Juniper JN0-650 Practice Test 10
Question 90
One customer VLAN is mapped to the wrong VNI on a leaf. Which configuration or operational step BEST meets the stated requirement?
- Set compatible route-target import and export policy for intended EVPN instances.
- Configure consistent supported VLAN-to-VNI mapping in the intended routing instances.
- Verify local MAC learning and Type2 MAC/IP route advertisement and import.
- Rename tenant VLANs to identical names and assume the VNI collision becomes safe.
Explanation
Correct Answer
B:Configure consistent supported VLAN-to-VNI mapping in the intended routing instances. VXLAN network identifiers distinguish overlay Layer 2 broadcast domains. The expected validation is that same-segment endpoints communicate while other VNIs remain isolated.
Incorrect Answers
A:Set compatible route-target import and export policy for intended EVPN instances. This addresses EVPN route target import export scope rather than the required VXLAN VNI to VLAN association decision. VXLAN network identifiers distinguish overlay Layer 2 broadcast domains.
C:Verify local MAC learning and Type2 MAC/IP route advertisement and import. This addresses EVPN Type2 MAC IP advertisement rather than the required VXLAN VNI to VLAN association decision. VXLAN network identifiers distinguish overlay Layer 2 broadcast domains.
D:Rename tenant VLANs to identical names and assume the VNI collision becomes safe. This is a risky or ineffective shortcut for VXLAN VNI to VLAN association. Reusing wrong VNI mapping can leak traffic across tenant boundaries or break reachability.
Question 91
A backbone adjacency has identical IP addressing but mismatched authentication type. Which next investigation or correction is MOST appropriate?
- Check area capabilities and LSDB LSA types at the ABR and branch.
- Compare show ospf neighbor with show ospf3 neighbor and inet versus inet6 routes.
- Check packet authentication indicators and interface OSPF security settings.
- Disable all routing-protocol authentication across the network to fix one key mismatch.
Explanation
Correct Answer
C:Check packet authentication indicators and interface OSPF security settings. This checks whether accepted authenticated Hellos lead to a stable neighbor relationship.
Incorrect Answers
A:Check area capabilities and LSDB LSA types at the ABR and branch. That check applies chiefly to OSPF stub area external LSA suppression, not the current OSPF authentication key or algorithm issue. OSPF authentication compatibility is independent of ordinary IP reachability.
B:Compare show ospf neighbor with show ospf3 neighbor and inet versus inet6 routes. That check applies chiefly to OSPFv2 versus OSPFv3 operations, not the current OSPF authentication key or algorithm issue. OSPF authentication compatibility is independent of ordinary IP reachability.
D:Disable all routing-protocol authentication across the network to fix one key mismatch. That bypass leaves the OSPF authentication key or algorithm issue unresolved. Invalid keys or incompatible authentication configuration silently discard adjacencies.
Question 92
Packets arrive with valid DSCP but leave the wrong queue because classification and scheduling are confused. Which technical principle BEST explains the CoS processing order ingress to egress decision?
- BGP address families determine which NLRI types may be exchanged.
- Shaping delays packets to smooth egress rate while policing meters and may drop.
- Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting.
- A CoS trust boundary defines whose markings should be honored.
Explanation
Correct Answer
C:Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting. In this situation, the relevant action is to trace classifier forwarding class PLP scheduler and rewrite stages in the correct pipeline order.
Incorrect Answers
A:BGP address families determine which NLRI types may be exchanged. That principle is related to BGP NLRI IPv4 unicast inet family, not the main CoS processing order ingress to egress choice. Configuring only an egress rewrite does not automatically set an upstream classifier.
B:Shaping delays packets to smooth egress rate while policing meters and may drop. That principle is related to Junos egress shaping rate, not the main CoS processing order ingress to egress choice. Configuring only an egress rewrite does not automatically set an upstream classifier.
D:A CoS trust boundary defines whose markings should be honored. That principle is related to QoS trust boundary at campus edge, not the main CoS processing order ingress to egress choice. Configuring only an egress rewrite does not automatically set an upstream classifier.
Question 93
An early broad classification term captures all traffic before a more specific guest rule. After deploying the recommended Filter-based VLAN rule precedence change, which result MOST directly verifies success?
- Eligible VLAN registration propagates and the intended traffic crosses participating trunks.
- BGP reaches Established with the expected local and remote ASN and prefix families.
- Intended guest frames match their rule and general traffic uses the appropriate default.
- Isolated endpoints reach the intended shared gateway but not peer isolated ports.
Explanation
Correct Answer
C:Intended guest frames match their rule and general traffic uses the appropriate default. This is the directly observable outcome for Filter-based VLAN rule precedence. Filter terms are evaluated in policy order subject to terminating actions.
Incorrect Answers
A:Eligible VLAN registration propagates and the intended traffic crosses participating trunks. This validates MVRP dynamic VLAN registration but does not directly demonstrate the required Filter-based VLAN rule precedence result. Filter terms are evaluated in policy order subject to terminating actions.
