cert
cert-1
cert-2

Pass Juniper JN0-650 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
JN0-650 Exam - Verified By Experts
JN0-650 Premium File

JN0-650 Premium File

$69.99
$76.99
  • Premium File 107 Questions & Answers. Last Update: Nov 08, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 18 downloads in the last 7 days
block-screenshots
Juniper JN0-650 Practice Test 3

Question 20

A MAC address keeps moving between ports because a physical loop exists. Which next investigation or correction is MOST appropriate?

  1. Inspect ethernet-switching table per VLAN and MAC movement logs.
  2. Inspect interface ethernet-switching configuration and VLAN counters on both ends.
  3. Configure an OSPF route filter to stop Layer 2 unknown-unicast flooding.
  4. Inspect ingress and egress double-tag format and switch VLAN translation state.

Explanation

Correct Answer

A:

Inspect ethernet-switching table per VLAN and MAC movement logs. This checks whether stable source MAC entries map to intended ingress interfaces and unknown floods are limited.

Incorrect Answers

B:

Inspect interface ethernet-switching configuration and VLAN counters on both ends. That check applies chiefly to 802.1Q trunk allowed VLANs, not the current Ethernet MAC learning and flooding issue. Ethernet switches learn source MACs per VLAN and flood unknown destinations until learned.

C:

Configure an OSPF route filter to stop Layer 2 unknown-unicast flooding. That bypass leaves the Ethernet MAC learning and flooding issue unresolved. A loop can cause rapid MAC movement and high broadcast utilization.

D:

Inspect ingress and egress double-tag format and switch VLAN translation state. That check applies chiefly to QinQ service VLAN outer tag, not the current Ethernet MAC learning and flooding issue. Ethernet switches learn source MACs per VLAN and flood unknown destinations until learned.

Question 21

A phone-plus-PC access port treats both devices' DSCP as equally trusted. Which technical principle BEST explains the QoS trust boundary at campus edge decision?

  1. A policer meters traffic and may drop or remark traffic exceeding its limits.
  2. A CoS trust boundary defines whose markings should be honored.
  3. BA classification interprets existing packet markings and assigns forwarding class and loss priority.
  4. BGP prefix controls limit received-route scale and safeguard resources.

Explanation

Correct Answer

B:

A CoS trust boundary defines whose markings should be honored. In this situation, the relevant action is to classify or remark untrusted edge traffic while retaining appropriate trusted phone service.

Incorrect Answers

A:

A policer meters traffic and may drop or remark traffic exceeding its limits. That principle is related to Junos ingress policer rate limit, not the main QoS trust boundary at campus edge choice. Trusting all edge markings lets ordinary traffic claim priority service.

C:

BA classification interprets existing packet markings and assigns forwarding class and loss priority. That principle is related to Junos ingress BA DSCP classifier, not the main QoS trust boundary at campus edge choice. Trusting all edge markings lets ordinary traffic claim priority service.

D:

BGP prefix controls limit received-route scale and safeguard resources. That principle is related to BGP prefix-limit peer protection, not the main QoS trust boundary at campus edge choice. Trusting all edge markings lets ordinary traffic claim priority service.

Question 22

A new ABR introduces external advertisements into an area intended to be stub. Which technical principle BEST explains the OSPF stub area external LSA suppression decision?

  1. OSPF neighbors exchange compatible Hellos before database synchronization.
  2. EVPN route targets control distribution membership independently of VNI packet encapsulation.
  3. NSSA can carry type-7 external LSAs and ABRs may translate them to type-5.
  4. OSPF stub areas restrict external AS-external advertisements and require compatible area flags.

Explanation

Correct Answer

D:

OSPF stub areas restrict external AS-external advertisements and require compatible area flags. In this situation, the relevant action is to configure compatible stub area attributes on all affected OSPF routers.

Incorrect Answers

A:

OSPF neighbors exchange compatible Hellos before database synchronization. That principle is related to OSPFv2 Hello and Dead timer adjacency, not the main OSPF stub area external LSA suppression choice. Mixing stub and normal-area settings prevents correct neighbor establishment.

B:

EVPN route targets control distribution membership independently of VNI packet encapsulation. That principle is related to EVPN route target import export scope, not the main OSPF stub area external LSA suppression choice. Mixing stub and normal-area settings prevents correct neighbor establishment.

C:

NSSA can carry type-7 external LSAs and ABRs may translate them to type-5. That principle is related to OSPF NSSA type-seven translation, not the main OSPF stub area external LSA suppression choice. Mixing stub and normal-area settings prevents correct neighbor establishment.

Question 23

A Junos EX trunk transports VLAN 110 but newly added VLAN 120 is absent at the remote switch. Which configuration or operational step BEST meets the stated requirement?

  1. Assign an IPv4 default route and assume the missing VLAN is automatically allowed on the trunk.
  2. Configure correct trunk mode VLAN membership and tagging at both switch interfaces.
  3. Combine required static VLAN membership with deliberate dynamic registration policy.
  4. Align MSTP region name revision and VLAN-to-instance mapping across intended peers.

