Pass the Juniper JNCIS-ENT JN0-352 Questions and answers with CertsForce

Root bridge election is based on comparing each switch's full Bridge Identifier, which combines the bridge priority value with the switch's MAC address, with priority always evaluated first and MAC address serving strictly as a tiebreaker when two or more switches present identical priority values. In this scenario, the network has been left entirely at the default spanning-tree configuration, meaning every switch is operating at the standard IEEE and Junos default bridge priority of 32768; since all three switches share the exact same priority value, the comparison necessarily falls through to the MAC address tiebreak, where the switch with the numerically lowest MAC address wins the election. Comparing the three addresses shown — 00:1a:2b:3c:4d:01, 00:1a:2b:3c:4d:02, and 00:1a:2b:3c:4d:03 — Switch A's address is the lowest, since only the final octet differs and 01 is less than both 02 and 03, making Switch A the elected root bridge. RSTP uses the identical Bridge ID comparison mechanism as legacy STP for root election, so there is no special 'median MAC address' rule that applies uniquely under RSTP, making that distractor factually invalid regardless of protocol version. The election process also does not require any manual bridge priority configuration to complete; the default priority value is entirely sufficient on its own to allow a deterministic election to occur, since default priorities are still numerically comparable Bridge IDs. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Default Priority and MAC Address Tiebreaking.

MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching – Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.

Voice VLAN is the Junos feature specifically designed to allow a single access port to simultaneously handle two distinct traffic streams: untagged data traffic from a PC or workstation using the port's normal access VLAN, and separately tagged voice traffic generated by an IP telephone that is typically daisy-chained between the switch port and the connected PC. When voice VLAN is configured on an access interface, the switch instructs the attached IP phone (commonly via LLDP-MED) which VLAN ID to tag its voice traffic with, and the switch is then able to correctly classify and prioritize that tagged voice traffic into its designated voice VLAN while simultaneously continuing to treat any untagged frames arriving on that same physical port as belonging to the port's regular, untagged access VLAN — precisely satisfying the requirement to accept both tagged and untagged traffic together on one access port. Native VLAN, by contrast, is a trunk-port-only concept that designates which VLAN untagged frames on a trunk should be associated with; it has no applicability to an access port and does not enable simultaneous tagged traffic acceptance there. Default VLAN simply refers to the VLAN an interface belongs to absent other configuration and carries no dual-traffic capability. IRB interfaces provide Layer 3 gateway functionality for a VLAN and are unrelated to how tagged versus untagged frames are accepted at Layer 2 on a given physical port. Reference topics: Junos Enterprise Switching – VLANs, Configuring Voice VLAN on Access Interfaces.

A functioning GRE tunnel interface in Junos requires, at minimum, both a tunnel source address and a tunnel destination address configured together under the tunnel statement of the gr- logical unit, since these two values together define the outer, delivery-layer IP header that will encapsulate every passenger packet sent through the tunnel; the source identifies which of the router's own addresses will originate the encapsulated traffic, and the destination identifies the remote tunnel endpoint the encapsulated traffic must be routed toward across the underlying IP network. The first option correctly supplies both required values in a single, complete statement — source 192.168.1.1 (Router A's own address) and destination 192.168.2.1 (Router B's address) — fully defining the tunnel's endpoints and ensuring the encapsulation and route-resolution process can succeed. The fourth option supplies only the destination and omits the source entirely, which is an incomplete configuration; without an explicit source, Junos cannot always reliably determine which local address to use for encapsulation, particularly on multi-address or multi-interface routers, and the tunnel configuration is left non-deterministic or non-functional as shown. The second option enables the IPv6 protocol family on the tunnel's logical unit, which is irrelevant to a scenario explicitly requiring IPv4 passenger traffic support. The third option attempts to assign a family inet address directly using one of the underlying tunnel endpoint addresses, which conflates the tunnel's own transport addressing with logical-unit protocol addressing and does not by itself establish the required source/destination tunnel definition. Reference topics: Junos Enterprise Routing – Tunneling, Configuring GRE Tunnel Source and Destination.

In the output of show ospf database, Junos marks every self-originated link-state advertisement with an asterisk immediately preceding the LSA's link-state ID. A self-originated LSA is one that was created and flooded by the router on which the command is being executed, as opposed to an LSA that was received from and originated by a neighboring router elsewhere in the area. In this exhibit, the asterisked Router LSA has an ID of 10.101.100.0 and an Advertising Router value of the same 10.101.100.0, confirming that this particular Router LSA describes the local device's own links, area membership, and interface costs, and that the local router itself flooded this LSA into the area's link-state database. This distinction matters operationally because when troubleshooting OSPF topology or SPF calculation issues, engineers frequently need to isolate their own router's advertised state from the states advertised by every other router in the area; the asterisk provides an immediate, unambiguous visual cue for that separation without needing to cross-reference the router's own ID separately. It has no relationship to designated router or backup designated router status — DR/BDR roles are indicated elsewhere in interface-level output, not through the asterisk convention in the LSA database dump, and a router that is neither DR nor BDR still self-originates and flags its own Router LSA the same way. Reference topics: Junos Enterprise Routing – OSPF, Interpreting the OSPF Link-State Database.

