CertArea
All Juniper Networks exams

Free JN0-352 practice test: 30 questions with answers

30 original questions for Enterprise Routing and Switching, Specialist (JNCIS-ENT), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
65 questions, 90 min

JN0-352 exam guide: topics, cost and format

All 30 JN0-352 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Layer 2 Switching or VLANs (4 questions)

  1. Question 1

    A workstation sends untagged Ethernet frames into a switch port that must place them in VLAN 20. No 802.1Q tags are expected from the workstation. Which port configuration meets this requirement?

    1. ATrunk mode allowing VLAN 20 while the native VLAN is left at its default
    2. BAccess mode with VLAN 20 as the only VLAN member of the port
    3. CAccess mode that expects the workstation to send 802.1Q tags for VLAN 20
    4. DTrunk mode with the workstation sending 802.1Q tags for VLAN 20
    Show answer and explanation
    Correct answer: B

    An access port carries a single VLAN and places untagged frames from the attached device into that VLAN, so option B is right. A trunk that allows VLAN 20 still places untagged frames in the native VLAN, and the other two options expect tags that the workstation does not send.

  2. Question 2

    Which statement about the native VLAN on an 802.1Q trunk port is correct?

    1. AFrames in the native VLAN are transmitted with an 802.1Q tag so the neighboring switch can identify the VLAN they belong to
    2. BThe native VLAN must always be the VLAN with the highest numeric ID among the VLANs carried on the trunk link
    3. CUntagged frames arriving on the trunk are placed in the native VLAN, and native VLAN frames leave the trunk untagged
    4. DThe native VLAN is reserved for spanning tree BPDUs and is not permitted to carry any user data traffic
    Show answer and explanation
    Correct answer: C

    The native VLAN is the VLAN that receives untagged incoming frames and whose frames are sent untagged on egress. The other options are wrong: native VLAN frames are not tagged, there is no requirement to use the highest VLAN ID, and the native VLAN can carry user traffic.

  3. Question 3

    Hosts in VLAN 10 and VLAN 30 are connected to the same switch and must reach each other. No external router is attached. The engineer adds a Layer 3 interface for each VLAN on the switch. What does this design provide?

    1. AThe VLANs are merged into one broadcast domain, so traffic between them is bridged at Layer 2 without any routing decision
    2. BThe switch routes between the VLANs at Layer 3, and each VLAN interface serves as that VLAN's default gateway
    3. CSpanning tree blocks the path between the VLANs, so the Layer 3 interfaces take over forwarding on the blocked links
    4. DEach Layer 3 interface only limits broadcast flooding, and hosts in the two VLANs still cannot reach one another at all
    Show answer and explanation
    Correct answer: B

    Inter-VLAN routing happens at Layer 3, so the switch's VLAN interfaces act as default gateways and route between VLAN 10 and VLAN 30. The other options describe Layer 2 bridging, spanning tree behavior, or a design in which hosts cannot communicate at all.

  4. Question 4

    Which two conditions cause a Layer 2 switch to flood a frame out multiple ports within the VLAN? (Choose two.)

    1. AThe destination MAC address is the Ethernet broadcast address
    2. BThe destination MAC address is already in the MAC table on the ingress port
    3. CThe destination MAC address is unknown to the switch for that VLAN
    4. DThe source MAC address has not yet been learned on any port of the switch
    Show answer and explanation
    Correct answer: A, C

    Broadcast frames and unknown unicast frames are flooded to all ports in the VLAN except the ingress port. A destination learned on the ingress port is filtered rather than flooded, and an unlearned source address does not by itself cause flooding.

Spanning Tree (4 questions)

  1. Question 5

    An engineer reviews an RSTP switch whose port offers the lowest-cost path toward the root bridge. The port is not the designated port for its segment. Which port role does it take?

