Free JNCIE-DC Practice Questions

Question 1

Leaf A and Leaf B attach one server through an all-active EVPN LAG with a shared ESI. A is the DF for the server's VLAN. A remote flow to the server's known MAC passes through B. A broadcast from the fabric reaches the server through A and is suppressed by B. Both links are healthy. An engineer proposes removing B's unicast next hop. How should the forwarding behavior be assessed?

Accepted Answer

Keep both unicast next hops; DF selection limits duplicate BUM delivery.

Answer

Remove B's unicast next hop; only the DF can reach that segment.

Answer

Give the leaves different ESIs; their forwarding roles indicate separate segments.

Answer

Make both leaves DFs; each active LAG member must forward broadcasts.

Question 2

A leaf port designated for a single server has been shut down by BPDU protection. A technician confirms that an unapproved bridge was inserted between the server and the leaf, with a second cable creating another Layer 2 path into the production network. Clearing the port's BPDU error once caused it to trip again. Other server ports and the fabric routing adjacencies remain healthy. Service restoration is urgent. Which response best contains the fault while preparing to restore the affected server?

Accepted Answer

Keep the port isolated, remove the bridge and extra cable, then reconnect the server directly before clearing the BPDU error.

Answer

Replace shutdown protection with root protection on the affected port, then restore forwarding while the bridge remains connected.

Answer

Configure BPDU drop-only behavior on the affected port, removing its spanning-tree configuration as required, then restore data forwarding.

Answer

Disable the tenant VLAN throughout the fabric, clear the port error, and leave the bridge connected until maintenance.

Question 3

A vMX running Junos 20.4 receives two EBGP paths to a remote VTEP through spines in AS 65101 and AS 65102. Both paths are accepted, their next hops resolve, and all other BGP multipath criteria match. The UNDERLAY group has multipath enabled, and the forwarding-table load-balancing policy is already applied. Only one next hop is installed. The separate spine ASNs must be retained. Which change removes the remaining eligibility restriction?

Accepted Answer

Add multiple-as to multipath under the UNDERLAY BGP group.

Answer

Split the spine peers into separate BGP groups, each with multipath enabled.

Answer

Give the less-used path a higher LOCAL_PREF through import policy.

Answer

Have one spine prepend its own ASN once to its advertised AS path.

Question 4

A DCI design review requires tenant aggregates to cross an IPv4 WAN in EVPN/VXLAN while host MAC tables and Layer 2 broadcasts remain local to each site. One Junos site uses Apstra 5.1.0; the other is controllerless. Both already originate their approved aggregates and support interface-less Type 5 forwarding. VTEP reachability, tenant L3 VNIs, and route-target policies are compatible. Apstra must generate its site's configuration without configlets. Select the design that preserves this service boundary.

Accepted Answer

Use native Remote EVPN Gateway settings for Type 5-only tenant exchange; keep Layer 2 virtual networks local.

Answer

Extend the Layer 2 virtual networks through native Remote EVPN Gateway settings, using Type 2 advertisements with ARP suppression.

Answer

Export tenant aggregates through WAN-facing IPv4 underlay BGP, preserving local Layer 2 networks and omitting tenant EVPN peering.

Answer

Use a scoped Apstra configlet for Type 5-only gateway peering, while keeping Layer 2 virtual networks local.

Question 5

A server's untunneled IPv4 unicast test flow carries DSCP 46 at both leaf ingress and fabric egress. The active ingress BA classifier maps 46 to latency, and the verified forwarding-class configuration maps latency to queue 5 and bulk to queue 2. A multifield filter is also attached on ingress; this platform supports BA followed by multifield classification. During a test with no other traffic, queue 2's transmitted-packet count rises with the flow while queue 5's count remains unchanged. No policer or DSCP rewrite is configured. Which fault best explains why increasing queue 5's service allocation did not improve this flow?

Accepted Answer

An ingress multifield term assigns the bulk forwarding class after BA classification without changing the DSCP.

Answer

The bulk scheduler is mapped to the latency class, causing the scheduler map to change latency's assigned queue number.

Answer

The latency scheduler has too little bandwidth, so packets assigned to queue 5 are being moved into queue 2.

