Juniper JN0-352 Enterprise Routing and Switching, Specialist (JNCIS-ENT) Exam Practice Test

OSPF's Designated Router election, as defined in RFC 2328 and implemented unchanged in Junos, is explicitly non-preemptive. Router priority is used only at the moment an election actually takes place — that is, when no DR or BDR currently exists on the segment. Once a DR and BDR have been elected and are functioning, a router with a numerically higher priority that joins the segment afterward does not trigger a new election and does not displace the incumbent DR or BDR, no matter how much higher its priority value is. In this scenario, R2 (priority 150) and R3 (priority 100) were already elected DR and BDR respectively while R1 was offline. When R1, whose priority of 200 would have made it the preferred DR had it been present during the original election, returns to the segment, it simply forms a full adjacency with the existing DR and BDR and takes on the DROther role like R4, without any re-election occurring. This design choice exists specifically to prevent unnecessary and disruptive Network LSA regeneration and adjacency churn every time a high-priority router reboots or rejoins a stable broadcast network. The only ways R1 could become DR going forward are if the current DR fails (promoting the BDR to DR and triggering a new BDR election) or if the entire segment's OSPF process is restarted, forcing a fresh election from a clean state. Reference topics: Junos Enterprise Routing – OSPF, Designated Router Election and Non-Preemption.

When storm control on an EX Series switch is configured with an action of interface-shutdown (rather than the default of simply dropping excess traffic), exceeding the configured bandwidth threshold for broadcast, multicast, or unknown-unicast traffic causes Junos to administratively disable the offending interface to protect the rest of the switching fabric. Recovery from this condition can happen automatically if a recovery-timeout interval has been configured, but when immediate manual recovery is required, the operational command clear ethernet-switching recovery-timeout interface interface-name explicitly clears the storm-control-triggered violation and re-enables the port without waiting for the timer to expire. This command is purpose-built for this exact condition and is distinct from more general troubleshooting commands: clear ethernet-switching table purges the learned MAC address database and has no bearing on a storm-control-disabled port; clear interface statistics resets traffic counters for diagnostic baselining but does not touch administrative state; and clear log messages simply flushes the local system log buffer. Administrators should also verify the underlying cause of the storm — a switching loop, a misbehaving host, or a misconfigured device — before manually clearing the condition, since without addressing the root cause the port is likely to trip again. This command and workflow are commonly tested as part of the Layer 2 security and resiliency features on EX platforms. Reference topics: Junos Enterprise Switching – Storm Control and Port Security, Recovering Interfaces Disabled by Storm Control.

The Complete Sequence Number PDU (CSNP) is the IS-IS mechanism used to summarize the entire contents of a router's link-state database, listing the LSP ID, sequence number, checksum, and remaining lifetime for every LSP the sending router currently believes should exist in the database for that level. On broadcast (LAN) circuits, the elected Designated Intermediate System periodically transmits CSNPs to all routers on the segment as a database-synchronization mechanism; any receiving router compares the summarized list against its own local database, and any discrepancy — an LSP it is missing entirely, or one for which it holds an older sequence number — triggers a targeted request for the specific, updated LSP content. On point-to-point circuits, a single CSNP is exchanged once when the adjacency first comes up, serving the identical synchronization purpose without needing periodic repetition. The Partial Sequence Number PDU (PSNP), by contrast, is used to acknowledge receipt of specific LSPs or to explicitly request specific LSPs identified as missing or outdated after a CSNP comparison, making it a partial, targeted PDU rather than a complete database listing. The LSP itself is the PDU that actually carries the detailed topology and reachability information being advertised, rather than a database summary. The IS-IS Hello PDU (IIH) is used purely for neighbor discovery and adjacency maintenance and carries no link-state database summary information whatsoever. Reference topics: Junos Enterprise Routing – IS-IS, CSNP and Link-State Database Synchronization.

