Free Juniper JN0-352 Practice Exam with Questions & Answers | Set: 2

The show route advertising-protocol bgp command displays exactly what would be transmitted to a specific BGP neighbor after all configured export routing policy has already been evaluated and applied, meaning any prefixes shown in this output have successfully passed through the export policy chain — confirming the export routing policy has been processed. The command header explicitly states '7 destinations, 7 routes (7 active, ...)' and every listed prefix is preceded by an asterisk, Junos's standard marker for an active route, confirming all seven displayed routes are active in the local routing table. The routing table name shown, XYZ.inet.0, indicates these routes reside in a named routing instance called XYZ rather than the default master routing instance, whose table would instead be labeled simply inet.0; this rules out the statement claiming the routes belong to the default instance. The AS path column shows only the origin code 'I' (IGP) with no AS numbers prepended ahead of it, meaning the AS path is empty, which indicates these prefixes were originated locally within R1's own AS (through redistribution or local origination) rather than having been learned from and passed through an external AS, ruling out that statement as well. Finally, the Nexthop column explicitly shows 'Self' for every route rather than an actual peer or learned address, confirming R1 is rewriting the next-hop attribute to its own address before advertising — a deliberate next-hop-self policy action typically applied toward IBGP peers. Reference topics: Junos Enterprise Routing – BGP, Verifying Advertised Routes and Export Policy Effects.

Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to 22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction. The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching – Firewall Filters, Matching on Address, Protocol, and Port Conditions.

The intent of this filter is to match and discard traffic from one single, specific host MAC address, which requires the source-mac-address match condition to reference the complete, exact 48-bit address using an explicit /48 mask (or no mask at all, which Junos treats as an implicit full match) so that only that one precise address is matched. As configured, the term instead specifies a /40 mask on 00:12:34:56:00:07, meaning only the first 40 bits (the first five octets, 00:12:34:56:00) are actually significant to the match, while the sixth octet is effectively wildcarded across its full range; this produces an imprecise, overly broad match criterion rather than the single-host match the administrator intended, and is a common configuration mistake that undermines the predictability and correctness of MAC-based filtering. The lesson tested here is that source and destination MAC address match conditions in Junos firewall filters must be specified with the correct, deliberate, and explicit prefix length appropriate to the intended scope — typically /48 for a single exact host — rather than an arbitrary or miscalculated mask value. Firewall filters under family ethernet-switching are fully capable of matching on both source-mac-address and destination-mac-address, which rules out that option entirely. Layer 2 MAC-based filters function correctly on both access and trunk interface modes, so interface type is not a limiting factor here. There is no indication in the exhibit that the filter's application direction (input versus output) is reversed. Reference topics: Junos Enterprise Switching – Layer 2 Security, MAC Address Match Conditions and Prefix Length Precision.

The factory-default storm control configuration on EX Series switches operates in a purely rate-limiting mode rather than an interface-shutdown mode. When broadcast, multicast, or unknown-unicast traffic on a port exceeds the configured bandwidth-percentage threshold, the default action is simply to police the offending traffic type and silently drop only the packets that exceed that threshold, while all traffic within the allowed rate continues to be forwarded normally and the interface itself remains administratively and operationally up throughout the event. This explains the observed symptom precisely: during the burst of unknown-unicast frames, the switch dropped the excess volume above the configured limit, producing a brief period of packet loss, but as soon as the burst subsided and traffic fell back under the threshold, storm control simply stopped dropping packets and normal forwarding resumed automatically — no administrative shutdown, recovery timer, or manual intervention was ever involved, because the interface was never taken down in the first place. This default drop-only behavior is distinct from the optional interface-shutdown action, which must be explicitly configured if an administrator wants storm control to disable a port outright on violation (as seen in a related scenario requiring the clear ethernet-switching recovery-timeout command). Storm control by default covers broadcast, multicast, and unknown-unicast traffic types together, not multicast alone, and it has no functional relationship to GRES, which governs Routing Engine redundancy rather than Layer 2 traffic policing. Reference topics: Junos Enterprise Switching – Storm Control, Default Drop Behavior Versus Interface Shutdown Action.

A link aggregation group bundles multiple physical Ethernet links into a single logical interface (an ae interface) specifically to provide both increased aggregate bandwidth and link-level redundancy. By default, the aeX interface remains operationally up as long as at least one member link within the bundle remains active and passing traffic; the LAG does not require every member link to be functional to continue operating. When one of the four 1-GbE member links in this scenario fails, LACP (if in use) or the underlying link-status monitoring detects the failure, removes that specific link from the active forwarding set, and redistributes traffic hashing across the three remaining healthy member links automatically and without operator intervention. End devices and upper-layer protocols continue to see a single, continuously up ae interface throughout this process, experiencing only a proportional reduction in available aggregate bandwidth rather than any interruption in connectivity. This default behavior is precisely why LAG is a foundational building block for resilient EX Series switch interconnects in enterprise and data center designs, since it allows individual optic, cable, or transceiver failures to be absorbed transparently. None of the distractor behaviors — full administrative shutdown of the bundle, forwarding limited to broadcast traffic only, or a temporary disabling of all member links during renegotiation — reflect actual Junos LAG behavior, which is designed explicitly to avoid any such disruption. Reference topics: Junos Enterprise Switching – Layer 2 Switching, Link Aggregation Group Resiliency.

