McAfee-Secured Website

Exam Code: JN0-664

Exam Name: Service Provider Routing and Switching, Professional (JNCIP-SP)

Certification Provider: Juniper

Corresponding Certification: JNCIP-SP

100% Juniper JN0-664 Guaranteed Success With Testking Training Materials

Get Real JN0-664 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

96 Questions & Answers with Testing Engine

"Service Provider Routing and Switching, Professional (JNCIP-SP) Exam", also known as JN0-664 exam, is a Juniper certification exam.

Pass your tests with the always up-to-date JN0-664 Exam Engine. Your JN0-664 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Juniper JN0-664 Practice Test 30

Question 290

A provider uses route damping on a customer aggregate. Observed: A stable recovered prefix stays suppressed after several route updates. After the correction, which result would most convincingly show that this fault is resolved?

  1. Only authorized mitigation components are programmed in the forwarding plane.
  2. The permitted tagged route enters only the intended instance.
  3. The best path selects the approved egress without modifying remote providers.
  4. The recovered prefix becomes usable after permitted penalty decay without excessive flapping.

Explanation

Correct Answer

D:

After examine damping state and adjust the policy to approved convergence objectives, inspect whether the recovered prefix becomes usable after permitted penalty decay without excessive flapping. This closes the loop between the reported observation (A stable recovered prefix stays suppressed after several route updates) and the underlying issue (Route flap damping penalty and reuse thresholds remain active).

Incorrect Answers

A:

This result is useful in another case with evidence A FlowSpec announcement is present but the PE never applies the firewall action. It does not test recovery from a stable recovered prefix stays suppressed after several route updates. Check instead whether the recovered prefix becomes usable after permitted penalty decay without excessive flapping.

B:

It confirms an unrelated service correction: The policy term matches community yet assigns an unintended routing-instance action. The present case reports A stable recovered prefix stays suppressed after several route updates. Its completion test is The recovered prefix becomes usable after permitted penalty decay without excessive flapping.

C:

That observation would verify a separate fault involving local preference policy unintentionally favors the expensive upstream path. Its symptom is Traffic selects an unwanted exit despite the closer contracted carrier. For this case the actual issue is route flap damping penalty and reuse thresholds remain active, and the relevant success signal is The recovered prefix becomes usable after permitted penalty decay without excessive flapping.

Question 291

A provider uses route damping on a customer aggregate. Observed: A stable recovered prefix stays suppressed after several route updates. Which root cause is most consistent with this symptom?

  1. The policy term matches community yet assigns an unintended routing-instance action.
  2. Route flap damping penalty and reuse thresholds remain active.
  3. FlowSpec address-family negotiation or validation against unicast reachability fails.
  4. Local preference policy unintentionally favors the expensive upstream path.

Explanation

Correct Answer

B:

The reported evidence—A stable recovered prefix stays suppressed after several route updates—supports route flap damping penalty and reuse thresholds remain active. The appropriate intervention is to examine damping state and adjust the policy to approved convergence objectives, with confirmation from the recovered prefix becomes usable after permitted penalty decay without excessive flapping. Other causes require actual device-state verification.

Incorrect Answers

A:

The policy term matches community yet assigns an unintended routing-instance action. would normally be accompanied by a route arrives with the right community but enters the wrong routing instance. The observed symptom is different: A stable recovered prefix stays suppressed after several route updates. The likely cause is Route flap damping penalty and reuse thresholds remain active.

C:

That explanation fits another condition: A FlowSpec announcement is present but the PE never applies the firewall action. The evidence here is A stable recovered prefix stays suppressed after several route updates. Its closer root cause is Route flap damping penalty and reuse thresholds remain active.

D:

The stated cause is possible elsewhere but explains traffic selects an unwanted exit despite the closer contracted carrier, not a stable recovered prefix stays suppressed after several route updates. This incident is better attributed to route flap damping penalty and reuse thresholds remain active.

Question 292

A provider uses route damping on a customer aggregate. Observed: A stable recovered prefix stays suppressed after several route updates. Which change-acceptance control is most relevant to preventing this exact failure?

