Enhance Your Career With Available Preparation Guide for JN0-351 Exam
Get Special Discount Offer of JN0-351 Certification Exam Sample Questions and Answers
Juniper JN0-351 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 20
In RSTP, which three port roles are associated with the discarding state? (Choose three.)
- A. backup
- B. root
- C. disabled
- D. alternate
- E. designated
Answer: A,C,D
Explanation:
Explanation
In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree123. The roles include root, designated, alternate, backup, and disabled123.
The discarding state is associated with the backup, alternate, and disabled roles123. In a stable topology with consistent port roles throughout the network, RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state2. Disabled ports are also in the discarding state3.
Therefore, options B, C, and D are correct.
NEW QUESTION # 21
Which two statements are true about the default VLAN on Juniper switches? (Choose two.)
- A. The default VLAN ID is not visible.
- B. The default VLAN ID is not assigned to any interface.
- C. The default VLAN ID can be changed.
- D. The default VLAN is set to a VLAN ID of 1 by default
Answer: C,D
Explanation:
Explanation
On Juniper switches, the default VLAN is set to a VLAN ID of 1 by default12. This means that all interfaces on the switch are members of VLAN 1 until they are specifically assigned to another VLAN12. Therefore, option A is correct.
The default VLAN ID can be changed12. This allows network administrators to configure the switch to use a different VLAN as the default, if necessary12. Therefore, option D is correct.
NEW QUESTION # 22
Which two statements are correct about using firewall filters on EX Series switches? (Choose two.)
- A. You can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.
- B. You can deploy only stateless firewall filters on an EX Series switch.
- C. You can only apply firewall filters to Layer 2 traffic on an EX Series switch.
- D. You can deploy both stateless and stateful firewall filters on an EX Series switch.
Answer: A,B
Explanation:
A is correct because you can deploy only stateless firewall filters on an EX Series switch. A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers1. A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or sessioninformation1. EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters2.
C is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch. Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks3. EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters4. You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.
NEW QUESTION # 23
Refer to the exhibit.
Referring to the output shown in the exhibit, which statement is correct?
- A. The state is normal for a DR neighbor.
- B. An MTU mismatch exists between the OSPF neighbors.
- C. An area ID mismatch exists between the OSPF neighbors
- D. The state is normal for a DRother neighbor
Answer: D
Explanation:
Explanation
In OSPF, the state of the neighbor relationship is determined by the exchange of OSPF packets between routers1. The state "2Way" as shown in the exhibit indicates that bi-directional communication has been established between the two OSPF routers1. This is the normal state for a neighbor that is not the Designated Router (DR) or Backup Designated Router (BDR) on a broadcast, non-broadcast multi-access (NBMA), or point-to-multipoint network1. These neighbors are often referred to as "DRothers"1. Therefore, option B is correct.
NEW QUESTION # 24
Which two statements are correct about tunnels? (Choose two.)
- A. Tunnel endpoints must have a valid route to the remote tunnel endpoint.
- B. IP-IP tunnels are stateful.
- C. BFD cannot be used to monitor tunnels.
- D. Tunnels add additional overhead to packet size.
Answer: A,D
Explanation:
Explanation
A tunnel is a connection between two computer networks, in which data is sent from one network to another through an encrypted link. Tunnels are commonly used to secure data communications between two networks or to connect two networks that use different protocols.
Option B is correct, because tunnel endpoints must have a valid route to the remote tunnel endpoint. A tunnel endpoint is the device that initiates or terminates a tunnel connection. For a tunnel to be established, both endpoints must be able to reach each other over the underlying network. This means that they must have a valid route to the IP address of the remote endpoint1.
Option D is correct, because tunnels add additional overhead to packet size. Tunnels work by encapsulating packets: wrapping packets inside of other packets. This means that the original packet becomes the payload of the surrounding packet, and the surrounding packet has its own header and trailer. The header and trailer of the surrounding packet add extra bytes to the packet size, which is called overhead. Overhead can reduce the efficiency and performance of a network, as it consumes more bandwidth and processing power2.
