multicast group, the switch records which port that request came from. It then builds a Layer 2 multicast forwarding table so that traffic for that group is only forwarded to the specific ports that have active listeners.

Junos OS 24.4 Configuration: On modern Juniper switches, you enable this globally or per VLAN using the set protocols igmp-snooping vlan command.

Option A (Promiscuous mode) is used for monitoring or specific security configurations (like Private VLANs) and would not limit multicast flooding. Option B (Spanning Tree) manages loop prevention and does not differentiate between traffic types for forwarding optimization. Option D (IRB interface) is used for Layer 3 routing between VLANs but does not inherently provide Layer 2 multicast optimization within a single VLAN.

The exhibit shows a BGP routing process where an Import Policy is being applied to routes received in the RIB-IN. Specifically, Policy 1 states: "Reject 0.0.0.0/0 from AS 64512."

In Junos OS, when a routing policy rejects a route, that route is not placed in the main routing table (inet.0) for active use. Instead, it becomes a hidden route. To verify that a specific peer is actually sending a route that is subsequently being rejected by your policy, you must use specific diagnostic commands:

Understanding "Hidden" Routes: When a BGP route is received but fails to meet policy requirements (or has an unreachable next-hop), Junos keeps it in the BGP RIB-IN but marks it as "hidden." It will not appear in a standard show route command.

Command Logic (Option D): The command show route receive-protocol bgp hidden allows an administrator to view all routes received from a specific neighbor, including those that were rejected by import policies.

show route receive-protocol bgp : Shows only the routes that passed the import policy and were accepted into the table. Since the 0.0.0.0/0 route from AS 64512 is explicitly rejected in the exhibit, it would not show up here.

Adding the hidden keyword is the essential step to see the rejected default route and verify that AS 64512 is indeed sending it before the policy drops it.

Other Options:

Option A is incorrect because it only shows accepted routes.

Option B and C are used to filter the existing active routing table based on gateway or next-hop attributes, but they cannot show routes that have been rejected and excluded from that table.

This scenario describes a specific use case where a switch port is shared by multiple devices (e.g., via a downstream unmanaged switch), and you want to simplify the authentication process.

Single Supplicant Mode (Option A): In this mode, the switch requires only the first device that connects to the port to successfully authenticate via 802.1X. Once that first device is authorized, the switch "opens" the port for all traffic. This means all subsequent devices attached to that same downstream switch are permitted to access the network without undergoing their own authentication.

Other Modes:

Single-secure supplicant (C): Only allows the first authenticated device; all others are blocked.

Multiple supplicant (D): Requires every device to authenticate individually.

MAC RADIUS (B): This is an authentication method, not a port-control mode.

The exhibit illustrates an EVPN-VXLAN fabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using an Ethernet Segment Identifier (ESI) in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A): When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C): To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes a Designated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states that Leaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrect because in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrect because Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

The exhibit shows a multicast network running PIM Sparse Mode where R2 is configured as a local Rendezvous Point (RP). However, the non-RP routers (like R5) show no learned RP in their show pim rps output. To resolve this using standard protocols for dynamic RP discovery, you must implement a mechanism that automates the distribution of RP information across the PIM domain.

Bootstrap Router (BSR) (Option B): BSR is the industry-standard (RFC 5059) mechanism for dynamically electing an RP and distributing that information throughout a PIM-SM domain.

It uses two roles: Candidate-RPs (C-RPs), which announce their desire to be an RP, and Candidate-BSRs (C-BSRs), which collect these announcements and flood them to all other routers in the network via PIM bootstrap messages.

BSR is a "standard protocol" as it is part of the PIMv2 specification. Once configured on R2 (as C-RP) and potentially R1 or R2 (as C-BSR), all other routers will dynamically learn that R2 is the RP for the specified group ranges.

Auto-RP (Option D): While this also provides dynamic RP discovery, it is a proprietary Cisco protocol. Although Junos supports it for interoperability, the question specifically asks for "standard protocols only," making BSR the preferred choice.

MSDP (Option A): Multicast Source Discovery Protocol (MSDP) is used to share information about active sources between different PIM domains or for Anycast-RP. It does not handle the initial discovery of an RP within a single domain for standard PIM-SM operations.

Anycast RP (Option C): This is a technique used for RP redundancy and load balancing. While it can use BSR or MSDP for synchronization, it is a design architecture rather than a standalone "standard protocol" for the basic dynamic discovery of an RP in the manner requested here.

