[Q12-Q32] 2026 Updated JN0-664 Tests Engine pdf – All Free Dumps Guaranteed!

JN0-664 Juniper

admin -

May 4, 2026

4.7/5 - (4 votes)

2026 Updated JN0-664 Tests Engine pdf – All Free Dumps Guaranteed!

Latest JNCIP-SP JN0-664 Actual Free Exam Questions

Juniper JN0-664 Certification Exam is a professional-level certification offered by Juniper Networks. It is designed to test the knowledge and skills of individuals who specialize in service provider networking technologies. As a JNCIP-SP certified professional, you will have the ability to design, configure, manage and troubleshoot Juniper Networks service provider routing and switching platforms.

Juniper JN0-664 (Service Provider, Professional (JNCIP-SP)) certification exam is designed for professionals who are looking to validate their advanced-level knowledge and skills in the field of Juniper service provider networking technologies. Service Provider, Professional (JNCIP-SP) certification demonstrates that the candidate has the expertise and experience to configure, troubleshoot and maintain Juniper Networks service provider routers, switches, and protocols.

Q12. You are configuring a BGP signaled Layer 2 VPN across your MPLS enabled core network.
In this scenario, which statement is correct?

You must use the same route-distinguisher value on both PE devices.

You must assign a unique site number to each attached site’s configuration.

This type of VPN only supports Ethernet interfaces when connecting to CE devices.

This type of VPN requires the support of the inet-vpn NLRI on all core BGP devices.

Q13. Exhibit

Referring to the exhibit, PE-1 and PE-2 are getting route updates for VPN-B when neither of them service that VPN Which two actions would optimize this process? (Choose two.)

Configure the resolution rib bgp.l3vpn.0 resolution-ribs inet.0 statement on the PEs.

Configure the family route-target statement on the RR.

Configure the resolution rib bgp.l3vpn.0 resolution-ribs inet.0 statement on the RR.

Configure the family route-target statement on the PEs.

BGP route target filtering can be configured on PE devices or on route reflectors (RRs). Configuring BGP route target filtering on RRs is more efficient and scalable, as it reduces the number of BGP sessions and updates between PE devices. To configure BGP route target filtering on RRs, the following steps are required:
Configure the family route-target statement under the BGP group or neighbor configuration on the RRs. This enables the exchange of the route-target address family between the RRs and their clients (PE devices).
Configure the resolution rib bgp.l3vpn.0 resolution-ribs inet.0 statement under the routing-options configuration on the RRs. This enables the RRs to resolve next hops for VPN routes using the inet.0 routing table.

Q14. Exhibit

The environment is using BGP All devices are in the same AS with reachability redundancy Referring to the exhibit, which statement is correct?

RR1 is peered to Client2 and RR2

RR2 is in an OpenConfirm State until RR1 becomes unreachable.

Client1 is peered to Client2 and Client3.

Peering is dynamically discovered between all devices.

BGP route reflectors are BGP routers that are allowed to ignore the IBGP loop avoidance rule and advertise IBGP learned routes to other IBGP peers under specific conditions. BGP route reflectors can reduce the number of IBGP sessions and updates in a network by eliminating the need for a full mesh of IBGP peers.
BGP route reflectors can have three types of peerings:
* EBGP neighbor: A BGP router that belongs to a different autonomous system (AS) than the route reflector.
* IBGP client neighbor: An IBGP router that receives reflected routes from the route reflector. A client does not need to peer with other clients or non-clients.
* IBGP non-client neighbor: An IBGP router that does not receive reflected routes from the route reflector. A non-client needs to peer with other non-clients and the route reflector.
In the exhibit, we can see that RR1 and RR2 are route reflectors in the same AS with reachability redundancy.
They have two types of peerings: EBGP neighbors (R1 and R4) and IBGP client neighbors (Client1, Client2, and Client3). RR1 and RR2 are also peered with each other as IBGP non-client neighbors.

Q15. Exhibit.

Referring to the exhibit, which path would traffic passing through R1 take to get to R4?

R1 -> R3 -> R4

R1 -> R2 -> R3 -> R4

R1 -> R2 -> R4

R1 -> R4

The OSPF cost is carried in the LSAs that are exchanged within an OSPF area. When a router calculates the cost to a destination it uses the cost of the exit interface of each router in the path to the destination.

Q16. What is the correct order of packet flow through configurable components in the Junos OS CoS features?

