Practice Free JN0-352 Enterprise Routing and Switching, Specialist (JNCIS-ENT) Exam Questions Answers With Explanation

A GRE-encapsulated packet consists of the original passenger packet wrapped inside a GRE header and a new outer IP delivery header, and the combined size of these two additions is what constitutes GRE's per-packet overhead. The base GRE header, as defined in RFC 2784 and used in its minimal, non-keyed, non-checksummed form (the default and most common deployment), is exactly 4 bytes in length, containing the flags/version field and the protocol type field identifying the encapsulated payload's ether type. Layered around that GRE header is a completely new outer IPv4 header, which itself consumes a standard 20 bytes, containing the tunnel source and destination addresses used for delivery across the underlying network. Adding these two components together — 4 bytes for the GRE header plus 20 bytes for the new outer IPv4 header — yields a total of exactly 24 bytes of overhead imposed on every encapsulated packet, which is precisely why Junos automatically sets the default protocol MTU on gr- tunnel interfaces to 1476 bytes (1500 minus 24) to prevent oversized, post-encapsulation packets from requiring fragmentation on a standard 1500-byte Ethernet path. The 20-byte figure alone describes only the new IP header in isolation and omits the GRE header itself, while 12 and 32 bytes do not correspond to any standard, non-keyed GRE encapsulation configuration and are included purely as plausible-looking distractors. Reference topics: Junos Enterprise Routing – Tunneling, GRE Header Overhead and MTU Planning.

GRE encapsulation adds a fixed 24 bytes of overhead to every packet it carries — 4 bytes for the GRE header itself and 20 bytes for the new outer IPv4 delivery header. When a host transmits a full 1500-byte Ethernet payload into a gr- interface, the resulting encapsulated packet becomes 1524 bytes, which exceeds the physical interface's standard 1500-byte MTU and forces fragmentation or drops if the don't-fragment bit is set. The correct remediation is to reduce the effective MTU seen by end hosts so that encapsulated packets never exceed the physical link's transmission limit. Junos automatically applies this logic to gr- logical interfaces, which default to a 1476-byte protocol MTU (1500 minus 24), but when the underlying physical interface or a manually configured path is involved, administrators must explicitly size the interface MTU to 1476 bytes to prevent post-encapsulation oversize packets. Allowing fragmentation with clear-dont-fragment is a workaround that increases CPU load and can degrade performance rather than solving the root cause, BFD addresses link-failure detection rather than MTU sizing, and ToS copying affects only the type-of-service byte, not packet length. Reference topics: Junos Enterprise Routing – Tunneling, GRE Encapsulation and MTU Considerations; Junos OS Configuring GRE Tunnel Interfaces.

The Complete Sequence Number PDU (CSNP) is the IS-IS mechanism used to summarize the entire contents of a router's link-state database, listing the LSP ID, sequence number, checksum, and remaining lifetime for every LSP the sending router currently believes should exist in the database for that level. On broadcast (LAN) circuits, the elected Designated Intermediate System periodically transmits CSNPs to all routers on the segment as a database-synchronization mechanism; any receiving router compares the summarized list against its own local database, and any discrepancy — an LSP it is missing entirely, or one for which it holds an older sequence number — triggers a targeted request for the specific, updated LSP content. On point-to-point circuits, a single CSNP is exchanged once when the adjacency first comes up, serving the identical synchronization purpose without needing periodic repetition. The Partial Sequence Number PDU (PSNP), by contrast, is used to acknowledge receipt of specific LSPs or to explicitly request specific LSPs identified as missing or outdated after a CSNP comparison, making it a partial, targeted PDU rather than a complete database listing. The LSP itself is the PDU that actually carries the detailed topology and reachability information being advertised, rather than a database summary. The IS-IS Hello PDU (IIH) is used purely for neighbor discovery and adjacency maintenance and carries no link-state database summary information whatsoever. Reference topics: Junos Enterprise Routing – IS-IS, CSNP and Link-State Database Synchronization.

