24 free Juniper JN0-664 JNCIP-SP practice questions from the CertStash pack of 96, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 24 free here, all 96 in the pack, and each step includes the one before it.
Get all 96 questions (US$39) · Download the first 10 as a PDF
Question 1
Which two statements are correct regarding the PIM DR in a PIM-SM domain? (Choose two.)
Show answer and explanation
Correct answer: C, D. The source DR sends PIM register messages from the source network to the RP; The receiver DR sends PIM join and PIM prune messages from the receiver network toward the RP.
In PIM Sparse Mode, the source DR (Designated Router) on the source network sends PIM register messages toward the RP to announce the source and encapsulate multicast data. The receiver DR on the receiver network sends PIM join and prune messages toward the RP to establish and maintain the multicast tree. These are core responsibilities of DRs at different ends of the multicast path.
Why the other options are wrong
- A. PIM DR election occurs on all links, including point-to-point links; this is not specific to point-to-point links only.
- B. If DR priorities match, the router with the highest IP address is selected as DR, not the lowest.
Question 2
An interface is configured with a behavior aggregate classifier and a multifield classifier. How will the packet be processed when received on this interface?
Show answer and explanation
Correct answer: B. The packet will be processed by the BA classifier first, then the MF classifier.
When both a behavior aggregate (BA) classifier and a multifield (MF) classifier are configured on an interface, the BA classifier is applied first as a coarse classification step. The MF classifier, which performs more granular classification based on multiple fields, is then applied to further refine the classification for packets that pass through the BA classifier.
Why the other options are wrong
- A. The MF classifier does not process packets before the BA classifier.
- C. Packets are not discarded simply because two classifiers are configured; they are processed according to the configured order.
- D. The classifiers will apply their configured changes to packet markings.
Question 3
You are configuring a BGP signaled Layer 2 VPN across your MPLS enabled core network. Your PE-2 device connects to two sites within the same VPN. In this scenario, which statement is correct?
Show answer and explanation
Correct answer: D. By default on PE-2, the remote site IDs are automatically assigned based on the order that you add the interfaces to the site configuration.
When a PE device connects to multiple sites within the same BGP L2VPN, the remote site identifiers are automatically assigned based on the sequence in which interfaces are added to the site configuration. This automatic assignment simplifies configuration management for multi-site deployments.
Why the other options are wrong
- A. A single Layer 2 VPN routing instance can support multiple sites on a PE device; separate instances are not required per site.
- B. The local site ID is not automatically assigned a value of 0, and it does not need to match the total number of attached sites.
- C. Multiple sites on a PE device can share physical interfaces using VLAN or other multiplexing techniques; separate physical interfaces are not mandatory.
Question 4
You are responding to an RFP for a new MPLS VPN implementation. The solution must use LDP for signaling and support Layer 2 connectivity without using BGP. The solution must be scalable and support multiple VPN connections over a single MPLS LSP. The customer wants to maintain all routing for their private network. In this scenario, which solution do you propose?
Show answer and explanation
Correct answer: C. LDP Layer 2 circuit
LDP Layer 2 Circuit (LDP L2Circuit) meets all requirements: it uses LDP for signaling without requiring BGP, supports Layer 2 connectivity, is scalable, allows multiple VPN connections over a single MPLS LSP through circuit multiplexing, and enables customers to maintain their own routing in the private network since it operates at Layer 2.
Why the other options are wrong
- A. Circuit cross-connect does not provide the scalability and multi-connection support required.
- B. BGP Layer 2 VPN requires BGP, which contradicts the requirement to not use BGP.
- D. Translational cross-connect is not a standard Layer 2 VPN solution and does not meet the stated requirements.
Question 5
Which two statements are correct about the customer interface in an LDP-signaled pseudowire? (Choose two.)
Show answer and explanation
Correct answer: A, B. When the encapsulation is vlan-ccc or extended-vlan-ccc, the configured VLAN tag is included in the control plane LDP advertisement; When the encapsulation is ethernet-ccc, tagged and untagged frames are both accepted in the data plane.
With vlan-ccc or extended-vlan-ccc encapsulation, the configured VLAN tag is included in the control plane LDP advertisement to identify the service. With ethernet-ccc encapsulation, the customer interface accepts both tagged and untagged Ethernet frames in the data plane, providing flexibility for different frame types on the same physical interface.
Why the other options are wrong
- C. Ethernet-ccc accepts both tagged and untagged frames, not only untagged frames.
