Free Sample Questions to Practice JN0-352 Certification Test Engine [Aug-2026]
2026 Valid JN0-352 Real Exam Questions, practice JNCIS-ENT
NEW QUESTION # 72
You are a network operator who wants to add a second ISP connection and remove the default route to the existing ISP You decide to deploy the BGP protocol in the network. What two statements are correct in this scenario? (Choose two.)
- A. IBGP updates the next-hop attribute to ensure reachability within an AS.
- B. EBGP peers advertise routes received from IBGP peers to other EBGP peers.
- C. IBGP peers advertise routes received from EBGP peers to other IBGP peers.
- D. IBGP peers advertise routes received from IBGP peers to other IBGP peers.
Answer: B,C
Explanation:
The rules are as simple as follows:
1. IBGP peers advertise routes received from EBGP peers to other IBGP peers.
2. EBGP peers advertise routes learned from IBGP or EBGP peers to other EBGP peers.
https://community.juniper.net/discussion/understanding-how-ibgpebgp-behaves-in-junos
NEW QUESTION # 73
You are configuring an IS-IS IGP network and do not see the IS-IS adjacencies established. In this scenario, what are two reasons for this problem? (Choose two.)
- A. The lo0 interface is not included as an IS-IS interface.
- B. The Level 2 routers have mismatched areas.
- C. IP subnets are not a /30 address.
- D. MTU is not at least 1492 bytes.
Answer: A,D
Explanation:
Option A suggests that the MTU is not at least 1492 bytes. This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies. If the MTU is less than this, IS-IS adjacencies will not be established.
Option D suggests that the lo0 interface is not included as an IS-IS interface. This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS. If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established.
NEW QUESTION # 74
Which statement about the default action of MAC limiting is true when the number of MAC addresses has hit the limit set?
- A. The switch will shut down the offending port for five minutes.
- B. The switch stops learning MAC addresses on the offending port, and any traffic to or from the offending MAC address will be dropped.
- C. The switch will shut down MAC learning on the offending port for five minutes.
- D. The switch stops learning MAC addresses on the offending port, but floods traffic out of all ports for the offending MAC address.
Answer: B
NEW QUESTION # 75
Which statement about aggregate routes is correct?
- A. Aggregate routes are always preferred over more specific routes, even when the specific routes have a better path.
- B. Aggregate routes can only be used for static routing but not for dynamic routing protocols.
- C. Aggregate routes are used for advertising summarized network prefixes.
- D. Aggregate routes are automatically generated for all of the subnets in a routing table.
Answer: C
Explanation:
Aggregate routes are used for advertising summarized network prefixes. They help minimize the number of routing tables in an IP network by consolidating selected multiple routes into a single route advertisement. This approach is in contrast to non-aggregation routing, in which every routing table contains a unique entry for each route.
Therefore, option D is correct. Options A, B, and C are not correct because:
Aggregate routes can be used with both static routing and dynamic routing protocols. Aggregate routes are not automatically generated for all of the subnets in a routing table. They need to be manually configured.
Aggregate routes are not always preferred over more specific routes. The route selection process in Junos OS considers several factors, including route preference and metric, before determining the active route.
NEW QUESTION # 76
In RSTP, which three port roles are associated with the discarding state? (Choose three.)
- A. backup
- B. disabled
- C. root
- D. alternate
- E. designated
Answer: A,B,D
Explanation:
In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree. The roles include root, designated, alternate, backup, and disabled.
The discarding state is associated with the backup, alternate, and disabled roles. In a stable topology with consistent port roles throughout the network, RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state. Disabled ports are also in the discarding state.
NEW QUESTION # 77
You have configured a GRE tunnel from your local router with tunnel source 10.0.0.1 to a remote router at destination 192.168.0.1. The tunnel is functioning until you commit set routing-options static route 0.0.0.0/0 next-hop gr-0/0/0. This configuration causes the tunnel to go down.
Which statement is correct in this scenario?
- A. The destination IP was being resolved using the default route, which now points to the tunnel itself.
- B. The tunnel destination must be resolved by a /32 host route.
- C. A GRE interface must use the loopback as its source address to be used as a default route.
- D. A GRE interface cannot be used as a next hop for a static route.
