JN0-352 Exam Dumps - Juniper JNCIS-ENT Questions and Answers

Nonstop active routing is specifically engineered to be completely transparent to the rest of the network: rather than relying on neighboring routers to preserve state during a Routing Engine switchover the way graceful restart does, NSR keeps a fully synchronized instance of the routing protocol process (rpd) running continuously on the backup Routing Engine, mirroring protocol adjacencies, the RIB, and session state in real time. Because neighbors never observe a session reset or restart signal during an NSR-driven switchover, there is no dependency on those neighbors supporting or enabling graceful restart extensions at all — this is the core architectural advantage that distinguishes NSR from GR and is precisely why the first and third answer choices are incorrect distractors. What NSR does require locally is Graceful Routing Engine Switchover (GRES) enabled first, since NSR is built as an extension on top of GRES and depends on it to synchronize kernel and interface state between the two Routing Engines before protocol-level synchronization can occur. Additionally, Juniper's official guidance mandates that both Routing Engines run the identical Junos OS software version; mismatched versions between the primary and backup Routing Engine can introduce incompatible internal data structures or feature behavior during state replication, jeopardizing the integrity of a switchover and is explicitly called out as a hard operational requirement rather than a mere best practice. Reference topics: Junos Enterprise Routing – High Availability, Nonstop Active Routing Requirements and GRES Dependency.

A GRE-encapsulated packet consists of the original passenger packet wrapped inside a GRE header and a new outer IP delivery header, and the combined size of these two additions is what constitutes GRE's per-packet overhead. The base GRE header, as defined in RFC 2784 and used in its minimal, non-keyed, non-checksummed form (the default and most common deployment), is exactly 4 bytes in length, containing the flags/version field and the protocol type field identifying the encapsulated payload's ether type. Layered around that GRE header is a completely new outer IPv4 header, which itself consumes a standard 20 bytes, containing the tunnel source and destination addresses used for delivery across the underlying network. Adding these two components together — 4 bytes for the GRE header plus 20 bytes for the new outer IPv4 header — yields a total of exactly 24 bytes of overhead imposed on every encapsulated packet, which is precisely why Junos automatically sets the default protocol MTU on gr- tunnel interfaces to 1476 bytes (1500 minus 24) to prevent oversized, post-encapsulation packets from requiring fragmentation on a standard 1500-byte Ethernet path. The 20-byte figure alone describes only the new IP header in isolation and omits the GRE header itself, while 12 and 32 bytes do not correspond to any standard, non-keyed GRE encapsulation configuration and are included purely as plausible-looking distractors. Reference topics: Junos Enterprise Routing – Tunneling, GRE Header Overhead and MTU Planning.

GRE is fundamentally a stateless encapsulation protocol: the encapsulating router simply wraps the passenger packet in a GRE header and an outer delivery IP header and forwards it based on ordinary IP routing table lookups toward the configured tunnel destination address. For that forwarding to succeed, the underlying (global or routing-instance) routing table on each endpoint must contain a valid, reachable route to the far-end tunnel address; without such a route, the tunnel interface will not come up or will be unable to deliver traffic, since GRE relies entirely on the existing IP infrastructure rather than any tunnel-specific signaling to establish reachability. Because GRE has no built-in state machine or session negotiation, it does not natively track whether the remote endpoint is alive — that requires an optional add-on such as GRE keepalives or BFD, neither of which is enabled by default; an operator must explicitly configure them if failure detection is required. GRE is also protocol-agnostic rather than IPv4-only: it can encapsulate IPv4, IPv6, MPLS, and other network-layer protocols as the passenger, which is one of its defining advantages over IP-in-IP tunneling. Finally, because GRE keeps no per-session state about the peer, it cannot detect or report tunnel failures on its own, reinforcing why route reachability is the one true prerequisite for tunnel operation. Reference topics: Junos Enterprise Routing – Tunneling, Understanding Generic Routing Encapsulation.

RSTP, as defined in IEEE 802.1w, introduces explicit, well-defined port roles that go beyond legacy 802.1D STP's simpler root/designated/blocking model, and the alternate port role is one of RSTP's key refinements. An alternate port is a port that receives BPDUs from a bridge other than the one through which the local switch's actual root port reaches the root bridge — in other words, it represents a second, redundant path toward the root bridge learned from a different upstream bridge than the one currently providing the best (root port) path. Because the existing root port already provides the lowest-cost, actively used path to the root, the alternate port is deliberately held in the discarding (non-forwarding) state during normal, stable operation, functioning purely as a pre-computed, ready-to-use backup; critically, RSTP's major performance advantage over legacy STP is that if the current root port fails, the switch can transition its alternate port directly and almost instantly into the forwarding root port role without needing to pass through the lengthy listening and learning timer-based states that classic STP required, since the alternate port's suitability as a backup was already continuously verified through ongoing BPDU reception. It is not simply 'not receiving BPDUs' (an alternate port receives BPDUs continuously, just inferior ones relative to the current root port), it is not itself the least-cost path (that describes the root port), and it does not forward based on designated-port overload, which is not a concept that exists in RSTP's port-role logic at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Port Roles: Alternate and Backup Ports.