- D. The VLAN tag configured for vlan-ccc or extended-vlan-ccc is included in the LDP advertisement, not excluded.
Question 6
You are configuring schedulers to define the class-of-service properties of output queues. You want to control packet drops during periods of congestion. In this scenario, which CoS configuration parameter would be used to accomplish this task?
Show answer and explanation
Correct answer: D. drop profile
The drop profile parameter in CoS scheduler configuration defines the packet drop behavior during congestion periods. It determines how packets are probabilistically or deterministically dropped based on queue depth and configured thresholds, effectively controlling packet drops when the output queue experiences congestion.
Why the other options are wrong
- A. Buffer size determines queue capacity but does not control the drop behavior during congestion.
- B. Priority determines which queues are serviced first but does not control packet drops during congestion.
- C. Shaping rate limits the output rate of traffic but does not directly control drops during congestion on output queues.
Question 7
You want to ensure that a single-area OSPF network will be loop free. In this scenario, what are two requirements that satisfy this requirement? (Choose two.)
Show answer and explanation
Correct answer: B, D. The Shortest Path First algorithm must prune looped paths; All nodes within an area must have the same information in their LSDBs.
A single-area OSPF network remains loop-free through the Shortest Path First (SPF) algorithm, which prunes looped paths by calculating shortest paths to all destinations based on link costs. Additionally, all nodes within an area must have identical Link State Databases (LSDBs) to ensure consistent routing decisions and prevent loops; the DR/BDR facilitates this by ensuring reliable LSA flooding to all nodes in the area.
Why the other options are wrong
- A. While the DR/BDR helps distribute information, they do not single-handedly ensure LSDB consistency; all nodes must participate in LSA exchange.
- C. Full mesh connectivity is not required; OSPF uses flooding and adjacency relationships, not necessarily full mesh topology.
Question 8
After a recent power outage, your manager asks you to investigate ways to automatically reduce the impact caused by suboptimal routing in your OSPF and OSPFv3 network after devices reboot. Which three configuration statements accomplish this task? (Choose three.)
Show answer and explanation
Correct answer: A, C, E. set protocols ospf3 realm ipv4-unicast overload timeout 900; set protocols ospf overload timeout 900; set protocols ospf3 overload timeout 900
After a device reboots, the overload feature prevents it from being used as a transit router until it is fully converged, reducing suboptimal routing. Option A configures overload for OSPFv3 with IPv4 unicast realm and a 900-second timeout. Option C configures overload for OSPF with a 900-second timeout. Option E configures overload for OSPFv3 with a 900-second timeout. These three statements provide graceful restart capabilities across both OSPF and OSPFv3 with automatic timeout-based recovery.
Why the other options are wrong
- B. Missing the timeout value, which is needed to automatically recover after convergence completes.
- D. Missing the timeout value, leaving the router in permanent overload state without automatic recovery.
Question 9
You are configuring anycast RP for load balancing and redundancy in your PIM-SM domain. You want to share active sources between RPs. In this scenario, what are two solutions that will accomplish this task? (Choose two.)
Show answer and explanation
Correct answer: A, B. Configure MSDP on each RP router; Configure anycast PIM with the rp-set statement on each RP router.
In anycast RP configurations, MSDP (Multicast Source Discovery Protocol) is configured on each RP router to share active sources between RPs and enable proper source discovery across the domain. The rp-set statement on each RP router establishes the anycast RP set membership. Configuring these on source DR routers or using rp-set alone is insufficient for complete load balancing and source sharing between RPs.
Why the other options are wrong
- C. The rp-set statement must be configured on RP routers, not on DR routers, as RPs need to know their set membership.
- D. MSDP must be configured on RP routers where the source state is learned, not on DR routers.
Question 10
Which two statements are correct about VPLS tunnels? (Choose two.)
Show answer and explanation
Correct answer: B, D. LDP-signaled VPLS tunnels only support control bit 0; BGP-signaled VPLS tunnels can use either RSVP or LDP between the PE routers.
In Junos, LDP-signaled VPLS supports only control bit 0, meaning the control word is not used. BGP-signaled VPLS only handles the VPLS signaling and auto-discovery, and it can run over either RSVP-signaled or LDP-signaled LSPs as the transport between PE routers. These two statements are correct.
Why the other options are wrong
- A. BGP-signaled VPLS supports auto-discovery, so remote sites do not need to be provisioned manually on each PE.
- C. LDP-signaled VPLS has no built-in auto-discovery; neighbors must be configured manually.
