Free JN0-460 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The EVPN control plane, which utilizes Multiprotocol BGP (MP-BGP), is responsible for learning and distributing endpoint (host) reachability information across the network. When a leaf device learns the MAC address of a locally connected host, it advertises this information to other VTEPs using an EVPN Type 2 (MAC/IP Advertisement) route. This same route type can also carry the host's IP address, which is learned via mechanisms like ARP snooping. This control plane learning and distribution of MAC and IP addresses eliminates the need for traditional data-plane flood-and-learn mechanisms and enables more efficient forwarding and features like ARP suppression.

A. The control plane encapsulates the traffic.

This is incorrect. Encapsulation of Ethernet frames into VXLAN packets is a data plane function performed by the VTEP's forwarding hardware.

D. The control plane rewrites the destination MAC address of the packet.

This is incorrect. Packet header modification, such as rewriting a MAC address for routing, is a data plane forwarding operation.

1. Juniper Networks TechLibrary, "Understanding EVPN with VXLAN Data Plane Encapsulation": In the "Control Plane: BGP" section, it states, "The control plane is responsible for MAC address learning and advertising... EVPN enables the control plane to learn and advertise not only the MAC addresses of the end devices, but also their IP addresses." This directly supports options B and C. The document also clarifies that VXLAN is the data plane encapsulation, which refutes option A.

2. Juniper Networks TechLibrary, "EVPN Type 2 Routes: MAC/IP Advertisement Route": This document specifies that the Type 2 route "advertises the MAC addresses of the hosts that are connected to a PE device... This route type can also optionally carry the IP address associated with the MAC address." This confirms that learning and advertising both MAC and IP addresses are functions of the EVPN control plane.

3. Juniper Networks Day One+ Guide, "Data Center Deployment with EVPN/VXLAN": In Chapter 2, "EVPN/VXLAN Fundamentals," the guide distinguishes between the control plane and data plane. It explains, "The control plane is responsible for exchanging reachability information between VTEPs... The data plane is responsible for encapsulating and decapsulating traffic." This clearly separates the control plane's role (learning/advertising) from the data plane's role (encapsulation, rewriting), refuting options A and D.

The Link Layer Discovery Protocol (LLDP) is an IEEE 802.1AB standard protocol used by network devices to advertise their identity and capabilities to neighboring devices on a local network.

One limitation is that LLDP must be explicitly configured and enabled on network infrastructure, such as Juniper switches, for it to operate. If it is not enabled on a specific port or globally, no discovery will occur.

Another fundamental limitation is its operational scope. LLDP functions only between directly connected devices. The LLDP data units (LLDPDUs) are link-local and are not forwarded by switches, meaning a device can only learn about its immediate neighbors, not devices further away in the topology.

B. LLDP is highly scalable because its traffic is confined to individual links and is not flooded or routed throughout the network.

D. This statement is false. While many network infrastructure devices support LLDP, a large number of end-client devices (e.g., laptops, PCs) do not.

1. Juniper Networks TechLibrary, "Understanding LLDP and LLDP-MED on EX Series Switches": This document explicitly states, "LLDP is a link-layer protocol that allows network devices to advertise their capabilities to their directly connected neighbors." This supports option C. The document also provides configuration examples, such as set protocols lldp interface ge-0/0/0, demonstrating that LLDP must be actively configured, which supports option A.

2. Juniper Mist Documentation, "Third-Party Switches": In the section for integrating non-Juniper switches, the documentation lists "Enable LLDP on all switch ports that connect to Mist APs and other switches" as a requirement for network visibility. This confirms that LLDP is a feature that requires explicit configuration (supporting option A).

3. IEEE Std 802.1AB-2016, "IEEE Standard for Local and metropolitan area networks - Station and Media Access Control Connectivity Discovery": Section 7.1, "LLDP architecture," describes the protocol's operation between adjacent systems on the same IEEE 802 LAN. The scope is inherently limited to a single physical link, which validates the "directly connected devices" limitation (supporting option C).

