I85PREP
⌘ K
JNCIS-ENT study materials
JNCIS-ENT study resources

JNCIS-ENT practice questions

One question at a time. Build your JNCIS-ENT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Layer 2 Switching or VLANs

Which statement describes the effect of placing switch interfaces into different VLANs?

  1. Interfaces in different VLANs must be given addresses from the same IP subnet.
  2. Each VLAN is a separate broadcast domain and the switch does not forward frames between them. Correct answer.
  3. All switch ports stay in a single broadcast domain while each VLAN keeps its own separate MAC address table.
  4. Frames received in one VLAN are replicated into every other VLAN by default.

Explanation

A VLAN is a Layer 2 broadcast domain, so broadcasts and unknown unicast frames stay inside the VLAN. Without a Layer 3 device or an IRB interface, the switch does not move frames between VLANs. Each VLAN also maintains its own MAC address table and its own instance of spanning tree state.

Question 2Layer 2 Switching or VLANs

What is the primary function of an 802.1Q trunk port on a switch?

  1. It forwards traffic for only the default VLAN and discards tagged frames.
  2. It carries traffic for multiple VLANs, tagging frames so the peer knows the VLAN. Correct answer.
  3. It removes the VLAN tag from every frame before forwarding it.
  4. It assigns every received frame to the access VLAN of the port.

Explanation

An 802.1Q trunk inserts a 12-bit VLAN identifier into the frame header so that many VLANs can share one physical link. The receiving trunk reads the tag to decide which VLAN the frame belongs to. Access ports, by contrast, belong to one VLAN and normally send untagged frames.

Question 3Layer 2 Switching or VLANs

Which range of VLAN identifiers can be configured on a Junos switch?

  1. 1 through 4095
  2. 2 through 4096
  3. 0 through 4095
  4. 1 through 4094 Correct answer.

Explanation

The 802.1Q tag field is 12 bits, giving 4096 code points, but the values at each end are reserved. Junos therefore accepts VLAN IDs from 1 to 4094 for normal configuration.

Question 4Layer 2 Switching or VLANs

Which set of port roles is defined by RSTP (802.1w)?

  1. Root, designated, alternate, and backup Correct answer.
  2. Blocking, listening, learning, and forwarding
  3. Primary, secondary, standby, and disabled
  4. Discarding, learning, and forwarding

Explanation

RSTP defines four port roles: root, designated, alternate, and backup. Alternate and backup ports provide immediate replacements for a failed root or designated port. Blocking, listening, learning, and forwarding are states rather than roles.

Question 5Layer 2 Switching or VLANs

Which set of port states is defined by classic 802.1D spanning tree?

  1. Initializing, listening, learning, and forwarding
  2. Discarding, learning, and forwarding
  3. Disabled, negotiating, learning, and forwarding
  4. Blocking, listening, learning, and forwarding Correct answer.

Explanation

802.1D uses five states, the fifth being disabled: blocking, listening, learning, forwarding, and disabled. A port must pass through listening and learning before it forwards, which is why convergence is slow. RSTP replaced these with the three states discarding, learning, and forwarding.

Question 6Layer 2 Switching or VLANs

What is the default MAC address aging time on a Junos switch?

  1. 3600 seconds
  2. 30 seconds
  3. 600 seconds
  4. 300 seconds Correct answer.

Explanation

Junos ages out dynamically learned MAC entries that have not been refreshed for 300 seconds by default. After the timer expires the entry is removed and traffic to that address is flooded until it is learned again. The value can be tuned per VLAN where the platform supports it.

Question 7Layer 2 Switching or VLANs

How does a Layer 2 switch populate its MAC address table?

  1. From the source MAC address of frames received on the port Correct answer.
  2. From the destination MAC of frames leaving the port
  3. From the port's configured VLAN membership table only
  4. From ARP replies cached by the routing engine

Explanation

The switch records the source MAC of each ingress frame together with the port and VLAN on which it arrived. Forwarding decisions then use the destination MAC to look up the correct egress port. Entries are refreshed each time the source address is seen again and age out when idle.

