Juniper Juniper Certifications JN0-351 Questions & Answers

• Question 151:

  You are concerned about spoofed MAC addresses on your LAN.

  Which two Layer 2 security features should you enable to minimize this concern? (Choose two.)

  A. dynamic ARP inspection

  B. IP source guard

  C. DHCP snooping

  D. static ARP

  Correct Answer: AC

  A is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping1. DAI discards any ARP packets that do not match the database or have invalid formats1. C is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in- the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted. Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports2. DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client2.

• Question 152:

  What is a purpose of using a spanning tree protocol?

  A. to look up MAC addresses

  B. to eliminate broadcast storms

  C. to route IP packets

  D. to tunnel Ethernet frames

  Correct Answer: B

  A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation1. A broadcast storm can occur when there are loops in the

  network topology, meaning that there are multiple paths between two devices2.

  A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths. It does this by creating a logical tree structure that spans all the devices in the network, and

  disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices3.

  By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths. Instead, broadcast packets will be sent only along the tree structure, reaching each

  device once and avoiding congestion3.

• Question 153:

  Which statement is correct about the storm control feature?

  A. The storm control feature is enabled in the factory-default configuration on EX Series switches.

  B. The storm control feature requires a special license on EX Series switches.

  C. The storm control feature is not supported on aggregate Ethernet interfaces.

  D. The storm control configuration only applies to traffic being sent between the forwarding and control plane.

  Correct Answer: A

  Option A is correct. The storm control feature is enabled in the factory-default configuration on EX Series switches12. On EX2200, EX3200, EX3300, EX4200, and EX6200 switches, the factory default configuration enables storm control for

  broadcast and unknown unicast traffic on all switch interfaces2. On EX4300 switches, the factory default configuration enables storm control on all Layer 2 switch interfaces1.

  Option B is incorrect. The storm control feature does not require a special license on EX Series switches34.

  Option C is incorrect. There's no information available that suggests the storm control feature is not supported on aggregate Ethernet interfaces. Option D is incorrect. The storm control configuration applies to traffic at the ingress of an

  interface5, not just between the forwarding and control plane.

• Question 154:

  Which two statements correctly describe RSTP port roles? (Choose two.)

  A. The designated port forwards data to the downstream network segment or device.

  B. The backup port is used as a backup for the root port.

  C. The alternate port is a standby port for an edge port.

  D. The root port is responsible for forwarding data to the root bridge.

  Correct Answer: AD

  Explanation: In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree1. Option A suggests that the designated port forwards data to the downstream network segment or device. This is correct because the designated port is the port on a network segment that has the best path to the root bridge1. It's responsible for forwarding frames towards the root bridge and sending configuration messages into its segment1. Option D suggests that the root port is responsible for forwarding data to the root bridge. This is also correct because the root port is always the link directly connected to the root bridge, or the shortest path to the root bridge1. It's used to forward traffic towards the root bridge1. Therefore, options A and D are correct.

• Question 155:

  Which statement is correct about IP-IP tunnels?

  A. IP-IP tunnels only support encapsulating IP traffic.

  B. IP-IP tunnels only support encapsulating non-IP traffic.

  C. The TTL in the inner packet is decremented during transit to the tunnel endpoint.

  D. There are 24 bytes of overhead with IP-IP encapsulation.

  Correct Answer: A

  IP-IP tunnels are a type of tunnels that use IP as both the encapsulating and encapsulated protocol. IP-IP tunnels are simple and easy to configure, but they do not provide any security or authentication features. IP-IP tunnels only support

  encapsulating IP traffic, which means that the payload of the inner packet must be an IP packet. IP-IP tunnels cannot encapsulate non-IP traffic, such as Ethernet frames or MPLS labels1. Option A is correct, because IP-IP tunnels only

  support encapsulating IP traffic. Option B is incorrect, because IP-IP tunnels only support encapsulating non-IP traffic. Option C is incorrect, because the TTL in the inner packet is not decremented during transit to the tunnel endpoint. The

  TTL in the outer packet is decremented by each router along the path, but the TTL in the inner packet is preserved until it reaches the tunnel endpoint2. Option D is incorrect, because there are 20 bytes of overhead with IP-IP encapsulation.

  The overhead consists of the header of the outer packet, which has a fixed size of 20 bytes for IPv43.

  References:

  1: IP-IP Tunneling 2: What is tunneling? | Tunneling in networking 3: IPv4 - Header

• Question 156:

  Exhibit What does the * indicate in the output shown in the exhibit?

