In an EVPN-VXLAN fabric, Broadcast, Unknown Unicast, and Multicast (BUM) traffic must be replicated and forwarded to all relevant Virtual Tunnel Endpoints (VTEPs) within a given Virtual Network Identifier (VNI). There are two primary methods to achieve this.

1. Ingress Replication (IR): The ingress VTEP, upon receiving a BUM frame, replicates the packet and sends a separate unicast VXLAN-encapsulated copy to every other VTEP participating in the same VNI. The list of remote VTEPs is learned via the BGP EVPN control plane using Type-3 (Inclusive Multicast Ethernet Tag) routes.

2. Underlay Replication (Multicast): The ingress VTEP sends a single copy of the BUM packet encapsulated in a VXLAN packet destined for a multicast group address. The IP underlay network, configured with a multicast routing protocol like PIM, handles the replication and forwarding of this packet to all VTEPs that have joined the multicast group for that VNI.

A. Use static routes: Static routes are used for Layer 3 unicast IP forwarding and are not a mechanism for handling multi-destination Layer 2 BUM traffic in an EVPN fabric.

B. Use BGP neighborship: BGP is the control plane protocol used to exchange EVPN route information, which enables BUM forwarding mechanisms like ingress replication, but it is not the data plane forwarding method itself.

1. Juniper Networks TechLibrary, "Understanding EVPN with VXLAN Data Plane Encapsulation": This document explicitly outlines the methods for BUM traffic handling. In the "BUM Traffic Handling" section, it states, "To handle BUM traffic, VTEPs can use ingress replication or PIM-based multicast in the underlay." This directly supports both ingress replication (C) and underlay replication (D).

2. Juniper Networks TechLibrary, "EVPN-VXLAN Multicast": This guide details the use of PIM in the underlay. The overview section explains, "You can configure Protocol Independent Multicast (PIM) in an Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) fabric to enable multicast traffic to be forwarded efficiently through the fabric." This validates underlay replication (D).

3. Juniper Networks TechLibrary, "Example: Configuring EVPN-VXLAN with Ingress Replication": This configuration example demonstrates the setup for ingress replication, confirming it as a standard method. The "Overview" section states, "This example shows how to configure an EVPN-VXLAN fabric where ingress replication is used to forward BUM traffic." This validates ingress replication (C).

4. RFC 7432: BGP MPLS-Based Ethernet VPN: This foundational IETF standard describes the mechanisms. Section 8.3, "Inclusive Multicast Ethernet Tag Route," details the control plane signaling used to build the flood list for ingress replication. Section 11, "P-Tunnel Types for Inclusive Multicast," describes using underlay multicast (e.g., PIM-SM) for BUM traffic.

Group-Based Policy (GBP) is a micro-segmentation feature used to logically group endpoints with similar functions or security postures. The primary goal is to apply security policies to these groups (tags) rather than individual IP addresses. By assigning GBP tags based on endpoint type (e.g., 'IoT-Devices', 'Corporate-Laptops', 'Guest-Users'), an administrator can create scalable policies to control traffic flow and effectively isolate different types of devices from each other within the same VRF, fulfilling the scenario's requirement.

A. Assign a separate GBP tag to each endpoint.

This approach is not scalable and defeats the purpose of "group-based" policy, creating an unmanageable administrative overhead.

C. Assign GBP tags based on endpoint location.

While location can be a policy attribute, GBP's primary function is logical segmentation based on role or type, not physical location.

D. Assign a single GBP tag to all endpoints.

This would place all endpoints into one group, providing no segmentation or isolation, which is the opposite of the stated goal.

---

1. Juniper Mist Documentation, "Microsegmentation Using Group-Based Policies": This document explicitly states, "You can use group-based policies to segment traffic based on user or device groups instead of IP addresses. For example, you can create groups such as Students, Faculty, and IoT devices, and then create policies to permit or deny traffic between these groups." This directly supports assigning tags based on endpoint type. (Source: Juniper Networks TechLibrary, Mist Wired Assurance documentation).

2. Juniper Mist Documentation, "Campus Fabric IP Clos Deployment Guide": In the "Microsegmentation and Macro-segmentation" section, the guide explains that GBP provides micro-segmentation within a VRF. It describes creating policies between groups of users/devices, reinforcing the concept of grouping by type or role for policy enforcement. (Source: Juniper Networks TechLibrary, Campus Fabric Deployment Guides).

The Juniper Mist platform operates on a hierarchical configuration model. Settings configured at a more specific level (Site) take precedence over settings from a more general level (Organization Template). In this scenario, because the WLAN and its policy are explicitly configured at the Site A level, this configuration will override the settings for the same WLAN within the organization-level template applied to Site A. Therefore, the policy created at the site level is the one that will be enforced.

A. The policy from the organization-level template is overridden by the more specific site-level configuration and will not be the one that is executed.

B. Organization-level configuration templates can be applied to individual sites, multiple selected sites, or site groups, not exclusively to site groups.

D. The core function of an organization-level template is to be applied to specific sites or groups of sites, which are explicitly selected during template configuration.