Answer: A
Explanation:
A GRE tunnel's outer, delivery-layer packets are forwarded using the router's ordinary underlay routing table, meaning the tunnel destination address (192.168.0.1 in this case) must itself be resolvable to a physical, non- tunnel next hop for the encapsulated packets to actually leave the router. Before this configuration change, the default route (or some more specific route) presumably pointed toward a real physical next hop, allowing the router to reach 192.168.0.1 and keep the tunnel operational. When the administrator commits a static default route of 0.0.0.0/0 with a next hop of gr-0/0/0, every destination lookup that previously fell back to the default route - including the lookup for the tunnel's own destination address, 192.168.0.1, since no more specific route exists for it - now recurses through the GRE interface itself. This creates a circular dependency: the router needs to route to 192.168.0.1 to keep the tunnel up, but the only route it has to reach 192.168.0.1 now points back into the tunnel that requires 192.168.0.1 to already be reachable, so the interface's next-hop resolution fails and the tunnel drops. This is an entirely valid and common GRE design pitfall rather than any platform restriction; GRE interfaces can be legitimately used as static route next hops, do not require loopback-sourced encapsulation, and do not require a /32 host route to resolve their destination, provided that route does not recursively point back through the tunnel. Reference topics: Junos Enterprise Routing - Tunneling, Route Recursion and GRE Tunnel Destination Resolution.
NEW QUESTION # 78
You have configured OSPF routing as shown in the exhibit. You notice that all interfaces have formed full adjacencies, with the exception of the interfaces connecting R3 and R4 with a status of 2Way.
What is the reason for this status?
- A. DROther routers will not form a full adjacency with each other.
- B. The two routers must both be configured as DR routers.
- C. The interface-type is not configured as p2p.
- D. The two routers must be configured in different areas.
Answer: A
NEW QUESTION # 79
Your company has a branch location that uses a Juniper Networks EX Series Switch. You are asked to troubleshoot a spanning-tree issue that keeps reoccurring within the branch environment. After investigation, you discover that end-devices running a virtualization application are generating BPDUs, which are disrupting the spanning-tree topology and causing periodic outages.
Which solution will prevent this problem from reoccurring?
- A. Configure BPDU protection on all edge interfaces.
- B. Configure root protection on all access interfaces.
- C. Disable RSTP on all access interfaces.
- D. Increase the max-age timer on all EX Series Switches.
Answer: A
Explanation:
This scenario describes end hosts - virtualization hosts running software switches or virtual bridging stacks
- unexpectedly generating and transmitting BPDUs on ports that are supposed to be pure edge (host-facing) ports where no BPDUs should ever legitimately be received. BPDU protection (BPDU guard) is the Junos feature purpose-built for exactly this situation: when applied to an edge-designated interface, it continuously monitors that port for any incoming BPDU, and the moment one is detected, it immediately and automatically disables the port, preventing the unexpected BPDU source from ever participating in or influencing the spanning-tree topology calculation, thereby protecting the stable, intended topology from disruption caused by unauthorized or accidental BPDU generation at the access edge. This directly and precisely resolves the described problem at its source, since the root cause is illegitimate BPDUs arriving on ports that were never meant to see them. Increasing the max-age timer only adjusts how long stale topology information is retained before being aged out and has no effect on preventing rogue BPDUs from being processed in the first place.
Disabling RSTP outright on access interfaces would eliminate spanning tree's loop-prevention protection on those ports entirely, introducing a much more severe risk of undetected Layer 2 loops. Root protection (root guard) defends specifically against a port attempting to become the root port by receiving a superior BPDU claiming a better path to root; it addresses a different threat model than blocking any BPDU outright on a true edge port. Reference topics: Junos Enterprise Switching - Spanning Tree Protocols, BPDU Protection on Edge Interfaces.
NEW QUESTION # 80
Which two statements are correct about martian routes? (Choose two.)
- A. Additional prefixes can be added to the list of martian routes.
- B. Martian routes are always host addresses.
- C. Martian routes are never installed in the route table.
- D. Martian routes only represent publicly used prefixes.
Answer: A,C
Explanation:
Martian routes are never installed in the route table.
Martian routes refer to IP addresses or prefixes that are considered invalid or reserved, and they are not installed in the routing table.
Additional prefixes can be added to the list of martian routes.
Network administrators can configure the system to treat additional prefixes as Martian routes based on specific network policies or requirements.
NEW QUESTION # 81
You need to block SSH (TCP port 22) traffic from the 192.168.10.0/24 network.
Which firewall filter term is correct in this scenario?