What people say about the full JN0-664 pack 5.0 from 4
You need to make sure you have enough time to read all Cert Stash JN0-664 exam questions carefully.All the Q&As are valid. I just passed my test yesterday.
Clearing my JN0-664 exam today was made possible thanks to the helpful dumps. Cert Stash is highly recommended for the Service Provider Professional (JNCIP-SP) exam. Thanks!
I couldn’t help but celebrate when I cleared my Service Provider Professional (JNCIP-SP) JN0-664 exam on the first attempt. I scored well, which was all thanks to the latest dumps of Cert Stash. Wonderful!
Question 11
Which three statements about IS-IS in a multi-area network are correct? (Choose three.)
Show answer and explanation
Correct answer: C, D, E. Internal L1 PDUs are flooded to the local area’s L2 routers; External L2 PDUs are flooded to all L2 routers in other areas; Internal L1 PDUs are only flooded to the local area's L1 routers.
In multi-area IS-IS networks, flooding scope is determined by PDU type and router level. Internal L1 PDUs are flooded only within the local area's L1 routers but are also flooded to the local area's L2 routers for database maintenance. External L2 PDUs, generated by L2 routers, are flooded to all L2 routers across all areas in the IS-IS domain. L1 PDUs never cross area boundaries to other areas.
Why the other options are wrong
- A. Internal L1 PDUs remain within the local area and are not flooded to L1 routers in other areas; they do not cross area boundaries.
- B. External L2 PDUs are flooded to all L2 routers throughout the entire domain, not restricted to only the local area's L2 routers.
Question 12
When using 0SPFv3 for an IPv4 environment, which statement is correct?
Show answer and explanation
Correct answer: D. OSPFv3 supports IPv4 only on interfaces with family inet6 defined.
OSPFv3 supports both IPv4 and IPv6 addressing, but IPv4 support in OSPFv3 requires that the interfaces have the family inet6 address family defined. This allows OSPFv3 to operate in an IPv4 environment by using IPv6 link-local addresses for adjacency while advertising IPv4 routes and prefixes.
Why the other options are wrong
- A. OSPFv3 supports both IPv4 and IPv6, not only IPv4.
- B. OSPFv3 is backward compatible with OSPFv2 for IPv4 routing capabilities when properly configured.
- C. OSPFv3 can support both IPv6 and IPv4 within the same routing instance through address families.
Question 13
You are a network architect for a service provider and want to offer Layer 2 services to your customers. You want to use EVPN for Layer 2 services in your existing MPLS network. Which two statements are correct in this scenario? (Choose two.)
Show answer and explanation
Correct answer: B, C. EVPN uses Type 2 routes to advertise MAC address and IP address pairs learned using ARP snooping; EVPN uses Type 3 routes to join a multicast tree to flood traffic.
EVPN Type 2 routes advertise MAC-to-IP address bindings learned through ARP snooping, enabling efficient MAC and IP learning. EVPN Type 3 routes are used for inclusive multicast tree joins, allowing PE routers to join the multicast tree for efficient flooding of unknown unicast, broadcast, and multicast traffic.
Why the other options are wrong
- A. Segment routing is optional in EVPN deployments and not required for Layer 2 services in existing MPLS networks.
- D. VXLAN is not required for EVPN in an existing MPLS network; EVPN operates as an overlay on the MPLS infrastructure.
Question 14
Which two statements describe PIM-SM? (Choose two.)
Show answer and explanation
Correct answer: B, D. Traffic is only forwarded to routers that request to join the distribution tree; Routers with receivers send join messages to their upstream neighbors.
PIM-SM (Sparse Mode) operates on the principle that traffic is sent only to places where receivers explicitly request it. Routers with receivers send PIM Join messages upstream toward the RP (Rendezvous Point) or the source to subscribe to the distribution tree. Traffic is only forwarded along the tree to routers that have requested group membership, making it an efficient pull model rather than a flood-and-prune approach.
Why the other options are wrong
- A. PIM-SM does not require periodic pruning by routers without receivers; routers simply do not join the tree if there are no local receivers.
- C. This describes PIM-DM (Dense Mode), not PIM-SM. PIM-DM floods traffic and prunes branches, whereas PIM-SM only sends where requested.
Question 15
A packet is received on an interface configured with transmission scheduling. One of the configured queues is exceeding the allocated bandwidth. In this scenario, which two actions will be taken by default on a Junos device? (Choose two.)
Show answer and explanation
Correct answer: A, D. The exceeding queue will be considered to have negative bandwidth credit; The excess traffic will use bandwidth available from other queues.
