2026年最新の有効なJN0-352テスト解答とJuniper試験PDF問題を試そう [Q27-Q51]

2026年最新の有効なJN0-352テスト解答とJuniper試験PDF問題を試そう

無料Juniper JN0-352試験問題と解答トレーニングを提供していますGoShiken

質問 # 27
Both the R1 and R2 devices are advertising prefix X into AS 65530 with the BGP attributes shown in the exhibit.

Which statement is correct in this scenario?

• A. R1's version of prefix X will be active because of the local preference attribute.
• B. R2's version of prefix X will be active because of the AS path attribute.
• C. R1's version of prefix X will be active because of the AS path attribute.
• D. R2's version of prefix X will be active because of the local preference attribute.

正解：B

質問 # 28
You are receiving multiple BGP routes from an upstream neighbor and only want to advertise a single summarized prefix to your internal OSPF neighbors. This route should only be advertised when you are receiving these BGP routes from this neighbor.
In this scenario, which type of route should you create?

• A. generate route
• B. static route using qualified next hops
• C. aggregate route
• D. static route using the resolve feature

正解：A

解説：
Both aggregate and generated routes would work, but the best choice is generated routes.
One key difference:
With aggregated routes any prefix in the routing table counts as a contributing route.
With generated routes only prefix with a valid next-hop qualifies.

質問 # 29
Referring to the exhibit, which two statements about BGP prefixes advertised by R1 to AS 65501 are true? (Choose two.)

• A. R1 will modify the AS path attribute in prefixes advertised to AS 65501
• B. R1 will modify the next-hop attribute in prefixes advertised to AS 65501
• C. R1 will modify the cluster list attribute in prefixes advertised to AS 65501
• D. R1 will modify the originator ID attribute in prefixes advertised to AS 65501

正解：B、D

質問 # 30
Referring to the output shown in the exhibit, which statement is correct?

• A. An MTU mismatch exists between the OSPF neighbors.
• B. An area ID mismatch exists between the OSPF neighbors
• C. The state is normal for a DR neighbor.
• D. The state is normal for a DRother neighbor

正解：D

解説：
In OSPF, the state of the neighbor relationship is determined by the exchange of OSPF packets between routers. The state "2Way" as shown in the exhibit indicates that bi-directional communication has been established between the two OSPF routers. This is the normal state for a neighbor that is not the Designated Router (DR) or Backup Designated Router (BDR) on a broadcast, non-broadcast multi-access (NBMA), or point-to-multipoint network. These neighbors are often referred to as "DRothers". Therefore, option B is correct.

質問 # 31
When trying to commit the configuration shown in the exhibit, you receive an error.
What is the problem?

• A. You have omitted the interface-mode accesscommand.
• B. You have not configured an IP address to the interface.
• C. You have omitted the interface-mode trunkcommand.
• D. You have not set the interface family correctly.

正解：C

質問 # 32
What is the maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation?

• A. 1480 bytes
• B. 1476 bytes
• C. 1500 bytes
• D. 1496 bytes

正解：B

解説：
The maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation is
1476 bytes. This is because GRE packets are formed by the addition of the original packets and the required GRE headers. These headers are 24-bytes in length and since these headers are added to the original frame, depending on the original size of the packet we may run into IP MTU problems. The most common IP MTU is 1500-bytes in length (Ethernet). When the tunnel is created, it deducts the 24-bytes it needs to encapsulate the passenger protocols and that is the IP MTU it will use. For example, if we are forming a tunnel over FastEthernet (IP MTU 1500) the IOS calculates the IP MTU on the tunnel as: 1500-bytes from Ethernet-24-bytes for the GRE encapsulation = 1476-Bytes.

質問 # 33

You need to apply a Layer 2 firewall filter on a Juniper Networks EX Series Switch to block traffic from the source MAC address 00:12:34:56:00:07 entering the switch on ge-0/0/3. After committing the configuration, traffic from the MAC address still passes through.
Referring to the exhibit, which statement is correct in this scenario?

