McAfee-Secured Website

Exam Code: JN0-664

Exam Name: Service Provider Routing and Switching, Professional (JNCIP-SP)

Certification Provider: Juniper

Corresponding Certification: JNCIP-SP

100% Juniper JN0-664 Guaranteed Success With Testking Training Materials

Get Real JN0-664 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

96 Questions & Answers with Testing Engine

"Service Provider Routing and Switching, Professional (JNCIP-SP) Exam", also known as JN0-664 exam, is a Juniper certification exam.

Pass your tests with the always up-to-date JN0-664 Exam Engine. Your JN0-664 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Juniper JN0-664 Practice Test 66

Question 650

A customer VRF contains two prefixes that overlap with a provider loopback. Observed: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. After the correction, which result would most convincingly show that this fault is resolved?

  1. Each VRF receives only the customer routes authorized for its service.
  2. Customer route tables exclude core loopbacks while customer service remains intact.
  3. Receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.
  4. Branch Internet flows use the approved breakout without cross-VPN leakage.

Explanation

Correct Answer

B:

After tighten tenant VRF RT/prefix filters to reject infrastructure destinations, inspect whether customer route tables exclude core loopbacks while customer service remains intact. This closes the loop between the reported observation (Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF) and the underlying issue (The import policy lacks explicit provider-infrastructure prefix exclusion).

Incorrect Answers

A:

It confirms an unrelated service correction: The PE imported VPN routes using shared route targets instead of isolated tenant membership. The present case reports Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. Its completion test is Customer route tables exclude core loopbacks while customer service remains intact.

C:

This result is useful in another case with evidence Customer multicast control signaling exists but payload delivery fails at a remote PE. It does not test recovery from provider-wide bgp policy accidentally imports the provider loopback into a customer vrf. Check instead whether customer route tables exclude core loopbacks while customer service remains intact.

D:

That observation would verify a separate fault involving no authorized internet route leak or default path exists for the branch vrfs. Its symptom is Remote branches can reach each other but not the public Internet. For this case the actual issue is the import policy lacks explicit provider-infrastructure prefix exclusion, and the relevant success signal is Customer route tables exclude core loopbacks while customer service remains intact.

Question 651

A customer VRF contains two prefixes that overlap with a provider loopback. Observed: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. Which root cause is most consistent with this symptom?

  1. The PE imported VPN routes using shared route targets instead of isolated tenant membership.
  2. No authorized Internet route leak or default path exists for the branch VRFs.
  3. MVPN provider-tunnel encapsulation or multicast transport mapping is inconsistent.
  4. The import policy lacks explicit provider-infrastructure prefix exclusion.

Explanation

Correct Answer

D:

The reported evidence—Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF—supports the import policy lacks explicit provider-infrastructure prefix exclusion. The appropriate intervention is to tighten tenant VRF RT/prefix filters to reject infrastructure destinations, with confirmation from customer route tables exclude core loopbacks while customer service remains intact. Other causes require actual device-state verification.

Incorrect Answers

A:

The PE imported VPN routes using shared route targets instead of isolated tenant membership. would normally be accompanied by traffic from one customer appears in the other's routing table. The observed symptom is different: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. The likely cause is The import policy lacks explicit provider-infrastructure prefix exclusion.

B:

The stated cause is possible elsewhere but explains remote branches can reach each other but not the public internet, not provider-wide bgp policy accidentally imports the provider loopback into a customer vrf. This incident is better attributed to the import policy lacks explicit provider-infrastructure prefix exclusion.

C:

That explanation fits another condition: Customer multicast control signaling exists but payload delivery fails at a remote PE. The evidence here is Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. Its closer root cause is The import policy lacks explicit provider-infrastructure prefix exclusion.

Question 652

A customer VRF contains two prefixes that overlap with a provider loopback. Observed: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. Which change-acceptance control is most relevant to preventing this exact failure?

  1. For each approved related change, verify that branch Internet flows use the approved breakout without cross-VPN leakage. Flag recurrence if remote branches can reach each other but not the public Internet.
  2. For each approved related change, verify that customer route tables exclude core loopbacks while customer service remains intact. Flag recurrence if provider-wide BGP policy accidentally imports the provider loopback into a customer VRF.
  3. For each approved related change, verify that each VRF receives only the customer routes authorized for its service. Flag recurrence if traffic from one customer appears in the other's routing table.
  4. For each approved related change, verify that receivers in the remote VPN get the correct multicast stream without cross-tenant delivery. Flag recurrence if customer multicast control signaling exists but payload delivery fails at a remote PE.

Explanation

Correct Answer

B:

The control is specific to the initial failure. It requires the result Customer route tables exclude core loopbacks while customer service remains intact. and treats Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. as a failure signal. The causal concern is the import policy lacks explicit provider-infrastructure prefix exclusion.

