JN0-650 Sample Questions Answers

This scenario describes the standard transition of Class of Service (CoS) metadata from the network edge to the network core.

MF vs. BA Classification: Edge devices use Multifield (MF) classifiers because incoming traffic often lacks markings. MF classification assigns traffic to an internal forwarding class based on multiple fields (IPs, ports, etc.). Core devices use Behavior Aggregate (BA) classifiers because they are faster; they only look at the CoS bits (like DSCP) in the header to determine the forwarding class.

The Problem: Internal forwarding class assignments made by an MF classifier on the edge device do not automatically travel with the packet. If the packet leaves the edge device with its original (potentially zeroed) DSCP bits, the core device ' s BA classifier will not be able to identify the priority.

The Solution (Option A): You must implement rewrite rules on the egress interfaces of the edge devices. A rewrite rule takes the internal forwarding class and loss priority assigned by the MF classifier and " writes " the corresponding DSCP value into the packet header as it exits toward the core. This ensures that the core device sees the correct DSCP marking and can apply the appropriate BA classification.

Incorrect Options: Rewrite rules are strictly an egress function to modify the packet for the next hop. Applying them on ingress (Option B) or core ingress (Option C) does not solve the problem of ensuring the packet header reflects the classification logic used during the internal switching process of the edge device.

Junos OS 24.4 handles multicast traffic using two distinct models based on whether the source is known in advance.

Knowledge and Sources (Option A): PIM-ASM (Any Source Multicast) is designed for " many-to-many " communication where receivers join a group ($*,G$) and rely on a Rendezvous Point (RP) to discover active sources. In contrast, PIM-SSM (Source-Specific Multicast) is for " one-to-many " scenarios where receivers must already know the exact source IP ($S,G$) before joining.

Protocol and RP Logic (Option D): PIM-SSM bypasses the RP entirely. It relies on IGMPv3 messages from the host, which explicitly include both the source address and the group address. This allows the last-hop router to build a Shortest Path Tree (SPT) directly toward the source immediately.

Register Process (Option B): While PIM-ASM does use registers, it is the First-Hop Router (Designated Router on the source segment) that sends the register to the RP, not the receiver ' s DR.

RP Role (Option C): This is exactly backwards; PIM-ASM requires an RP for source discovery, whereas PIM-SSM does not use one at all.

VSTP (VLAN Spanning Tree Protocol) is designed for interoperability with environments running Cisco’s Per-VLAN Spanning Tree Plus (PVST+).

Per-VLAN Instances (Option E): The core function of VSTP is to maintain a separate spanning tree instance for every VLAN configured on the switch. This allows for different root bridges and different topologies per VLAN, enabling traffic load-balancing across various physical links.

BPDU Generation (Option A): Because each VLAN has its own instance, VSTP must send separate BPDUs for each VLAN. These BPDUs are tagged with the respective VLAN ID to ensure the receiving switch can process them for the correct instance.

Instance Limits (Option D): On many Juniper platforms, VSTP is limited to supporting a maximum of 253 unique spanning tree topologies (instances). If the number of VLANs exceeds this limit, additional VLANs will not have spanning tree protection unless migrated to a different protocol like MSTP.

Incorrect Statements: Option B is incorrect because VSTP is compatible with RSTP; it actually uses RSTP algorithms (Rapid-VSTP) by default in modern Junos versions to provide fast convergence. Option C is incorrect because STP or RSTP is usually the default spanning tree protocol on EX Series switches, not VSTP.

In Junos OS, the supplicant-mode configuration under protocols dot1x determines how the switch handles multiple MAC addresses on a single physical port. According to the exhibit, the current mode is set to Single, and the Number of connected supplicants is 2. This indicates that the port is currently allowing multiple devices, which contradicts the goal of limiting access to only one device at a time.

Here is the breakdown of why Option C is the correct solution based on Juniper’s standard behavior:

Supplicant Mode: Single (Current State): In this mode, the first device to authenticate opens the port for all subsequent devices. As long as the first device remains authenticated, other devices can send traffic through the port without individual authentication. This is why the exhibit shows 2 connected supplicants despite the mode being " Single. "

Supplicant Mode: Single-Secure (The Solution): This mode strictly limits the port to only one MAC address. Once a device successfully authenticates via 802.1X, the switch drops any traffic coming from any other MAC address on that port. If the authenticated device logs off or the session times out, the port becomes available for a new device, but never more than one simultaneously. * Supplicant Mode: Multiple (Option B): This mode allows multiple supplicants to authenticate individually. Each MAC address must go through its own authentication process. This would allow more than one device, which is the opposite of the user ' s requirement.