A classic and well-documented gotcha in filter-based forwarding deployments is that the static default route configured inside each forwarding instance frequently references a next-hop address that Junos cannot resolve, simply because the interface and other directly connected routes needed to validate that next hop as reachable exist only in the master inet.0 table by default, not automatically inside the newly created forwarding instance's own table. Since a static route's next hop must be resolvable against routes present within its own routing table to become active, the static default routes inside the ISP-A and ISP-B forwarding instances remain inactive precisely because the necessary interface/next-hop routes were never made visible inside those instances. The standard solution taught for this exact FBF scenario is to configure a routing information base (RIB) group that explicitly imports the relevant interface routes between the master inet.0 table and each forwarding instance's table, allowing the static default route's next hop inside each instance to resolve correctly against the leaked routes and become active. Applying a firewall filter without ever attaching it to an interface accomplishes nothing, since an unapplied filter never evaluates any traffic. Increasing the static route's preference value only affects which competing route wins selection and does nothing to resolve an unreachable next hop. Changing the instance type away from forwarding (to virtual-router) would in fact break FBF entirely, since filter-based forwarding specifically depends on the forwarding instance type working together with a routing-instance firewall filter action. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Filter-Based Forwarding and RIB Group Route Leaking.

A generate route is a specialized type of Junos summary route that, unlike an aggregate route, is permitted to inherit and use an actual forwarding next hop rather than being restricted to reject or discard. When multiple contributing routes exist beneath the summarized prefix, Junos selects one of them as the primary contributor using a deterministic process: it first evaluates route preference (choosing the contributor with the lowest, most preferred value), then breaks any remaining tie by preferring the contributing route with the numerically lowest metric, and continues through further tie-breaking criteria if necessary until a single primary contributor is identified. The generate route then adopts the next hop of that specific primary contributor as its own forwarding next hop, meaning traffic matching the generate route but not matching any individual contributing route is forwarded toward whichever real next hop the primary (best) contributing route currently uses. This behavior is fundamentally different from an aggregate route, which never adopts a forwarding next hop at all and instead installs with a reject (or optionally discard) next hop by default, deliberately preventing traffic from being forwarded toward a next hop that might not actually lead to the intended more-specific destination. There is no mechanism by which the next hop is chosen arbitrarily from the 'first' or 'least-specific' contributor, and while a next hop can be manually overridden under the generate route's own configuration, that is not the default resolution behavior being described here. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Generate Routes and Primary Contributor Selection.

RSTP, as defined in IEEE 802.1w, introduces explicit, well-defined port roles that go beyond legacy 802.1D STP's simpler root/designated/blocking model, and the alternate port role is one of RSTP's key refinements. An alternate port is a port that receives BPDUs from a bridge other than the one through which the local switch's actual root port reaches the root bridge — in other words, it represents a second, redundant path toward the root bridge learned from a different upstream bridge than the one currently providing the best (root port) path. Because the existing root port already provides the lowest-cost, actively used path to the root, the alternate port is deliberately held in the discarding (non-forwarding) state during normal, stable operation, functioning purely as a pre-computed, ready-to-use backup; critically, RSTP's major performance advantage over legacy STP is that if the current root port fails, the switch can transition its alternate port directly and almost instantly into the forwarding root port role without needing to pass through the lengthy listening and learning timer-based states that classic STP required, since the alternate port's suitability as a backup was already continuously verified through ongoing BPDU reception. It is not simply 'not receiving BPDUs' (an alternate port receives BPDUs continuously, just inferior ones relative to the current root port), it is not itself the least-cost path (that describes the root port), and it does not forward based on designated-port overload, which is not a concept that exists in RSTP's port-role logic at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Port Roles: Alternate and Backup Ports.