Incorrect Answers

A:

The proposed control is tied to no authorized internet route leak or default path exists for the branch vrfs, typically observed when remote branches can reach each other but not the public Internet. Here the target is the import policy lacks explicit provider-infrastructure prefix exclusion; monitor customer route tables exclude core loopbacks while customer service remains intact.

C:

This gate monitors a different failure, traffic from one customer appears in the other's routing table. It would not detect the current problem: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. The appropriate check requires customer route tables exclude core loopbacks while customer service remains intact.

D:

It is valid for another service scenario but checks customer multicast control signaling exists but payload delivery fails at a remote pe. This case instead needs a gate for provider-wide bgp policy accidentally imports the provider loopback into a customer vrf and evidence that customer route tables exclude core loopbacks while customer service remains intact.

Question 653

A provider offers multicast VPN to an enterprise. Observed: Customer multicast control signaling exists but payload delivery fails at a remote PE. What should the routing engineer change first to address this particular symptom?

  1. Correct the receiving VRF import target or the originating export target according to service policy.
  2. Assign inet6 routes to the proper tenant instance and explicitly control exports.
  3. Match the supported MVPN transport profile and customer multicast state.
  4. Scope Internet default RT membership to contracted tenant VRFs only.

Explanation

Correct Answer

C:

The decisive evidence is that Customer multicast control signaling exists but payload delivery fails at a remote PE. This follows from mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent. The focused remedy is to match the supported MVPN transport profile and customer multicast state. Confirm improvement when receivers in the remote VPN get the correct multicast stream without cross-tenant delivery. Validate on an approved lab or change window before touching production.

Incorrect Answers

A:

The option may be useful when the customer route has a VPNv4 NLRI but is missing on a remote PE, but that is not the current evidence. Here, customer multicast control signaling exists but payload delivery fails at a remote PE, indicating mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent. The targeted action is Match the supported MVPN transport profile and customer multicast state.

B:

This change belongs to a different Layer 3 VPNs issue: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. That issue involves the customer interface or routing family is associated with the wrong routing instance. The current symptom is Customer multicast control signaling exists but payload delivery fails at a remote PE. It instead requires match the supported MVPN transport profile and customer multicast state.

D:

This remediates broad rt import/export policy exposed the default across unrelated vpns, normally indicated by One customer's default route is accidentally propagated to every tenant. It would leave the observed problem (Customer multicast control signaling exists but payload delivery fails at a remote PE) unresolved. Address it with match the supported MVPN transport profile and customer multicast state.

Question 654

A provider offers multicast VPN to an enterprise. Observed: Customer multicast control signaling exists but payload delivery fails at a remote PE. Which acceptance observation best confirms that the proposed change worked?

  1. The remote VRF imports only the intended VPN prefix and the site becomes reachable.
  2. Global and tenant IPv6 RIBs remain separate and allowed customer routes work.
  3. Only subscribed customers receive the shared breakout route.
  4. Receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

Explanation

Correct Answer

D:

This acceptance criterion tests the actual fault. The source evidence was Customer multicast control signaling exists but payload delivery fails at a remote PE. The correction addresses mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent; success requires receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

Incorrect Answers

A:

That observation would verify a separate fault involving the remote vrf does not import the route's export route target. Its symptom is The customer route has a VPNv4 NLRI but is missing on a remote PE. For this case the actual issue is mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent, and the relevant success signal is Receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

B:

It confirms an unrelated service correction: The customer interface or routing family is associated with the wrong routing instance. The present case reports Customer multicast control signaling exists but payload delivery fails at a remote PE. Its completion test is Receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

C:

This result is useful in another case with evidence One customer's default route is accidentally propagated to every tenant. It does not test recovery from customer multicast control signaling exists but payload delivery fails at a remote pe. Check instead whether receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

Question 655

A provider offers multicast VPN to an enterprise. Observed: Customer multicast control signaling exists but payload delivery fails at a remote PE. What is the most likely source of the observed routing or service failure?

  1. The customer interface or routing family is associated with the wrong routing instance.
  2. The remote VRF does not import the route's export route target.
  3. Broad RT import/export policy exposed the default across unrelated VPNs.
  4. MVPN provider-tunnel encapsulation or multicast transport mapping is inconsistent.

Explanation

Correct Answer

D:

This explanation is the closest match to the observed symptom: Customer multicast control signaling exists but payload delivery fails at a remote PE. The specified root issue is MVPN provider-tunnel encapsulation or multicast transport mapping is inconsistent. Repair it through match the supported MVPN transport profile and customer multicast state, then check receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

Incorrect Answers

A:

The customer interface or routing family is associated with the wrong routing instance. would normally be accompanied by ipv6 routes leak into the global ipv6 table instead of the tenant's inet6 vrf. The observed symptom is different: Customer multicast control signaling exists but payload delivery fails at a remote PE. The likely cause is MVPN provider-tunnel encapsulation or multicast transport mapping is inconsistent.

