The EVPN control plane, which utilizes Multiprotocol BGP (MP-BGP), is responsible for learning and distributing endpoint (host) reachability information across the network. When a leaf device learns the MAC address of a locally connected host, it advertises this information to other VTEPs using an EVPN Type 2 (MAC/IP Advertisement) route. This same route type can also carry the host's IP address, which is learned via mechanisms like ARP snooping. This control plane learning and distribution of MAC and IP addresses eliminates the need for traditional data-plane flood-and-learn mechanisms and enables more efficient forwarding and features like ARP suppression.

A. The control plane encapsulates the traffic.

This is incorrect. Encapsulation of Ethernet frames into VXLAN packets is a data plane function performed by the VTEP's forwarding hardware.

D. The control plane rewrites the destination MAC address of the packet.

This is incorrect. Packet header modification, such as rewriting a MAC address for routing, is a data plane forwarding operation.

1. Juniper Networks TechLibrary, "Understanding EVPN with VXLAN Data Plane Encapsulation": In the "Control Plane: BGP" section, it states, "The control plane is responsible for MAC address learning and advertising... EVPN enables the control plane to learn and advertise not only the MAC addresses of the end devices, but also their IP addresses." This directly supports options B and C. The document also clarifies that VXLAN is the data plane encapsulation, which refutes option A.

2. Juniper Networks TechLibrary, "EVPN Type 2 Routes: MAC/IP Advertisement Route": This document specifies that the Type 2 route "advertises the MAC addresses of the hosts that are connected to a PE device... This route type can also optionally carry the IP address associated with the MAC address." This confirms that learning and advertising both MAC and IP addresses are functions of the EVPN control plane.

3. Juniper Networks Day One+ Guide, "Data Center Deployment with EVPN/VXLAN": In Chapter 2, "EVPN/VXLAN Fundamentals," the guide distinguishes between the control plane and data plane. It explains, "The control plane is responsible for exchanging reachability information between VTEPs... The data plane is responsible for encapsulating and decapsulating traffic." This clearly separates the control plane's role (learning/advertising) from the data plane's role (encapsulation, rewriting), refuting options A and D.

The Link Layer Discovery Protocol (LLDP) is an IEEE 802.1AB standard protocol used by network devices to advertise their identity and capabilities to neighboring devices on a local network.

One limitation is that LLDP must be explicitly configured and enabled on network infrastructure, such as Juniper switches, for it to operate. If it is not enabled on a specific port or globally, no discovery will occur.

Another fundamental limitation is its operational scope. LLDP functions only between directly connected devices. The LLDP data units (LLDPDUs) are link-local and are not forwarded by switches, meaning a device can only learn about its immediate neighbors, not devices further away in the topology.

B. LLDP is highly scalable because its traffic is confined to individual links and is not flooded or routed throughout the network.

D. This statement is false. While many network infrastructure devices support LLDP, a large number of end-client devices (e.g., laptops, PCs) do not.

1. Juniper Networks TechLibrary, "Understanding LLDP and LLDP-MED on EX Series Switches": This document explicitly states, "LLDP is a link-layer protocol that allows network devices to advertise their capabilities to their directly connected neighbors." This supports option C. The document also provides configuration examples, such as set protocols lldp interface ge-0/0/0, demonstrating that LLDP must be actively configured, which supports option A.

2. Juniper Mist Documentation, "Third-Party Switches": In the section for integrating non-Juniper switches, the documentation lists "Enable LLDP on all switch ports that connect to Mist APs and other switches" as a requirement for network visibility. This confirms that LLDP is a feature that requires explicit configuration (supporting option A).

3. IEEE Std 802.1AB-2016, "IEEE Standard for Local and metropolitan area networks - Station and Media Access Control Connectivity Discovery": Section 7.1, "LLDP architecture," describes the protocol's operation between adjacent systems on the same IEEE 802 LAN. The scope is inherently limited to a single physical link, which validates the "directly connected devices" limitation (supporting option C).

In a centrally-routed bridging (CRB) fabric the access switches only bridge; all Layer-3 first-hop gateway interfaces (SVIs/IRB) reside on the centralized VTEPs in the distribution (or core) tier.

Edge-routed bridging (ERB) moves both the VTEP and the SVI/IRB to the access leaf switches so that routing is performed at the edge. Therefore, when migrating from CRB to ERB, the default-gateway for every VLAN is relocated from the distribution layer to the access layer.