  1. For each approved related change, verify that the recovered prefix becomes usable after permitted penalty decay without excessive flapping. Flag recurrence if a stable recovered prefix stays suppressed after several route updates.
  2. For each approved related change, verify that the best path selects the approved egress without modifying remote providers. Flag recurrence if traffic selects an unwanted exit despite the closer contracted carrier.
  3. For each approved related change, verify that the permitted tagged route enters only the intended instance. Flag recurrence if a route arrives with the right community but enters the wrong routing instance.
  4. For each approved related change, verify that only authorized mitigation components are programmed in the forwarding plane. Flag recurrence if a FlowSpec announcement is present but the PE never applies the firewall action.

Explanation

Correct Answer

A:

The control is specific to the initial failure. It requires the result The recovered prefix becomes usable after permitted penalty decay without excessive flapping. and treats A stable recovered prefix stays suppressed after several route updates. as a failure signal. The causal concern is route flap damping penalty and reuse thresholds remain active.

Incorrect Answers

B:

The proposed control is tied to local preference policy unintentionally favors the expensive upstream path, typically observed when traffic selects an unwanted exit despite the closer contracted carrier. Here the target is route flap damping penalty and reuse thresholds remain active; monitor the recovered prefix becomes usable after permitted penalty decay without excessive flapping.

C:

This gate monitors a different failure, a route arrives with the right community but enters the wrong routing instance. It would not detect the current problem: A stable recovered prefix stays suppressed after several route updates. The appropriate check requires the recovered prefix becomes usable after permitted penalty decay without excessive flapping.

D:

It is valid for another service scenario but checks a flowspec announcement is present but the pe never applies the firewall action. This case instead needs a gate for a stable recovered prefix stays suppressed after several route updates and evidence that the recovered prefix becomes usable after permitted penalty decay without excessive flapping.

Question 293

A mitigation controller injects BGP FlowSpec rules for volumetric attacks. Observed: A FlowSpec announcement is present but the PE never applies the firewall action. What should the routing engineer change first to address this particular symptom?

  1. Apply an appropriate externally visible traffic-engineering attribute or provider community.
  2. Establish permitted FlowSpec family and validation rules before accepting actions.
  3. Repair upstream next-hop resolution rather than forcing an arbitrary best path.
  4. Refine source/destination and protocol match components to the verified attack pattern.

Explanation

Correct Answer

B:

The decisive evidence is that A FlowSpec announcement is present but the PE never applies the firewall action. This follows from flowspec address-family negotiation or validation against unicast reachability fails. The focused remedy is to establish permitted FlowSpec family and validation rules before accepting actions. Confirm improvement when only authorized mitigation components are programmed in the forwarding plane. Validate on an approved lab or change window before touching production.

Incorrect Answers

A:

This remediates local preference is not exported to other autonomous systems, normally indicated by External peers continue choosing the wrong ingress despite local preference changes. It would leave the observed problem (A FlowSpec announcement is present but the PE never applies the firewall action) unresolved. Address it with establish permitted FlowSpec family and validation rules before accepting actions.

C:

The option may be useful when a route is not selected despite the upstream session remaining Established, but that is not the current evidence. Here, a FlowSpec announcement is present but the PE never applies the firewall action, indicating flowspec address-family negotiation or validation against unicast reachability fails. The targeted action is Establish permitted FlowSpec family and validation rules before accepting actions.

D:

This change belongs to a different BGP issue: Normal customer traffic is dropped because the match covers the entire tenant aggregate. That issue involves flowspec match components are less specific than the approved attack signature. The current symptom is A FlowSpec announcement is present but the PE never applies the firewall action. It instead requires establish permitted FlowSpec family and validation rules before accepting actions.

Question 294

A mitigation controller injects BGP FlowSpec rules for volumetric attacks. Observed: A FlowSpec announcement is present but the PE never applies the firewall action. Which acceptance observation best confirms that the proposed change worked?

  1. The preferred default has a valid resolved next hop and becomes active.
  2. Only authorized mitigation components are programmed in the forwarding plane.
  3. Upstream route selection changes as validated by external path observations.
  4. The attack is filtered while unaffected flows remain reachable.

