Practice Free JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Exam Questions Answers With Explanation

The exhibit illustrates an EVPN-VXLAN fabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using an Ethernet Segment Identifier (ESI) in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A): When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C): To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes a Designated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states that Leaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrect because in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrect because Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

In this scenario, the requirement is to authenticate devices based on their MAC addresses using a centralized database.

MAC RADIUS (Option A): This is the standard Juniper method for authenticating "headless" or non-802.1X capable devices based on their hardware (MAC) address. The switch acts as a proxy, sending the device's MAC address as the username and password to a centralized RADIUS server (the centralized database). If the MAC address is found in the server's database, the device is granted access to the network. This perfectly matches the user's requirement for MAC-based authentication and a centralized database.

Captive Portal (Option B): This is a web-based authentication method requiring user interaction (login via a browser), which is not based on MAC address identification for the initial authentication phase.

Supplicant Modes (Options C & D): These define how multiple devices are handled on an 802.1X-enabled port, but they are not authentication methods themselves; they rely on 802.1X (EAP-based) or MAC-RADIUS being already configured.

In BGP path selection, the Local Preference attribute is one of the most common ways to influence outbound traffic from an Autonomous System (AS). It is a well-known discretionary attribute that is propagated throughout the AS to tell internal routers which path is preferred for a specific destination.

Priority Rule: In the BGP selection algorithm, a higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.

Influencing Outbound Traffic (Option A): To ensure that Provider A is always preferred, you would apply an import policy on R1 (the router connected to Provider A) to set the local preference of all received routes to a value higher than the default (e.g., 200). Since 200 > 100, R3 and R4 will prefer the path via R1.

Alternative Method (Option C): Conversely, you can achieve the same result by applying an import policy on R2 (the router connected to Provider B) to set the local preference to a value lower than the default (e.g., 50). Since the routes from R1 remain at the default of 100, and 100 > 50, the path via R1 (Provider A) is preferred.

Why B and D are incorrect: Setting a higher local preference on R2 (Option B) would make Provider B the preferred exit point. Setting a lower local preference on R1 (Option D) would make Provider A the least preferred exit point.

The exhibit shows a custom Behavior Aggregate (BA) classifier named my-classifier for the Differentiated Services Code Point (DSCP) protocol.

Importing Defaults (Statement C): The configuration line import default; is crucial. In Junos OS, when you create a custom classifier, you can use this statement to import the default mapping table for all code points that you have not explicitly defined in the current block. This ensures that only the specific traffic types you care about are customized while the rest follows industry-standard defaults.

Logical Interface Association (Statement A): In the Junos class-of-service hierarchy, classifiers are typically applied to logical interfaces (e.g., ge-0/0/0.0). While they can sometimes be applied at a higher level, the standard practice for enterprise routing and switching is to associate them with the logical unit to provide granular control over subinterfaces or VLAN-tagged traffic.

Why others are incorrect: Statement B is less accurate because the primary binding point in Junos is the unit (logical interface). Statement D is incorrect because the specific classifications defined in the custom block override the defaults; they are not overwritten by them.

The exhibit shows the MSTP configuration for two switches, switch1 and switch2. MSTP allows you to group multiple VLANs into a single Multiple Spanning Tree Instance (MSTI), enabling different root bridges and topologies for different sets of VLANs.

Root Bridge Election (Option B): For any Spanning Tree instance, the switch with the lowest bridge priority is elected as the root bridge.

For msti 2, switch1 has a priority of 4k (4096), while switch2 has a priority of 8k (8192).

Since 4096 < 8192, switch1 is elected the root bridge for msti 2.

Failover Behavior (Option D): Spanning Tree is designed for redundancy. If a primary root bridge fails, the remaining switches in the network re-elect a new root based on the next lowest priority.

If switch2 goes down, switch1 becomes the only switch in the region.

Regardless of its original priority (4k or 8k), switch1 will take over as the root bridge for both msti 1 and msti 2 because there are no other contenders with a better (lower) priority.

Incorrect Statements: Option A is incorrect because for msti 1, switch2 has the lower priority (4k vs. 8k), making switch2 the root bridge. Option C is incorrect because it contradicts the fundamental high-availability nature of Spanning Tree.