When a queue exceeds its allocated bandwidth, it accumulates negative bandwidth credit, representing the overage. Excess traffic will use available bandwidth from other queues through the credit system, allowing borrowing from underutilized queues. This provides bandwidth flexibility while maintaining scheduling discipline.
Why the other options are wrong
- B. Excess traffic is not discarded by default; it uses borrowing mechanisms instead.
- C. Exceeding queues have negative credit, not positive credit, when they overspend their allocation.
Question 16
Which statement is correct about IS-IS when it performs the Dijkstra algorithm?
Show answer and explanation
Correct answer: B. When a new neighbor ID in the tree database matches a router ID in the LSDthe neighbor ID is moved to the candidate database.
During the Dijkstra shortest path first calculation, IS-IS maintains a tree database of candidate neighbors and an LSDB (Link State Database). When processing the tree database, the algorithm identifies neighbors whose router IDs match entries in the LSDB and moves these matched entries from the tree database to the candidate database for further processing as potential next hops.
Why the other options are wrong
- A. The local router's tuples are initially placed in the candidate database, not moved from the tree database.
- C. Tuples are moved from the candidate database (lowest cost) to the tree database, not the reverse.
- D. The algorithm stops when the candidate database is empty, not the tree database.
Question 17
You are asked to protect your company's customers from amplification attacks. In this scenario, what is Juniper's recommended protection method?
Show answer and explanation
Correct answer: B. BGP FlowSpec
BGP FlowSpec is Juniper's recommended method for protecting against amplification attacks. It allows dynamic filtering of traffic at the network edge based on traffic flow specifications, enabling operators to drop amplification attack traffic before it reaches its target. FlowSpec can be deployed rapidly across the network to respond to ongoing attacks and filter specific traffic patterns associated with amplification attacks.
Why the other options are wrong
- A. ASN prepending is used for traffic engineering and influencing route selection, not for DDoS protection.
- C. Destination-based RTBH (Remote Triggered Black Hole) drops all traffic to a destination, which is too broad for selective amplification attack mitigation.
- D. Unicast Reverse Path Forwarding validates source address legitimacy but does not specifically address amplification attacks, which often use spoofed sources.
Question 18
Which two statements are correct about a sham link? (Choose two.)
Show answer and explanation
Correct answer: A, B. The PEs exchange Type 1 OSPF LSAs instead of Type 3 OSPF LSAs for the L3VPN routes; It creates an OSPF multihop neighborship between two PE routers.
A sham link creates an OSPF multihop neighbor relationship between two PE routers across the MPF backbone. This allows them to exchange Type 1 (Router) LSAs directly instead of Type 3 (Summary) LSAs, enabling optimal path selection for L3VPN routes and preventing suboptimal routing through the MPLS network.
Why the other options are wrong
- C. Sham links are OSPF constructs, not BGP; they do not create BGP neighbor relationships.
- D. Type 1 LSAs are exchanged via the sham link, not Type 3 LSAs.
Question 19
Which two statements about IS-IS are correct? (Choose two.)
Show answer and explanation
Correct answer: B, C. PSNPs are used to acknowledge a received LSP; PSNPs are used to request a missing LSP.
In IS-IS, PSNPs (Partial Sequence Number PDUs) are used to acknowledge receipt of specific LSPs and to request missing LSPs by including the sequence numbers of LSPs that need to be transmitted. CSNPs (Complete Sequence Number PDUs) contain a complete list of all LSPs known to the router and are used to synchronize the link-state database during adjacency formation or flooding, but they do not request missing LSPs or acknowledge individual receipt.
Why the other options are wrong
- A. Incorrect because CSNPs provide a complete database summary and are used for synchronization, not for requesting specific missing LSPs.
- D. Incorrect because CSNPs are used for database synchronization and summary purposes, not for acknowledging individual LSP receipts.
Question 20
You have an L2VPN connecting two CEs across a provider network that runs OSPF. You have OSPF configured on both CEs. Which two statements are correct in this scenario? (Choose two.)
Show answer and explanation
Correct answer: B, D. OSPF neighborship is formed between the two CEs; The CE and PE OSPF areas can be different.
In an L2VPN scenario, the two CEs are directly connected via the provider network, and OSPF can be configured between them. The OSPF adjacency forms between the two CEs themselves, not between CE and PE devices. Since the CEs are in a separate routing domain from the provider's OSPF network, their OSPF areas can differ from the provider's configuration; there is no requirement for area matching across the VPN boundary.