Multifield Classifier -> Behavior Aggregate Classifier -> Input Policer -> Forwarding Policy Options -> Fabric Scheduler -> Output Policer -> Rewrite Marker -> Scheduler/Shaper/RED

Behavior Aggregate Classifier -> Multifield Classifier -> Input Policer -> Forwarding Policy Options -> Fabric Scheduler -> Output Policer -> Scheduler/Shaper/RED -> Rewrite Marker

Behavior Aggregate Classifier -> Input Policer -> Multifield Classifier -> Forwarding Policy Options -> Fabric Scheduler -> Output Policer -> Scheduler/Shaper/RED -> Rewrite Marker

Behavior Aggregate Classifier -> Multifield Classifier -> Input Policer -> Forwarding Policy Options -> Fabric Scheduler -> Scheduler/Shaper/RED -> Output Policer -> Rewrite Marker

Explanation
The correct order of packet flow through configurable components in the Junos OS CoS features is as follows:
* Behavior Aggregate Classifier: This component uses a single field in a packet header to classify traffic into different forwarding classes and loss priorities based on predefined or user-defined values.
* Input Policer: This component applies rate-limiting and marking actions to incoming traffic based on the forwarding class and loss priority assigned by the classifier.
* Multifield Classifier: This component uses multiple fields in a packet header to classify traffic into different forwarding classes and loss priorities based on user-defined values and filters.
* Forwarding Policy Options: This component applies actions such as load balancing, filtering, or routing to traffic based on the forwarding class and loss priority assigned by the classifier.
* Fabric Scheduler: This component schedules traffic across the switch fabric based on the forwarding class and loss priority assigned by the classifier.
* Output Policer: This component applies rate-limiting and marking actions to outgoing traffic based on the forwarding class and loss priority assigned by the classifier.
* Scheduler/Shaper/RED: This component schedules, shapes, and drops traffic at the egress interface based on the forwarding class and loss priority assigned by the classifier.
* Rewrite Marker: This component rewrites the code-point bits of packets leaving an interface based on the forwarding class and loss priority assigned by the classifier.

Q17. You are examining an L3VPN route that includes the information shown in the exhibit.
Which statement is correct in this scenario?

The information shows a route target.

The information shows a Type 1 route distinguisher.

The information shows a Type 0 route distinguisher.

The information shows a Type 2 route distinguisher.

Type 1: When Type value is 1, the Administrator field is 4-bytes and Assigned Number field is 2- bytes.
The Administrator field should be set to the IP address (public IP addresses should be used). The Assigned Number field contains a number from a numbering space that is administered by the enterprise to which the IP address has been assigned by the appropriate authority.

Q18. Exhibit

Based on the configuration contents shown in the exhibit, which statement is true?

Joins for group 224.7.7.7 are rejected if the source address is 192.168.100.10

Joins for any group are accepted if the group count value is less than 25.

Joins for group 224.7.7.7 are always rejected, regardless of the group count.

Joins for group 224.7.7.7 are accepted if the group count is less than 25

This configuration applies to IGMP (Internet Group Management Protocol) and is designed to control multicast group memberships on the interface ge-0/0/0.0.
Breaking Down the Configuration
1## Policy-Statement: block-igmp
policy-statement block-igmp {
term 1 {
from {
route-filter 224.7.7.7/32 exact;
source-address-filter 192.168.100.10/32 exact;
}
then reject;
}
}
* This policy blocks IGMP joins for group 224.7.7.7 only if the source IP is 192.168.100.10.
* If both conditions match, the request is rejected.
2## IGMP Configuration on Interface ge-0/0/0.0
[edit protocols igmp]
user@router# show
interface ge-0/0/0.0 {
group-policy block-igmp;
group-limit 25;
}
* group-policy block-igmp applies the policy statement block-igmp, meaning IGMP join requests are evaluated based on this policy.
* group-limit 25 means the interface allows up to 25 multicast groups.
Evaluating the Answer Choices
# A. Joins for group 224.7.7.7 are rejected if the source address is 192.168.100.10.
* Correct, because:
* The policy specifically matches group 224.7.7.7 and source IP 192.168.100.10.
* If both conditions are met, the join is rejected.
# B. Joins for any group are accepted if the group count value is less than 25.
* Incorrect, because:
* The group-limit (25) applies to the total number of IGMP groups but does not override explicit policy rules.
* Even if there are fewer than 25 groups, a join request can still be rejected by the policy statement.
# C. Joins for group 224.7.7.7 are always rejected, regardless of the group count.
* Incorrect, because:
* The policy only blocks joins from the specific source 192.168.100.10.
* Joins from other sources to 224.7.7.7 are allowed.
# D. Joins for group 224.7.7.7 are accepted if the group count is less than 25.
* Incorrect, because:
* Joins for 224.7.7.7 from source 192.168.100.10 will always be rejected, even if the group count is below 25.
* The group-limit does not override the rejection policy.
“Joins for group 224.7.7.7 are rejected if the source address is 192.168.100.10.”
# Official Juniper Documentation Reference:
# Junos IGMP Policy Configuration Guide
“A group-policy statement allows filtering IGMP joins based on multicast group address and source IP.”

