McAfee-Secured Website

Exam Code: JN0-664

Exam Name: Service Provider Routing and Switching, Professional (JNCIP-SP)

Certification Provider: Juniper

Corresponding Certification: JNCIP-SP

100% Juniper JN0-664 Guaranteed Success With Testking Training Materials

Get Real JN0-664 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

96 Questions & Answers with Testing Engine

"Service Provider Routing and Switching, Professional (JNCIP-SP) Exam", also known as JN0-664 exam, is a Juniper certification exam.

Pass your tests with the always up-to-date JN0-664 Exam Engine. Your JN0-664 training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Juniper JN0-664 Practice Test 69

Question 680

A managed services provider requires access to VPN routes for a security inspection node. Observed: One tenant bypasses inspection due to a direct imported route. What operational check best guards against this problem returning?

  1. For each approved related change, verify that the customer selects the intended VPN path under controlled backdoor tests. Flag recurrence if sham-link connectivity is missing and a customer backdoor link becomes preferred.
  2. For each approved related change, verify that core routing stays independent and tenant Internet access follows its authorized path. Flag recurrence if core transit traffic starts following a customer Internet gateway.
  3. For each approved related change, verify that traceroute and routing checks confirm two-way customer reachability. Flag recurrence if the remote PE sees the updated VPNv4 prefix but CE traffic cannot return.
  4. For each approved related change, verify that allowed tenant traffic traverses the inspection service with symmetric return paths. Flag recurrence if one tenant bypasses inspection due to a direct imported route.

Explanation

Correct Answer

D:

This control asks for the same recovery evidence (Allowed tenant traffic traverses the inspection service with symmetric return paths) and flags recurrence of the same failure (One tenant bypasses inspection due to a direct imported route). It targets the underlying issue, rt policy permits an alternate direct path that avoids the approved service chain, rather than a different service problem. The exact cadence must be agreed with operations.

Incorrect Answers

A:

The proposed control is tied to the provider path appears less preferable to the direct intra-area backdoor path, typically observed when sham-link connectivity is missing and a customer backdoor link becomes preferred. Here the target is rt policy permits an alternate direct path that avoids the approved service chain; monitor allowed tenant traffic traverses the inspection service with symmetric return paths.

B:

This gate monitors a different failure, core transit traffic starts following a customer internet gateway. It would not detect the current problem: One tenant bypasses inspection due to a direct imported route. The appropriate check requires allowed tenant traffic traverses the inspection service with symmetric return paths.

C:

It is valid for another service scenario but checks the remote pe sees the updated vpnv4 prefix but ce traffic cannot return. This case instead needs a gate for one tenant bypasses inspection due to a direct imported route and evidence that allowed tenant traffic traverses the inspection service with symmetric return paths.

Question 681

A PE leaks a default from a customer VRF into the provider master table. Observed: Core transit traffic starts following a customer Internet gateway. Which targeted remediation is most appropriate for the observed condition?

  1. Define route-policy preference for the primary and backup CE advertisements.
  2. Adjust customer-specific CE-to-PE route admission and VRF propagation policy.
  3. Remove unintended master-table import and implement a scoped VPN-only default.
  4. Configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed.

Explanation

Correct Answer

C:

This fix addresses the stated cause rather than an unrelated protocol. The reported symptom—Core transit traffic starts following a customer Internet gateway—is consistent with a route leak was configured in the wrong direction between master and tenant vrfs. Use the specified correction, then verify: Core routing stays independent and tenant Internet access follows its authorized path. Preserve existing policy and tenant isolation.

Incorrect Answers

A:

This change belongs to a different Layer 3 VPNs issue: The VPN intermittently chooses the slower CE even though the primary is healthy. That issue involves pe inbound route preference does not reflect the customer's intended ce priority. The current symptom is Core transit traffic starts following a customer Internet gateway. It instead requires remove unintended master-table import and implement a scoped VPN-only default.

B:

This remediates the ce-facing import policy is not accepting those routes, normally indicated by The PE does not export the agreed customer prefixes into its VRF. It would leave the observed problem (Core transit traffic starts following a customer Internet gateway) unresolved. Address it with remove unintended master-table import and implement a scoped VPN-only default.

