Juniper JN0-650 Practice Test 59
Question 580
An edge policy uses community values to decide whether to advertise specific routes. Select TWO statements that correctly combine the BGP communities tagging routing intent implementation, its evidence, or its governing principle.
- Apply supported route-flap damping only where its stability tradeoff is justified.
- Trace BGP received route status through import policy next-hop resolution and path eligibility.
- Rename a BGP group Backup and assume it inserts communities into all updates.
- Add approved BGP community tags and match them in explicit import or export policies.
- Tagged prefixes follow documented export or preference behavior at the target neighbor.
Explanation
Correct Answers
D:Add approved BGP community tags and match them in explicit import or export policies. This is the intended implementation action for BGP communities tagging routing intent.
E:Tagged prefixes follow documented export or preference behavior at the target neighbor. This is direct observable evidence for BGP communities tagging routing intent.
Incorrect Answers
A:Apply supported route-flap damping only where its stability tradeoff is justified. This belongs to BGP route damping flap penalty, not the specified BGP communities tagging routing intent operation. BGP communities carry policy metadata without directly supplying next-hop reachability.
B:Trace BGP received route status through import policy next-hop resolution and path eligibility. This belongs to BGP hidden and rejected path diagnosis, not the specified BGP communities tagging routing intent operation. BGP communities carry policy metadata without directly supplying next-hop reachability.
C:Rename a BGP group Backup and assume it inserts communities into all updates. This would not be an appropriate BGP communities tagging routing intent decision. Marking a community without a matching policy may not change routing.
Question 581
A remote router unexpectedly prefers a type-two external despite a longer route to its ASBR. Select TWO statements that correctly combine the OSPF external type-one versus type-two metrics implementation, its evidence, or its governing principle.
- Align supported MTU and OSPF adjacency expectations on the link.
- Increase a LAN VLAN ID and expect it to change the OSPF external metric type.
- The preferred external route follows correct E1 total metric or E2 selection rules.
- Choose an intentional OSPF external metric type and test ASBR reachability assumptions.
- Use a consistent OSPF reference-bandwidth policy across the intended routing domain.
Explanation
Correct Answers
C:The preferred external route follows correct E1 total metric or E2 selection rules. This is direct observable evidence for OSPF external type-one versus type-two metrics.
D:Choose an intentional OSPF external metric type and test ASBR reachability assumptions. This is the intended implementation action for OSPF external type-one versus type-two metrics.
Incorrect Answers
A:Align supported MTU and OSPF adjacency expectations on the link. This belongs to OSPF interface MTU mismatch, not the specified OSPF external type-one versus type-two metrics operation. OSPF E1 includes internal cost to ASBR whereas E2 comparison primarily uses external metric.
B:Increase a LAN VLAN ID and expect it to change the OSPF external metric type. This would not be an appropriate OSPF external type-one versus type-two metrics decision. Treating E1 and E2 as interchangeable can send traffic over an unsuitable exit.
E:Use a consistent OSPF reference-bandwidth policy across the intended routing domain. This belongs to OSPF reference bandwidth and high-speed links, not the specified OSPF external type-one versus type-two metrics operation. OSPF E1 includes internal cost to ASBR whereas E2 comparison primarily uses external metric.
Question 582
Legacy printers cannot run an 802.1X supplicant but require controlled admission. Which configuration or operational step BEST meets the stated requirement?
- Apply deliberate supported authentication method ordering and independent role policy.
- Configure supported captive portal redirect and identity or terms policy for guest VLANs.
- Configure supported MAC-based RADIUS authentication with narrow device policies.
- Place every MAC into the administrator allowlist to simplify printer onboarding.
Explanation
Correct Answer
C:Configure supported MAC-based RADIUS authentication with narrow device policies. MAC RADIUS can authorize nonsupplicant devices but MAC identity is easier to spoof. The expected validation is that registered printers receive limited required access while unknown MACs are rejected.
Incorrect Answers
A:Apply deliberate supported authentication method ordering and independent role policy. This addresses 802.1X versus MAC RADIUS method priority rather than the required MAC RADIUS printer onboarding decision. MAC RADIUS can authorize nonsupplicant devices but MAC identity is easier to spoof.
