JN0-650 Sample Questions Answers

OSPFv2 (IPv4) and OSPFv3 (IPv6) share many fundamental concepts, such as the SPF algorithm and the use of areas, but they have distinct differences in how they handle prefix information and LSA headers in Junos OS.

Backbone Requirement (Option C): Both OSPFv2 and OSPFv3 utilize a hierarchical structure. In both versions, all areas must connect to a central Area 0 (the backbone) to allow for inter-area routing. If an area is not physically connected to Area 0, a virtual link must be established.

Flooding Scope (Option D): One of the significant architectural changes in OSPFv3 is the inclusion of the flooding scope directly into the LSA header. In OSPFv3, the LS Type field is expanded to 16 bits, where the top three bits define the flooding scope (e.g., Link-local, Area, or AS scope). This allows routers to understand how far an LSA should be propagated without needing to understand the specific LSA type itself.

LSA Prefix Information (Option A): This statement is misleading. In OSPFv2, Router and Network LSAs (Type 1 and 2) carry both topology and prefix information. However, a key design goal of OSPFv3 was to separate topology from prefix information. In OSPFv3, Type 1 and 2 LSAs only describe the topology, while prefixes are carried in new LSA types: Intra-Area-Prefix-LSAs (Type 9) and Link-LSAs (Type 8).

Processing (Option B): OSPFv2 is processed " per-subnet " because it forms adjacencies based on IPv4 subnets. OSPFv3 is processed " per-link " , meaning it forms adjacencies between interfaces on the same physical link regardless of whether they share a common IPv6 prefix.

In a standard Layer 2 switch environment without specific multicast optimizations, multicast traffic is treated similarly to broadcast traffic and is flooded out of all ports within a VLAN (except the port where it was received). This is inefficient as it consumes unnecessary bandwidth on ports where no receivers are present.

To optimize this, IGMP Snooping is the standard solution.

How it works: The switch " snoops " or monitors IGMP (Internet Group Management Protocol) messages between hosts and routers.

Result: When a receiver sends an IGMP Membership Report (Join) for a specific multicast group, the switch records which port that request came from. It then builds a Layer 2 multicast forwarding table so that traffic for that group is only forwarded to the specific ports that have active listeners.

Junos OS 24.4 Configuration: On modern Juniper switches, you enable this globally or per VLAN using the set protocols igmp-snooping vlan < vlan-name > command.

Option A (Promiscuous mode) is used for monitoring or specific security configurations (like Private VLANs) and would not limit multicast flooding. Option B (Spanning Tree) manages loop prevention and does not differentiate between traffic types for forwarding optimization. Option D (IRB interface) is used for Layer 3 routing between VLANs but does not inherently provide Layer 2 multicast optimization within a single VLAN.

The exhibit shows a BGP routing process where an Import Policy is being applied to routes received in the RIB-IN. Specifically, Policy 1 states: " Reject 0.0.0.0/0 from AS 64512. "

In Junos OS, when a routing policy rejects a route, that route is not placed in the main routing table (inet.0) for active use. Instead, it becomes a hidden route. To verify that a specific peer is actually sending a route that is subsequently being rejected by your policy, you must use specific diagnostic commands:

Understanding " Hidden " Routes: When a BGP route is received but fails to meet policy requirements (or has an unreachable next-hop), Junos keeps it in the BGP RIB-IN but marks it as " hidden. " It will not appear in a standard show route command.

Command Logic (Option D): The command show route receive-protocol bgp < peer ip > hidden allows an administrator to view all routes received from a specific neighbor, including those that were rejected by import policies.

show route receive-protocol bgp < peer ip > : Shows only the routes that passed the import policy and were accepted into the table. Since the 0.0.0.0/0 route from AS 64512 is explicitly rejected in the exhibit, it would not show up here.

Adding the hidden keyword is the essential step to see the rejected default route and verify that AS 64512 is indeed sending it before the policy drops it.