Answer

The egress interface needs an EF rewrite rule before its scheduler can recognize packets that were classified as latency.

Question 6

Leaf A and external router B protect their BGP adjacency with asynchronous BFD. They advertise these parameters:

A: Desired Min TX 100 ms; Required Min RX 200 ms; Detect Multiplier 5.
B: Desired Min TX 300 ms; Required Min RX 100 ms; Detect Multiplier 4.

Both endpoints must detect a lost peer in less than 1,000 ms. The session is stable, timer adaptation is inactive, and the proposed settings are supported. Which single adjustment brings both nominal detection timeouts within the requirement?

Accepted Answer

Reduce B's advertised Detect Multiplier from 4 to 3.

Answer

Reduce A's advertised Detect Multiplier from 5 to 3.

Answer

Reduce A's advertised Required Min RX from 200 ms to 100 ms.

Answer

Reduce A's advertised Desired Min TX from 100 ms to 50 ms.

Question 7

A tenant uses asymmetric IRB. A host in VLAN 110 (VNI 10110) sends to a different subnet in VLAN 220 (VNI 10220) on a remote leaf. Both subnets belong to one VRF; both VLANs are instantiated at ingress, and the destination MAC/IP binding and remote VTEP route are valid. Which VNI and egress action should the engineer expect for this inter-subnet packet?

Accepted Answer

VNI 10220, followed by bridging to the host at the egress leaf.

Answer

VNI 10110, followed by routing into VLAN 220 at the egress leaf.

Answer

VNI 10220, followed by routing into VLAN 220 at the egress leaf.

Answer

VNI 10110, followed by bridging to the host at the egress leaf.

Question 8

An underlay audit finds a leaf advertising its connected tenant subnet, 10.60.8.0/24. Only its VTEP loopback, 10.255.8.8/32, may be advertised; the tenant subnet must remain reachable locally. Both routes are active direct routes. The BGP export policy is:

term DIRECT { from { protocol direct; } then accept; }
term VTEP { from { route-filter 10.255.8.8/32 exact; } then accept; }
term END { then reject; }

Which single edit enforces the advertisement restriction?

Accepted Answer

Delete the DIRECT term.

Answer

Apply this policy as BGP import instead.

Answer

Move term VTEP ahead of term DIRECT.

Answer

Move term END between DIRECT and VTEP.

Question 9

A new storage uplink changes operational state five times in 60 seconds, yet Apstra 5.1.0 reports no flapping anomaly. The probe selects links tagged storage-critical and triggers above three changes in that interval. Raw telemetry is current, but the uplink is absent from the probe's selected-interface list and output. Previously tagged links still appear; storage-critical exists in the catalog. Monitoring must remain limited to those critical links. What restores coverage of the new uplink?

Accepted Answer

Assign storage-critical to the new uplink's link object and commit the blueprint change.

Answer

Lower the existing probe's state-change threshold while retaining its current tag selection.

Answer

Create another probe with the same tag selection and the same state-change threshold.

Answer

Replace the probe's link selector with a selection covering every interface on the leaf.

Question 10

Traffic from an unmanaged peer reaches a controllerless VXLAN stitching gateway. The peer's tenant MAC/IP advertisement shows MAC label 9100 and route target target:65071:6100. A capture shows the affected packet arriving from that peer with UDP destination 4789, VXLAN VNI 7100, and inner VLAN 110. The advertised route target is imported, and tunnel endpoints are reachable. Which incoming service context should the engineer inspect?

Accepted Answer

VNI 7100, taken from the received VXLAN header.

Answer

VNI 9100, as identified by the peer's advertised MAC label.

Answer

VNI 6100, as identified by the imported route-target suffix.

Answer

VNI 110, as identified by the encapsulated frame's VLAN tag.

Free JNCIE-DC Practice Questions

Domain 1: Layer 3 Underlay

Question 1

Question 2

Domain 2: Overlay

Question 3

Question 4

Domain 3: Data Center Interconnect (DCI)

Question 5

Question 6

Domain 4: Security

Question 7

Domain 5: Class of Service (CoS)

Question 8

Domain 6: Management

Question 9

Question 10

That's 10 of 1,030