The Juniper JN0-352 exam validates your expertise in enterprise routing and switching technologies within the Juniper Data Center Certification program. This exam is designed for network professionals who design, implement, and troubleshoot complex routing and switching environments using Juniper solutions. This landing page provides a structured study roadmap, covers the core exam topics, and connects you with practical preparation resources to help you pass with confidence.
Use this topic map to guide your study for Juniper JN0-352 (Enterprise Routing and Switching, Specialist) within the Juniper Data Center Certification path.
The JN0-352 exam uses multiple question formats to assess both conceptual knowledge and practical decision-making skills. Questions progress in difficulty and reflect real-world scenarios that network professionals encounter.
Questions increase in complexity as you progress, requiring you to integrate knowledge across multiple domains and apply critical thinking to unfamiliar situations.
An effective study plan divides the exam topics into weekly modules, allowing time for hands-on practice and concept integration. Combine self-study with practical labs and regular progress checks to build confidence and identify weak areas early.
Explore other Juniper certifications: view all Juniper exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to JN0-352 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a Bundle Discount offer for both formats: Enterprise Routing and Switching, Specialist.
BGP, OSPF, and High Availability typically account for a significant portion of the exam. However, Layer 2 concepts and security are equally important for real-world deployments. Balance your study time across all domains rather than skipping any topic, as the exam tests integrated knowledge.
In practice, you first design VLAN segments and trunk ports (Layer 2 Switching), then prevent loops using Spanning Tree, and finally secure the infrastructure against MAC flooding and ARP attacks (Layer 2 Security). These three topics form the foundation of a secure, stable access layer before routing protocols take over.
Hands-on experience is highly valuable. Prioritize labs that let you configure OSPF and BGP from scratch, implement VRRP failover, and troubleshoot protocol convergence issues. Even simulated labs build muscle memory and deepen your understanding of how configuration changes affect network behavior.
Confusing administrative distance values across routing protocols, overlooking VLAN trunk configuration details, and misunderstanding BGP path selection rules are frequent pitfalls. Additionally, many candidates rush through scenario questions without fully reading all options. Slow down, re-read the question, and eliminate obviously wrong answers first.
Review high-level concept summaries rather than re-reading entire study guides. Take one full-length timed practice test to validate your pacing and identify any remaining gaps. Spend remaining time on weak areas identified in practice tests, and get adequate sleep the night before the exam to ensure mental clarity.
A Juniper Networks EX Series Switch has storm control enabled on all interfaces. The ge-0/0/1 interface carrying several VLANs hits its storm control limit and is shut down.
In this scenario, which command allows you to manually clear the violation?
When storm control on an EX Series switch is configured with an action of interface-shutdown (rather than the default of simply dropping excess traffic), exceeding the configured bandwidth threshold for broadcast, multicast, or unknown-unicast traffic causes Junos to administratively disable the offending interface to protect the rest of the switching fabric. Recovery from this condition can happen automatically if a recovery-timeout interval has been configured, but when immediate manual recovery is required, the operational command clear ethernet-switching recovery-timeout interface interface-name explicitly clears the storm-control-triggered violation and re-enables the port without waiting for the timer to expire. This command is purpose-built for this exact condition and is distinct from more general troubleshooting commands: clear ethernet-switching table purges the learned MAC address database and has no bearing on a storm-control-disabled port; clear interface statistics resets traffic counters for diagnostic baselining but does not touch administrative state; and clear log messages simply flushes the local system log buffer. Administrators should also verify the underlying cause of the storm --- a switching loop, a misbehaving host, or a misconfigured device --- before manually clearing the condition, since without addressing the root cause the port is likely to trip again. This command and workflow are commonly tested as part of the Layer 2 security and resiliency features on EX platforms. Reference topics: Junos Enterprise Switching -- Storm Control and Port Security, Recovering Interfaces Disabled by Storm Control.
You have enabled MACsec on two directly connected Ethernet devices but MACsec is not working.
Which two actions will solve this problem? (Choose two.)
MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching -- Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.
Which statement describes the purpose of an integrated routing and bridging (IRB) interface on a Juniper Networks EX Series Switch?