- A. term block-ssh { from { source-address 192.168.10.0/24; service ssh; } then reject; }
- B. term block-ssh { from { source-address 192.168.10.0/24; protocol tcp; destination-port 22; } then discard; }
- C. term block-ssh { from { source-address 192.168.10.0/24; protocol tcp; source-port 22; } then discard; }
- D. term block-ssh { from { destination-address 192.168.10.0/24; protocol tcp; destination-port 22; } then discard; }
Answer: B
Explanation:
Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to
22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction.
The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching - Firewall Filters, Matching on Address, Protocol, and Port Conditions.
NEW QUESTION # 82
What is the default keepalive time for BGP?
- A. 30 seconds
- B. 90 seconds
- C. 60 seconds
- D. 10 seconds
Answer: A
Explanation:
The default hold-time is 90 seconds, meaning that the default frequency for keepalive messages is 30 seconds.
https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/ref/statement/precision-timers-edit-protocols-bgp.html#:~:text=BGP%20on%20the%20local%20routing,keepalive%20messages%20is%2030
%20seconds
NEW QUESTION # 83
You are asked to connect an IP phone and a user computer using the same interface on an EX Series switch. The traffic from the computer does not use a VLAN tag, whereas the traffic from the IP phone uses a VLAN tag.
Which feature enables the interface to receive both types of traffic?
- A. native VLAN
- B. MAC limiting
- C. voice VLAN
- D. DHCP snooping
Answer: C
Explanation:
The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the voice VLAN. The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs. This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority.
NEW QUESTION # 84
R1 has a BGP session with a router that has a peer autonomous system number of 64501. It is exchanging routes, and is advertising those routes to IBGP peers. The downstream IBGP peers, however, cannot pass traffic to the advertised networks.
Referring to the exhibit, which configuration change must occur to solve this problem?
- A. The BGP group ext-64501 must include the import next-hop-selfpolicy.
- B. The BGP group ext-64501 must include the export next-hop-selfpolicy.
- C. The BGP group int-64503 must include the import next-hop-selfpolicy.
- D. The BGP group int-64503 must include the export next-hop-selfpolicy.
Answer: D
NEW QUESTION # 85
Which statement about configuring persistent MAC learning is correct?
- A. Persistent MAC learning cannot be configured on redundant trunk groups.
- B. Persistent MAC learning requires 802.1X authentication.
- C. Persistent MAC learning flushes dynamically learned MAC addresses on reboots.
- D. Persistent MAC learning can be configured on access mode interfaces.
Answer: D
NEW QUESTION # 86
You are a network operator troubleshooting BGP connectivity.
Which two statements are correct about the output shown in the exhibit? (Choose two.)
- A. The R1 is configured for AS 65400.
- B. The routers are exchanging IPv4 routes.
- C. Peer 10.32.1.2 is configured for AS 63645.
- D. The BGP session is not established.
Answer: A,B
Explanation:
The local AS is 65400, as indicated by "Local AS: 65400".
The output shows "NLRI for this session: inet-unicast", which indicates that the routers are exchanging IPv4 unicast routes.
NEW QUESTION # 87
Referring to the exhibit, which two statements about BGP prefixes advertised by R1 to AS 65501 are true? (Choose two.)
- A. R1 will modify the AS path attribute in prefixes advertised to AS 65501
- B. R1 will modify the cluster list attribute in prefixes advertised to AS 65501
- C. R1 will modify the originator ID attribute in prefixes advertised to AS 65501
- D. R1 will modify the next-hop attribute in prefixes advertised to AS 65501
Answer: C,D
NEW QUESTION # 88
You must implement filter-based forwarding. You need to direct traffic from the 192.168.1.0/24 through vr1 and traffic from 10.210.0.128/26 through vr2.
Which configuration is correct in this scenario?
- A.
- B.
- C.
- D.
Answer: A
NEW QUESTION # 89
You are required to ensure that Switch 1 will always be designated as the root bridge when participating in your switched network.
What do you need to do to satisfy this requirement?
- A. Ensure Switch1 has the highest port costs of all the other switches.
- B. Ensure Switch1 has the lowest port priority of all other switches.
- C. Ensure Switch1 has the lowest bridge priority of all the other switches.
- D. Ensure Switch 1 has the highest system MAC address.