A link aggregation group bundles multiple physical Ethernet links into a single logical interface (an ae interface) specifically to provide both increased aggregate bandwidth and link-level redundancy. By default, the aeX interface remains operationally up as long as at least one member link within the bundle remains active and passing traffic; the LAG does not require every member link to be functional to continue operating. When one of the four 1-GbE member links in this scenario fails, LACP (if in use) or the underlying link-status monitoring detects the failure, removes that specific link from the active forwarding set, and redistributes traffic hashing across the three remaining healthy member links automatically and without operator intervention. End devices and upper-layer protocols continue to see a single, continuously up ae interface throughout this process, experiencing only a proportional reduction in available aggregate bandwidth rather than any interruption in connectivity. This default behavior is precisely why LAG is a foundational building block for resilient EX Series switch interconnects in enterprise and data center designs, since it allows individual optic, cable, or transceiver failures to be absorbed transparently. None of the distractor behaviors — full administrative shutdown of the bundle, forwarding limited to broadcast traffic only, or a temporary disabling of all member links during renegotiation — reflect actual Junos LAG behavior, which is designed explicitly to avoid any such disruption. Reference topics: Junos Enterprise Switching – Layer 2 Switching, Link Aggregation Group Resiliency.

This detailed adjacency output shows R3 maintaining four separate, fully Up adjacencies, evenly split between the two IS-IS levels. R1 and R2 are both formed at Level 1, confirming that R3 is directly adjacent to exactly two Level 1 neighbors within its local area, which validates that statement. R4 and R5 are both formed at Level 2, and Level 2 adjacencies are, by definition, part of the IS-IS backbone that interconnects areas; a router maintaining any Level 2 adjacency is by that fact participating in and connected to the Level 2 backbone, confirming R3's backbone connectivity as well. Every one of the four listed adjacencies explicitly shows 'Speaks: IP, IPv6' in its detail output, which is Junos's way of indicating that both the IPv4 and IPv6 address families have been successfully negotiated and are active over that circuit; this directly contradicts, rather than supports, the claim that IPv6 is disabled on these neighbors — if IPv6 were disabled, the Speaks field would list only IP. Regarding authentication, the output contains no field, flag, or indication whatsoever referencing authentication configuration or state for the R5 adjacency (or any adjacency); Junos would typically surface authentication-related information separately if it were configured and relevant, and its complete absence here means no basis exists in the exhibit to conclude authentication is required for that specific adjacency. Reference topics: Junos Enterprise Routing – IS-IS, Level 1 and Level 2 Adjacencies and Address Family Negotiation.

TLV 22, the Extended IS Reachability TLV defined in RFC 5305, is the modern and Junos-preferred mechanism for advertising a router's adjacent neighbors together with the metric associated with each link. It carries the seven-octet system ID and pseudonode number of each neighbor along with a 24-bit wide metric field, and supports an extensible set of sub-TLVs used for traffic-engineering data such as interface and neighbor IP addresses, bandwidth, and administrative groups. The original IS Reachability TLV, TLV 2, defined in the base ISO 10589 standard, carries similar neighbor and metric information but is constrained to a 6-bit narrow metric with a maximum value of 63, which is inadequate for expressing meaningful cost differentiation in modern, high-capacity enterprise and service-provider topologies; consequently, Junos deployments are commonly configured for wide-metrics-only, favoring TLV 22 over the legacy TLV 2 whenever traffic-engineering-capable or simply more granular metric representation is desired. TLV 132, the IP Interface Address TLV, only advertises the IPv4 addresses configured on the originating router's interfaces and carries no neighbor-adjacency or metric information. TLV 129, the Protocols Supported TLV, merely lists which network-layer protocols (such as IPv4 or IPv6) the originating router is capable of routing, and likewise has nothing to do with neighbor reachability or link cost. Reference topics: Junos Enterprise Routing – IS-IS, Extended IS Reachability and Wide Metrics.

