Juniper JN0-351 Online Practice Questions and Exam Preparation

Juniper JN0-351 Online Questions & Answers

• Question 1:

  Exhibit Referring to the exhibit, which two configuration changes must you apply for packets to reach from R1 to R3 using IS-IS? (Choose two.)

  

  A. On R1, enable Level 1 on the ge-0/0/1 interface.
  B. On R3 disable Level 2 on the ge-0/0/4 interface.
  C. On R1, disable Level 2 on the ge-0/0/1 interface.
  D. On R3 enable Level 1 on the ge-0/0/4 interface
  A. On R1, enable Level 1 on the ge-0/0/1 interface.
  D. On R3 enable Level 1 on the ge-0/0/4 interface

  ---

  explanation:

  Explanation/Reference:

  D. On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge- 0/0/4 interface on R3 would allow packets to reach from R1 to R3. These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks1 and Cisco34.

• Question 2:

  Which two statements about BGP facilitate the prevention of routing loops between two autonomous systems? (Choose two.)

  A. EBGP routers will append their AS number when advertising routes to their neighbors.
  B. EBGP routers will only accept routes that contain their own AS number in the AS_PATH.
  C. EBGP routers will drop routes that contain their own AS number in the AS_PATH
  D. EBGP routers will prepend their AS number when advertising routes to their neighbors
  A. EBGP routers will append their AS number when advertising routes to their neighbors.
  C. EBGP routers will drop routes that contain their own AS number in the AS_PATH

  ---

  explanation:

  Explanation/Reference:

  BGP (Border Gateway Protocol) is a protocol designed to exchange routing and reachability information among autonomous systems (AS) on the internet1. Option A is correct. When an EBGP router advertises routes to its

  neighbors, it appends its AS number to the AS_PATH attribute1. This is a key mechanism in BGP to prevent routing loops1.

  Option C is correct. BGP has a built-in loop prevention mechanism whereby if a BGP router detects its own AS in the AS_PATH attribute, it will drop the prefix and will not continue to advertise it2. This helps to prevent routing loops2. Option B

  is incorrect. EBGP routers do not accept routes that contain their own AS number in the AS_PATH2. Instead, they drop such routes as part of the loop prevention mechanism2.

  Option D is incorrect. While it's true that EBGP routers append their AS number when advertising routes, they do not prepend their AS number1. The term "prepend" in BGP usually refers to a technique used to influence path selection by

  artificially lengthening the AS_PATH3.

• Question 3:

  You are asked to create a new firewall filter to evaluate Layer 3 traffic that is being sent between VLANs. In this scenario, which two statements are correct? (Choose two.)

  A. You should create a family Ethernet-switching firewall filter with the appropriate match criteria and actions.
  B. You should apply the firewall filter to the appropriate VLAN.
  C. You should create a family inet firewall filter with the appropriate match criteria and actions.
  D. You should apply the firewall filter to the appropriate IRB interface.
  C. You should create a family inet firewall filter with the appropriate match criteria and actions.
  D. You should apply the firewall filter to the appropriate IRB interface.

  ---

  explanation:

  Explanation/Reference:

  A firewall filter is a configuration that defines the rules that determine whether to forward or discard packets at specific processing points in the packet flow. A firewall filter can also modify the attributes of the packets, such as priority, marking, or logging. A firewall filter can be applied to various interfaces, protocols, or routing instances on a Juniper device1. A firewall filter has a family attribute, which specifies the type of traffic that the filter can evaluate. The family attribute can be one of the following: inet, inet6, mpls, vpls, iso, or ethernet-switching2. The family inet firewall filter is used to evaluate IPv4 traffic, which is the most common type of Layer 3 traffic on a network. To create a family inet firewall filter, you need to specify the appropriate match criteria and actions for each term in the filter. The match criteria can include various fields in the IPv4 header, such as source address, destination address, protocol, port number, or DSCP value. The actions can include accept, discard, reject, count, log, policer, or next term3. To apply a firewall filter to Layer 3 traffic that is being sent between VLANs, you need to apply the filter to the appropriate IRB interface. An IRB interface is an integrated routing and bridging interface that provides Layer 3 functionality for a VLAN on a Juniper device. An IRB interface has an IP address that acts as the default gateway for the hosts in the VLAN. An IRB interface can also participate in routing protocols and forward packets to other VLANs or networks4. Therefore, option C is correct, because you should create a family inet firewall filter with the appropriate match criteria and actions. Option D is correct, because you should apply the firewall filter to the appropriate IRB interface. Option A is incorrect, because you should not create a family ethernet-switching firewall filter with the appropriate match criteria and actions. A family ethernet-switching firewall filter is used to evaluate Layer 2 traffic on a Juniper device. A family ethernet-switching firewall filter can only match on MAC addresses or VLAN IDs, not on IP addresses or protocols5. Option B is incorrect, because you should not apply the firewall filter to the appropriate VLAN. A VLAN is a logical grouping of hosts that share the same broadcast domain on a Layer 2 network. A VLAN does not have an IP address or routing capability. A firewall filter cannot be applied directly to a VLAN; it must be applied to an interface that belongs to or connects to the VLAN6. References:

  1: Firewall Filters Overview 2: Configuring Firewall Filters 3: Configuring Firewall Filter Match Conditions and Actions 4: Understanding Integrated Routing and Bridging Interfaces 5: Configuring Ethernet-Switching Firewall Filters 6: Understanding VLANs

• Question 4:

  Which statement about aggregate routes is correct?

  A. Aggregate routes can only be used for static routing but not for dynamic routing protocols.
  B. Aggregate routes are automatically generated for all of the subnets in a routing table.
  C. Aggregate routes are always preferred over more specific routes, even when the specific routes have a better path.
  D. Aggregate routes are used for advertising summarized network prefixes.
  D. Aggregate routes are used for advertising summarized network prefixes.

  ---

  explanation:

  Explanation/Reference:

  Aggregate routes are used for advertising summarized network prefixes12. They help minimize the number of routing tables in an IP network by consolidating selected multiple routes into a single route advertisement1. This

  approach is in contrast to non-aggregation routing, in which every routing table contains a unique entry for each route1.

  Therefore, option D is correct. Options A, B, and C are not correct because:

  Aggregate routes can be used with both static routing and dynamic routing protocols1.

  Aggregate routes are not automatically generated for all of the subnets in a routing table. They need to be manually configured1.

  Aggregate routes are not always preferred over more specific routes. The route selection process in Junos OS considers several factors, including route preference and metric, before determining the active route1.

• Question 5:

  You need to configure a LAG between your switches. In this scenario, which two statements are correct? (Choose two.)

  A. Duplex and speed settings are not required to match on both participating devices.
  B. Duplex and speed settings are required to match on both participating devices.
  C. Member links are not required to be contiguous ports.
  D. Member links are required to be contiguous ports.
  B. Duplex and speed settings are required to match on both participating devices.
  C. Member links are not required to be contiguous ports.

  ---

  explanation:

  Explanation/Reference:

  B is correct because duplex and speed settings are required to match on both participating devices. According to the Juniper Networks documentation1, all the interfaces in a LAG must have the same speed and be in full-duplex mode. This

  ensures that the LAG can operate as a single logical link without any performance or compatibility issues.

  C is correct because member links are not required to be contiguous ports. According to the Juniper Networks documentation2, you can group any Ethernet interfaces on a switch into a LAG, regardless of their physical location or slot

  number. This provides flexibility and scalability for configuring LAGs on switches.

• Question 6:

  Which two statements are correct about using firewall filters on EX Series switches? (Choose two.)

  A. You can deploy only stateless firewall filters on an EX Series switch.
  B. You can only apply firewall filters to Layer 2 traffic on an EX Series switch.
  C. You can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.
  D. You can deploy both stateless and stateful firewall filters on an EX Series switch.
  A. You can deploy only stateless firewall filters on an EX Series switch.
  C. You can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.

  ---

  explanation:

  Explanation/Reference:

  A is correct because you can deploy only stateless firewall filters on an EX Series switch. A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers1. A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or sessioninformation1. EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters2. C is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch. Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks3. EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters4. You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.

• Question 7:

  You are a network operator who wants to add a second ISP connection and remove the default route to the existing ISP You decide to deploy the BGP protocol in the network.

  What two statements are correct in this scenario? (Choose two.)

  A. IBGP updates the next-hop attribute to ensure reachability within an AS.
  B. IBGP peers advertise routes received from EBGP peers to other IBGP peers.
  C. IBGP peers advertise routes received from IBGP peers to other IBGP peers.
  D. EBGP peers advertise routes received from IBGP peers to other EBGP peers.
  A. IBGP updates the next-hop attribute to ensure reachability within an AS.
  B. IBGP peers advertise routes received from EBGP peers to other IBGP peers.