In a centrally-routed bridging (CRB) fabric the access switches only bridge; all Layer-3 first-hop gateway interfaces (SVIs/IRB) reside on the centralized VTEPs in the distribution (or core) tier.

Edge-routed bridging (ERB) moves both the VTEP and the SVI/IRB to the access leaf switches so that routing is performed at the edge. Therefore, when migrating from CRB to ERB, the default-gateway for every VLAN is relocated from the distribution layer to the access layer.

A. from access to distribution – CRB→ERB moves gateway toward the edge, not toward the distribution layer.

B. from distribution to core – Gateway already central; ERB does not push it further inward.

D. from core to distribution – Still centralised; ERB explicitly places gateway on edge access switches.

1. Juniper Networks, “EVPN-VXLAN Campus Fabric Design Guide,” Rev. 2023-04, Section “CRB vs. ERB,” pp. 7-10.

2. Juniper TechLibrary, “Understanding Campus Fabric Edge-Routed Bridging,” Junos OS Documentation, §‘First-hop gateway location’.

3. Juniper Day One Guide “Deploying Campus Fabrics with EVPN-VXLAN,” Ch. 2, pp. 18-21 (“In ERB the IRB interface is instantiated on the access-layer switch, unlike CRB where it is on the distribution/core device”).

In an EVPN-VXLAN fabric, the VXLAN Tunnel End Point (VTEP) is the functional entity responsible for data plane operations. Its primary role is to encapsulate Layer 2 Ethernet frames from a source endpoint into VXLAN packets, which are then transported over the Layer 3 IP underlay network. At the receiving end, the destination VTEP de-encapsulates the VXLAN packet to retrieve the original Ethernet frame and forwards it to the destination endpoint. This process allows for the extension of Layer 2 segments over a Layer 3 infrastructure, which is fundamental to the operation of a campus fabric.

A. VLAN: A VLAN is a Layer 2 broadcast domain. Traffic from a VLAN is the payload that gets encapsulated into a VXLAN packet, but the VLAN itself does not perform the encapsulation.

C. EVPN route reflector: This is a control plane component. It uses BGP to distribute EVPN reachability information (MAC and IP addresses) between VTEPs, but it does not handle data plane traffic or perform encapsulation.

D. GBP tag: A Group-Based Policy (GBP) tag is a metadata field carried within the VXLAN header to enable micro-segmentation and policy enforcement. It is part of the encapsulated data, not the component performing the encapsulation.

1. Juniper Networks TechLibrary, EVPN-VXLAN Campus Fabric: Core-Distribution. (2023). In the "Campus Fabric Overview" section, it states, "The access switches act as VXLAN tunnel endpoints (VTEPs) and are responsible for encapsulating and de-encapsulating VXLAN traffic."

2. Juniper Networks TechLibrary, Understanding EVPN with VXLAN Data Plane Encapsulation. (2023). Under the "VXLAN" section, it defines the VTEP: "A VTEP is a device that is capable of VXLAN encapsulation and de-encapsulation. Each VTEP has an IP interface with an IP address on the transport IP network."

3. Juniper Networks Day One+ Guide, Deploying a Campus Fabric with EVPN-VXLAN. (2023). In Chapter 2, "Campus Fabric Architecture," the role of the VTEP is described as the device that "encapsulates Ethernet frames in VXLAN packets and de-encapsulates VXLAN packets to Ethernet frames." The guide also clarifies the role of the route reflector as a control plane element.

For a greenfield deployment, Juniper Mist provides several flexible methods to onboard switches. The Juniper Mist AI mobile application can be used to scan the QR code on a switch, which contains the unique claim code, to add it to an organization's inventory. For large-scale deployments, an entire purchase order can be linked to the Mist organization, automatically populating the inventory with all associated devices. Additionally, the comprehensive Mist API allows for programmatic and automated onboarding of switches, which is highly efficient for new, large-scale site rollouts.

A. The serial number is a device identifier but is not used as the primary input for the initial claiming process in the Mist portal or app; the claim/activation code is required.

E. The system MAC address is used for device identification and communication on the network, but it is not the primary credential used to claim a new switch into a Mist organization.

