Juniper JN0-650 Practice Test 7
Question 60
During an operational risk review, this situation is reported: A provider changes its ASN and a previously stable BGP session stops opening. If the underlying control is neglected, which failure would MOST directly follow?
- Mis-scoped multicast can leak too far or fail to reach authorized hosts.
- Confusing local preference with Junos route preference can produce wrong active-route reasoning.
- Wrong peer-AS values cause BGP OPEN rejection despite TCP connectivity.
- Merely seeing multiple BGP routes does not prove load balancing occurs.
Explanation
Correct Answer
C:Wrong peer-AS values cause BGP OPEN rejection despite TCP connectivity. BGP OPEN exchange checks autonomous-system identity and capability compatibility. A useful corrective investigation is to inspect show bgp neighbor last error and BGP OPEN notification fields.
Incorrect Answers
A:BGP OPEN exchange checks autonomous-system identity and capability compatibility. Mis-scoped multicast can leak too far or fail to reach authorized hosts.
B:BGP OPEN exchange checks autonomous-system identity and capability compatibility. Confusing local preference with Junos route preference can produce wrong active-route reasoning.
D:BGP OPEN exchange checks autonomous-system identity and capability compatibility. Merely seeing multiple BGP routes does not prove load balancing occurs.
Question 61
A network engineer needs to distinguish EAP failure from a VLAN or transport problem. Select TWO statements that correctly combine the Junos Layer 2 authentication session monitoring implementation, its evidence, or its governing principle.
- Replace every access switch because one Ethernet interface reports no authenticated sessions.
- Configure supported periodic reauthentication with realistic operational timers.
- Session logs identify the failing exchange or authorized role without broad policy bypass.
- Collect show dot1x interface and access session state plus relevant RADIUS logs.
- Configure supported captive portal redirect and identity or terms policy for guest VLANs.
Explanation
Correct Answers
C:Session logs identify the failing exchange or authorized role without broad policy bypass. This is direct observable evidence for Junos Layer 2 authentication session monitoring.
D:Collect show dot1x interface and access session state plus relevant RADIUS logs. This is the intended implementation action for Junos Layer 2 authentication session monitoring.
Incorrect Answers
A:Replace every access switch because one Ethernet interface reports no authenticated sessions. This would not be an appropriate Junos Layer 2 authentication session monitoring decision. Checking only link-up LED can miss failed 802.1X or RADIUS authorization.
B:Configure supported periodic reauthentication with realistic operational timers. This belongs to 802.1X periodic reauthentication, not the specified Junos Layer 2 authentication session monitoring operation. Authentication monitoring must inspect credentials authorization and port state separately.
E:Configure supported captive portal redirect and identity or terms policy for guest VLANs. This belongs to Captive portal web authentication, not the specified Junos Layer 2 authentication session monitoring operation. Authentication monitoring must inspect credentials authorization and port state separately.
Question 62
During an operational risk review, this situation is reported: A malicious workstation marks all packets as expedited voice using an attached phone switch. If the underlying control is neglected, which failure would MOST directly follow?
- Trusting every attached PC's markings can consume voice queues and bypass policy.
- Treating both streams as one unrestricted VLAN can violate QoS and segmentation rules.
- Assuming all ASM traffic must stay permanently on RP shared tree may waste bandwidth.
- A physical pair or overload fault can stop power before any voice VLAN setup matters.
Explanation
Correct Answer
A:Trusting every attached PC's markings can consume voice queues and bypass policy. Phone pass-through ports need explicit data security and QoS trust design. A useful corrective investigation is to compare ingress classification and permitted VLANs for phone versus PC traffic.
Incorrect Answers
B:Treating both streams as one unrestricted VLAN can violate QoS and segmentation rules. This is a Voice VLAN tagged versus PC data traffic failure pattern, not the primary Phone and PC shared switch-port security failure in this case. Phone pass-through ports need explicit data security and QoS trust design.