Configuration Example for BSR in Junos OS 24.4: To enable this, you would add the following to the RP (R2):

set protocols pim rp bootstrap-discovery

set protocols pim rp candidate-rp 10.222.1.2 group-ranges 224.0.0.0/4

set protocols pim rp candidate-bsr 10.222.1.2

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, "headless" devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.

This scenario describes the standard transition of Class of Service (CoS) metadata from the network edge to the network core.

MF vs. BA Classification: Edge devices use Multifield (MF) classifiers because incoming traffic often lacks markings. MF classification assigns traffic to an internal forwarding class based on multiple fields (IPs, ports, etc.). Core devices use Behavior Aggregate (BA) classifiers because they are faster; they only look at the CoS bits (like DSCP) in the header to determine the forwarding class.

The Problem: Internal forwarding class assignments made by an MF classifier on the edge device do not automatically travel with the packet. If the packet leaves the edge device with its original (potentially zeroed) DSCP bits, the core device's BA classifier will not be able to identify the priority.

The Solution (Option A): You must implement rewrite rules on the egress interfaces of the edge devices. A rewrite rule takes the internal forwarding class and loss priority assigned by the MF classifier and "writes" the corresponding DSCP value into the packet header as it exits toward the core. This ensures that the core device sees the correct DSCP marking and can apply the appropriate BA classification.

Incorrect Options: Rewrite rules are strictly an egress function to modify the packet for the next hop. Applying them on ingress (Option B) or core ingress (Option C) does not solve the problem of ensuring the packet header reflects the classification logic used during the internal switching process of the edge device.

In OSPF, the election of a Designated Router (DR) and a Backup Designated Router (BDR) is mandatory on broadcast and non-broadcast multi-access (NBMA) network types to manage link-state database synchronization efficiently.

The exhibit shows that both device1 and device2 have their OSPF interface priority explicitly set to 0. According to the Junos OS 24.4 OSPF implementation:

Ineligibility (Priority 0): A router with a priority of 0 is strictly ineligible to be elected as a DR or BDR for that segment.

No Election Possible: When every router on a broadcast segment has a priority of 0, the election process cannot complete because there are no eligible candidates to fill the required roles.

State Behavior (Stuck in 2-Way): In OSPF adjacency formation, the 2-Way state indicates that bidirectional communication has been established (each router has seen itself in the other's Hello packets). However, to progress to the Exstart and Exchange states on a multi-access network, routers must first identify a DR and BDR.

Result: Since neither router can become the DR, they both wait indefinitely for a third party (with priority > 0) to take the lead. Consequently, the OSPF adjacency will be stuck in the 2-Way state. Adjacencies only reach the Full state with the DR and BDR; routers in a "DROther" role remain in 2-Way with each other.

Option A and D are incorrect because the router ID (IP address) only acts as a tiebreaker if priorities are equal and greater than 0. Option B is incorrect because routers cannot reach the Exstart state (where they negotiate master/slave for database exchange) without first having a DR/BDR elected.

VSTP (VLAN Spanning Tree Protocol) is Juniper's implementation that provides a separate spanning tree instance for each VLAN, ensuring compatibility with Cisco's PVST+. However, it has significant scaling limitations:

Instance Limits: On many Juniper EX and QFX series switches, VSTP is restricted to a maximum of 253 or 510 VLAN instances depending on the software version (ELS vs. non-ELS). In your scenario, having 450 VLANs exceeds the standard 253-instance limit found on many platforms.

The Solution (Option B): When the number of VLANs exceeds the VSTP capacity, the recommended best practice is to enable RSTP (Rapid Spanning Tree Protocol). Unlike VSTP, RSTP runs a single spanning tree instance for the entire switch, regardless of how many VLANs are configured. This ensures that all 450 VLANs are protected from loops without hitting the hardware's instance-count limit.

Other Options: Option A (force-version) only affects the BPDU format for compatibility but doesn't solve the instance limit. Option C and Option D are parameter tuning actions that do not address the architectural limitation of the number of running instances.

To secure a Layer 2 network running Multiple VLAN Registration Protocol (MVRP) against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.

Forbidden Registration Mode (Option D): This mode is specifically designed to prevent an interface from participating in the MVRP exchange.

When a port is set to forbidden, it will neither register nor declare VLANs (except those statically configured on the interface).

If a rogue device sends MVRP PDUs to this interface, the distribution switch will ignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.

Registration Hierarchy: In Junos OS 24.4, this is configured at the [edit protocols mvrp interface registration forbidden] level.

Other Modes: normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize the LLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery) protocol.

VoIP Specifics: While standard LLDP (C) is for general device discovery, LLDP-MED is an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification: LLDP-MED supports Location Identification TLVs (Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation: On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.