VSTP (VLAN Spanning Tree Protocol) is Juniper's implementation that provides a separate spanning tree instance for each VLAN, ensuring compatibility with Cisco's PVST+. However, it has significant scaling limitations:

Instance Limits: On many Juniper EX and QFX series switches, VSTP is restricted to a maximum of 253 or 510 VLAN instances depending on the software version (ELS vs. non-ELS). In your scenario, having 450 VLANs exceeds the standard 253-instance limit found on many platforms.

The Solution (Option B): When the number of VLANs exceeds the VSTP capacity, the recommended best practice is to enable RSTP (Rapid Spanning Tree Protocol). Unlike VSTP, RSTP runs a single spanning tree instance for the entire switch, regardless of how many VLANs are configured. This ensures that all 450 VLANs are protected from loops without hitting the hardware's instance-count limit.

Other Options: Option A (force-version) only affects the BPDU format for compatibility but doesn't solve the instance limit. Option C and Option D are parameter tuning actions that do not address the architectural limitation of the number of running instances.

Junos OS 24.4 handles multicast traffic using two distinct models based on whether the source is known in advance.

Knowledge and Sources (Option A): PIM-ASM (Any Source Multicast) is designed for "many-to-many" communication where receivers join a group ($*,G$) and rely on a Rendezvous Point (RP) to discover active sources. In contrast, PIM-SSM (Source-Specific Multicast) is for "one-to-many" scenarios where receivers must already know the exact source IP ($S,G$) before joining.

Protocol and RP Logic (Option D): PIM-SSM bypasses the RP entirely. It relies on IGMPv3 messages from the host, which explicitly include both the source address and the group address. This allows the last-hop router to build a Shortest Path Tree (SPT) directly toward the source immediately.

Register Process (Option B): While PIM-ASM does use registers, it is the First-Hop Router (Designated Router on the source segment) that sends the register to the RP, not the receiver's DR.

RP Role (Option C): This is exactly backwards; PIM-ASM requires an RP for source discovery, whereas PIM-SSM does not use one at all.

This scenario describes the standard transition of Class of Service (CoS) metadata from the network edge to the network core.

MF vs. BA Classification: Edge devices use Multifield (MF) classifiers because incoming traffic often lacks markings. MF classification assigns traffic to an internal forwarding class based on multiple fields (IPs, ports, etc.). Core devices use Behavior Aggregate (BA) classifiers because they are faster; they only look at the CoS bits (like DSCP) in the header to determine the forwarding class.

The Problem: Internal forwarding class assignments made by an MF classifier on the edge device do not automatically travel with the packet. If the packet leaves the edge device with its original (potentially zeroed) DSCP bits, the core device's BA classifier will not be able to identify the priority.

The Solution (Option A): You must implement rewrite rules on the egress interfaces of the edge devices. A rewrite rule takes the internal forwarding class and loss priority assigned by the MF classifier and "writes" the corresponding DSCP value into the packet header as it exits toward the core. This ensures that the core device sees the correct DSCP marking and can apply the appropriate BA classification.

Incorrect Options: Rewrite rules are strictly an egress function to modify the packet for the next hop. Applying them on ingress (Option B) or core ingress (Option C) does not solve the problem of ensuring the packet header reflects the classification logic used during the internal switching process of the edge device.

In Junos OS Class of Service (CoS), schedulers are the components that define how traffic in a specific queue is treated before it is transmitted out of an interface.

Queue Priority (Statement C): A scheduler identifies the priority of the queue (e.g., low, medium-low, medium-high, or high). This determines the order in which the hardware handles traffic from different queues.

Buffer Size (Statement D): A scheduler defines the buffer size (amount of memory) allocated to a queue, which can be specified as a percentage, a temporal value (in microseconds), or the remainder of available buffer space. This helps manage bursts of traffic and prevent tail drops.

Other Components: Rate-limiting (Statement A) is typically handled by policers or interface-level shaping, while code translation (Statement B) is the role of rewrite rules.

In an EVPN-VXLAN environment, different BGP route types serve distinct purposes in building the control plane. The Ethernet Segment Identifier (ESI) is a unique 10-byte identifier used to represent a multi-homed segment.

Type 1: Ethernet Auto-Discovery (A-D) Route (Option A): This route type is essential for multi-homing scenarios. It carries the ESI to support features like fast convergence and aliasing. By advertising an A-D route per Ethernet Segment, a PE tells other routers that it is connected to that specific ESI. It does not carry individual host MAC addresses; instead, it provides a "mass withdraw" mechanism to quickly update paths if the entire segment goes down.

