Juniper JN0-650 Practice Test 63
Question 620
A Junos VSTP domain unintentionally selects one root for all VLANs. Which technical principle BEST explains the VSTP per-VLAN root distribution decision?
- Spanning tree chooses port roles to avoid loops while maintaining redundant paths.
- VSTP runs per-VLAN spanning-tree decisions rather than one shared instance.
- Filter-based VLAN decisions can classify traffic by supported packet fields instead of fixed port membership alone.
- RADIUS outcomes express AAA authorization decisions separate from transport connectivity.
Explanation
Correct Answer
B:VSTP runs per-VLAN spanning-tree decisions rather than one shared instance. In this situation, the relevant action is to configure appropriate VSTP VLAN-specific bridge priorities and port values.
Incorrect Answers
A:Spanning tree chooses port roles to avoid loops while maintaining redundant paths. That principle is related to MSTP root port and alternate path, not the main VSTP per-VLAN root distribution choice. Misconfigured VLAN-specific roots can send traffic over inefficient links.
C:Filter-based VLAN decisions can classify traffic by supported packet fields instead of fixed port membership alone. That principle is related to Filter-based VLAN assignment, not the main VSTP per-VLAN root distribution choice. Misconfigured VLAN-specific roots can send traffic over inefficient links.
D:RADIUS outcomes express AAA authorization decisions separate from transport connectivity. That principle is related to RADIUS Access-Accept versus Access-Reject handling, not the main VSTP per-VLAN root distribution choice. Misconfigured VLAN-specific roots can send traffic over inefficient links.
Question 621
An RP address is configured but not reachable via the unicast underlay. Select TWO statements that correctly combine the Static RP mapping group range implementation, its evidence, or its governing principle.
- Correlate multicast route incoming interface with outgoing-interface list and group state.
- Use IGMPv3-capable receivers and source-specific membership where applicable.
- Every receiver-facing router resolves the same intended RP for each permitted group.
- Apply a consistent scoped RP mapping with verified routing to the RP.
- Set a BGP community called RP and assume all PIM routers adopt it.
Explanation
Correct Answers
C:Every receiver-facing router resolves the same intended RP for each permitted group. This is direct observable evidence for Static RP mapping group range.
D:Apply a consistent scoped RP mapping with verified routing to the RP. This is the intended implementation action for Static RP mapping group range.
Incorrect Answers
A:Correlate multicast route incoming interface with outgoing-interface list and group state. This belongs to Multicast routing table incoming outgoing lists, not the specified Static RP mapping group range operation. RP mapping and unicast RP reachability are separate multicast requirements.
B:Use IGMPv3-capable receivers and source-specific membership where applicable. This belongs to IGMPv3 source include mode, not the specified Static RP mapping group range operation. RP mapping and unicast RP reachability are separate multicast requirements.
E:Set a BGP community called RP and assume all PIM routers adopt it. This would not be an appropriate Static RP mapping group range decision. Inconsistent RP views can divide a single group into separate multicast trees.
Question 622
A misconfigured RT causes tenant A MAC routes to appear in tenant B routing context. Which technical principle BEST explains the EVPN route target import export scope decision?
- Q-in-Q tunnels customer 802.1Q tags inside a provider service VLAN.
- Type1 Ethernet A-D routes signal Ethernet segment reachability and support multihoming convergence.
- EVPN route targets control distribution membership independently of VNI packet encapsulation.
- ESI identifies a shared multihomed Ethernet segment to EVPN control plane.
Explanation
Correct Answer
C:EVPN route targets control distribution membership independently of VNI packet encapsulation. In this situation, the relevant action is to set compatible route-target import and export policy for intended EVPN instances.
Incorrect Answers
A:Q-in-Q tunnels customer 802.1Q tags inside a provider service VLAN. That principle is related to QinQ service VLAN outer tag, not the main EVPN route target import export scope choice. Excessively broad RT import can expose tenant routes or create wrong forwarding entries.
