Juniper JN0-650 Practice Test 57
Question 560
During an operational risk review, this situation is reported: A switch accidentally places an unauthenticated device into the internal employee VLAN. If the underlying control is neglected, which failure would MOST directly follow?
- Treating one successful login as authorization for every attached client increases exposure.
- An overly permissive guest VLAN becomes an alternative corporate-network entry.
- Missing MSDP source advertisements can isolate multicast sources between RPs.
- Accepting every certificate to restore access undermines network identity controls.
Explanation
Correct Answer
B:An overly permissive guest VLAN becomes an alternative corporate-network entry. Guest VLAN authorizes limited access for eligible unauthenticated clients. A useful corrective investigation is to verify assigned VLAN and ACLs with valid employee and guest test clients.
Incorrect Answers
A:Treating one successful login as authorization for every attached client increases exposure. This is a 802.1X multi-supplicant port control failure pattern, not the primary Guest VLAN for unauthenticated clients failure in this case. Guest VLAN authorizes limited access for eligible unauthenticated clients.
C:Missing MSDP source advertisements can isolate multicast sources between RPs. This is a MSDP source active exchange failure pattern, not the primary Guest VLAN for unauthenticated clients failure in this case. Guest VLAN authorizes limited access for eligible unauthenticated clients.
D:Accepting every certificate to restore access undermines network identity controls. This is a 802.1X EAP authentication credential validation failure pattern, not the primary Guest VLAN for unauthenticated clients failure in this case. Guest VLAN authorizes limited access for eligible unauthenticated clients.
Question 561
A WAN peer expects a traffic-entry preference but sees inconsistent MED attributes. Which next investigation or correction is MOST appropriate?
- Verify received community values and the matching routing-policy terms.
- Inspect advertised BGP MED and compare upstream decision policy when accessible.
- Assign MED through a spanning-tree bridge priority and call it a BGP attribute.
- Inspect show bgp neighbor last error and BGP OPEN notification fields.
Explanation
Correct Answer
B:Inspect advertised BGP MED and compare upstream decision policy when accessible. This checks whether the upstream accepts advertised MED values with understood decision constraints.
Incorrect Answers
A:Verify received community values and the matching routing-policy terms. That check applies chiefly to BGP communities tagging routing intent, not the current BGP MED inbound traffic hint issue. MED is a nontransitive path attribute often compared between paths from the same neighboring AS.
C:Assign MED through a spanning-tree bridge priority and call it a BGP attribute. That bypass leaves the BGP MED inbound traffic hint issue unresolved. Assuming MED overrides every higher-priority BGP selection criterion leads to false expectations.
D:Inspect show bgp neighbor last error and BGP OPEN notification fields. That check applies chiefly to BGP eBGP peer AS and local identity, not the current BGP MED inbound traffic hint issue. MED is a nontransitive path attribute often compared between paths from the same neighboring AS.
Question 562
A customer subnet repeatedly withdraws and reappears causing control-plane churn. Which configuration or operational step BEST meets the stated requirement?
- Configure supported graceful-restart capabilities and safe timers based on design.
- Raise Ethernet MTU to eliminate every BGP route-flap penalty.
- Apply controlled AS_PATH prepending in export policy to appropriate external neighbors.
- Apply supported route-flap damping only where its stability tradeoff is justified.
Explanation
Correct Answer
D:Apply supported route-flap damping only where its stability tradeoff is justified. Route damping suppresses unstable routes but adds recovery latency. The expected validation is that flapping prefixes are damped according to intended thresholds and recover within acceptable time.
Incorrect Answers
A:Configure supported graceful-restart capabilities and safe timers based on design. This addresses BGP graceful restart session continuity rather than the required BGP route damping flap penalty decision. Route damping suppresses unstable routes but adds recovery latency.
B:Raise Ethernet MTU to eliminate every BGP route-flap penalty. This is a risky or ineffective shortcut for BGP route damping flap penalty. Damping critical destinations without review can prolong customer downtime.