C:Assuming all ASM traffic must stay permanently on RP shared tree may waste bandwidth. This is a ASM shared tree versus SPT switchover failure pattern, not the primary Phone and PC shared switch-port security failure in this case. Phone pass-through ports need explicit data security and QoS trust design.
D:A physical pair or overload fault can stop power before any voice VLAN setup matters. This is a PoE fault isolation and cable pair failure pattern, not the primary Phone and PC shared switch-port security failure in this case. Phone pass-through ports need explicit data security and QoS trust design.
Question 63
A flood packet received from a multihomed segment returns to the same segment through the other leaf. After deploying the recommended EVPN multihoming split horizon loop avoidance change, which result MOST directly verifies success?
- Only matching tenant EVPN routes import and authorized MAC learning succeeds.
- Frame captures show the planned outer service tag and intact customer VLAN identity.
- Tunnel packets reach the remote VTEP and encapsulated frames traverse the overlay.
- BUM frames are not looped back to the originating Ethernet segment.
Explanation
Correct Answer
D:BUM frames are not looped back to the originating Ethernet segment. This is the directly observable outcome for EVPN multihoming split horizon loop avoidance. EVPN split-horizon prevents replication back toward the same multihomed Ethernet segment.
Incorrect Answers
A:Only matching tenant EVPN routes import and authorized MAC learning succeeds. This validates EVPN route target import export scope but does not directly demonstrate the required EVPN multihoming split horizon loop avoidance result. EVPN split-horizon prevents replication back toward the same multihomed Ethernet segment.
B:Frame captures show the planned outer service tag and intact customer VLAN identity. This validates QinQ service VLAN outer tag but does not directly demonstrate the required EVPN multihoming split horizon loop avoidance result. EVPN split-horizon prevents replication back toward the same multihomed Ethernet segment.
C:Tunnel packets reach the remote VTEP and encapsulated frames traverse the overlay. This validates VXLAN VTEP loopback underlay route but does not directly demonstrate the required EVPN multihoming split horizon loop avoidance result. EVPN split-horizon prevents replication back toward the same multihomed Ethernet segment.
Question 64
A television feed must accept traffic only from one known source for a 232/8 group. Which configuration or operational step BEST meets the stated requirement?
- Configure an Anycast RP as a mandatory component for every SSM group.
- Use compatible IGMPv3 source membership and PIM SSM range design.
- Verify PIM join prune messages and incoming outgoing interface lists across the chain.
- Verify PIM sparse-mode SPT switch behavior and source-specific forwarding entries.
Explanation
Correct Answer
B:Use compatible IGMPv3 source membership and PIM SSM range design. Source Specific Multicast builds source-directed trees without an ASM rendezvous point. The expected validation is that (S,G) state forwards only the desired source without RP discovery for SSM.
Incorrect Answers
A:Configure an Anycast RP as a mandatory component for every SSM group. This is a risky or ineffective shortcut for SSM without rendezvous point. Using ASM-only membership for an SSM group prevents the intended source-specific join.
C:Verify PIM join prune messages and incoming outgoing interface lists across the chain. This addresses PIM join prune forwarding path rather than the required SSM without rendezvous point decision. Source Specific Multicast builds source-directed trees without an ASM rendezvous point.
D:Verify PIM sparse-mode SPT switch behavior and source-specific forwarding entries. This addresses ASM shared tree versus SPT switchover rather than the required SSM without rendezvous point decision. Source Specific Multicast builds source-directed trees without an ASM rendezvous point.
Question 65
The operator assumes priority-high can be unlimited without policy consequences. Which technical principle BEST explains the Scheduler strict priority and starvation decision?
- Junos rewrite rules use internal forwarding class and PLP to set outbound header bits.
- BA classification interprets existing packet markings and assigns forwarding class and loss priority.
- Multicast RPF prevents loops by checking the expected route toward the source or RP.
- Strict priority can reduce latency but must be designed to avoid starvation.
Explanation
Correct Answer
D:Strict priority can reduce latency but must be designed to avoid starvation. In this situation, the relevant action is to configure supported priority treatment with bounds and sufficient lower-class service.