D:

The option may be useful when customer VPN prefixes reach the ASBR but fail beyond the boundary, but that is not the current evidence. Here, core transit traffic starts following a customer Internet gateway, indicating a route leak was configured in the wrong direction between master and tenant vrfs. The targeted action is Remove unintended master-table import and implement a scoped VPN-only default.

Question 682

A PE leaks a default from a customer VRF into the provider master table. Observed: Core transit traffic starts following a customer Internet gateway. What evidence would validate recovery from this precise failure mode?

  1. Eligible CE prefixes enter the correct VRF and appear in remote VPN sites.
  2. Far-side PEs import intended VPN routes and customer packets traverse the AS boundary.
  3. The VPN picks the correct site under normal and simulated failure.
  4. Core routing stays independent and tenant Internet access follows its authorized path.

Explanation

Correct Answer

D:

The intended result is Core routing stays independent and tenant Internet access follows its authorized path. It specifically verifies recovery from a route leak was configured in the wrong direction between master and tenant vrfs, which produced the original symptom: Core transit traffic starts following a customer Internet gateway. It is stronger evidence than a generic interface-up indicator.

Incorrect Answers

A:

This result is useful in another case with evidence The PE does not export the agreed customer prefixes into its VRF. It does not test recovery from core transit traffic starts following a customer internet gateway. Check instead whether core routing stays independent and tenant Internet access follows its authorized path.

B:

That observation would verify a separate fault involving asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete. Its symptom is Customer VPN prefixes reach the ASBR but fail beyond the boundary. For this case the actual issue is a route leak was configured in the wrong direction between master and tenant vrfs, and the relevant success signal is Core routing stays independent and tenant Internet access follows its authorized path.

C:

It confirms an unrelated service correction: PE inbound route preference does not reflect the customer's intended CE priority. The present case reports Core transit traffic starts following a customer Internet gateway. Its completion test is Core routing stays independent and tenant Internet access follows its authorized path.

Question 683

A PE leaks a default from a customer VRF into the provider master table. Observed: Core transit traffic starts following a customer Internet gateway. What underlying protocol or service configuration problem best explains the evidence?

  1. The CE-facing import policy is not accepting those routes.
  2. PE inbound route preference does not reflect the customer's intended CE priority.
  3. A route leak was configured in the wrong direction between master and tenant VRFs.
  4. ASBR MP-BGP labeled VPN route handling and next-hop resolution are incomplete.

Explanation

Correct Answer

C:

Because core transit traffic starts following a customer Internet gateway, the likely cause is a route leak was configured in the wrong direction between master and tenant vrfs. It is testable: Remove unintended master-table import and implement a scoped VPN-only default. Expected follow-up: Core routing stays independent and tenant Internet access follows its authorized path.

Incorrect Answers

A:

That explanation fits another condition: The PE does not export the agreed customer prefixes into its VRF. The evidence here is Core transit traffic starts following a customer Internet gateway. Its closer root cause is A route leak was configured in the wrong direction between master and tenant VRFs.

B:

PE inbound route preference does not reflect the customer's intended CE priority. would normally be accompanied by the vpn intermittently chooses the slower ce even though the primary is healthy. The observed symptom is different: Core transit traffic starts following a customer Internet gateway. The likely cause is A route leak was configured in the wrong direction between master and tenant VRFs.

D:

The stated cause is possible elsewhere but explains customer vpn prefixes reach the asbr but fail beyond the boundary, not core transit traffic starts following a customer internet gateway. This incident is better attributed to a route leak was configured in the wrong direction between master and tenant vrfs.

Question 684

A PE leaks a default from a customer VRF into the provider master table. Observed: Core transit traffic starts following a customer Internet gateway. Which ongoing validation gate would best detect a recurrence of this problem?

