Latest [Mar 24, 2026] JN0-351 Exam Questions – Valid JN0-351 Dumps Pdf
JN0-351 Practice Test Questions Answers Updated 109 Questions
Juniper JN0-351 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 22
Click the Exhibit button.
Which statement concerning Bidirectional Forwarding Detection (BFD) is true for the configuration shown in the exhibit?
- A. The link 1o neighbor 192.168.100.2 is not using BFD.
- B. The effective interval for neighbor 172.30.1.2 is 500 ms.
- C. The minimum-interval must match on both ends.
- D. The effective interval for neighbor 192.168.100.2 is 500 ms.
Answer: C
NEW QUESTION # 23
You want to ensure traffic is routed through a GRE tunnel. In this scenario, which two statements will satisfy this requirement? (Choose two.)
- A. All intermediary devices must have a route to the tunnel endpoints.
- B. BFD must be used on the stateless tunneling protocols.
- C. Tunnel endpoints must have a route that directs traffic into the tunnel.
- D. Keepalives must be used on stateless tunneling protocols.
Answer: A,C
Explanation:
Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.
Option B is correct. All intermediary devices must have a route to the tunnel endpoints. In real- world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.
NEW QUESTION # 24
Referring to the exhibit, which two configuration changes must you apply for packets to reach from R1 to R3 using IS-IS? (Choose two.)
- A. On R1, disable Level 2 on the ge-0/0/1 interface.
- B. On R3 enable Level 1 on the ge-0/0/4 interface
- C. On R3 disable Level 2 on the ge-0/0/4 interface.
- D. On R1, enable Level 1 on the ge-0/0/1 interface.
Answer: B,D
Explanation:
A) On R1, enable Level 1 on the ge-0/0/1 interface. In IS-IS, both levels (Level 1 and Level 2) are enabled by default when you enable IS-IS on an interface1. Level 1 systems route within an area.
If the destination is outside an area, Level 1 systems route toward a Level 2 system. Therefore, enabling Level 1 on the ge-0/0/1 interface on R1 would allow packets to reach from R1 to R3.
D) On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge-0/0/4 interface on R3 would allow packets to reach from R1 to R3. These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks1 and Cisco.
NEW QUESTION # 25
You are concerned about spoofed MAC addresses on your LAN. Which two Layer 2 security features should you enable to minimize this concern? (Choose two.)
- A. IP source guard
- B. dynamic ARP inspection
- C. DHCP snooping
- D. static ARP
Answer: B,C
Explanation:
A is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping. DAI discards any ARP packets that do not match the database or have invalid formats. C is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted. Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports. DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client.
NEW QUESTION # 26
Which three statements are correct about OSPF packet types? (Choose three.)
- A. Link-state update packets contain one or more LSAs.
- B. Link-state acknowledgment packets are sent every 30 seconds.
- C. Hello packets are sent every 30 seconds by default.
- D. Database description packets are used during the adjacency formation process.
- E. Link-state request packets are sent after receiving an LSA header not in the OSPF database.
Answer: A,D,E
NEW QUESTION # 27
Which statement is correct about the storm control feature?
- A. The storm control feature is enabled in the factory-default configuration on EX Series switches.
- B. The storm control feature requires a special license on EX Series switches.
- C. The storm control feature is not supported on aggregate Ethernet interfaces.
- D. The storm control configuration only applies to traffic being sent between the forwarding and control plane.
Answer: A
Explanation:
* Option A is correct. The storm control feature is enabled in the factory-default configuration on EX Series switches 1 2 . On EX2200, EX3200, EX3300, EX4200, and EX6200 switches, the factory default configuration enables storm control for broadcast and unknown unicast traffic on all switch interfaces 2 . On EX4300 switches, the factory default configuration enables storm control on all Layer
2 switch interfaces 1 .
* Option B is incorrect. The storm control feature does not require a special license on EX Series switches 3 4 .
* Option C is incorrect. There's no information available that suggests the storm control feature is not supported on aggregate Ethernet interfaces.
* Option D is incorrect. The storm control configuration applies to traffic at the ingress of an interface 5 , not just between the forwarding and control plane.
NEW QUESTION # 28
What is the default hello interval on an OSPF interface?
