Juniper Data Center, Associate JN0-281 Exam Questions

Answer : A, D

EBGP is the BGP session type formed between different autonomous systems. In Juniper data center IP fabrics, EBGP is frequently used for the underlay because it can provide all required reachability without an additional interior gateway protocol. The fabric can advertise loopbacks and point-to-point link subnets directly in BGP, then use ECMP to install multiple equal-cost next hops. This is why EBGP sessions do not require an IGP as a fundamental dependency. Some designs still add an IGP for other reasons, but EBGP itself can carry the underlay routes needed for full fabric connectivity.

EBGP sessions are also typically established between directly connected peers. In a standard leaf-spine underlay, each leaf peers with each spine over the routed physical links between them, using the interface IP addresses on those point-to-point subnets. This matches EBGP default behavior, including a one-hop TTL expectation and straightforward operational troubleshooting.

Loopback peering is not required for EBGP. It is possible, but it usually needs additional configuration such as multihop and a routing method to ensure reachability to the remote loopback before the BGP session can form. EBGP also supports sessions with non-directly connected peers when multihop is configured, so it is incorrect to claim EBGP does not support that capability.

Answer : B

In a leaf spine IP fabric, spines form the high-speed transit layer and leaves provide the attachment points for servers, services, and edge connectivity. The defining physical topology rule is that every spine connects directly to every leaf. This design creates consistent one-hop transit through a spine for traffic between any two leaves, which keeps latency predictable and simplifies capacity planning. It also enables equal-cost multipath routing across all available spine links, allowing the fabric to use bandwidth efficiently and recover quickly from failures by shifting traffic to remaining paths.

Spine-to-spine connections are not required in a classic two-tier leaf spine fabric. Adding spine-to-spine links can create unnecessary complexity and does not improve the standard forwarding model, because spines are intended to provide transit between leaves, not to act as an additional meshed layer. Likewise, there is no inherent requirement that each spine must have two or more physical links to each leaf. Many fabrics start with one link per spine-leaf pair and scale capacity by adding more spines or adding additional parallel links as demand grows. The redundancy objective is achieved primarily by multiple spines and multiple available routed paths, not by mandating multiple links between every spine and every leaf from the outset.

Answer : B, D

On Junos Ethernet switching, access and trunk ports serve different purposes and therefore treat VLAN tags differently by default. An access port is intended for a single VLAN and is designed to connect to endpoints that do not tag their frames. Because of that, access ports forward traffic as untagged on the wire and internally associate those untagged frames to the configured access VLAN. This makes access ports the standard choice for single-VLAN server NICs, management devices, and any endpoint expecting a plain Ethernet connection.

A trunk port is intended to carry traffic for multiple VLANs over a single link, which is typical for switch-to-switch uplinks, leaf-to-spine connectivity where VLAN services are extended, and hosts or appliances that use VLAN tagging. By default, trunk ports forward tagged traffic and require VLAN tags to identify the VLAN membership of each frame. Untagged behavior on a trunk is not assumed by default and is typically governed by configuring a native VLAN or equivalent untagged VLAN handling, depending on platform and design. Without such configuration, untagged frames are not treated as a normal expected case for a trunk link in data center fabrics.

Therefore, the correct default statements are that access ports forward untagged traffic and trunk ports forward tagged traffic, matching options B and D.

Answer : A

In Junos OSPF, the passive setting is used when you want the prefix on an interface to be advertised into OSPF, but you do not want the interface to form OSPF neighbor adjacencies or send OSPF Hello packets. This is a common data center requirement for server-facing, management, or loopback-related interfaces where you want the subnet to be reachable through the routing domain, but there is no OSPF-capable neighbor on that link. By making the interface passive, the router still includes the connected network in OSPF as an internal route, so other routers learn how to reach that subnet. At the same time, the interface does not participate in adjacency formation, which reduces unnecessary protocol chatter and eliminates the risk of accidentally forming neighbors on an untrusted or unintended segment.

The other options do not meet the requirement. Interface-type changes the OSPF network type behavior, such as broadcast or point-to-point, but it does not stop adjacency formation while still advertising the network. Strict-bfd relates to failure detection behavior when BFD is used with routing protocols and does not control whether OSPF forms neighbors. Link-protection is related to fast reroute and protection mechanisms, not suppressing OSPF adjacency on an interface.

Answer : B

In Junos BGP configuration, export policy can be applied at multiple levels, including the BGP group level and the individual neighbor level. When an export policy is configured directly under a specific neighbor, that policy is explicitly associated with advertisements sent to that neighbor and is therefore the policy that applies to that neighbor. In the exhibit, neighbor 172.16.1.101 has an export statement configured within the neighbor stanza, and that statement references the advertise-ospf policy. This is the most specific policy attachment in the configuration because it is tied to a single peer rather than to the entire group or the whole BGP process.

Group-level export policies, such as advertise-aggregate configured under the group, apply broadly to all neighbors in that group unless a neighbor has additional neighbor-specific policy. A BGP-level export policy configured outside the group applies as a more general export policy scope. However, the question asks which export policy applies to the specific neighbor, and the correct selection is the neighbor-specific export policy that is explicitly configured for that peer.

Operationally, this allows data center engineers to advertise different route sets to different peers, for example exporting OSPF-derived infrastructure routes to one neighbor while exporting aggregates or static routes to another, all while keeping a consistent group template for shared settings such as peer AS and session type.

Answer : B, C

Spine and leaf architectures improve data center scalability by using a consistent, modular building block. When you need more server ports, you add leaf switches. When you need more fabric capacity, you add spine switches. This horizontal growth model avoids the limitations of traditional three-tier designs that often require larger aggregation devices or complex expansion. Because each leaf connects to every spine, the fabric naturally provides many parallel paths and can use equal-cost multipath forwarding across all uplinks. These properties deliver better scaling characteristics in both bandwidth and port count, which is why option B is correct.

Option C is also correct because spine and leaf fabrics provide low and predictable hop counts. Traffic between endpoints on different leaves typically crosses the fabric with a consistent number of hops, usually one spine hop in a two-tier fabric. This predictability reduces latency variance and improves application performance, especially for east-west traffic patterns common to distributed systems, storage, and microservices. Predictable paths also simplify troubleshooting and capacity planning.

Container and hypervisor management is primarily an orchestration and operations topic rather than a direct network architecture advantage. Finally, making all broadcast domains reachable is not an inherent benefit; modern data centers usually limit Layer 2 flooding domains and prefer routed underlays with overlays for segmentation, rather than expanding broadcast reachability everywhere.

Answer : A

In Junos-based data center switching, an IRB interface is the Layer 3 gateway that is logically associated with a Layer 2 VLAN or bridge domain. The VLAN provides Layer 2 bridging inside the broadcast domain, while the IRB interface provides the routed interface that enables hosts in that VLAN to reach destinations outside their local subnet. This is the standard mechanism used for inter-VLAN routing on Juniper switches and for providing default gateway services to servers connected to access ports or VLAN-tagged trunks.

Operationally, endpoints in a VLAN use the IRB interface IP address as their default gateway. Frames destined to a remote subnet are bridged at Layer 2 to the IRB gateway MAC address, and then the packet is routed at Layer 3 based on the routing table. This allows a single device to perform both bridging within the VLAN and routing between VLANs or to other routed interfaces, which is why the concept is called integrated routing and bridging.

IRB does not encrypt traffic and does not provide NAT by itself; those functions are typically associated with security services features and firewall platforms. IRB is also not the mechanism that performs pure bridging within the same VLAN, because bridging is handled by the VLAN or bridge domain and the Ethernet switching table.