Q19. Exhibit.

Referring to the exhibit, what must be changed to establish a Level 1 adjacency between routers R1 and R2?

Change the level l disable parameter under the R1 protocols isis interface lo0.0 hierarchy to the level 2 disable parameter.

Add IP addresses to the interface ge-1/2/3 unit 0 family iso hierarchy on both R1 and R2.

Remove the level 1 disable parameter under the R2 protocols isis interface lo0.0 configuration hierarchy.

Change the level 1 disable parameter under the R2 protocols isis interface ge-l/2/3.0 hierarchy to the level 2 disable parameter.

Q20. Exhibit

Referring to the exhibit, CE-1 is providing NAT services for the hosts at Site 1 and you must provide Internet access for those hosts Which two statements are correct in this scenario? (Choose two.)

You must configure a static route in the main routing instance for the 10 1 2.0/24 prefix that uses the VPN-A.inet.0 table as the next hop

You must configure a static route in the main routing instance for the 203.0.113.1/32 prefix that uses the VPN-A.inet.0 table as the next hop.

You must configure a RIB group on PE-1 to leak a default route from the inet.0 table to the VPN-A.inet.0 table.

You must configure a RIB group on PE-1 to leak the 10 1 2.0/24 prefix from the VPN-A.inet.0 table to the inet.0 table.

Q21. Exhibit

You want to use both links between R1 and R2 Because of the bandwidth difference between the two links, you must ensure that the links are used as much as possible.
Which action will accomplish this goal?

Define a policy to tag routes with the appropriate bandwidth community.

Disable multipath.

Ensure that the metric-out parameter on the Gigabit Ethernet interface is higher than the 10 Gigibit Ethernet interface.

Enable per-prefix load balancing.

https://www.juniper.net/documentation/us/en/software/junos/sampling-forwarding-monitoring/bgp/topics/concept/bgp-multipath-unequal-understanding.html

Q22. You want Site 1 to access three VLANs that are located in Site 2 and Site 3. The customer-facing interface on the PE-1 router is configured for Ethernet-VLAN encapsulation.

What is the minimum number of L2VPN routing instances to be configured to accomplish this task?

Q23. You have an L2VPN connecting two CEs across a provider network that runs OSPF. You have OSPF configured on both CEs.
Which two statements are correct in this scenario? (Choose two.)

OSPF neighborship is formed between the CEs and PEs.

The CE and PE OSPF areas can be different.

The CE and PE OSPF areas must match.

OSPF neighborship is formed between the two CEs.

In an L2VPN scenario, the provider network connects two customer edge (CE) devices across a Layer 2 virtual private network. Let’s analyze how OSPF operates in this setup.
1. **OSPF Neighborship in L2VPN**:
– An L2VPN provides a Layer 2 connection between two sites, making it transparent to Layer 3 protocols like OSPF. This means the CEs can form OSPF adjacencies directly with each other as if they were on the same local network.
2. **OSPF Configuration on CEs and PEs**:
– **Statement A: OSPF neighborship is formed between the CEs and PEs**:
– Incorrect. In an L2VPN, the provider’s network is transparent to the OSPF running on the CEs. OSPF neighborship forms directly between the CEs, not between the CEs and PEs.
– **Statement B: The CE and PE OSPF areas can be different**:
– Correct. Since OSPF adjacencies form directly between the CEs and not between CEs and PEs, the OSPF areas on the CEs and PEs can be different. The provider network acts as a transparent bridge, and OSPF doesn’t see the PEs.
– **Statement C: The CE and PE OSPF areas must match**:
– Incorrect. As noted above, because the OSPF neighborship forms directly between the CEs, the OSPF areas on the CEs and PEs do not need to match.
– **Statement D: OSPF neighborship is formed between the two CEs**:
– Correct. The L2VPN makes the connection between the two CEs appear as a direct Layer 2 link, allowing them to form an OSPF adjacency directly.
**Conclusion**:
Given the above analysis, the correct statements are:
**B. The CE and PE OSPF areas can be different.**
**D. OSPF neighborship is formed between the two CEs.**
**References**:
– Juniper Networks Documentation on L2VPNs: [Configuring Layer 2 VPNs](https://www.juniper.net
/documentation/en_US/junos/topics/task/configuration/layer-2-vpns-configuring.html)
– OSPF Configuration Guide: [Junos OS OSPF Configuration](https://www.juniper.net/documentation/en_US
/junos/topics/concept/ospf-routing-overview.html)

Q24. R4 is directly connected to both RPs (R2 and R3). R4 is currently sending all joins upstream to R3 but you want all joins to go to R2 instead.