MAC RADIUS Restrict (Option A): This feature is used to force MAC-based authentication and does not inherently limit the number of devices to one in the same way that changing the supplicant mode does.

Maximum EAPOL requests (Option D): This parameter defines how many times the switch will send an EAP-Request/Identity frame to a supplicant before giving up. Changing this to 1 does not restrict the number of devices allowed on the port; it only changes the retry logic for a single authentication attempt.

Configuration Example for Junos OS 24.4: To implement this change, you would use the following command: set protocols dot1x edit interface ge-0/0/10.0 supplicant-mode single-secure

Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same broadcast domain. When a PVLAN spans multiple switches, a special type of trunk configuration is required to maintain the isolation and community logic across the inter-switch links.

Isolated VLAN Trunking (Option D): To extend an isolated VLAN across multiple switches, you must configure the trunk port on each switch to allow the isolated VLAN ID. In Junos OS, this is specifically achieved by configuring the interface as a trunk and associating it with the primary VLAN and the specific isolated VLAN. The correct syntax for enabling this inter-switch communication is to configure trunk ports that recognize the isolated VLAN tag (e.g., set interfaces < interface > unit 0 family ethernet-switching vlan members [ primary-vlan isolated-vlan ]).

Forwarding Rules: Traffic from an isolated port on Switch A must reach a promiscuous port (often on Switch B) to exit the PVLAN. The inter-switch trunk carries this traffic using the secondary (isolated) VLAN ID, ensuring that it remains isolated from other host ports on the remote switch.

Option A (inter-switch-link): In standard Junos switching, the inter-switch-link statement is used in Virtual Chassis or specific fabric designs, but for standard PVLAN extension, standard 802.1Q trunking with secondary VLAN IDs is the mechanism used.

Options B and C: These describe specific port roles (isolated vs. community) rather than the method used to enable trunking between switches.

The exhibit shows a custom Behavior Aggregate (BA) classifier named my-classifier for the Differentiated Services Code Point (DSCP) protocol.

Importing Defaults (Statement C): The configuration line import default; is crucial. In Junos OS, when you create a custom classifier, you can use this statement to import the default mapping table for all code points that you have not explicitly defined in the current block. This ensures that only the specific traffic types you care about are customized while the rest follows industry-standard defaults.

Logical Interface Association (Statement A): In the Junos class-of-service hierarchy, classifiers are typically applied to logical interfaces (e.g., ge-0/0/0.0). While they can sometimes be applied at a higher level, the standard practice for enterprise routing and switching is to associate them with the logical unit to provide granular control over subinterfaces or VLAN-tagged traffic.

Why others are incorrect: Statement B is less accurate because the primary binding point in Junos is the unit (logical interface). Statement D is incorrect because the specific classifications defined in the custom block override the defaults; they are not overwritten by them.

The exhibit illustrates an Autonomous System (AS 65512) receiving the same prefix ($203.0.113.0/24$) from two different neighbors, ISP A and ISP B. To influence outbound traffic from AS 65512 so that ISP A is preferred, you must manipulate the BGP Local Preference attribute.BGP Path Selection and Local Preference: Local preference is the first attribute evaluated by BGP after checking if the next hop is reachable. A higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.Applying the Preference (Option B): By applying an import policy on router R1 to set a local preference higher than 100 (e.g., 200) for routes from ISP A, R1, R2, and R3 will all prefer the path through R1 to reach ISP A.Applying the Preference (Option C): Alternatively, you can achieve the same result by applying an import policy on R2 to set a local preference lower than 100 (e.g., 50) for routes from ISP B. Since the routes from R1 remain at the default of 100, the path through ISP A (100) will be preferred over ISP B (50).Why A and D are incorrect: Setting a lower preference for ISP A (Option A) or a higher preference for ISP B (Option D) would result in ISP B being preferred for outbound traffic, which is the opposite of the requirement.