  1. For each approved related change, verify that far-side PEs import intended VPN routes and customer packets traverse the AS boundary. Flag recurrence if customer VPN prefixes reach the ASBR but fail beyond the boundary.
  2. For each approved related change, verify that the VPN picks the correct site under normal and simulated failure. Flag recurrence if the VPN intermittently chooses the slower CE even though the primary is healthy.
  3. For each approved related change, verify that core routing stays independent and tenant Internet access follows its authorized path. Flag recurrence if core transit traffic starts following a customer Internet gateway.
  4. For each approved related change, verify that eligible CE prefixes enter the correct VRF and appear in remote VPN sites. Flag recurrence if the PE does not export the agreed customer prefixes into its VRF.

Explanation

Correct Answer

C:

A useful regression gate tests whether core routing stays independent and tenant Internet access follows its authorized path and alerts when core transit traffic starts following a customer Internet gateway. This directly checks the technical weakness: A route leak was configured in the wrong direction between master and tenant VRFs. The gate is derived from the fictional incident and is not an independent Juniper engineer signoff.

Incorrect Answers

A:

The proposed control is tied to asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete, typically observed when customer VPN prefixes reach the ASBR but fail beyond the boundary. Here the target is a route leak was configured in the wrong direction between master and tenant vrfs; monitor core routing stays independent and tenant Internet access follows its authorized path.

B:

This gate monitors a different failure, the vpn intermittently chooses the slower ce even though the primary is healthy. It would not detect the current problem: Core transit traffic starts following a customer Internet gateway. The appropriate check requires core routing stays independent and tenant Internet access follows its authorized path.

D:

It is valid for another service scenario but checks the pe does not export the agreed customer prefixes into its vrf. This case instead needs a gate for core transit traffic starts following a customer internet gateway and evidence that core routing stays independent and tenant Internet access follows its authorized path.

Question 685

A provider transitions some VPN sites to interprovider option B. Observed: Customer VPN prefixes reach the ASBR but fail beyond the boundary. Which change most directly corrects the failure while respecting the existing service boundary?

  1. Configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed.
  2. Apply distinct route-target import policies for the separate VPNs.
  3. Correct VRF label association and inspect MPLS service-label forwarding state.
  4. Check labels and forwarding entries across all ECMP transport next hops and repair the fault.

Explanation

Correct Answer

A:

The observed condition is Customer VPN prefixes reach the ASBR but fail beyond the boundary. That indicates asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete. Applying the proposed remedy directly changes that condition. A concrete completion check is: Far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

Incorrect Answers

B:

This remediates the pe imported vpn routes using shared route targets instead of isolated tenant membership, normally indicated by Traffic from one customer appears in the other's routing table. It would leave the observed problem (Customer VPN prefixes reach the ASBR but fail beyond the boundary) unresolved. Address it with configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed.

C:

This change belongs to a different Layer 3 VPNs issue: Customer VPN packets arrive with a valid label but are dropped during VRF lookup. That issue involves the service label maps to an unexpected forwarding table or vrf. The current symptom is Customer VPN prefixes reach the ASBR but fail beyond the boundary. It instead requires configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed.

D:

The option may be useful when the remote PE sees valid VPN reachability but data plane drops occur after ECMP change, but that is not the current evidence. Here, customer VPN prefixes reach the ASBR but fail beyond the boundary, indicating asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete. The targeted action is Configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed.

Question 686

A provider transitions some VPN sites to interprovider option B. Observed: Customer VPN prefixes reach the ASBR but fail beyond the boundary. After the correction, which result would most convincingly show that this fault is resolved?

  1. VPN packets are forwarded successfully over each eligible transport path.
  2. Each VRF receives only the customer routes authorized for its service.
  3. Far-side PEs import intended VPN routes and customer packets traverse the AS boundary.
  4. Inbound labeled packets resolve into the intended customer's VRF.

Explanation

Correct Answer

C:

After configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed, inspect whether far-side PEs import intended VPN routes and customer packets traverse the AS boundary. This closes the loop between the reported observation (Customer VPN prefixes reach the ASBR but fail beyond the boundary) and the underlying issue (ASBR MP-BGP labeled VPN route handling and next-hop resolution are incomplete).