Junos firewall filters evaluate terms sequentially from top to bottom, and a term is only terminal for a packet if its then clause contains an explicit terminating action such as accept, discard, reject, or next term without a match. The count and log actions used in track-icmp are non-terminating; they update statistics and generate a log entry but do not stop evaluation, so a matching ICMP packet falls through to the next term after being counted. The second term, allow-tcp-established, matches only TCP packets carrying the ACK or RST flags as defined by the tcp-established keyword; an ICMP echo request does not satisfy protocol tcp, so this term is skipped entirely and does not accept the packet. Evaluation therefore reaches the implicit catch-all term block-rest, which has no from conditions and matches every remaining packet, incrementing blocked-counter and discarding it. The net effect for the described ICMP ping is that icmp-counter is incremented by the first term, the packet is neither accepted nor rejected by the second term, and blocked-counter is incremented immediately before the packet is silently discarded by the final term. This layered-term behavior, where counting is independent of the accept/discard decision, is a frequently tested nuance of Junos firewall filter processing logic. Reference topics: Junos Enterprise Switching – Layer 2 Security and Firewall Filters, Filter Term Evaluation Order.

In the output of show ospf database, Junos marks every self-originated link-state advertisement with an asterisk immediately preceding the LSA's link-state ID. A self-originated LSA is one that was created and flooded by the router on which the command is being executed, as opposed to an LSA that was received from and originated by a neighboring router elsewhere in the area. In this exhibit, the asterisked Router LSA has an ID of 10.101.100.0 and an Advertising Router value of the same 10.101.100.0, confirming that this particular Router LSA describes the local device's own links, area membership, and interface costs, and that the local router itself flooded this LSA into the area's link-state database. This distinction matters operationally because when troubleshooting OSPF topology or SPF calculation issues, engineers frequently need to isolate their own router's advertised state from the states advertised by every other router in the area; the asterisk provides an immediate, unambiguous visual cue for that separation without needing to cross-reference the router's own ID separately. It has no relationship to designated router or backup designated router status — DR/BDR roles are indicated elsewhere in interface-level output, not through the asterisk convention in the LSA database dump, and a router that is neither DR nor BDR still self-originates and flags its own Router LSA the same way. Reference topics: Junos Enterprise Routing – OSPF, Interpreting the OSPF Link-State Database.

Root bridge election is based on comparing each switch's full Bridge Identifier, which combines the bridge priority value with the switch's MAC address, with priority always evaluated first and MAC address serving strictly as a tiebreaker when two or more switches present identical priority values. In this scenario, the network has been left entirely at the default spanning-tree configuration, meaning every switch is operating at the standard IEEE and Junos default bridge priority of 32768; since all three switches share the exact same priority value, the comparison necessarily falls through to the MAC address tiebreak, where the switch with the numerically lowest MAC address wins the election. Comparing the three addresses shown — 00:1a:2b:3c:4d:01, 00:1a:2b:3c:4d:02, and 00:1a:2b:3c:4d:03 — Switch A's address is the lowest, since only the final octet differs and 01 is less than both 02 and 03, making Switch A the elected root bridge. RSTP uses the identical Bridge ID comparison mechanism as legacy STP for root election, so there is no special 'median MAC address' rule that applies uniquely under RSTP, making that distractor factually invalid regardless of protocol version. The election process also does not require any manual bridge priority configuration to complete; the default priority value is entirely sufficient on its own to allow a deterministic election to occur, since default priorities are still numerically comparable Bridge IDs. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Default Priority and MAC Address Tiebreaking.

The virtual-router routing-instance type in Junos is a general-purpose instance type intended for creating isolated, independent routing and forwarding contexts within a single physical device for applications that have nothing to do with MPLS-based VPN services — common use cases include multi-tenant network segmentation, filter-based forwarding deployments, and simple traffic isolation between departments or customers on a shared switch or router, all of which are non-VPN-related applications by nature. Layer 2 and Layer 3 VPN services, by contrast, rely on a different, dedicated routing-instance type specifically named vrf, which integrates with MPLS/BGP-based VPN signaling, route distinguishers, route targets, and PE-CE routing exchange; virtual-router instances do not participate in that VPN signaling framework at all, which is why the statement associating virtual-router with VPN use is incorrect. Whenever an administrator creates any user-configured routing instance — regardless of its specific type — Junos automatically allocates and generates a brand-new, dedicated routing table for that instance, named according to the pattern instance-name.inet.0 (or the appropriate address-family suffix), which is entirely separate from and independent of the default master inet.0 table used by the global/default routing context. Because each new routing instance receives its own distinct table rather than sharing or defaulting into the master inet.0 table, the statement claiming instances automatically fall back to using inet.0 unless configured otherwise is factually incorrect; instances are isolated by design from the outset. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Routing Instance Types and Table Allocation.

Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to 22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction. The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching – Firewall Filters, Matching on Address, Protocol, and Port Conditions.

Switch A is already fixed as the root bridge in this topology (priority 0), so the outcome being engineered here is not about root bridge election at all, but about which of Switch C's two available paths toward that already-established root — the direct C-to-A link, or the indirect C-to-B-to-A path — RSTP selects as the lower-cost, primary path. RSTP's path-cost calculation for any non-root switch sums the port costs of every link along a candidate path to the root and always selects whichever candidate path has the lowest total accumulated cost as that switch's active root path, placing the corresponding local port into the forwarding root port role while any higher-cost alternative path is placed into a non-forwarding (alternate) role. To force Switch C to prefer routing through Switch B rather than connecting to Switch A directly, the administrator must make the direct C-to-A link's cost higher than the combined cost of the C-to-B link plus the B-to-A link added together, so that the indirect, two-hop path through Switch B mathematically totals to a lower cumulative cost than the single direct hop, causing RSTP's cost comparison to favor the indirect path as primary. Setting Switch B's priority (to either 1 or 0) is irrelevant here, since Switch B is not a root bridge candidate in this scenario and priority manipulation would only affect a root bridge election, not path cost preference between a fixed root and a downstream switch. Lowering the direct link's cost, the inverse of the correct answer, would instead reinforce the direct path rather than override it. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Path Cost and Root Port Selection.