In a Juniper Q-in-Q (Layer 2 tunneling) environment, VLAN rewrites (specifically the swap operation) provide the most granular control over how customer traffic (C-VLANs) is mapped to service provider traffic (S-VLANs).

VLAN Rewrites (The Swap Operation): This method involves replacing the incoming customer VLAN tag with a service provider tag as the frame enters the tunnel. This is technically a " swap " because the original C-VLAN tag is removed and the S-VLAN tag is written in its place. At the egress of the tunnel, the S-VLAN tag is swapped back for the original C-VLAN tag. This is often used when different customers use the same C-VLAN IDs and the provider needs to keep them unique within their core.

Many-to-Many: This is a mapping style where multiple customer VLANs are mapped to multiple service provider VLANs, but it typically relies on the " push " (stacking) operation rather than a literal " swap " of the tag itself.

All-in-One: This is the simplest form of Q-in-Q where all traffic entering an interface is " pushed " into a single S-VLAN tag, regardless of any existing C-VLAN tags. No swapping occurs; the original tags are simply buried under the new provider tag.

L2PT (Layer 2 Protocol Tunneling): This is a feature used to tunnel Layer 2 control protocols (like STP, CDP, or LLDP) across a provider network by encapsulating them or changing their destination MAC addresses. It does not involve the swapping of VLAN tags.

The exhibit illustrates an EVPN-VXLAN fabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using an Ethernet Segment Identifier (ESI) in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A): When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C): To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes a Designated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states that Leaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrect because in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrect because Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

To secure a Layer 2 network running Multiple VLAN Registration Protocol (MVRP) against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.

Forbidden Registration Mode (Option D): This mode is specifically designed to prevent an interface from participating in the MVRP exchange.

When a port is set to forbidden, it will neither register nor declare VLANs (except those statically configured on the interface).

If a rogue device sends MVRP PDUs to this interface, the distribution switch will ignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.

Registration Hierarchy: In Junos OS 24.4, this is configured at the [edit protocols mvrp interface < interface-name > registration forbidden] level.

Other Modes: normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, " headless " devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.

In PIM Sparse Mode (PIM-SM), the Rendezvous Point (RP) is the cornerstone of the multicast distribution model.

The Meeting Point (Option A): The RP serves as a central clearinghouse where multicast sources and receivers meet.

When a source starts transmitting, the first-hop router encapsulates the data and sends it to the RP via a PIM Register message.

When a receiver wants to join a group, its last-hop router sends a (*,G) PIM Join request toward the RP.

The RP then manages the distribution from the source to the receivers until a Shortest Path Tree (SPT) can be established directly between them.

Incorrect Statements: Option B is incorrect because PIM Dense Mode does not use an RP; it uses a " flood and prune " mechanism. Option C is incorrect because the RP only forwards traffic to interfaces that have explicitly requested it via Join messages, which is what makes it " sparse " . Option D is incorrect because SSM (Source-Specific Multicast) specifically avoids using an RP by having receivers join a known source directly.

In BGP path selection, the Local Preference attribute is one of the most common ways to influence outbound traffic from an Autonomous System (AS). It is a well-known discretionary attribute that is propagated throughout the AS to tell internal routers which path is preferred for a specific destination.

Priority Rule: In the BGP selection algorithm, a higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.

Influencing Outbound Traffic (Option A): To ensure that Provider A is always preferred, you would apply an import policy on R1 (the router connected to Provider A) to set the local preference of all received routes to a value higher than the default (e.g., 200). Since 200 > 100, R3 and R4 will prefer the path via R1.

Alternative Method (Option C): Conversely, you can achieve the same result by applying an import policy on R2 (the router connected to Provider B) to set the local preference to a value lower than the default (e.g., 50). Since the routes from R1 remain at the default of 100, and 100 > 50, the path via R1 (Provider A) is preferred.

Why B and D are incorrect: Setting a higher local preference on R2 (Option B) would make Provider B the preferred exit point. Setting a lower local preference on R1 (Option D) would make Provider A the least preferred exit point.

This scenario describes a specific use case where a switch port is shared by multiple devices (e.g., via a downstream unmanaged switch), and you want to simplify the authentication process.

Single Supplicant Mode (Option A): In this mode, the switch requires only the first device that connects to the port to successfully authenticate via 802.1X. Once that first device is authorized, the switch " opens " the port for all traffic. This means all subsequent devices attached to that same downstream switch are permitted to access the network without undergoing their own authentication.