• A. The filter is applied in the wrong direction.
• B. The MAC address and mask in the firewall filter need to be explicit.
• C. The interface needs to be of type trunk for the filter to evaluate correctly.
• D. Firewall filters under family ethernet-switching cannot match on MAC addresses.

正解：B

解説：
The intent of this filter is to match and discard traffic from one single, specific host MAC address, which requires the source-mac-address match condition to reference the complete, exact 48-bit address using an explicit /48 mask (or no mask at all, which Junos treats as an implicit full match) so that only that one precise address is matched. As configured, the term instead specifies a /40 mask on 00:12:34:56:00:07, meaning only the first 40 bits (the first five octets, 00:12:34:56:00) are actually significant to the match, while the sixth octet is effectively wildcarded across its full range; this produces an imprecise, overly broad match criterion rather than the single-host match the administrator intended, and is a common configuration mistake that undermines the predictability and correctness of MAC-based filtering. The lesson tested here is that source and destination MAC address match conditions in Junos firewall filters must be specified with the correct, deliberate, and explicit prefix length appropriate to the intended scope - typically /48 for a single exact host
- rather than an arbitrary or miscalculated mask value. Firewall filters under family ethernet-switching are fully capable of matching on both source-mac-address and destination-mac-address, which rules out that option entirely. Layer 2 MAC-based filters function correctly on both access and trunk interface modes, so interface type is not a limiting factor here. There is no indication in the exhibit that the filter's application direction (input versus output) is reversed. Reference topics: Junos Enterprise Switching - Layer 2 Security, MAC Address Match Conditions and Prefix Length Precision.

質問 # 34
Your GRE tunnel is not transitioning to the Upstatus. What would be the first step in troubleshooting the problem?

• A. Verify the status of the management routing instance.
• B. Verify tunnel endpoint reachability.
• C. Verify that the routing instance for GRE tunnels is created.
• D. Verify that the status of the management interface is up.

正解：B

質問 # 35
You are deploying an EX Series switch with a Wi-Fi access point. The access point needs all untagged traffic to use a specific VLAN. In this scenario, which feature should you enable on the switch port?

• A. VLAN tagging
• B. flexible VLAN tagging
• C. native VLAN
• D. voice VLAN

正解：C

質問 # 36
What are three well-known mandatory BGP attributes? (Choose three.)

• A. local preference
• B. community
• C. next hop
• D. origin
• E. AS path

正解：C、D、E

質問 # 37
Which two statements correctly describe RSTP port roles? (Choose two.)

• A. The root port is responsible for forwarding data to the root bridge.
• B. The backup port is used as a backup for the root port.
• C. The alternate port is a standby port for an edge port.
• D. The designated port forwards data to the downstream network segment or device.

正解：A、D

解説：
An RSTP topology contains ports that have specific roles:
The root port is responsible for forwarding data to the root bridge.
The alternate port is a standby port for the root port. When a root port goes down, the alternate port becomes the active root port.
The designated port forwards data to the downstream network segment or device.
The backup port is a backup port for the designated port. When a designated port goes down, the backup port becomes the active designated port and starts forwarding data.

質問 # 38

Click the Exhibit button.
Referring to the exhibit, all possible firewall filters are configured along the path from Server A to Server B.
In which order will Switch 1 process transmit (Tx) and receive (Rx) firewall filters?

• A. Rx-Port -- > Rx-VLAN -- > Rx-Router -- > Tx-Router -- > Tx-VLAN - > Tx-Port
• B. Rx-Port -- > Rx-VLAN -- > Tx-VLAN -- > Tx-Port
• C. Rx-Port -- > Rx-Router -- > Tx-Router -- > Tx-Port
• D. Rx-Port -- > Rx-VLAN -- > Rx-Router -- > Tx-VLAN -- > Tx-Port