Referring to the exhibit, which configuration change will solve this issue?

Change the bootstrap priority on R2 to be higher than R3.

Change the local address on R2 to be higher than R3.

Change the default route in inet.2 on R4 from R3 as the next hop to R2.

Change the group-range to be more specific on R2 than R3.

Q25. Exhibit

You must ensure that the VPN backbone is preferred over the back door intra-area link as long as the VPN is available. Referring to the exhibit, which action will accomplish this task?

Configure an import routing policy on the CE routers that rejects OSPF routes learned on the backup intra-area link.

Enable OSPF traffic-engineering.

Configure the OSPF metric on the backup intra-area link that is higher than the L3VPN link.

Create an OSPF sham link between the PE routers.

A sham link is a logical link between two PE routers that belong to the same OSPF area but are connected through an L3VPN. A sham link makes the PE routers appear as if they are directly connected, and prevents OSPF from preferring an intra-area back door link over the VPN backbone. To create a sham link, you need to configure the local and remote addresses of the PE routers under the [edit protocols ospf area area-id] hierarchy level1.
https://www.juniper.net/documentation/us/en/software/junos/ospf/topics/topic-map/configuring-ospfv2-sham- links.html

Q26. Exhibit

Referring to the exhibit, a working L3VPN exists that connects VPN-A sites CoS is configured correctly to match on the MPLS EXP bits of the LSP, but when traffic is sent from Site-1 to Site-2, PE-2 is not classifying the traffic correctly What should you do to solve the problem?

Configure the explicit-null statement on PE-1.

Configure the explicit-null statement on PE-2

Configure VPN prefix mapping for the PE-1_to_PE-2 LSP

Set a static CoS value for the PE-1_to_PE-2 LSP

Explanation
The explicit-null statement enables the PE router to send an MPLS label with a value of 0 (explicit null) instead of an IP header for packets destined to the VPN customer sites. This allows the penultimate hop router (the router before the egress PE router) to preserve the EXP bits of the MPLS label and pass them to the egress PE router. The egress PE router can then use these EXP bits to classify the traffic according to the CoS policy2
. In this example, PE-1 should configure the explicit-null statement under [edit protocols mpls label-switched-path PE-1_to_PE-2] hierarchy level.

Q27. Refer to the exhibit.

Click the Exhibit button.
Referring to the exhibit, which two statements are correct about BGP routes on R3 that are advertised to R1? (Choose two.)

By default, the next-hop value for these routes is changed by R3 before being sent to R1.

By default, all BGP attributes values must be removed before advertising the routes to R1.

By default, the BGP local-preference value that is assigned on R3 is advertised to R1.

By default, the next-hop value for these routes is not changed by R3 before being sent to R1.

In the exhibit, we see an internal BGP (iBGP) setup within AS 65512, and an external BGP (eBGP) connection between R3 and ISP-A (AS 65511). The questions focus on the behavior of BGP routes advertised from R3 to R1 within the same AS.
1. **BGP Next-Hop Attribute (Option A and D)**:
– In iBGP, the next-hop attribute is **not** changed when a route is advertised to another iBGP peer. This means that when R3 advertises a route to R1, it retains the original next-hop value as learned from the eBGP peer (ISP-A).
– Therefore, Option D is correct: “By default, the next-hop value for these routes is not changed by R3 before being sent to R1.”
2. **BGP Attributes (Option B and C)**:
– BGP attributes such as local preference, AS-path, and others are crucial for BGP route selection. The local preference attribute is used within an AS to indicate the preferred path for outbound traffic.
– When R3 advertises BGP routes to R1, it includes the local preference value assigned to those routes. This value is not removed and is propagated within the iBGP mesh.
– Therefore, Option C is correct: “By default, the BGP local-preference value that is assigned on R3 is advertised to R1.”
**Reference**:
– Juniper Networks documentation on BGP behavior provides detailed insights into the propagation of BGP attributes within iBGP and eBGP contexts. Specifically, the Junos OS documentation covers the default behavior of next-hop and local preference attributes in BGP configurations.
– Junos OS BGP Configuration Guide: [Junos OS BGP Configuration Guide](https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-overview.html)
– For a deeper understanding of BGP attributes and their default behaviors, the “Juniper Networks Day One: Exploring BGP” book is an excellent resource.