1. Juniper Mist Documentation, "Onboard a Switch to Your Organization": This document explicitly lists the valid methods for claiming a switch: "You can claim a switch by using one of the following methods: Activation Code, QR Code, Purchase Order." This directly supports options B and C. The document also mentions the API as a method for automation. (Source: Juniper Networks TechLibrary, Mist Wired Assurance section).

2. Juniper Mist Documentation, "Claim Switches by Purchase Order": This guide details the procedure for linking a Juniper sales order to a Mist organization. It states, "You can claim switches by using the purchase order (PO) that you used to buy the switches... When you claim switches by using a PO, all the switches in that PO are automatically assigned to your organization." This validates option C as a bulk onboarding method ideal for greenfield sites. (Source: Juniper Networks TechLibrary, Mist Wired Assurance section).

3. Juniper Mist API Documentation: The official API documentation outlines the endpoints available for managing an organization's inventory. Specifically, the POST /api/v1/orgs/{orgid}/inventory endpoint allows for programmatically adding devices to the inventory using their activation codes. This confirms that the API can be used to automate the provisioning and onboarding process, supporting option D. (Source: api.mist.com, Official Juniper Mist API Documentation, Org Inventory Operations).

The Juniper Mist platform can forward various event types, including audits, alarms, and access point (AP) events, to an external server. For integration with a standard log collector or a Security Information and Event Management (SIEM) system, the designated feature is Remote Syslog. This feature allows an administrator to configure a destination syslog server's IP address and port, enabling the Mist cloud to stream event messages in a standardized format, which is the primary function of a log collector.

B. webhooks: While Mist webhooks can also send event notifications, they use HTTP POST requests with a JSON payload, typically for integration with applications like Slack or custom automation scripts, not standard log collectors.

C. NETCONF: NETCONF is a network management protocol used for configuring and monitoring network devices. It is not used for streaming general event logs to a collector.

D. SNMP traps: SNMP traps are used to send asynchronous alerts about specific, critical events (e.g., an AP going offline) to a Network Management System (NMS), not for streaming a broad range of event messages.

1. Juniper Mist Documentation, "Remote Syslog": "Mist provides the ability to stream specific event types to a customer’s remote Syslog server. The supported events are: Audits, Alarms, AP Events, and Client Events." This document explicitly details the feature for sending events to a log collector. (Accessed via the Juniper Mist Cloud UI Help section under Organization > Site Configuration).

2. Juniper Mist Documentation, "Webhooks": "Mist can send event information to a 3rd party server via HTTP post. These events include alarms, audit logs, device events, and location updates." This source confirms webhooks send event data but via HTTP, which is distinct from the syslog protocol expected by a traditional log collector. (Accessed via the Juniper Mist Cloud UI Help section under Organization > Site Configuration).

3. Juniper TechLibrary, "Mist APIs": The documentation on Mist APIs describes the use of Webhooks for real-time notifications and API polling for data, but designates syslog as the streaming mechanism for logs. This distinction clarifies the intended purpose of each feature. (Reference: Mist API Documentation section on Webhooks).

Dynamic Port Configuration (DPC) in the Juniper Mist cloud allows administrators to automatically apply a specific port configuration based on the attributes of the device connecting to a switch port. The configuration process requires two fundamental steps: first, specifying which ports on the switch will be enabled for dynamic configuration. Second, creating rules that define the device-matching criteria (e.g., LLDP information) and selecting the corresponding Port Profile (Configuration Profile) that should be applied to the port when a match occurs. This automates port provisioning for devices like access points, phones, and cameras.

B. Define the polling frequency for DPC.

DPC is an event-driven feature, typically triggered by link-up events and LLDP/CDP advertisements from a connected device, not by a configurable polling mechanism.

D. Define the minimum Junos version.

While a minimum Junos version is required for the feature to function, it is a system prerequisite, not a configurable parameter within the DPC policy itself.