    1. AAlternate port, which is blocked and provides a backup path toward the root bridge
    2. BRoot port, which provides the best path toward the root bridge from this switch
    3. CBackup port, which is blocked and backs up a designated port on the same segment
    4. DDesignated port, which forwards frames for its segment away from the root bridge
    Show answer and explanation
    Correct answer: B

    A root port is the switch's best path toward the root bridge, which matches the scenario. An alternate port and a backup port are both blocked, and a designated port serves its segment rather than the switch's own path to the root.

  2. Question 6

    Which set of port states does RSTP use, compared with classic 802.1D STP?

    1. ARSTP adds a new proposal state between the blocking state and the learning state for faster convergence
    2. BRSTP removes the learning state so that ports move directly from blocking to forwarding
    3. CRSTP uses discarding, learning and forwarding, collapsing the blocking and listening states
    4. DRSTP keeps the same five states as STP and changes only the names of the port roles
    Show answer and explanation
    Correct answer: C

    RSTP (802.1w) uses the discarding, learning and forwarding states, folding blocking and listening into discarding. Proposal and agreement are handshake messages used during convergence rather than a port state, so the other options are wrong.

  3. Question 7

    In a stable spanning tree topology, which bridge originates the configuration BPDUs that other bridges relay through the network?

    1. AThe root bridge originates them, and other bridges relay them out their designated ports
    2. BEvery bridge originates its own configuration BPDUs on all ports while the topology remains stable
    3. CThe bridge with the highest bridge ID originates them so that it can keep control of the topology
    4. DEach access switch originates BPDUs toward the root bridge out of its root port
    Show answer and explanation
    Correct answer: A

    The root bridge generates configuration BPDUs and other bridges relay them out their designated ports. The root is the bridge with the lowest bridge ID, root ports only receive BPDUs, and not every bridge originates BPDUs on every port.

  4. Question 8

    Two switches in the same spanning tree domain both have the same bridge priority. Which switch becomes the root bridge?

    1. AThe switch with the higher MAC address, because the highest bridge ID always wins the election
    2. BThe switch whose hostname comes first alphabetically, because spanning tree uses hostnames as tie-breakers
    3. CThe switch with the lower MAC address, because equal priorities are broken by the lower MAC value
    4. DThe switch with the longer uptime, because the bridge that has been running longest is preferred as root
    Show answer and explanation
    Correct answer: C

    The root is the bridge with the lowest bridge ID, which combines the bridge priority with the MAC address, so equal priorities are decided by the lower MAC address. Higher MAC addresses, hostnames and uptime do not decide the election.

Layer 2 Security (4 questions)

  1. Question 9

    An administrator enables DHCP snooping on an access switch. The uplink to the DHCP server is trusted and the access ports are untrusted. A rogue device on an untrusted access port begins sending DHCP OFFER messages to clients. What does the switch do with those messages?

    1. AFloods the offers to the trusted uplink while recording the event in the system log
    2. BForwards the offers, because DHCP messages are exempt from snooping checks on access ports
    3. CAdds the rogue device to the binding table as a trusted DHCP server for the VLAN
    4. DDrops the server replies received on the untrusted port
    Show answer and explanation
    Correct answer: D

    DHCP snooping drops DHCP server responses such as OFFER and ACK that arrive on untrusted ports, which blocks rogue DHCP servers. The other options wrongly exempt DHCP from snooping, add a rogue device to the binding table, or send the offers toward the uplink.

  2. Question 10

    Which two statements about MACsec are correct? (Choose two.)

    1. AIt provides hop-by-hop encryption and integrity protection for Ethernet frames between directly connected devices
    2. BIt uses a key agreement protocol to negotiate the keys that protect the link between two devices
    3. CIt encrypts traffic end to end across routed networks, so intermediate routers never see the payload
    4. DIt replaces IEEE 802.1X port authentication entirely, so no separate authentication step is needed
    Show answer and explanation
    Correct answer: A, B

    MACsec (IEEE 802.1AE) protects each link hop by hop, and MACsec Key Agreement (MKA) negotiates the keys. It does not encrypt end to end across routers, and it does not replace 802.1X, which is often used alongside it for device authentication.