Question 8Layer 2 Switching or VLANs

An 802.1Q trunk port receives a frame that carries no VLAN tag. How does the switch classify that frame?

  1. It places the frame in the highest-numbered VLAN configured on the trunk.
  2. It drops the frame, because trunk ports accept only tagged frames.
  3. It places the frame in the trunk's native VLAN. Correct answer.
  4. It places the frame in VLAN 0, which is reserved for untagged traffic.

Explanation

Untagged frames arriving on a trunk are assigned to the native VLAN of that port, which by default is VLAN 1 in Junos. The same native VLAN is used to send that VLAN's traffic untagged toward the peer. Both ends should be configured with the same native VLAN ID.

Question 9Layer 2 Switching or VLANs

How is the root bridge chosen in a spanning tree topology?

  1. The bridge with the highest configured priority and the lowest MAC address
  2. The bridge that has been powered on the longest
  3. The bridge with the most ports in the forwarding state
  4. The bridge with the lowest bridge ID (priority plus MAC address) Correct answer.

Explanation

The bridge ID is the bridge priority followed by the bridge MAC address, and the numerically lowest value wins. Priority is compared first, so a lower priority beats a better MAC address. If priorities tie, the lower MAC address becomes the root.

Question 10Layer 2 Switching or VLANs

In what increments can the STP bridge priority be configured on Junos switches?

  1. In increments of 1
  2. In increments of 8192
  3. In increments of 16
  4. In increments of 4096 Correct answer.

Explanation

The bridge priority occupies the most significant bits of the 16-bit bridge ID, leaving 4 bits for a multiplier. Valid values therefore run from 0 to 61440 in steps of 4096, such as 0, 4096, 8192, and so on. Administrators lower the priority on the intended root bridge.

Question 11Layer 2 Switching or VLANs

An interface is configured as an RSTP edge port and its link comes up with no BPDU received. What happens?

  1. The port passes through listening and learning before it forwards.
  2. The port goes straight to forwarding without causing a topology change. Correct answer.
  3. The port stays in the discarding state until it receives a BPDU.
  4. The port sends a proposal to its neighbor and waits for agreement.

Explanation

Edge ports are expected to connect to end stations, so RSTP moves them directly to forwarding on link up. Because no topology change is signalled, other bridges are not disturbed and the connected host can transmit immediately. If a BPDU is later received, the port loses its edge status.

Question 12Layer 2 Switching or VLANs

Which Junos RSTP setting blocks an edge port that receives a BPDU?

  1. no-root-port
  2. layer2-control
  3. mac-limit
  4. bpdu-block-on-edge Correct answer.

Explanation

bpdu-block-on-edge gives edge ports BPDU-guard behavior: if a BPDU arrives, the port is blocked so a rogue switch cannot inject spanning tree information. This protects the topology while still allowing hosts to connect without waiting for STP. The port can be recovered by clearing the blocking state or after the configured timeout.

Question 13Layer 2 Switching or VLANs

A switch receives a unicast frame whose destination MAC address is not in its MAC table. What does the switch do with the frame?

  1. It drops the frame and generates a log message.
  2. It sends the frame only to the default gateway port.
  3. It floods the frame out of every other port in the same VLAN. Correct answer.
  4. It floods the frame out of every port in every VLAN on the switch.

Explanation

An unknown unicast frame is treated like a broadcast and flooded within its own VLAN only. Flooding is scoped to the VLAN so other broadcast domains are not affected. Once the destination replies, its source MAC is learned and later frames are unicast.

Question 14Layer 2 Switching or VLANs

What provides an in-band Layer 3 gateway for hosts in a VLAN on a Junos switch?

  1. A static route pointing at the VLAN's broadcast address
  2. An access port in the VLAN with an IP address on the physical interface
  3. A routed interface bound to the trunk's native VLAN
  4. An IRB interface that carries the VLAN's IP address Correct answer.

Explanation

An IRB interface is a logical Layer 3 interface associated with a VLAN, and hosts use its address as their default gateway. Traffic between VLANs is then routed by the switch instead of being bridged. One IRB unit is typically configured per VLAN that needs routing.