  ---

  explanation:

  Explanation/Reference:

  A is correct because IBGP updates the next-hop attribute to ensure reachability within an AS. This is because the next-hop attribute is the IP address of the router that advertises the route to a BGP peer. If the next-hop attribute is not changed by IBGP, it would be the IP address of an external router, which may not be reachable by all routers within the AS. Therefore, IBGP updates the next-hop attribute to the IP address of the router that received the route from an EBGP peer1. B is correct because IBGP peers advertise routes received from EBGP peers to other IBGP peers. This is because BGP follows the rule of advertising only the best route to a destination, and EBGP routes have a higher preference than IBGP routes. Therefore, IBGP peers advertise routes learned from an EBGP peer to all BGP peers, including both EBGP and IBGP peers1.

• Question 8:

  Exhibit

  

  You have configured a GRE tunnel. To reduce the risk of dropping traffic, you have configured a keepalive OAM probe to monitor the state of the tunnel; however, traffic drops are still occurring.

  Referring to the exhibit, what is the problem?

  A. For GRE tunnels, the OAM protocol requires that the BFD protocols also be used.
  B. The "event link-adjacency-loss" option must be set.
  C. LLDP needs to be removed from the gr-1/1/10.1 interface.
  D. The hold-time value must be two times the keepalive-time value
  D. The hold-time value must be two times the keepalive-time value

  ---

  explanation:

  Explanation/Reference:

  A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply. If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down1. To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router. The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down2. According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel2. This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps. In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply. Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel. Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives3. Option B is incorrect, because the "event link- adjacency-loss" option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down4. Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels5. References:

  1: Configuring Keepalive Time and Hold time for a GRE Tunnel Interface 2: keepalive | Junos OS | Juniper Networks 3: Configuring Bidirectional Forwarding Detection 4: event link-adjacency-loss | Junos OS | Juniper Networks 5: Understanding Link Layer Discovery Protocol

• Question 9:

  Which statement is correct about controlling the routes installed by a RIB group?

  A. An import policy is applied to the RIB group.
  B. Only routes in the last table are installed.
  C. A firewall filter must be configured to install routes in the RIB groups.
  D. An export policy is applied to the RIB group.
  A. An import policy is applied to the RIB group.

  ---

  explanation:

  Explanation/Reference:

  A RIB group is a configuration that allows a routing protocol to install routes into multiple routing tables in Junos OS. A RIB group consists of an import-rib statement,which specifies the source routing table, and an export-rib

  statement, which specifies the destination routing table or group. A RIB group can also include an import- policy statement, which specifies one or more policies to control which routes are imported into the destination routing table or group1.

  An import policy is a policy statement that defines the criteria for accepting or rejecting routes from the source routing table. An import policy can also modify the attributes of the imported routes, such as preference, metric, or community. An

  import policy can be applied to a RIB group by using the import-policy statement under the [edit routing-options rib- groups] hierarchy level1.

  Therefore, option A is correct, because an import policy is applied to the RIB group to control which routes are installed in the destination routing table or group. Option B is incorrect, because all routes in the source routing table are imported

  into the destination routing table or group, unless filtered by an import policy. Option C is incorrect, because a firewall filter is not used to install routes in the RIB groups; a firewall filter is used to filter packets based on various criteria. Option

  D is incorrect, because an export policy is not applied to the RIB group; an export policy is applied to a routing protocol to control which routes are advertised to other devices.

  References:

  1: rib-groups | Junos OS | Juniper Networks

• Question 10:

  Which statement is correct about graceful Routing Engine switchover (GRES)?

  A. The PFE restarts and the kernel and interface information is lost.
  B. GRES has a helper mode and a restarting mode.
  C. When combined with NSR, routing is preserved and the new master RE does not restart rpd.
  D. With no other high availability features enabled, routing is preserved and the new master RE does not restart rpd.
  C. When combined with NSR, routing is preserved and the new master RE does not restart rpd.

  ---

  explanation:

  Explanation/Reference:

  The Graceful Routing Engine Switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails1. GRES preserves interface and kernel information, ensuring that traffic is not interrupted1. However, GRES does not preserve the control plane1. To preserve routing during a switchover, GRES must be combined with either Graceful Restart protocol extensions or Nonstop Active Routing (NSR)1. When GRES is combined with NSR, nearly 75 percent of line rate worth of traffic per Packet Forwarding Engine remains uninterrupted during GRES1. Any updates to the primary Routing Engine are replicated to the backup Routing Engine as soon as they occur1. Therefore, when GRES is combined with NSR, routing is preserved and the new master RE does not restart rpd1.