  3. Question 11

    A server port begins sending a flood of broadcast frames that degrades the whole VLAN. The administrator wants the switch to limit broadcast traffic on that port above a set threshold. Which Layer 2 feature fits this requirement?

    1. AStorm control, which limits broadcast, multicast or unknown unicast traffic on the port
    2. BDynamic ARP inspection, which checks ARP packets against the DHCP snooping binding table
    3. CMAC limiting, which caps the number of MAC addresses that can be learned on the port
    4. DPort mirroring, which copies the traffic on the port to a monitoring device for analysis
    Show answer and explanation
    Correct answer: A

    Storm control measures broadcast, multicast and unknown unicast traffic on a port and acts when a threshold is exceeded. MAC limiting, dynamic ARP inspection and port mirroring do not rate-limit broadcast traffic.

  4. Question 12

    A switch port that connects to an end device is protected with BPDU guard. A user connects another switch to that port, and the port receives a BPDU. What does BPDU guard do?

    1. AKeeps the port up but blocks data frames while still letting the switch learn MAC addresses on it
    2. BForwards the BPDU and changes the port to a root port so that the new switch joins the topology
    3. CDisables the port when the BPDU arrives, and the port stays down until it is recovered
    4. DChanges the port to an alternate role so that the new switch can become the designated bridge for it
    Show answer and explanation
    Correct answer: C

    BPDU guard shuts down an edge port when it receives a BPDU, which protects the topology from an unexpected switch. The other options describe keeping the port up, relaying the BPDU, or changing port roles, none of which BPDU guard does.

Protocol Independent Routing (3 questions)

  1. Question 13

    A company owns the prefix 10.20.0.0/16 but uses only some subnets inside it. The engineer adds a static route for the whole block that points to a discard next hop, so packets for unused subnets do not follow a default route toward other networks. Which statement describes this route?

    1. AThe discard next hop returns an ICMP unreachable message to the sender for every packet to an unused subnet
    2. BThe discard next hop silently drops matching packets, so a broader default route cannot forward them elsewhere
    3. CThe discard next hop forwards unused subnets toward the default gateway, where they are dropped by the upstream router
    4. DThe static route is installed only while a more specific route to the same subnet is present in the table
    Show answer and explanation
    Correct answer: B

    A discard next hop drops matching packets silently, so a less specific default route cannot pick them up. A reject next hop is the one that returns an ICMP unreachable message, a static route is not limited to existing more specific routes, and a discard route never forwards packets.

  2. Question 14

    What is the main difference between filter-based forwarding and normal destination-based routing?

    1. AFilter-based forwarding selects the next hop from the destination address only, but applies the decision before routing protocols run
    2. BFilter-based forwarding replaces dynamic routing protocols with a static table that the operator builds by hand
    3. CFilter-based forwarding copies selected packets to a second router for logging while the original follows the normal route
    4. DFilter-based forwarding lets a firewall filter choose a routing table or next hop based on fields such as the source address
    Show answer and explanation
    Correct answer: D

    Filter-based forwarding uses a firewall filter action to direct matching packets to a routing instance or next hop based on criteria such as source address, which normal destination-based routing cannot do. The other options describe a destination-only lookup, static routing, or traffic copying rather than filter-based forwarding.

  3. Question 15

    An engineer needs prefixes that exist in the default routing table of a router to also appear in the routing table of a separate routing instance on the same router. Which Junos feature is designed for copying routes between routing tables?

    1. AA filter-based forwarding rule, which selects a routing table for each packet based on its source
    2. BAn aggregate route, which summarizes several contributing prefixes into one advertised route
    3. CA generated route, which installs a summary only while a contributing route exists in the table
    4. DA RIB group, which imports selected routes from one routing table into one or more other tables
    Show answer and explanation
    Correct answer: D

    A RIB group imports routes from one routing table into other routing tables on the same router, which is what this scenario needs. Aggregate and generated routes create summary prefixes rather than copying existing routes, and filter-based forwarding chooses a table per packet instead of copying routes.