Question 15Layer 2 Switching or VLANs

A port connects an IP phone that has a PC attached to its internal switch. How is the traffic normally separated?

  1. The switch tags every frame with the voice VLAN ID and the phone strips the tag for the PC.
  2. The phone tags voice traffic with the voice VLAN ID and sends PC traffic untagged. Correct answer.
  3. The phone places its own traffic in the native VLAN and tags the PC traffic.
  4. Both PC and voice traffic are placed in the voice VLAN and tagged.

Explanation

The phone marks its own RTP and signalling traffic with the voice VLAN tag while passing PC frames untagged to the access VLAN of the port. The switch port is configured with both VLANs as members so both streams are carried. This keeps latency-sensitive voice traffic in its own broadcast domain and QoS policy.

Question 16Layer 2 Switching or VLANs

Which Junos RSTP interface setting keeps a port from ever being elected as the root port?

  1. bpdu-block-on-edge
  2. no-root-port Correct answer.
  3. edge
  4. interface-mac-limit

Explanation

no-root-port implements root protection: the interface is prevented from becoming the root port even if it receives superior BPDUs. This is used on ports facing access devices so an unauthorized switch cannot move the root bridge. Topology stability is preserved because the legitimate root remains in place.

Question 17Layer 2 Switching or VLANs

Two switches are joined by a trunk where one side uses native VLAN 10 and the other uses native VLAN 20. What happens to untagged traffic?

  1. Untagged frames are automatically retagged with VLAN 1.
  2. Untagged traffic from VLAN 10 is delivered into VLAN 20. Correct answer.
  3. Untagged frames are duplicated into both VLAN 10 and VLAN 20.
  4. Untagged frames are dropped at both ends.

Explanation

Each side assigns untagged frames to its own native VLAN, so frames leave VLAN 10 untagged and arrive in VLAN 20. The two VLANs are effectively joined for untagged traffic, which is both a connectivity defect and a security risk. Best practice is to match native VLANs on both ends or to leave no access ports in the native VLAN.

Question 18Layer 2 Switching or VLANs

Which statement describes a designated port in spanning tree?

  1. It is the port that is always held in the blocking state.
  2. It is the port on a segment that forwards traffic toward the root bridge. Correct answer.
  3. It is any port that has been configured as an edge port.
  4. It is the port on a non-root bridge that provides the best path to the root.

Explanation

Every Layer 2 segment has exactly one designated port, and it is the port closest to the root bridge for that segment. Designated ports forward traffic toward the root and are the only ports that send BPDUs onto the segment. On the root bridge itself, all active ports are designated.

Question 19Layer 2 Switching or VLANs

A non-root bridge has two interfaces with equal root path cost. Which tie-breaker does RSTP apply first to select the root port?

  1. The highest port priority, then the highest port number
  2. The oldest BPDU received, then the shortest uptime
  3. The lowest designated bridge ID, then the lowest designated port ID Correct answer.
  4. The lowest local port MAC address, then the highest port number

Explanation

After root path cost, STP compares the bridge ID of the designated bridge that sent the BPDU, preferring the lower value. If those match, the lower designated port ID decides. As a final tie-breaker the local port ID on the receiving bridge is used.

Question 20Layer 2 Switching or VLANs

Two Junos switches run MSTP and must belong to the same MSTP region. Which parameters must match?

  1. Hostname, management subnet, and STP protocol version
  2. Bridge priority, port cost, and hello time
  3. VLAN IDs in use, MAC addresses, and root bridge ID
  4. Region name, revision level, and VLAN-to-instance mapping Correct answer.

Explanation

MSTP regions are defined by the region name, the revision number, and the mapping of VLANs to MST instances. Only switches with all three values in common belong to the same region and share its IST. Bridge priority and timers affect topology but do not define region membership.

Question 21Layer 2 Switching or VLANs

How does VSTP differ from RSTP on Junos switches?

