JN0-650 Juniper Enterprise Routing and Switching - Professional (JNCIP-ENT) Free Practice Exam Questions (2026 Updated)

In Junos OS, the figure-of-merit is an internal numerical value used by the BGP Route Damping mechanism to quantify the stability of a specific BGP route. When a route " flaps " (becomes unstable), the Junos OS increases this value by assigning a specific penalty based on the type of event that occurred:

The route is withdrawn (Option A): When a BGP neighbor sends a withdrawal message for a prefix, Junos assigns a significant penalty—typically 1,000 by default—to the route ' s figure-of-merit.

The route is readvertised (Option C): When a previously withdrawn route is announced again by the neighbor, the Junos OS adds another penalty to the figure-of-merit value to track the continued instability.

The route ' s path attributes changed (Option E): If a route remains reachable but its BGP attributes (such as the AS Path or Community) change, it is considered a flap. Junos assigns a smaller penalty—typically 500 by default—for this attribute change.

As the figure-of-merit accumulates and exceeds a predefined suppress threshold , the route is suppressed and no longer used for forwarding. Over time, the value decreases according to a configured half-life until it falls below a reuse threshold , at which point the route becomes active again. Factors like local preference or the origin (IBGP/EBGP) do not trigger these internal penalty increments for the figure-of-merit.

In External BGP (EBGP), there is a default safety mechanism that requires the peer ' s next hop to be on a directly connected network.

TTL Constraint: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. If the next hop is not directly connected (e.g., when peering via loopback interfaces or across a multi-hop path), the packet will expire before reaching the destination, causing the route to be discarded or the session to fail.

The Multihop Solution (Option B): To override this behavior, you must configure the multihop statement under the BGP neighbor or group hierarchy. This allows the BGP session to establish by increasing the TTL (typically to 64 or a user-defined value) and bypasses the " directly connected " check.

Incorrect Options: Option A (accept-remote-nexthop) is used in internal BGP or specific routing-instance scenarios to resolve next hops that aren ' t in the local routing table, but it doesn ' t solve the EBGP TTL/direct-connection requirement. Option C (advertise-inactive) allows BGP to advertise routes that are not the best path in the routing table, which is irrelevant to next-hop reachability. Option D (multipath) is used for load-sharing across multiple paths.

The behavior described is the fundamental operational principle of OSPF ' s hierarchical area structure.

LSA Flooding Scope: In OSPFv2, Type-1 (Router) and Type-2 (Network) Link-State Advertisements (LSAs) are restricted to a local area flooding scope . They contain detailed topology information (such as which routers are connected to which links) that is only relevant for calculating the Shortest Path First (SPF) tree within that specific area.

ABR Functionality: Area Border Routers (ABRs), such as R1 in this scenario, act as the gateway between areas. The ABR does not forward Type-1 or Type-2 LSAs from one area to another. Instead, it extracts the prefix information (the network address and mask) from those LSAs and generates a Type-3 (Summary) LSA .

Interarea Reachability: This Type-3 LSA is then flooded into the backbone (Area 0) and subsequently into other non-backbone areas, such as Area 2. This explains why R2 sees an " interarea route " to R3’s network in its routing table and has the corresponding Type-3 LSA in its database, but cannot see the original Type-1 or Type-2 LSAs from Area 1.

Why other options are incorrect: Option A is incorrect because this is standard protocol behavior, not the result of a manual filter. Option B is incorrect as there is no such " disable " feature; the protocol design inherently prevents these LSAs from crossing boundaries. Option C is incorrect because OSPFv3 still uses Type-1 and Type-2 LSAs (renamed but functionally similar for topology), and the prompt specifically identifies the deployment as OSPFv2 .

This question focuses on port security and preventing " rogue switches " or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A): This is the most restrictive 802.1X mode in Junos OS. It allows exactly one MAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C): This mode allows the first authenticated user to " open " the port for all other users. This would actually allow a rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B): This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D): This is an authentication method, not a port-access mode that limits the number of supplicants.

The exhibit shows a BGP Route Reflector (RR) configuration where an export policy named NHS (Next-Hop Self) is applied to the internal BGP group int-group. The policy NHS sets the next-hop self attribute for BGP routes.

The Problem (Traffic Tromboning): In a standard BGP Route Reflector design, the RR should reflect routes without modifying the BGP next-hop attribute. By applying a next-hop self policy on the export to clients, the RR tells all its clients that it is the exit point for those routes. Consequently, all data plane traffic is sent to the RR first before being forwarded to the actual destination, rather than following the optimal direct path between clients. This is known as " traffic tromboning " or suboptimal routing.