OSPF (3 questions)

  1. Question 16

    Which OSPF LSA type is originated by an autonomous system boundary router to advertise routes redistributed from outside the OSPF domain?

    1. AType 1 router LSA, which describes the links and state of the originating router inside its own area
    2. BType 5 AS external LSA, which an autonomous system boundary router originates for redistributed routes
    3. CType 2 network LSA, which the designated router generates to describe a multi-access transit segment
    4. DType 3 summary LSA, which an area border router uses to advertise prefixes between OSPF areas
    Show answer and explanation
    Correct answer: B

    Type 5 AS external LSAs are flooded through the OSPF domain (except stub areas) to advertise routes an ASBR imports from other sources. Type 1 describes a router's own links within an area, Type 2 is generated by the DR for a transit segment, and Type 3 carries inter-area prefixes.

  2. Question 17

    A broadcast segment already has an elected OSPF designated router. A new router with a higher interface priority is then connected to the same segment. Which outcome occurs?

    1. AThe current designated router keeps its role, since OSPF does not preempt a DR after election
    2. BBoth routers become designated routers and share the segment's network LSA between them for redundancy
    3. CThe routers compare router IDs again, and the router with the lowest router ID becomes the designated router
    4. DThe new router takes over as designated router immediately, because the highest priority always wins a DR election
    Show answer and explanation
    Correct answer: A

    OSPF DR elections are non-preemptive, so the existing DR keeps its role and the new router waits. Router IDs are compared only when priorities tie, and a segment never has two DRs.

  3. Question 18

    An engineer wants an OSPF area in which routers receive no Type 3, Type 4 or Type 5 LSAs except a default route for destinations outside the area. Which area type matches this design?

    1. ABackbone area 0, which carries every LSA type and is required for inter-area routing
    2. BStub area, which blocks Type 5 external LSAs but still carries inter-area summary LSAs
    3. CNSSA, which lets the area originate Type 7 external LSAs for locally redistributed routes
    4. DTotally stubby area, which admits only a default summary route and blocks other inter-area and external routes
    Show answer and explanation
    Correct answer: D

    A totally stubby area blocks Type 3 summaries except a default, plus Type 4 and Type 5 LSAs. A plain stub area still carries Type 3 summaries, an NSSA originates Type 7 LSAs for its own external routes, and area 0 is the backbone rather than a restricted area.

IS-IS (3 questions)

  1. Question 19

    Which IS-IS PDU type is used to discover neighbors and to establish and maintain adjacencies on a link?

    1. AHello PDU, which is also called an IIH and is used to discover and maintain neighbor adjacencies
    2. BLink state PDU, which carries the router's topology and reachability information to the rest of the level
    3. CComplete sequence number PDU, which summarizes the entire link state database for synchronization
    4. DPartial sequence number PDU, which requests or acknowledges specific LSPs that a neighbor is missing
    Show answer and explanation
    Correct answer: A

    IS-IS Hello PDUs (IIHs) discover neighbors and maintain adjacencies. LSPs carry topology information, while CSNPs and PSNPs synchronize the link state database, so none of those is used for neighbor discovery.

  2. Question 20

    A Level 1 router inside an IS-IS area needs to reach a destination in another area. The router holds only the Level 1 link state database for its own area. What does it normally use to reach the destination?

    1. AThe full Level 2 link state database, which it stores in its entirety alongside the Level 1 database
    2. BA flooded Level 1 LSP that the backbone router repeats into every neighboring area of the domain
    3. CA default route toward a nearby Level 1-2 router that sets the attached bit in its LSPs
    4. DA separate Level 1 adjacency that it forms with every router in the other area of the domain
    Show answer and explanation
    Correct answer: C

    Level 1 routers keep only the Level 1 database and reach other areas through a default route toward a Level 1-2 router that sets the attached bit. The other options describe storing Level 2 data, flooding Level 1 LSPs across areas, or forming Level 1 adjacencies across areas, none of which happens.