Other Options:

Option A is incorrect because it only shows accepted routes.

Option B and C are used to filter the existing active routing table based on gateway or next-hop attributes, but they cannot show routes that have been rejected and excluded from that table.

In a Juniper Q-in-Q (Layer 2 tunneling) environment, VLAN rewrites (specifically the swap operation) provide the most granular control over how customer traffic (C-VLANs) is mapped to service provider traffic (S-VLANs).

VLAN Rewrites (The Swap Operation): This method involves replacing the incoming customer VLAN tag with a service provider tag as the frame enters the tunnel. This is technically a " swap " because the original C-VLAN tag is removed and the S-VLAN tag is written in its place. At the egress of the tunnel, the S-VLAN tag is swapped back for the original C-VLAN tag. This is often used when different customers use the same C-VLAN IDs and the provider needs to keep them unique within their core.

Many-to-Many: This is a mapping style where multiple customer VLANs are mapped to multiple service provider VLANs, but it typically relies on the " push " (stacking) operation rather than a literal " swap " of the tag itself.

All-in-One: This is the simplest form of Q-in-Q where all traffic entering an interface is " pushed " into a single S-VLAN tag, regardless of any existing C-VLAN tags. No swapping occurs; the original tags are simply buried under the new provider tag.

L2PT (Layer 2 Protocol Tunneling): This is a feature used to tunnel Layer 2 control protocols (like STP, CDP, or LLDP) across a provider network by encapsulating them or changing their destination MAC addresses. It does not involve the swapping of VLAN tags.

In an EVPN-VXLAN Edge-Routed Bridging (ERB) architecture, also known as a collapsed fabric, the Layer 3 default gateway functionality is moved from the core/spine layer down to the edge (the leaf or distribution layer).

Anycast Gateways: To support seamless host mobility and redundancy, multiple distribution/leaf switches are configured with the same anycast IP address and MAC address on their IRB interfaces for a given VLAN. This allows a host to move between different switches without needing to update its default gateway configuration or ARP cache.

Distributed Routing: Routing occurs locally at the edge (distribution layer). Traffic destined for a different subnet is routed by the first switch it hits (the ingress leaf), rather than being backhauled to a central core router.

Symmetric vs. Asymmetric IRB: Junos OS 24.4 supports both models, but the ERB design typically utilizes symmetric routing for better scalability, where each leaf only needs to know the routes for its locally connected VNIs and uses a transit VNI for inter-subnet communication.

Option A is incorrect because while unique IPs can be used (Method 1 in some docs), the defining characteristic of an efficient ERB design is the use of shared Anycast IPs for the gateway. Option C describes a Centrally-Routed Bridging (CRB) design, not ERB.

VSTP (VLAN Spanning Tree Protocol) is designed for interoperability with environments running Cisco’s Per-VLAN Spanning Tree Plus (PVST+).

Per-VLAN Instances (Option E): The core function of VSTP is to maintain a separate spanning tree instance for every VLAN configured on the switch. This allows for different root bridges and different topologies per VLAN, enabling traffic load-balancing across various physical links.

BPDU Generation (Option A): Because each VLAN has its own instance, VSTP must send separate BPDUs for each VLAN. These BPDUs are tagged with the respective VLAN ID to ensure the receiving switch can process them for the correct instance.

Instance Limits (Option D): On many Juniper platforms, VSTP is limited to supporting a maximum of 253 unique spanning tree topologies (instances). If the number of VLANs exceeds this limit, additional VLANs will not have spanning tree protection unless migrated to a different protocol like MSTP.

Incorrect Statements: Option B is incorrect because VSTP is compatible with RSTP; it actually uses RSTP algorithms (Rapid-VSTP) by default in modern Junos versions to provide fast convergence. Option C is incorrect because STP or RSTP is usually the default spanning tree protocol on EX Series switches, not VSTP.