Answer: C
Explanation:
Because root bridge election is decided primarily by comparing bridge priority values - with the switch advertising the numerically lowest priority always winning, and MAC address serving only as a fallback tiebreaker when priorities are tied - the only deterministic, reliable way to guarantee that a specific switch is elected root regardless of any other switch's hardware characteristics is to explicitly configure that switch with a lower bridge priority than every other participating switch in the topology. Relying on MAC address alone, as the first distractor suggests, is fundamentally unreliable: MAC addresses are burned in at the factory, cannot be predicted or controlled by the administrator, and any future hardware replacement or newly introduced switch with a numerically lower MAC address could unexpectedly seize the root role since MAC comparison only comes into play at equal priority in the first place, meaning a 'highest MAC' strategy does not even align with how the tiebreak actually favors the lowest value. Port priority and port cost are entirely separate STP parameters that influence which port on a non-root switch is selected as its root port, or which port is selected as designated versus blocking on a given segment; neither parameter has any bearing whatsoever on which switch is elected root bridge for the whole topology, since that decision is made purely from the Bridge ID comparison, independent of any per-port settings. Explicitly and deliberately lowering Switch 1's configured bridge priority is the only correct, industry-standard method. Reference topics: Junos Enterprise Switching - Spanning Tree Protocols, Guaranteeing Root Bridge Placement via Bridge Priority.
NEW QUESTION # 90
Which two BGP attributes must be supported by all BGP implementations and must be included in every update? (Choose two.)
- A. community
- B. next hop
- C. AS path
- D. MED
Answer: B,C
Explanation:
BGP attributes are properties that BGP uses for route advertisement, path selection, and loop prevention. There are four categories of BGP attributes:
Well-known mandatory: Must be recognized by all BGP routers, present in all BGP updates, and passed on to other BGP routers.
Well-known discretionary: Supported by all BGP implementations, and are optionally included in BGP updates.
Optional transitive: May not be supported by all implementations of BGP.
Optional non-transitive: May not be supported by all implementations of BGP. The well-known mandatory attributes must be supported by all BGP implementations and must be included in every update. These include the AS path and next hop attributes.
NEW QUESTION # 91 
Click the Exhibit button.
An OSPF broadcast segment has four routers with roles as shown in the exhibit. R1 is currently offline, and default OSPF settings are in place.
In this scenario, what happens when R1 comes back online?
- A. DR roles do not change; R1 becomes DROther.
- B. R1 becomes the DR and R2 becomes the BDR.
- C. R1 becomes the DR and R3 remains the BDR.
- D. R1 cannot join the OSPF area until the current DR (R2) is restarted.
Answer: A
Explanation:
OSPF's Designated Router election, as defined in RFC 2328 and implemented unchanged in Junos, is explicitly non-preemptive. Router priority is used only at the moment an election actually takes place - that is, when no DR or BDR currently exists on the segment. Once a DR and BDR have been elected and are functioning, a router with a numerically higher priority that joins the segment afterward does not trigger a new election and does not displace the incumbent DR or BDR, no matter how much higher its priority value is. In this scenario, R2 (priority 150) and R3 (priority 100) were already elected DR and BDR respectively while R1 was offline. When R1, whose priority of 200 would have made it the preferred DR had it been present during the original election, returns to the segment, it simply forms a full adjacency with the existing DR and BDR and takes on the DROther role like R4, without any re-election occurring. This design choice exists specifically to prevent unnecessary and disruptive Network LSA regeneration and adjacency churn every time a high-priority router reboots or rejoins a stable broadcast network. The only ways R1 could become DR going forward are if the current DR fails (promoting the BDR to DR and triggering a new BDR election) or if the entire segment's OSPF process is restarted, forcing a fresh election from a clean state. Reference topics:
Junos Enterprise Routing - OSPF, Designated Router Election and Non-Preemption.
NEW QUESTION # 92
Referring to the exhibit, which statement is correct?
- A. The local device is using a bridge priority of 4k.
- B. The local device is the root bridge for this RSTP topology.
- C. The root bridge is using a bridge priority of 4k.
- D. The root bridge has not been elected for this RSTP topology.
Answer: C
Explanation:
The "Root ID" shows 4096.00:19:e2:55:36:1e. The first part of this ID, 4096, is the bridge priority of the root bridge.
The local bridge ID is shown as 32768.00:19:e2:55:1d:30, indicating that the local device has a default bridge priority of 32768, which is higher (and thus less preferred) than 4096.
Thus, the root bridge has a priority of 4096, and the local device is not the root bridge. The local device is participating in the RSTP topology and has identified another bridge as the root.
NEW QUESTION # 93
......
Genuine JN0-352 Exam Dumps Free Demo Valid QA's: https://www.testpassking.com/JN0-352-exam-testking-pass.html