Juniper JN0-650 Practice Test 35
Question 340
During an operational risk review, this situation is reported: An expired security credential stays accepted on a long-lived active switch port. If the underlying control is neglected, which failure would MOST directly follow?
- Excessively short reauthentication periods can destabilize normal connectivity.
- A portal that grants full internal access after a checkbox violates guest isolation.
- Basic LLDP neighbor discovery alone may not advertise the required voice VLAN.
- Placing critical admin endpoints behind MAC-only authentication permits spoofing risk.
Explanation
Correct Answer
A:Excessively short reauthentication periods can destabilize normal connectivity. Reauthentication refreshes an existing access session's policy decision. A useful corrective investigation is to review session timers and test role change after reauthentication.
Incorrect Answers
B:A portal that grants full internal access after a checkbox violates guest isolation. This is a Captive portal web authentication failure pattern, not the primary 802.1X periodic reauthentication failure in this case. Reauthentication refreshes an existing access session's policy decision.
C:Basic LLDP neighbor discovery alone may not advertise the required voice VLAN. This is a LLDP-MED voice network policy failure pattern, not the primary 802.1X periodic reauthentication failure in this case. Reauthentication refreshes an existing access session's policy decision.
D:Placing critical admin endpoints behind MAC-only authentication permits spoofing risk. This is a MAC RADIUS spoofing limitations failure pattern, not the primary 802.1X periodic reauthentication failure in this case. Reauthentication refreshes an existing access session's policy decision.
Question 341
During an operational risk review, this situation is reported: An EVPN leaf has verified host IP/MAC mappings but still floods every ARP request. If the underlying control is neglected, which failure would MOST directly follow?
- Incorrect or missing Type1 signaling can slow convergence or misrepresent ES availability.
- Incorrect discovery scope or policy leaves segments with stale RP maps.
- Incorrect or stale host bindings can return the wrong MAC or fail to suppress requests.
- Having an IP-connected VTEP does not mean its peer negotiates EVPN NLRI.
Explanation
Correct Answer
C:Incorrect or stale host bindings can return the wrong MAC or fail to suppress requests. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it. A useful corrective investigation is to measure ARP flood rate and verify authoritative bindings during host changes.
Incorrect Answers
A:Incorrect or missing Type1 signaling can slow convergence or misrepresent ES availability. This is a EVPN Type1 Ethernet auto discovery failure pattern, not the primary EVPN ARP suppression from IP MAC bindings failure in this case. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.
B:Incorrect discovery scope or policy leaves segments with stale RP maps. This is a PIM RP discovery and bootstrap mapping failure pattern, not the primary EVPN ARP suppression from IP MAC bindings failure in this case. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.
D:Having an IP-connected VTEP does not mean its peer negotiates EVPN NLRI. This is a BGP EVPN address-family peer negotiation failure pattern, not the primary EVPN ARP suppression from IP MAC bindings failure in this case. EVPN IP/MAC learning can support distributed ARP suppression where platforms support it.
Question 342
A routed VLAN has receivers but membership records age out after several minutes. After deploying the recommended IGMP querier on subscriber VLAN change, which result MOST directly verifies success?
- Registered printers receive limited required access while unknown MACs are rejected.
- Multicast frames reach receiver ports instead of every port by default.
- Periodic queries refresh receiver membership and groups do not unexpectedly expire.
- Receivers continue forwarding through the surviving RP without changing group configuration.
Explanation
Correct Answer
C:Periodic queries refresh receiver membership and groups do not unexpectedly expire. This is the directly observable outcome for IGMP querier on subscriber VLAN. IGMP queriers maintain host membership state on a local multicast segment.
Incorrect Answers
A:Registered printers receive limited required access while unknown MACs are rejected. This validates MAC RADIUS printer onboarding but does not directly demonstrate the required IGMP querier on subscriber VLAN result. IGMP queriers maintain host membership state on a local multicast segment.
B:Multicast frames reach receiver ports instead of every port by default. This validates IGMP snooping access-port replication but does not directly demonstrate the required IGMP querier on subscriber VLAN result. IGMP queriers maintain host membership state on a local multicast segment.