The Solution (Option C): The most direct way to fix this is to delete the export policy that is forcing the next-hop to be the RR. By deleting protocols bgp group int-group export NHS, the RR will resume standard behavior and reflect the original next-hop received from the route source, allowing clients to route traffic directly to the correct destination.

The Refined Solution (Option D): If you must keep the NHS policy (perhaps for routes learned from external peers), you should ensure it only applies to those specific routes. By adding from route-type internal to the policy term and then potentially changing the logic (or simply narrowing the scope), you can prevent the RR from incorrectly applying next-hop self to internal routes that it is merely reflecting. In the context of this specific problem, Option D combined with a change in the policy ' s action or scope helps ensure reflected internal routes maintain their original, optimal next-hops.

Option A is incorrect because setting next-hop self for external routes is common practice, but it doesn ' t solve the problem of internal reflected routes being diverted to the RR.

Option B is incorrect because applying this as an import policy would change how the RR itself sees the routes, but it wouldn ' t fix the attributes being sent out to the clients in the reflection process.

In Junos OS, a physical or logical interface is typically associated with a single OSPF area. However, there are specific design requirements—such as migrating an interface from one area to another without downtime or creating specific transit topologies—where an interface needs to exist in two areas simultaneously.

Multi-area Adjacency (Option B): The secondary command under the OSPF interface hierarchy allows an interface to be part of a secondary area in addition to its primary area.

Protocol Behavior: When an interface is configured as secondary, the router sends and receives OSPF Hello packets for both the primary and secondary areas on that single link. This allows the router to form adjacencies with neighbors in both areas over the same physical connection.

Use Case: This is frequently used in hub-and-spoke topologies or during network restructuring to ensure reachability is maintained while changing area boundaries. It effectively allows a " logical " split of the interface at the OSPF protocol level.

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.

The exhibit displays the default-switch.evpn.0 routing table, which is used on Juniper leaf devices to store EVPN Type 2 (MAC/IP) routes.

Route Distinguisher (Option C): In EVPN, the Route Distinguisher (RD) is an 8-byte prefix added to a route to make it unique within the BGP control plane. The RD format in the exhibit is < IP-Address > : < Identifier > .

For example, the prefix 2:192.168.100.1:1::5010::... indicates an EVPN Type 2 route (2:) where 192.168.100.1:1 is the Route Distinguisher.

This RD identifies the specific routing instance on the originating VTEP that advertised the MAC/IP address.

Option A is incorrect: The RD 192.168.100.2:1 does not necessarily mean the host device has that IP; it means the originating switch has that router ID/IP used for its RD.

Option B is incorrect: While the RD often incorporates the router ID, the RD itself is the full string (e.g., 192.168.100.1:1), which is distinct from the raw Router ID used in the BGP summary.

Option D is incorrect: Looking at the entries for 10.1.1.1 and 10.1.2.3, they are associated with different identifiers in the RD strings (5010 and 5020 respectively), which typically map to different VNIs or bridge domains.

The IETF standards for EVPN-VXLAN define the scalability and forwarding behavior of the architecture.

VXLAN Scale (Statement B): The Virtual Network Identifier (VNI) is a 24-bit field in the VXLAN header. This allows for up to $2^{24}$ unique identifiers, which translates to approximately 16 million distinct VXLAN broadcast domains (segments) within a single fabric. * Forwarding Behavior (Statement D): VXLAN is a MAC-in-UDP encapsulation technology. When a Layer 2 frame enters the tunnel at a VTEP, the original Layer 2 frame (including the original source and destination MAC addresses) is encapsulated into a UDP/IP packet and transported across the IP underlay. When it reaches the egress VTEP, the header is removed and the Layer 2 frame is forwarded unchanged to the destination host.

Why others are incorrect: Statement A is incorrect because EVPN itself can technically support more than 16 million domains, but the data plane (VXLAN) is the limiting factor in this specific deployment scenario. Statement C is incorrect because VXLAN encapsulates Layer 2 frames, not just " IP packets, " and it treats the entire frame as a payload.

In an end-to-end CoS (Class of Service) design, there is a clear distinction between classification at the ingress and rewrite rules at the egress.

The Problem: Your edge devices are successfully classifying traffic (assigning packets to internal forwarding classes). However, the core devices—which use BA (Behavior Aggregate) classifiers—are not classifying correctly. BA classifiers look at the bits in the packet header (like DSCP or 802.1p) to determine priority.

