Practice Free JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Exam Questions Answers With Explanation

BGP is a routing protocol that operates between autonomous systems (AS). An AS is a group of routers under a single administrative control. BGP can be classified into two types: internal BGP (IBGP) and external BGP (EBGP). IBGP is the BGP communication between routers within the same AS, while EBGP is the BGP communication between routers in different AS. BGP uses the AS_PATH attribute to record the AS numbers that the route has passed through, and uses it to prevent routing loops and select the best path.

In this scenario, you want to add a second ISP connection and remove the default route to the existing ISP. This means that you want to have more control over the routing decisions and use BGP to exchange routes with both ISPs. To do this, you need to deploy the BGP protocol in your network and configure both IBGP and EBGP sessions. The correct statements about BGP in this scenario are:

IBGP peers advertise routes received from EBGP peers to other IBGP peers. This is the default behavior of IBGP, as it allows the routers within the same AS to learn the routes from different EBGP peers and select the best exit point. However, IBGP has a rule that it does not advertise routes received from IBGP peers to other IBGP peers, to avoid creating routing loops. Therefore, option B is correct and option C is incorrect. To overcome this rule, IBGP requires a full mesh topology, where every IBGP router is directly connected to every other IBGP router, or a route reflector or confederation design, where some IBGP routers act as intermediaries to reflect or aggregate the routes to other IBGP routers.

EBGP peers advertise routes received from IBGP peers to other EBGP peers. This is the default behavior of EBGP, as it allows the routers in different AS to exchange routes and reachability information. However, EBGP has a rule that it does not advertise routes received from EBGP peers to other EBGP peers, to avoid creating routing loops. Therefore, option D is correct and option A is incorrect. To overcome this rule, EBGP uses the AS_PATH attribute to filter out the routes that contain its own AS number, or uses route maps or policies to control the route advertisement. IBGP does not update the next-hop attribute to ensure reachability within an AS, as the next-hop attribute is preserved by IBGP. Instead, IBGP relies on an underlying IGP (Interior Gateway Protocol) to provide reachability to the next-hop.

The default MAC age-out timer on an EX Series switch is 300 seconds 1 2 .  The MAC age-out timer is the maximum time that an entry can remain in the MAC table before it “ages out,” or is removed 3 1 .  This configuration can influence efficiency of network resource use by affecting the amount of traffic that is flooded to all interfaces 1 .  When traffic is received for MAC addresses no longer in the Ethernet routing table, the router floods the traffic to all interfaces 1 .

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .

The exhibit shows the configuration of BFD liveness detection for BGP at the global level, which applies to all BGP neighbors by default 1 .  However, this configuration does not specify the session mode, which determines whether BFD uses single-hop or multihop mode to communicate with a neighbor 2 .

For single-hop BGP neighbors, which are directly connected on the same subnet, the session mode can be either automatic or single-hop.  For multihop BGP neighbors, which are not directly connected and require multiple hops to reach, the session mode must be multihop 2 .

Since your BGP neighbors are in different countries, they are likely to be multihop neighbors.  Therefore, you need to configure the session mode as multihop for each neighbor individually at the [edit protocols bgp group group-name neighbor address bfd-liveness-detection] hierarchy level 2 . For example:

protocols { bgp { group usa { neighbor 192.0.2.1 { bfd-liveness-detection { session-mode multihop; } } } group france { neighbor 198.51.100.1 { bfd-liveness-detection { session-mode multihop; } } } } }

If you do not configure the session mode for multihop neighbors, BFD will use the default mode of automatic, which will try to use single-hop mode and fail to establish a BFD session with the remote neighbor 2 . This will prevent BGP from using BFD to detect liveliness and failover.

Therefore, the answer  B  is correct, as you need to configure the BFD liveness detection on the BGP neighbor level with the appropriate session mode for multihop neighbors.

On Juniper switches, the default VLAN is set to a VLAN ID of 1 by default 1 2 .  This means that all interfaces on the switch are members of VLAN 1 until they are specifically assigned to another VLAN 1 2 . Therefore, option A is correct.

The default VLAN ID can be changed 1 2 .  This allows network administrators to configure the switch to use a different VLAN as the default, if necessary 1 2 . Therefore, option D is correct.

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

A  is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets.  Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port 1 .

C  is correct because the interface is configured as a trunk port.  By default, all trunk ports on the switch are trusted for DHCP snooping 2 . This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port.  Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port 2 .

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/lsa-refresh-interval-edit-protocols-ospf.html

According to the Juniper documentation 1 , the source and destination addresses of a GRE tunnel interface must be in different subnets. If they are in the same subnet, the router will not be able to route the GRE packets correctly. In the exhibit, the source and destination addresses are both in the 192.168.197.0/24 subnet, which is invalid for GRE tunneling. Therefore, the correct answer is D. References:  Configuring GRE Tunnel Interfaces | Junos OS

The output of the show bgp neighbor command shows the following information:

The local AS number of R1 is 65400, as indicated by the line “Local: 10.32.1.1+179 AS 65400”.

The peer AS number of 10.32.1.2 is 63645, as indicated by the line “Peer: 10.32.1.2+179 AS 63645”.

The BGP session is established, as indicated by the line “State: Established”.