  1. VSTP uses 802.1D timers, while RSTP uses per-VLAN hello timers.
  2. VSTP is the Juniper implementation of MSTP and requires region configuration.
  3. VSTP operates only on aggregated Ethernet interfaces.
  4. VSTP builds one spanning tree per VLAN; RSTP builds a single tree for all VLANs. Correct answer.

Explanation

VSTP runs an independent RSTP instance in each VLAN, so a loop in one VLAN does not block ports for the other VLANs. Standard RSTP on the switch maintains a single topology shared by all VLANs, so a blocked port is blocked for every VLAN. VSTP is useful when per-VLAN load balancing of the tree is required.

Question 22Layer 2 Switching or VLANs

In a Q-in-Q provider network, what does the provider edge device do to a customer frame that already carries a VLAN tag?

  1. It rewrites the customer tag as the provider's native VLAN ID.
  2. It adds an outer provider tag and leaves the customer tag intact. Correct answer.
  3. It removes the customer tag and forwards the frame as untagged.
  4. It drops tagged frames and permits only untagged customer traffic.

Explanation

Q-in-Q, or 802.1ad provider bridging, stacks a second 802.1Q tag in front of the customer tag. The outer tag identifies the service instance inside the provider network while the inner tag remains meaningful only to the customer. This lets overlapping customer VLAN IDs be carried transparently across the provider backbone.

Question 23Layer 2 Switching or VLANs

In RSTP, a designated port sends a proposal to its neighbor. What does the neighbor do when it accepts the proposal?

  1. It sends a topology change notification to the root bridge before it forwards.
  2. It replies with an agreement, makes the port its root port, and synchronizes its other ports. Correct answer.
  3. It waits for the max-age timer to expire before it starts forwarding traffic.
  4. It replies with an agreement and keeps all of its other ports in the discarding state.

Explanation

The proposal/agreement handshake lets RSTP converge a point-to-point link without waiting for timer expiry. The receiving bridge makes the port its root port, agrees, and then synchronizes by moving its other non-edge ports to discarding. Edge ports and already synchronized ports are unaffected.

Question 24Spanning Tree

Two switches advertise the same configured bridge priority on a LAN segment. Which value decides which of them becomes the root bridge?

  1. The highest MAC address of the switch
  2. The lowest numeric port ID on the switch
  3. The lowest MAC address of the switch Correct answer.
  4. The switch with the greatest number of active ports

Explanation

The bridge ID is a combination of the 2-byte bridge priority and the 6-byte system MAC address, and the lowest bridge ID wins the root election. When priorities are equal, the comparison falls through to the MAC address, where the numerically lower value is preferred.

Question 25Spanning Tree

What is the default bridge priority value for a Junos switch running RSTP?

  1. 61440
  2. 65535
  3. 4096
  4. 32768 Correct answer.

Explanation

The bridge priority field is 2 bytes, and Junos defaults it to the mid-range value 32768 so that an administrator can move a switch either up or down in the election. Priorities are configured in increments of 4096.

Question 26Spanning Tree

What is the default hello time used by IEEE 802.1D spanning tree?

  1. 10 seconds
  2. 4 seconds
  3. 1 second
  4. 2 seconds Correct answer.

Explanation

The default hello time is 2 seconds, which is the interval at which the root bridge generates configuration BPDUs. All bridges inherit the root's hello time from the received BPDU.

Question 27Spanning Tree

What is the default max age timer value in IEEE 802.1D spanning tree?

  1. 15 seconds
  2. 20 seconds Correct answer.
  3. 2 seconds
  4. 30 seconds

Explanation

Max age defaults to 20 seconds and defines how long a bridge keeps a BPDU it has received before considering the information stale. If no new BPDU arrives within that window, the topology is recalculated.

Question 28Spanning Tree

Which list describes the port states defined by IEEE 802.1D STP?

  1. Blocking, listening, forwarding
  2. Blocking, listening, learning, forwarding, disabled Correct answer.
  3. Discarding, learning, forwarding
  4. Initializing, blocking, learning, forwarding

Explanation

Classic 802.1D defines five port states: blocking, listening, learning, forwarding, and disabled. The listening and learning states each last one forward delay interval, which is why 802.1D convergence is slow.