1. Juniper Mist Documentation, "Use Configuration Templates": In the section detailing configuration hierarchy, it states, "Mist has a configuration hierarchy. You can configure settings at the Organization level and at the Site level. Site-level settings override Organization-level settings. For example, if you enable a specific band in a template and disable it at the site level, the site-level setting (disabled) takes precedence." This directly supports the principle that site-level configurations are executed over template-level ones.

2. Juniper Learning Portal, JNCIA-MistAI Courseware, "Module 3: Mist Configuration Basics": This module explains the object hierarchy (Organization > Site). It details that templates are created at the organization level to provide a baseline configuration for multiple sites, but any configuration made directly on a site object will override the template settings for that specific site. This confirms that the site-level policy is the effective one.

3. Juniper TechLibrary, "Mist Cloud—An Introduction to the Cloud-Native Platform": This document outlines the architectural design, which includes the hierarchical management structure. It explains that this structure allows for both broad, consistent policy application via organization-level templates and granular, site-specific exceptions and configurations, with the latter taking precedence.

The Post-Install role, also known as the Installer role within the Juniper Mist platform, is a limited-privilege account designed specifically for personnel responsible for the physical deployment of hardware. Users with this role can perform tasks essential for bringing new devices online, such as claiming Access Points (APs) and switches into an organization's inventory, assigning those devices to a specific site, and placing them on a floorplan map. This role is intentionally restricted and does not have access to broader network configuration, monitoring dashboards, or troubleshooting workflows, ensuring a secure separation of duties.

A. It is used for help-desk monitoring and workflow for all sites.

This describes the Helpdesk role, which is focused on monitoring client status and performing basic troubleshooting, not device installation.

C. It has read-only access to all sites.

This describes the Observer role, which can view configurations and analytics but cannot make any changes, including installing new devices.

D. It has full access to all sites.

This describes the Administrator or Super User role, which has comprehensive privileges to configure, manage, and monitor the entire site or organization.

1. Juniper Mist Documentation, "Administrator Roles": The documentation explicitly defines the "Installer" role (functionally equivalent to "Post-Install"). It states, "The Installer role has privileges to install and provision new devices. For example, an Installer can claim APs and Switches, assign devices to a site, and place APs on a floorplan." This directly supports the function described in the correct answer. (Found in the Juniper Mist Cloud UI documentation under Organization > Administrators).

2. Juniper Networks, "Mist Cloud Administration Guide": In the section on Role-Based Access Control (RBAC), the guide details the different predefined roles. The Installer role is characterized by its limited scope, focusing solely on the actions required to add and place new hardware, which aligns with option B.

EVPN uses Multi-Protocol BGP (MP-BGP) to advertise reachability information. To handle overlapping address spaces from different sites or tenants, EVPN utilizes a Route Distinguisher (RD). The RD is a 64-bit value that is prepended to each customer route (e.g., 172.16.1.0/24), creating a globally unique VPN route within the service provider's network. For example, Site 1's route becomes RD1:172.16.1.0/24 and Site 2's becomes RD2:172.16.1.0/24. This ensures that BGP can carry and differentiate between these identical prefixes, maintaining traffic separation for each site.

A. It elects a designated forwarder.

Incorrect. Designated Forwarder (DF) election is a mechanism used in EVPN multihoming scenarios to prevent forwarding loops and manage traffic flow to a multihomed customer device.

B. It uses a Layer 2 gateway.

Incorrect. A Layer 2 gateway (like a PE router) is the device that implements the EVPN functions, but it is not the mechanism itself that prevents address overlap.

D. It uses an Ethernet segment identifier (ESI).

Incorrect. An ESI is used in multihoming to uniquely identify a customer's Ethernet segment. It is critical for fast convergence and mass route withdrawal, not for resolving IP address conflicts.

---

1. Juniper Networks Documentation, "Understanding EVPN with VXLAN Data Plane Encapsulation": In the section "MAC-VRF Routing Instance," it states, "A unique route distinguisher (RD) is required for each MAC-VRF instance on a PE router. The RD is used to differentiate MAC addresses that might be the same across different tenants." This directly confirms the RD's role in handling overlapping addresses.

Source: Juniper Networks TechLibrary, Data Center, EVPN-VXLAN.

2. Juniper Networks Documentation, "EVPN-VXLAN Overview": This document explains, "To distinguish customer routes, EVPN uses the route distinguisher (RD) BGP extended community attribute, which is a unique value for each virtual routing and forwarding (VRF) instance."

Source: Juniper Networks TechLibrary, Technology, Routing, EVPN.

3. RFC 7432: BGP MPLS-Based Ethernet VPN, Section 7. "MAC/IP Advertisement Route": "The RD MUST be a unique value per MAC-VRF on a PE. The purpose of the RD is to allow for overlapping MAC addresses and overlapping IP addresses to be used in different tenants."

Source: IETF RFC 7432, Page 11.

4. Juniper Networks Documentation, "EVPN Multihoming Overview": This document clarifies the roles of ESI and DF election: "In a multihomed EVPN network, the PE routers connected to the same Ethernet segment participate in a designated forwarder (DF) election process... An Ethernet segment identifier (ESI) is a 10-octet value that uniquely identifies an Ethernet segment." This distinguishes their function from that of an RD.

Source: Juniper Networks TechLibrary, Technology, Routing, EVPN.