Juniper Juniper Certifications JN0-351 Questions & Answers

• Question 161:

  Which three protocols support BFD? (Choose three.)

  A. RSTP

  B. BGP

  C. OSPF

  D. LACP

  E. FTP

  Correct Answer: BCD

  Explanation: BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster

  convergence and fault recovery. According to the Juniper Networks documentation, the following protocols support BFD on Junos OS devices1:

  BGP: BFD can be used to monitor the connectivity between BGP peers and trigger a session reset if a failure is detected. BFD can be configured for both internal and external BGP sessions, as well as for IPv4 and IPv6 address families2.

  OSPF: BFD can be used to monitor the connectivity between OSPF neighbors and trigger a state change if a failure is detected. BFD can be configured for both OSPFv2 and OSPFv3 protocols, as well as for point-to-point and broadcast

  network types3.

  LACP: BFD can be used to monitor the connectivity between LACP members and trigger a link state change if a failure is detected. BFD can be configured for both active and passive LACP modes, as well as for static and dynamic LAGs4.

  Other protocols that support BFD on Junos OS devices are:

  IS-IS: BFD can be used to monitor the connectivity between IS-IS neighbors and trigger a state change if a failure is detected. BFD can be configured for both level 1 and level 2 IS-IS adjacencies, as well as for point-to-point and broadcast

  network types.

  RIP: BFD can be used to monitor the connectivity between RIP neighbors and trigger a route update if a failure is detected. BFD can be configured for both RIP version 1 and version 2 protocols, as well as for IPv4 and IPv6 address families.

  VRRP: BFD can be used to monitor the connectivity between VRRP routers and trigger a priority change if a failure is detected. BFD can be configured for both VRRP version 2 and version 3 protocols, as well as for IPv4 and IPv6 address

  families.

  The protocols that do not support BFD on Junos OS devices are:

  RSTP: RSTP is a spanning tree protocol that provides loop prevention and rapid convergence in layer 2 networks. RSTP does not use BFD to detect link failures, but relies on its own hello mechanism that sends BPDU packets every 2

  seconds by default.

  FTP: FTP is an application layer protocol that is used to transfer files between hosts over a TCP connection. FTP does not use BFD to detect connection failures, but relies on TCP's own retransmission and timeout mechanisms.

  References:

  1: [Configuring Bidirectional Forwarding Detection] 2: [Configuring Bidirectional Forwarding Detection for BGP] 3: [Configuring Bidirectional Forwarding Detection for OSPF] 4:

  [Configuring Bidirectional Forwarding Detection for Link Aggregation Control Protocol] :

  [Configuring Bidirectional Forwarding Detection for IS-IS] : [Configuring Bidirectional Forwarding Detection for RIP] : [Configuring Bidirectional Forwarding Detection for VRRP] :

  [Understanding Rapid Spanning Tree Protocol] : [Understanding FTP]

• Question 162:

  Which two statements are true about the default VLAN on Juniper switches? (Choose two.)

  A. The default VLAN is set to a VLAN ID of 1 by default

  B. The default VLAN ID is not assigned to any interface.

  C. The default VLAN ID is not visible.

  D. The default VLAN ID can be changed.

  Correct Answer: AD

  Explanation: On Juniper switches, the default VLAN is set to a VLAN ID of 1 by default12. This means that all interfaces on the switch are members of VLAN 1 until they are specifically assigned to another VLAN12. Therefore, option A is correct. The default VLAN ID can be changed12. This allows network administrators to configure the switch to use a different VLAN as the default, if necessary12. Therefore, option D is correct.

• Question 163:

  What are two characteristics of RSTP alternate ports? (Choose two.)

  A. RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch.

  B. RSTP alternate ports provide an alternate lower cost path to the root bridge.

  C. RSTP alternate ports provide an alternate higher cost path to the root bridge.

  D. RSTP alternate ports are active ports used to forward frames toward the root bridge.

  Correct Answer: AC

  A is correct because RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch. An alternate port is a backup port for a root port, which means it receives better BPDUs from another bridge than the current root port1. However, an alternate port does not forward any traffic, as it is in a discarding state2. It only listens to BPDUs and waits for the root port to fail. If the root port fails, the alternate port can immediately transition to a forwarding state and become the new root port1. C is correct because RSTP alternate ports provide an alternate higher cost path to the root bridge. An alternate port is selected based on the same criteria as the root port, which are the lowest bridge ID, the lowest path cost, the lowest sender port ID, and the lowest receiver port ID3. However, an alternate port receives a higher cost BPDU than the root port, otherwise it would be the root port itself1. Therefore, an alternate port provides an alternate higher cost path to the root bridge than the root port.

• Question 164:

  Exhibit

  

  You are receiving the BGP route shown in the exhibit from four different upstream ISPs.

  Referring to the exhibit, which ISP will be selected as the active path?

  A. ISP1

  B. ISP 3

  C. ISP 4

  D. ISP 2

  Correct Answer: C

  Explanation: In BGP, the path selection process is based on a set of attributes1. The process starts by preferring the path with the highest weight, then the highest local preference, then the locally originated routes, and so on1. If all these attributes are the same, then it prefers the path with the shortest AS path1. Referring to the exhibit, all four ISPs have the same weight, local preference, and origin1. However, ISP 4 has the shortest AS path1. Therefore, ISP 4 will be selected as the active path. So, option C is correct.

• Question 165:

  You deployed a new EX Series switch with DHCP snooping enabled and you do not see any entries in the snooping databases for an interface. Which two Juniper configurations for that interface caused this issue? (Choose two.)