Junos OS 24.4 on EX Series switches provides robust support for LLDP (Link Layer Discovery Protocol) and its extension, LLDP-MED (Media Endpoint Discovery).

LLDP-MED Power Negotiation: This feature allows a switch (Power Sourcing Equipment or PSE) and a connected device (Powered Device or PD), such as an IP phone or access point, to negotiate power requirements beyond the standard IEEE 802.3af/at classes. The switch can dynamically allocate the exact amount of power the device needs (in 0.1W increments), which optimizes the power budget of the switch.

LLDP Scope: LLDP is a Link Layer protocol (Layer 2), but it is not restricted to Layer 2 interfaces; it can also operate on Layer 3 interfaces to advertise system identity and capabilities. This makes Option A incorrect.

Link-Local Protocol: LLDP frames use a specific multicast MAC address (01:80:c2:00:00:0e) that is not flooded or forwarded by switches. They are strictly link-local between two directly connected neighbors. This makes Option B incorrect.

Endpoint Focus: LLDP-MED is specifically designed for Media Endpoint Devices (like VoIP phones), providing TLVs for network policy (VLAN/QoS), location identification, and inventory management. Standard LLDP is used for discovering network connectivity devices. This makes Option D incorrect.

The exhibit illustrates a standard end-to-end Class of Service (CoS) path consisting of an edge router (R1) and core/intermediate routers (R2 and R3).

Edge Classification (Option B): The scenario specifies that video traffic enters the network without any class-of-service markings. Because there are no DSCP or 802.1p bits to inspect, the ingress router (R1) cannot use simple Behavior Aggregate (BA) classification. Instead, it must use Multifield (MF) classification. MF classification allows the router to look deeper into the packet (Source/Destination IP, Protocol, Port numbers) to identify the video stream and assign it to a specific forwarding class. * Core Classification (Option D): Once R1 has identified the traffic, it will typically apply a rewrite rule on its egress interface to mark the packets with a specific CoS value (like a DSCP code). Consequently, the downstream routers (R2 and R3) do not need to perform expensive deep-packet inspection again. They can use Behavior Aggregate (BA) classification, which simply looks at the markings in the packet header to determine the appropriate forwarding priority.

Option A and C: These are incorrect because BA classification is impossible on unmarked ingress traffic, and performing MF classification in the core is inefficient and not a recommended Juniper design practice for high-speed transit.

In BGP path selection, the Local Preference attribute is one of the most common ways to influence outbound traffic from an Autonomous System (AS). It is a well-known discretionary attribute that is propagated throughout the AS to tell internal routers which path is preferred for a specific destination.

Priority Rule: In the BGP selection algorithm, a higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.

Influencing Outbound Traffic (Option A): To ensure that Provider A is always preferred, you would apply an import policy on R1 (the router connected to Provider A) to set the local preference of all received routes to a value higher than the default (e.g., 200). Since 200 > 100, R3 and R4 will prefer the path via R1.

Alternative Method (Option C): Conversely, you can achieve the same result by applying an import policy on R2 (the router connected to Provider B) to set the local preference to a value lower than the default (e.g., 50). Since the routes from R1 remain at the default of 100, and 100 > 50, the path via R1 (Provider A) is preferred.

Why B and D are incorrect: Setting a higher local preference on R2 (Option B) would make Provider B the preferred exit point. Setting a lower local preference on R1 (Option D) would make Provider A the least preferred exit point.

EVPN Route Type 5 (IP Prefix Route) is used to advertise IP prefixes (subnets) between broadcast domains or between VRFs in an EVPN fabric.

IP-VRF-to-IP-VRF (Statement C): In an EVPN-VXLAN architecture, Type 5 routes are primarily used for Layer 3 connectivity. They allow different IP-VRFs on different VTEPs to exchange prefix information directly. This model is widely referred to as IP-VRF-to-IP-VRF routing because it enables inter-subnet routing at the leaf layer without requiring Layer 2 MAC learning for those specific prefixes.