Option A is incorrect, because BFD can be used to monitor tunnels. BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster convergence and fault recovery.
BFD can also be used to monitor the connectivity of tunnels, such as GRE, IPsec, or MPLS.
Option C is incorrect, because IP-IP tunnels are stateless. IP-IP tunnels are a type of tunnels that use IP as both the encapsulating and encapsulated protocol. IP-IP tunnels are simple and easy to configure, but they do not provide any security or authentication features. IP-IP tunnels are stateless, which means that they do not keep track of the state or status of the tunnel connection. Stateless tunnels do not require any signaling or negotiation between the endpoints, but they also do not provide any error detection or recovery mechanisms.
References:
1: What is Tunneling? | Tunneling in Networking 2: What Is Tunnel In Networking, Its Types, And Its Benefits? : [Configuring Bidirectional Forwarding Detection] : [IP-IP Tunneling]
NEW QUESTION # 25
Exhibit.
What is the management IP address of the device shown in the exhibit?
- A. 172.23.12.100
- B. 172.23.11.10
- C. 128.0.0.1
- D. 10.210.20.233
Answer: A
Explanation:
Explanation
The management IP address of a device is the IP address that is used to access the device for configuration and monitoring purposes. It is usually assigned to a dedicatedmanagement interface that is separate from the data interfaces. The management interface can be accessed via SSH, Telnet, HTTP, or other protocols.
In the exhibit, the list of interfaces and their statuses shows that the management interface isme0. This interface has an admin status ofup, a protocol status ofinet, a local address of172.23.12.100/24, and a remote address ofunspecified. This means that the me0 interface is active, has an IPv4 address assigned, and is not connected to another device.
Therefore, the management IP address of the device shown in the exhibit is172.23.12.100.
References:
[Management Interfaces Overview] : [Displaying Interface Status Information]
NEW QUESTION # 26
Exhibit.
You have configured the four EX Series switches with RSTP, as shown in the exhibit. You discover that whenever a link between switches goes up or down, the switches take longer than expected for RSTP to converge, using the default settings.
In this scenario, which action would solve the delay in RSTP convergence?
- A. The max-age must be increased to 20
- B. The hello-time must be increased.
- C. The bridge priority for EX-4 must be set at 4000.
- D. The force-version must be removed.
Answer: D
Explanation:
The exhibit shows the configuration of RSTP on EX-4, which has the command force-version stp. This command forces the switch to use the legacy STP protocol instead of RSTP, even though the switch supports RSTP1. This means that EX-4 will not be able to take advantage of the faster convergence and enhanced features of RSTP, such as edge ports, link type, and proposal/agreement sequence2.
The other switches in the network are likely to be running RSTP, as it is the default protocol for EX Series switches3. Therefore, there will be a compatibility issue between EX-4 and the other switches, which will result in longer convergence times and suboptimal performance. The switch will also generate a warning message that says "Warning: STP version mismatch with neighbor" when it receives a BPDU from a RSTP neighbor1.
To solve this problem, the force-version command must be removed from EX-4, so that it can run RSTP natively and interoperate with the other switches in the network. This will enable faster convergence and better stability for the network topology. To remove the command, you can use the delete protocols rstp force-version command in configuration mode1.
NEW QUESTION # 27
You have two OSPF routers forming an adjacency. R1 has a priority of 32 and a router ID of 192.168.1.2. R2 has a priority of 64 and a router ID of 192.168.1.1. The routers were started at the same time and all other OSPF settings are the default settings.
Which statement is correct in this scenario?
- A. R1 will be the BDR.
- B. Router IDs must match for an adjacency to form.
- C. R2 will be the BDR.
- D. At least three routers are required for a DR/BDR election
Answer: A
Explanation:
Explanation
In OSPF, the Designated Router (DR) and Backup Designated Router (BDR) are elected based on the priority of the routers1. The router with the highest priority becomes the DR, and the router with the second highest priority becomes the BDR1. If there is a tie in priority, then the router with the highest Router ID is chosen1.
In this scenario, R2 has a higher priority (64) than R1 (32), so R2 will become the DR1. Since R1 has the second highest priority, it will become the BDR1. Therefore, option D is correct.
