The JN0-650 exam validates your expertise in enterprise routing and switching technologies within the Juniper Enterprise Routing and Switching certification path. This exam is designed for network professionals who implement, manage, and troubleshoot complex Juniper routing and switching environments. Passing JN0-650 earns you the Enterprise Routing and Switching, Professional credential, demonstrating mastery of advanced networking concepts and real-world operational skills. This page outlines the exam syllabus, question formats, and a structured preparation approach to help you study effectively and build confidence.
Use this topic map to guide your study for Juniper JN0-650 (Enterprise Routing and Switching, Professional) within the Juniper Enterprise Routing and Switching path.
JN0-650 uses multiple question types to assess both conceptual knowledge and the ability to apply that knowledge in realistic network scenarios. Questions progress in difficulty and require you to think through operational decisions and technical trade-offs.
Questions build in complexity, moving from recall to analysis to application, ensuring you can handle real-world challenges in production Juniper environments.
A structured study plan aligned to the exam syllabus helps you cover all domains efficiently and build practical confidence. Dedicate time to each topic cluster, practice with realistic questions, and review explanations to close knowledge gaps.
Explore other Juniper certifications: view all Juniper exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to JN0-650 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a bundle discount for both formats: Enterprise Routing and Switching, Professional.
BGP, EVPN, and Class of Service (CoS) typically account for a significant portion of the exam. However, all eight domains are tested, so balanced preparation across Interior Gateway Protocols (IGPs), Ethernet Switching and Spanning Tree, Layer 2 Authentication and Access Control, IP Multicast, and IP Telephony Features is essential. Review the official exam blueprint to confirm current weightings.
IGPs handle internal routing and convergence within your autonomous system, while BGP manages external routing and policy-based path selection. IP Multicast runs on top of the unicast routing infrastructure provided by IGPs and BGP, using the underlying topology to build distribution trees. Understanding this layered relationship helps you design networks where all three protocols operate efficiently without conflicts.
Lab experience configuring and troubleshooting BGP policies, EVPN instances, and CoS queuing is highly valuable. Hands-on work with Spanning Tree convergence, 802.1X authentication, and voice VLAN setup also reinforces exam concepts. If you can access Juniper equipment or simulators, prioritize labs that involve multi-device topologies and realistic failure scenarios.
Misunderstanding BGP route filtering and policy application is a frequent pitfall. Confusing RSTP port roles and convergence behavior, underestimating CoS queue behavior under congestion, and overlooking EVPN route target filtering also lead to lost points. Carefully review explanations when you miss questions, and pay special attention to scenario questions that test your judgment, not just recall.
Focus on high-weight topics and re-review any domains where your practice test scores were below 80 percent. Do a final timed practice test to confirm your pacing and identify any remaining gaps. In the last few days, review command syntax, output formats, and key decision trees (for example, how to choose between OSPF and IS-IS, or when to use EVPN over traditional VLANs). Get adequate sleep the night before the exam.
Your Layer 2 network uses 802.1X to authenticate user devices connecting to the network. You are asked to include a new Layer 2 interface connection from the conference room in your network. You must ensure that only a single device is allowed to authenticate on this port at one time to avoid users from being able to plug in a rogue switch to this port.
In this scenario, which 802.1X method would you use for the new interface?
This question focuses on port security and preventing 'rogue switches' or multiple devices from accessing a single physical port simultaneously.
Single-Secure Supplicant Mode (Option A): This is the most restrictive 802.1X mode in Junos OS. It allows exactly one MAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.
Single Supplicant Mode (Option C): This mode allows the first authenticated user to 'open' the port for all other users. This would actually allow a rogue switch to function once the first device is authorized.
Multiple Supplicant Mode (Option B): This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.
MAC-RADIUS (Option D): This is an authentication method, not a port-access mode that limits the number of supplicants.
Exhibit.
You want to limit port access to only one device at a time.
Referring to the exhibit, which configuration change will accomplish this task?
In Junos OS, the supplicant-mode configuration under protocols dot1x determines how the switch handles multiple MAC addresses on a single physical port. According to the exhibit, the current mode is set to Single, and the Number of connected supplicants is 2. This indicates that the port is currently allowing multiple devices, which contradicts the goal of limiting access to only one device at a time.
Here is the breakdown of why Option C is the correct solution based on Juniper's standard behavior:
Supplicant Mode: Single (Current State): In this mode, the first device to authenticate opens the port for all subsequent devices. As long as the first device remains authenticated, other devices can send traffic through the port without individual authentication. This is why the exhibit shows 2 connected supplicants despite the mode being 'Single.'