  

  A. The switch ports have a router attached.

  B. The interface is down.

  C. The interface is active.

  D. All interfaces have elected a root bridge.

  Correct Answer: C

  The exhibit shows the output of the command show vlans brief, which displays brief information about VLANs and their associated interfaces1. The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging. The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic1. This can be verified by the command show interfaces terse, which displays the status of the interfaces2.

• Question 157:

  Exhibit.

  

  You want to verify prefix information being sent from 10.36.1.4.

  Which two statements are correct about the output shown in the exhibit? (Choose two.)

  A. The routes displayed have traversed one or more autonomous systems.

  B. The output shows routes that were received prior to the application of any BGP import policies.

  C. The output shows routes that are active and rejected by an import policy.

  D. The routes displayed are being learned from an I BGP peer.

  Correct Answer: AB

  Explanation: The output shown in the exhibit is the result of the command "show ip bgp neighbor 10.36.1.4 received-routes", which displays all received routes (both accepted and rejected) from the specified neighbor.

  Option A is correct, because the routes displayed have traversed one or more autonomous systems. This can be seen from the AS_PATH attribute, which shows the sequence of AS numbers that the route has passed through. For example,

  the route 10.0.0.0/8 has an AS_PATH of 65001 65002, which means that it has traversed AS 65001 and AS 65002 before reaching the local router.

  Option B is correct, because the output shows routes that were received prior to the application of any BGP import policies. This can be seen from the fact that some routes have a status code of "r", which means that they are rejected by an

  import policy. The"received-routes" keyword shows the routes coming from a given neighbor before the inbound policy has been applied. To see the routes after the inbound policy has been applied, the "routes" keyword should be used

  instead. Option C is incorrect, because the output does not show routes that are active and rejected by an import policy. The status code of "r" means that the route is rejected by an import policy, but it does not mean that it is active. The

  status code of ">" means that the route is active and selected as the best path. None of the routes in the output have both ">" and "r" status codes.

  Option D is incorrect, because the routes displayed are not being learned from an IBGP peer. An IBGP peer is a BGP neighbor that belongs to the same AS as the local router. The output shows that the neighbor 10.36.1.4 has a remote AS of

  65001, which is different from the local AS of 65002. Therefore, the neighbor is an EBGP peer, not an IBGP peer.

• Question 158:

  You are configuring an IS-IS IGP network and do not see the IS-IS adjacencies established. In this scenario, what are two reasons for this problem? (Choose two.)

  A. MTU is not at least 1492 bytes.

  B. IP subnets are not a /30 address.

  C. The Level 2 routers have mismatched areas.

  D. The lo0 interface is not included as an IS-IS interface.

  Correct Answer: AD

  Explanation: Option A suggests that the MTU is not at least 1492 bytes. This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies1. If the MTU is less than this, IS-IS adjacencies will not be established1.

  Option D suggests that the lo0 interface is not included as an IS-IS interface. This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS1. If the loopback interface is not included in IS-IS, it could prevent

  IS-IS adjacencies from being established1.

  Therefore, options A and D are correct.

• Question 159:

  Exhibit.

  

  You are using OSPF to advertise the subnets that are used by the Denver and Dallas offices. The routers that are directly connected to the Dallas and Denver subnets are not advertising the connected subnets.

  Referring to the exhibit, which two statements are correct? (Choose two.)

  A. Create static routes on the switches using the local vMX router's loopback interface for the next hop.

  B. Configure and apply a routing policy that redistributes the Dallas and Denver subnets using Type 5 LSAs.

  C. Configure and apply a routing policy that redistributes the connected Dallas and Denver subnets.

  D. Enable the passive option on the OSPF interfaces that are connected to the Dallas and Denver subnets.

  Correct Answer: CD

  Explanation: The routers that are directly connected to the Dallas and Denver subnets are not advertising the connected subnets. This can be resolved by redistributing the connected subnets into OSPF1.

  Option C suggests to configure and apply a routing policy that redistributes the connected Dallas and Denver subnets. This is correct because redistribution allows routes from one routing protocol to be communicated to another, and in this

  case, it allows the connected subnets to be advertised through OSPF1.

  Option D suggests enabling the passive option on the OSPF interfaces that are connected to the Dallas and Denver subnets. This is also correct because in OSPF, a passive interface is an interface that belongs to the OSPF router, but does

  not send OSPF Hello packets1. It's typically used on an interface that you don't want to use for OSPF adjacencies, but you still want to advertise its IP address1. Therefore, enabling passive interface can help in advertising the Dallas and

  Denver subnets.

• Question 160:

  What are two reasons for creating multiple areas in OSPF? (Choose two.)

  A. to reduce the convergence time

  B. to increase the number of adjacencies in the backbone

  C. to increase the size of the LSDB

  D. to reduce LSA flooding across the network

  Correct Answer: AD

  Explanation: Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.

  Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.