Juniper Enterprise Routing and Switching, Specialist (JNCIS-ENT) JN0-352 Exam Dumps: Updated Questions & Answers (July 2026)

IEEE 802.3ad LACP defines two distinct negotiation modes, active and passive, and the standard's fundamental requirement for successful negotiation is that at least one end of the point-to-point link must be configured in active mode; an actively configured device initiates LACPDU transmission on its own, while a passively configured device waits and only responds once it receives an LACPDU from its peer. If both ends of the bundle were left in passive mode simultaneously, neither side would ever initiate the exchange, and no negotiation — and therefore no functioning aggregated bundle — would ever occur; at least one active participant is therefore mandatory, though having both sides active (active-active) is also fully valid and is in fact the most common production deployment. Junos does not enable LACP automatically on aggregated Ethernet interfaces; unlike some competing platforms, LACP must be explicitly configured under the aggregated-ether-options lacp hierarchy, and specifying no LACP configuration at all results in a 'static' LAG that relies purely on physical link-state rather than any protocol negotiation — there is no implicit default active mode. There is likewise no requirement to configure differing LACP system priority values between the two peer switches; system priority is used only to determine which side of the link controls port selection during negotiation and has no bearing on whether the bundle can form. Both sides being mandatorily active is a stricter requirement than the actual standard specifies. Reference topics: Junos Enterprise Switching – Link Aggregation, LACP Active and Passive Mode Negotiation.

IS-IS is a link-state protocol that, like OSPF, runs Dijkstra's Shortest Path First algorithm independently on each router against its own copy of the synchronized link-state database to compute the best path toward every reachable destination. Each link within the topology carries an administrator-assigned or default metric, and as the SPF algorithm walks the topology graph from the local router outward, it sums the metrics of every link traversed along a candidate path to produce that path's total accumulated cost. Among all possible paths to a given destination prefix, IS-IS always selects and installs the path (or, in the case of equal-cost multipath, the set of paths) with the numerically lowest total accumulated metric, exactly mirroring the 'lowest cost wins' principle shared by essentially all link-state IGPs. A higher accumulated metric value is by definition a less preferred, more costly path, making that option the direct inverse of correct IS-IS behavior. Level 2 proximity to the destination has no independent bearing on path selection beyond however it happens to be reflected in the accumulated metric itself — IS-IS does not apply a separate rule preferring paths merely for passing near a Level 2 router. Likewise, LSP recency (sequence number or freshness) governs which version of a given LSP is trusted and flooded during database synchronization, ensuring the topology database itself is accurate and loop-free, but it plays no role in the SPF cost comparison once the database is synchronized and consistent. Reference topics: Junos Enterprise Routing – IS-IS, SPF Calculation and Metric-Based Path Selection.

MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching – Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.

The metric that OSPF assigns to a destination is visible from two complementary vantage points in Junos. The show route protocol ospf command displays the main routing table filtered to OSPF-learned prefixes, and each entry shows the computed cost alongside the next hop, exactly as it was installed after SPF calculation. The show ospf route command (which accepts filters such as intra-area, inter-area, and extern) presents the OSPF-specific routing table, organized by route type, and explicitly lists the metric column for every intra-area, inter-area, and external route the local router has calculated. Together these two commands give both the RIB-level and the protocol-level view of route cost. By contrast, show ospf database extensive dumps the raw link-state advertisements, where metrics appear only as link-level values buried inside Router or Network LSAs rather than as a resolved route cost, so it is not the direct tool for viewing a route's metric. show ospf interface reports interface operational state, area, and DR/BDR information but does not present a cost or metric field at all in its standard output. Candidates should be comfortable distinguishing the RIB-oriented and protocol-table-oriented verification commands, since JNCIS-ENT scenarios frequently test whether a candidate reaches for the correct show command layer during troubleshooting. Reference topics: Junos Enterprise Routing – OSPF Operation and Verification, Monitoring OSPF.

RFC 4271 defines the BGP finite state machine as a strict, ordered progression of six states that a session must move through to successfully establish. A newly configured or reset session always begins in Idle, where BGP initializes resources and refuses connections until the ConnectRetry timer fires. From Idle, the router transitions to Connect and attempts to establish the underlying TCP transport session to the configured peer address on port 179. If that TCP attempt does not immediately succeed, the session falls back to the Active state, where the router continues retrying the TCP connection in the background; once the TCP handshake finally completes (from either Connect or Active), the session advances to OpenSent, during which the router transmits its own BGP OPEN message advertising its AS number, hold time, BGP identifier, and capabilities. Upon receiving and validating a compatible OPEN message from the peer, the session moves to OpenConfirm, where both sides exchange KEEPALIVE messages to confirm the parameters negotiated in the OPEN exchange are mutually acceptable. Only after this confirmation does the session reach Established, the final state in which UPDATE messages carrying actual routing information begin to flow between the peers. Any deviation from this Idle → Connect → Active → OpenSent → OpenConfirm → Established ordering, as presented in the other answer choices, does not reflect the standardized BGP state machine. Reference topics: Junos Enterprise Routing – BGP, The BGP Finite State Machine.

Each of the 24 end-device-facing interfaces in this scenario needs to carry traffic for exactly one VLAN, and the end devices themselves are ordinary hosts that neither expect nor generate 802.1Q-tagged frames. This is precisely the definition of an access port in Junos: family ethernet-switching interface-mode is set to access, and a single vlan members statement assigns the port to VLAN 70. Access mode ensures frames egressing toward the host are untagged and any frames received are implicitly treated as belonging to the configured VLAN, which is both simpler to manage and more efficient than trunking, since access ports do not carry the 802.1Q tag overhead nor process VLAN pruning logic relevant only to multi-VLAN links. Trunk mode, by contrast, is reserved for switch-to-switch or switch-to-router links that must simultaneously carry frames for multiple VLANs, such as the uplink toward the distribution switch that transports VLANs 30, 50, and 70 together — configuring the 24 host-facing ports as trunks (with or without a native VLAN) would be functionally incorrect and operationally wasteful, since end devices have no need to interpret VLAN tags. There is also no such behavior in Junos where VLAN-ID numeric value dictates default port behavior, making the 'no configuration needed' option a distractor with no basis in EX Series switching architecture. Reference topics: Junos Enterprise Switching – VLANs, Configuring Access and Trunk Port Modes.