Question 29Spanning Tree

Which three port states are defined by RSTP (IEEE 802.1w)?

  1. Discarding, listening, forwarding
  2. Blocking, learning, forwarding
  3. Blocking, listening, forwarding
  4. Discarding, learning, forwarding Correct answer.

Explanation

RSTP collapses the five 802.1D states into three: discarding, learning, and forwarding. Blocking, listening, and disabled are all folded into the discarding state, since they behave identically from a forwarding perspective.

Question 30Spanning Tree

Using the original IEEE 802.1D short path-cost method, which cost is assigned to a 1 Gbps link?

  1. 4 Correct answer.
  2. 100
  3. 2
  4. 19

Explanation

The short method uses small integers scaled by link speed: 100 for 10 Mbps, 19 for 100 Mbps, 4 for 1 Gbps, and 2 for 10 Gbps. Lower cost means the link is more preferred when building the path to the root.

Question 31Spanning Tree

Which RSTP port role stays in the discarding state while providing an alternative path toward the root bridge?

  1. Alternate port Correct answer.
  2. Root port
  3. Designated port
  4. Backup port

Explanation

An alternate port receives BPDUs from another bridge that are inferior to those arriving on the root port, so it remains discarding but can take over quickly if the root port fails. A backup port is instead a stand-in for a designated port on the same shared segment.

Question 32Spanning Tree

What is the effect of configuring an RSTP interface as an edge port?

  1. It blocks the interface whenever a topology change is detected
  2. It stops transmitting BPDUs on that interface
  3. It goes directly to forwarding when the link comes up, skipping the proposal and agreement exchange Correct answer.
  4. It is always elected as the designated port for the segment

Explanation

Edge ports connect to end stations that do not run spanning tree, so RSTP places them straight into forwarding on link-up to avoid an unnecessary proposal/agreement cycle. They still participate normally if a BPDU is later received, depending on the protections configured.

Question 33Spanning Tree

A Junos switch has bpdu-block-on-edge configured. What happens when a BPDU is received on an edge port?

  1. The BPDU is silently dropped and the port keeps forwarding
  2. The port is blocked and stays down until it is cleared or auto-recovery restores it Correct answer.
  3. The port is converted into a non-edge trunk port
  4. The switch immediately becomes the root bridge for that VLAN

Explanation

BPDU protection assumes edge ports should never see BPDUs; receiving one indicates a misconfiguration or a rogue switch. Junos therefore disables the interface, and an administrator must clear it with the spanning-tree clear command unless bpdu-block-on-edge with auto-recovery is configured.

Question 34Spanning Tree

What does root protection (no-root-port) accomplish on a Junos switch?

  1. It stops a port from becoming the root port if a superior BPDU is received Correct answer.
  2. It forces the port to remain the designated port on its segment
  3. It blocks the port when a topology change notification arrives
  4. It prevents the port from forwarding the BPDUs it receives

Explanation

Root protection is applied on ports facing the access network so that an unauthorized or misconfigured switch cannot take over as root. If a superior BPDU arrives, the port is placed in the root-inconsistent (blocking) state instead of being accepted as the root port.

Question 35Spanning Tree

What is the purpose of loop protection (no-loopback) on a Junos RSTP interface?

  1. It disables the interface when any BPDU is received on it
  2. It keeps an alternate or backup port from moving to forwarding and raises an alarm Correct answer.
  3. It shortens convergence by skipping the learning state
  4. It prevents the local switch from ever becoming the root bridge

Explanation

Loop protection guards against unidirectional link failures in which a blocking port stops receiving BPDUs and therefore believes it may transition to forwarding. When such a transition is about to occur, Junos keeps the port in its current state and generates an alarm so the fault is visible.

Question 36Spanning Tree

Which three values must match for two switches to be members of the same MSTP region?

  1. Region ID, root priority, and path-cost method
  2. Configuration name, revision level, and VLAN-to-instance mapping Correct answer.
  3. Bridge priority, hello time, and forward delay
  4. System MAC address, hostname, and management address

Explanation

MSTP identifies a region by a configuration identifier made of the region name, the revision level, and a digest of the VLAN-to-instance mapping table. All three must match exactly; otherwise the switches treat each other as belonging to different regions and use the common spanning tree between them.