IS-IS (Intermediate System to Intermediate System) was designed by ISO as a link-state Interior Gateway Protocol for routing within a single autonomous system, functioning on a hierarchical two-level model conceptually similar to OSPF's areas, which makes the first statement unambiguously correct. Within that hierarchy, Level 1 routers maintain detailed topology information only for their own local area and use a default route toward the nearest Level 2 or Level 1/Level 2 router to reach destinations outside the area; they explicitly do not carry inter-area topology information and therefore cannot route traffic between areas on their own. Routers that participate in both levels simultaneously — Level 1/Level 2 (L1/L2) routers — sit at the area boundary, maintaining a Level 1 database for their local area and a Level 2 database for the backbone, and it is specifically these dual-level routers that stitch inter-area traffic together, forwarding packets from the local area into the Level 2 backbone and vice versa, which confirms the second correct statement. Regarding route preference, Junos assigns distinct default preference (administrative distance) values of 15 for IS-IS Level 1 routes and 18 for IS-IS Level 2 routes — neither of which is 20 — so the preference-value statement is factually incorrect and included as a distractor testing precise knowledge of Junos default protocol preferences. Reference topics: Junos Enterprise Routing – IS-IS, Level 1, Level 2, and L1/L2 Router Roles; Default Route Preference Values.

GRE encapsulation adds a fixed 24 bytes of overhead to every packet it carries — 4 bytes for the GRE header itself and 20 bytes for the new outer IPv4 delivery header. When a host transmits a full 1500-byte Ethernet payload into a gr- interface, the resulting encapsulated packet becomes 1524 bytes, which exceeds the physical interface's standard 1500-byte MTU and forces fragmentation or drops if the don't-fragment bit is set. The correct remediation is to reduce the effective MTU seen by end hosts so that encapsulated packets never exceed the physical link's transmission limit. Junos automatically applies this logic to gr- logical interfaces, which default to a 1476-byte protocol MTU (1500 minus 24), but when the underlying physical interface or a manually configured path is involved, administrators must explicitly size the interface MTU to 1476 bytes to prevent post-encapsulation oversize packets. Allowing fragmentation with clear-dont-fragment is a workaround that increases CPU load and can degrade performance rather than solving the root cause, BFD addresses link-failure detection rather than MTU sizing, and ToS copying affects only the type-of-service byte, not packet length. Reference topics: Junos Enterprise Routing – Tunneling, GRE Encapsulation and MTU Considerations; Junos OS Configuring GRE Tunnel Interfaces.

IEEE 802.3ad LACP defines two distinct negotiation modes, active and passive, and the standard's fundamental requirement for successful negotiation is that at least one end of the point-to-point link must be configured in active mode; an actively configured device initiates LACPDU transmission on its own, while a passively configured device waits and only responds once it receives an LACPDU from its peer. If both ends of the bundle were left in passive mode simultaneously, neither side would ever initiate the exchange, and no negotiation — and therefore no functioning aggregated bundle — would ever occur; at least one active participant is therefore mandatory, though having both sides active (active-active) is also fully valid and is in fact the most common production deployment. Junos does not enable LACP automatically on aggregated Ethernet interfaces; unlike some competing platforms, LACP must be explicitly configured under the aggregated-ether-options lacp hierarchy, and specifying no LACP configuration at all results in a 'static' LAG that relies purely on physical link-state rather than any protocol negotiation — there is no implicit default active mode. There is likewise no requirement to configure differing LACP system priority values between the two peer switches; system priority is used only to determine which side of the link controls port selection during negotiation and has no bearing on whether the bundle can form. Both sides being mandatorily active is a stricter requirement than the actual standard specifies. Reference topics: Junos Enterprise Switching – Link Aggregation, LACP Active and Passive Mode Negotiation.

The Junos BGP path selection algorithm proceeds through a strict, ordered sequence of comparison steps, and once next-hop reachability and route preference (administrative distance) have been confirmed as equal, local preference is the very first BGP-specific path attribute evaluated in the decision process. A route carrying a higher local preference value is always chosen over a competing route to the same prefix with a lower local preference, and this comparison takes absolute precedence over every subsequent attribute in the algorithm; if local preference values differ between candidate paths, the selection process concludes at this step without ever needing to examine AS path length, origin type, or MED at all. Only when two or more competing paths share an identical local preference value does the algorithm proceed to its third step, comparing AS path length and preferring the shortest, and only after a further tie does it move on to origin type (preferring IGP-origin over EGP-origin, and EGP-origin over incomplete), followed by MED comparison (preferring the lowest value, and only among routes learned from the same neighboring AS by default). Because local preference is evaluated strictly before all three of the other listed attributes, it is the attribute BGP consults first among the choices given, making it the deciding factor in scenarios such as this exhibit where multiple autonomous systems advertise competing paths toward the same 192.168.1.0/24 prefix. Reference topics: Junos Enterprise Routing – BGP, Understanding BGP Path Selection Order.