An integrated routing and bridging interface, configured as irb.x on an EX Series switch, is the mechanism that bridges the Layer 2 and Layer 3 forwarding planes for a given bridge domain or VLAN. By assigning an irb logical unit to a VLAN and configuring an IP address on that unit, the switch gains a routable Layer 3 gateway address that hosts within that VLAN can use as their default gateway, enabling traffic destined for other subnets to be routed off the local broadcast domain. Internally, when a frame destined for the gateway's MAC address arrives on any port belonging to that VLAN, the switch's integrated circuitry hands the packet from the Layer 2 bridging domain to the Layer 3 routing engine associated with the corresponding irb interface, and vice versa for the return path --- hence the name 'integrated routing and bridging.' IRB does not eliminate the need for routing instances, which remain a separate mechanism for isolating routing tables; it does not itself perform inter-VLAN switching, since switching still happens strictly within a VLAN's own broadcast domain; and it has no relationship to trunk ports, which remain necessary for carrying multiple tagged VLANs between switches. IRB is the standard method for enabling inter-VLAN routing on a single EX Series switch without an external router. Reference topics: Junos Enterprise Switching -- Routing VLANs, Configuring Integrated Routing and Bridging.
Which two statements describe the purpose of a BGP notification message? (Choose two.)
A BGP NOTIFICATION message is one of the four core message types defined in RFC 4271, alongside OPEN, UPDATE, and KEEPALIVE, and it serves a very specific and narrow purpose within the protocol: whenever a BGP speaker detects an unrecoverable, fatal condition in the session --- such as a malformed OPEN message, an unsupported capability, a hold-timer expiration, a finite-state-machine error, or an administratively initiated reset --- it transmits a NOTIFICATION message to its peer immediately before closing the underlying TCP connection and tearing down the session entirely. This confirms that a NOTIFICATION always signals the termination of the session upon a fatal error, never a routine, in-session update. Structurally, every NOTIFICATION message carries a defined error code and error subcode field, which together precisely classify the category and specific nature of the fault that triggered the termination (for example, 'Cease' with a subcode indicating administrative shutdown, or 'Update Message Error' with a subcode indicating a malformed attribute), giving the receiving peer's administrator concrete diagnostic information about exactly why the session was torn down. Updating route attributes while keeping a session alive is the role of the UPDATE message, not NOTIFICATION, and refreshing a neighbor's table without resetting the session describes the optional Route Refresh capability (a separate, distinct BGP mechanism), neither of which describes NOTIFICATION's function. Reference topics: Junos Enterprise Routing -- BGP, BGP Message Types and the NOTIFICATION Message.
[Exhibit]
Click the Exhibit button.
Devices on VLAN 5 and VLAN 7 need to communicate with each other.
Referring to the exhibit, what will satisfy this requirement?
VLAN 5 and VLAN 7 are two entirely separate Layer 2 broadcast domains, each with its own distinct IP subnet, and devices in one VLAN can never reach devices in the other through switching alone --- Layer 3 routing between the two subnets is mandatory for any inter-VLAN communication to occur, regardless of how the VLANs are configured at Layer 2. On a single EX Series switch, the correct and standard mechanism for enabling this routing without an external router is to create one integrated routing and bridging (IRB) logical interface for each VLAN, assign each IRB the appropriate gateway IP address for its respective subnet (192.168.5.1 for VLAN 5's irb.5 and 192.168.7.1 for VLAN 7's irb.7, for example), and ensure routing is active on the switch so that traffic arriving at one IRB's gateway address destined for the other VLAN's subnet is routed internally between the two IRB interfaces. Attempting to bind a single family inet interface with two distinct subnet addresses via secondary addressing conflates two separate broadcast domains onto one Layer 3 interface incorrectly and is not how VLAN routing is architected in Junos. Spanning tree exists purely to prevent Layer 2 loops and has no routing function whatsoever, so configuring it cannot enable inter-VLAN reachability. Placing both VLANs on a single trunk with Multiple VLAN Registration Protocol (MVRP) only automates VLAN membership propagation across trunk links; it does not provide any Layer 3 routing capability between the VLANs either. Reference topics: Junos Enterprise Switching -- Routing VLANs, Configuring IRB Interfaces for Inter-VLAN Routing.