Question 37Spanning Tree

What does VSTP provide on a Junos switch?

  1. A single spanning-tree instance shared by all VLANs
  2. A separate RSTP instance per VLAN with BPDUs tagged by VLAN ID Correct answer.
  3. Loop-free load sharing without any per-VLAN configuration
  4. A link-state replacement protocol for spanning tree

Explanation

VSTP runs an independent RSTP instance for each participating VLAN, which allows per-VLAN topologies and lets a Junos switch interoperate with Cisco PVST+ environments. BPDUs are carried with the IEEE 802.1Q tag of the VLAN they belong to.

Question 38Spanning Tree

How is the root path cost of a bridge port determined?

  1. The sum of the port costs along the path back to the root bridge Correct answer.
  2. The highest port cost along the path to the root
  3. The link bandwidth of the root port divided by ten
  4. The cost of the port's own link only

Explanation

Each bridge adds the cost of the port on which a BPDU was received to the root path cost carried in that BPDU. The result is the cumulative cost of the whole path to the root, and the port advertising the lowest value becomes the root port.

Question 39Spanning Tree

In RSTP, what happens when a non-edge port transitions to forwarding?

  1. A TCN BPDU is unicast to the root, which acknowledges it
  2. Nothing happens until the max age timer expires
  3. The change is propagated through the topology and bridges flush their MAC address entries Correct answer.
  4. A new root bridge election is triggered

Explanation

In RSTP a topology change is detected when a non-edge port starts forwarding, and the detecting bridge sets the topology change flag in its BPDUs. Neighbours relay the flag toward the rest of the topology, and each bridge flushes the MAC entries learned on the affected ports so traffic is relearned quickly.

Question 40Spanning Tree

A Junos EX Series switch is powered on with no spanning-tree configuration at all. Which protocol is running on its switched ports?

  1. STP (IEEE 802.1D)
  2. RSTP Correct answer.
  3. VSTP
  4. MSTP

Explanation

Junos enables RSTP by default on EX Series switches, so a factory-default device already provides loop prevention with rapid convergence. The other modes must be explicitly enabled and, where relevant, configured.

Question 41Spanning Tree

Which port on a shared LAN segment is elected as the designated port?

  1. The port with the lowest path cost on the non-root switch
  2. The port with the highest port priority value
  3. The port with the lowest port ID on the root bridge
  4. The port whose BPDU advertises the best path to the root bridge Correct answer.

Explanation

On any segment exactly one port is designated and it is the one advertising the best BPDU, meaning the lowest root path cost, then the lowest sender bridge ID, then the lowest port ID. The designated port is responsible for sending BPDUs onto that segment toward the root.

Question 42Spanning Tree

On a point-to-point RSTP link, a downstream bridge receives a proposal BPDU from its new upstream neighbour. What does the downstream bridge do before replying with an agreement?

  1. It synchronizes by setting its non-edge designated ports to discarding Correct answer.
  2. It places the port that received the proposal into the blocking state
  3. It sends a topology change notification toward the root bridge
  4. It waits one forward delay interval for the timers to expire

Explanation

RSTP's proposal/agreement handshake relies on a synchronization step: the receiving bridge puts all of its other non-edge ports into discarding so the new link cannot create a transient loop. Once synchronized, it returns an agreement and the proposal port moves directly to forwarding.

Question 43Spanning Tree

Which MSTP instance is the Internal Spanning Tree (IST) that presents the region as a single virtual bridge to the common spanning tree?

  1. The instance with the lowest VLAN mapped to it
  2. The instance with the highest instance ID
  3. Instance 0 Correct answer.
  4. The instance designated as the master instance by priority

Explanation

Instance 0 is always the IST and it carries the CST information as well as any VLANs explicitly mapped to it. The whole region appears as one bridge to the outside world through the IST, and additional instances are numbered 1 through 4094.

Question 44Spanning Tree

Which statement about VSTP on Junos is correct?