1. Juniper Mist Documentation, "Dynamic Port Configuration": This official guide outlines the configuration steps. It explicitly states, "Select the ports on which you would like to enable Dynamic Configuration" and "In the rule configuration, select the Port Profile that client devices will be assigned to when matching the rule." This directly supports answers C and A, respectively. The document makes no mention of configuring a polling frequency or a Junos version within the DPC rule.

Source: Juniper Mist Cloud Documentation, available under the "Switches" section. (Direct link cannot be provided as it's within the authenticated Mist portal, but the public-facing documentation mirrors this process).

2. Juniper Networks, "Juniper Mist Wired Assurance Feature Guide", Section: Port Profiles: This guide details the use of Port Profiles, which are the core component applied by DPC. It explains that Port Profiles are applied to ports either statically or dynamically. The dynamic application is achieved through DPC, which requires associating these profiles with rules and applying them to a selection of ports.

Source: Juniper Networks Technical Documentation, specific guides for Mist Wired Assurance. The process described confirms that selecting a profile (A) and assigning it to ports (C) are the essential actions.

For a Juniper cloud-ready switch to connect to the Juniper Mist Cloud, it must be able to resolve the Mist cloud's fully qualified domain names (FQDNs) to IP addresses, which necessitates connectivity to a DNS server. Additionally, the switch requires outbound network access to the Mist cloud. It primarily attempts to establish a secure connection over TCP port 2200 for the Juniper Message Bus (JMB), and if that fails, it falls back to using a WebSockets connection over TCP port 443. These two conditions—DNS resolution and appropriate outbound port access—are fundamental prerequisites for successful onboarding and management.

A. The minimum required Junos OS version varies by switch model and is typically much lower than 23.2. For example, some EX models are supported with versions as early as 18.x.

C. Licensing for Mist-managed devices is handled within the Juniper Mist portal itself. The switch does not need a direct connection to the Juniper Agile Licensing Portal for its operation.

1. Juniper Mist Documentation, "Juniper Mist Ports and IP Addresses for Firewall Configuration": This document explicitly states, "Juniper devices (APs, switches, and routers) connect to the Juniper Mist cloud over TCP port 443 or TCP port 2200." This directly supports answer B.

2. Juniper Mist Documentation, "Bring Your Juniper Switch into the Mist Cloud": In the "Before You Begin" section, a key prerequisite is listed: "Ensure that the switch can resolve hostnames to IP addresses. You can use a DNS server or static DNS entries for this." This directly supports answer D.

3. Juniper Mist Documentation, "Supported EX Series Switches": This page details the minimum Junos OS versions required for each switch model to be managed by Mist. The versions listed (e.g., 18.2R1 for EX2300, 20.4R2 for EX4400) demonstrate that version 23.2 is not a universal minimum requirement, invalidating option A.

The Mist platform uses several heuristics to automatically determine a switch's uplink port for topology mapping and network insights. Two primary methods are analyzing Spanning Tree Protocol (STP) roles and traffic volume. The STP root port is, by definition, the port with the best path to the root bridge, making it a logical uplink. Additionally, Mist analyzes traffic statistics; a port with significantly higher transmit (TX) and receive (RX) byte counts compared to other ports is presumed to be an uplink, as it aggregates traffic from access ports.

B. MTU size is a Layer 2 configuration that is not a reliable indicator of a port's topological role; both access and uplink ports can be configured with jumbo frames.

D. Port descriptions are user-configured, arbitrary text strings. Mist's automated discovery algorithms do not parse these descriptions to determine port roles.

1. Juniper Mist Documentation, "View Switch Details": In the section describing the switch topology view, the documentation states, "Mist automatically detects the uplink ports on your switches by using heuristics such as Link Layer Discovery Protocol (LLDP), Spanning Tree Protocol (STP) information, and traffic patterns." This directly supports that STP role (C) and traffic volume (A) are used.

2. Juniper Mist, "Wired Assurance Feature Guide": This guide details the mechanisms for monitoring and managing wired networks. In the chapter on "Network Insights and Topology," it explains that the topology is constructed using data collected from the switches, including STP state and port statistics, to infer relationships between network devices. The port with the STP root role and/or the highest traffic utilization is identified as the uplink.