B:Type1 Ethernet A-D routes signal Ethernet segment reachability and support multihoming convergence. That principle is related to EVPN Type1 Ethernet auto discovery, not the main EVPN route target import export scope choice. Excessively broad RT import can expose tenant routes or create wrong forwarding entries.
D:ESI identifies a shared multihomed Ethernet segment to EVPN control plane. That principle is related to Ethernet segment identifier ESI consistency, not the main EVPN route target import export scope choice. Excessively broad RT import can expose tenant routes or create wrong forwarding entries.
Question 623
A distribution port blocks when superior BPDUs arrive from a downstream access switch. Which technical principle BEST explains the Root protection on designated links decision?
- Spanning tree chooses port roles to avoid loops while maintaining redundant paths.
- MVRP advertises VLAN registration dynamically between compatible bridge ports.
- Multifield classification can use packet fields beyond preexisting DSCP markings.
- Root protection guards designated bridge roles against unexpected root changes.
Explanation
Correct Answer
D:Root protection guards designated bridge roles against unexpected root changes. In this situation, the relevant action is to configure root protection on links that must not receive superior root advertisements.
Incorrect Answers
A:Spanning tree chooses port roles to avoid loops while maintaining redundant paths. That principle is related to MSTP root port and alternate path, not the main Root protection on designated links choice. Allowing untrusted access switches to become STP root can shift and disrupt network paths.
B:MVRP advertises VLAN registration dynamically between compatible bridge ports. That principle is related to MVRP dynamic VLAN registration, not the main Root protection on designated links choice. Allowing untrusted access switches to become STP root can shift and disrupt network paths.
C:Multifield classification can use packet fields beyond preexisting DSCP markings. That principle is related to Junos multifield firewall filter classification, not the main Root protection on designated links choice. Allowing untrusted access switches to become STP root can shift and disrupt network paths.
Question 624
A regional ABR advertises intra-area prefixes but cannot move routes across the backbone. Which next investigation or correction is MOST appropriate?
- Check ABR area membership backbone adjacency and summary LSAs.
- Create a separate nonbackbone area ID at both ends and expect it to substitute for area zero.
- Compare interarea LSAs and test addresses at aggregate boundaries.
- Compare export term counters originator LSDB and external destinations on a neighbor.
Explanation
Correct Answer
A:Check ABR area membership backbone adjacency and summary LSAs. This checks whether interarea prefixes traverse the intended backbone with stable SPF reachability.
Incorrect Answers
B:Create a separate nonbackbone area ID at both ends and expect it to substitute for area zero. That bypass leaves the OSPF area-border backbone connectivity issue unresolved. Designing arbitrary direct interarea exchanges without a backbone can partition routing.
C:Compare interarea LSAs and test addresses at aggregate boundaries. That check applies chiefly to OSPF interarea route summarization, not the current OSPF area-border backbone connectivity issue. Standard multi-area OSPF uses the backbone to exchange interarea information.
D:Compare export term counters originator LSDB and external destinations on a neighbor. That check applies chiefly to OSPF external export policy redistribution, not the current OSPF area-border backbone connectivity issue. Standard multi-area OSPF uses the backbone to exchange interarea information.
Question 625
A network operator observes one large TCP flow uses one of two equal-cost BGP paths. Which configuration or operational step BEST meets the stated requirement?
- Trace BGP received route status through import policy next-hop resolution and path eligibility.
- Increase BGP hold timer to force a single TCP session to use both ECMP links.
- Restore valid next-hop reachability without indiscriminately accepting broken routes.
- Validate supported forwarding-table hashing and load distribution across many distinct flows.
Explanation
Correct Answer
D:Validate supported forwarding-table hashing and load distribution across many distinct flows. ECMP commonly hashes traffic flows rather than balancing individual packets deterministically. The expected validation is that aggregate flows use eligible next hops without causing excessive same-flow reordering.
Incorrect Answers
A:Trace BGP received route status through import policy next-hop resolution and path eligibility. This addresses BGP hidden and rejected path diagnosis rather than the required BGP ECMP per-flow hashing decision. ECMP commonly hashes traffic flows rather than balancing individual packets deterministically.
B:Increase BGP hold timer to force a single TCP session to use both ECMP links. This is a risky or ineffective shortcut for BGP ECMP per-flow hashing. Predicting equal utilization for a single heavy flow misunderstands per-flow selection.
C:Restore valid next-hop reachability without indiscriminately accepting broken routes. This addresses BGP next-hop reachability hidden route rather than the required BGP ECMP per-flow hashing decision. ECMP commonly hashes traffic flows rather than balancing individual packets deterministically.
Question 626
A malicious workstation marks all packets as expedited voice using an attached phone switch. Which next investigation or correction is MOST appropriate?
- Inspect LLDP-MED advertisements and tagged phone frames on the link.
- Treat a phone's physical presence as authorization for every downstream workstation.
- Inspect show poe interface and total allocated versus available watts.
- Compare ingress classification and permitted VLANs for phone versus PC traffic.
Explanation
Correct Answer
D:Compare ingress classification and permitted VLANs for phone versus PC traffic. This checks whether legitimate phone traffic receives voice service while PC traffic cannot gain voice privileges.
Incorrect Answers
A:Inspect LLDP-MED advertisements and tagged phone frames on the link. That check applies chiefly to LLDP-MED voice network policy, not the current Phone and PC shared switch-port security issue. Phone pass-through ports need explicit data security and QoS trust design.
B:Treat a phone's physical presence as authorization for every downstream workstation. That bypass leaves the Phone and PC shared switch-port security issue unresolved. Trusting every attached PC's markings can consume voice queues and bypass policy.
C:Inspect show poe interface and total allocated versus available watts. That check applies chiefly to PoE power budget switch capacity, not the current Phone and PC shared switch-port security issue. Phone pass-through ports need explicit data security and QoS trust design.
Question 627
A technician assumes an IPv4 239/8 address can be reused unchanged as an IPv6 multicast address. Select TWO statements that correctly combine the IPv6 multicast scope and group use implementation, its evidence, or its governing principle.
- Select appropriate IPv6 multicast addressing and scope behavior for intended receivers.
- Correlate multicast route incoming interface with outgoing-interface list and group state.
- Align multicast RPF expectations with unicast or configured multicast routing topology.
- Configure 239.255.0.1 as an IPv6 multicast group and claim syntax is interoperable.
- Packets remain inside the permitted IPv6 scope and group memberships reflect the destination.
Explanation
Correct Answers
A:Select appropriate IPv6 multicast addressing and scope behavior for intended receivers. This is the intended implementation action for IPv6 multicast scope and group use.
E:Packets remain inside the permitted IPv6 scope and group memberships reflect the destination. This is direct observable evidence for IPv6 multicast scope and group use.
Incorrect Answers
B:Correlate multicast route incoming interface with outgoing-interface list and group state. This belongs to Multicast routing table incoming outgoing lists, not the specified IPv6 multicast scope and group use operation. IPv6 multicast uses ff00::/8 scoped addressing separate from IPv4 group syntax.
C:Align multicast RPF expectations with unicast or configured multicast routing topology. This belongs to Multicast RPF shortest reverse path check, not the specified IPv6 multicast scope and group use operation. IPv6 multicast uses ff00::/8 scoped addressing separate from IPv4 group syntax.
D:Configure 239.255.0.1 as an IPv6 multicast group and claim syntax is interoperable. This would not be an appropriate IPv6 multicast scope and group use decision. Mis-scoped multicast can leak too far or fail to reach authorized hosts.
Question 628
A remote office must redistribute a local static prefix while the area limits ordinary type-5 flooding. After deploying the recommended OSPF NSSA type-seven translation change, which result MOST directly verifies success?
- Active routes prefer the expected lowest cumulative OSPF metric.
