Free Practice Questions for the Juniper JNCIS-ENT JN0-351 Exam (2026 Updated)

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

According to the Juniper documentation1, when a switch receives a unicast frame destined to a MAC address that is not registered in the bridging table, it floods the frame out all ports that are part of the same VLAN, except the receiving port. This is the default behavior of a switch when it does not know the destination MAC address. The switch does not perform an ARP request, send an error message, or flood the frame to all VLANs. References: Understanding Unicast Flooding | Junos OS | Juniper Networks

To create a LAG interface, you need to perform two actions: enable LAG on the chassis and on each member interface. The first action is to configure the chassis stanza with the aggregated-devices statement and specify the number of LAG interfaces and the link-speed for each interface. The second action is to configure each member interface with the family ethernet-switching statement and the aggregated-ether-options statement with the lacp option. The name of the first LAG interface is not relevant, as long as it matches the name of the aggregated interface under the interfaces stanza. The name can be ae0, ae1, or any other valid name. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

When the MAC address limit feature with the shutdown action is implemented on a switch, if a violation occurs, the interface is disabled and a system log entry is generated 1 .  If the switch has been configured with the port-error-disable statement, the disabled interface recovers automatically upon expiration of the specified disable timeout 1 .  However, if the switch has not been configured for auto-recovery from port error disabled conditions, you must manually clear the violation by running the clear ethernet-switching port-error command for the interface to send and receive traffic again 1 .  This explanation is based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 1 .

The exhibit shows the output of the command  show vlans brief , which displays brief information about VLANs and their associated interfaces 1 .

The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging.

The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic 1 .  This can be verified by the command  show interfaces terse , which displays the status of the interfaces 2 .

Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.

Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

The output shown in the exhibit is a brief display of the Ethernet switching table, which shows the learned Layer 2 MAC addresses for each VLAN and interface 1 .

The command  show ethernet-switching table  displays the Ethernet switching table with brief information, such as the destination MAC address, the VLAN name, the forwarding state, and the interface name 1 .

The command  show route forwarding-table  displays the routing table information for each protocol family, such as inet, inet6, mpls, iso, and so on 2 . It does not show the Ethernet switching table or the MAC addresses.

The command  show ethernet-switching table extensive  displays the Ethernet switching table with extensive information, such as the destination MAC address, the VLAN name, the forwarding state, the interface name, the VLAN index, and the tag type 1 . It shows more details than the brief output shown in the exhibit.

The command  show route forwarding-table family ethernet-switching  displays the routing table information for the ethernet-switching protocol family, which shows the destination MAC address, the next-hop MAC address, and the interface name 3 . It does not show the VLAN name or the forwarding state.

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 2 3 .  The roles include root, designated, alternate, backup, and disabled 1 2 3 .

The discarding state is associated with the backup, alternate, and disabled roles 1 2 3 .  In a stable topology with consistent port roles throughout the network, RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state 2 .  Disabled ports are also in the discarding state 3 .

Therefore, options B, C, and D are correct.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/lsa-refresh-interval-edit-protocols-ospf.html

A  is correct because RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch.  An alternate port is a backup port for a root port, which means it receives better BPDUs from another bridge than the current root port 1 .  However, an alternate port does not forward any traffic, as it is in a discarding state 2 . It only listens to BPDUs and waits for the root port to fail.  If the root port fails, the alternate port can immediately transition to a forwarding state and become the new root port 1 .

C  is correct because RSTP alternate ports provide an alternate higher cost path to the root bridge.  An alternate port is selected based on the same criteria as the root port, which are the lowest bridge ID, the lowest path cost, the lowest sender port ID, and the lowest receiver port ID 3 .  However, an alternate port receives a higher cost BPDU than the root port, otherwise it would be the root port itself 1 . Therefore, an alternate port provides an alternate higher cost path to the root bridge than the root port.

A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply.  If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down 1 .

To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router.  The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down 2 .

According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel 2 . This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps.

In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply.

Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel.  Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives 3 .  Option B is incorrect, because the “event link-adjacency-loss” option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down 4 .  Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels 5 .

The default MAC age-out timer on an EX Series switch is 300 seconds 1 2 .  The MAC age-out timer is the maximum time that an entry can remain in the MAC table before it “ages out,” or is removed 3 1 .  This configuration can influence efficiency of network resource use by affecting the amount of traffic that is flooded to all interfaces 1 .  When traffic is received for MAC addresses no longer in the Ethernet routing table, the router floods the traffic to all interfaces 1 .

A  is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets.  Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port 1 .

C  is correct because the interface is configured as a trunk port.  By default, all trunk ports on the switch are trusted for DHCP snooping 2 . This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port.  Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port 2 .

The correct answer to your question is  C. Option C . Here is why:

Option C shows the configuration of the  chassis  statement, which defines the properties of the router chassis, such as the number of aggregated Ethernet interfaces, the number of FPCs, and the number of PICs 1 .

To enable aggregated Ethernet interfaces on a router, you need to specify the  aggregated-devices  statement under the  chassis  statement and set the  ethernet  parameter to the desired number of interfaces 2 . For example, to enable two aggregated Ethernet interfaces, you can use the following configuration:

chassis { aggregated-devices { ethernet { device-count 2; } } }

Option C shows this configuration with the device-count set to 2, which will enable two aggregated Ethernet interfaces on the router. The other options do not show this configuration and will not enable any aggregated Ethernet interfaces on the router.

Therefore, option C is the correct answer to your question.

The static route to the 0.0.0.0/0 network has a next hop of xe-0/0/0.0, which is a local interface. BGP does not accept static routes with a local interface as the next hop, because it cannot advertise them to other BGP peers. BGP requires a valid IP address as the next hop for static routes that are redistributed into BGP. To fix this issue, the static route should have a next hop of an IP address that is reachable via the xe-0/0/0.0 interface, such as the IP address of the eBGP neighbor. Alternatively, the next hop can be modified by using a route map when redistributing the static route into BGP12.

The other options are not correct because:

The as-path parameter is not required for redistributing static routes into BGP. The as-path attribute is automatically set by BGP when advertising routes to other BGP peers3.

A community string is not required for redistributing static routes into BGP. A community is an optional attribute that can be used to group routes and apply policies to them4.

The no-readvertise feature is not specified in the configuration. The no-readvertise feature is used to prevent routes learned from one iBGP peer from being advertised to another iBGP peer5.

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.

Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

 References:  Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks

OSPF DR/BDR election is a process that occurs on multi-access data links. It is intended to select two OSPF nodes: one to be acting as the Designated Router (DR), and another to be acting as the Backup Designated Router (BDR). The DR and BDR are responsible for generating network LSAs for the multi-access network and synchronizing the LSDB with other routers on the same network 1 .

The DR/BDR election is based on two criteria: the OSPF priority and the router ID. The OSPF priority is a value between 0 and 255 that can be configured on each interface participating in OSPF. The default priority is 1. A priority of 0 means that the router will not participate in the election and will never become a DR or BDR. The router with the highest priority will become the DR, and the router with the second highest priority will become the BDR. If there is a tie in priority, then the router ID is used as a tie-breaker. The router ID is a 32-bit number that uniquely identifies each router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address on a loopback interface or any active interface 2 .

In this scenario, all routers have the same priority of 1, so the router ID will determine the outcome of the election. The router IDs are shown in the exhibit as RID values. The highest RID belongs to R4 (10.10.10.4), so R4 will become the DR. The second highest RID belongs to R3 (10.10.10.3), so R3 will become the BDR.