By default, EBGP sessions are built with the expectation that peers are directly connected at Layer 3, and Junos enforces this by sending EBGP packets with a TTL of 1. When loopback addresses are used as the session endpoints instead of the directly connected physical interface addresses, the resulting IP packets must traverse at least one additional router hop between the two loopbacks, and a TTL of 1 will expire in transit before reaching the remote loopback, causing the TCP handshake — and therefore the BGP session — to fail even though a valid route to the peer's loopback exists. The multihop statement (configured as an EBGP multihop parameter with an accompanying TTL value, most commonly set to 2 for a single intermediate hop) instructs Junos to increase the TTL used for that peer's BGP packets so they survive the extra hop count between loopbacks. This is a mandatory addition any time an EBGP session is deliberately built against non-directly-connected addresses, whereas IBGP sessions, by contrast, do not have this default restriction because IBGP already assumes peers may be multiple hops apart within the same AS. Multipath affects load-balancing across equal-cost paths, damping suppresses flapping routes, and passive controls whether a router waits for the remote peer to initiate the TCP connection — none of these resolve the TTL expiration problem inherent to loopback-based EBGP peering. Reference topics: Junos Enterprise Routing – BGP, Configuring EBGP Multihop Sessions.

Junos firewall filters evaluate terms sequentially from top to bottom, and a term is only terminal for a packet if its then clause contains an explicit terminating action such as accept, discard, reject, or next term without a match. The count and log actions used in track-icmp are non-terminating; they update statistics and generate a log entry but do not stop evaluation, so a matching ICMP packet falls through to the next term after being counted. The second term, allow-tcp-established, matches only TCP packets carrying the ACK or RST flags as defined by the tcp-established keyword; an ICMP echo request does not satisfy protocol tcp, so this term is skipped entirely and does not accept the packet. Evaluation therefore reaches the implicit catch-all term block-rest, which has no from conditions and matches every remaining packet, incrementing blocked-counter and discarding it. The net effect for the described ICMP ping is that icmp-counter is incremented by the first term, the packet is neither accepted nor rejected by the second term, and blocked-counter is incremented immediately before the packet is silently discarded by the final term. This layered-term behavior, where counting is independent of the accept/discard decision, is a frequently tested nuance of Junos firewall filter processing logic. Reference topics: Junos Enterprise Switching – Layer 2 Security and Firewall Filters, Filter Term Evaluation Order.

Each of the 24 end-device-facing interfaces in this scenario needs to carry traffic for exactly one VLAN, and the end devices themselves are ordinary hosts that neither expect nor generate 802.1Q-tagged frames. This is precisely the definition of an access port in Junos: family ethernet-switching interface-mode is set to access, and a single vlan members statement assigns the port to VLAN 70. Access mode ensures frames egressing toward the host are untagged and any frames received are implicitly treated as belonging to the configured VLAN, which is both simpler to manage and more efficient than trunking, since access ports do not carry the 802.1Q tag overhead nor process VLAN pruning logic relevant only to multi-VLAN links. Trunk mode, by contrast, is reserved for switch-to-switch or switch-to-router links that must simultaneously carry frames for multiple VLANs, such as the uplink toward the distribution switch that transports VLANs 30, 50, and 70 together — configuring the 24 host-facing ports as trunks (with or without a native VLAN) would be functionally incorrect and operationally wasteful, since end devices have no need to interpret VLAN tags. There is also no such behavior in Junos where VLAN-ID numeric value dictates default port behavior, making the 'no configuration needed' option a distractor with no basis in EX Series switching architecture. Reference topics: Junos Enterprise Switching – VLANs, Configuring Access and Trunk Port Modes.

OSPF neighbor state progression, as defined in RFC 2328 and displayed by Junos through show ospf neighbor, moves through a well-defined set of named states: Down, Attempt, Init, 2-Way, ExStart, Exchange, Loading, and Full. Down is the initial state, indicating no Hello packets have been recently received from a potential neighbor on that interface; it is a genuine, valid OSPF state and is correctly included here. Init indicates that a Hello packet has been received from the neighbor, but that neighbor has not yet listed the local router's own router ID within its Hello packet, so bidirectional communication has not yet been confirmed; this too is a standard, valid state. Loading occurs after the Exchange state, during which Database Description packets have been fully exchanged and the router is now actively requesting the specific, more-detailed LSAs it identified as missing or outdated from its neighbor via Link State Request packets; it is likewise a standard, valid OSPF neighbor state. 'Established' is not an OSPF state at all — that terminology belongs to BGP's finite state machine, where Established represents the fully operational session state; the OSPF equivalent concept is instead called Full. 'Reject' is not a recognized OSPF neighbor state under any circumstance and does not appear anywhere in the RFC 2328 state machine, making it an invalid distractor as well. Reference topics: Junos Enterprise Routing – OSPF, The OSPF Neighbor State Machine.