C:Apply controlled AS_PATH prepending in export policy to appropriate external neighbors. This addresses BGP AS path prepend outbound advertisement rather than the required BGP route damping flap penalty decision. Route damping suppresses unstable routes but adds recovery latency.
Question 563
During an operational risk review, this situation is reported: A VLAN disappears from a transit because one switch does not participate in dynamic registration. If the underlying control is neglected, which failure would MOST directly follow?
- Identical RP addresses without source-state coordination can break ASM reachability.
- Misconfigured VLAN-specific roots can send traffic over inefficient links.
- Leaving roots uncontrolled may put access switches in core transit roles.
- Incomplete participation can leave VLANs unregistered on intermediate trunks.
Explanation
Correct Answer
D:Incomplete participation can leave VLANs unregistered on intermediate trunks. MVRP advertises VLAN registration dynamically between compatible bridge ports. A useful corrective investigation is to inspect MVRP registration status and learned dynamic VLAN entries.
Incorrect Answers
A:Identical RP addresses without source-state coordination can break ASM reachability. This is a Anycast RP with shared address failure pattern, not the primary MVRP dynamic VLAN registration failure in this case. MVRP advertises VLAN registration dynamically between compatible bridge ports.
B:Misconfigured VLAN-specific roots can send traffic over inefficient links. This is a VSTP per-VLAN root distribution failure pattern, not the primary MVRP dynamic VLAN registration failure in this case. MVRP advertises VLAN registration dynamically between compatible bridge ports.
C:Leaving roots uncontrolled may put access switches in core transit roles. This is a MSTP instance root selection failure pattern, not the primary MVRP dynamic VLAN registration failure in this case. MVRP advertises VLAN registration dynamically between compatible bridge ports.
Question 564
A snooping switch has no valid querier or membership state and ages out port membership. Which technical principle BEST explains the IGMP snooping access-port replication decision?
- Import changes received-route eligibility while export governs what is sent to peers.
- IGMP snooping uses observed host joins to constrain layer-2 multicast replication.
- Multicast involves host membership router tree state and actual forwarding traffic.
- PIM establishes multicast router adjacencies independently of host IGMP group membership.
Explanation
Correct Answer
B:IGMP snooping uses observed host joins to constrain layer-2 multicast replication. In this situation, the relevant action is to enable appropriate IGMP snooping and maintain valid querier membership learning.
Incorrect Answers
A:Import changes received-route eligibility while export governs what is sent to peers. That principle is related to BGP import versus export policy direction, not the main IGMP snooping access-port replication choice. Missing membership state or wrong querier behavior can flood or blackhole multicast.
C:Multicast involves host membership router tree state and actual forwarding traffic. That principle is related to Multicast troubleshooting separate control and data planes, not the main IGMP snooping access-port replication choice. Missing membership state or wrong querier behavior can flood or blackhole multicast.
D:PIM establishes multicast router adjacencies independently of host IGMP group membership. That principle is related to PIM sparse-mode neighbor discovery, not the main IGMP snooping access-port replication choice. Missing membership state or wrong querier behavior can flood or blackhole multicast.
Question 565
A router receives packets marked DSCP EF and must map them to expedited forwarding. After deploying the recommended Junos ingress BA DSCP classifier change, which result MOST directly verifies success?
- Each packet class reaches the planned output queue with expected counters.
- Packet counters show EF-marked traffic assigned to approved forwarding class and queue.
- Congestion accounting distinguishes low-PLP and high-PLP traffic as intended.
- Only matching tenant EVPN routes import and authorized MAC learning succeeds.
Explanation
Correct Answer
B:Packet counters show EF-marked traffic assigned to approved forwarding class and queue. This is the directly observable outcome for Junos ingress BA DSCP classifier. BA classification interprets existing packet markings and assigns forwarding class and loss priority.