D:Receivers continue forwarding through the surviving RP without changing group configuration. This validates Anycast RP with shared address but does not directly demonstrate the required IGMP querier on subscriber VLAN result. IGMP queriers maintain host membership state on a local multicast segment.
Question 343
A trunk toward the access layer expects specific VLAN priority bits for voice and video. After deploying the recommended IEEE 802.1p CoS rewrite on Ethernet change, which result MOST directly verifies success?
- Captures and counters explain ingress class egress queue and final header marking.
- Remote peers recognize Ethernet segment participation and respond to advertised withdrawals.
- Captures show intended 802.1Q PCP values without damaging VLAN identity.
- Packet counters show EF-marked traffic assigned to approved forwarding class and queue.
Explanation
Correct Answer
C:Captures show intended 802.1Q PCP values without damaging VLAN identity. This is the directly observable outcome for IEEE 802.1p CoS rewrite on Ethernet. 802.1p PCP bits are distinct from IP DSCP and may require explicit mapping.
Incorrect Answers
A:Captures and counters explain ingress class egress queue and final header marking. This validates CoS processing order ingress to egress but does not directly demonstrate the required IEEE 802.1p CoS rewrite on Ethernet result. 802.1p PCP bits are distinct from IP DSCP and may require explicit mapping.
B:Remote peers recognize Ethernet segment participation and respond to advertised withdrawals. This validates EVPN Type1 Ethernet auto discovery but does not directly demonstrate the required IEEE 802.1p CoS rewrite on Ethernet result. 802.1p PCP bits are distinct from IP DSCP and may require explicit mapping.
D:Packet counters show EF-marked traffic assigned to approved forwarding class and queue. This validates Junos ingress BA DSCP classifier but does not directly demonstrate the required IEEE 802.1p CoS rewrite on Ethernet result. 802.1p PCP bits are distinct from IP DSCP and may require explicit mapping.
Question 344
Customer switches on opposite ends of a provider link stop seeing one another's control frames. Select THREE statements that correctly combine the L2PT customer BPDU tunneling implementation, its evidence, or its governing principle.
- L2PT encapsulates selected customer Layer 2 control frames across a provider domain.
- Assign supported isolated secondary VLAN roles and permitted promiscuous uplink mapping.
- Enable BGP EVPN route reflection as a replacement for tunneling Ethernet BPDUs.
- Customer BPDUs traverse the service and provider STP remains isolated.
- Configure supported Layer 2 Protocol Tunneling for selected customer control protocols.
- Trace each Layer 2 hop for VLAN membership tagging outer and inner tags and protection state.
Explanation
Correct Answers
A:L2PT encapsulates selected customer Layer 2 control frames across a provider domain. It explains the action and observed outcome for L2PT customer BPDU tunneling.
D:Customer BPDUs traverse the service and provider STP remains isolated. This is direct observable evidence for L2PT customer BPDU tunneling.
E:Configure supported Layer 2 Protocol Tunneling for selected customer control protocols. This is the intended implementation action for L2PT customer BPDU tunneling.
Incorrect Answers
B:Assign supported isolated secondary VLAN roles and permitted promiscuous uplink mapping. This belongs to Private VLAN isolated port separation, not the specified L2PT customer BPDU tunneling operation. L2PT encapsulates selected customer Layer 2 control frames across a provider domain.
C:Enable BGP EVPN route reflection as a replacement for tunneling Ethernet BPDUs. This would not be an appropriate L2PT customer BPDU tunneling decision. Without supported control protocol tunneling customer STP may not work across the service.
F:Trace each Layer 2 hop for VLAN membership tagging outer and inner tags and protection state. This belongs to Layer 2 trunk VLAN mismatch diagnosis, not the specified L2PT customer BPDU tunneling operation. L2PT encapsulates selected customer Layer 2 control frames across a provider domain.
Question 345
A newly connected router with high priority does not preempt the existing healthy DR. Which technical principle BEST explains the OSPF designated router election broadcast LAN decision?
- Junos OSPF export policies govern which eligible routes enter OSPF as externals.
- LLDP-MED extends neighbor discovery with voice-oriented network policy information.