正解：A

解説：
Because Server A resides in VLAN 10 and Server B resides in VLAN 20, traffic between them cannot remain a purely Layer 2 switched flow; it must be routed between the two VLANs, which on Switch 1 means the packet traverses the switch's internal routing engine (via an IRB interface) between the ingress and egress switching stages. Junos processes firewall filters along this path in a strict, layered order that mirrors the packet's actual journey through the device. First, any filter applied at the physical ingress port level (Rx-Port) is evaluated as the frame first arrives on ge-0/0/10. Next, any filter applied to the ingress VLAN (Rx-VLAN, i.
e., VLAN 10) is evaluated as the frame is classified into its source broadcast domain. Because the destination subnet requires routing, the packet is then handed to the routing engine, where any input/ingress routed filter (Rx-Router) applied to the receiving IRB interface is evaluated next, followed by any output/egress routed filter (Tx-Router) applied as the now-routed packet is handed from the routing engine back out toward VLAN
20. Finally, the packet passes through any egress VLAN filter (Tx-VLAN, for VLAN 20) and then the egress physical port filter (Tx-Port) on ge-0/0/20 immediately before transmission to Server B. This complete six- stage sequence - Rx-Port, Rx-VLAN, Rx-Router, Tx-Router, Tx-VLAN, Tx-Port - reflects every filter- evaluation checkpoint a routed, inter-VLAN packet passes through on an EX Series Layer 3 switch.
Reference topics: Junos Enterprise Switching - Layer 2 Switching and Firewall Filter Processing Order for Routed VLAN Traffic.

質問 # 39
Which two statements describe NSR? (Choose two.)

• A. NSR provides routing loop protection.
• B. NSR rapidly detects link failures.
• C. NSR provides high availability with multiple Routing Engines.
• D. NSR requires GRES to function properly.

正解：C、D

質問 # 40
You have configured a GRE tunnel from your local router with tunnel source 10.0.0.1 to a remote router at destination 192.168.0.1. The tunnel is functioning until you commit set routing-options static route 0.0.0.0/0 next-hop gr-0/0/0. This configuration causes the tunnel to go down.
Which statement is correct in this scenario?

• A. The destination IP was being resolved using the default route, which now points to the tunnel itself.
• B. A GRE interface cannot be used as a next hop for a static route.
• C. The tunnel destination must be resolved by a /32 host route.
• D. A GRE interface must use the loopback as its source address to be used as a default route.

正解：A

解説：
A GRE tunnel's outer, delivery-layer packets are forwarded using the router's ordinary underlay routing table, meaning the tunnel destination address (192.168.0.1 in this case) must itself be resolvable to a physical, non- tunnel next hop for the encapsulated packets to actually leave the router. Before this configuration change, the default route (or some more specific route) presumably pointed toward a real physical next hop, allowing the router to reach 192.168.0.1 and keep the tunnel operational. When the administrator commits a static default route of 0.0.0.0/0 with a next hop of gr-0/0/0, every destination lookup that previously fell back to the default route - including the lookup for the tunnel's own destination address, 192.168.0.1, since no more specific route exists for it - now recurses through the GRE interface itself. This creates a circular dependency: the router needs to route to 192.168.0.1 to keep the tunnel up, but the only route it has to reach 192.168.0.1 now points back into the tunnel that requires 192.168.0.1 to already be reachable, so the interface's next-hop resolution fails and the tunnel drops. This is an entirely valid and common GRE design pitfall rather than any platform restriction; GRE interfaces can be legitimately used as static route next hops, do not require loopback-sourced encapsulation, and do not require a /32 host route to resolve their destination, provided that route does not recursively point back through the tunnel. Reference topics: Junos Enterprise Routing - Tunneling, Route Recursion and GRE Tunnel Destination Resolution.

質問 # 41
You have traffic for a video streaming application traversing a GRE tunnel in your network and users are reporting poor performance. Both ends of the tunnel are using the default settings for a gigabit Ethernet interface, but you observe excessive packet drops due to exceeding the MTU.
Which two steps would you take to improve connectivity for this application? (Choose two.)

• A. Increase the MTU for the member interfaces to 1500 bytes.
• B. Increase the MTU for the member interfaces to 1524 bytes.
• C. Configure the clear-dont-fragment option on the member interfaces.
• D. Route the GRE tunnel through a higher bandwidth link.

正解：B、C

質問 # 42
Referring to the exhibit, which two statements are correct? (Choose two.)