BGP employs two distinct loop-prevention mechanisms depending on whether peers are external or internal to the same autonomous system. Between external peers (EBGP), loop prevention relies on the AS path attribute: every time a route crosses an AS boundary, the local AS number is prepended to the path, and a router rejects any incoming route whose AS path already contains its own AS number, since that would indicate the route has looped back around. Between internal peers (IBGP) within the same AS, however, the AS path attribute never changes, because IBGP does not add AS numbers as routes are readvertised internally — meaning AS path alone cannot detect an internal loop. Instead, IBGP enforces a strict split-horizon-style rule: a router that learns a route via IBGP must never readvertise that route to another IBGP peer. This rule guarantees that every IBGP speaker within the AS must be directly peered with every other IBGP speaker (a logical full mesh) in order for all routers to receive all routes, since no IBGP router will relay IBGP-learned routes onward on another router's behalf. This full-mesh requirement is precisely why techniques such as route reflection and confederations were later developed — they preserve the same loop-prevention guarantee while relaxing the physical full-mesh peering burden. VRRP and BFD serve entirely unrelated purposes (gateway redundancy and fast failure detection, respectively) and play no role in BGP loop prevention. Reference topics: Junos Enterprise Routing – BGP, IBGP Split-Horizon and the Full-Mesh Requirement.

Once the two candidate routes have equal route preference and equal local preference (both defaulting to 100 unless modified by policy), the Junos BGP algorithm proceeds to its third decision step, which compares the length of each candidate's AS path attribute and selects whichever path carries the shortest AS path, since a shorter path is interpreted as traversing fewer autonomous system hops to reach the origin. This step occurs well before the algorithm ever reaches the specific EBGP-over-IBGP preference rule, which is only evaluated later, after local preference, AS path length, origin type, and MED have all already been compared and found equal between the candidates; because an IBGP-learned copy of a route typically retains the identical AS path that was originally received from the external AS (IBGP does not prepend the local AS number the way crossing an AS boundary does), it is entirely possible, and often the deciding scenario, for AS path length to differ between competing paths well before the algorithm would ever need to fall back on the IBGP-versus-EBGP tiebreak. Selecting a route purely because it was 'learned through IBGP' is not a rule that exists anywhere in the algorithm and would in fact typically be the opposite of Junos's later EBGP-preference tiebreak. Neither next-hop IP address value nor router ID value is compared with a 'highest wins' rule at any point in the standard path selection sequence — where router ID is used at all, Junos prefers the lowest value, not the highest, making both of those distractors doubly incorrect. Reference topics: Junos Enterprise Routing – BGP, Path Selection Order: AS Path Length Precedes EBGP/IBGP Preference.

Because root bridge election is decided primarily by comparing bridge priority values — with the switch advertising the numerically lowest priority always winning, and MAC address serving only as a fallback tiebreaker when priorities are tied — the only deterministic, reliable way to guarantee that a specific switch is elected root regardless of any other switch's hardware characteristics is to explicitly configure that switch with a lower bridge priority than every other participating switch in the topology. Relying on MAC address alone, as the first distractor suggests, is fundamentally unreliable: MAC addresses are burned in at the factory, cannot be predicted or controlled by the administrator, and any future hardware replacement or newly introduced switch with a numerically lower MAC address could unexpectedly seize the root role since MAC comparison only comes into play at equal priority in the first place, meaning a 'highest MAC' strategy does not even align with how the tiebreak actually favors the lowest value. Port priority and port cost are entirely separate STP parameters that influence which port on a non-root switch is selected as its root port, or which port is selected as designated versus blocking on a given segment; neither parameter has any bearing whatsoever on which switch is elected root bridge for the whole topology, since that decision is made purely from the Bridge ID comparison, independent of any per-port settings. Explicitly and deliberately lowering Switch 1's configured bridge priority is the only correct, industry-standard method. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Guaranteeing Root Bridge Placement via Bridge Priority.

OSPF relies on two IANA-reserved multicast addresses to distribute its control-plane traffic across broadcast and NBMA network types, and Link State Update (LSU) packets, which carry the actual LSAs being flooded, are addressed to one or the other depending on the role of the sending router. The address 224.0.0.5, designated AllSPFRouters, is used when any OSPF router — including a router that is itself the Designated Router or Backup Designated Router — needs to flood an LSU to every OSPF-speaking router on the segment; this is the address used for Hello packets universally and for LSU flooding directed at the entire segment. The address 224.0.0.6, designated AllDRouters, is used specifically by non-DR, non-BDR routers (DROthers) when they need to send an LSU or other update destined for the DR and BDR only, since only the DR and BDR actually listen on this address; the DR then takes responsibility for reflooding that information to the rest of the segment using 224.0.0.5. This two-address design is central to how OSPF achieves flooding efficiency on multi-access networks by funneling updates through the DR rather than requiring full-mesh flooding among every router pair. The addresses 224.0.0.8 and 224.0.0.9 are not used by OSPF at all; 224.0.0.9 is in fact reserved for RIPv2 multicast updates, making it a plausible-looking but incorrect distractor. Reference topics: Junos Enterprise Routing – OSPF, Multicast Addressing for Hello and Link State Update Packets.