- OSPFv2 and OSPFv3 have related SPF logic but separate protocol and address-family configuration.
- OSPF DR election on broadcast networks is priority based and nonpreemptive under normal conditions.
Explanation
Correct Answer
D:OSPF DR election on broadcast networks is priority based and nonpreemptive under normal conditions. In this situation, the relevant action is to tune eligible OSPF interface priority and plan an explicit election event where required.
Incorrect Answers
A:Junos OSPF export policies govern which eligible routes enter OSPF as externals. That principle is related to OSPF external export policy redistribution, not the main OSPF designated router election broadcast LAN choice. Assuming every high-priority router instantly replaces the current DR leads to wrong operational expectations.
B:LLDP-MED extends neighbor discovery with voice-oriented network policy information. That principle is related to LLDP-MED voice network policy, not the main OSPF designated router election broadcast LAN choice. Assuming every high-priority router instantly replaces the current DR leads to wrong operational expectations.
C:OSPFv2 and OSPFv3 have related SPF logic but separate protocol and address-family configuration. That principle is related to OSPFv2 versus OSPFv3 operations, not the main OSPF designated router election broadcast LAN choice. Assuming every high-priority router instantly replaces the current DR leads to wrong operational expectations.
Question 346
One branch has (S,G) state with no downstream outgoing interface after a topology change. Which technical principle BEST explains the Multicast routing table incoming outgoing lists decision?
- Shaping delays packets to smooth egress rate while policing meters and may drop.
- MSDP can exchange source-active awareness across ASM RP domains.
- Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state.
- Multicast RPF prevents loops by checking the expected route toward the source or RP.
Explanation
Correct Answer
C:Multicast forwarding depends on both RPF incoming checks and valid outgoing interface state. In this situation, the relevant action is to correlate multicast route incoming interface with outgoing-interface list and group state.
Incorrect Answers
A:Shaping delays packets to smooth egress rate while policing meters and may drop. That principle is related to Junos egress shaping rate, not the main Multicast routing table incoming outgoing lists choice. Missing OIF state yields no receiver traffic despite an upstream multicast feed.
B:MSDP can exchange source-active awareness across ASM RP domains. That principle is related to MSDP source active exchange, not the main Multicast routing table incoming outgoing lists choice. Missing OIF state yields no receiver traffic despite an upstream multicast feed.
D:Multicast RPF prevents loops by checking the expected route toward the source or RP. That principle is related to Multicast RPF shortest reverse path check, not the main Multicast routing table incoming outgoing lists choice. Missing OIF state yields no receiver traffic despite an upstream multicast feed.
Question 347
Guest browser redirection works but a certificate or session issue prevents authorization. Select THREE statements that correctly combine the Captive portal web authentication implementation, its evidence, or its governing principle.
- Review authentication policy and RADIUS response attributes with an authorized test identity.
- Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation.
- Expose internal management networks to every guest once they open the portal page.
- Configure supported captive portal redirect and identity or terms policy for guest VLANs.
- The guest is redirected appropriately and receives only permitted post-portal access.
- Collect show dot1x interface and access session state plus relevant RADIUS logs.
Explanation
Correct Answers
B:Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation. It explains the action and observed outcome for Captive portal web authentication.
D:Configure supported captive portal redirect and identity or terms policy for guest VLANs. This is the intended implementation action for Captive portal web authentication.
E:The guest is redirected appropriately and receives only permitted post-portal access. This is direct observable evidence for Captive portal web authentication.
Incorrect Answers
A:Review authentication policy and RADIUS response attributes with an authorized test identity. This belongs to RADIUS Access-Accept versus Access-Reject handling, not the specified Captive portal web authentication operation. Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation.
C:Expose internal management networks to every guest once they open the portal page. This would not be an appropriate Captive portal web authentication decision. A portal that grants full internal access after a checkbox violates guest isolation.
F:Collect show dot1x interface and access session state plus relevant RADIUS logs. This belongs to Junos Layer 2 authentication session monitoring, not the specified Captive portal web authentication operation. Captive portal web authentication is not a replacement for cryptographic endpoint supplicant validation.