  3. Question 21

    On an IS-IS broadcast segment, a DIS has already been elected. A router with a higher DIS priority then joins the segment. What happens?

    1. AThe current DIS keeps its role until it fails, because IS-IS never preempts an elected DIS on a segment
    2. BThe new router becomes the DIS, because IS-IS election is preemptive and the higher priority wins
    3. CThe router with the lowest system ID becomes the DIS regardless of the priority values that are configured
    4. DBoth routers become DIS for the segment and each one generates its own pseudonode LSP
    Show answer and explanation
    Correct answer: B

    IS-IS DIS election is preemptive, so a router with a higher priority takes over the DIS role, unlike OSPF DR election. Priority decides the election rather than the lowest system ID, and each segment has one DIS per level.

BGP (3 questions)

  1. Question 22

    A router learns the same prefix from two EBGP peers. Both paths have the same local preference. One path has a shorter AS path than the other. Which path does the router prefer, assuming no earlier tie-breaking attribute differs?

    1. AThe path with the higher router ID, because router ID is compared before the AS path attribute
    2. BThe path with the longer AS path, because a longer path is treated as more specific to the origin
    3. CThe path with the shorter AS path, because AS path length is compared before MED in best-path selection
    4. DThe path learned from the peer with the lower IP address, because peer address is compared first
    Show answer and explanation
    Correct answer: C

    Best-path selection compares local preference first and then AS path length, so with equal local preference the shorter AS path wins. A longer AS path is less preferred, and router ID and peer address are compared only after AS path.

  2. Question 23

    Which two of these BGP path attributes are well-known mandatory? (Choose two.)

    1. AORIGIN, which every update that carries reachability information must include
    2. BLOCAL_PREF, which is exchanged only between peers inside the same autonomous system
    3. CAS_PATH, which lists the autonomous systems a route has traversed toward the local router
    4. DMULTI_EXIT_DISC, which is optional and non-transitive and may be absent from an update
    Show answer and explanation
    Correct answer: A, C

    ORIGIN and AS_PATH are well-known mandatory attributes, along with NEXT_HOP. LOCAL_PREF is well-known discretionary and MULTI_EXIT_DISC is optional non-transitive, so neither has to be present in every update.

  3. Question 24

    Router R1 learns a prefix from an EBGP peer in another autonomous system and advertises it to its IBGP peer R2 without changing the next hop. R2 has no IGP route to the external peer's address. What is the most likely result?

    1. AR2 receives the prefix but cannot use it, because the BGP next hop is not reachable through the IGP
    2. BR2 rejects the prefix, because IBGP peers never accept routes that carry AS path information from outside
    3. CR2 installs the prefix with R1 as the next hop, so traffic reaches the external peer directly through R1
    4. DR2 rewrites the AS path to its own autonomous system, which makes the prefix usable through the IGP
    Show answer and explanation
    Correct answer: A

    IBGP keeps the external next hop unchanged, so R2 needs an IGP route to that address before it can use the prefix, which is why next-hop-self is often configured on R1. Making R1 the next hop, rejecting the route, or rewriting the AS path are not how IBGP behaves.

Tunnels (3 questions)

  1. Question 25

    Which two statements about GRE tunnels are correct? (Choose two.)

    1. AGRE is stateless, so tunnel endpoints do not track session state for each flow
    2. BGRE encrypts the payload when a key is configured, which removes the need for IPsec
    3. CGRE adds no encryption or authentication by itself, so IPsec is needed when confidentiality is required
    4. DGRE can carry only IPv4 payloads, so IPv6 traffic must be sent through an IP-IP tunnel instead
    Show answer and explanation
    Correct answer: A, C

    GRE is a stateless encapsulation with no built-in encryption or authentication, so IPsec is added when confidentiality is needed. A configured GRE key only identifies the tunnel and does not encrypt traffic, and GRE is not limited to IPv4 payloads.