B:

The stated cause is possible elsewhere but explains the customer route has a vpnv4 nlri but is missing on a remote pe, not customer multicast control signaling exists but payload delivery fails at a remote pe. This incident is better attributed to mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent.

C:

That explanation fits another condition: One customer's default route is accidentally propagated to every tenant. The evidence here is Customer multicast control signaling exists but payload delivery fails at a remote PE. Its closer root cause is MVPN provider-tunnel encapsulation or multicast transport mapping is inconsistent.

Question 656

A provider offers multicast VPN to an enterprise. Observed: Customer multicast control signaling exists but payload delivery fails at a remote PE. What operational check best guards against this problem returning?

  1. For each approved related change, verify that receivers in the remote VPN get the correct multicast stream without cross-tenant delivery. Flag recurrence if customer multicast control signaling exists but payload delivery fails at a remote PE.
  2. For each approved related change, verify that global and tenant IPv6 RIBs remain separate and allowed customer routes work. Flag recurrence if iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF.
  3. For each approved related change, verify that the remote VRF imports only the intended VPN prefix and the site becomes reachable. Flag recurrence if the customer route has a VPNv4 NLRI but is missing on a remote PE.
  4. For each approved related change, verify that only subscribed customers receive the shared breakout route. Flag recurrence if one customer's default route is accidentally propagated to every tenant.

Explanation

Correct Answer

A:

This control asks for the same recovery evidence (Receivers in the remote VPN get the correct multicast stream without cross-tenant delivery) and flags recurrence of the same failure (Customer multicast control signaling exists but payload delivery fails at a remote PE). It targets the underlying issue, mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent, rather than a different service problem. The exact cadence must be agreed with operations.

Incorrect Answers

B:

This gate monitors a different failure, ipv6 routes leak into the global ipv6 table instead of the tenant's inet6 vrf. It would not detect the current problem: Customer multicast control signaling exists but payload delivery fails at a remote PE. The appropriate check requires receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

C:

The proposed control is tied to the remote vrf does not import the route's export route target, typically observed when the customer route has a VPNv4 NLRI but is missing on a remote PE. Here the target is mvpn provider-tunnel encapsulation or multicast transport mapping is inconsistent; monitor receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

D:

It is valid for another service scenario but checks one customer's default route is accidentally propagated to every tenant. This case instead needs a gate for customer multicast control signaling exists but payload delivery fails at a remote pe and evidence that receivers in the remote VPN get the correct multicast stream without cross-tenant delivery.

Question 657

A PE deploys IPv6 VPN on a dual-stack customer service. Observed: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. Which targeted remediation is most appropriate for the observed condition?

  1. Assign inet6 routes to the proper tenant instance and explicitly control exports.
  2. Assign the interface to the correct VRF and verify route learning.
  3. Apply compatible SOO tagging and route rejection on re-entry.
  4. Use route targets for import/export policy and RDs only for uniqueness as appropriate.

Explanation

Correct Answer

A:

This fix addresses the stated cause rather than an unrelated protocol. The reported symptom—IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF—is consistent with the customer interface or routing family is associated with the wrong routing instance. Use the specified correction, then verify: Global and tenant IPv6 RIBs remain separate and allowed customer routes work. Preserve existing policy and tenant isolation.

Incorrect Answers

B:

This change belongs to a different Layer 3 VPNs issue: The configured interface belongs to the master instance instead of its customer VRF. That issue involves the customer-facing logical interface was not bound to the intended routing instance. The current symptom is IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. It instead requires assign inet6 routes to the proper tenant instance and explicitly control exports.

C:

The option may be useful when both PEs advertise the same CE prefix with inconsistent site-of-origin tags, but that is not the current evidence. Here, iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF, indicating the customer interface or routing family is associated with the wrong routing instance. The targeted action is Assign inet6 routes to the proper tenant instance and explicitly control exports.

D:

This remediates a route distinguisher provides nlri uniqueness, not import-policy membership, normally indicated by Operators expect the RD itself to enforce customer route isolation. It would leave the observed problem (IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF) unresolved. Address it with assign inet6 routes to the proper tenant instance and explicitly control exports.

Question 658

A PE deploys IPv6 VPN on a dual-stack customer service. Observed: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. What evidence would validate recovery from this precise failure mode?

  1. Global and tenant IPv6 RIBs remain separate and allowed customer routes work.
  2. Customer ARP and route exchange occur only inside its authorized VRF.
  3. The multihomed site's prefix remains stable without reimport looping.
  4. Customer isolation follows the configured RT membership even where IPv4 prefixes overlap.

