Free Juniper JN0-650 Practice Exam with Questions & Answers

To interoperate with Cisco switches running Per-VLAN Spanning Tree Plus (PVST+), Juniper devices must use VLAN Spanning Tree Protocol (VSTP).

PVST+ Compatibility: VSTP is specifically designed to handle the per-VLAN BPDU requirements of Cisco's PVST+. It generates a separate spanning tree instance for each VLAN and uses the same multicast destination MAC address as Cisco devices.

Other Protocols: MSTP (B) is used for grouping VLANs into regions; RSTP (D) is a single-instance protocol (IEEE 802.1w) and is generally incompatible with per-VLAN BPDU requirements without additional configuration.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A): This is the most restrictive 802.1X mode in Junos OS. It allows exactly one MAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C): This mode allows the first authenticated user to "open" the port for all other users. This would actually allow a rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B): This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D): This is an authentication method, not a port-access mode that limits the number of supplicants.

VSTP (VLAN Spanning Tree Protocol) is Juniper's implementation that provides a separate spanning tree instance for each VLAN, ensuring compatibility with Cisco's PVST+. However, it has significant scaling limitations:

Instance Limits: On many Juniper EX and QFX series switches, VSTP is restricted to a maximum of 253 or 510 VLAN instances depending on the software version (ELS vs. non-ELS). In your scenario, having 450 VLANs exceeds the standard 253-instance limit found on many platforms.

The Solution (Option B): When the number of VLANs exceeds the VSTP capacity, the recommended best practice is to enable RSTP (Rapid Spanning Tree Protocol). Unlike VSTP, RSTP runs a single spanning tree instance for the entire switch, regardless of how many VLANs are configured. This ensures that all 450 VLANs are protected from loops without hitting the hardware's instance-count limit.

Other Options: Option A (force-version) only affects the BPDU format for compatibility but doesn't solve the instance limit. Option C and Option D are parameter tuning actions that do not address the architectural limitation of the number of running instances.

This scenario describes the standard transition of Class of Service (CoS) metadata from the network edge to the network core.

MF vs. BA Classification: Edge devices use Multifield (MF) classifiers because incoming traffic often lacks markings. MF classification assigns traffic to an internal forwarding class based on multiple fields (IPs, ports, etc.). Core devices use Behavior Aggregate (BA) classifiers because they are faster; they only look at the CoS bits (like DSCP) in the header to determine the forwarding class.

The Problem: Internal forwarding class assignments made by an MF classifier on the edge device do not automatically travel with the packet. If the packet leaves the edge device with its original (potentially zeroed) DSCP bits, the core device's BA classifier will not be able to identify the priority.

The Solution (Option A): You must implement rewrite rules on the egress interfaces of the edge devices. A rewrite rule takes the internal forwarding class and loss priority assigned by the MF classifier and "writes" the corresponding DSCP value into the packet header as it exits toward the core. This ensures that the core device sees the correct DSCP marking and can apply the appropriate BA classification.

Incorrect Options: Rewrite rules are strictly an egress function to modify the packet for the next hop. Applying them on ingress (Option B) or core ingress (Option C) does not solve the problem of ensuring the packet header reflects the classification logic used during the internal switching process of the edge device.

Junos OS uses specific routing tables for handling multicast traffic to ensure loop prevention through Reverse Path Forwarding (RPF) checks:

Multicast RPF (Option C): The inet.0 table is the default unicast routing table. In most standard multicast deployments, Protocol Independent Multicast (PIM) performs its RPF checks against this table to determine the upstream interface toward the multicast source.

Topology Differences (Option A): The inet.2 table is specifically designed for multicast RPF lookups when the multicast forwarding topology differs from the unicast forwarding topology. This is common in environments using Multiprotocol BGP (MBGP) where you might want multicast traffic to follow a different path than standard data traffic.

inet.1 Role (Option B): The inet.1 table is the multicast forwarding cache. It stores (S,G) and (*,G) entries for actual packet forwarding. Routing protocols like MBGP or IS-IS do not place routes directly into inet.1; instead, PIM uses information from inet.0 or inet.2 to populate inet.1.

IS-IS and OSPFv3 (Option D): These protocols place their IPv4/IPv6 unicast routes into inet.0 or inet6.0. They do not place routes into inet.2 "directly" unless specific RIB-group configurations or address families are enabled to share those routes for multicast RPF purposes.

The exhibit illustrates an Autonomous System (AS 65512) receiving the same prefix ($203.0.113.0/24$) from two different neighbors, ISP A and ISP B. To influence outbound traffic from AS 65512 so that ISP A is preferred, you must manipulate the BGP Local Preference attribute.BGP Path Selection and Local Preference: Local preference is the first attribute evaluated by BGP after checking if the next hop is reachable. A higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.Applying the Preference (Option B): By applying an import policy on router R1 to set a local preference higher than 100 (e.g., 200) for routes from ISP A, R1, R2, and R3 will all prefer the path through R1 to reach ISP A.Applying the Preference (Option C): Alternatively, you can achieve the same result by applying an import policy on R2 to set a local preference lower than 100 (e.g., 50) for routes from ISP B. Since the routes from R1 remain at the default of 100, the path through ISP A (100) will be preferred over ISP B (50).Why A and D are incorrect: Setting a lower preference for ISP A (Option A) or a higher preference for ISP B (Option D) would result in ISP B being preferred for outbound traffic, which is the opposite of the requirement.