By default, EBGP sessions are built with the expectation that peers are directly connected at Layer 3, and Junos enforces this by sending EBGP packets with a TTL of 1. When loopback addresses are used as the session endpoints instead of the directly connected physical interface addresses, the resulting IP packets must traverse at least one additional router hop between the two loopbacks, and a TTL of 1 will expire in transit before reaching the remote loopback, causing the TCP handshake — and therefore the BGP session — to fail even though a valid route to the peer's loopback exists. The multihop statement (configured as an EBGP multihop parameter with an accompanying TTL value, most commonly set to 2 for a single intermediate hop) instructs Junos to increase the TTL used for that peer's BGP packets so they survive the extra hop count between loopbacks. This is a mandatory addition any time an EBGP session is deliberately built against non-directly-connected addresses, whereas IBGP sessions, by contrast, do not have this default restriction because IBGP already assumes peers may be multiple hops apart within the same AS. Multipath affects load-balancing across equal-cost paths, damping suppresses flapping routes, and passive controls whether a router waits for the remote peer to initiate the TCP connection — none of these resolve the TTL expiration problem inherent to loopback-based EBGP peering. Reference topics: Junos Enterprise Routing – BGP, Configuring EBGP Multihop Sessions.

The described symptom — excessive packet drops specifically attributed to exceeding the MTU on a GRE tunnel carrying full-size video streaming traffic across default-MTU gigabit Ethernet interfaces — is a direct consequence of the 24 bytes of GRE encapsulation overhead pushing packets that were already at or near the standard 1500-byte Ethernet MTU past the physical interface's transmission limit once the outer GRE and IP headers are added. The most durable fix is to proactively increase the physical member interfaces' MTU beyond the 1500-byte default — to 1524 bytes or higher — which provides sufficient headroom to absorb the full GRE encapsulation overhead without ever causing the fully encapsulated packet to exceed the interface's transmission capability, allowing full-size 1500-byte payloads to pass through the tunnel intact and without fragmentation or drops. As a complementary measure, configuring the clear-dont-fragment-bit option on the tunnel or member interfaces instructs Junos to clear the DF (don't fragment) bit on oversized packets rather than dropping them outright when they do exceed the available MTU, allowing the Packet Forwarding Engine to fragment and later reassemble the traffic instead of silently discarding it, which directly addresses the reported packet loss even under transient conditions. Simply raising the MTU only to 1500 bytes fails to account for the 24-byte GRE overhead and would not resolve the underlying oversize condition. Routing the tunnel over a higher-bandwidth link addresses potential congestion but does nothing to correct an MTU-based packet-size violation, which is the root cause explicitly identified in this scenario. Reference topics: Junos Enterprise Routing – Tunneling, GRE MTU Sizing and Fragmentation Handling for High-Throughput Applications.

The Backup Designated Router exists specifically to provide immediate failover redundancy for the Designated Router role on a multi-access broadcast or NBMA segment: the BDR maintains full adjacencies with every other router on the segment concurrently with the DR, precisely so that if the DR ever fails or is withdrawn, the BDR can be promoted directly to DR essentially instantaneously, without needing to wait through a fresh, full DR/BDR election process, and a new BDR election then takes place separately among the remaining DROther routers to fill the now-vacant backup role. This immediate promotion behavior confirms the first statement as correct. The Designated Router's other core responsibility on the segment is originating the Type 2 Network LSA, which describes the multi-access network itself as a pseudonode, listing every router attached to that segment; this LSA type exists specifically to avoid the full-mesh explosion of Router LSA adjacency listings that would otherwise be needed to describe a shared broadcast segment, and only the DR — never the BDR, and never any DROther — is responsible for generating and maintaining this particular LSA under normal, stable conditions, which confirms the third statement while directly ruling out the fourth. There is no such thing as the DR 'electing' an area border router; ABR status is instead a role a router acquires organically by having interfaces in more than one OSPF area, entirely independent of any DR/BDR election process on any individual segment. Reference topics: Junos Enterprise Routing – OSPF, DR/BDR Roles and Type 2 Network LSA Origination.

The intent of this filter is to match and discard traffic from one single, specific host MAC address, which requires the source-mac-address match condition to reference the complete, exact 48-bit address using an explicit /48 mask (or no mask at all, which Junos treats as an implicit full match) so that only that one precise address is matched. As configured, the term instead specifies a /40 mask on 00:12:34:56:00:07, meaning only the first 40 bits (the first five octets, 00:12:34:56:00) are actually significant to the match, while the sixth octet is effectively wildcarded across its full range; this produces an imprecise, overly broad match criterion rather than the single-host match the administrator intended, and is a common configuration mistake that undermines the predictability and correctness of MAC-based filtering. The lesson tested here is that source and destination MAC address match conditions in Junos firewall filters must be specified with the correct, deliberate, and explicit prefix length appropriate to the intended scope — typically /48 for a single exact host — rather than an arbitrary or miscalculated mask value. Firewall filters under family ethernet-switching are fully capable of matching on both source-mac-address and destination-mac-address, which rules out that option entirely. Layer 2 MAC-based filters function correctly on both access and trunk interface modes, so interface type is not a limiting factor here. There is no indication in the exhibit that the filter's application direction (input versus output) is reversed. Reference topics: Junos Enterprise Switching – Layer 2 Security, MAC Address Match Conditions and Prefix Length Precision.