Why the other options are wrong
- A. OSPF adjacency is established between the CEs, not between CEs and PEs. The PE devices operate at Layer 2 for this connection.
- C. There is no requirement for OSPF areas to match between CE and PE because they are in separate routing domains connected via Layer 2.
Question 21
You are configuring a Layer 3 VPN between two sites. You are configuring the vrf-target target: 65100:100 statement in your routing instance. In this scenario, which two statements describe the vrf-target configuration? (Choose two.)
Show answer and explanation
Correct answer: A, C. This value is used to identify BGP routes learned from the remote PE device; This value is used to add a target community to BGP routes advertised to the remote PE device.
The vrf-target is a route target extended community used for VRF import and export policies. It identifies BGP routes learned from the remote PE device for import into the local VRF, and it is added as a target community to BGP routes advertised to the remote PE device to indicate which VRF they belong to.
Why the other options are wrong
- B. The vrf-target is not used to add communities to routes advertised to the local CE device; it operates between PE devices.
- D. The vrf-target identifies routes from remote PEs, not from the local CE device.
Question 22
A router running IS-IS is configured with an ISO address of 49.0001.00a0.c96b.c490.00. Which part of this address is the system ID?
Show answer and explanation
Correct answer: C. 00a0.c96b.c490 is the system identifier.
ISO addresses in IS-IS follow the format: AFI.Area.System-ID.NSEL. In the address 49.0001.00a0.c96b.c490.00, the components are: 49 is the AFI (Authority and Format Identifier), 0001 is the area identifier, 00a0.c96b.c490 is the system ID (6 octets), and 00 is the NSEL (N-Selector). The system ID is always 6 octets or 48 bits and is represented as three 16-bit hexadecimal values.
Why the other options are wrong
- A. c96b.c490 is only 4 octets and represents the last portion of the system ID, not the complete system identifier.
- B. c490 is only 2 octets and represents only the final part of the system ID, not the full 6-octet identifier.
- D. 0001.00a0.c96b.c490 includes the area identifier (0001) along with the system ID, but the system ID itself excludes the area portion.
Question 23
Which two statements are correct about reflecting inet-vpn unicast prefixes in BGP route reflection? (Choose two.)
Show answer and explanation
Correct answer: C, D. Route reflectors do not change any existing BGP attributes by default when advertising routes; A BGP peer does not require any configuration changes to become a route reflector client.
Route reflectors do not modify existing BGP attributes such as AS PATH, NEXT_HOP, or LOCAL_PREF when readvertising routes from clients to other clients or to non-client peers; they only add cluster ID and originator ID attributes for loop prevention. BGP peers can become route reflector clients with no configuration changes on their end; the configuration required is only on the route reflector itself, which designates certain neighbors as clients.
Why the other options are wrong
- A. Clients do not add originator ID; the route reflector adds the originator ID when readvertising client routes to prevent loops.
- B. Route reflectors do not add cluster ID to the AS PATH; cluster ID is a separate attribute used for loop detection within the route reflector cluster.
Question 24
What is the correct order of packet flow through configurable components in the Junos OS CoS features?
Show answer and explanation
Correct answer: B. Behavior Aggregate Classifier -> Multifield Classifier -> Input Policer -> Forwarding Policy Options -> Fabric Scheduler -> Output Policer -> Scheduler/Shaper/RED -> Rewrite Marker
The correct packet flow through Junos OS CoS components follows the ingress-to-egress path: Behavior Aggregate Classifier first applies class-of-service markings based on packet headers, followed by the Multifield Classifier for more granular classification. The Input Policer then enforces rate limits on ingress traffic. Forwarding Policy Options applies routing policies, and the Fabric Scheduler manages internal fabric switching. On egress, the Output Policer enforces per-queue rate limits, followed by the Scheduler/Shaper/RED which performs queue management and drop policies, and finally the Rewrite Marker re-marks packet headers based on the assigned forwarding class and drop profile.
Why the other options are wrong
- A. Incorrect because Multifield Classifier should come after Behavior Aggregate Classifier, not before it, and Rewrite Marker should be last.
- C. Incorrect because Multifield Classifier should come after Behavior Aggregate Classifier, not between Input Policer and Forwarding Policy Options.
- D. Incorrect because Scheduler/Shaper/RED must come before Output Policer on egress, not after it.
That was 24 of 96.
The full Juniper JN0-664 JNCIP-SP pack has all 96 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 50 free as one PDF by email. Get the Half Pack →