JN0-351 Exam Dumps : Enterprise Routing and Switching Specialist (JNCIS-ENT)

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

The routers that are directly connected to the Dallas and Denver subnets are not advertising the connected subnets.  This can be resolved by redistributing the connected subnets into OSPF 1 .

Option C suggests to configure and apply a routing policy that redistributes the connected Dallas and Denver subnets.  This is correct because redistribution allows routes from one routing protocol to be communicated to another, and in this case, it allows the connected subnets to be advertised through OSPF 1 .

Option D suggests enabling the passive option on the OSPF interfaces that are connected to the Dallas and Denver subnets.  This is also correct because in OSPF, a passive interface is an interface that belongs to the OSPF router, but does not send OSPF Hello packets 1 .  It’s typically used on an interface that you don’t want to use for OSPF adjacencies, but you still want to advertise its IP address 1 . Therefore, enabling passive interface can help in advertising the Dallas and Denver subnets.