  2. Question 26

    Which description matches IP-in-IP encapsulation?

    1. AIP-in-IP adds a GRE header and carries Ethernet frames between two sites across an IP core network
    2. BIP-in-IP encrypts the inner packet with a shared key configured on both tunnel endpoints
    3. CIP-in-IP wraps an entire IP packet inside another IP header, with no extra GRE header and no encryption
    4. DIP-in-IP is limited to a single subnet and cannot cross a router between two sites
    Show answer and explanation
    Correct answer: C

    IP-in-IP places an entire IP packet inside an outer IP header and provides no encryption. The other options describe GRE or encrypted tunneling, and IP-in-IP is routed across routers like any other tunnel.

  3. Question 27

    A GRE tunnel interface between two sites stays down. The engineer finds that the remote tunnel endpoint address is not reachable through the underlay routing table. Which action should the engineer take first?

    1. AChange the encapsulation to IP-in-IP, because GRE tunnels cannot be brought up over a routed underlay network
    2. BRaise the tunnel interface MTU to the largest value supported by the physical Ethernet link
    3. CVerify that the underlay has a valid route to the remote tunnel endpoint address
    4. DEnable BFD on the tunnel interface so the interface comes up without a route to the remote endpoint
    Show answer and explanation
    Correct answer: C

    The tunnel's outer source and destination addresses must be reachable through the underlay, so a missing route to the remote endpoint is the first thing to check. Changing the encapsulation, raising the MTU or enabling BFD does not bring up a tunnel that has no path to its far end.

High Availability (3 questions)

  1. Question 28

    Two switches must combine several physical Ethernet links into one logical bundle and negotiate its membership dynamically. Which protocol provides this negotiation?

    1. ASpanning tree, which blocks redundant links so that the topology stays free of loops
    2. BLACP, which exchanges LACP PDUs to negotiate membership of the aggregated Ethernet bundle
    3. CVRRP, which shares a virtual gateway address between two routers on the same segment
    4. DBFD, which detects link or neighbor failures quickly but does not form a bundle of links
    Show answer and explanation
    Correct answer: B

    LACP is the dynamic link aggregation protocol defined in IEEE 802.1AX, and it negotiates which links join the bundle. Spanning tree blocks links rather than bundling them, VRRP provides a virtual gateway, and BFD only detects failures.

  2. Question 29

    An administrator wants forwarding to continue during a restart of a router's routing protocol process. Neighboring routers must keep using the restarting router's routes until it has resynchronized. Which feature provides this behavior?

    1. ABFD, which detects neighbor failures within milliseconds and removes the affected routes at once
    2. BBGP multipath, which installs several equal-cost BGP paths into the forwarding table at the same time
    3. CVRRP, which moves a virtual gateway address to a backup router when the master stops advertising
    4. DGraceful restart, which lets neighbors keep forwarding with the restarting router's routes during a control plane restart
    Show answer and explanation
    Correct answer: D

    Graceful restart keeps forwarding state in place and relies on helper neighbors to keep routes during the restart. BFD only detects failures, VRRP moves a gateway address, and BGP multipath installs parallel paths, so none of them keeps neighbor routes during a process restart.

  3. Question 30

    Which feature keeps routing protocol state synchronized on the backup Routing Engine so that neighbors do not see an adjacency loss during a switchover?

    1. ANonstop active routing, which replicates protocol state to the backup Routing Engine so neighbors see no adjacency loss
    2. BVirtual chassis, which joins several switches into one logical device with a single control plane
    3. CRedundant trunk group, which provides an active and standby uplink pair on EX series switches
    4. DGraceful restart, which depends on neighbors to hold routes while the restarting router rebuilds its state
    Show answer and explanation
    Correct answer: A

    Nonstop active routing keeps protocol state current on the backup Routing Engine, so neighbors do not need to help during a switchover. Graceful restart relies on neighbors, virtual chassis is a different structure, and redundant trunk groups protect uplinks rather than routing state.