Overlay Next Hop (Statement B): For a PE router to reach a prefix advertised via a Type 5 route, it must resolve the overlay next hop. This next hop is typically the loopback IP address of the originating VTEP, which the receiving router uses to build the VXLAN tunnel.

Why others are incorrect: Statement A is incorrect because Type 7 routes are used for IGMP/MLD join synchronization. Statement D is incorrect because Type 5 routes advertise IP prefixes, not MAC addresses; MAC extended communities are associated with Type 2 routes.

VSTP (VLAN Spanning Tree Protocol) is Juniper ' s implementation that provides a separate spanning tree instance for each VLAN, ensuring compatibility with Cisco ' s PVST+. However, it has significant scaling limitations:

Instance Limits: On many Juniper EX and QFX series switches, VSTP is restricted to a maximum of 253 or 510 VLAN instances depending on the software version (ELS vs. non-ELS). In your scenario, having 450 VLANs exceeds the standard 253-instance limit found on many platforms.

The Solution (Option B): When the number of VLANs exceeds the VSTP capacity, the recommended best practice is to enable RSTP (Rapid Spanning Tree Protocol). Unlike VSTP, RSTP runs a single spanning tree instance for the entire switch, regardless of how many VLANs are configured. This ensures that all 450 VLANs are protected from loops without hitting the hardware ' s instance-count limit.

Other Options: Option A (force-version) only affects the BPDU format for compatibility but doesn ' t solve the instance limit. Option C and Option D are parameter tuning actions that do not address the architectural limitation of the number of running instances.

In Junos OS Class of Service (CoS), schedulers are the fundamental components used to manage the resources of individual egress queues. They determine how the switch handles traffic for a specific forwarding class as it waits to exit an interface.

Buffer Size (Option A): A scheduler defines the buffer size (memory allocation) for its assigned queue. This buffer holds packets during periods of congestion to prevent immediate packet loss. The size can be configured as a specific percentage of the total interface buffer, a temporal value in microseconds, or using the " remainder " of available space.

Queue Priority (Option D): A scheduler identifies the priority of the queue. Junos supports multiple priority levels, such as low , medium-low , medium-high , and high . This setting dictates the order in which the transmission hardware services the queues; for example, high-priority queues are typically emptied before low-priority ones.

Why other options are incorrect: Interface rate-limiting (Option B) is typically managed at the interface level or through policers , not the scheduler itself, which focuses on queue-specific transmission rates. DiffServ code translation (Option C) is the responsibility of rewrite rules , which modify the packet header markings as they leave the switch.

When a peer incorrectly floods your router with an excessive number of routes, it can exhaust system resources and crash the routing engine.

Prefix-Limit (Option B): The prefix-limit (or accepted-prefix-limit) parameter is the primary defense against such " route leaks " .

You can set a maximum threshold for the number of prefixes allowed from a specific BGP neighbor or group.

When the limit is reached, Junos can be configured to either just log a warning or tear down the BGP session entirely (using the teardown keyword) to protect the router.

This prevents the " hundreds of thousand routes " from ever being fully processed or installed into the main routing table.

Damping (Option A): Damping is used to suppress unstable, " flapping " routes, but it does not limit the total volume of stable routes received.

Junos OS 24.4 provides several server-failover options for 802.1X authentication to maintain network availability when the RADIUS server is unreachable.

Fallback Behavior (Option D): The use-cache fallback action allows the switch to consult its local cache of previously authenticated MAC addresses.

If a device was already authorized and its information is in the cache, the switch will continue to permit access based on those cached credentials.

However, if a new device (not in the cache) attempts to connect while the server is down, the switch cannot verify its credentials and will deny the access attempt. This matches the specific requirement to permit authorized devices while denying new ones.