Explanation

Correct Answer

B:

This acceptance criterion tests the actual fault. The source evidence was A FlowSpec announcement is present but the PE never applies the firewall action. The correction addresses flowspec address-family negotiation or validation against unicast reachability fails; success requires only authorized mitigation components are programmed in the forwarding plane.

Incorrect Answers

A:

That observation would verify a separate fault involving the competing next hop fails recursive reachability validation. Its symptom is A route is not selected despite the upstream session remaining Established. For this case the actual issue is flowspec address-family negotiation or validation against unicast reachability fails, and the relevant success signal is Only authorized mitigation components are programmed in the forwarding plane.

C:

This result is useful in another case with evidence External peers continue choosing the wrong ingress despite local preference changes. It does not test recovery from a flowspec announcement is present but the pe never applies the firewall action. Check instead whether only authorized mitigation components are programmed in the forwarding plane.

D:

It confirms an unrelated service correction: FlowSpec match components are less specific than the approved attack signature. The present case reports A FlowSpec announcement is present but the PE never applies the firewall action. Its completion test is Only authorized mitigation components are programmed in the forwarding plane.

Question 295

A mitigation controller injects BGP FlowSpec rules for volumetric attacks. Observed: A FlowSpec announcement is present but the PE never applies the firewall action. What is the most likely source of the observed routing or service failure?

  1. FlowSpec address-family negotiation or validation against unicast reachability fails.
  2. FlowSpec match components are less specific than the approved attack signature.
  3. The competing next hop fails recursive reachability validation.
  4. Local preference is not exported to other autonomous systems.

Explanation

Correct Answer

A:

This explanation is the closest match to the observed symptom: A FlowSpec announcement is present but the PE never applies the firewall action. The specified root issue is FlowSpec address-family negotiation or validation against unicast reachability fails. Repair it through establish permitted FlowSpec family and validation rules before accepting actions, then check only authorized mitigation components are programmed in the forwarding plane.

Incorrect Answers

B:

FlowSpec match components are less specific than the approved attack signature. would normally be accompanied by normal customer traffic is dropped because the match covers the entire tenant aggregate. The observed symptom is different: A FlowSpec announcement is present but the PE never applies the firewall action. The likely cause is FlowSpec address-family negotiation or validation against unicast reachability fails.

C:

The stated cause is possible elsewhere but explains a route is not selected despite the upstream session remaining established, not a flowspec announcement is present but the pe never applies the firewall action. This incident is better attributed to flowspec address-family negotiation or validation against unicast reachability fails.

D:

That explanation fits another condition: External peers continue choosing the wrong ingress despite local preference changes. The evidence here is A FlowSpec announcement is present but the PE never applies the firewall action. Its closer root cause is FlowSpec address-family negotiation or validation against unicast reachability fails.

Question 296

A mitigation controller injects BGP FlowSpec rules for volumetric attacks. Observed: A FlowSpec announcement is present but the PE never applies the firewall action. What operational check best guards against this problem returning?

  1. For each approved related change, verify that only authorized mitigation components are programmed in the forwarding plane. Flag recurrence if a FlowSpec announcement is present but the PE never applies the firewall action.
  2. For each approved related change, verify that upstream route selection changes as validated by external path observations. Flag recurrence if external peers continue choosing the wrong ingress despite local preference changes.
  3. For each approved related change, verify that the attack is filtered while unaffected flows remain reachable. Flag recurrence if normal customer traffic is dropped because the match covers the entire tenant aggregate.
  4. For each approved related change, verify that the preferred default has a valid resolved next hop and becomes active. Flag recurrence if a route is not selected despite the upstream session remaining Established.

Explanation

Correct Answer

A:

This control asks for the same recovery evidence (Only authorized mitigation components are programmed in the forwarding plane) and flags recurrence of the same failure (A FlowSpec announcement is present but the PE never applies the firewall action). It targets the underlying issue, flowspec address-family negotiation or validation against unicast reachability fails, rather than a different service problem. The exact cadence must be agreed with operations.