B:Configure supported captive portal redirect and identity or terms policy for guest VLANs. This addresses Captive portal web authentication rather than the required MAC RADIUS printer onboarding decision. MAC RADIUS can authorize nonsupplicant devices but MAC identity is easier to spoof.
D:Place every MAC into the administrator allowlist to simplify printer onboarding. This is a risky or ineffective shortcut for MAC RADIUS printer onboarding. Treating a MAC address as strong cryptographic proof can weaken segmentation.
Question 583
A visitor copies the allowed printer MAC address to a laptop. Which configuration or operational step BEST meets the stated requirement?
- Configure supported MAC-based RADIUS authentication with narrow device policies.
- Review authentication policy and RADIUS response attributes with an authorized test identity.
- Restrict MAC RADIUS to low-trust device segments and use stronger 802.1X for capable users.
- Treat a globally unique MAC as unforgeable proof of employee identity.
Explanation
Correct Answer
C:Restrict MAC RADIUS to low-trust device segments and use stronger 802.1X for capable users. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities. The expected validation is that spoofed MAC identity cannot grant administrator or high-trust employee access.
Incorrect Answers
A:Configure supported MAC-based RADIUS authentication with narrow device policies. This addresses MAC RADIUS printer onboarding rather than the required MAC RADIUS spoofing limitations decision. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
B:Review authentication policy and RADIUS response attributes with an authorized test identity. This addresses RADIUS Access-Accept versus Access-Reject handling rather than the required MAC RADIUS spoofing limitations decision. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
D:Treat a globally unique MAC as unforgeable proof of employee identity. This is a risky or ineffective shortcut for MAC RADIUS spoofing limitations. Placing critical admin endpoints behind MAC-only authentication permits spoofing risk.
Question 584
During an operational risk review, this situation is reported: A new leaf is missing from the replication membership of a VXLAN VNI. If the underlying control is neglected, which failure would MOST directly follow?
- Using ASM-only membership for an SSM group prevents the intended source-specific join.
- An EVPN Type2 route with unreachable tunnel next hop cannot deliver traffic.
- Missing IMET state can break ARP and unknown unicast even with selected Type2 routes.
- Incorrect DF state may duplicate BUM traffic or strand a segment after failure.
Explanation
Correct Answer
C:Missing IMET state can break ARP and unknown unicast even with selected Type2 routes. Type3 IMET routes signal participation in an EVPN broadcast domain for BUM distribution. A useful corrective investigation is to inspect EVPN Type3 routes and flood lists for the affected VNI.
Incorrect Answers
A:Using ASM-only membership for an SSM group prevents the intended source-specific join. This is a SSM without rendezvous point failure pattern, not the primary EVPN Type3 IMET inclusive multicast routes failure in this case. Type3 IMET routes signal participation in an EVPN broadcast domain for BUM distribution.
B:An EVPN Type2 route with unreachable tunnel next hop cannot deliver traffic. This is a VXLAN VTEP loopback underlay route failure pattern, not the primary EVPN Type3 IMET inclusive multicast routes failure in this case. Type3 IMET routes signal participation in an EVPN broadcast domain for BUM distribution.
D:Incorrect DF state may duplicate BUM traffic or strand a segment after failure. This is a EVPN designated forwarder DF for BUM failure pattern, not the primary EVPN Type3 IMET inclusive multicast routes failure in this case. Type3 IMET routes signal participation in an EVPN broadcast domain for BUM distribution.
Question 585
A new point-to-point IPv6 interface has global addresses but missing OSPFv3 enablement. Select TWO statements that correctly combine the OSPFv3 IPv6 link-local neighbor formation implementation, its evidence, or its governing principle.
- Add an IPv4 static route and treat it as proof OSPFv3 neighbors are established.
- Configure an appropriate NSSA design and verify type-7 external translation where applicable.
- IPv6 link-local neighbors exchange OSPFv3 packets and learn approved prefixes.
- Verify IPv6 interface participation and OSPFv3 prefix advertisement settings.