Other Modes:

Single-secure supplicant (C): Only allows the first authenticated device; all others are blocked.

Multiple supplicant (D): Requires every device to authenticate individually.

MAC RADIUS (B): This is an authentication method, not a port-control mode.

Junos OS 24.4 on EX Series switches provides robust support for LLDP (Link Layer Discovery Protocol) and its extension, LLDP-MED (Media Endpoint Discovery).

LLDP-MED Power Negotiation: This feature allows a switch (Power Sourcing Equipment or PSE) and a connected device (Powered Device or PD), such as an IP phone or access point, to negotiate power requirements beyond the standard IEEE 802.3af/at classes. The switch can dynamically allocate the exact amount of power the device needs (in 0.1W increments), which optimizes the power budget of the switch.

LLDP Scope: LLDP is a Link Layer protocol (Layer 2), but it is not restricted to Layer 2 interfaces; it can also operate on Layer 3 interfaces to advertise system identity and capabilities. This makes Option A incorrect.

Link-Local Protocol: LLDP frames use a specific multicast MAC address (01:80:c2:00:00:0e) that is not flooded or forwarded by switches. They are strictly link-local between two directly connected neighbors. This makes Option B incorrect.

Endpoint Focus: LLDP-MED is specifically designed for Media Endpoint Devices (like VoIP phones), providing TLVs for network policy (VLAN/QoS), location identification, and inventory management. Standard LLDP is used for discovering network connectivity devices. This makes Option D incorrect.

The exhibit shows a multicast network running PIM Sparse Mode where R2 is configured as a local Rendezvous Point (RP). However, the non-RP routers (like R5) show no learned RP in their show pim rps output. To resolve this using standard protocols for dynamic RP discovery, you must implement a mechanism that automates the distribution of RP information across the PIM domain.

Bootstrap Router (BSR) (Option B): BSR is the industry-standard (RFC 5059) mechanism for dynamically electing an RP and distributing that information throughout a PIM-SM domain.

It uses two roles: Candidate-RPs (C-RPs), which announce their desire to be an RP, and Candidate-BSRs (C-BSRs), which collect these announcements and flood them to all other routers in the network via PIM bootstrap messages.

BSR is a " standard protocol " as it is part of the PIMv2 specification. Once configured on R2 (as C-RP) and potentially R1 or R2 (as C-BSR), all other routers will dynamically learn that R2 is the RP for the specified group ranges.

Auto-RP (Option D): While this also provides dynamic RP discovery, it is a proprietary Cisco protocol. Although Junos supports it for interoperability, the question specifically asks for " standard protocols only, " making BSR the preferred choice.

MSDP (Option A): Multicast Source Discovery Protocol (MSDP) is used to share information about active sources between different PIM domains or for Anycast-RP. It does not handle the initial discovery of an RP within a single domain for standard PIM-SM operations.

Anycast RP (Option C): This is a technique used for RP redundancy and load balancing. While it can use BSR or MSDP for synchronization, it is a design architecture rather than a standalone " standard protocol " for the basic dynamic discovery of an RP in the manner requested here.

Configuration Example for BSR in Junos OS 24.4: To enable this, you would add the following to the RP (R2):

set protocols pim rp bootstrap-discovery

set protocols pim rp candidate-rp 10.222.1.2 group-ranges 224.0.0.0/4

set protocols pim rp candidate-bsr 10.222.1.2

Junos OS 24.4 provides several server-failover options for 802.1X authentication to maintain network availability when the RADIUS server is unreachable.

Fallback Behavior (Option D): The use-cache fallback action allows the switch to consult its local cache of previously authenticated MAC addresses.

If a device was already authorized and its information is in the cache, the switch will continue to permit access based on those cached credentials.

However, if a new device (not in the cache) attempts to connect while the server is down, the switch cannot verify its credentials and will deny the access attempt. This matches the specific requirement to permit authorized devices while denying new ones.

Other Fallback Options:

permit (Option C): This would allow all devices (even new ones) to access the network, typically in a restricted " guest " or " bypass " VLAN.

deny (Option A): This would drop all traffic from all devices on the port if the server is unreachable.

vlan-name (Option B): This moves authenticated or unauthenticated users into a specific fallback VLAN.