The Missing Link (Option C): When a packet leaves the edge device, its internal forwarding class and loss priority must be " written " back into the packet header so that the next-hop (the core device) can see it. By default, Junos may not preserve or set these bits correctly on egress. You must apply rewrite rules on the edge switches ' egress interfaces facing the core. These rules ensure the DSCP values in the headers match the forwarding class determined by the edge ' s MF classifier, allowing the core ' s BA classifier to function properly.

Other Options: Option A (policer) handles rate limiting, not classification. Option B is incorrect because core devices often have different hardware or scaling needs than edge switches, and standard BA configuration is preferred over templates in the core. Option D is incorrect because MF classifiers are standard for edge devices where deep packet inspection is needed to identify traffic types.

VSTP (VLAN Spanning Tree Protocol) is designed for interoperability with environments running Cisco’s Per-VLAN Spanning Tree Plus (PVST+).

Per-VLAN Instances (Option E): The core function of VSTP is to maintain a separate spanning tree instance for every VLAN configured on the switch. This allows for different root bridges and different topologies per VLAN, enabling traffic load-balancing across various physical links.

BPDU Generation (Option A): Because each VLAN has its own instance, VSTP must send separate BPDUs for each VLAN. These BPDUs are tagged with the respective VLAN ID to ensure the receiving switch can process them for the correct instance.

Instance Limits (Option D): On many Juniper platforms, VSTP is limited to supporting a maximum of 253 unique spanning tree topologies (instances). If the number of VLANs exceeds this limit, additional VLANs will not have spanning tree protection unless migrated to a different protocol like MSTP.

Incorrect Statements: Option B is incorrect because VSTP is compatible with RSTP; it actually uses RSTP algorithms (Rapid-VSTP) by default in modern Junos versions to provide fast convergence. Option C is incorrect because STP or RSTP is usually the default spanning tree protocol on EX Series switches, not VSTP.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, " headless " devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.

Junos OS 24.4 handles multicast traffic using two distinct models based on whether the source is known in advance.

Knowledge and Sources (Option A): PIM-ASM (Any Source Multicast) is designed for " many-to-many " communication where receivers join a group ($*,G$) and rely on a Rendezvous Point (RP) to discover active sources. In contrast, PIM-SSM (Source-Specific Multicast) is for " one-to-many " scenarios where receivers must already know the exact source IP ($S,G$) before joining.

Protocol and RP Logic (Option D): PIM-SSM bypasses the RP entirely. It relies on IGMPv3 messages from the host, which explicitly include both the source address and the group address. This allows the last-hop router to build a Shortest Path Tree (SPT) directly toward the source immediately.

Register Process (Option B): While PIM-ASM does use registers, it is the First-Hop Router (Designated Router on the source segment) that sends the register to the RP, not the receiver ' s DR.

RP Role (Option C): This is exactly backwards; PIM-ASM requires an RP for source discovery, whereas PIM-SSM does not use one at all.

This scenario describes a specific use case where a switch port is shared by multiple devices (e.g., via a downstream unmanaged switch), and you want to simplify the authentication process.

Single Supplicant Mode (Option A): In this mode, the switch requires only the first device that connects to the port to successfully authenticate via 802.1X. Once that first device is authorized, the switch " opens " the port for all traffic. This means all subsequent devices attached to that same downstream switch are permitted to access the network without undergoing their own authentication.

Other Modes:

Single-secure supplicant (C): Only allows the first authenticated device; all others are blocked.

Multiple supplicant (D): Requires every device to authenticate individually.

MAC RADIUS (B): This is an authentication method, not a port-control mode.

In a three-stage EVPN-VXLAN fabric (Spine-Leaf architecture) where leaf devices perform the gateway services (Edge-Routed Bridging or ERB):

VTEP Functionality (Option B): Leaf devices act as VXLAN Tunnel End Points (VTEPs). They are responsible for encapsulating Ethernet frames from locally connected hosts into VXLAN packets for transport across the IP fabric and de-encapsulating incoming VXLAN packets.

Fabric Support (Option C): In a standard Juniper IP fabric design, both the leaf and spine devices are typically expected to support VXLAN and EVPN capabilities. While spines in an ERB design might only perform IP forwarding in the underlay, they often participate in the BGP control plane (as Route Reflectors) or provide the ability to transition to Centrally-Routed Bridging (CRB) where spines would act as gateways.

Incorrect Options: Option A is incorrect because the entire fabric infrastructure must be " VXLAN aware " in terms of MTU settings and routing capability to support the overlay. Option D is incorrect because in an ERB design, the spine devices are high-speed transit nodes and do not terminate VXLAN tunnels; only the edge (leaf) devices act as VTEPs.