IS-IS (Intermediate System to Intermediate System) was designed by ISO as a link-state Interior Gateway Protocol for routing within a single autonomous system, functioning on a hierarchical two-level model conceptually similar to OSPF's areas, which makes the first statement unambiguously correct. Within that hierarchy, Level 1 routers maintain detailed topology information only for their own local area and use a default route toward the nearest Level 2 or Level 1/Level 2 router to reach destinations outside the area; they explicitly do not carry inter-area topology information and therefore cannot route traffic between areas on their own. Routers that participate in both levels simultaneously — Level 1/Level 2 (L1/L2) routers — sit at the area boundary, maintaining a Level 1 database for their local area and a Level 2 database for the backbone, and it is specifically these dual-level routers that stitch inter-area traffic together, forwarding packets from the local area into the Level 2 backbone and vice versa, which confirms the second correct statement. Regarding route preference, Junos assigns distinct default preference (administrative distance) values of 15 for IS-IS Level 1 routes and 18 for IS-IS Level 2 routes — neither of which is 20 — so the preference-value statement is factually incorrect and included as a distractor testing precise knowledge of Junos default protocol preferences. Reference topics: Junos Enterprise Routing – IS-IS, Level 1, Level 2, and L1/L2 Router Roles; Default Route Preference Values.

GRE is fundamentally a stateless encapsulation protocol: the encapsulating router simply wraps the passenger packet in a GRE header and an outer delivery IP header and forwards it based on ordinary IP routing table lookups toward the configured tunnel destination address. For that forwarding to succeed, the underlying (global or routing-instance) routing table on each endpoint must contain a valid, reachable route to the far-end tunnel address; without such a route, the tunnel interface will not come up or will be unable to deliver traffic, since GRE relies entirely on the existing IP infrastructure rather than any tunnel-specific signaling to establish reachability. Because GRE has no built-in state machine or session negotiation, it does not natively track whether the remote endpoint is alive — that requires an optional add-on such as GRE keepalives or BFD, neither of which is enabled by default; an operator must explicitly configure them if failure detection is required. GRE is also protocol-agnostic rather than IPv4-only: it can encapsulate IPv4, IPv6, MPLS, and other network-layer protocols as the passenger, which is one of its defining advantages over IP-in-IP tunneling. Finally, because GRE keeps no per-session state about the peer, it cannot detect or report tunnel failures on its own, reinforcing why route reachability is the one true prerequisite for tunnel operation. Reference topics: Junos Enterprise Routing – Tunneling, Understanding Generic Routing Encapsulation.

In the output of show ospf database, Junos marks every self-originated link-state advertisement with an asterisk immediately preceding the LSA's link-state ID. A self-originated LSA is one that was created and flooded by the router on which the command is being executed, as opposed to an LSA that was received from and originated by a neighboring router elsewhere in the area. In this exhibit, the asterisked Router LSA has an ID of 10.101.100.0 and an Advertising Router value of the same 10.101.100.0, confirming that this particular Router LSA describes the local device's own links, area membership, and interface costs, and that the local router itself flooded this LSA into the area's link-state database. This distinction matters operationally because when troubleshooting OSPF topology or SPF calculation issues, engineers frequently need to isolate their own router's advertised state from the states advertised by every other router in the area; the asterisk provides an immediate, unambiguous visual cue for that separation without needing to cross-reference the router's own ID separately. It has no relationship to designated router or backup designated router status — DR/BDR roles are indicated elsewhere in interface-level output, not through the asterisk convention in the LSA database dump, and a router that is neither DR nor BDR still self-originates and flags its own Router LSA the same way. Reference topics: Junos Enterprise Routing – OSPF, Interpreting the OSPF Link-State Database.

BGP employs two distinct loop-prevention mechanisms depending on whether peers are external or internal to the same autonomous system. Between external peers (EBGP), loop prevention relies on the AS path attribute: every time a route crosses an AS boundary, the local AS number is prepended to the path, and a router rejects any incoming route whose AS path already contains its own AS number, since that would indicate the route has looped back around. Between internal peers (IBGP) within the same AS, however, the AS path attribute never changes, because IBGP does not add AS numbers as routes are readvertised internally — meaning AS path alone cannot detect an internal loop. Instead, IBGP enforces a strict split-horizon-style rule: a router that learns a route via IBGP must never readvertise that route to another IBGP peer. This rule guarantees that every IBGP speaker within the AS must be directly peered with every other IBGP speaker (a logical full mesh) in order for all routers to receive all routes, since no IBGP router will relay IBGP-learned routes onward on another router's behalf. This full-mesh requirement is precisely why techniques such as route reflection and confederations were later developed — they preserve the same loop-prevention guarantee while relaxing the physical full-mesh peering burden. VRRP and BFD serve entirely unrelated purposes (gateway redundancy and fast failure detection, respectively) and play no role in BGP loop prevention. Reference topics: Junos Enterprise Routing – BGP, IBGP Split-Horizon and the Full-Mesh Requirement.