Juniper JN0-650 Practice Test 26
Question 250
Network design requires stronger authorization for privileged endpoints than a known hardware address. Select TWO statements that correctly combine the MAC RADIUS spoofing limitations implementation, its evidence, or its governing principle.
- Spoofed MAC identity cannot grant administrator or high-trust employee access.
- Configure supported periodic reauthentication with realistic operational timers.
- Restrict MAC RADIUS to low-trust device segments and use stronger 802.1X for capable users.
- Define a risk-approved server-fail fallback action with restrictive VLAN or deny behavior.
- Treat a globally unique MAC as unforgeable proof of employee identity.
Explanation
Correct Answers
A:Spoofed MAC identity cannot grant administrator or high-trust employee access. This is direct observable evidence for MAC RADIUS spoofing limitations.
C:Restrict MAC RADIUS to low-trust device segments and use stronger 802.1X for capable users. This is the intended implementation action for MAC RADIUS spoofing limitations.
Incorrect Answers
B:Configure supported periodic reauthentication with realistic operational timers. This belongs to 802.1X periodic reauthentication, not the specified MAC RADIUS spoofing limitations operation. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
D:Define a risk-approved server-fail fallback action with restrictive VLAN or deny behavior. This belongs to RADIUS server unreachable fallback policy, not the specified MAC RADIUS spoofing limitations operation. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
E:Treat a globally unique MAC as unforgeable proof of employee identity. This would not be an appropriate MAC RADIUS spoofing limitations decision. Placing critical admin endpoints behind MAC-only authentication permits spoofing risk.
Question 251
During an operational risk review, this situation is reported: One copper link has wiring faults while data LEDs intermittently appear active. If the underlying control is neglected, which failure would MOST directly follow?
- Trusting every attached PC's markings can consume voice queues and bypass policy.
- A physically connected device without LLDP exchange cannot receive LLDP-based network policy.
- Failure to reauthorize after recovery can leave endpoints overprivileged or stuck in fallback.
- A physical pair or overload fault can stop power before any voice VLAN setup matters.
Explanation
Correct Answer
D:A physical pair or overload fault can stop power before any voice VLAN setup matters. PoE delivery requires compatible power sourcing and physical cable conditions. A useful corrective investigation is to compare PoE state and cable diagnostics on known-good versus failing links.
Incorrect Answers
A:PoE delivery requires compatible power sourcing and physical cable conditions. Trusting every attached PC's markings can consume voice queues and bypass policy.
B:PoE delivery requires compatible power sourcing and physical cable conditions. A physically connected device without LLDP exchange cannot receive LLDP-based network policy.
C:PoE delivery requires compatible power sourcing and physical cable conditions. Failure to reauthorize after recovery can leave endpoints overprivileged or stuck in fallback.
Question 252
VLAN 100 should use distribution switch A while VLAN 200 uses switch B as spanning-tree root. After deploying the recommended VSTP per-VLAN root distribution change, which result MOST directly verifies success?
- Rogue bridge BPDUs trigger the intended guard action without affecting valid trunks.
- Customer BPDUs traverse the service and provider STP remains isolated.
- Each VLAN shows its intended root and a loop-free active topology.
- Under controlled load intended voice QoS remains protected while other classes retain service.
Explanation
Correct Answer
C:Each VLAN shows its intended root and a loop-free active topology. This is the directly observable outcome for VSTP per-VLAN root distribution. VSTP runs per-VLAN spanning-tree decisions rather than one shared instance.
Incorrect Answers
A:Rogue bridge BPDUs trigger the intended guard action without affecting valid trunks. This validates BPDU protection on access edges but does not directly demonstrate the required VSTP per-VLAN root distribution result. VSTP runs per-VLAN spanning-tree decisions rather than one shared instance.
B:Customer BPDUs traverse the service and provider STP remains isolated. This validates L2PT customer BPDU tunneling but does not directly demonstrate the required VSTP per-VLAN root distribution result. VSTP runs per-VLAN spanning-tree decisions rather than one shared instance.
D:Under controlled load intended voice QoS remains protected while other classes retain service. This validates CoS end-to-end verification of drop behavior but does not directly demonstrate the required VSTP per-VLAN root distribution result. VSTP runs per-VLAN spanning-tree decisions rather than one shared instance.
Question 253
Higher-power phones boot only when fewer neighboring ports are active. Which technical principle BEST explains the PoE power budget switch capacity decision?
- IEEE PoE total power budget and per-port allocation constrain powered endpoints.
- Q-in-Q tunnels customer 802.1Q tags inside a provider service VLAN.
- PoE detection classification and allocation are distinct from Ethernet packet switching.
- LLDP-MED extends neighbor discovery with voice-oriented network policy information.
Explanation
Correct Answer
A:IEEE PoE total power budget and per-port allocation constrain powered endpoints. In this situation, the relevant action is to calculate supported switch PoE budget and per-port device allocation before deployment.