Explanation

Correct Answer

B:

Configure correct trunk mode VLAN membership and tagging at both switch interfaces. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk. The expected validation is that expected tagged VLAN traffic traverses the trunk while unapproved VLANs remain blocked.

Incorrect Answers

A:

Assign an IPv4 default route and assume the missing VLAN is automatically allowed on the trunk. This is a risky or ineffective shortcut for 802.1Q trunk allowed VLANs. Missing tagged membership creates silent Layer 2 reachability gaps.

C:

Combine required static VLAN membership with deliberate dynamic registration policy. This addresses MVRP static versus dynamic registration rather than the required 802.1Q trunk allowed VLANs decision. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.

D:

Align MSTP region name revision and VLAN-to-instance mapping across intended peers. This addresses MSTP region name revision and VLAN digest rather than the required 802.1Q trunk allowed VLANs decision. IEEE 802.1Q tags distinguish VLAN traffic across a common trunk.

Question 24

An ASM source registers on RP-A while all receivers currently use RP-B. Which next investigation or correction is MOST appropriate?

  1. Test loss of one RP while checking source registration and receiver delivery.
  2. Inspect IPv6 multicast destination and scope flags in packet traces.
  3. Configure IGMP snooping alone and expect it to exchange MSDP source-active records across routers.
  4. Inspect show msdp peer and source-active caches for known sources.

Explanation

Correct Answer

D:

Inspect show msdp peer and source-active caches for known sources. This checks whether remote RP learns eligible sources and establishes multicast data delivery to subscribers.

Incorrect Answers

A:

Test loss of one RP while checking source registration and receiver delivery. That check applies chiefly to Anycast RP with shared address, not the current MSDP source active exchange issue. MSDP can exchange source-active awareness across ASM RP domains.

B:

Inspect IPv6 multicast destination and scope flags in packet traces. That check applies chiefly to IPv6 multicast scope and group use, not the current MSDP source active exchange issue. MSDP can exchange source-active awareness across ASM RP domains.

C:

Configure IGMP snooping alone and expect it to exchange MSDP source-active records across routers. That bypass leaves the MSDP source active exchange issue unresolved. Missing MSDP source advertisements can isolate multicast sources between RPs.

Question 25

An unauthorized access switch advertises a lower bridge ID and attempts to become root. After deploying the recommended Root protection on designated links change, which result MOST directly verifies success?

  1. Same-community endpoints communicate while different communities stay isolated.
  2. Two-tagged frames pass through provider ports with the expected EtherType.
  3. The handset receives voice VLAN policy and tags voice frames as intended.
  4. Downstream superior BPDUs are rejected while the intended root remains authoritative.

Explanation

Correct Answer

D:

Downstream superior BPDUs are rejected while the intended root remains authoritative. This is the directly observable outcome for Root protection on designated links. Root protection guards designated bridge roles against unexpected root changes.

Incorrect Answers

A:

Same-community endpoints communicate while different communities stay isolated. This validates Private VLAN community and promiscuous roles but does not directly demonstrate the required Root protection on designated links result. Root protection guards designated bridge roles against unexpected root changes.

B:

Two-tagged frames pass through provider ports with the expected EtherType. This validates QinQ tag protocol EtherType compatibility but does not directly demonstrate the required Root protection on designated links result. Root protection guards designated bridge roles against unexpected root changes.

C:

The handset receives voice VLAN policy and tags voice frames as intended. This validates LLDP-MED voice network policy but does not directly demonstrate the required Root protection on designated links result. Root protection guards designated bridge roles against unexpected root changes.

Question 26

A client leaves a video group yet traffic persists to its access port. Which next investigation or correction is MOST appropriate?

  1. Compare snooping tables and mirrored traffic on subscribed and unsubscribed ports.
  2. Compare RP mappings group ranges and route to RP across nodes.
  3. Add a static ARP entry and assume receivers automatically issue IGMP membership reports.
  4. Inspect IGMP group membership and packet reports on affected VLAN interfaces.

Explanation

Correct Answer

D:

Inspect IGMP group membership and packet reports on affected VLAN interfaces. This checks whether group memberships reflect active local receivers and unwanted replicated traffic diminishes.

Incorrect Answers

A:

Compare snooping tables and mirrored traffic on subscribed and unsubscribed ports. That check applies chiefly to IGMP snooping access-port replication, not the current IGMPv2 membership report and leave issue. IGMP expresses host interest in groups while routing protocols move traffic between subnets.

B:

Compare RP mappings group ranges and route to RP across nodes. That check applies chiefly to Static RP mapping group range, not the current IGMPv2 membership report and leave issue. IGMP expresses host interest in groups while routing protocols move traffic between subnets.

C:

Add a static ARP entry and assume receivers automatically issue IGMP membership reports. That bypass leaves the IGMPv2 membership report and leave issue unresolved. Treating IGMP as an interrouter PIM replacement prevents routed multicast delivery.

Question 27

A desk phone bridges a PC to the access port but the PC must not impersonate voice traffic. Which configuration or operational step BEST meets the stated requirement?

  1. Calculate supported switch PoE budget and per-port device allocation before deployment.
  2. Apply a deliberate trust boundary and separate PC and voice VLAN access policies.
  3. Verify supported PoE power classes and power negotiation for the specific phone model.
  4. Treat a phone's physical presence as authorization for every downstream workstation.