• A. The ge-0/0/10 interface will not participate in the RSTP topology.
• B. The ge-0/0/10 interface will be part of the RSTP topology but will block incoming BPDUs.
• C. This device must be selected as the root bridge.
• D. The ge-0/0/13 interface will be selected as the forwarding interface.

正解：A、D

質問 # 43

Click the Exhibit button.
You are asked to ensure that there will not be any unwanted STP topology changes affecting your root bridge placement because a rogue switch was introduced into the network at the access layer.
Referring to the exhibit, which interfaces will need to have root protection applied to accomplish this task?

• A. Place root protection on ge-0/0/12 and ge-0/0/13 on Switch-1 and Switch-2.
• B. Place root protection on ge-0/0/6 and ge-0/0/8 on Switch-1 and Switch-2.
• C. Place root protection on ge-0/0/6 and ge-0/0/8 on Switch-3 and Switch-4.
• D. Place root protection on ge-0/0/6 and ge-0/0/8 on Switch-1 only.

正解：B

解説：
Root protection (root guard) must always be applied on the ports of the switches you trust to remain root- bridge-eligible, specifically on the interfaces facing away from the legitimate root and toward parts of the network where an untrusted or rogue device could plausibly appear and begin transmitting superior BPDUs.
In this topology, Switch-1 is the intended, permanent root bridge (lowest priority, 4k), and Switch-2 is its aggregation-layer peer; both sit above the access layer, where Switch-3 and Switch-4 connect downstream toward end-user-facing infrastructure and where an accidental or malicious rogue switch is realistically most likely to be introduced. The ge-0/0/6 and ge-0/0/8 interfaces on Switch-1 and Switch-2 are precisely the downlink ports facing that access layer, meaning they are the exact points at which a rogue switch's superior BPDU (one advertising a lower priority than the legitimate root) would first be received if such a device appeared beneath Switch-3 or Switch-4. Applying root protection on those specific interfaces causes Junos to immediately block (move to a root-inconsistent, discarding state) any port that receives a superior BPDU, preventing the rogue device from ever being accepted as root, while normal, non-superior BPDUs continue to be processed without disruption. Applying root guard on Switch-1 and Switch-2's peer link (ge-0/0/12/13) would be inappropriate, since that link legitimately connects two trusted, root-eligible switches. Reference topics: Junos Enterprise Switching - Spanning Tree Protocols, Root Protection Placement Strategy.

質問 # 44
You are asked to create a new firewall filter to evaluate Layer 3 traffic that is being sent between VLANs. In this scenario, which two statements are correct? (Choose two.)

• A. You should apply the firewall filter to the appropriate VLAN.
• B. You should create a family inet firewall filter with the appropriate match criteria and actions.
• C. You should apply the firewall filter to the appropriate IRB interface.
• D. You should create a family Ethernet-switching firewall filter with the appropriate match criteria and actions.

正解：B、C

解説：
A firewall filter is a configuration that defines the rules that determine whether to forward or discard packets at specific processing points in the packet flow. A firewall filter can also modify the attributes of the packets, such as priority, marking, or logging. A firewall filter can be applied to various interfaces, protocols, or routing instances on a Juniper device. A firewall filter has a family attribute, which specifies the type of traffic that the filter can evaluate. The family attribute can be one of the following: inet, inet6, mpls, vpls, iso, or ethernet- switching. The family inet firewall filter is used to evaluate IPv4 traffic, which is the most common type of Layer 3 traffic on a network.
To create a family inet firewall filter, you need to specify the appropriate match criteria and actions for each term in the filter. The match criteria can include various fields in the IPv4 header, such as source address, destination address, protocol, port number, or DSCP value. The actions can include accept, discard, reject, count, log, policer, or next term. To apply a firewall filter to Layer 3 traffic that is being sent between VLANs, you need to apply the filter to the appropriate IRB interface. An IRB interface is an integrated routing and bridging interface that provides Layer
3 functionality for a VLAN on a Juniper device. An IRB interface has an IP address that acts as the default gateway for the hosts in the VLAN. An IRB interface can also participate in routing protocols and forward packets to other VLANs or networks.
Therefore, option C is correct, because you should create a family inet firewall filter with the appropriate match criteria and actions. Option D is correct, because you should apply the firewall filter to the appropriate IRB interface

質問 # 45
You are creating an aggregated Ethernet bundle using LACP on your Juniper Networks EX Series device.
In this scenario, which statement is correct?