- A. 20 seconds
- B. 30 seconds
- C. 60 seconds
- D. 10 seconds
Answer: D
Explanation:
The default hello interval on an OSPF interface depends on the network type of the interface. For point-to- point and broadcast network types, the default hello interval is 10 seconds. For non-broadcast and point-to- multipoint network types, the default hello interval is 30 seconds. The hello interval is the time between sending hello packets to establish and maintain neighbor adjacencies. The hello interval can be configured manually on each interface using the ip ospf hello-interval command. References:
* OSPF Hello and Dead Interval - NetworkLessons.com
* OSPF Hello and Dead Interval: Operation and Configuration
* Adjusting OSPF Timers - Cisco IOS Cookbook, 2nd Edition
* ospf timer hello - WLAN AC V200R010C00 Command Reference - Huawei
* OSPF Timers - Hello and Dead Intervals - Packet Lab
NEW QUESTION # 29
Click the Exhibit button.
Which two statements about the firewall filter terms shown in the exhibit are true? (Choose two.)
- A. All traffic not matching the from statement in term one is accepted by term two.
- B. Traffic that matches the from statement in term one is discarded.
- C. Traffic that matches the from statement in term one is accepted.
- D. Traffic matching the from statement in term two is logged.
Answer: A,C
Explanation:
A firewall filter is a Junos security solution to filter or control traffic at the data plane as they enter or exit an interface 1 . A firewall filter consists of one or more terms, each with a set of conditions and actions 2 . The device evaluates every packet against the firewall filter terms in the order they are defined, and performs the actions specified in the first term that matches the packet 3 . If no term matches the packet, the device discards the packet by default 3 .
In the exhibit, the firewall filter mac-address is applied to the family ethernet-switching and involves filtering MAC addresses. There are two terms, term one and term two , each with different conditions and actions. The from statement specifies the match conditions, and the then statement specifies the actions. If the from statement is omitted, all packets are considered to match and the actions in the then statement are taken 2 . If the then statement is omitted, the packets that match the conditions in the from statement are accepted by default 2 .
* Term one logs traffic from a specific source MAC address 88:05:00:29:3c:de/48 . The log action is a nonterminating action, which means that the device continues to evaluate the packet against the remaining terms in the filter 2 . Therefore, traffic that matches the from statement in term one is not discarded, and option A is incorrect.
* Term two accepts all other traffic not specified in term one. The then accept action is a terminating action, which means that the device stops evaluating the packet against the filter and forwards the packet 2 . Therefore, all traffic not matching the from statement in term one is accepted by term two, and option D is correct.
* Term two does not have a from statement, which means that all packets are considered to match this term. Therefore, traffic matching the from statement in term two is not logged, and option B is incorrect.
* Term one does not have a then statement other than the log action, which means that the packets that match the from statement are accepted by default. Therefore, traffic that matches the from statement in term one is accepted, and option C is correct.
References:
2 : term (Firewall Filter)
3 : Firewall Filters Overview
1 : Juniper Firewall Filter Configuration Example
NEW QUESTION # 30
Which statement is correct about the IS-IS ISO NET address?
- A. An ISO NET address must be unique for each device in the network.
- B. An ISO NET address defined with a system ID of 0000.0000.0000 must be selected as the DIS.
- C. You can only define a single ISO NET address per device.
- D. The Area ID must match on all devices within a L2 area.
Answer: A
Explanation:
An ISO NET address is a type of network address used by the IS-IS routing protocol. It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP).
An ISO NET address consists of three parts: an area ID, a system ID, and a selector. The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area. The selector identifies a specific service or function on the device, such as routing or management.
An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths. If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.
NEW QUESTION # 31
Which two multicast IP addresses are used for link-state update packets? (Choose two.)
- A. 224.0.0.5
- B. 224.0.0.9
- C. 224.0.0.6
- D. 224.0.0.10
Answer: A,C
Explanation:
Link-state update packets are used to flood link-state advertisements (LSAs) among OSPF routers. The destination IP address of these packets depends on the network type and the state of the interface. On broadcast and point-to-point networks, OSPF uses two IP multicast addresses: 224.0.0.5 for all OSPF routers and 224.0.0.6 for all designated routers (DRs) and backup designated routers (BDRs)12. If the interface state is DR or BDR, the link-state update packets are sent to 224.0.0.5. Otherwise, they are sent to 224.0.0.63. On non-broadcast networks, such as Frame Relay or ATM, link-state update packets are sent as unicasts to each adjacent neighbor3. Therefore, the correct answer is A and D. References: Understanding OSPF Areas | Junos OS, How OSPF Works - IP Routing [Book] - O'Reilly Media, Link state packet - Wikipedia
NEW QUESTION # 32
You are attempting to set up VRRP with R1 and R2 being participating members. You want R1 to be the master router and R2 to be the backup router with the virtual router they create being at address 172.25.100.1. The virtual router is not pinging from either User A or User B. Referring to the exhibit, what must be done to correct the problem?