Incorrect Answers

B:

It is valid for another service scenario but checks external peers continue choosing the wrong ingress despite local preference changes. This case instead needs a gate for a flowspec announcement is present but the pe never applies the firewall action and evidence that only authorized mitigation components are programmed in the forwarding plane.

C:

This gate monitors a different failure, normal customer traffic is dropped because the match covers the entire tenant aggregate. It would not detect the current problem: A FlowSpec announcement is present but the PE never applies the firewall action. The appropriate check requires only authorized mitigation components are programmed in the forwarding plane.

D:

The proposed control is tied to the competing next hop fails recursive reachability validation, typically observed when a route is not selected despite the upstream session remaining Established. Here the target is flowspec address-family negotiation or validation against unicast reachability fails; monitor only authorized mitigation components are programmed in the forwarding plane.

Question 297

A tenant controller sends a FlowSpec discard rule for a broad prefix. Observed: Normal customer traffic is dropped because the match covers the entire tenant aggregate. Which targeted remediation is most appropriate for the observed condition?

  1. Coordinate carrier-supported communities or accepted inbound steering methods.
  2. Apply a narrow import filter and prefix-limit according to the service agreement.
  3. Match local source address and remote neighbor definition with multihop permissions.
  4. Refine source/destination and protocol match components to the verified attack pattern.

Explanation

Correct Answer

D:

This fix addresses the stated cause rather than an unrelated protocol. The reported symptom—Normal customer traffic is dropped because the match covers the entire tenant aggregate—is consistent with flowspec match components are less specific than the approved attack signature. Use the specified correction, then verify: The attack is filtered while unaffected flows remain reachable. Preserve existing policy and tenant isolation.

Incorrect Answers

A:

This change belongs to a different BGP issue: New prepended announcements do not influence the chosen inbound route. That issue involves upstream local preference overrides the longer as-path signal. The current symptom is Normal customer traffic is dropped because the match covers the entire tenant aggregate. It instead requires refine source/destination and protocol match components to the verified attack pattern.

B:

This remediates bgp inbound acceptance policy and max-prefix safety do not constrain the contracted feed, normally indicated by An unexpected memory spike occurs although only a few prefixes should be accepted. It would leave the observed problem (Normal customer traffic is dropped because the match covers the entire tenant aggregate) unresolved. Address it with refine source/destination and protocol match components to the verified attack pattern.

C:

The option may be useful when one router silently sources TCP from a physical interface instead of its loopback, but that is not the current evidence. Here, normal customer traffic is dropped because the match covers the entire tenant aggregate, indicating flowspec match components are less specific than the approved attack signature. The targeted action is Refine source/destination and protocol match components to the verified attack pattern.

Question 298

A tenant controller sends a FlowSpec discard rule for a broad prefix. Observed: Normal customer traffic is dropped because the match covers the entire tenant aggregate. What evidence would validate recovery from this precise failure mode?

  1. RIB contains only contracted routes and resource usage returns to safe levels.
  2. Inbound traffic converges to the agreed primary while the backup remains available.
  3. The session's TCP endpoint addresses match the planned loopback addresses.
  4. The attack is filtered while unaffected flows remain reachable.

Explanation

Correct Answer

D:

The intended result is The attack is filtered while unaffected flows remain reachable. It specifically verifies recovery from flowspec match components are less specific than the approved attack signature, which produced the original symptom: Normal customer traffic is dropped because the match covers the entire tenant aggregate. It is stronger evidence than a generic interface-up indicator.

Incorrect Answers

A:

This result is useful in another case with evidence An unexpected memory spike occurs although only a few prefixes should be accepted. It does not test recovery from normal customer traffic is dropped because the match covers the entire tenant aggregate. Check instead whether the attack is filtered while unaffected flows remain reachable.

B:

It confirms an unrelated service correction: Upstream local preference overrides the longer AS-path signal. The present case reports Normal customer traffic is dropped because the match covers the entire tenant aggregate. Its completion test is The attack is filtered while unaffected flows remain reachable.

