JN0-351 Juniper Enterprise Routing and Switching Specialist (JNCIS-ENT) Free Practice Exam Questions (2026 Updated)

In BGP, routing policies are used to control the flow of routing information between BGP peers 1 .

Option C suggests that import policies are applied after the RIB-In table.  This is correct because import policies in BGP are applied to routes that are received from a BGP peer, before they are installed in the local BGP Routing Information Base (RIB-In) 1 .  The RIB-In is a database that stores all the routes that are received from all peers 1 .

Option D suggests that export policies are applied after the RIB-Local table.  This is correct because export policies in BGP are applied to routes that are being advertised to a BGP peer, after they have been selected from the local BGP Routing Information Base (RIB-Local) 1 .  The RIB-Local is a database that stores all the routes that the local router is using 1 .

Therefore, options C and D are correct.

Junos devices support various types of tunnels for different purposes 1 2 .

Option B is correct.  Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network 1 .  Junos devices support GRE tunnels 1 .

Option D is correct.  IPsec (Internet Protocol Security) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session 1 .  Junos devices support IPsec tunnels 1 .

Option A is incorrect. Spanning Tree Protocol (STP) is not a type of tunnel.  It’s a network protocol designed to prevent loops in a bridged Ethernet local area network 2 .

Option C is incorrect.  While Junos devices do support IP-IP (also known as IP tunneling), it’s not supported on all Junos devices 1 .

The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the  voice VLAN 1 2 .

The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs 1 2 .  This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority 1 2 . Therefore, option D is correct.

 In a Rapid Spanning Tree Protocol (RSTP) topology, the root bridge is determined by the switch with the lowest bridge priority value 1 2 .  If all switches have the same priority, then the root bridge is assigned to the switch whose MAC address’s hex value is the lowest 2 .  The default bridge priority value is 32768 3 2 . However, without the actual exhibit, it’s difficult to definitively determine which device is the root bridge.  But based on the options provided, if we assume that the local device has a lower bridge priority or a lower MAC address than other devices in the network, then it could be considered as the root bridge for this RSTP topology 4 5 .

The exhibit shows the output of the command  show vlans brief , which displays brief information about VLANs and their associated interfaces 1 .

The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging.

The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic 1 .  This can be verified by the command  show interfaces terse , which displays the status of the interfaces 2 .

A. The routes displayed have traversed one or more autonomous systems. True. The AS path attribute shows AS numbers (e.g., 65401 65520.), indicating the route ' s traversal through various autonomous systems. D. The routes displayed are being learned from an IBGP peer. True. The absence of the ' * > i ' marker before the prefixes indicates they are being learned from an IBGP peer. Therefore, the correct statements are A. The routes displayed have traversed one or more autonomous systems. and D. The routes displayed are being learned from an IBGP peer.

BGP has a simple loop prevention mechanism for eBGP that checks the AS path for its own AS number. However, this mechanism does not work for iBGP, since all routers in the same AS have the same AS number. Therefore, iBGP has two additional rules to prevent routing loops within an autonomous system:

A router does not advertise a route learned from an iBGP neighbor to another iBGP neighbor. This rule ensures that a route does not loop back to the original iBGP router through another iBGP path.

A router does not accept a route learned from an iBGP neighbor if the next hop is not reachable via an IGP. This rule ensures that a router does not forward packets to an unreachable next hop.

These two rules imply that iBGP sessions must be configured as a logical full mesh, meaning that every iBGP router must have a direct iBGP session with every other iBGP router in the same AS. This way, every iBGP router can learn the best route from the eBGP routers and use the IGP to reach the next hop. A logical full mesh does not require a physical full mesh, meaning that iBGP routers do not have to be directly connected. They can use intermediate routers to establish iBGP sessions, as long as the IGP can reach the next hop.

A logical full mesh can be challenging to scale and maintain, especially for large ASes with many iBGP routers. Therefore, some alternatives to the full mesh requirement have been developed, such as route reflectors and confederations. These alternatives relax the iBGP rules and introduce additional attributes and mechanisms to prevent routing loops, such as originator ID and cluster list. References:

BGP Fundamentals

BGP - eBGP loop prevention mechanism same AS number

Loop Prevention in BGP Routing

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

A. On R1, enable Level 1 on the ge-0/0/1 interface.  In IS-IS, both levels (Level 1 and Level 2) are enabled by default when you enable IS-IS on an interface 1 .  Level 1 systems route within an area 2 .  If the destination is outside an area, Level 1 systems route toward a Level 2 system 2 . Therefore, enabling Level 1 on the ge-0/0/1 interface on R1 would allow packets to reach from R1 to R3.

D. On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge-0/0/4 interface on R3 would allow packets to reach from R1 to R3.

These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks 1  and Cisco 3 4 .

In a trunk port configuration with multiple VLANs, the native VLAN carries untagged traffic. This means frames sent or received on the port without a VLAN tag are automatically assigned to the native VLAN.

Here ' s why the other options are incorrect:

A. The native VLAN must be the default VLAN on the port.  This is not necessarily true. The native VLAN and the default VLAN can be different. The default VLAN is the VLAN assigned to untagged traffic on access ports, while the native VLAN applies to trunk ports.

B. The native VLAN is automatically configured through DHCP.  This is incorrect. The native VLAN needs to be manually configured on the switch port. DHCP is used for assigning IP addresses, not VLAN IDs.

D. The native VLAN is the highest tagged VLAN ID on the port.  This is also incorrect. The native VLAN and tagged VLANs are independent. The native VLAN is not related to the highest or lowest tagged VLAN ID.

Therefore, the only true statement is that the native VLAN is an untagged VLAN ID on the port.

IS-IS (Intermediate System to Intermediate System) is a routing protocol that is designed to move information efficiently within a computer network 1 2 .  It supports multiple protocol topologies, including IPv4, IPv6, and multicast 1 2 . Therefore, options C, E, and D are correct.

 References:  Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks

Option B is correct.  Filter-based forwarding (FBF), also known as Policy Based Routing (PBR), uses the forwarding routing instance type 1 2 .

Option C is correct.  Routing Information Base (RIB) groups are used to copy routes from one routing table to another 3 4 .  In the context of FBF, RIB groups can be used to copy routes from the inet.0 routing table 3 4 .

Option A is incorrect.  FBF does not use the no-forwarding routing instance type 1 5 .

Option D is incorrect.  RIB groups are not used to hide routes in the inet.0 routing table 3 4 .  They are used to share or copy routes between different routing tables 3 4 .

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.