Free Juniper JN0-352 Practice Test Questions and Answers (2026)

Firewall filters in Junos OS must be applied in the correct direction (input or output) relative to the traffic flow on the interface. To block traffic entering a switch port, the filter must be explicitly applied in the input direction. If the filter is mistakenly applied in the output direction, it will only evaluate traffic leaving the port, allowing the ingress traffic from the specified MAC address to pass through the switch unaffected.

B: Junos OS allows MAC addresses to be specified without an explicit mask in firewall filters, defaulting to an exact match (/48).

C: Layer 2 firewall filters can be applied to both access and trunk ports; the port mode does not prevent the filter from evaluating traffic.

D: Firewall filters configured under the ethernet-switching family fully support matching on both source and destination MAC addresses.

1. Juniper Networks, "Junos OS Routing Policies, Firewall Filters, and Traffic Policers User Guide," Section: Applying Firewall Filters to Layer 2 Interfaces, 2023.

2. Juniper Networks TechLibrary, "Configuring Firewall Filters for Port, VLAN, and Router Interfaces," 2023.

3. Juniper Networks, "EX Series Switch Software Features," Section: Ethernet-Switching Firewall Filters Overview.

A BGP Notification message is used to signal a fatal error condition to a BGP peer. When a BGP speaker sends or receives a Notification message, it immediately terminates the BGP session and removes all associated routing entries. The message contains an Error Code and an Error Subcode that explicitly report the specific reason for the error and the subsequent session closure.

A: This describes a BGP UPDATE message, which is used to advertise or withdraw routes while keeping the session active.

D: This describes a BGP Route Refresh message, which requests a re-advertisement of routes without tearing down the session.

- RFC 4271, "A Border Gateway Protocol 4 (BGP-4)", Section 4.5 (NOTIFICATION Message Format) and Section 6.7 (Notification processing). https://doi.org/10.17487/RFC4271

- Juniper Networks TechLibrary, "BGP Message Types" (Understanding BGP Messages).

Based on standard Junos OS IS-IS operational outputs (such as show isis interface), loopback interfaces (e.g., lo0.0) are typically configured as passive. A passive interface in IS-IS advertises its IP address into the routing domain but does not send or receive IS-IS hello packets, meaning it does not form adjacencies. Furthermore, if a physical interface like ge-0/0/2.0 is configured specifically for Level 1 only (or has Level 2 explicitly disabled in the output), it is restricted to Level 1 operations and cannot establish a Level 2 adjacency with a neighbor.

A. A Designated Intermediate System (DIS) is only elected on broadcast network types (like Ethernet LANs), not on point-to-point interfaces.

C. Loopback interfaces are logical, virtual interfaces configured as passive; they do not transmit hello packets and therefore cannot establish IS-IS adjacencies.

- Juniper Networks, "Junos OS Routing Protocols Library," Release 21.4, Chapter: IS-IS Configuration, Section: Configuring Passive Interfaces.

- Juniper Networks, "IS-IS User Guide," Section: Understanding IS-IS Adjacencies and Levels.

The route metric for OSPF-learned routes can be viewed in the routing table with show route protocol ospf, where Junos displays OSPF routes and their metric values. It can also be viewed from the OSPF routing table using show ospf route intra, which displays intra-area OSPF routes and their associated cost. The OSPF database and interface commands show LSA/interface information, not the selected route’s routing-table metric in the same direct way.

C. show ospf database extensive displays LSDB/LSA details; it is not the direct command for viewing the installed route metric.

D. show ospf interface shows interface-level OSPF information such as interface cost, not the metric assigned to a specific route.

- Juniper Networks, Junos OS CLI Reference, show route protocol command, “Output fields”; shows protocol-learned routes with route preference and metric.

- Juniper Networks, Junos OS CLI Reference, show ospf route command, options including intra; output includes destination, route type, next hop, and cost.

- Juniper Networks, Junos OS CLI Reference, show ospf database extensive command; describes displaying OSPF link-state database/LSA contents.

- Juniper Networks, Junos OS CLI Reference, show ospf interface command; output fields include interface state, area, neighbors, and interface cost.

By default in VRRP, only the router that is the IP address owner (where the physical interface IP matches the Virtual IP) will respond to ICMP echo requests (pings) destined for the VIP. If a router is acting as the VRRP master but is not the IP address owner, it drops these packets. To allow a non-owner VRRP master to respond to ICMP requests sent to the VIP, the accept-data configuration statement must be applied to the VRRP group configuration.

Option A is incorrect because the track command is used to monitor interfaces or routes to dynamically adjust VRRP priority, not to accept traffic.

Option C is incorrect because advertise-interval changes the frequency of VRRP hello packets, which does not affect ICMP processing.

Option D is incorrect because no-preempt prevents a higher-priority router from taking over the master role, which is unrelated to responding to pings.

- Juniper Networks, "Junos OS High Availability User Guide," Configuring VRRP to Accept Data, Document ID: Release 23.4.

- RFC 5798, "Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6", Section 6.4.3.