Incorrect Answers
B:Q-in-Q tunnels customer 802.1Q tags inside a provider service VLAN. That principle is related to QinQ service VLAN outer tag, not the main PoE power budget switch capacity choice. Summing device requirements above available chassis budget causes port power denial.
C:PoE detection classification and allocation are distinct from Ethernet packet switching. That principle is related to PoE class discovery and allocation, not the main PoE power budget switch capacity choice. Summing device requirements above available chassis budget causes port power denial.
D:LLDP-MED extends neighbor discovery with voice-oriented network policy information. That principle is related to LLDP-MED voice network policy, not the main PoE power budget switch capacity choice. Summing device requirements above available chassis budget causes port power denial.
Question 254
A policer drops valid traffic because committed burst settings are unrealistic. Which next investigation or correction is MOST appropriate?
- Attach a BGP community to packets and call it an interface policer.
- Measure queue throughput and share under controlled competing traffic.
- Inspect show class-of-service interface and forwarding-class counters.
- Measure policer counters and packet loss at below and above configured rate.
Explanation
Correct Answer
D:Measure policer counters and packet loss at below and above configured rate. This checks whether excess traffic is treated according to policy and compliant traffic continues.
Incorrect Answers
A:Attach a BGP community to packets and call it an interface policer. That bypass leaves the Junos ingress policer rate limit issue unresolved. Wrong burst values can create unnecessary packet loss for permitted applications.
B:Measure queue throughput and share under controlled competing traffic. That check applies chiefly to Scheduler transmit rate bandwidth allocation, not the current Junos ingress policer rate limit issue. A policer meters traffic and may drop or remark traffic exceeding its limits.
C:Inspect show class-of-service interface and forwarding-class counters. That check applies chiefly to Junos ingress BA DSCP classifier, not the current Junos ingress policer rate limit issue. A policer meters traffic and may drop or remark traffic exceeding its limits.
Question 255
An exchange peer approaches route memory capacity after a misconfigured advertisement. Which next investigation or correction is MOST appropriate?
- Inspect show route advertising-protocol BGP and remote policy confirmation if available.
- Inspect reflected path originator ID cluster list and neighbor client roles.
- Test near-limit route scenarios and examine neighbor status or alarms.
- Change one interface description to max-prefix and expect a route-count limit.
Explanation
Correct Answer
C:Test near-limit route scenarios and examine neighbor status or alarms. This checks whether excessive routes trigger the intended protection without destabilizing unrelated sessions.
Incorrect Answers
A:Inspect show route advertising-protocol BGP and remote policy confirmation if available. That check applies chiefly to BGP AS path prepend outbound advertisement, not the current BGP prefix-limit peer protection issue. BGP prefix controls limit received-route scale and safeguard resources.
B:Inspect reflected path originator ID cluster list and neighbor client roles. That check applies chiefly to BGP route reflection cluster, not the current BGP prefix-limit peer protection issue. BGP prefix controls limit received-route scale and safeguard resources.
D:Change one interface description to max-prefix and expect a route-count limit. That bypass leaves the BGP prefix-limit peer protection issue unresolved. No route-count guard can overwhelm route memory or control-plane processing.
Question 256
A Junos EX trunk transports VLAN 110 but newly added VLAN 120 is absent at the remote switch. After deploying the recommended 802.1Q trunk allowed VLANs change, which result MOST directly verifies success?
- Untagged frames enter the correct VLAN and reach only eligible peers.
- Expected tagged VLAN traffic traverses the trunk while unapproved VLANs remain blocked.
- Active routes prefer the expected lowest cumulative OSPF metric.
- Intended guest frames match their rule and general traffic uses the appropriate default.
Explanation
Correct Answer
B:Expected tagged VLAN traffic traverses the trunk while unapproved VLANs remain blocked. This is the directly observable outcome for 802.1Q trunk allowed VLANs. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.
Incorrect Answers
A:Untagged frames enter the correct VLAN and reach only eligible peers. This validates Ethernet access interface VLAN membership but does not directly demonstrate the required 802.1Q trunk allowed VLANs result. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.
C:Active routes prefer the expected lowest cumulative OSPF metric. This validates OSPF path cost selection but does not directly demonstrate the required 802.1Q trunk allowed VLANs result. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.
D:Intended guest frames match their rule and general traffic uses the appropriate default. This validates Filter-based VLAN rule precedence but does not directly demonstrate the required 802.1Q trunk allowed VLANs result. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.
Question 257
A multicast source exists but group join state never reaches a configured rendezvous point. Which next investigation or correction is MOST appropriate?
- Trace multicast forwarding entries hop by hop toward source or RP.
- Configure an IP host default gateway and assume that automatically elects a PIM RP.
- Inspect show pim rps and multicast route shared-tree state.
- Review RP election discovery information and group-range reachability.
