Juniper JN0-352 Exam Dumps

Layer 2 MAC learning on an EX Series switch, as on any standard Ethernet bridge, is a passive, frame-driven process rather than an active polling or query-based mechanism. Every time a frame arrives on any interface, the switch inspects the frame's source MAC address field and, if that address is not already present in the Ethernet switching (bridge) table for the associated VLAN, creates a new dynamic entry recording the source MAC address, the VLAN it was learned on, and the specific ingress interface through which the frame arrived. Junos also stamps each learned entry with an aging timestamp, which is refreshed every time a subsequent frame from that same source MAC is received; entries that receive no refreshing traffic within the configured MAC aging interval (300 seconds by default) are eventually purged from the table to keep it current and to reclaim table space from hosts that have moved or gone offline. This source-address-driven, per-frame learning process happens continuously and automatically with no dependency on spanning-tree state changes --- although a topology change notification can trigger accelerated aging of the table to flush potentially stale entries faster, learning itself is not gated by or contingent upon such an event occurring. The switch never learns addresses from the destination field of a frame, since the destination address, if already known, is used purely for the forwarding lookup decision, not for populating new table entries. Reference topics: Junos Enterprise Switching -- Layer 2 Switching Fundamentals, Source MAC Learning and Table Aging.

MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching -- Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.

In this configuration, R1's physical interface address (10.10.10.1) is different from the VRRP virtual IP address (10.100.100.1), meaning R1 is operating as a non-owner VRRP master --- it did not originate the virtual address as one of its own real interface addresses. By default, Junos VRRP masters that do not own the virtual address will forward transit traffic destined through that address but will not process or respond to traffic addressed directly to the VIP itself, such as ICMP echo requests, Telnet, or SSH sessions aimed at 10.100.100.1. This is deliberate default behavior intended to prevent ambiguity about which physical device is answering on behalf of a shared virtual identity. To allow the master to accept and respond to packets whose destination is the virtual address itself, the accept-data statement must be explicitly configured under the vrrp-group hierarchy. Once enabled, the elected master will process locally destined traffic sent to the VIP, resolving exactly the symptom described. The track option is used for interface or route-based priority adjustment to influence mastership, advertise-interval tunes the frequency of VRRP hello advertisements, and no-preempt prevents a higher-priority router from reclaiming mastership once a lower-priority router has taken over --- none of these affect whether the master processes traffic destined to the VIP. Reference topics: Junos Enterprise Routing -- High Availability, VRRP accept-data Behavior.

Local preference is a well-known, discretionary BGP path attribute carried exclusively in IBGP UPDATE messages, and Junos assigns every route a local preference value of 100 by default whenever a route is received without an explicit LOCAL_PREF value already attached, or when the attribute has not been otherwise modified through routing policy. This default of 100 becomes the implicit baseline against which any administrator-configured local preference adjustments are compared. Because higher local preference values are always preferred over lower ones during BGP best-path selection --- and this evaluation happens before AS path length, origin, or MED are ever considered --- network engineers commonly use local preference specifically to steer outbound traffic leaving the autonomous system toward a preferred exit peer or upstream provider, by assigning a higher local preference to routes learned from that preferred peer relative to routes learned from alternative peers, making the third statement correct as well. Local preference is explicitly excluded from advertisement to EBGP peers under the BGP specification; it is meaningful only within the boundaries of a single AS and is stripped before a route crosses an AS boundary outward, since a neighboring AS has no reason to trust or honor another organization's internal preference values. A local preference of 0 does not have any special 'drop' semantics in BGP --- it is simply the lowest possible numeric preference value and is treated like any other value during comparison, not as a discard instruction. Reference topics: Junos Enterprise Routing -- BGP, Local Preference Defaults and Outbound Traffic Engineering.

The Backup Designated Router exists specifically to provide immediate failover redundancy for the Designated Router role on a multi-access broadcast or NBMA segment: the BDR maintains full adjacencies with every other router on the segment concurrently with the DR, precisely so that if the DR ever fails or is withdrawn, the BDR can be promoted directly to DR essentially instantaneously, without needing to wait through a fresh, full DR/BDR election process, and a new BDR election then takes place separately among the remaining DROther routers to fill the now-vacant backup role. This immediate promotion behavior confirms the first statement as correct. The Designated Router's other core responsibility on the segment is originating the Type 2 Network LSA, which describes the multi-access network itself as a pseudonode, listing every router attached to that segment; this LSA type exists specifically to avoid the full-mesh explosion of Router LSA adjacency listings that would otherwise be needed to describe a shared broadcast segment, and only the DR --- never the BDR, and never any DROther --- is responsible for generating and maintaining this particular LSA under normal, stable conditions, which confirms the third statement while directly ruling out the fourth. There is no such thing as the DR 'electing' an area border router; ABR status is instead a role a router acquires organically by having interfaces in more than one OSPF area, entirely independent of any DR/BDR election process on any individual segment. Reference topics: Junos Enterprise Routing -- OSPF, DR/BDR Roles and Type 2 Network LSA Origination.