Nonstop active routing's defining architectural feature is that the backup Routing Engine runs a fully live, active instance of the routing protocol daemon (rpd) in parallel with the primary Routing Engine's rpd instance, continuously, from the moment NSR and its prerequisite GRES are established — not merely at the instant a switchover begins. As protocol adjacencies form, routes are learned, and the RIB is updated on the primary Routing Engine, that same protocol and RIB state is mirrored in real time to the backup Routing Engine's rpd process through an internal synchronization mechanism, so the backup's protocol state remains a live, up-to-date replica of the primary's at essentially every moment during normal operation. When a switchover occurs, the backup Routing Engine simply assumes the primary role with protocol adjacencies, routing tables, and forwarding state already fully populated and current, allowing it to continue operating without re-establishing neighbor relationships or re-learning the network topology, which is what makes the switchover genuinely nonstop and invisible to neighboring routers. This is fundamentally different from graceful restart, where the restarting router must rebuild its state by requesting help from cooperating neighbors after the fact. The Packet Forwarding Engine plays no role in synchronizing protocol-layer information such as LSAs or BGP updates; that is strictly an rpd-to-rpd function coordinated through the Routing Engine synchronization infrastructure. Reference topics: Junos Enterprise Routing – High Availability, Nonstop Active Routing Architecture and rpd Synchronization.

Root protection (root guard) must always be applied on the ports of the switches you trust to remain root-bridge-eligible, specifically on the interfaces facing away from the legitimate root and toward parts of the network where an untrusted or rogue device could plausibly appear and begin transmitting superior BPDUs. In this topology, Switch-1 is the intended, permanent root bridge (lowest priority, 4k), and Switch-2 is its aggregation-layer peer; both sit above the access layer, where Switch-3 and Switch-4 connect downstream toward end-user-facing infrastructure and where an accidental or malicious rogue switch is realistically most likely to be introduced. The ge-0/0/6 and ge-0/0/8 interfaces on Switch-1 and Switch-2 are precisely the downlink ports facing that access layer, meaning they are the exact points at which a rogue switch's superior BPDU (one advertising a lower priority than the legitimate root) would first be received if such a device appeared beneath Switch-3 or Switch-4. Applying root protection on those specific interfaces causes Junos to immediately block (move to a root-inconsistent, discarding state) any port that receives a superior BPDU, preventing the rogue device from ever being accepted as root, while normal, non-superior BPDUs continue to be processed without disruption. Applying root guard on Switch-1 and Switch-2's peer link (ge-0/0/12/13) would be inappropriate, since that link legitimately connects two trusted, root-eligible switches. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Root Protection Placement Strategy.

When storm control on an EX Series switch is configured with an action of interface-shutdown (rather than the default of simply dropping excess traffic), exceeding the configured bandwidth threshold for broadcast, multicast, or unknown-unicast traffic causes Junos to administratively disable the offending interface to protect the rest of the switching fabric. Recovery from this condition can happen automatically if a recovery-timeout interval has been configured, but when immediate manual recovery is required, the operational command clear ethernet-switching recovery-timeout interface interface-name explicitly clears the storm-control-triggered violation and re-enables the port without waiting for the timer to expire. This command is purpose-built for this exact condition and is distinct from more general troubleshooting commands: clear ethernet-switching table purges the learned MAC address database and has no bearing on a storm-control-disabled port; clear interface statistics resets traffic counters for diagnostic baselining but does not touch administrative state; and clear log messages simply flushes the local system log buffer. Administrators should also verify the underlying cause of the storm — a switching loop, a misbehaving host, or a misconfigured device — before manually clearing the condition, since without addressing the root cause the port is likely to trip again. This command and workflow are commonly tested as part of the Layer 2 security and resiliency features on EX platforms. Reference topics: Junos Enterprise Switching – Storm Control and Port Security, Recovering Interfaces Disabled by Storm Control.

The L column in this output identifies which IS-IS levels are active on each interface, using the standard bitmask where 1 represents Level 1 only and 3 represents both Level 1 and Level 2 combined. Interface ge-0/0/2.0 shows an L value of 1 and its Level 2 DR field explicitly reads Disabled, meaning Level 2 has not been enabled on that circuit at all; consequently no Level 2 adjacency can ever form there, regardless of what the neighboring router advertises, which confirms that statement as correct. The lo0.0 loopback interface shows Passive under both the Level 1 DR and Level 2 DR columns. A passive IS-IS interface is deliberately excluded from adjacency formation — no IIH PDUs are sent or expected on it — but its associated prefix is still injected into the router's own LSP and flooded throughout the area, which is precisely why loopbacks are configured as passive: to guarantee the router ID/loopback prefix is reachable network-wide without wasting adjacency overhead on an interface with no real neighbor. This confirms that R3 advertises its loopback address, while ruling out the claim that the loopback is used to form an adjacency. Regarding designated routers, all circuits shown here report 'Point to Point' rather than an actual DR system ID, because DR election in IS-IS is a construct exclusive to broadcast (LAN) circuits; point-to-point circuits never elect a DR, so the first statement is false. Reference topics: Junos Enterprise Routing – IS-IS, Interface Levels and Passive Interfaces.

Layer 2 MAC learning on an EX Series switch, as on any standard Ethernet bridge, is a passive, frame-driven process rather than an active polling or query-based mechanism. Every time a frame arrives on any interface, the switch inspects the frame's source MAC address field and, if that address is not already present in the Ethernet switching (bridge) table for the associated VLAN, creates a new dynamic entry recording the source MAC address, the VLAN it was learned on, and the specific ingress interface through which the frame arrived. Junos also stamps each learned entry with an aging timestamp, which is refreshed every time a subsequent frame from that same source MAC is received; entries that receive no refreshing traffic within the configured MAC aging interval (300 seconds by default) are eventually purged from the table to keep it current and to reclaim table space from hosts that have moved or gone offline. This source-address-driven, per-frame learning process happens continuously and automatically with no dependency on spanning-tree state changes — although a topology change notification can trigger accelerated aging of the table to flush potentially stale entries faster, learning itself is not gated by or contingent upon such an event occurring. The switch never learns addresses from the destination field of a frame, since the destination address, if already known, is used purely for the forwarding lookup decision, not for populating new table entries. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Source MAC Learning and Table Aging.

Local preference is a well-known, discretionary BGP path attribute carried exclusively in IBGP UPDATE messages, and Junos assigns every route a local preference value of 100 by default whenever a route is received without an explicit LOCAL_PREF value already attached, or when the attribute has not been otherwise modified through routing policy. This default of 100 becomes the implicit baseline against which any administrator-configured local preference adjustments are compared. Because higher local preference values are always preferred over lower ones during BGP best-path selection — and this evaluation happens before AS path length, origin, or MED are ever considered — network engineers commonly use local preference specifically to steer outbound traffic leaving the autonomous system toward a preferred exit peer or upstream provider, by assigning a higher local preference to routes learned from that preferred peer relative to routes learned from alternative peers, making the third statement correct as well. Local preference is explicitly excluded from advertisement to EBGP peers under the BGP specification; it is meaningful only within the boundaries of a single AS and is stripped before a route crosses an AS boundary outward, since a neighboring AS has no reason to trust or honor another organization's internal preference values. A local preference of 0 does not have any special 'drop' semantics in BGP — it is simply the lowest possible numeric preference value and is treated like any other value during comparison, not as a discard instruction. Reference topics: Junos Enterprise Routing – BGP, Local Preference Defaults and Outbound Traffic Engineering.

A generate route is a specialized type of Junos summary route that, unlike an aggregate route, is permitted to inherit and use an actual forwarding next hop rather than being restricted to reject or discard. When multiple contributing routes exist beneath the summarized prefix, Junos selects one of them as the primary contributor using a deterministic process: it first evaluates route preference (choosing the contributor with the lowest, most preferred value), then breaks any remaining tie by preferring the contributing route with the numerically lowest metric, and continues through further tie-breaking criteria if necessary until a single primary contributor is identified. The generate route then adopts the next hop of that specific primary contributor as its own forwarding next hop, meaning traffic matching the generate route but not matching any individual contributing route is forwarded toward whichever real next hop the primary (best) contributing route currently uses. This behavior is fundamentally different from an aggregate route, which never adopts a forwarding next hop at all and instead installs with a reject (or optionally discard) next hop by default, deliberately preventing traffic from being forwarded toward a next hop that might not actually lead to the intended more-specific destination. There is no mechanism by which the next hop is chosen arbitrarily from the 'first' or 'least-specific' contributor, and while a next hop can be manually overridden under the generate route's own configuration, that is not the default resolution behavior being described here. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Generate Routes and Primary Contributor Selection.