  1. VSTP cannot interoperate with Cisco PVST+
  2. Each VLAN runs its own RSTP instance and sends BPDUs tagged with that VLAN ID Correct answer.
  3. A single instance runs for all VLANs using untagged BPDUs
  4. All VLANs must share the same bridge priority value

Explanation

VSTP instantiates a separate RSTP state machine for every VLAN that has VSTP enabled, and its BPDUs carry the matching 802.1Q VLAN tag. This per-VLAN behaviour is what allows different VLANs to use different root bridges and to interoperate with PVST+ domains.

Question 45Spanning Tree

A port configured with root protection receives a superior BPDU on a Junos switch. What is the resulting port state?

  1. Designated forwarding, while the existing root port is retained
  2. Root-inconsistent (blocking) until superior BPDUs stop arriving Correct answer.
  3. Forwarding, with an SNMP trap generated
  4. Administratively disabled until an operator clears it

Explanation

Root protection places the receiving port in the root-inconsistent state, which behaves like a blocking port, so the superior BPDU cannot displace the legitimate root. Unlike BPDU protection, the port recovers automatically once the superior BPDUs stop arriving.

Question 46Spanning Tree

An RSTP-enabled switch port receives a BPDU formatted for classic IEEE 802.1D spanning tree. How does the port behave?

  1. It disables RSTP globally on the switch
  2. It falls back to 802.1D behaviour and timers for that segment Correct answer.
  3. It discards the legacy BPDU and continues the proposal/agreement process
  4. It blocks the port permanently to avoid topology loops

Explanation

RSTP is backward compatible: when a port receives a version 0 BPDU it operates in 802.1D mode on that segment and uses the legacy timers, while remaining ports keep RSTP behaviour. The port migrates back to RSTP once legacy BPDUs stop arriving.

Question 47Layer 2 Security

On a Junos EX Series switch, DHCP snooping is enabled for a VLAN. What is the default trust state of the switch interfaces for DHCP snooping?

  1. All access interfaces are untrusted and all trunk interfaces are trusted.
  2. All interfaces are trusted by default.
  3. Interfaces become trusted once the DHCP snooping database is populated.
  4. All interfaces are untrusted by default. Correct answer.

Explanation

Junos treats every interface as untrusted when DHCP snooping is enabled, so DHCP server replies are dropped unless the port is explicitly marked trusted. Trust is normally configured only on the uplink toward the legitimate DHCP server or relay. The state is administrative and does not change when database entries are learned.

Question 48Layer 2 Security

In an 802.1X deployment on a Junos switch, which role does the switch itself perform?

  1. Authentication server, because it validates credentials against its local database
  2. Supplicant, because it supplies its credentials to the authentication server
  3. Authenticator, controlling port access based on the authentication result Correct answer.
  4. Key server, because it distributes session keys to the client and the switch

Explanation

802.1X defines three roles: the supplicant is the end-user client, the authenticator is the switch that controls access to the LAN, and the authentication server is the RADIUS server that validates credentials. The switch relays EAP messages between supplicant and server and enforces the decision on the port.

Question 49Layer 2 Security

Which Junos firewall filter family is used on an EX Series switch to filter frames based on Layer 2 fields such as source MAC address?

  1. family ethernet-switching Correct answer.
  2. family inet
  3. family mpls
  4. family bridge

Explanation

Filters of family ethernet-switching are applied to Layer 2 interfaces and can match on source-mac, destination-mac, ether-type, and VLAN-related fields. Other families match headers that exist only at higher layers.

Question 50Layer 2 Security

In a private VLAN configuration on an EX Series switch, which secondary VLAN type prevents hosts in that VLAN from communicating with each other while still allowing them to reach the promiscuous port?

  1. isolated VLAN Correct answer.
  2. community VLAN
  3. primary VLAN
  4. tagged VLAN

Explanation

Private VLANs use a primary VLAN plus secondary VLANs. An isolated secondary VLAN permits hosts to talk only to the promiscuous port, while a community VLAN allows hosts within the community to talk to each other as well as to the promiscuous port.