Explanation
Correct Answer
C:Inspect show pim rps and multicast route shared-tree state. This checks whether (*,G) joins establish a shared tree via the intended RP and receivers get the stream.
Incorrect Answers
A:Trace multicast forwarding entries hop by hop toward source or RP. That check applies chiefly to PIM join prune forwarding path, not the current PIM sparse-mode RP shared tree issue. Sparse-mode ASM commonly uses an RP to establish initial shared-tree multicast state.
B:Configure an IP host default gateway and assume that automatically elects a PIM RP. That bypass leaves the PIM sparse-mode RP shared tree issue unresolved. Absent or inconsistent RP mapping prevents initial ASM group discovery.
D:Review RP election discovery information and group-range reachability. That check applies chiefly to PIM RP discovery and bootstrap mapping, not the current PIM sparse-mode RP shared tree issue. Sparse-mode ASM commonly uses an RP to establish initial shared-tree multicast state.
Question 258
One branch has (S,G) state with no downstream outgoing interface after a topology change. Which next investigation or correction is MOST appropriate?
- Check only the BGP session up flag and conclude multicast delivery is healthy.
- Examine show multicast route and per-interface packet counters at each hop.
- Inspect destination group fields in received packets and routing entries.
- Trace multicast forwarding entries hop by hop toward source or RP.
Explanation
Correct Answer
B:Examine show multicast route and per-interface packet counters at each hop. This checks whether traffic from the expected source reaches only authorized receiver interfaces.
Incorrect Answers
A:Check only the BGP session up flag and conclude multicast delivery is healthy. That bypass leaves the Multicast routing table incoming outgoing lists issue unresolved. Missing OIF state yields no receiver traffic despite an upstream multicast feed.
C:Inspect destination group fields in received packets and routing entries. That check applies chiefly to IPv4 multicast group address versus unicast, not the current Multicast routing table incoming outgoing lists issue. Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state.
D:Trace multicast forwarding entries hop by hop toward source or RP. That check applies chiefly to PIM join prune forwarding path, not the current Multicast routing table incoming outgoing lists issue. Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state.
Question 259
A network upgrade leaves old reference bandwidth values across Junos routing domains. Which next investigation or correction is MOST appropriate?
- Check packet authentication indicators and interface OSPF security settings.
- Raise one link bandwidth value in a monitoring chart without checking OSPF cost calculation.
- Compare show route protocol ospf and interface metric contributions along both paths.
- Inspect calculated OSPF metrics for representative 10-Gbps and 100-Gbps links.
Explanation
Correct Answer
D:Inspect calculated OSPF metrics for representative 10-Gbps and 100-Gbps links. This checks whether faster links receive the planned comparative metrics in the routing database.
Incorrect Answers
A:Check packet authentication indicators and interface OSPF security settings. That check applies chiefly to OSPF authentication key or algorithm, not the current OSPF reference bandwidth and high-speed links issue. OSPF automatic cost can require reference-bandwidth adjustment as interfaces become faster.
B:Raise one link bandwidth value in a monitoring chart without checking OSPF cost calculation. That bypass leaves the OSPF reference bandwidth and high-speed links issue unresolved. Inconsistent reference bandwidth across routers may distort intended route decisions.
C:Compare show route protocol ospf and interface metric contributions along both paths. That check applies chiefly to OSPF path cost selection, not the current OSPF reference bandwidth and high-speed links issue. OSPF automatic cost can require reference-bandwidth adjustment as interfaces become faster.
Question 260
A team incorrectly configures a multicast group as the unicast source host IP. Which technical principle BEST explains the IPv4 multicast group address versus unicast decision?
- EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.
- IPv4 multicast destination ranges are group identifiers rather than ordinary host addresses.
- Multicast involves host membership router tree state and actual forwarding traffic.
- IGMPv3 supports source filters needed for Source Specific Multicast participation.
Explanation
Correct Answer
B:IPv4 multicast destination ranges are group identifiers rather than ordinary host addresses. In this situation, the relevant action is to distinguish multicast destination group addresses from sender unicast identities.
Incorrect Answers
A:EVPN IP/MAC learning can support distributed ARP suppression where platforms support it. That principle is related to EVPN ARP suppression from IP MAC bindings, not the main IPv4 multicast group address versus unicast choice. Confusing group addresses and source addresses breaks multicast forwarding and diagnostics.
C:Multicast involves host membership router tree state and actual forwarding traffic. That principle is related to Multicast troubleshooting separate control and data planes, not the main IPv4 multicast group address versus unicast choice. Confusing group addresses and source addresses breaks multicast forwarding and diagnostics.
D:IGMPv3 supports source filters needed for Source Specific Multicast participation. That principle is related to IGMPv3 source include mode, not the main IPv4 multicast group address versus unicast choice. Confusing group addresses and source addresses breaks multicast forwarding and diagnostics.
