JN0-351 Exam Dumps - Enterprise Routing and Switching Specialist (JNCIS-ENT)

The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the  voice VLAN 1 2 .

The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs 1 2 .  This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority 1 2 . Therefore, option D is correct.

The bridging table is a data structure that stores the MAC addresses and the associated interface details and MAC learned time for each MAC address. The bridging table is used by the switch to forward frames based on the destination MAC address. The ether type details and the preamble of Ethernet packet are not stored in the bridging table, as they are not relevant for the switching process. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

The maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation is 1476 bytes 1 .  This is because GRE packets are formed by the addition of the original packets and the required GRE headers 1 .  These headers are 24-bytes in length and since these headers are added to the original frame, depending on the original size of the packet we may run into IP MTU problems 1 .  The most common IP MTU is 1500-bytes in length (Ethernet) 1 .  When the tunnel is created, it deducts the 24-bytes it needs to encapsulate the passenger protocols and that is the IP MTU it will use 1 .  For example, if we are forming a tunnel over FastEthernet (IP MTU 1500) the IOS calculates the IP MTU on the tunnel as: 1500-bytes from Ethernet - 24-bytes for the GRE encapsulation = 1476-Bytes 1 .

The default MAC age-out timer on an EX Series switch is 300 seconds 1 2 .  The MAC age-out timer is the maximum time that an entry can remain in the MAC table before it “ages out,” or is removed 3 1 .  This configuration can influence efficiency of network resource use by affecting the amount of traffic that is flooded to all interfaces 1 .  When traffic is received for MAC addresses no longer in the Ethernet routing table, the router floods the traffic to all interfaces 1 .

A tunnel is a connection between two computer networks, in which data is sent from one network to another through an encrypted link. Tunnels are commonly used to secure data communications between two networks or to connect two networks that use different protocols.

Option B is correct, because tunnel endpoints must have a valid route to the remote tunnel endpoint. A tunnel endpoint is the device that initiates or terminates a tunnel connection. For a tunnel to be established, both endpoints must be able to reach each other over the underlying network.  This means that they must have a valid route to the IP address of the remote endpoint 1 .

Option D is correct, because tunnels add additional overhead to packet size. Tunnels work by encapsulating packets: wrapping packets inside of other packets. This means that the original packet becomes the payload of the surrounding packet, and the surrounding packet has its own header and trailer. The header and trailer of the surrounding packet add extra bytes to the packet size, which is called overhead.  Overhead can reduce the efficiency and performance of a network, as it consumes more bandwidth and processing power 2 .

Option A is incorrect, because BFD can be used to monitor tunnels. BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster convergence and fault recovery. BFD can also be used to monitor the connectivity of tunnels, such as GRE, IPsec, or MPLS.

Option C is incorrect, because IP-IP tunnels are stateless. IP-IP tunnels are a type of tunnels that use IP as both the encapsulating and encapsulated protocol. IP-IP tunnels are simple and easy to configure, but they do not provide any security or authentication features. IP-IP tunnels are stateless, which means that they do not keep track of the state or status of the tunnel connection. Stateless tunnels do not require any signaling or negotiation between the endpoints, but they also do not provide any error detection or recovery mechanisms.

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .