Juniper Networks JN0-352: Enterprise Routing and Switching, Specialist (JNCIS-ENT)

Last checked November 10, 2026 against the official Juniper Networks exam page.

1. Question 1Layer 2 Switching or VLANs

   A workstation sends untagged Ethernet frames into a switch port that must place them in VLAN 20. No 802.1Q tags are expected from the workstation. Which port configuration meets this requirement?

   1. ATrunk mode allowing VLAN 20 while the native VLAN is left at its default
   2. BAccess mode with VLAN 20 as the only VLAN member of the port
   3. CAccess mode that expects the workstation to send 802.1Q tags for VLAN 20
   4. DTrunk mode with the workstation sending 802.1Q tags for VLAN 20
   Show answer and explanationHide answer

   Correct answer: B

   An access port carries a single VLAN and places untagged frames from the attached device into that VLAN, so option B is right. A trunk that allows VLAN 20 still places untagged frames in the native VLAN, and the other two options expect tags that the workstation does not send.

2. Question 2Spanning Tree

   An engineer reviews an RSTP switch whose port offers the lowest-cost path toward the root bridge. The port is not the designated port for its segment. Which port role does it take?

   1. AAlternate port, which is blocked and provides a backup path toward the root bridge
   2. BRoot port, which provides the best path toward the root bridge from this switch
   3. CBackup port, which is blocked and backs up a designated port on the same segment
   4. DDesignated port, which forwards frames for its segment away from the root bridge
   Show answer and explanationHide answer

   Correct answer: B

   A root port is the switch's best path toward the root bridge, which matches the scenario. An alternate port and a backup port are both blocked, and a designated port serves its segment rather than the switch's own path to the root.

3. Question 3Layer 2 Security

   An administrator enables DHCP snooping on an access switch. The uplink to the DHCP server is trusted and the access ports are untrusted. A rogue device on an untrusted access port begins sending DHCP OFFER messages to clients. What does the switch do with those messages?

   1. AFloods the offers to the trusted uplink while recording the event in the system log
   2. BForwards the offers, because DHCP messages are exempt from snooping checks on access ports
   3. CAdds the rogue device to the binding table as a trusted DHCP server for the VLAN
   4. DDrops the server replies received on the untrusted port
   Show answer and explanationHide answer

   Correct answer: D

   DHCP snooping drops DHCP server responses such as OFFER and ACK that arrive on untrusted ports, which blocks rogue DHCP servers. The other options wrongly exempt DHCP from snooping, add a rogue device to the binding table, or send the offers toward the uplink.

4. Question 4Protocol Independent Routing

   A company owns the prefix 10.20.0.0/16 but uses only some subnets inside it. The engineer adds a static route for the whole block that points to a discard next hop, so packets for unused subnets do not follow a default route toward other networks. Which statement describes this route?

   1. AThe discard next hop returns an ICMP unreachable message to the sender for every packet to an unused subnet
   2. BThe discard next hop silently drops matching packets, so a broader default route cannot forward them elsewhere
   3. CThe discard next hop forwards unused subnets toward the default gateway, where they are dropped by the upstream router
   4. DThe static route is installed only while a more specific route to the same subnet is present in the table
   Show answer and explanationHide answer

   Correct answer: B

   A discard next hop drops matching packets silently, so a less specific default route cannot pick them up. A reject next hop is the one that returns an ICMP unreachable message, a static route is not limited to existing more specific routes, and a discard route never forwards packets.

5. Question 5OSPF

   Which OSPF LSA type is originated by an autonomous system boundary router to advertise routes redistributed from outside the OSPF domain?

   1. AType 1 router LSA, which describes the links and state of the originating router inside its own area
   2. BType 5 AS external LSA, which an autonomous system boundary router originates for redistributed routes
   3. CType 2 network LSA, which the designated router generates to describe a multi-access transit segment
   4. DType 3 summary LSA, which an area border router uses to advertise prefixes between OSPF areas
   Show answer and explanationHide answer

   Correct answer: B

   Type 5 AS external LSAs are flooded through the OSPF domain (except stub areas) to advertise routes an ASBR imports from other sources. Type 1 describes a router's own links within an area, Type 2 is generated by the DR for a transit segment, and Type 3 carries inter-area prefixes.