  A. The interface is configured as a disabled port.

  B. MAC limiting is enabled on the interface.

  C. The interface is configured as a trunk port.

  D. Dynamic ARP inspection is enabled on the interface.

  Correct Answer: AC

  A is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets. Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port1. C is correct because the interface is configured as a trunk port. By default, all trunk ports on the switch are trusted for DHCP snooping2. This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port. Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port2.

• Question 166:

  Which statement is correct about graceful Routing Engine switchover (GRES)?

  A. The PFE restarts and the kernel and interface information is lost.

  B. GRES has a helper mode and a restarting mode.

  C. When combined with NSR, routing is preserved and the new master RE does not restart rpd.

  D. With no other high availability features enabled, routing is preserved and the new master RE does not restart rpd.

  Correct Answer: C

  Explanation: The Graceful Routing Engine Switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails1. GRES preserves interface and kernel information, ensuring that traffic is not interrupted1. However, GRES does not preserve the control plane1. To preserve routing during a switchover, GRES must be combined with either Graceful Restart protocol extensions or Nonstop Active Routing (NSR)1. When GRES is combined with NSR, nearly 75 percent of line rate worth of traffic per Packet Forwarding Engine remains uninterrupted during GRES1. Any updates to the primary Routing Engine are replicated to the backup Routing Engine as soon as they occur1. Therefore, when GRES is combined with NSR, routing is preserved and the new master RE does not restart rpd1.

• Question 167:

  Which statement is correct about controlling the routes installed by a RIB group?

  A. An import policy is applied to the RIB group.

  B. Only routes in the last table are installed.

  C. A firewall filter must be configured to install routes in the RIB groups.

  D. An export policy is applied to the RIB group.

  Correct Answer: A

  Explanation: A RIB group is a configuration that allows a routing protocol to install routes into multiple routing tables in Junos OS. A RIB group consists of an import-rib statement,which specifies the source routing table, and an export-rib

  statement, which specifies the destination routing table or group. A RIB group can also include an import- policy statement, which specifies one or more policies to control which routes are imported into the destination routing table or group1.

  An import policy is a policy statement that defines the criteria for accepting or rejecting routes from the source routing table. An import policy can also modify the attributes of the imported routes, such as preference, metric, or community. An

  import policy can be applied to a RIB group by using the import-policy statement under the [edit routing-options rib- groups] hierarchy level1.

  Therefore, option A is correct, because an import policy is applied to the RIB group to control which routes are installed in the destination routing table or group. Option B is incorrect, because all routes in the source routing table are imported

  into the destination routing table or group, unless filtered by an import policy. Option C is incorrect, because a firewall filter is not used to install routes in the RIB groups; a firewall filter is used to filter packets based on various criteria. Option

  D is incorrect, because an export policy is not applied to the RIB group; an export policy is applied to a routing protocol to control which routes are advertised to other devices.

  References:

  1: rib-groups | Junos OS | Juniper Networks

• Question 168:

  Exhibit

  

  You have configured a GRE tunnel. To reduce the risk of dropping traffic, you have configured a keepalive OAM probe to monitor the state of the tunnel; however, traffic drops are still occurring.

  Referring to the exhibit, what is the problem?

  A. For GRE tunnels, the OAM protocol requires that the BFD protocols also be used.

  B. The "event link-adjacency-loss" option must be set.

  C. LLDP needs to be removed from the gr-1/1/10.1 interface.

  D. The hold-time value must be two times the keepalive-time value

  Correct Answer: D

  A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply. If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down1. To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router. The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down2. According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel2. This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps. In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply. Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel. Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives3. Option B is incorrect, because the "event link- adjacency-loss" option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down4. Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels5. References:

  1: Configuring Keepalive Time and Hold time for a GRE Tunnel Interface 2: keepalive | Junos OS | Juniper Networks 3: Configuring Bidirectional Forwarding Detection 4: event link-adjacency-loss | Junos OS | Juniper Networks 5: Understanding Link Layer Discovery Protocol

• Question 169:

  You are a network operator who wants to add a second ISP connection and remove the default route to the existing ISP You decide to deploy the BGP protocol in the network.

  What two statements are correct in this scenario? (Choose two.)

  A. IBGP updates the next-hop attribute to ensure reachability within an AS.

  B. IBGP peers advertise routes received from EBGP peers to other IBGP peers.

  C. IBGP peers advertise routes received from IBGP peers to other IBGP peers.

  D. EBGP peers advertise routes received from IBGP peers to other EBGP peers.

  Correct Answer: AB

  A is correct because IBGP updates the next-hop attribute to ensure reachability within an AS. This is because the next-hop attribute is the IP address of the router that advertises the route to a BGP peer. If the next-hop attribute is not changed by IBGP, it would be the IP address of an external router, which may not be reachable by all routers within the AS. Therefore, IBGP updates the next-hop attribute to the IP address of the router that received the route from an EBGP peer1. B is correct because IBGP peers advertise routes received from EBGP peers to other IBGP peers. This is because BGP follows the rule of advertising only the best route to a destination, and EBGP routes have a higher preference than IBGP routes. Therefore, IBGP peers advertise routes learned from an EBGP peer to all BGP peers, including both EBGP and IBGP peers1.

• Question 170:

  Which two statements are correct about using firewall filters on EX Series switches? (Choose two.)

  A. You can deploy only stateless firewall filters on an EX Series switch.

  B. You can only apply firewall filters to Layer 2 traffic on an EX Series switch.

  C. You can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.

  D. You can deploy both stateless and stateful firewall filters on an EX Series switch.

  Correct Answer: AC

  A is correct because you can deploy only stateless firewall filters on an EX Series switch. A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers1. A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or sessioninformation1. EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters2. C is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch. Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks3. EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters4. You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.