Marvis is Juniper's AI-driven Virtual Network Assistant (VNA). To activate the Marvis engine, including its conversational interface, proactive anomaly detection, and AI-driven troubleshooting capabilities, the "Virtual Network Assistant" subscription is required. This subscription serves as the foundation for Marvis functionality. While other assurance subscriptions like Wired or Wi-Fi Assurance provide the necessary data for Marvis to analyze, the VNA subscription is what explicitly enables the service itself.

A. Access Assurance: This subscription provides cloud-native Network Access Control (NAC) for secure network onboarding and policy enforcement, which is a separate function from the Marvis AI engine.

B. IoT Assurance: This subscription is specifically for the management, security, and location services of IoT and Bluetooth Low Energy (BLE) devices.

D. Wired Assurance: This subscription enables cloud management and service level expectations (SLEs) for Juniper EX Series switches. Marvis uses this data, but the VNA subscription is required to activate Marvis.

1. Juniper Mist Cloud Services Subscriptions Datasheet: "The Marvis Virtual Network Assistant (VNA) subscription is required to enable the Marvis VNA service. It is a prerequisite for Marvis for Wired, Marvis for WAN, and Marvis for Minis." (Juniper Networks, "Juniper Mist Cloud Services Subscriptions Datasheet", Page 3, "Marvis Virtual Network Assistant" section).

2. Juniper Mist Marvis Actions Datasheet: "A subscription to Marvis is required to see the full Marvis Actions dashboard..." This document consistently refers to the service enabled by the VNA subscription. (Juniper Networks, "Marvis Actions Datasheet", Page 1).

In an EVPN-VXLAN fabric, Broadcast, Unknown Unicast, and Multicast (BUM) traffic must be replicated and forwarded to all relevant Virtual Tunnel Endpoints (VTEPs) within a given Virtual Network Identifier (VNI). There are two primary methods to achieve this.

1. Ingress Replication (IR): The ingress VTEP, upon receiving a BUM frame, replicates the packet and sends a separate unicast VXLAN-encapsulated copy to every other VTEP participating in the same VNI. The list of remote VTEPs is learned via the BGP EVPN control plane using Type-3 (Inclusive Multicast Ethernet Tag) routes.

2. Underlay Replication (Multicast): The ingress VTEP sends a single copy of the BUM packet encapsulated in a VXLAN packet destined for a multicast group address. The IP underlay network, configured with a multicast routing protocol like PIM, handles the replication and forwarding of this packet to all VTEPs that have joined the multicast group for that VNI.

A. Use static routes: Static routes are used for Layer 3 unicast IP forwarding and are not a mechanism for handling multi-destination Layer 2 BUM traffic in an EVPN fabric.

B. Use BGP neighborship: BGP is the control plane protocol used to exchange EVPN route information, which enables BUM forwarding mechanisms like ingress replication, but it is not the data plane forwarding method itself.

1. Juniper Networks TechLibrary, "Understanding EVPN with VXLAN Data Plane Encapsulation": This document explicitly outlines the methods for BUM traffic handling. In the "BUM Traffic Handling" section, it states, "To handle BUM traffic, VTEPs can use ingress replication or PIM-based multicast in the underlay." This directly supports both ingress replication (C) and underlay replication (D).

2. Juniper Networks TechLibrary, "EVPN-VXLAN Multicast": This guide details the use of PIM in the underlay. The overview section explains, "You can configure Protocol Independent Multicast (PIM) in an Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) fabric to enable multicast traffic to be forwarded efficiently through the fabric." This validates underlay replication (D).

3. Juniper Networks TechLibrary, "Example: Configuring EVPN-VXLAN with Ingress Replication": This configuration example demonstrates the setup for ingress replication, confirming it as a standard method. The "Overview" section states, "This example shows how to configure an EVPN-VXLAN fabric where ingress replication is used to forward BUM traffic." This validates ingress replication (C).