Incorrect Answers
A:Junos rewrite rules use internal forwarding class and PLP to set outbound header bits. That principle is related to DSCP egress rewrite rules, not the main Scheduler strict priority and starvation choice. Unbounded high-priority traffic can starve nonpriority queues.
B:BA classification interprets existing packet markings and assigns forwarding class and loss priority. That principle is related to Junos ingress BA DSCP classifier, not the main Scheduler strict priority and starvation choice. Unbounded high-priority traffic can starve nonpriority queues.
C:Multicast RPF prevents loops by checking the expected route toward the source or RP. That principle is related to Multicast RPF shortest reverse path check, not the main Scheduler strict priority and starvation choice. Unbounded high-priority traffic can starve nonpriority queues.
Question 66
A dual-stack exchange carries IPv4 prefixes but not expected IPv6 customer destinations. Which configuration or operational step BEST meets the stated requirement?
- Configure appropriate inet6-unicast family and compatible IPv6 next-hop reachability.
- Set a policy-based higher local preference for preferred internal BGP paths.
- Permit the intended TCP179 flow under explicit control-plane security policy.
- Create an IPv4 host route and assume it automatically advertises a /64 via inet6.
Explanation
Correct Answer
A:Configure appropriate inet6-unicast family and compatible IPv6 next-hop reachability. MP-BGP uses address-family negotiation and next-hop encodings for IPv6 NLRI. The expected validation is that authorized IPv6 BGP routes appear in inet6.0 with valid next hops.
Incorrect Answers
B:Set a policy-based higher local preference for preferred internal BGP paths. This addresses BGP LOCAL_PREF outbound exit selection rather than the required BGP NLRI IPv6 unicast inet6 family decision. MP-BGP uses address-family negotiation and next-hop encodings for IPv6 NLRI.
C:Permit the intended TCP179 flow under explicit control-plane security policy. This addresses BGP TCP 179 and firewall reachability rather than the required BGP NLRI IPv6 unicast inet6 family decision. MP-BGP uses address-family negotiation and next-hop encodings for IPv6 NLRI.
D:Create an IPv4 host route and assume it automatically advertises a /64 via inet6. This is a risky or ineffective shortcut for BGP NLRI IPv6 unicast inet6 family. IPv4 unicast route reception does not imply IPv6 family availability.
Question 67
A remote VXLAN tunnel endpoint cannot be reached even though local VLAN switching works. After deploying the recommended VXLAN VTEP loopback underlay route change, which result MOST directly verifies success?
- Remote peers recognize Ethernet segment participation and respond to advertised withdrawals.
- Each hop has the intended upstream join and only subscribed downstream interfaces.
- Tunnel packets reach the remote VTEP and encapsulated frames traverse the overlay.
- Only the authorized DF forwards designated BUM traffic toward the shared segment.
Explanation
Correct Answer
C:Tunnel packets reach the remote VTEP and encapsulated frames traverse the overlay. This is the directly observable outcome for VXLAN VTEP loopback underlay route. VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning.
Incorrect Answers
A:Remote peers recognize Ethernet segment participation and respond to advertised withdrawals. This validates EVPN Type1 Ethernet auto discovery but does not directly demonstrate the required VXLAN VTEP loopback underlay route result. VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning.
B:Each hop has the intended upstream join and only subscribed downstream interfaces. This validates PIM join prune forwarding path but does not directly demonstrate the required VXLAN VTEP loopback underlay route result. VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning.
D:Only the authorized DF forwards designated BUM traffic toward the shared segment. This validates EVPN designated forwarder DF for BUM but does not directly demonstrate the required VXLAN VTEP loopback underlay route result. VXLAN data plane depends on routable VTEP endpoints independent of EVPN MAC learning.
Question 68
The corporate AAA cluster becomes unreachable during planned maintenance. Which configuration or operational step BEST meets the stated requirement?
- Define a risk-approved server-fail fallback action with restrictive VLAN or deny behavior.