Incorrect Answers

A:

That observation would verify a separate fault involving service-label forwarding and transport next-hop resolution disagree on one path. Its symptom is The remote PE sees valid VPN reachability but data plane drops occur after ECMP change. For this case the actual issue is asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete, and the relevant success signal is Far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

B:

This result is useful in another case with evidence Traffic from one customer appears in the other's routing table. It does not test recovery from customer vpn prefixes reach the asbr but fail beyond the boundary. Check instead whether far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

D:

It confirms an unrelated service correction: The service label maps to an unexpected forwarding table or VRF. The present case reports Customer VPN prefixes reach the ASBR but fail beyond the boundary. Its completion test is Far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

Question 687

A provider transitions some VPN sites to interprovider option B. Observed: Customer VPN prefixes reach the ASBR but fail beyond the boundary. Which root cause is most consistent with this symptom?

  1. The service label maps to an unexpected forwarding table or VRF.
  2. Service-label forwarding and transport next-hop resolution disagree on one path.
  3. The PE imported VPN routes using shared route targets instead of isolated tenant membership.
  4. ASBR MP-BGP labeled VPN route handling and next-hop resolution are incomplete.

Explanation

Correct Answer

D:

The reported evidence—Customer VPN prefixes reach the ASBR but fail beyond the boundary—supports asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete. The appropriate intervention is to configure approved option B VPN route exchange and valid labeled next-hop rewrite as designed, with confirmation from far-side PEs import intended VPN routes and customer packets traverse the AS boundary. Other causes require actual device-state verification.

Incorrect Answers

A:

The service label maps to an unexpected forwarding table or VRF. would normally be accompanied by customer vpn packets arrive with a valid label but are dropped during vrf lookup. The observed symptom is different: Customer VPN prefixes reach the ASBR but fail beyond the boundary. The likely cause is ASBR MP-BGP labeled VPN route handling and next-hop resolution are incomplete.

B:

The stated cause is possible elsewhere but explains the remote pe sees valid vpn reachability but data plane drops occur after ecmp change, not customer vpn prefixes reach the asbr but fail beyond the boundary. This incident is better attributed to asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete.

C:

That explanation fits another condition: Traffic from one customer appears in the other's routing table. The evidence here is Customer VPN prefixes reach the ASBR but fail beyond the boundary. Its closer root cause is ASBR MP-BGP labeled VPN route handling and next-hop resolution are incomplete.

Question 688

A provider transitions some VPN sites to interprovider option B. Observed: Customer VPN prefixes reach the ASBR but fail beyond the boundary. Which change-acceptance control is most relevant to preventing this exact failure?

  1. For each approved related change, verify that inbound labeled packets resolve into the intended customer's VRF. Flag recurrence if customer VPN packets arrive with a valid label but are dropped during VRF lookup.
  2. For each approved related change, verify that each VRF receives only the customer routes authorized for its service. Flag recurrence if traffic from one customer appears in the other's routing table.
  3. For each approved related change, verify that far-side PEs import intended VPN routes and customer packets traverse the AS boundary. Flag recurrence if customer VPN prefixes reach the ASBR but fail beyond the boundary.
  4. For each approved related change, verify that vPN packets are forwarded successfully over each eligible transport path. Flag recurrence if the remote PE sees valid VPN reachability but data plane drops occur after ECMP change.

Explanation

Correct Answer

C:

The control is specific to the initial failure. It requires the result Far-side PEs import intended VPN routes and customer packets traverse the AS boundary. and treats Customer VPN prefixes reach the ASBR but fail beyond the boundary. as a failure signal. The causal concern is asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete.

Incorrect Answers

A:

This gate monitors a different failure, customer vpn packets arrive with a valid label but are dropped during vrf lookup. It would not detect the current problem: Customer VPN prefixes reach the ASBR but fail beyond the boundary. The appropriate check requires far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

B:

It is valid for another service scenario but checks traffic from one customer appears in the other's routing table. This case instead needs a gate for customer vpn prefixes reach the asbr but fail beyond the boundary and evidence that far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

D:

The proposed control is tied to service-label forwarding and transport next-hop resolution disagree on one path, typically observed when the remote PE sees valid VPN reachability but data plane drops occur after ECMP change. Here the target is asbr mp-bgp labeled vpn route handling and next-hop resolution are incomplete; monitor far-side PEs import intended VPN routes and customer packets traverse the AS boundary.