NEW QUESTION # 28
What are two reasons for creating multiple areas in OSPF? (Choose two.)
- A. to increase the number of adjacencies in the backbone
- B. to reduce the convergence time
- C. to reduce LSA flooding across the network
- D. to increase the size of the LSDB
Answer: B,C
Explanation:
Explanation
Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.
Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.
NEW QUESTION # 29
An update to your organization's network security requirements document requires management traffic to be isolated in a non-default routing-instance. You want to implement this requirement on your Junos-based devices.
Which two commands enable this behavior? (Choose two.)
- A. set routing-instances mgmtjunoa interface ge-0/0/0.0
- B. set routing-instances mgmt_junos
- C. set system management-instance
- D. set routing-instances mgmt_junos interface em1
Answer: B,C
Explanation:
Explanation
To isolate management traffic in a non-default routing-instance on Junos-based devices, you can use the set system management-instance and set routing-instances mgmt_junos commands12.
set system management-instance: This command associates the management interface (usually named fxp0 or em0 for Junos OS, or re0:mgmt-* or re1:mgmt-* for Junos OS Evolved) with the non-default virtual routing and forwarding (VRF) instance1. After you configure the non-default management VRF instance, management traffic no longer has to share a routing table with other control traffic or protocol traffic1.
set routing-instances mgmt_junos: This command creates a new routing instance named mgmt_junos. The name of the dedicated management VRF instance is reserved and hardcoded as mgmt_junos; you cannot configure any other routing instance by the name mgmt_junos1.
Therefore, options C and D are correct. Options A and B are not correct because they attempt to assign an interface to the mgmt_junos routing instance, which is not necessary for isolating management traffic1.
NEW QUESTION # 30
After receiving a BGP route, which two conditions are verified by the receiving router to ensure that the received route is valid? (Choose two)
- A. The AS-path length is greater than 0.
- B. The next hop is reachable.
- C. The loops do not exist.
- D. The local preference is greater than 0.
Answer: B,C
Explanation:
B is correct because the loops do not exist is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid. A loop in BGP means that a route has been advertised by the same AS more than once, which can cause routing instability and inefficiency1. To prevent loops, BGP uses the AS-path attribute, which lists the AS numbers that a route has traversed from the origin to the destination2. The receiving router checks the AS-path attribute of the received route and discards it if it finds its own AS number in the list2. This way, BGP avoids accepting routes that contain loops.
C is correct because the next hop is reachable is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid. The next hop is the IP address of the next router that is used to forward packets to the destination network3. The receiving router checks the next hop attribute of the received route and verifies that it has a valid route to reach it3. If the next hop is not reachable, the received route is not usable and is rejected by the receiving router3. This way, BGP ensures that only feasible routes are accepted.
NEW QUESTION # 31
Which statement is correct about controlling the routes installed by a RIB group?
- A. A firewall filter must be configured to install routes in the RIB groups.
- B. An import policy is applied to the RIB group.
- C. Only routes in the last table are installed.
- D. An export policy is applied to the RIB group.
Answer: B
Explanation:
Explanation
A RIB group is a configuration that allows a routing protocol to install routes into multiple routing tables in Junos OS. A RIB group consists of an import-rib statement,which specifies the source routing table, and an export-rib statement, which specifies the destination routing table or group. A RIB group can also include an import-policy statement, which specifies one or more policies to control which routes are imported into the destination routing table or group1.
An import policy is a policy statement that defines the criteria for accepting or rejecting routes from the source routing table. An import policy can also modify the attributes of the imported routes, such as preference, metric, or community. An import policy can be applied to a RIB group by using the import-policy statement under the [edit routing-options rib-groups] hierarchy level1.
Therefore, option A is correct, because an import policy is applied to the RIB group to control which routes are installed in the destination routing table or group. Option B is incorrect, because all routes in the source routing table are imported into the destination routing table or group, unless filtered by an import policy.
Option C is incorrect, because a firewall filter is not used to install routes in the RIB groups; a firewall filter is used to filter packets based on various criteria. Option D is incorrect, because an export policy is not applied to the RIB group; an export policy is applied to a routing protocol to control which routes are advertised to other devices.