4. RFC 7432: BGP MPLS-Based Ethernet VPN: This foundational IETF standard describes the mechanisms. Section 8.3, "Inclusive Multicast Ethernet Tag Route," details the control plane signaling used to build the flood list for ingress replication. Section 11, "P-Tunnel Types for Inclusive Multicast," describes using underlay multicast (e.g., PIM-SM) for BUM traffic.

Group-Based Policy (GBP) is a micro-segmentation feature used to logically group endpoints with similar functions or security postures. The primary goal is to apply security policies to these groups (tags) rather than individual IP addresses. By assigning GBP tags based on endpoint type (e.g., 'IoT-Devices', 'Corporate-Laptops', 'Guest-Users'), an administrator can create scalable policies to control traffic flow and effectively isolate different types of devices from each other within the same VRF, fulfilling the scenario's requirement.

A. Assign a separate GBP tag to each endpoint.

This approach is not scalable and defeats the purpose of "group-based" policy, creating an unmanageable administrative overhead.

C. Assign GBP tags based on endpoint location.

While location can be a policy attribute, GBP's primary function is logical segmentation based on role or type, not physical location.

D. Assign a single GBP tag to all endpoints.

This would place all endpoints into one group, providing no segmentation or isolation, which is the opposite of the stated goal.

---

1. Juniper Mist Documentation, "Microsegmentation Using Group-Based Policies": This document explicitly states, "You can use group-based policies to segment traffic based on user or device groups instead of IP addresses. For example, you can create groups such as Students, Faculty, and IoT devices, and then create policies to permit or deny traffic between these groups." This directly supports assigning tags based on endpoint type. (Source: Juniper Networks TechLibrary, Mist Wired Assurance documentation).

2. Juniper Mist Documentation, "Campus Fabric IP Clos Deployment Guide": In the "Microsegmentation and Macro-segmentation" section, the guide explains that GBP provides micro-segmentation within a VRF. It describes creating policies between groups of users/devices, reinforcing the concept of grouping by type or role for policy enforcement. (Source: Juniper Networks TechLibrary, Campus Fabric Deployment Guides).

The Juniper Mist platform operates on a hierarchical configuration model. Settings configured at a more specific level (Site) take precedence over settings from a more general level (Organization Template). In this scenario, because the WLAN and its policy are explicitly configured at the Site A level, this configuration will override the settings for the same WLAN within the organization-level template applied to Site A. Therefore, the policy created at the site level is the one that will be enforced.

A. The policy from the organization-level template is overridden by the more specific site-level configuration and will not be the one that is executed.

B. Organization-level configuration templates can be applied to individual sites, multiple selected sites, or site groups, not exclusively to site groups.

D. The core function of an organization-level template is to be applied to specific sites or groups of sites, which are explicitly selected during template configuration.

1. Juniper Mist Documentation, "Use Configuration Templates": In the section detailing configuration hierarchy, it states, "Mist has a configuration hierarchy. You can configure settings at the Organization level and at the Site level. Site-level settings override Organization-level settings. For example, if you enable a specific band in a template and disable it at the site level, the site-level setting (disabled) takes precedence." This directly supports the principle that site-level configurations are executed over template-level ones.

2. Juniper Learning Portal, JNCIA-MistAI Courseware, "Module 3: Mist Configuration Basics": This module explains the object hierarchy (Organization > Site). It details that templates are created at the organization level to provide a baseline configuration for multiple sites, but any configuration made directly on a site object will override the template settings for that specific site. This confirms that the site-level policy is the effective one.

3. Juniper TechLibrary, "Mist Cloud—An Introduction to the Cloud-Native Platform": This document outlines the architectural design, which includes the hierarchical management structure. It explains that this structure allows for both broad, consistent policy application via organization-level templates and granular, site-specific exceptions and configurations, with the latter taking precedence.

The Post-Install role, also known as the Installer role within the Juniper Mist platform, is a limited-privilege account designed specifically for personnel responsible for the physical deployment of hardware. Users with this role can perform tasks essential for bringing new devices online, such as claiming Access Points (APs) and switches into an organization's inventory, assigning those devices to a specific site, and placing them on a floorplan map. This role is intentionally restricted and does not have access to broader network configuration, monitoring dashboards, or troubleshooting workflows, ensuring a secure separation of duties.