The IETF standards for EVPN-VXLAN define the scalability and forwarding behavior of the architecture.

VXLAN Scale (Statement B): The Virtual Network Identifier (VNI) is a 24-bit field in the VXLAN header. This allows for up to $2^{24}$ unique identifiers, which translates to approximately 16 million distinct VXLAN broadcast domains (segments) within a single fabric. * Forwarding Behavior (Statement D): VXLAN is a MAC-in-UDP encapsulation technology. When a Layer 2 frame enters the tunnel at a VTEP, the original Layer 2 frame (including the original source and destination MAC addresses) is encapsulated into a UDP/IP packet and transported across the IP underlay. When it reaches the egress VTEP, the header is removed and the Layer 2 frame is forwarded unchanged to the destination host.

Why others are incorrect: Statement A is incorrect because EVPN itself can technically support more than 16 million domains, but the data plane (VXLAN) is the limiting factor in this specific deployment scenario. Statement C is incorrect because VXLAN encapsulates Layer 2 frames, not just "IP packets," and it treats the entire frame as a payload.

Junos OS 24.4 provides several server-failover options for 802.1X authentication to maintain network availability when the RADIUS server is unreachable.

Fallback Behavior (Option D): The use-cache fallback action allows the switch to consult its local cache of previously authenticated MAC addresses.

If a device was already authorized and its information is in the cache, the switch will continue to permit access based on those cached credentials.

However, if a new device (not in the cache) attempts to connect while the server is down, the switch cannot verify its credentials and will deny the access attempt. This matches the specific requirement to permit authorized devices while denying new ones.

Other Fallback Options:

permit (Option C): This would allow all devices (even new ones) to access the network, typically in a restricted "guest" or "bypass" VLAN.

deny (Option A): This would drop all traffic from all devices on the port if the server is unreachable.

vlan-name (Option B): This moves authenticated or unauthenticated users into a specific fallback VLAN.

The exhibit shows the Class of Service (CoS) transmit queue information for interface ge-0/0/11. To determine the correct behavior, we must analyze the bandwidth allocations and the queue limit settings:

Bandwidth Calculation (Option A): In Junos OS, when multiple queues are assigned specific percentages of bandwidth, the "remainder" (represented by 'r') is the total interface bandwidth minus the sum of the explicitly configured percentages.

Bandwidth assigned to Queue 1 (EF) = 10%.

Bandwidth assigned to Queue 2 (AF) = 10%.

Bandwidth assigned to Queue 3 (NC) = 4%.

Total explicitly assigned = $10\% + 10\% + 4\% = 24\%$.

Remainder for Queue 0 (Best Effort) = $100\% - 24\% = 76\%$.

"Limit: exact" Behavior (Option B): The exhibit shows that Queue 2 (assured-forwarding) has a Limit set to exact.

By default, a queue in Junos can consume more than its allocated bandwidth if other queues are idle.

However, when the exact keyword is applied to the transmit-rate (transmission rate), the queue is strictly rate-limited to its configured percentage.

This means that traffic in Queue 2 will be capped at 10% of the interface bandwidth regardless of whether the network is congested or not. If the traffic exceeds 10%, the excess will be dropped or buffered to match the exact rate.

Option C is incorrect because 100% of the bandwidth is not reserved for a single queue; it is distributed across four queues.

Option D is less accurate than B because it implies the drop behavior only occurs during congestion. The exact parameter enforces the limit even when the rest of the interface is completely idle.

The exhibit displays the default-switch.evpn.0 routing table, which is used on Juniper leaf devices to store EVPN Type 2 (MAC/IP) routes.

Route Distinguisher (Option C): In EVPN, the Route Distinguisher (RD) is an 8-byte prefix added to a route to make it unique within the BGP control plane. The RD format in the exhibit is :.

For example, the prefix 2:192.168.100.1:1::5010::... indicates an EVPN Type 2 route (2:) where 192.168.100.1:1 is the Route Distinguisher.

This RD identifies the specific routing instance on the originating VTEP that advertised the MAC/IP address.

Option A is incorrect: The RD 192.168.100.2:1 does not necessarily mean the host device has that IP; it means the originating switch has that router ID/IP used for its RD.

Option B is incorrect: While the RD often incorporates the router ID, the RD itself is the full string (e.g., 192.168.100.1:1), which is distinct from the raw Router ID used in the BGP summary.

Option D is incorrect: Looking at the entries for 10.1.1.1 and 10.1.2.3, they are associated with different identifiers in the RD strings (5010 and 5020 respectively), which typically map to different VNIs or bridge domains.

The exhibit shows router1 (AS 65001) connected to router2 (AS 65002) via two parallel physical links. The show bgp summary output indicates that sessions are established with two neighbors: 10.10.10.1 and 10.10.20.1. Currently, for the second neighbor (10.10.20.1), there are 0 active routes despite having 4 accepted routes, which indicates that BGP has selected only one "best path" via the first neighbor for forwarding.

BGP Best Path Selection: By default, BGP only selects a single best path for any given destination prefix and installs that one path into the forwarding table. In a topology with parallel links to the same AS, this leads to underutilization of available bandwidth.

Multipath Solution (Option B): To enable active routes from both peers and allow for load-balancing (ECMP) across both links, you must enable the multipath feature.

When the multipath statement is configured under the protocols bgp group ext-peers hierarchy, it tells Junos OS to install multiple equal-cost BGP paths into the routing table and subsequent forwarding table.

Since both neighbors belong to the same peer group (ext-peers) and the same AS (65002), configuring multipath at the group level will apply to both sessions, allowing paths from both neighbors to be marked as "active".

Incorrect Options:

Option A: 172.16.1.1 is the loopback address of router2. The exhibit shows peering is currently done using physical interface addresses (10.10.10.1 and 10.10.20.1), so this address is irrelevant to the current active sessions.

Option C: Configuring the neighbor address alone without the multipath parameter will not change the best-path selection behavior.

Option D: 10.10.20.2 is the local interface IP of router1, not the neighbor's IP. BGP multipath must be configured to point to remote peer paths.

Configuration Example for Junos OS 24.4: To implement this, apply the following command: set protocols bgp group ext-peers multipath

In Junos OS Class of Service (CoS) processing, there is a specific order of operation for packet classification.

Precedence of Multifield (MF) Classifiers: When both a Behavior Aggregate (BA) classifier and a Multifield (MF) classifier are applied to an interface, the MF classifier takes precedence.

Processing Order:

The BA classifier (e.g., DSCP or 802.1p) inspects the packet header and assigns an initial forwarding class and loss priority.

The MF classifier (which looks at multiple fields like source/destination IP and port) is processed later in the pipeline.

The "Final Word": Because the MF classifier is evaluated later, its results overwrite any previous assignments made by the BA classifier. Therefore, if a packet matches both, the MF classifier determines the final forwarding class assignment.

In External BGP (EBGP), there is a default safety mechanism that requires the peer's next hop to be on a directly connected network.

TTL Constraint: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. If the next hop is not directly connected (e.g., when peering via loopback interfaces or across a multi-hop path), the packet will expire before reaching the destination, causing the route to be discarded or the session to fail.

The Multihop Solution (Option B): To override this behavior, you must configure the multihop statement under the BGP neighbor or group hierarchy. This allows the BGP session to establish by increasing the TTL (typically to 64 or a user-defined value) and bypasses the "directly connected" check.

Incorrect Options: Option A (accept-remote-nexthop) is used in internal BGP or specific routing-instance scenarios to resolve next hops that aren't in the local routing table, but it doesn't solve the EBGP TTL/direct-connection requirement. Option C (advertise-inactive) allows BGP to advertise routes that are not the best path in the routing table, which is irrelevant to next-hop reachability. Option D (multipath) is used for load-sharing across multiple paths.

The exhibit illustrates a PIM multicast environment where router R2 has received a multicast packet from Source 1 (192.168.100.10) on its ge-0/0/4.0 interface. To prevent loops, PIM-SM uses a mechanism called Reverse Path Forwarding (RPF).

RPF Check Process (Option A): When a multicast packet arrives, the router performs an RPF check by looking up the source's IP address in its unicast routing table (typically inet.0).

The exhibit's command output, show multicast rpf 192.168.100.10, explicitly shows that for the source network $192.168.100.0/24$, the RPF interface is ge-0/0/1.0.

Because the packet actually arrived on ge-0/0/4.0 instead of the expected ge-0/0/1.0 interface, the RPF check fails.

Packet Discard (Option C): According to standard PIM-SM operation in Junos OS 24.4, if a multicast packet fails the RPF check—meaning it arrived on an interface that the router does not use to reach the source via unicast—the packet is discarded. This is a fundamental loop-prevention mechanism that ensures multicast traffic is only accepted from the shortest path toward the source.

Option B is incorrect because the router will not add any interfaces to the Outgoing Interface List (OIL) for a packet that fails the initial RPF check.

Option D is incorrect because the exhibit clearly shows the interface in the RPF table (ge-0/0/1.0) is different from the interface where the packet was received (ge-0/0/4.0).