Free Juniper JN0-351 Practice Exam with Questions & Answers

According to the Juniper documentation 1 , the output of the show vlans command displays the forwarding options for the VLAN, including the DHCP security features. In the exhibit, the output shows that DHCP security is enabled, and that ARP inspection and IP source guard are also enabled. These features work together to protect the switch from IP spoofing and ARP spoofing attacks. DHCP snooping builds a database of IP/MAC bindings by snooping DHCP messages. ARP inspection validates ARP packets against the DHCP snooping database and drops invalid packets.  IP source guard checks the IP and MAC source addresses of packets against the DHCP snooping database and drops spoofed packets 2 3 . Therefore, the correct answer is A, B, and C.

The other options are not correct because:

D. The DHCP snooping database is not protected by default.  To protect the database from corruption or loss, you need to configure a file name and a location for storing the database, and enable periodic write operations to the file 4 . The exhibit does not show any such configuration.

E. DHCP snooping is not enabled for IPv6 traffic by default.  To enable DHCPv6 snooping, you need to configure a DHCPv6 relay agent and specify the trusted interfaces for DHCPv6 messages 5 . The exhibit does not show any such configuration.

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

Option B is correct.  Flooding is a mechanism used in Layer 2 bridging where the switch sends incoming packets to all its ports except for the port where the packet originated 1 .  This is done when the switch doesn’t know the destination MAC address or when the packet is a broadcast or multicast 1 .

Option C is correct.  Learning is another mechanism used in Layer 2 bridging where the switch learns the source MAC addresses of incoming packets and associates them with the port on which they were received 2 3 .  This information is stored in a MAC address table, also known as a bridge table 2 3 .

Option A is incorrect.  Blocking is a state in Spanning Tree Protocol (STP) used to prevent loops in a network 2 .  It’s not a mechanism used in building and maintaining a Layer 2 bridge table 2 .

Option D is incorrect.  Listening is also a state in Spanning Tree Protocol (STP) where the switch listens for BPDUs to make sure no loops occur in the network before transitioning to the learning state 2 .  It’s not a mechanism used in building and maintaining a Layer 2 bridge table 2 .

When the MAC address limit feature with the shutdown action is implemented on a switch, if a violation occurs, the interface is disabled and a system log entry is generated 1 .  If the switch has been configured with the port-error-disable statement, the disabled interface recovers automatically upon expiration of the specified disable timeout 1 .  However, if the switch has not been configured for auto-recovery from port error disabled conditions, you must manually clear the violation by running the clear ethernet-switching port-error command for the interface to send and receive traffic again 1 .  This explanation is based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 1 .

A RIB group is a configuration that allows a routing protocol to install routes into multiple routing tables in Junos OS. A RIB group consists of an import-rib statement, which specifies the source routing table, and an export-rib statement, which specifies the destination routing table or group.  A RIB group can also include an import-policy statement, which specifies one or more policies to control which routes are imported into the destination routing table or group 1 .

An import policy is a policy statement that defines the criteria for accepting or rejecting routes from the source routing table. An import policy can also modify the attributes of the imported routes, such as preference, metric, or community.  An import policy can be applied to a RIB group by using the import-policy statement under the [edit routing-options rib-groups] hierarchy level 1 .

Therefore, option A is correct, because an import policy is applied to the RIB group to control which routes are installed in the destination routing table or group. Option B is incorrect, because all routes in the source routing table are imported into the destination routing table or group, unless filtered by an import policy. Option C is incorrect, because a firewall filter is not used to install routes in the RIB groups; a firewall filter is used to filter packets based on various criteria. Option D is incorrect, because an export policy is not applied to the RIB group; an export policy is applied to a routing protocol to control which routes are advertised to other devices.

A  is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets.  Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port 1 .

C  is correct because the interface is configured as a trunk port.  By default, all trunk ports on the switch are trusted for DHCP snooping 2 . This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port.  Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port 2 .

According to the Juniper documentation1, when a switch receives a unicast frame destined to a MAC address that is not registered in the bridging table, it floods the frame out all ports that are part of the same VLAN, except the receiving port. This is the default behavior of a switch when it does not know the destination MAC address. The switch does not perform an ARP request, send an error message, or flood the frame to all VLANs. References: Understanding Unicast Flooding | Junos OS | Juniper Networks

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

The correct answer to your question is  C. Option C . Here is why:

Option C shows the configuration of the  chassis  statement, which defines the properties of the router chassis, such as the number of aggregated Ethernet interfaces, the number of FPCs, and the number of PICs 1 .

To enable aggregated Ethernet interfaces on a router, you need to specify the  aggregated-devices  statement under the  chassis  statement and set the  ethernet  parameter to the desired number of interfaces 2 . For example, to enable two aggregated Ethernet interfaces, you can use the following configuration:

chassis { aggregated-devices { ethernet { device-count 2; } } }

Option C shows this configuration with the device-count set to 2, which will enable two aggregated Ethernet interfaces on the router. The other options do not show this configuration and will not enable any aggregated Ethernet interfaces on the router.

Therefore, option C is the correct answer to your question.