In this scenario, the requirement is to authenticate devices based on their MAC addresses using a centralized database.

MAC RADIUS (Option A): This is the standard Juniper method for authenticating " headless " or non-802.1X capable devices based on their hardware (MAC) address. The switch acts as a proxy, sending the device ' s MAC address as the username and password to a centralized RADIUS server (the centralized database). If the MAC address is found in the server ' s database, the device is granted access to the network. This perfectly matches the user ' s requirement for MAC-based authentication and a centralized database.

Captive Portal (Option B): This is a web-based authentication method requiring user interaction (login via a browser), which is not based on MAC address identification for the initial authentication phase.

Supplicant Modes (Options C & D): These define how multiple devices are handled on an 802.1X-enabled port, but they are not authentication methods themselves; they rely on 802.1X (EAP-based) or MAC-RADIUS being already configured.

Junos OS 24.4 on EX Series switches provides robust support for LLDP (Link Layer Discovery Protocol) and its extension, LLDP-MED (Media Endpoint Discovery).

LLDP-MED Power Negotiation: This feature allows a switch (Power Sourcing Equipment or PSE) and a connected device (Powered Device or PD), such as an IP phone or access point, to negotiate power requirements beyond the standard IEEE 802.3af/at classes. The switch can dynamically allocate the exact amount of power the device needs (in 0.1W increments), which optimizes the power budget of the switch.

LLDP Scope: LLDP is a Link Layer protocol (Layer 2), but it is not restricted to Layer 2 interfaces; it can also operate on Layer 3 interfaces to advertise system identity and capabilities. This makes Option A incorrect.

Link-Local Protocol: LLDP frames use a specific multicast MAC address (01:80:c2:00:00:0e) that is not flooded or forwarded by switches. They are strictly link-local between two directly connected neighbors. This makes Option B incorrect.

Endpoint Focus: LLDP-MED is specifically designed for Media Endpoint Devices (like VoIP phones), providing TLVs for network policy (VLAN/QoS), location identification, and inventory management. Standard LLDP is used for discovering network connectivity devices. This makes Option D incorrect.

OSPF (Open Shortest Path First) is a standards-based Link-State Interior Gateway Protocol (IGP) implemented within Junos OS 24.4:

Intra-AS Routing: OSPF is designed to distribute routing information and perform neighbor discovery within a single Autonomous System (AS). It divides the AS into areas to localize Link-State Advertisements (LSAs) and reduce the size of the Link-State Database (LSDB) on each router. (Option B)

Algorithm: OSPF uses the Shortest Path First (SPF) or Dijkstra algorithm, not a distance vector algorithm (which would be RIP or BGP). This makes Option A incorrect.

Directly Connected Routes: In Junos OS, you must explicitly configure an interface under the [edit protocols ospf] hierarchy to include it in the OSPF process. Once an interface is added, its prefix is automatically advertised to neighbors via Router (Type 1) LSAs. This makes Option C technically inaccurate in the context of interfaces participating in the protocol.

Scope: Protocols used between multiple autonomous systems are External Gateway Protocols (EGPs), such as BGP. This makes Option D incorrect.

In an EVPN-VXLAN environment using ESI-LAG (Ethernet Segment Identifier Link Aggregation) , the Core Isolation feature is a safety mechanism designed to prevent traffic blackholing. When a leaf switch (acting as a VTEP) loses its BGP peering or its link to the IP fabric core, it assumes it is " isolated " from the rest of the network. To protect the network, the switch automatically shuts down its local member links of any multi-homed ESI-LAG to force traffic to the peer switch that still has core connectivity.

However, during a migration or in specific transitional topologies where the core might be temporarily unreachable or not yet fully established, this feature can cause the leaf switches to shut down all downstream IDF (Intermediate Distribution Frame) connections, leading to a total loss of connectivity.

The Solution (Option C): By enabling the no-core-isolation statement under the [edit protocols evpn] hierarchy, you instruct the switch to disable this automatic shutdown behavior . This ensures that even if the BGP session or core links are not yet stable during the migration process, the ESI-LAG interfaces remain Up , allowing the IDFs to maintain connectivity to their local default gateways or other local resources.

Why others are incorrect: Enabling EVPN-VXLAN before migration (Option A) does not address the isolation logic. Removing MC-LAG/Virtual Chassis links prematurely (Option B) would cause an immediate outage. The network-isolation-profile (Option D) is typically used for different loop prevention scenarios and does not override the specific core-isolation check that affects multi-homed ESIs.