Question 348
A service provider network recognizes outer VLAN tag using a configured tag protocol identifier. Which configuration or operational step BEST meets the stated requirement?
- Configure root protection on links that must not receive superior root advertisements.
- Configure supported Layer 2 Protocol Tunneling for selected customer control protocols.
- Modify the DSCP value and expect the outer 802.1Q tag EtherType to change.
- Align supported outer-tag TPID and VLAN-stacking configuration across participating devices.
Explanation
Correct Answer
D:Align supported outer-tag TPID and VLAN-stacking configuration across participating devices. VLAN stacking requires compatible tag interpretation and consistent port behavior. The expected validation is that two-tagged frames pass through provider ports with the expected EtherType.
Incorrect Answers
A:Configure root protection on links that must not receive superior root advertisements. This addresses Root protection on designated links rather than the required QinQ tag protocol EtherType compatibility decision. VLAN stacking requires compatible tag interpretation and consistent port behavior.
B:Configure supported Layer 2 Protocol Tunneling for selected customer control protocols. This addresses L2PT customer BPDU tunneling rather than the required QinQ tag protocol EtherType compatibility decision. VLAN stacking requires compatible tag interpretation and consistent port behavior.
C:Modify the DSCP value and expect the outer 802.1Q tag EtherType to change. This is a risky or ineffective shortcut for QinQ tag protocol EtherType compatibility. Mismatched TPID assumptions can cause customer frames to be dropped.
Question 349
A newly installed summary route changes the RPF interface for a heavily used group. Which next investigation or correction is MOST appropriate?
- Increase IGMP membership duration to repair an unrelated reversed unicast route.
- Compare snooping tables and mirrored traffic on subscribed and unsubscribed ports.
- Review show route source prefix versus show multicast route incoming interface.
- Compare RP mappings group ranges and route to RP across nodes.
Explanation
Correct Answer
C:Review show route source prefix versus show multicast route incoming interface. This checks whether incoming multicast packets arrive on the interface selected by a valid source route.
Incorrect Answers
A:Increase IGMP membership duration to repair an unrelated reversed unicast route. That bypass leaves the Multicast source route policy and RPF issue unresolved. An unexpected source route preference may cause RPF failures after a control-plane change.
B:Compare snooping tables and mirrored traffic on subscribed and unsubscribed ports. That check applies chiefly to IGMP snooping access-port replication, not the current Multicast source route policy and RPF issue. RPF uses source or RP reachability and can change when unicast routing changes.
D:Compare RP mappings group ranges and route to RP across nodes. That check applies chiefly to Static RP mapping group range, not the current Multicast source route policy and RPF issue. RPF uses source or RP reachability and can change when unicast routing changes.
Question 350
A classifier places premium voice and ordinary data in the same loss priority. Select TWO statements that correctly combine the Packet loss priority PLP marking implementation, its evidence, or its governing principle.
- Congestion accounting distinguishes low-PLP and high-PLP traffic as intended.
- Set IP TTL to a high value and assume packet loss priority becomes low.
- Assign deliberate PLP values through classification or policing policy.
- Configure suitable RED or WRED drop profiles and map PLP to planned thresholds.
- Define suitable forwarding classes and their supported queue mappings.
Explanation
Correct Answers
A:Congestion accounting distinguishes low-PLP and high-PLP traffic as intended. This is direct observable evidence for Packet loss priority PLP marking.
C:Assign deliberate PLP values through classification or policing policy. This is the intended implementation action for Packet loss priority PLP marking.
Incorrect Answers
B:Set IP TTL to a high value and assume packet loss priority becomes low. This would not be an appropriate Packet loss priority PLP marking decision. Treating every packet as identical PLP may defeat differentiated congestion policy.
D:Configure suitable RED or WRED drop profiles and map PLP to planned thresholds. This belongs to RED WRED drop profile thresholds, not the specified Packet loss priority PLP marking operation. Packet loss priority influences drop likelihood independent of forwarding class alone.
E:Define suitable forwarding classes and their supported queue mappings. This belongs to Junos forwarding class to queue mapping, not the specified Packet loss priority PLP marking operation. Packet loss priority influences drop likelihood independent of forwarding class alone.