- Same-segment endpoints communicate while other VNIs remain isolated.
- NSSA-local external reachability is advertised as expected into other areas.
- Accepted authenticated Hellos lead to a stable neighbor relationship.
Explanation
Correct Answer
C:NSSA-local external reachability is advertised as expected into other areas. This is the directly observable outcome for OSPF NSSA type-seven translation. NSSA can carry type-7 external LSAs and ABRs may translate them to type-5.
Incorrect Answers
A:Active routes prefer the expected lowest cumulative OSPF metric. This validates OSPF path cost selection but does not directly demonstrate the required OSPF NSSA type-seven translation result. NSSA can carry type-7 external LSAs and ABRs may translate them to type-5.
B:Same-segment endpoints communicate while other VNIs remain isolated. This validates VXLAN VNI to VLAN association but does not directly demonstrate the required OSPF NSSA type-seven translation result. NSSA can carry type-7 external LSAs and ABRs may translate them to type-5.
D:Accepted authenticated Hellos lead to a stable neighbor relationship. This validates OSPF authentication key or algorithm but does not directly demonstrate the required OSPF NSSA type-seven translation result. NSSA can carry type-7 external LSAs and ABRs may translate them to type-5.
Question 629
One laptop has the correct username but an untrusted EAP server certificate. Which technical principle BEST explains the 802.1X EAP authentication credential validation decision?
- Guest VLAN authorizes limited access for eligible unauthenticated clients.
- EAP credential validation requires mutual compatible authentication and trust policy.
- RADIUS outcomes express AAA authorization decisions separate from transport connectivity.
- MED is a nontransitive path attribute often compared between paths from the same neighboring AS.
Explanation
Correct Answer
B:EAP credential validation requires mutual compatible authentication and trust policy. In this situation, the relevant action is to configure appropriate supplicant EAP trust and supported RADIUS certificate or credential policy.
Incorrect Answers
A:Guest VLAN authorizes limited access for eligible unauthenticated clients. That principle is related to Guest VLAN for unauthenticated clients, not the main 802.1X EAP authentication credential validation choice. Accepting every certificate to restore access undermines network identity controls.
C:RADIUS outcomes express AAA authorization decisions separate from transport connectivity. That principle is related to RADIUS Access-Accept versus Access-Reject handling, not the main 802.1X EAP authentication credential validation choice. Accepting every certificate to restore access undermines network identity controls.
D:MED is a nontransitive path attribute often compared between paths from the same neighboring AS. That principle is related to BGP MED inbound traffic hint, not the main 802.1X EAP authentication credential validation choice. Accepting every certificate to restore access undermines network identity controls.
Question 630
Voice uses strict priority but high-volume traffic prevents normal data from progressing. Which configuration or operational step BEST meets the stated requirement?
- Configure appropriate rewrite rules mapping forwarding class and PLP to egress DSCP.
- Put every queue at the highest priority and claim starvation is impossible.
- Configure supported priority treatment with bounds and sufficient lower-class service.
- Classify authorized control-plane traffic into an appropriate protected forwarding class.
Explanation
Correct Answer
C:Configure supported priority treatment with bounds and sufficient lower-class service. Strict priority can reduce latency but must be designed to avoid starvation. The expected validation is that voice latency stays controlled while data classes continue transmitting.
Incorrect Answers
A:Configure appropriate rewrite rules mapping forwarding class and PLP to egress DSCP. This addresses DSCP egress rewrite rules rather than the required Scheduler strict priority and starvation decision. Strict priority can reduce latency but must be designed to avoid starvation.
B:Put every queue at the highest priority and claim starvation is impossible. This is a risky or ineffective shortcut for Scheduler strict priority and starvation. Unbounded high-priority traffic can starve nonpriority queues.
D:Classify authorized control-plane traffic into an appropriate protected forwarding class. This addresses Network-control forwarding class differentiation rather than the required Scheduler strict priority and starvation decision. Strict priority can reduce latency but must be designed to avoid starvation.