Explanation

Correct Answer

B:

Apply a deliberate trust boundary and separate PC and voice VLAN access policies. Phone pass-through ports need explicit data security and QoS trust design. The expected validation is that legitimate phone traffic receives voice service while PC traffic cannot gain voice privileges.

Incorrect Answers

A:

Calculate supported switch PoE budget and per-port device allocation before deployment. This addresses PoE power budget switch capacity rather than the required Phone and PC shared switch-port security decision. Phone pass-through ports need explicit data security and QoS trust design.

C:

Verify supported PoE power classes and power negotiation for the specific phone model. This addresses PoE class discovery and allocation rather than the required Phone and PC shared switch-port security decision. Phone pass-through ports need explicit data security and QoS trust design.

D:

Treat a phone's physical presence as authorization for every downstream workstation. This is a risky or ineffective shortcut for Phone and PC shared switch-port security. Trusting every attached PC's markings can consume voice queues and bypass policy.

Question 28

An EVPN leaf has verified host IP/MAC mappings but still floods every ARP request. Which next investigation or correction is MOST appropriate?

  1. Suppress all ARP requests while intentionally removing every IP/MAC mapping.
  2. Measure ARP flood rate and verify authoritative bindings during host changes.
  3. Compare received extended communities and imported EVPN instance routes.
  4. Inspect EVPN Type2 NLRI and destination MAC forwarding entries.

Explanation

Correct Answer

B:

Measure ARP flood rate and verify authoritative bindings during host changes. This checks whether eligible ARP lookups are answered locally and unnecessary BUM replication decreases.

Incorrect Answers

A:

Suppress all ARP requests while intentionally removing every IP/MAC mapping. That bypass leaves the EVPN ARP suppression from IP MAC bindings issue unresolved. Incorrect or stale host bindings can return the wrong MAC or fail to suppress requests.

C:

Compare received extended communities and imported EVPN instance routes. That check applies chiefly to EVPN route target import export scope, not the current EVPN ARP suppression from IP MAC bindings issue. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.

D:

Inspect EVPN Type2 NLRI and destination MAC forwarding entries. That check applies chiefly to EVPN Type2 MAC IP advertisement, not the current EVPN ARP suppression from IP MAC bindings issue. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.

Question 29

A user changes from contractor to employee but the wired session retains its old authorization. Which configuration or operational step BEST meets the stated requirement?

  1. Configure a restricted guest VLAN as an explicit supported fallback for selected unauthenticated devices.
  2. Disable every session timeout to guarantee revoked identities remain connected.
  3. Configure supported reauthentication or session restoration after AAA recovery.
  4. Configure supported periodic reauthentication with realistic operational timers.

Explanation

Correct Answer

D:

Configure supported periodic reauthentication with realistic operational timers. Reauthentication refreshes an existing access session's policy decision. The expected validation is that new identity policy takes effect without repeatedly disrupting healthy clients.

Incorrect Answers

A:

Configure a restricted guest VLAN as an explicit supported fallback for selected unauthenticated devices. This addresses Guest VLAN for unauthenticated clients rather than the required 802.1X periodic reauthentication decision. Reauthentication refreshes an existing access session's policy decision.

B:

Disable every session timeout to guarantee revoked identities remain connected. This is a risky or ineffective shortcut for 802.1X periodic reauthentication. Excessively short reauthentication periods can destabilize normal connectivity.

C:

Configure supported reauthentication or session restoration after AAA recovery. This addresses RADIUS server-fail remediation and reauthentication rather than the required 802.1X periodic reauthentication decision. Reauthentication refreshes an existing access session's policy decision.

Question 30

An engineer changes a transit interface cost but routes still choose an unexpected next hop. Which technical principle BEST explains the OSPF path cost selection decision?

  1. OSPF database exchange can stall when peers disagree on interface MTU.
  2. OSPF SPF selects lowest cumulative link cost subject to policy and availability.
  3. BGP neighbor state and route installation are separate control-plane gates.
  4. Routing policy must match the relevant address family as well as eligible source routes.

Explanation

Correct Answer

B:

OSPF SPF selects lowest cumulative link cost subject to policy and availability. In this situation, the relevant action is to assign deliberate OSPF interface costs and check the total path metric.

Incorrect Answers

A:

OSPF database exchange can stall when peers disagree on interface MTU. That principle is related to OSPF interface MTU mismatch, not the main OSPF path cost selection choice. Overlooking total cost can route critical traffic over a constrained backup path.

C:

BGP neighbor state and route installation are separate control-plane gates. That principle is related to BGP hidden and rejected path diagnosis, not the main OSPF path cost selection choice. Overlooking total cost can route critical traffic over a constrained backup path.

D:

Routing policy must match the relevant address family as well as eligible source routes. That principle is related to OSPFv3 routing policy for external IPv6, not the main OSPF path cost selection choice. Overlooking total cost can route critical traffic over a constrained backup path.

Enterprise Routing and Switching, Professional (JNCIP-ENT) (JN0-650) Practice Tests