- A. A VRRP policy is needed on R1 and R2.
- B. The VRRP group value on R1 and R2 must match.
- C. A VRRP authentication type value is needed on R1 and R2.
- D. The VRRP priority value on R1 and R2 must match.
Answer: B
NEW QUESTION # 33
What does the MAC limiting feature do on EX Series switches?
- A. It limits the number of MAC addresses learned on an access port.
- B. It limits the number of MAC addresses learned on a trunk port.
- C. It limits the acceptable values for a MAC address to a specified range.
- D. It limits the time a learned MAC address stays in the MAC routing table.
Answer: A
Explanation:
MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch's default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface.
Additionally, you can configure specific "allowed" MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:
[EX] How to control MAC address access through Junos OS for EX Series switches1 Configuring MAC Limiting2 Understanding MAC Limiting and MAC Move Limiting3
NEW QUESTION # 34
After receiving a BGP route, which two conditions are verified by the receiving router to ensure that the received route is valid? (Choose two)
- A. The loops do not exist.
- B. The next hop is reachable.
- C. The local preference is greater than 0.
- D. The AS-path length is greater than 0.
Answer: A,B
Explanation:
B is correct because the loops do not exist is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid. A loop in BGP means that a route has been advertised by the same AS more than once, which can cause routing instability and inefficiency1. To prevent loops, BGP uses the AS-path attribute, which lists the AS numbers that a route has traversed from the origin to the destination2. The receiving router checks the AS-path attribute of the received route and discards it if it finds its own AS number in the list2. This way, BGP avoids accepting routes that contain loops.
C is correct because the next hop is reachable is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid. The next hop is the IP address of the next router that is used to forward packets to the destination network3. The receiving router checks the next hop attribute of the received route and verifies that it has a valid route to reach it3. If the next hop is not reachable, the received route is not usable and is rejected by the receiving router3. This way, BGP ensures that only feasible routes are accepted.
NEW QUESTION # 35
You are troubleshooting a BGP routing issue between your network and a customer router and are reviewing the BGP routing policies. Which two statements are correct in this scenario?
(Choose two.)
- A. Import policies are applied to routes in the RIB-Local table.
- B. Export policies are applied to routes in the RIB-ln table.
- C. Import policies are applied after the RIB-ln table.
- D. Export policies are applied after the RIB-Local table.
Answer: C,D
Explanation:
In BGP, routing policies are used to control the flow of routing information between BGP peers.
Option C suggests that import policies are applied after the RIB-In table. This is correct because import policies in BGP are applied to routes that are received from a BGP peer, before they are installed in the local BGP Routing Information Base (RIB-In). The RIB-In is a database that stores all the routes that are received from all peers.
Option D suggests that export policies are applied after the RIB-Local table. This is correct because export policies in BGP are applied to routes that are being advertised to a BGP peer, after they have been selected from the local BGP Routing Information Base (RIB-Local). The RIB-Local is a database that stores all the routes that the local router is using.
NEW QUESTION # 36
Which three actions are required for filter-based forwarding? (Choose three.)
- A. Create a forwarding option for load balancing.
- B. Create routing policies for source addresses.
- C. Create a firewall filter to match desired traffic.
- D. Create routing instances for individual destinations.
- E. Create a RIB group for next-hop entries.
Answer: B,C,E
NEW QUESTION # 37
What does the * indicate in the output shown in the exhibit?
- A. The interface is active.
- B. The switch ports have a router attached.
- C. All interfaces have elected a root bridge.
- D. The interface is down.
Answer: A
Explanation:
The exhibit shows the output of the command show vlans brief, which displays brief information about VLANs and their associated interfaces.
The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging. The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic. This can be verified by the command show interfaces terse, which displays the status of the interfaces.
NEW QUESTION # 38
......
JN0-351 dumps Sure Practice with 109 Questions: https://www.actualtestsit.com/Juniper/JN0-351-exam-prep-dumps.html
Get New JN0-351 Certification – Valid Exam Dumps Questions: https://drive.google.com/open?id=1WWnAZ5Ns92dDEEv2vR1fiF8v8pI-oLw2