A. from access to distribution – CRB→ERB moves gateway toward the edge, not toward the distribution layer.

B. from distribution to core – Gateway already central; ERB does not push it further inward.

D. from core to distribution – Still centralised; ERB explicitly places gateway on edge access switches.

1. Juniper Networks, “EVPN-VXLAN Campus Fabric Design Guide,” Rev. 2023-04, Section “CRB vs. ERB,” pp. 7-10.

2. Juniper TechLibrary, “Understanding Campus Fabric Edge-Routed Bridging,” Junos OS Documentation, §‘First-hop gateway location’.

3. Juniper Day One Guide “Deploying Campus Fabrics with EVPN-VXLAN,” Ch. 2, pp. 18-21 (“In ERB the IRB interface is instantiated on the access-layer switch, unlike CRB where it is on the distribution/core device”).

In an EVPN-VXLAN fabric, the VXLAN Tunnel End Point (VTEP) is the functional entity responsible for data plane operations. Its primary role is to encapsulate Layer 2 Ethernet frames from a source endpoint into VXLAN packets, which are then transported over the Layer 3 IP underlay network. At the receiving end, the destination VTEP de-encapsulates the VXLAN packet to retrieve the original Ethernet frame and forwards it to the destination endpoint. This process allows for the extension of Layer 2 segments over a Layer 3 infrastructure, which is fundamental to the operation of a campus fabric.

A. VLAN: A VLAN is a Layer 2 broadcast domain. Traffic from a VLAN is the payload that gets encapsulated into a VXLAN packet, but the VLAN itself does not perform the encapsulation.

C. EVPN route reflector: This is a control plane component. It uses BGP to distribute EVPN reachability information (MAC and IP addresses) between VTEPs, but it does not handle data plane traffic or perform encapsulation.

D. GBP tag: A Group-Based Policy (GBP) tag is a metadata field carried within the VXLAN header to enable micro-segmentation and policy enforcement. It is part of the encapsulated data, not the component performing the encapsulation.

1. Juniper Networks TechLibrary, EVPN-VXLAN Campus Fabric: Core-Distribution. (2023). In the "Campus Fabric Overview" section, it states, "The access switches act as VXLAN tunnel endpoints (VTEPs) and are responsible for encapsulating and de-encapsulating VXLAN traffic."

2. Juniper Networks TechLibrary, Understanding EVPN with VXLAN Data Plane Encapsulation. (2023). Under the "VXLAN" section, it defines the VTEP: "A VTEP is a device that is capable of VXLAN encapsulation and de-encapsulation. Each VTEP has an IP interface with an IP address on the transport IP network."

3. Juniper Networks Day One+ Guide, Deploying a Campus Fabric with EVPN-VXLAN. (2023). In Chapter 2, "Campus Fabric Architecture," the role of the VTEP is described as the device that "encapsulates Ethernet frames in VXLAN packets and de-encapsulates VXLAN packets to Ethernet frames." The guide also clarifies the role of the route reflector as a control plane element.

For a greenfield deployment, Juniper Mist provides several flexible methods to onboard switches. The Juniper Mist AI mobile application can be used to scan the QR code on a switch, which contains the unique claim code, to add it to an organization's inventory. For large-scale deployments, an entire purchase order can be linked to the Mist organization, automatically populating the inventory with all associated devices. Additionally, the comprehensive Mist API allows for programmatic and automated onboarding of switches, which is highly efficient for new, large-scale site rollouts.

A. The serial number is a device identifier but is not used as the primary input for the initial claiming process in the Mist portal or app; the claim/activation code is required.

E. The system MAC address is used for device identification and communication on the network, but it is not the primary credential used to claim a new switch into a Mist organization.

1. Juniper Mist Documentation, "Onboard a Switch to Your Organization": This document explicitly lists the valid methods for claiming a switch: "You can claim a switch by using one of the following methods: Activation Code, QR Code, Purchase Order." This directly supports options B and C. The document also mentions the API as a method for automation. (Source: Juniper Networks TechLibrary, Mist Wired Assurance section).

2. Juniper Mist Documentation, "Claim Switches by Purchase Order": This guide details the procedure for linking a Juniper sales order to a Mist organization. It states, "You can claim switches by using the purchase order (PO) that you used to buy the switches... When you claim switches by using a PO, all the switches in that PO are automatically assigned to your organization." This validates option C as a bulk onboarding method ideal for greenfield sites. (Source: Juniper Networks TechLibrary, Mist Wired Assurance section).