IS-IS is a link-state protocol that, like OSPF, runs Dijkstra's Shortest Path First algorithm independently on each router against its own copy of the synchronized link-state database to compute the best path toward every reachable destination. Each link within the topology carries an administrator-assigned or default metric, and as the SPF algorithm walks the topology graph from the local router outward, it sums the metrics of every link traversed along a candidate path to produce that path's total accumulated cost. Among all possible paths to a given destination prefix, IS-IS always selects and installs the path (or, in the case of equal-cost multipath, the set of paths) with the numerically lowest total accumulated metric, exactly mirroring the 'lowest cost wins' principle shared by essentially all link-state IGPs. A higher accumulated metric value is by definition a less preferred, more costly path, making that option the direct inverse of correct IS-IS behavior. Level 2 proximity to the destination has no independent bearing on path selection beyond however it happens to be reflected in the accumulated metric itself — IS-IS does not apply a separate rule preferring paths merely for passing near a Level 2 router. Likewise, LSP recency (sequence number or freshness) governs which version of a given LSP is trusted and flooded during database synchronization, ensuring the topology database itself is accurate and loop-free, but it plays no role in the SPF cost comparison once the database is synchronized and consistent. Reference topics: Junos Enterprise Routing – IS-IS, SPF Calculation and Metric-Based Path Selection.

Switch A is already fixed as the root bridge in this topology (priority 0), so the outcome being engineered here is not about root bridge election at all, but about which of Switch C's two available paths toward that already-established root — the direct C-to-A link, or the indirect C-to-B-to-A path — RSTP selects as the lower-cost, primary path. RSTP's path-cost calculation for any non-root switch sums the port costs of every link along a candidate path to the root and always selects whichever candidate path has the lowest total accumulated cost as that switch's active root path, placing the corresponding local port into the forwarding root port role while any higher-cost alternative path is placed into a non-forwarding (alternate) role. To force Switch C to prefer routing through Switch B rather than connecting to Switch A directly, the administrator must make the direct C-to-A link's cost higher than the combined cost of the C-to-B link plus the B-to-A link added together, so that the indirect, two-hop path through Switch B mathematically totals to a lower cumulative cost than the single direct hop, causing RSTP's cost comparison to favor the indirect path as primary. Setting Switch B's priority (to either 1 or 0) is irrelevant here, since Switch B is not a root bridge candidate in this scenario and priority manipulation would only affect a root bridge election, not path cost preference between a fixed root and a downstream switch. Lowering the direct link's cost, the inverse of the correct answer, would instead reinforce the direct path rather than override it. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Path Cost and Root Port Selection.

The show ethernet-switching table command displays the Layer 2 forwarding database (the bridge or MAC table) that an EX Series switch builds dynamically by inspecting the source MAC address of every frame it receives. Each entry records the learned MAC address, the VLAN it was learned on, the type of entry (dynamic, static, or persistent), and the specific interface through which that address was seen, which is precisely the information needed to confirm whether the switch has learned the host connected to ge-0/0/3. If the host's MAC address is absent from the table, that immediately points to a Layer 1/2 issue — no frames have been received from the host, a cabling or port problem exists, or the interface is administratively down or blocked by spanning tree — rather than a Layer 3 routing or VLAN membership problem. show interfaces terse only reports administrative and link state along with any assigned protocol family addresses, offering no MAC-learning visibility. show vlans lists VLAN definitions and their member interfaces but does not display learned host addresses. show interfaces extensive provides detailed physical-layer counters and error statistics, useful for diagnosing frame loss or interface errors, but it does not expose the switching table. For intra-VLAN reachability troubleshooting, verifying MAC learning is always the first and most direct Layer 2 checkpoint. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Monitoring the Ethernet Switching Table.

The entire purpose of route aggregation is summarization — replacing a set of more-specific contributing routes with a single, broader prefix advertised outward — and this summarization inherently hides internal routing instability from external peers: if one of the underlying contributing /24 blocks within a summarized /16 flaps up and down due to a local link issue, external peers who only see the stable, unchanging /16 aggregate are completely insulated from that churn, since the aggregate itself remains active and advertised as long as at least one contributing route is present, regardless of how much internal fluctuation occurs among the individual contributors. This stability-hiding characteristic is one of the primary operational benefits that motivates using aggregate routes in the first place, confirming that statement as correct. Regarding next-hop behavior, official Juniper documentation is explicit and unambiguous: when an aggregate route is installed in the routing table, Junos assigns it a reject next hop by default, meaning traffic matching only the aggregate (and no more-specific contributor) is dropped and an ICMP unreachable message is returned to the source; a discard next hop is available only as an optional, explicitly configured alternative when silent dropping without ICMP notification is preferred, but it is not the default. Aggregate routes categorically do not advertise their individual contributing routes; suppressing those specific, more-granular prefixes from onward advertisement in favor of the single summary is the aggregate's defining function, directly contradicting the first statement. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Default Reject Next Hop and Route Summarization Benefits.

RFC 4271 defines the BGP finite state machine as a strict, ordered progression of six states that a session must move through to successfully establish. A newly configured or reset session always begins in Idle, where BGP initializes resources and refuses connections until the ConnectRetry timer fires. From Idle, the router transitions to Connect and attempts to establish the underlying TCP transport session to the configured peer address on port 179. If that TCP attempt does not immediately succeed, the session falls back to the Active state, where the router continues retrying the TCP connection in the background; once the TCP handshake finally completes (from either Connect or Active), the session advances to OpenSent, during which the router transmits its own BGP OPEN message advertising its AS number, hold time, BGP identifier, and capabilities. Upon receiving and validating a compatible OPEN message from the peer, the session moves to OpenConfirm, where both sides exchange KEEPALIVE messages to confirm the parameters negotiated in the OPEN exchange are mutually acceptable. Only after this confirmation does the session reach Established, the final state in which UPDATE messages carrying actual routing information begin to flow between the peers. Any deviation from this Idle → Connect → Active → OpenSent → OpenConfirm → Established ordering, as presented in the other answer choices, does not reflect the standardized BGP state machine. Reference topics: Junos Enterprise Routing – BGP, The BGP Finite State Machine.

The show spanning-tree bridge command is specifically designed to surface exactly the two pieces of information required in this scenario within a single output. Its Root ID field reports the full Bridge Identifier (priority and MAC address) of whichever switch has been elected root bridge for the spanning-tree instance in question, immediately answering which switch in the campus network is currently acting as root, regardless of whether that happens to be the local device or a remote one. In the same output, the command's Root port field explicitly names the specific local interface (for example, ge-0/0/1.0) that the local switch has selected as its path toward that root bridge, directly answering the second part of the requirement without needing to cross-reference a separate command. Together, these two fields give a complete, immediate picture of both root bridge identity and local root port selection from one operational command. show spanning-tree interface instead presents a per-interface breakdown of STP role (root, designated, alternate, backup) and state across all local ports, which can indirectly reveal the root port by looking for the 'Root' role, but it does not directly report the Root ID/root bridge identity in the same structured way that show spanning-tree bridge does. show ethernet-switching table and show ethernet-switching interface pertain entirely to MAC address learning and switching-specific interface configuration respectively, and neither surfaces any spanning-tree topology or root bridge information at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Verifying Root Bridge and Root Port with show spanning-tree bridge.