A. It is used for help-desk monitoring and workflow for all sites.

This describes the Helpdesk role, which is focused on monitoring client status and performing basic troubleshooting, not device installation.

C. It has read-only access to all sites.

This describes the Observer role, which can view configurations and analytics but cannot make any changes, including installing new devices.

D. It has full access to all sites.

This describes the Administrator or Super User role, which has comprehensive privileges to configure, manage, and monitor the entire site or organization.

1. Juniper Mist Documentation, "Administrator Roles": The documentation explicitly defines the "Installer" role (functionally equivalent to "Post-Install"). It states, "The Installer role has privileges to install and provision new devices. For example, an Installer can claim APs and Switches, assign devices to a site, and place APs on a floorplan." This directly supports the function described in the correct answer. (Found in the Juniper Mist Cloud UI documentation under Organization > Administrators).

2. Juniper Networks, "Mist Cloud Administration Guide": In the section on Role-Based Access Control (RBAC), the guide details the different predefined roles. The Installer role is characterized by its limited scope, focusing solely on the actions required to add and place new hardware, which aligns with option B.

EVPN uses Multi-Protocol BGP (MP-BGP) to advertise reachability information. To handle overlapping address spaces from different sites or tenants, EVPN utilizes a Route Distinguisher (RD). The RD is a 64-bit value that is prepended to each customer route (e.g., 172.16.1.0/24), creating a globally unique VPN route within the service provider's network. For example, Site 1's route becomes RD1:172.16.1.0/24 and Site 2's becomes RD2:172.16.1.0/24. This ensures that BGP can carry and differentiate between these identical prefixes, maintaining traffic separation for each site.

A. It elects a designated forwarder.

Incorrect. Designated Forwarder (DF) election is a mechanism used in EVPN multihoming scenarios to prevent forwarding loops and manage traffic flow to a multihomed customer device.

B. It uses a Layer 2 gateway.

Incorrect. A Layer 2 gateway (like a PE router) is the device that implements the EVPN functions, but it is not the mechanism itself that prevents address overlap.

D. It uses an Ethernet segment identifier (ESI).

Incorrect. An ESI is used in multihoming to uniquely identify a customer's Ethernet segment. It is critical for fast convergence and mass route withdrawal, not for resolving IP address conflicts.

---

1. Juniper Networks Documentation, "Understanding EVPN with VXLAN Data Plane Encapsulation": In the section "MAC-VRF Routing Instance," it states, "A unique route distinguisher (RD) is required for each MAC-VRF instance on a PE router. The RD is used to differentiate MAC addresses that might be the same across different tenants." This directly confirms the RD's role in handling overlapping addresses.

Source: Juniper Networks TechLibrary, Data Center, EVPN-VXLAN.

2. Juniper Networks Documentation, "EVPN-VXLAN Overview": This document explains, "To distinguish customer routes, EVPN uses the route distinguisher (RD) BGP extended community attribute, which is a unique value for each virtual routing and forwarding (VRF) instance."

Source: Juniper Networks TechLibrary, Technology, Routing, EVPN.

3. RFC 7432: BGP MPLS-Based Ethernet VPN, Section 7. "MAC/IP Advertisement Route": "The RD MUST be a unique value per MAC-VRF on a PE. The purpose of the RD is to allow for overlapping MAC addresses and overlapping IP addresses to be used in different tenants."

Source: IETF RFC 7432, Page 11.

4. Juniper Networks Documentation, "EVPN Multihoming Overview": This document clarifies the roles of ESI and DF election: "In a multihomed EVPN network, the PE routers connected to the same Ethernet segment participate in a designated forwarder (DF) election process... An Ethernet segment identifier (ESI) is a 10-octet value that uniquely identifies an Ethernet segment." This distinguishes their function from that of an RD.

Source: Juniper Networks TechLibrary, Technology, Routing, EVPN.