- Configure supported RADIUS VLAN assignment attributes and switch VLAN mappings.
- Configure supported reauthentication or session restoration after AAA recovery.
- Treat every invalid password as proof RADIUS is down and admit all users.
Explanation
Correct Answer
A:Define a risk-approved server-fail fallback action with restrictive VLAN or deny behavior. Server timeout and explicit credential rejection should use different fallback decisions. The expected validation is that aAA outages trigger the documented limited continuity state and recovery restores normal authentication.
Incorrect Answers
B:Configure supported RADIUS VLAN assignment attributes and switch VLAN mappings. This addresses Dynamic VLAN assignment from RADIUS rather than the required RADIUS server unreachable fallback policy decision. Server timeout and explicit credential rejection should use different fallback decisions.
C:Configure supported reauthentication or session restoration after AAA recovery. This addresses RADIUS server-fail remediation and reauthentication rather than the required RADIUS server unreachable fallback policy decision. Server timeout and explicit credential rejection should use different fallback decisions.
D:Treat every invalid password as proof RADIUS is down and admit all users. This is a risky or ineffective shortcut for RADIUS server unreachable fallback policy. Fail-open all access during AAA outages can expose critical assets.
Question 69
A dual-homed router reports no neighbor despite successful IP pings across the link. Which next investigation or correction is MOST appropriate?
- Inspect route details including external type metrics and forwarding next hops.
- Add an unrelated static default route and expect the OSPF area mismatch to disappear.
- Verify source route active state policy terms and destination inet6.0 routes.
- Compare the interface area bindings and decoded Hello area field.
Explanation
Correct Answer
D:Compare the interface area bindings and decoded Hello area field. This checks whether hello packets agree on area identification and neighbors reach Full.
Incorrect Answers
A:Inspect route details including external type metrics and forwarding next hops. That check applies chiefly to OSPF external type-one versus type-two metrics, not the current OSPFv2 area identifier consistency issue. OSPF adjacency requires compatible area identity at both ends.
B:Add an unrelated static default route and expect the OSPF area mismatch to disappear. That bypass leaves the OSPFv2 area identifier consistency issue unresolved. Different configured area IDs prevent neighbors forming even when IP transport works.
C:Verify source route active state policy terms and destination inet6.0 routes. That check applies chiefly to OSPFv3 routing policy for external IPv6, not the current OSPFv2 area identifier consistency issue. OSPF adjacency requires compatible area identity at both ends.
Question 70
Voice queues crowd out background classes because their transmit rates are poorly planned. Select TWO statements that correctly combine the Scheduler transmit rate bandwidth allocation implementation, its evidence, or its governing principle.
- Increase VLAN ID to allocate more physical bandwidth to the class.
- Configure suitable scheduler transmit-rate reservations considering link capacity.
- Assign deliberate PLP values through classification or policing policy.
- Apply the intended scheduler map to the actual output interface.
- Congested classes meet intended minimum shares without exceeding physical bandwidth.
Explanation
Correct Answers
B:Configure suitable scheduler transmit-rate reservations considering link capacity. This is the intended implementation action for Scheduler transmit rate bandwidth allocation.
E:Congested classes meet intended minimum shares without exceeding physical bandwidth. This is direct observable evidence for Scheduler transmit rate bandwidth allocation.
Incorrect Answers
A:Increase VLAN ID to allocate more physical bandwidth to the class. This would not be an appropriate Scheduler transmit rate bandwidth allocation decision. Setting guaranteed transmit rates above available capacity yields unrealistic SLA expectations.
C:Assign deliberate PLP values through classification or policing policy. This belongs to Packet loss priority PLP marking, not the specified Scheduler transmit rate bandwidth allocation operation. Scheduler transmit rates allocate planned bandwidth service to queues.
D:Apply the intended scheduler map to the actual output interface. This belongs to Scheduler maps attached to egress interface, not the specified Scheduler transmit rate bandwidth allocation operation. Scheduler transmit rates allocate planned bandwidth service to queues.