B:BGP reaches Established with the expected local and remote ASN and prefix families. This validates BGP eBGP peer AS and local identity but does not directly demonstrate the required Filter-based VLAN rule precedence result. Filter terms are evaluated in policy order subject to terminating actions.
D:Isolated endpoints reach the intended shared gateway but not peer isolated ports. This validates Private VLAN isolated port separation but does not directly demonstrate the required Filter-based VLAN rule precedence result. Filter terms are evaluated in policy order subject to terminating actions.
Question 94
Guest browser redirection works but a certificate or session issue prevents authorization. Which technical principle BEST explains the Captive portal web authentication decision?
- Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation.
- Communities can be selectively matched manipulated and stripped in routing policy.
- 802.1X separates supplicant authenticator and authentication server roles.
- Authentication success does not guarantee matching VLAN mapping or permitted data-plane access.
Explanation
Correct Answer
A:Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation. In this situation, the relevant action is to configure supported captive portal redirect and identity or terms policy for guest VLANs.
Incorrect Answers
B:Communities can be selectively matched manipulated and stripped in routing policy. That principle is related to BGP communities match and deletion, not the main Captive portal web authentication choice. A portal that grants full internal access after a checkbox violates guest isolation.
C:802.1X separates supplicant authenticator and authentication server roles. That principle is related to 802.1X supplicant authenticator RADIUS roles, not the main Captive portal web authentication choice. A portal that grants full internal access after a checkbox violates guest isolation.
D:Authentication success does not guarantee matching VLAN mapping or permitted data-plane access. That principle is related to Multiple access control enforcement troubleshooting, not the main Captive portal web authentication choice. A portal that grants full internal access after a checkbox violates guest isolation.
Question 95
A shared service router must reach devices across multiple private VLAN secondary groups. Which technical principle BEST explains the Private VLAN community and promiscuous roles decision?
- Root protection guards designated bridge roles against unexpected root changes.
- Private VLAN community ports have scoped peer reachability and promiscuous ports serve shared resources.
- Per-VLAN STP compatibility depends on VLAN tagging and protocol expectations.
- RADIUS outcomes express AAA authorization decisions separate from transport connectivity.
Explanation
Correct Answer
B:Private VLAN community ports have scoped peer reachability and promiscuous ports serve shared resources. In this situation, the relevant action is to configure community secondary roles and the appropriate promiscuous uplink association.
Incorrect Answers
A:Root protection guards designated bridge roles against unexpected root changes. That principle is related to Root protection on designated links, not the main Private VLAN community and promiscuous roles choice. Mistaking community roles for isolated roles can interrupt same-group operation.
C:Per-VLAN STP compatibility depends on VLAN tagging and protocol expectations. That principle is related to VSTP interoperation and VLAN tagging, not the main Private VLAN community and promiscuous roles choice. Mistaking community roles for isolated roles can interrupt same-group operation.
D:RADIUS outcomes express AAA authorization decisions separate from transport connectivity. That principle is related to RADIUS Access-Accept versus Access-Reject handling, not the main Private VLAN community and promiscuous roles choice. Mistaking community roles for isolated roles can interrupt same-group operation.
Question 96
An SSM receiver appears to depend on an ASM RP despite having a known source. Which technical principle BEST explains the SSM without rendezvous point decision?
- Forwarding classes express per-hop traffic treatment and map to transmission queues.
- Source Specific Multicast builds source-directed trees without an ASM rendezvous point.
- IGMP queriers maintain host membership state on a local multicast segment.
- Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state.
Explanation
Correct Answer
B:Source Specific Multicast builds source-directed trees without an ASM rendezvous point. In this situation, the relevant action is to use compatible IGMPv3 source membership and PIM SSM range design.
Incorrect Answers
A:Forwarding classes express per-hop traffic treatment and map to transmission queues. That principle is related to Junos forwarding class to queue mapping, not the main SSM without rendezvous point choice. Using ASM-only membership for an SSM group prevents the intended source-specific join.
C:IGMP queriers maintain host membership state on a local multicast segment. That principle is related to IGMP querier on subscriber VLAN, not the main SSM without rendezvous point choice. Using ASM-only membership for an SSM group prevents the intended source-specific join.
D:Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state. That principle is related to Multicast routing table incoming outgoing lists, not the main SSM without rendezvous point choice. Using ASM-only membership for an SSM group prevents the intended source-specific join.
Question 97
An IPv6 passive interface must be advertised without forming unwanted neighbors. Which next investigation or correction is MOST appropriate?
- Add an IPv4 network statement and assume it advertises every IPv6 LAN.
- Inspect NSSA LSAs and translated external entries at the ABR.
- Inspect route hidden reason protocol database and configured policy chains.
- Compare show route table inet6.0 protocol ospf3 with OSPFv3 LSA information.
Explanation
Correct Answer
D:Compare show route table inet6.0 protocol ospf3 with OSPFv3 LSA information. This checks whether intended inet6 routes appear on remote Junos nodes with resolvable next hops.