Supplicant Mode: Single-Secure (The Solution): This mode strictly limits the port to only one MAC address. Once a device successfully authenticates via 802.1X, the switch drops any traffic coming from any other MAC address on that port. If the authenticated device logs off or the session times out, the port becomes available for a new device, but never more than one simultaneously. * Supplicant Mode: Multiple (Option B): This mode allows multiple supplicants to authenticate individually. Each MAC address must go through its own authentication process. This would allow more than one device, which is the opposite of the user's requirement.
MAC RADIUS Restrict (Option A): This feature is used to force MAC-based authentication and does not inherently limit the number of devices to one in the same way that changing the supplicant mode does.
Maximum EAPOL requests (Option D): This parameter defines how many times the switch will send an EAP-Request/Identity frame to a supplicant before giving up. Changing this to 1 does not restrict the number of devices allowed on the port; it only changes the retry logic for a single authentication attempt.
Configuration Example for Junos OS 24.4: To implement this change, you would use the following command: set protocols dot1x edit interface ge-0/0/10.0 supplicant-mode single-secure
Which two statements are correct about EVPN/VXLAN deployments? (Choose two.)
In an EVPN-VXLAN architecture, the interaction between the control plane (EVPN) and the data plane (VXLAN) is defined by specific functional components:
VTEP (VXLAN Tunnel End Point): These are the entities responsible for the encapsulation and de-encapsulation of Layer 2 Ethernet frames into Layer 3 UDP/IP packets. A VTEP can be a physical switch (like a QFX or EX series) or a software-based entity. When traffic enters the fabric, the ingress VTEP wraps it in a VXLAN header; the egress VTEP removes this header before delivering it to the destination host. (Option B)
VNI (Virtual Network Identifier): The VNI is a 24-bit field in the VXLAN header that allows for up to 16 million unique identifiers. It is used to identify specific broadcast domains (or VLANs) within the overlay network. Each VNI effectively represents a virtualized Layer 2 segment that is stretched across the Layer 3 underlay. (Option D)
Incorrect statements: Option A is incorrect because VNIs are identifiers, not the 'engine' that performs encapsulation---that is the VTEP's job. Option C is incorrect because VTEPs identify the endpoints of a tunnel, not the individual broadcast domains themselves.
Your existing enterprise network uses OSPFv3 on Juniper devices. You need to extend the networking into a new building, and it needs to be in its own OSPF are
a. Your team is debating about making the area a stub
Which two statements are correct in this scenario? (Choose two.)
OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.
Virtual Links (Option C): According to OSPF standards (both v2 and v3), virtual links cannot pass through stub areas. A virtual link must transit a 'transit area,' which must be a standard (non-stub) area with a full routing table.
Totally Stubby Areas (Option D): A stub area (which blocks Type 5 External LSAs) can be further restricted into a totally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.
Incorrect Statements: Option A is incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR. Option B is incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.
The network you support currently has a mixture of MC-LAG and Virtual Chassis being used to provide redundant connectivity from various IDFs. A project to modernize the architecture and move to EVPN-VXLAN using ESI-LAG will be starting soon. You want to avoid IDFs losing connectivity as the core devices are migrated to EVPN-VXLAN. Which action will accomplish this task?
In an EVPN-VXLAN environment using ESI-LAG (Ethernet Segment Identifier Link Aggregation), the Core Isolation feature is a safety mechanism designed to prevent traffic blackholing. When a leaf switch (acting as a VTEP) loses its BGP peering or its link to the IP fabric core, it assumes it is 'isolated' from the rest of the network. To protect the network, the switch automatically shuts down its local member links of any multi-homed ESI-LAG to force traffic to the peer switch that still has core connectivity.
However, during a migration or in specific transitional topologies where the core might be temporarily unreachable or not yet fully established, this feature can cause the leaf switches to shut down all downstream IDF (Intermediate Distribution Frame) connections, leading to a total loss of connectivity.
The Solution (Option C): By enabling the no-core-isolation statement under the [edit protocols evpn] hierarchy, you instruct the switch to disable this automatic shutdown behavior. This ensures that even if the BGP session or core links are not yet stable during the migration process, the ESI-LAG interfaces remain Up, allowing the IDFs to maintain connectivity to their local default gateways or other local resources.
Why others are incorrect: Enabling EVPN-VXLAN before migration (Option A) does not address the isolation logic. Removing MC-LAG/Virtual Chassis links prematurely (Option B) would cause an immediate outage. The network-isolation-profile (Option D) is typically used for different loop prevention scenarios and does not override the specific core-isolation check that affects multi-homed ESIs.