C:

That observation would verify a separate fault involving update-source and reachability design disagree across the peers. Its symptom is One router silently sources TCP from a physical interface instead of its loopback. For this case the actual issue is flowspec match components are less specific than the approved attack signature, and the relevant success signal is The attack is filtered while unaffected flows remain reachable.

Question 299

A tenant controller sends a FlowSpec discard rule for a broad prefix. Observed: Normal customer traffic is dropped because the match covers the entire tenant aggregate. What underlying protocol or service configuration problem best explains the evidence?

  1. BGP inbound acceptance policy and max-prefix safety do not constrain the contracted feed.
  2. Update-source and reachability design disagree across the peers.
  3. Upstream local preference overrides the longer AS-path signal.
  4. FlowSpec match components are less specific than the approved attack signature.

Explanation

Correct Answer

D:

Because normal customer traffic is dropped because the match covers the entire tenant aggregate, the likely cause is flowspec match components are less specific than the approved attack signature. It is testable: Refine source/destination and protocol match components to the verified attack pattern. Expected follow-up: The attack is filtered while unaffected flows remain reachable.

Incorrect Answers

A:

That explanation fits another condition: An unexpected memory spike occurs although only a few prefixes should be accepted. The evidence here is Normal customer traffic is dropped because the match covers the entire tenant aggregate. Its closer root cause is FlowSpec match components are less specific than the approved attack signature.

B:

The stated cause is possible elsewhere but explains one router silently sources tcp from a physical interface instead of its loopback, not normal customer traffic is dropped because the match covers the entire tenant aggregate. This incident is better attributed to flowspec match components are less specific than the approved attack signature.

C:

Upstream local preference overrides the longer AS-path signal. would normally be accompanied by new prepended announcements do not influence the chosen inbound route. The observed symptom is different: Normal customer traffic is dropped because the match covers the entire tenant aggregate. The likely cause is FlowSpec match components are less specific than the approved attack signature.

Question 300

A tenant controller sends a FlowSpec discard rule for a broad prefix. Observed: Normal customer traffic is dropped because the match covers the entire tenant aggregate. Which ongoing validation gate would best detect a recurrence of this problem?

  1. For each approved related change, verify that the attack is filtered while unaffected flows remain reachable. Flag recurrence if normal customer traffic is dropped because the match covers the entire tenant aggregate.
  2. For each approved related change, verify that the session's TCP endpoint addresses match the planned loopback addresses. Flag recurrence if one router silently sources TCP from a physical interface instead of its loopback.
  3. For each approved related change, verify that rIB contains only contracted routes and resource usage returns to safe levels. Flag recurrence if an unexpected memory spike occurs although only a few prefixes should be accepted.
  4. For each approved related change, verify that inbound traffic converges to the agreed primary while the backup remains available. Flag recurrence if new prepended announcements do not influence the chosen inbound route.

Explanation

Correct Answer

A:

A useful regression gate tests whether the attack is filtered while unaffected flows remain reachable and alerts when normal customer traffic is dropped because the match covers the entire tenant aggregate. This directly checks the technical weakness: FlowSpec match components are less specific than the approved attack signature. The gate is derived from the fictional incident and is not an independent Juniper engineer signoff.

Incorrect Answers

B:

The proposed control is tied to update-source and reachability design disagree across the peers, typically observed when one router silently sources TCP from a physical interface instead of its loopback. Here the target is flowspec match components are less specific than the approved attack signature; monitor the attack is filtered while unaffected flows remain reachable.

C:

It is valid for another service scenario but checks an unexpected memory spike occurs although only a few prefixes should be accepted. This case instead needs a gate for normal customer traffic is dropped because the match covers the entire tenant aggregate and evidence that the attack is filtered while unaffected flows remain reachable.

D:

This gate monitors a different failure, new prepended announcements do not influence the chosen inbound route. It would not detect the current problem: Normal customer traffic is dropped because the match covers the entire tenant aggregate. The appropriate check requires the attack is filtered while unaffected flows remain reachable.

Service Provider Routing and Switching, Professional (JNCIP-SP) (JN0-664) Practice Tests