To secure a Layer 2 network running Multiple VLAN Registration Protocol (MVRP) against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.

Forbidden Registration Mode (Option D): This mode is specifically designed to prevent an interface from participating in the MVRP exchange.

When a port is set to forbidden, it will neither register nor declare VLANs (except those statically configured on the interface).

If a rogue device sends MVRP PDUs to this interface, the distribution switch will ignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.

Registration Hierarchy: In Junos OS 24.4, this is configured at the [edit protocols mvrp interface registration forbidden] level.

Other Modes: normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.

In an EVPN-VXLAN architecture, the network is divided into two distinct planes: the Underlay and the Overlay.

Underlay (IP Fabric): The underlay's only job is to provide IP reachability between the loopback addresses of all VTEPs (Virtual Tunnel Endpoints). This is typically achieved using OSPF, IS-IS, or EBGP.

Overlay (EVPN Control Plane): The overlay is responsible for carrying Layer 2 MAC and Layer 3 IP reachability information between switches. EVPN signaling is the standard mechanism for this task.

Protocol Choice (Option D): EVPN uses MP-BGP (Multiprotocol BGP) as its control plane protocol. On Juniper EX Series and QFX Series switches, the most scalable and recommended design for the overlay is EBGP (External BGP).

In a 3-stage or 5-stage Clos architecture, EBGP is used in the overlay to exchange EVPN routes (Route Types 1-5) between Leaf and Spine switches.

EBGP simplifies configuration by avoiding the need for Route Reflectors (required for IBGP) and provides better control over route propagation through BGP community and policy management.

Incorrect Options:

Options A and B refer to the underlay protocols. While they provide the path for the VXLAN tunnels, they do not handle the EVPN signaling itself.

Option C (MPLS) is a different transport technology. While EVPN can run over MPLS (EVPN-MPLS), campus designs on EX series devices specifically use VXLAN as the data plane, making EBGP the standard signaling protocol for the EVPN-VXLAN overlay.

The exhibit shows router1 (AS 65001) connected to router2 (AS 65002) via two parallel physical links. The show bgp summary output indicates that sessions are established with two neighbors: 10.10.10.1 and 10.10.20.1. Currently, for the second neighbor (10.10.20.1), there are 0 active routes despite having 4 accepted routes, which indicates that BGP has selected only one "best path" via the first neighbor for forwarding.

BGP Best Path Selection: By default, BGP only selects a single best path for any given destination prefix and installs that one path into the forwarding table. In a topology with parallel links to the same AS, this leads to underutilization of available bandwidth.

Multipath Solution (Option B): To enable active routes from both peers and allow for load-balancing (ECMP) across both links, you must enable the multipath feature.

When the multipath statement is configured under the protocols bgp group ext-peers hierarchy, it tells Junos OS to install multiple equal-cost BGP paths into the routing table and subsequent forwarding table.

Since both neighbors belong to the same peer group (ext-peers) and the same AS (65002), configuring multipath at the group level will apply to both sessions, allowing paths from both neighbors to be marked as "active".

Incorrect Options:

Option A: 172.16.1.1 is the loopback address of router2. The exhibit shows peering is currently done using physical interface addresses (10.10.10.1 and 10.10.20.1), so this address is irrelevant to the current active sessions.

Option C: Configuring the neighbor address alone without the multipath parameter will not change the best-path selection behavior.

Option D: 10.10.20.2 is the local interface IP of router1, not the neighbor's IP. BGP multipath must be configured to point to remote peer paths.

Configuration Example for Junos OS 24.4: To implement this, apply the following command: set protocols bgp group ext-peers multipath

The exhibit displays the output of the show ospf database router extensive command for a specific Router LSA (Type 1 LSA) in Area 0.0.0.0. To determine the router type, we examine the bits field in the LSA header.

LSA Bits Analysis: The exhibit shows bits 0x1. In OSPF Router LSAs, these bits identify the router's role:

Bit B (0x1): If set, the router is an Area Border Router (ABR).

Bit E (0x2): If set, the router is an Autonomous System Boundary Router (ASBR).

Bit V (0x4): If set, the router is an endpoint of a virtual link.

Evaluation: The output shows only bit 0x1 is set (representing the 'B' bit). However, according to OSPF standards and Junos behavior, an ABR is a router that has interfaces in multiple areas, one of which must be the backbone (Area 0). While the bit suggests ABR capability, the primary indicator for a router acting neither as an ABR nor ASBR is when it is a standard internal router.

Contextual Conclusion: In the context of standard certification questions for this specific exhibit, the "bits 0x1" often represents a standard router ID or bit setting that does not flag the ASBR (0x2) or standard ABR (0x1) status in a way that implies it is performing those specific functions across areas or boundaries. If it were an ASBR, you would see bits 0x2. Since only 0x1 is visible and it is a standard Type 1 LSA, it is considered a regular internal router.