Incorrect Answers
A:Each packet class reaches the planned output queue with expected counters. This validates Junos forwarding class to queue mapping but does not directly demonstrate the required Junos ingress BA DSCP classifier result. BA classification interprets existing packet markings and assigns forwarding class and loss priority.
C:Congestion accounting distinguishes low-PLP and high-PLP traffic as intended. This validates Packet loss priority PLP marking but does not directly demonstrate the required Junos ingress BA DSCP classifier result. BA classification interprets existing packet markings and assigns forwarding class and loss priority.
D:Only matching tenant EVPN routes import and authorized MAC learning succeeds. This validates EVPN route target import export scope but does not directly demonstrate the required Junos ingress BA DSCP classifier result. BA classification interprets existing packet markings and assigns forwarding class and loss priority.
Question 566
A team expects BGP path selection to decide between routes learned from separate protocols. Which next investigation or correction is MOST appropriate?
- Inspect show route hidden extensive and relevant policy terms.
- Inspect show route extensive for route preference protocol and active flag.
- Verify capability negotiation and route states during controlled restart.
- Increase BGP MED and assume it necessarily beats an OSPF route in Junos RIB selection.
Explanation
Correct Answer
B:Inspect show route extensive for route preference protocol and active flag. This checks whether active route reflects Junos protocol preference then applicable next-hop and policy conditions.
Incorrect Answers
A:Inspect show route hidden extensive and relevant policy terms. That check applies chiefly to BGP hidden and rejected path diagnosis, not the current BGP route preference versus OSPF issue. Junos route selection between protocols is not the same as BGP best-path selection.
C:Verify capability negotiation and route states during controlled restart. That check applies chiefly to BGP graceful restart session continuity, not the current BGP route preference versus OSPF issue. Junos route selection between protocols is not the same as BGP best-path selection.
D:Increase BGP MED and assume it necessarily beats an OSPF route in Junos RIB selection. That bypass leaves the BGP route preference versus OSPF issue unresolved. Confusing local preference with Junos route preference can produce wrong active-route reasoning.
Question 567
A leaf receives valid Type2 routes but its MAC-VRF does not import them. After deploying the recommended EVPN route target import export scope change, which result MOST directly verifies success?
- Each participating VTEP has the required BUM flood destinations for the VNI.
- The preferred external route follows correct E1 total metric or E2 selection rules.
- Peers agree on a common Ethernet segment and relevant EVPN ES routes.
- Only matching tenant EVPN routes import and authorized MAC learning succeeds.
Explanation
Correct Answer
D:Only matching tenant EVPN routes import and authorized MAC learning succeeds. This is the directly observable outcome for EVPN route target import export scope. EVPN route targets control distribution membership independently of VNI packet encapsulation.
Incorrect Answers
A:Each participating VTEP has the required BUM flood destinations for the VNI. This validates EVPN Type3 IMET inclusive multicast routes but does not directly demonstrate the required EVPN route target import export scope result. EVPN route targets control distribution membership independently of VNI packet encapsulation.
B:The preferred external route follows correct E1 total metric or E2 selection rules. This validates OSPF external type-one versus type-two metrics but does not directly demonstrate the required EVPN route target import export scope result. EVPN route targets control distribution membership independently of VNI packet encapsulation.
C:Peers agree on a common Ethernet segment and relevant EVPN ES routes. This validates Ethernet segment identifier ESI consistency but does not directly demonstrate the required EVPN route target import export scope result. EVPN route targets control distribution membership independently of VNI packet encapsulation.
Question 568
A new iBGP route-reflector cluster learns prefixes whose next hop exists only at the exit router. Select TWO statements that correctly combine the iBGP next-hop-self on edge implementation, its evidence, or its governing principle.
- Internal clients install reachable paths and forward via the intended exit router.
- Permit the intended TCP179 flow under explicit control-plane security policy.
- Set a larger LOCAL_PREF and assume that makes an unresolved next hop reachable.