3. Juniper Mist API Documentation: The official API documentation outlines the endpoints available for managing an organization's inventory. Specifically, the POST /api/v1/orgs/{orgid}/inventory endpoint allows for programmatically adding devices to the inventory using their activation codes. This confirms that the API can be used to automate the provisioning and onboarding process, supporting option D. (Source: api.mist.com, Official Juniper Mist API Documentation, Org Inventory Operations).

The Juniper Mist platform can forward various event types, including audits, alarms, and access point (AP) events, to an external server. For integration with a standard log collector or a Security Information and Event Management (SIEM) system, the designated feature is Remote Syslog. This feature allows an administrator to configure a destination syslog server's IP address and port, enabling the Mist cloud to stream event messages in a standardized format, which is the primary function of a log collector.

B. webhooks: While Mist webhooks can also send event notifications, they use HTTP POST requests with a JSON payload, typically for integration with applications like Slack or custom automation scripts, not standard log collectors.

C. NETCONF: NETCONF is a network management protocol used for configuring and monitoring network devices. It is not used for streaming general event logs to a collector.

D. SNMP traps: SNMP traps are used to send asynchronous alerts about specific, critical events (e.g., an AP going offline) to a Network Management System (NMS), not for streaming a broad range of event messages.

1. Juniper Mist Documentation, "Remote Syslog": "Mist provides the ability to stream specific event types to a customer’s remote Syslog server. The supported events are: Audits, Alarms, AP Events, and Client Events." This document explicitly details the feature for sending events to a log collector. (Accessed via the Juniper Mist Cloud UI Help section under Organization > Site Configuration).

2. Juniper Mist Documentation, "Webhooks": "Mist can send event information to a 3rd party server via HTTP post. These events include alarms, audit logs, device events, and location updates." This source confirms webhooks send event data but via HTTP, which is distinct from the syslog protocol expected by a traditional log collector. (Accessed via the Juniper Mist Cloud UI Help section under Organization > Site Configuration).

3. Juniper TechLibrary, "Mist APIs": The documentation on Mist APIs describes the use of Webhooks for real-time notifications and API polling for data, but designates syslog as the streaming mechanism for logs. This distinction clarifies the intended purpose of each feature. (Reference: Mist API Documentation section on Webhooks).

Dynamic Port Configuration (DPC) in the Juniper Mist cloud allows administrators to automatically apply a specific port configuration based on the attributes of the device connecting to a switch port. The configuration process requires two fundamental steps: first, specifying which ports on the switch will be enabled for dynamic configuration. Second, creating rules that define the device-matching criteria (e.g., LLDP information) and selecting the corresponding Port Profile (Configuration Profile) that should be applied to the port when a match occurs. This automates port provisioning for devices like access points, phones, and cameras.

B. Define the polling frequency for DPC.

DPC is an event-driven feature, typically triggered by link-up events and LLDP/CDP advertisements from a connected device, not by a configurable polling mechanism.

D. Define the minimum Junos version.

While a minimum Junos version is required for the feature to function, it is a system prerequisite, not a configurable parameter within the DPC policy itself.

1. Juniper Mist Documentation, "Dynamic Port Configuration": This official guide outlines the configuration steps. It explicitly states, "Select the ports on which you would like to enable Dynamic Configuration" and "In the rule configuration, select the Port Profile that client devices will be assigned to when matching the rule." This directly supports answers C and A, respectively. The document makes no mention of configuring a polling frequency or a Junos version within the DPC rule.

Source: Juniper Mist Cloud Documentation, available under the "Switches" section. (Direct link cannot be provided as it's within the authenticated Mist portal, but the public-facing documentation mirrors this process).

2. Juniper Networks, "Juniper Mist Wired Assurance Feature Guide", Section: Port Profiles: This guide details the use of Port Profiles, which are the core component applied by DPC. It explains that Port Profiles are applied to ports either statically or dynamically. The dynamic application is achieved through DPC, which requires associating these profiles with rules and applying them to a selection of ports.

Source: Juniper Networks Technical Documentation, specific guides for Mist Wired Assurance. The process described confirms that selecting a profile (A) and assigning it to ports (C) are the essential actions.

For a Juniper cloud-ready switch to connect to the Juniper Mist Cloud, it must be able to resolve the Mist cloud's fully qualified domain names (FQDNs) to IP addresses, which necessitates connectivity to a DNS server. Additionally, the switch requires outbound network access to the Mist cloud. It primarily attempts to establish a secure connection over TCP port 2200 for the Juniper Message Bus (JMB), and if that fails, it falls back to using a WebSockets connection over TCP port 443. These two conditions—DNS resolution and appropriate outbound port access—are fundamental prerequisites for successful onboarding and management.