Type 4: Ethernet Segment Route (Option D): This route is used exclusively for Designated Forwarder (DF) election. It advertises the existence of an ESI and the ES-Import Route Target to all other PE routers. This allows PE routers connected to the same multi-homed segment to discover each other automatically and elect a DF to handle BUM traffic. Like Type 1, it focuses on the segment identity and does not include MAC addresses.

Type 2: MAC/IP Advertisement Route (Option B): This is the primary route used for host reachability. It must include a MAC address (and optionally an IP). While it also includes the ESI to indicate which segment the host is behind, its primary function is MAC advertisement.

Type 3: Inclusive Multicast Ethernet Tag Route (Option C): This route is used for VTEP discovery and building the replication list for BUM traffic. It identifies the VTEP's IP and the VNI, but it does not carry the ESI or MAC addresses.

In an EVPN-VXLAN architecture, the interaction between the control plane (EVPN) and the data plane (VXLAN) is defined by specific functional components:

VTEP (VXLAN Tunnel End Point): These are the entities responsible for the encapsulation and de-encapsulation of Layer 2 Ethernet frames into Layer 3 UDP/IP packets. A VTEP can be a physical switch (like a QFX or EX series) or a software-based entity. When traffic enters the fabric, the ingress VTEP wraps it in a VXLAN header; the egress VTEP removes this header before delivering it to the destination host. (Option B)

VNI (Virtual Network Identifier): The VNI is a 24-bit field in the VXLAN header that allows for up to 16 million unique identifiers. It is used to identify specific broadcast domains (or VLANs) within the overlay network. Each VNI effectively represents a virtualized Layer 2 segment that is stretched across the Layer 3 underlay. (Option D)

Incorrect statements: Option A is incorrect because VNIs are identifiers, not the "engine" that performs encapsulation—that is the VTEP's job. Option C is incorrect because VTEPs identify the endpoints of a tunnel, not the individual broadcast domains themselves.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A): In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C): EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group family evpn signaling.

Incorrect Options: Option B is incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN. Option D is incorrect because while the loopback interface must be reachable, it is typically advertised via an IGP (like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not "advertise" the loopback to establish the initial peerings.

The exhibit shows the output of the command show route protocol bgp on router R1 for the prefix 172.16.10.1/32. To determine the correct characteristics of this route, we analyze the specific BGP attributes and next-hop information provided in the routing table entry:

Multipath Parameter (Option B): The routing table shows two distinct paths for the prefix 172.16.10.1/32. The first path has two next hops (192.168.10.1 and 192.168.20.1) and is marked with the plus symbol (+) and the asterisk (*), indicating it is both an active and the best route. The presence of multiple next hops being used simultaneously for a single BGP path is a clear indication that the multipath parameter is enabled in the BGP configuration. In Junos OS, BGP multipath allows the installation of multiple equal-cost BGP paths into the forwarding table to facilitate load balancing.

Available Next Hops (Option C): The output explicitly lists two functional next hops for the active path: 192.168.10.1 via ge-1/0/0.2 and 192.168.20.1 via ge-1/0/1.3. Both show an outgoing interface, confirming that this route has two next hops available for traffic forwarding.

IBGP vs. EBGP (Option A): The BGP routes shown have an AS path of 200 I. This indicates the routes were learned from an external Autonomous System (AS 200). Furthermore, the protocol preference is 170. In Junos OS, the default preference for External BGP (EBGP) is 170, whereas the default preference for Internal BGP (IBGP) is 200. Therefore, this configuration is for EBGP, not IBGP.

Hidden Next Hops (Option D): The summary line at the top of the exhibit mentions that there are "2 hidden" routes in the inet.0 table. However, these hidden routes are not the next hops for the 172.16.10.1/32 prefix. A hidden route is a prefix that was rejected by policy or has an unreachable next hop; it is not a "hidden next hop" belonging to an active route.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A): This is the most restrictive 802.1X mode in Junos OS. It allows exactly one MAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C): This mode allows the first authenticated user to "open" the port for all other users. This would actually allow a rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B): This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D): This is an authentication method, not a port-access mode that limits the number of supplicants.