- Configure supported OSPFv3 interface participation and compatible neighbor settings.
Explanation
Correct Answers
C:IPv6 link-local neighbors exchange OSPFv3 packets and learn approved prefixes. This is direct observable evidence for OSPFv3 IPv6 link-local neighbor formation.
E:Configure supported OSPFv3 interface participation and compatible neighbor settings. This is the intended implementation action for OSPFv3 IPv6 link-local neighbor formation.
Incorrect Answers
A:Add an IPv4 static route and treat it as proof OSPFv3 neighbors are established. This would not be an appropriate OSPFv3 IPv6 link-local neighbor formation decision. Global IPv6 addressing alone does not guarantee OSPFv3 routing.
B:Configure an appropriate NSSA design and verify type-7 external translation where applicable. This belongs to OSPF NSSA type-seven translation, not the specified OSPFv3 IPv6 link-local neighbor formation operation. OSPFv3 IPv6 adjacencies depend on link-local reachability and protocol enablement.
D:Verify IPv6 interface participation and OSPFv3 prefix advertisement settings. This belongs to OSPFv3 IPv6 prefix advertisement, not the specified OSPFv3 IPv6 link-local neighbor formation operation. OSPFv3 IPv6 adjacencies depend on link-local reachability and protocol enablement.
Question 586
A RADIUS Access-Accept succeeds but the switch keeps the default guest VLAN. Which next investigation or correction is MOST appropriate?
- Correlate failure timestamp with EAPOL RADIUS and assigned VLAN evidence.
- Add a VLAN label to the device hostname and assume RADIUS returns it.
- Inspect RADIUS tunnel attributes and actual assigned port VLAN membership.
- Inspect authenticator sessions and RADIUS logs before and after service restoration.
Explanation
Correct Answer
C:Inspect RADIUS tunnel attributes and actual assigned port VLAN membership. This checks whether authenticated users enter the intended authorized VLAN while rejected users do not.
Incorrect Answers
A:Correlate failure timestamp with EAPOL RADIUS and assigned VLAN evidence. That check applies chiefly to Junos Layer 2 authentication session monitoring, not the current Dynamic VLAN assignment from RADIUS issue. RADIUS authorization can assign network context after successful authentication.
B:Add a VLAN label to the device hostname and assume RADIUS returns it. That bypass leaves the Dynamic VLAN assignment from RADIUS issue unresolved. Successful authentication alone does not prove dynamic VLAN attributes are accepted.
D:Inspect authenticator sessions and RADIUS logs before and after service restoration. That check applies chiefly to RADIUS server-fail remediation and reauthentication, not the current Dynamic VLAN assignment from RADIUS issue. RADIUS authorization can assign network context after successful authentication.
Question 587
One laptop has the correct username but an untrusted EAP server certificate. Which next investigation or correction is MOST appropriate?
- Inspect EAP failure reason and client/server trust chains.
- Disable RADIUS certificate checking for all wired users permanently.
- Review session timers and test role change after reauthentication.
- Test authorized and unauthorized MACs behind the same physical port.
Explanation
Correct Answer
A:Inspect EAP failure reason and client/server trust chains. This checks whether authorized user EAP exchanges complete while invalid or expired certificates are rejected.
Incorrect Answers
B:Disable RADIUS certificate checking for all wired users permanently. That bypass leaves the 802.1X EAP authentication credential validation issue unresolved. Accepting every certificate to restore access undermines network identity controls.
C:Review session timers and test role change after reauthentication. That check applies chiefly to 802.1X periodic reauthentication, not the current 802.1X EAP authentication credential validation issue. EAP credential validation requires mutual compatible authentication and trust policy.
D:Test authorized and unauthorized MACs behind the same physical port. That check applies chiefly to 802.1X multi-supplicant port control, not the current 802.1X EAP authentication credential validation issue. EAP credential validation requires mutual compatible authentication and trust policy.
Question 588
A managed laptop must authenticate before receiving production VLAN traffic. Which configuration or operational step BEST meets the stated requirement?
- Configure supported reauthentication or session restoration after AAA recovery.