Explanation

Correct Answer

A:

The intended result is Global and tenant IPv6 RIBs remain separate and allowed customer routes work. It specifically verifies recovery from the customer interface or routing family is associated with the wrong routing instance, which produced the original symptom: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. It is stronger evidence than a generic interface-up indicator.

Incorrect Answers

B:

It confirms an unrelated service correction: The customer-facing logical interface was not bound to the intended routing instance. The present case reports IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. Its completion test is Global and tenant IPv6 RIBs remain separate and allowed customer routes work.

C:

That observation would verify a separate fault involving site-of-origin extended-community filtering is missing and can cause routing feedback. Its symptom is Both PEs advertise the same CE prefix with inconsistent site-of-origin tags. For this case the actual issue is the customer interface or routing family is associated with the wrong routing instance, and the relevant success signal is Global and tenant IPv6 RIBs remain separate and allowed customer routes work.

D:

This result is useful in another case with evidence Operators expect the RD itself to enforce customer route isolation. It does not test recovery from ipv6 routes leak into the global ipv6 table instead of the tenant's inet6 vrf. Check instead whether global and tenant IPv6 RIBs remain separate and allowed customer routes work.

Question 659

A PE deploys IPv6 VPN on a dual-stack customer service. Observed: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. What underlying protocol or service configuration problem best explains the evidence?

  1. Site-of-origin extended-community filtering is missing and can cause routing feedback.
  2. The customer-facing logical interface was not bound to the intended routing instance.
  3. The customer interface or routing family is associated with the wrong routing instance.
  4. A route distinguisher provides NLRI uniqueness, not import-policy membership.

Explanation

Correct Answer

C:

Because iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF, the likely cause is the customer interface or routing family is associated with the wrong routing instance. It is testable: Assign inet6 routes to the proper tenant instance and explicitly control exports. Expected follow-up: Global and tenant IPv6 RIBs remain separate and allowed customer routes work.

Incorrect Answers

A:

The stated cause is possible elsewhere but explains both pes advertise the same ce prefix with inconsistent site-of-origin tags, not ipv6 routes leak into the global ipv6 table instead of the tenant's inet6 vrf. This incident is better attributed to the customer interface or routing family is associated with the wrong routing instance.

B:

The customer-facing logical interface was not bound to the intended routing instance. would normally be accompanied by the configured interface belongs to the master instance instead of its customer vrf. The observed symptom is different: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. The likely cause is The customer interface or routing family is associated with the wrong routing instance.

D:

That explanation fits another condition: Operators expect the RD itself to enforce customer route isolation. The evidence here is IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. Its closer root cause is The customer interface or routing family is associated with the wrong routing instance.

Question 660

A PE deploys IPv6 VPN on a dual-stack customer service. Observed: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. Which ongoing validation gate would best detect a recurrence of this problem?

  1. For each approved related change, verify that global and tenant IPv6 RIBs remain separate and allowed customer routes work. Flag recurrence if iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF.
  2. For each approved related change, verify that customer isolation follows the configured RT membership even where IPv4 prefixes overlap. Flag recurrence if operators expect the RD itself to enforce customer route isolation.
  3. For each approved related change, verify that the multihomed site's prefix remains stable without reimport looping. Flag recurrence if both PEs advertise the same CE prefix with inconsistent site-of-origin tags.
  4. For each approved related change, verify that customer ARP and route exchange occur only inside its authorized VRF. Flag recurrence if the configured interface belongs to the master instance instead of its customer VRF.

Explanation

Correct Answer

A:

A useful regression gate tests whether global and tenant IPv6 RIBs remain separate and allowed customer routes work and alerts when iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. This directly checks the technical weakness: The customer interface or routing family is associated with the wrong routing instance. The gate is derived from the fictional incident and is not an independent Juniper engineer signoff.

Incorrect Answers

B:

It is valid for another service scenario but checks operators expect the rd itself to enforce customer route isolation. This case instead needs a gate for ipv6 routes leak into the global ipv6 table instead of the tenant's inet6 vrf and evidence that global and tenant IPv6 RIBs remain separate and allowed customer routes work.

C:

The proposed control is tied to site-of-origin extended-community filtering is missing and can cause routing feedback, typically observed when both PEs advertise the same CE prefix with inconsistent site-of-origin tags. Here the target is the customer interface or routing family is associated with the wrong routing instance; monitor global and tenant IPv6 RIBs remain separate and allowed customer routes work.

D:

This gate monitors a different failure, the configured interface belongs to the master instance instead of its customer vrf. It would not detect the current problem: IPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. The appropriate check requires global and tenant IPv6 RIBs remain separate and allowed customer routes work.

Service Provider Routing and Switching, Professional (JNCIP-SP) (JN0-664) Practice Tests