In Junos OS, when multiple firewall filters are applied to a packet traversing a switch, they are processed in a specific hierarchical order. For ingress (Rx) traffic, the switch processes Port (PACL), then VLAN (VACL), and finally Router (RACL) filters. For egress (Tx) traffic, the order is reversed: Router (RACL), then VLAN (VACL), and finally Port (PACL) filters. Therefore, the complete processing sequence for a routed packet encountering all possible filters is Rx-Port, Rx-VLAN, Rx-Router, Tx-Router, Tx-VLAN, and Tx-Port.

B. This option omits the Tx-Router filter, which is processed first on the egress path before the Tx-VLAN filter.

C. This option completely omits the Router (RACL) filters, which are necessary for routed traffic between different subnets.

D. This option omits the VLAN (VACL) filters, which are processed between Port and Router filters.

- Juniper Networks, "Junos OS Routing Policies, Firewall Filters, and Traffic Policers User Guide," Understanding the Order of Firewall Filters Applied to a Packet. Section: Filter Processing Order.

IS-IS (Intermediate System to Intermediate System) is a link-state Interior Gateway Protocol (IGP) designed to route traffic within a single autonomous system (AS). In the IS-IS two-level hierarchical architecture, Level 1 (L1) routers perform intra-area routing, while Level 2 (L2) routers perform inter-area routing. Routers configured as Level 1/Level 2 (L1/L2) maintain both L1 and L2 link-state databases, allowing them to connect L1 areas to the L2 backbone and route traffic between different IS-IS areas.

B: IS-IS Level 1 routers only possess knowledge of their own area and route traffic strictly intra-area.

C: In Junos OS, the default route preference is 15 for IS-IS Level 1 routes and 18 for Level 2 routes, not 20.

1. Juniper Networks, "Understanding IS-IS Routing," Junos OS Routing Protocols Library, Section: IS-IS Levels and Areas.

2. Juniper Networks, "Default Route Preferences," Junos OS Routing Policies, Multipath, and Filters Library, Table 1: Default Route Preferences.

3. ISO/IEC 10589:2002, "Intermediate System to Intermediate System intra-domain routeing information exchange protocol," Section 7.

To enable communication between devices in different VLANs (such as VLAN 5 and VLAN 7), inter-VLAN routing must be configured. On Juniper EX Series switches, this is achieved by creating an Integrated Routing and Bridging (IRB) interface for each VLAN. By assigning an IP address to each IRB interface, the switch acts as the default gateway for the devices in those VLANs. The switch's routing engine then routes traffic between the connected IRB subnets at Layer 3.

A. Secondary addressing on a single interface does not provide the necessary Layer 3 separation and routing between distinct Layer 2 broadcast domains (VLANs).

B. Spanning Tree Protocol (STP) is a Layer 2 loop prevention mechanism and cannot route traffic between different VLANs.

C. A trunk port carries multiple VLANs at Layer 2, but without a Layer 3 routing mechanism, devices in different VLANs cannot communicate.

- Juniper Networks, "Junos OS Ethernet Switching User Guide," Inter-VLAN Routing Overview, Section: Configuring IRB Interfaces.

- Juniper Networks TechLibrary, "Understanding Integrated Routing and Bridging," Document ID: Junos OS Release 21.4.

When storm control is configured on a Juniper EX Series switch with an action to shut down an interface upon exceeding the specified bandwidth limit, the interface is placed in an error-disabled state to protect the network from broadcast storms. To manually clear this violation and restore the interface to an operational state before the automatic recovery timer expires, the administrator must use the clear ethernet-switching recovery-timeout command.

A. Incorrect because this command clears dynamically learned MAC addresses from the forwarding table, which does not recover an error-disabled port.

B. Incorrect because this command resets interface traffic counters and statistics, but does not re-enable a port shut down by storm control.

C. Incorrect because this command clears the system log messages buffer, which has no effect on interface operational states.

1. Juniper Networks. "Junos OS Command Reference." Section: clear ethernet-switching recovery-timeout.

2. Juniper Networks. "Layer 2 Switching and Ethernet Switching User Guide." Section: Configuring Storm Control and Port Error Recovery.

Generic Routing Encapsulation (GRE) adds a total of 24 bytes of overhead to the original payload packet. This encapsulation consists of a 20-byte outer IPv4 delivery header (used to route the packet across the transit network) and a 4-byte standard GRE header (which identifies the passenger protocol). This additional 24-byte overhead must be carefully considered when configuring the Maximum Transmission Unit (MTU) and Maximum Segment Size (MSS) to prevent unintended packet fragmentation or dropped frames.

A: 12 bytes is incorrect because it does not account for the full size of the required IPv4 and GRE headers.

B: 32 bytes is incorrect; standard GRE without additional optional extensions (like key or sequence numbers) is exactly 24 bytes.

D: 20 bytes only accounts for the outer IPv4 delivery header, completely omitting the mandatory 4-byte GRE header.

1. Juniper Networks, "Junos OS Services Interfaces Library," Section: GRE Tunnel Overview and MTU Considerations, 2023.

2. RFC 2784, "Generic Routing Encapsulation (GRE)," Section 2 (Structure and Header Formats), https://doi.org/10.17487/RFC2784.

3. RFC 7676, "IPv6 Support for Generic Routing Encapsulation (GRE)," Section 3.