- Apply supported BGP accepted-prefix limits and operational alerts.
- Apply a scoped BGP next-hop-self or next-hop resolution design at the appropriate edge.
Explanation
Correct Answers
A:Internal clients install reachable paths and forward via the intended exit router. This is direct observable evidence for iBGP next-hop-self on edge.
E:Apply a scoped BGP next-hop-self or next-hop resolution design at the appropriate edge. This is the intended implementation action for iBGP next-hop-self on edge.
Incorrect Answers
B:Permit the intended TCP179 flow under explicit control-plane security policy. This belongs to BGP TCP 179 and firewall reachability, not the specified iBGP next-hop-self on edge operation. iBGP may preserve external next-hop attributes unless policy changes them.
C:Set a larger LOCAL_PREF and assume that makes an unresolved next hop reachable. This would not be an appropriate iBGP next-hop-self on edge decision. Unreachable preserved eBGP next hops can make internally advertised routes unusable.
D:Apply supported BGP accepted-prefix limits and operational alerts. This belongs to BGP prefix-limit peer protection, not the specified iBGP next-hop-self on edge operation. iBGP may preserve external next-hop attributes unless policy changes them.
Question 569
A routing policy should remove one internal community before advertising externally. Which technical principle BEST explains the BGP communities match and deletion decision?
- MVRP advertises VLAN registration dynamically between compatible bridge ports.
- BGP route reflection reduces iBGP full-mesh needs using originator and cluster loop controls.
- iBGP may preserve external next-hop attributes unless policy changes them.
- Communities can be selectively matched manipulated and stripped in routing policy.
Explanation
Correct Answer
D:Communities can be selectively matched manipulated and stripped in routing policy. In this situation, the relevant action is to match and add or delete only documented communities using supported Junos policy statements.
Incorrect Answers
A:MVRP advertises VLAN registration dynamically between compatible bridge ports. That principle is related to MVRP dynamic VLAN registration, not the main BGP communities match and deletion choice. Exporting internal tags to a peer may disclose internal routing policy semantics.
B:BGP route reflection reduces iBGP full-mesh needs using originator and cluster loop controls. That principle is related to BGP route reflection cluster, not the main BGP communities match and deletion choice. Exporting internal tags to a peer may disclose internal routing policy semantics.
C:IBGP may preserve external next-hop attributes unless policy changes them. That principle is related to iBGP next-hop-self on edge, not the main BGP communities match and deletion choice. Exporting internal tags to a peer may disclose internal routing policy semantics.
Question 570
A leaf's loopback address disappears from the fabric underlay after a routing change. Which technical principle BEST explains the VXLAN VTEP loopback underlay route decision?
- Type1 Ethernet A-D routes signal Ethernet segment reachability and support multihoming convergence.
- RP mapping and unicast RP reachability are separate multicast requirements.
- EVPN all-active multihoming can use parallel forwarding paths with designated loop protection.
- VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning.
Explanation
Correct Answer
D:VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning. In this situation, the relevant action is to restore valid underlay routing to VTEP addresses and verify permitted VXLAN traffic.
Incorrect Answers
A:Type1 Ethernet A-D routes signal Ethernet segment reachability and support multihoming convergence. That principle is related to EVPN Type1 Ethernet auto discovery, not the main VXLAN VTEP loopback underlay route choice. An EVPN Type2 route with unreachable tunnel next hop cannot deliver traffic.
B:RP mapping and unicast RP reachability are separate multicast requirements. That principle is related to Static RP mapping group range, not the main VXLAN VTEP loopback underlay route choice. An EVPN Type2 route with unreachable tunnel next hop cannot deliver traffic.
C:EVPN all-active multihoming can use parallel forwarding paths with designated loop protection. That principle is related to EVPN all-active multihoming forwarding, not the main VXLAN VTEP loopback underlay route choice. An EVPN Type2 route with unreachable tunnel next hop cannot deliver traffic.