Incorrect Answers
A:Add an IPv4 network statement and assume it advertises every IPv6 LAN. That bypass leaves the OSPFv3 IPv6 prefix advertisement issue unresolved. An established IPv6 adjacency does not prove every attached prefix is advertised.
B:Inspect NSSA LSAs and translated external entries at the ABR. That check applies chiefly to OSPF NSSA type-seven translation, not the current OSPFv3 IPv6 prefix advertisement issue. OSPFv3 separates neighbor topology information from IPv6 prefix dissemination.
C:Inspect route hidden reason protocol database and configured policy chains. That check applies chiefly to OSPF routing policy import filtering, not the current OSPFv3 IPv6 prefix advertisement issue. OSPFv3 separates neighbor topology information from IPv6 prefix dissemination.
Question 98
Receivers on a VLAN join an ASM group but a snooping bridge fails to track membership. Which configuration or operational step BEST meets the stated requirement?
- Align source reachability and any approved multicast RPF policy with actual topology.
- Apply a consistent scoped RP mapping with verified routing to the RP.
- Add a static ARP entry and assume receivers automatically issue IGMP membership reports.
- Verify IGMPv2 membership joins leaves and querier operation for the intended subnet.
Explanation
Correct Answer
D:Verify IGMPv2 membership joins leaves and querier operation for the intended subnet. IGMP expresses host interest in groups while routing protocols move traffic between subnets. The expected validation is that group memberships reflect active local receivers and unwanted replicated traffic diminishes.
Incorrect Answers
A:Align source reachability and any approved multicast RPF policy with actual topology. This addresses Multicast source route policy and RPF rather than the required IGMPv2 membership report and leave decision. IGMP expresses host interest in groups while routing protocols move traffic between subnets.
B:Apply a consistent scoped RP mapping with verified routing to the RP. This addresses Static RP mapping group range rather than the required IGMPv2 membership report and leave decision. IGMP expresses host interest in groups while routing protocols move traffic between subnets.
C:Add a static ARP entry and assume receivers automatically issue IGMP membership reports. This is a risky or ineffective shortcut for IGMPv2 membership report and leave. Treating IGMP as an interrouter PIM replacement prevents routed multicast delivery.
Question 99
During an operational risk review, this situation is reported: Packets arrive with valid DSCP but leave the wrong queue because classification and scheduling are confused. If the underlying control is neglected, which failure would MOST directly follow?
- Overbroad classifiers permit bulk traffic to consume low-latency queues.
- Uncontrolled method fallback can turn a stronger supplicant policy into a weak MAC-only policy.
- Unbounded high-priority traffic can starve nonpriority queues.
- Configuring only an egress rewrite does not automatically set an upstream classifier.
Explanation
Correct Answer
D:Configuring only an egress rewrite does not automatically set an upstream classifier. Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting. A useful corrective investigation is to check effective interface classifier scheduler map and rewrite settings together.
Incorrect Answers
A:Overbroad classifiers permit bulk traffic to consume low-latency queues. This is a Junos multifield firewall filter classification failure pattern, not the primary CoS processing order ingress to egress failure in this case. Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting.
B:Uncontrolled method fallback can turn a stronger supplicant policy into a weak MAC-only policy. This is a 802.1X versus MAC RADIUS method priority failure pattern, not the primary CoS processing order ingress to egress failure in this case. Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting.
C:Unbounded high-priority traffic can starve nonpriority queues. This is a Scheduler strict priority and starvation failure pattern, not the primary CoS processing order ingress to egress failure in this case. Junos CoS decisions progress from ingress classification through queue scheduling to egress rewriting.
Question 100
An internal failover sends outbound traffic through the wrong ISP despite healthy iBGP. Which next investigation or correction is MOST appropriate?
- Inspect BGP path attributes and active routes at multiple iBGP speakers.
- Advertise a larger MED to the upstream and assume all local speakers raise LOCAL_PREF.
- Inspect negotiated families and show route table inet.0 protocol bgp.
- Inspect eligible multipath route detail and forwarding table next hops.
Explanation
Correct Answer
A:Inspect BGP path attributes and active routes at multiple iBGP speakers. This checks whether enterprise routers prefer approved primary exit while allowing backup on withdrawal.
Incorrect Answers
B:Advertise a larger MED to the upstream and assume all local speakers raise LOCAL_PREF. That bypass leaves the BGP LOCAL_PREF outbound exit selection issue unresolved. Treating MED as a replacement for internal LOCAL_PREF can select the wrong exit.
C:Inspect negotiated families and show route table inet.0 protocol bgp. That check applies chiefly to BGP NLRI IPv4 unicast inet family, not the current BGP LOCAL_PREF outbound exit selection issue. LOCAL_PREF is propagated within an AS and commonly steers outbound path selection.
D:Inspect eligible multipath route detail and forwarding table next hops. That check applies chiefly to BGP multipath equal-cost path installation, not the current BGP LOCAL_PREF outbound exit selection issue. LOCAL_PREF is propagated within an AS and commonly steers outbound path selection.