References:
1: rib-groups | Junos OS | Juniper Networks
NEW QUESTION # 32
Which statement is correct about IP-IP tunnels?
- A. IP-IP tunnels only support encapsulating non-IP traffic.
- B. There are 24 bytes of overhead with IP-IP encapsulation.
- C. IP-IP tunnels only support encapsulating IP traffic.
- D. The TTL in the inner packet is decremented during transit to the tunnel endpoint.
Answer: C
Explanation:
Explanation
IP-IP tunnels are a type of tunnels that use IP as both the encapsulating and encapsulated protocol. IP-IP tunnels are simple and easy to configure, but they do not provide any security or authentication features. IP-IP tunnels only support encapsulating IP traffic, which means that the payload of the inner packet must be an IP packet. IP-IP tunnels cannot encapsulate non-IP traffic, such as Ethernet frames or MPLS labels1.
Option A is correct, because IP-IP tunnels only support encapsulating IP traffic. Option B is incorrect, because IP-IP tunnels only support encapsulating non-IP traffic. Option C is incorrect, because the TTL in the inner packet is not decremented during transit to the tunnel endpoint. The TTL in the outer packet is decremented by each router along the path, but the TTL in the inner packet is preserved until it reaches the tunnel endpoint2.
Option D is incorrect, because there are 20 bytes of overhead with IP-IP encapsulation. The overhead consists of the header of the outer packet, which has a fixed size of 20 bytes for IPv43.
References:
1: IP-IP Tunneling 2: What is tunneling? | Tunneling in networking 3: IPv4 - Header
NEW QUESTION # 33
Which two statements about BGP facilitate the prevention of routing loops between two autonomous systems?
(Choose two.)
- A. EBGP routers will drop routes that contain their own AS number in the AS_PATH
- B. EBGP routers will prepend their AS number when advertising routes to their neighbors
- C. EBGP routers will append their AS number when advertising routes to their neighbors.
- D. EBGP routers will only accept routes that contain their own AS number in the AS_PATH.
Answer: A,C
Explanation:
Explanation
BGP (Border Gateway Protocol) is a protocol designed to exchange routing and reachability information among autonomous systems (AS) on the internet1.
Option A is correct. When an EBGP router advertises routes to its neighbors, it appends its AS number to the AS_PATH attribute1. This is a key mechanism in BGP to prevent routing loops1.
Option C is correct. BGP has a built-in loop prevention mechanism whereby if a BGP router detects its own AS in the AS_PATH attribute, it will drop the prefix and will not continue to advertise it2. This helps to prevent routing loops2.
Option B is incorrect. EBGP routers do not accept routes that contain their own AS number in the AS_PATH2. Instead, they drop such routes as part of the loop prevention mechanism2.
Option D is incorrect. While it's true that EBGP routers append their AS number when advertising routes, they do not prepend their AS number1. The term "prepend" in BGP usually refers to a technique used to influence path selection by artificially lengthening the AS_PATH3.
NEW QUESTION # 34
You want to ensure traffic is routed through a GRE tunnel.
In this scenario, which two statements will satisfy this requirement? (Choose two.)
- A. Tunnel endpoints must have a route that directs traffic into the tunnel.
- B. BFD must be used on the stateless tunneling protocols.
- C. Keepalives must be used on stateless tunneling protocols.
- D. All intermediary devices must have a route to the tunnel endpoints.
Answer: A,D
Explanation:
Explanation
Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.
Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.
NEW QUESTION # 35
Which statement is correct about graceful Routing Engine switchover (GRES)?
- A. The PFE restarts and the kernel and interface information is lost.
- B. GRES has a helper mode and a restarting mode.
- C. With no other high availability features enabled, routing is preserved and the new master RE does not restart rpd.
- D. When combined with NSR, routing is preserved and the new master RE does not restart rpd.
Answer: D
Explanation:
Explanation
The Graceful Routing Engine Switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails1. GRES preserves interface and kernel information, ensuring that traffic is not interrupted1. However, GRES does not preserve the control plane1.