- Change the OSPF router ID and assume user 802.1X certificates become valid.
- Configure supported captive portal redirect and identity or terms policy for guest VLANs.
- Configure supported 802.1X authenticator on edge ports and RADIUS server reachability.
Explanation
Correct Answer
D:Configure supported 802.1X authenticator on edge ports and RADIUS server reachability. 802.1X separates supplicant authenticator and authentication server roles. The expected validation is that a compliant supplicant authenticates and the switch authorizes its port policy.
Incorrect Answers
A:Configure supported reauthentication or session restoration after AAA recovery. This addresses RADIUS server-fail remediation and reauthentication rather than the required 802.1X supplicant authenticator RADIUS roles decision. 802.1X separates supplicant authenticator and authentication server roles.
B:Change the OSPF router ID and assume user 802.1X certificates become valid. This is a risky or ineffective shortcut for 802.1X supplicant authenticator RADIUS roles. Treating RADIUS as an EAPOL packet directly emitted by the laptop prevents correct troubleshooting.
C:Configure supported captive portal redirect and identity or terms policy for guest VLANs. This addresses Captive portal web authentication rather than the required 802.1X supplicant authenticator RADIUS roles decision. 802.1X separates supplicant authenticator and authentication server roles.
Question 589
During an operational risk review, this situation is reported: A private VLAN isolated endpoint can reach another isolated endpoint because role assignments are wrong. If the underlying control is neglected, which failure would MOST directly follow?
- Removing the inner tag can merge otherwise separate customer networks.
- Treating primary VLAN membership alone as isolation allows undesired peer traffic.
- Broad first-match conditions can eclipse later VLAN classification terms.
- Inconsistent RP views can divide a single group into separate multicast trees.
Explanation
Correct Answer
B:Treating primary VLAN membership alone as isolation allows undesired peer traffic. Private VLAN isolation provides Layer 2 separation within a shared primary VLAN. A useful corrective investigation is to validate allowed gateway ping and blocked peer-to-peer Layer 2 paths.
Incorrect Answers
A:Removing the inner tag can merge otherwise separate customer networks. This is a QinQ service VLAN outer tag failure pattern, not the primary Private VLAN isolated port separation failure in this case. Private VLAN isolation provides Layer 2 separation within a shared primary VLAN.
C:Broad first-match conditions can eclipse later VLAN classification terms. This is a Filter-based VLAN rule precedence failure pattern, not the primary Private VLAN isolated port separation failure in this case. Private VLAN isolation provides Layer 2 separation within a shared primary VLAN.
D:Inconsistent RP views can divide a single group into separate multicast trees. This is a Static RP mapping group range failure pattern, not the primary Private VLAN isolated port separation failure in this case. Private VLAN isolation provides Layer 2 separation within a shared primary VLAN.
Question 590
Network design requires stronger authorization for privileged endpoints than a known hardware address. Which next investigation or correction is MOST appropriate?
- Correlate failure timestamp with EAPOL RADIUS and assigned VLAN evidence.
- Verify assigned VLAN and ACLs with valid employee and guest test clients.
- Test an unauthorized device with a duplicate MAC in a nonproduction scenario.
- Treat a globally unique MAC as unforgeable proof of employee identity.
Explanation
Correct Answer
C:Test an unauthorized device with a duplicate MAC in a nonproduction scenario. This checks whether spoofed MAC identity cannot grant administrator or high-trust employee access.
Incorrect Answers
A:Correlate failure timestamp with EAPOL RADIUS and assigned VLAN evidence. That check applies chiefly to Junos Layer 2 authentication session monitoring, not the current MAC RADIUS spoofing limitations issue. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
B:Verify assigned VLAN and ACLs with valid employee and guest test clients. That check applies chiefly to Guest VLAN for unauthenticated clients, not the current MAC RADIUS spoofing limitations issue. MAC addresses can be imitated and are weaker credentials than authenticated EAP identities.
D:Treat a globally unique MAC as unforgeable proof of employee identity. That bypass leaves the MAC RADIUS spoofing limitations issue unresolved. Placing critical admin endpoints behind MAC-only authentication permits spoofing risk.