Question 689

A provider provisions an LDP-signaled pseudowire between two customer Ethernet ports. Observed: One endpoint reports a matching neighbor but pseudowire status stays Down. What should the routing engineer change first to address this particular symptom?

  1. Configure supported all-active ES routes and aliasing behavior.
  2. Align service MTU and encapsulation overhead across both pseudowire ends.
  3. Configure the contracted matching VC ID and compatible circuit signaling on both endpoints.
  4. Clear stale MAC state safely and update the active VPLS member circuits.

Explanation

Correct Answer

C:

The decisive evidence is that One endpoint reports a matching neighbor but pseudowire status stays Down. This follows from the local and remote virtual circuit identifiers do not match. The focused remedy is to configure the contracted matching VC ID and compatible circuit signaling on both endpoints. Confirm improvement when the L2 circuit becomes Up and customer frames traverse the pseudowire. Validate on an approved lab or change window before touching production.

Incorrect Answers

A:

This remediates evpn aliasing and backup-path signaling are not aligned for the ethernet segment, normally indicated by Both attachment PEs forward duplicate known unicast after migration. It would leave the observed problem (One endpoint reports a matching neighbor but pseudowire status stays Down) unresolved. Address it with configure the contracted matching VC ID and compatible circuit signaling on both endpoints.

B:

This change belongs to a different Layer 2 VPNs issue: Traffic passes small frames but larger customer packets are discarded. That issue involves the attachment circuit and pseudowire do not share a compatible effective mtu. The current symptom is One endpoint reports a matching neighbor but pseudowire status stays Down. It instead requires configure the contracted matching VC ID and compatible circuit signaling on both endpoints.

D:

The option may be useful when customer MAC addresses appear on the wrong PE after a planned move, but that is not the current evidence. Here, one endpoint reports a matching neighbor but pseudowire status stays Down, indicating the local and remote virtual circuit identifiers do not match. The targeted action is Configure the contracted matching VC ID and compatible circuit signaling on both endpoints.

Question 690

A provider provisions an LDP-signaled pseudowire between two customer Ethernet ports. Observed: One endpoint reports a matching neighbor but pseudowire status stays Down. Which acceptance observation best confirms that the proposed change worked?

  1. MAC learning associates each CE to the currently correct VPLS attachment.
  2. Known-unicast forwarding uses qualified paths without persistent duplicate frames.
  3. Large authorized frames pass without fragmentation-induced drops.
  4. The L2 circuit becomes Up and customer frames traverse the pseudowire.

Explanation

Correct Answer

D:

This acceptance criterion tests the actual fault. The source evidence was One endpoint reports a matching neighbor but pseudowire status stays Down. The correction addresses the local and remote virtual circuit identifiers do not match; success requires the L2 circuit becomes Up and customer frames traverse the pseudowire.

Incorrect Answers

A:

That observation would verify a separate fault involving the vpls service still contains stale forwarding database or pseudowire mapping. Its symptom is Customer MAC addresses appear on the wrong PE after a planned move. For this case the actual issue is the local and remote virtual circuit identifiers do not match, and the relevant success signal is The L2 circuit becomes Up and customer frames traverse the pseudowire.

B:

This result is useful in another case with evidence Both attachment PEs forward duplicate known unicast after migration. It does not test recovery from one endpoint reports a matching neighbor but pseudowire status stays down. Check instead whether the L2 circuit becomes Up and customer frames traverse the pseudowire.

C:

It confirms an unrelated service correction: The attachment circuit and pseudowire do not share a compatible effective MTU. The present case reports One endpoint reports a matching neighbor but pseudowire status stays Down. Its completion test is The L2 circuit becomes Up and customer frames traverse the pseudowire.

Service Provider Routing and Switching, Professional (JNCIP-SP) (JN0-664) Practice Tests