• A. LACP active mode is required on at least one side of the bundle.
• B. By default, LACP is in active mode on aggregated Ethernet interfaces.
• C. LACP active mode is required on both sides of the bundle.
• D. You must use different LACP system priorities for each switch.

正解：A

解説：
IEEE 802.3ad LACP defines two distinct negotiation modes, active and passive, and the standard's fundamental requirement for successful negotiation is that at least one end of the point-to-point link must be configured in active mode; an actively configured device initiates LACPDU transmission on its own, while a passively configured device waits and only responds once it receives an LACPDU from its peer. If both ends of the bundle were left in passive mode simultaneously, neither side would ever initiate the exchange, and no negotiation - and therefore no functioning aggregated bundle - would ever occur; at least one active participant is therefore mandatory, though having both sides active (active-active) is also fully valid and is in fact the most common production deployment. Junos does not enable LACP automatically on aggregated Ethernet interfaces; unlike some competing platforms, LACP must be explicitly configured under the aggregated-ether-options lacp hierarchy, and specifying no LACP configuration at all results in a 'static' LAG that relies purely on physical link-state rather than any protocol negotiation - there is no implicit default active mode. There is likewise no requirement to configure differing LACP system priority values between the two peer switches; system priority is used only to determine which side of the link controls port selection during negotiation and has no bearing on whether the bundle can form. Both sides being mandatorily active is a stricter requirement than the actual standard specifies. Reference topics: Junos Enterprise Switching - Link Aggregation, LACP Active and Passive Mode Negotiation.

質問 # 46
Which two statements are true about the default VLAN on Juniper switches? (Choose two.)

• A. The default VLAN ID can be changed.
• B. The default VLAN ID is not assigned to any interface.
• C. The default VLAN ID is not visible.
• D. The default VLAN is set to a VLAN ID of 1 by default

正解：A、D

解説：
On Juniper switches, the default VLAN is set to a VLAN ID of 1 by default. This means that all interfaces on the switch are members of VLAN until they are specifically assigned to another VLAN. Therefore, option A is correct.
The default VLAN ID can be changed. This allows network administrators to configure the switch to use a different VLAN as the default, if necessary. Therefore, option D is correct.

質問 # 47
Which statement is correct about the IS-IS ISO NET address?

• A. You can only define a single ISO NET address per device.
• B. An ISO NET address must be unique for each device in the network.
• C. An ISO NET address defined with a system ID of 0000.0000.0000 must be selected as the DIS.
• D. The Area ID must match on all devices within a L2 area.

正解：B

解説：
An ISO NET address is a type of network address used by the IS-IS routing protocol. It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP).
An ISO NET address consists of three parts: an area ID, a system ID, and a selector. The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area. The selector identifies a specific service or function on the device, such as routing or management.
An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths. If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

質問 # 48
Which two elements are used to create the STP bridge ID? (Choose two.)

• A. the root port number
• B. the port cost
• C. the system MAC address
• D. the bridge priority value

正解：C、D

質問 # 49
You are asked to change the setting for the LSAs age out back to the default value. In this scenario, which time interval will accomplish this task?

• A. 3600 seconds
• B. 600 seconds
• C. 300 seconds
• D. 1800 seconds

正解：A

質問 # 50
Which statement concerning Bidirectional Forwarding Detection (BFD) is true for the configuration shown in the exhibit?

• A. The link to neighbor 192.168.100.2 is not using BFD.
• B. The minimum-interval must match on both ends.
• C. The effective interval for neighbor 192.168.100.2 is 500 ms.
• D. The effective interval for neighbor 172.30.1.2 is 500 ms.

正解：C

質問 # 51
......

トップクラスJuniper JN0-352オンライン問題集：https://www.goshiken.com/Juniper/JN0-352-mondaishu.html