Other Fallback Options:

permit (Option C): This would allow all devices (even new ones) to access the network, typically in a restricted " guest " or " bypass " VLAN.

deny (Option A): This would drop all traffic from all devices on the port if the server is unreachable.

vlan-name (Option B): This moves authenticated or unauthenticated users into a specific fallback VLAN.

Private VLANs (PVLANs) allow for granular port isolation within a single broadcast domain. When extending a PVLAN across multiple switches (S1 to S2), the secondary VLANs (Community or Isolated) must be preserved across the trunk links.

802.1Q Tagging (Option B): For traffic from a Community VLAN (RND) to reach members on a different switch, the Community VLAN must have its own 802.1Q VLAN tag (VLAN ID) associated with it. When a frame from a community port on S1 traverses the trunk to S2, it is tagged with this specific secondary VLAN ID. S2 receives the tagged frame, identifies it as belonging to the RND community, and forwards it to the appropriate community or promiscuous ports.

Why it fails without a tag: If the RND community is only defined locally on S1 without a global VLAN ID, the trunk port will not know how to distinguish that traffic from the Primary VLAN or other communities.

Incorrect Options: Option A is incorrect because the community VLAN must have a different tag than the parent (Primary) VLAN to maintain the internal PVLAN logic. Option C is incorrect because stripping tags would lead to the traffic being merged into the native VLAN or dropped. Option D is incorrect because RND is a community VLAN; changing it to an isolated VLAN would change its behavior (preventing communication between members of that same group).

The exhibit shows the Class of Service (CoS) transmit queue information for interface ge-0/0/11. To determine the correct behavior, we must analyze the bandwidth allocations and the queue limit settings:

Bandwidth Calculation (Option A): In Junos OS, when multiple queues are assigned specific percentages of bandwidth, the " remainder " (represented by ' r ' ) is the total interface bandwidth minus the sum of the explicitly configured percentages.

Bandwidth assigned to Queue 1 (EF) = 10%.

Bandwidth assigned to Queue 2 (AF) = 10%.

Bandwidth assigned to Queue 3 (NC) = 4%.

Total explicitly assigned = $10\% + 10\% + 4\% = 24\%$.

Remainder for Queue 0 (Best Effort) = $100\% - 24\% = 76\%$.

" Limit: exact " Behavior (Option B): The exhibit shows that Queue 2 (assured-forwarding) has a Limit set to exact.

By default, a queue in Junos can consume more than its allocated bandwidth if other queues are idle.

However, when the exact keyword is applied to the transmit-rate (transmission rate), the queue is strictly rate-limited to its configured percentage.

This means that traffic in Queue 2 will be capped at 10% of the interface bandwidth regardless of whether the network is congested or not. If the traffic exceeds 10%, the excess will be dropped or buffered to match the exact rate.

Option C is incorrect because 100% of the bandwidth is not reserved for a single queue; it is distributed across four queues.

Option D is less accurate than B because it implies the drop behavior only occurs during congestion. The exact parameter enforces the limit even when the rest of the interface is completely idle.

The show ospf interface output provides critical information about the local OSPF state.

Loopback Behavior (Option A): The output shows lo0.0 is in the DR (Designated Router) state with Nbrs 0. In Junos OS, OSPF adjacencies are not formed over loopback interfaces; they are treated as stub networks.

Neighbor State (Option D): Every interface listed (ge-0/0/1.0, ge-0/0/2.0, and lo0.0) shows Nbrs 0. This indicates that the router is not seeing any OSPF neighbors. Since the physical interfaces are in the DR state (meaning the router has elected itself as the DR because no other routers responded), it confirms the router is not receiving OSPF Hello messages from any potential neighbors on those segments.

Router ID: The DR ID 192.168.1.17 is the local router ' s own ID, not a neighbor it is trying to reach.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize the LLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery) protocol.

VoIP Specifics: While standard LLDP (C) is for general device discovery, LLDP-MED is an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification: LLDP-MED supports Location Identification TLVs (Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation: On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.