A. The minimum required Junos OS version varies by switch model and is typically much lower than 23.2. For example, some EX models are supported with versions as early as 18.x.

C. Licensing for Mist-managed devices is handled within the Juniper Mist portal itself. The switch does not need a direct connection to the Juniper Agile Licensing Portal for its operation.

1. Juniper Mist Documentation, "Juniper Mist Ports and IP Addresses for Firewall Configuration": This document explicitly states, "Juniper devices (APs, switches, and routers) connect to the Juniper Mist cloud over TCP port 443 or TCP port 2200." This directly supports answer B.

2. Juniper Mist Documentation, "Bring Your Juniper Switch into the Mist Cloud": In the "Before You Begin" section, a key prerequisite is listed: "Ensure that the switch can resolve hostnames to IP addresses. You can use a DNS server or static DNS entries for this." This directly supports answer D.

3. Juniper Mist Documentation, "Supported EX Series Switches": This page details the minimum Junos OS versions required for each switch model to be managed by Mist. The versions listed (e.g., 18.2R1 for EX2300, 20.4R2 for EX4400) demonstrate that version 23.2 is not a universal minimum requirement, invalidating option A.

The Mist platform uses several heuristics to automatically determine a switch's uplink port for topology mapping and network insights. Two primary methods are analyzing Spanning Tree Protocol (STP) roles and traffic volume. The STP root port is, by definition, the port with the best path to the root bridge, making it a logical uplink. Additionally, Mist analyzes traffic statistics; a port with significantly higher transmit (TX) and receive (RX) byte counts compared to other ports is presumed to be an uplink, as it aggregates traffic from access ports.

B. MTU size is a Layer 2 configuration that is not a reliable indicator of a port's topological role; both access and uplink ports can be configured with jumbo frames.

D. Port descriptions are user-configured, arbitrary text strings. Mist's automated discovery algorithms do not parse these descriptions to determine port roles.

1. Juniper Mist Documentation, "View Switch Details": In the section describing the switch topology view, the documentation states, "Mist automatically detects the uplink ports on your switches by using heuristics such as Link Layer Discovery Protocol (LLDP), Spanning Tree Protocol (STP) information, and traffic patterns." This directly supports that STP role (C) and traffic volume (A) are used.

2. Juniper Mist, "Wired Assurance Feature Guide": This guide details the mechanisms for monitoring and managing wired networks. In the chapter on "Network Insights and Topology," it explains that the topology is constructed using data collected from the switches, including STP state and port statistics, to infer relationships between network devices. The port with the STP root role and/or the highest traffic utilization is identified as the uplink.

Marvis is Juniper's AI-driven Virtual Network Assistant (VNA). To activate the Marvis engine, including its conversational interface, proactive anomaly detection, and AI-driven troubleshooting capabilities, the "Virtual Network Assistant" subscription is required. This subscription serves as the foundation for Marvis functionality. While other assurance subscriptions like Wired or Wi-Fi Assurance provide the necessary data for Marvis to analyze, the VNA subscription is what explicitly enables the service itself.

A. Access Assurance: This subscription provides cloud-native Network Access Control (NAC) for secure network onboarding and policy enforcement, which is a separate function from the Marvis AI engine.

B. IoT Assurance: This subscription is specifically for the management, security, and location services of IoT and Bluetooth Low Energy (BLE) devices.

D. Wired Assurance: This subscription enables cloud management and service level expectations (SLEs) for Juniper EX Series switches. Marvis uses this data, but the VNA subscription is required to activate Marvis.

1. Juniper Mist Cloud Services Subscriptions Datasheet: "The Marvis Virtual Network Assistant (VNA) subscription is required to enable the Marvis VNA service. It is a prerequisite for Marvis for Wired, Marvis for WAN, and Marvis for Minis." (Juniper Networks, "Juniper Mist Cloud Services Subscriptions Datasheet", Page 3, "Marvis Virtual Network Assistant" section).

2. Juniper Mist Marvis Actions Datasheet: "A subscription to Marvis is required to see the full Marvis Actions dashboard..." This document consistently refers to the service enabled by the VNA subscription. (Juniper Networks, "Marvis Actions Datasheet", Page 1).