The routers are exchanging IPv4 routes, as indicated by the line “Type: External State: Established Flags: < Sync > ” and the table showing the number of prefixes received and sent for inet.0 routing table. References:  Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks , [show bgp neighbor - Technical Documentation - Support - Juniper Networks]

A  is correct because RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch.  An alternate port is a backup port for a root port, which means it receives better BPDUs from another bridge than the current root port 1 .  However, an alternate port does not forward any traffic, as it is in a discarding state 2 . It only listens to BPDUs and waits for the root port to fail.  If the root port fails, the alternate port can immediately transition to a forwarding state and become the new root port 1 .

C  is correct because RSTP alternate ports provide an alternate higher cost path to the root bridge.  An alternate port is selected based on the same criteria as the root port, which are the lowest bridge ID, the lowest path cost, the lowest sender port ID, and the lowest receiver port ID 3 .  However, an alternate port receives a higher cost BPDU than the root port, otherwise it would be the root port itself 1 . Therefore, an alternate port provides an alternate higher cost path to the root bridge than the root port.

In a trunk port configuration with multiple VLANs, the native VLAN carries untagged traffic. This means frames sent or received on the port without a VLAN tag are automatically assigned to the native VLAN.

Here ' s why the other options are incorrect:

A. The native VLAN must be the default VLAN on the port.  This is not necessarily true. The native VLAN and the default VLAN can be different. The default VLAN is the VLAN assigned to untagged traffic on access ports, while the native VLAN applies to trunk ports.

B. The native VLAN is automatically configured through DHCP.  This is incorrect. The native VLAN needs to be manually configured on the switch port. DHCP is used for assigning IP addresses, not VLAN IDs.

D. The native VLAN is the highest tagged VLAN ID on the port.  This is also incorrect. The native VLAN and tagged VLANs are independent. The native VLAN is not related to the highest or lowest tagged VLAN ID.

Therefore, the only true statement is that the native VLAN is an untagged VLAN ID on the port.

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

 References:  Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks

Option A suggests that the MTU is not at least 1492 bytes.  This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies 1 .  If the MTU is less than this, IS-IS adjacencies will not be established 1 .

Option D suggests that the lo0 interface is not included as an IS-IS interface.  This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS 1 .  If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established 1 .

Therefore, options A and D are correct.

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 .

Option A suggests that the designated port forwards data to the downstream network segment or device.  This is correct because the designated port is the port on a network segment that has the best path to the root bridge 1 .  It’s responsible for forwarding frames towards the root bridge and sending configuration messages into its segment 1 .

Option D suggests that the root port is responsible for forwarding data to the root bridge.  This is also correct because the root port is always the link directly connected to the root bridge, or the shortest path to the root bridge 1 .  It’s used to forward traffic towards the root bridge 1 .

Therefore, options A and D are correct.

 References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

[Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks]

[Understanding Firewall Filter Terms - TechLibrary - Juniper Networks]

The routers that are directly connected to the Dallas and Denver subnets are not advertising the connected subnets.  This can be resolved by redistributing the connected subnets into OSPF 1 .

Option C suggests to configure and apply a routing policy that redistributes the connected Dallas and Denver subnets.  This is correct because redistribution allows routes from one routing protocol to be communicated to another, and in this case, it allows the connected subnets to be advertised through OSPF 1 .

Option D suggests enabling the passive option on the OSPF interfaces that are connected to the Dallas and Denver subnets.  This is also correct because in OSPF, a passive interface is an interface that belongs to the OSPF router, but does not send OSPF Hello packets 1 .  It’s typically used on an interface that you don’t want to use for OSPF adjacencies, but you still want to advertise its IP address 1 . Therefore, enabling passive interface can help in advertising the Dallas and Denver subnets.

The default hello interval on an OSPF interface depends on the network type of the interface. For point-to-point and broadcast network types, the default hello interval is 10 seconds. For non-broadcast and point-to-multipoint network types, the default hello interval is 30 seconds. The hello interval is the time between sending hello packets to establish and maintain neighbor adjacencies. The hello interval can be configured manually on each interface using the  ip ospf hello-interval  command. References:

OSPF Hello and Dead Interval - NetworkLessons.com

OSPF Hello and Dead Interval: Operation and Configuration

Adjusting OSPF Timers - Cisco IOS Cookbook, 2nd Edition

ospf timer hello - WLAN AC V200R010C00 Command Reference - Huawei

OSPF Timers – Hello and Dead Intervals - Packet Lab

A RIB group is a configuration that allows a routing protocol to install routes into multiple routing tables in Junos OS. A RIB group consists of an import-rib statement, which specifies the source routing table, and an export-rib statement, which specifies the destination routing table or group.  A RIB group can also include an import-policy statement, which specifies one or more policies to control which routes are imported into the destination routing table or group 1 .

An import policy is a policy statement that defines the criteria for accepting or rejecting routes from the source routing table. An import policy can also modify the attributes of the imported routes, such as preference, metric, or community.  An import policy can be applied to a RIB group by using the import-policy statement under the [edit routing-options rib-groups] hierarchy level 1 .

Therefore, option A is correct, because an import policy is applied to the RIB group to control which routes are installed in the destination routing table or group. Option B is incorrect, because all routes in the source routing table are imported into the destination routing table or group, unless filtered by an import policy. Option C is incorrect, because a firewall filter is not used to install routes in the RIB groups; a firewall filter is used to filter packets based on various criteria. Option D is incorrect, because an export policy is not applied to the RIB group; an export policy is applied to a routing protocol to control which routes are advertised to other devices.

A  is correct because you can deploy only stateless firewall filters on an EX Series switch.  A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers 1 .  A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or session information 1 .  EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters 2 .

C  is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.  Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks 3 .  EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters 4 . You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.