To preserve routing during a switchover, GRES must be combined with either Graceful Restart protocol extensions or Nonstop Active Routing (NSR)1. When GRES is combined with NSR, nearly 75 percent of line rate worth of traffic per Packet Forwarding Engine remains uninterrupted during GRES1. Any updates to the primary Routing Engine are replicated to the backup Routing Engine as soon as they occur1.
Therefore, when GRES is combined with NSR, routing is preserved and the new master RE does not restart rpd1.
NEW QUESTION # 36
Exhibit
Which command displays the output shown in the exhibit?
- A. show route forwarding-table
- B. show route forwarding-table family ethernet-switching
- C. show ethernet-switching table extensive
- D. show ethernet-switching table
Answer: D
Explanation:
The output shown in the exhibit is a brief display of the Ethernet switching table, which shows the learned Layer 2 MAC addresses for each VLAN and interface1.
The command show ethernet-switching table displays the Ethernet switching table with brief information, such as the destination MAC address, the VLAN name, the forwarding state, and the interface name1.
The command show route forwarding-table displays the routing table information for each protocol family, such as inet, inet6, mpls, iso, and so on2. It does not show the Ethernet switching table or the MAC addresses.
The command show ethernet-switching table extensive displays the Ethernet switching table with extensive information, such as the destination MAC address, the VLAN name, the forwarding state, the interface name, the VLAN index, and the tag type1. It shows more details than the brief output shown in the exhibit.
The command show route forwarding-table family ethernet-switching displays the routing table information for the ethernet-switching protocol family, whichshows the destination MAC address, the next-hop MAC address, and the interface name3. It does not show the VLAN name or the forwarding state.
NEW QUESTION # 37
You need to configure a LAG between your switches. In this scenario, which two statements are correct?
(Choose two.)
- A. Member links are not required to be contiguous ports.
- B. Duplex and speed settings are not required to match on both participating devices.
- C. Member links are required to be contiguous ports.
- D. Duplex and speed settings are required to match on both participating devices.
Answer: A,D
Explanation:
B is correct because duplex and speed settings are required to match on both participating devices. According to the Juniper Networks documentation1, all the interfaces in a LAG must have the same speed and be in full-duplex mode. This ensures that the LAG can operate as a single logical link without any performance or compatibility issues.
C is correct because member links are not required to be contiguous ports. According to the Juniper Networks documentation2, you can group any Ethernet interfaces on a switch into a LAG, regardless of their physical location or slot number. This provides flexibility and scalability for configuring LAGs on switches.
NEW QUESTION # 38
You are concerned about spoofed MAC addresses on your LAN.
Which two Layer 2 security features should you enable to minimize this concern? (Choose two.)
- A. dynamic ARP inspection
- B. DHCP snooping
- C. static ARP
- D. IP source guard
Answer: A,B
Explanation:
A is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping1. DAI discards any ARP packets that do not match the database or have invalid formats1.
C is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks.
DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted. Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports2. DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client2.
NEW QUESTION # 39
You are an operator for a network running 1S-IS. Two routers are failing to form an adjacency. What are two reasons for this problem? (Choose two.)
- A. The family iso configuration is missing from the adjacency interface.
- B. There are mismatched router IDs on the L2 routers.
- C. There is no configured ISO address on any IS-IS interface.
- D. There is a mismatched area ID between the L2 routers.
Answer: A,C
Explanation:
Explanation
The two reasons for the failure to form an adjacency in a network running IS-IS could be:
B: There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured. Without this address, the routers cannot form an adjacency1.
D: The family iso configuration is missing from the adjacency interface. The 'family iso' configuration is essential for IS-IS to function correctly. If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency1.
These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks23.
NEW QUESTION # 40
......
Updated JN0-351 Dumps Questions Are Available For Passing Juniper Exam: https://www.actual4test.com/JN0-351_examcollection.html
New JN0-351 Dumps For Preparing JNCIS-ENT Certified Juniper Exam Well: https://drive.google.com/open?id=1XV48m8LRreh-WtvLZkklN1Sn8C2iKGVi