Q28. Which two EVPN route types are used to advertise a multihomed Ethernet segment? (Choose two )

Type 1

Type 3

Type 4

Type 2

EVPN is a solution that provides Ethernet multipoint services over MPLS networks. EVPN uses BGP to distribute endpoint provisioning information and set up pseudowires between PE devices. EVPN uses different route types to convey different information in the control plane. The following are the main EVPN route types:
Type 1 – Ethernet Auto-Discovery Route: This route type is used for network-wide messaging and discovery of other PE devices that are part of the same EVPN instance. It also carries information about the redundancy mode and load balancing algorithm of the PE devices.
Type 2 – MAC/IP Advertisement Route: This route type is used for MAC and IP address learning and advertisement between PE devices. It also carries information about the Ethernet segment identifier (ESI) and the label for forwarding traffic to the MAC or IP address.
Type 3 – Inclusive Multicast Ethernet Tag Route: This route type is used for broadcast, unknown unicast, and multicast (BUM) traffic forwarding. It also carries information about the multicast group and the label for forwarding BUM traffic.
Type 4 – Ethernet Segment Route: This route type is used for multihoming scenarios, where a CE device is connected to more than one PE device. It also carries information about the ESI and the designated forwarder (DF) election process.

Q29. Exhibit

Referring to the exhibit, a working L3VPN exists that connects VPN-A sites CoS is configured correctly to match on the MPLS EXP bits of the LSP, but when traffic is sent from Site-1 to Site-2, PE-2 is not classifying the traffic correctly What should you do to solve the problem?

Configure the explicit-null statement on PE-1.

Configure the explicit-null statement on PE-2

Configure VPN prefix mapping for the PE-1_to_PE-2 LSP

Set a static CoS value for the PE-1_to_PE-2 LSP

The explicit-null statement enables the PE router to send an MPLS label with a value of 0 (explicit null) instead of an IP header for packets destined to the VPN customer sites. This allows the penultimate hop router (the router before the egress PE router) to preserve the EXP bits of the MPLS label and pass them to the egress PE router. The egress PE router can then use these EXP bits to classify the traffic according to the CoS policy2
. In this example, PE-1 should configure the explicit-null statement under [edit protocols mpls label-switched-path PE-1_to_PE-2] hierarchy level.

Q30. Exhibit

Referring to the exhibit, you must provide Internet access for VPN-A using CE-1 as the hub CE.
Which two statements are correct in this situation? (Choose two.)

You must use RIB groups to leak routes between the inet. o and vpn-a. inet. o tables.

RIB groups are not needed to leak routes between the inet. 0 and VPN-A. inet. 0 tables,

Internet traffic from Site 2 takes the path of PE-2 -> PE-1 -> GW-1.

Internet traffic from Site 2 takes the path of PE-2 -> PE-1 -> CE-1 -> PE-1 -> GW-1.

To provide Internet access for VPN-A using CE-1 as the hub CE, you need to do the following:
You must use RIB groups to leak routes between the inet.0 and vpn-a.inet.0 tables on PE-1 and CE-1.
RIB groups are routing options that allow you to import routes from one routing table into another routing table based on certain criteria. In this scenario, you need to configure RIB groups on PE-1 and CE-1 to import Internet routes from inet.0 into vpn-a.inet.0 and vice versa.
Internet traffic from Site 2 takes the path of PE-2 -> PE-1 -> CE-1 -> PE-1 -> GW-1. This is because Site 2 does not have direct Internet access and needs to use CE-1 as its default gateway for Internet traffic. Site 2 sends its Internet traffic to PE-2, which forwards it to PE-1 based on VPN-A routes. PE-1 then sends it to CE-1 based on RIB group import policy. CE-1 then sends it back to PE-1 based on its default route pointing to GW-1. PE-1 then forwards it to GW-1 based on RIB group import policy again.

Q31. Exhibit

The network shown in the exhibit is based on IS-IS
Which statement is correct in this scenario?

The NSEL byte for Area 0001 is 00.

The area address is two bytes.

The routers are using unnumbered interfaces

The system IDofR1_2 is 192.168.16.1

IS-IS is an interior gateway protocol that uses link-state routing to exchange routing information among routers within a single autonomous system. IS-IS uses two types of addresses to identify routers and areas: system ID and area address. The system ID is a unique identifier for each router in an IS-IS domain. The system ID is 6 octets long and can be derived from the MAC address or manually configured. The area address is a variable-length identifier for each area in an IS-IS domain. The area address can be 1 to 13 octets long and is composed of high-order octets of the address. An IS-IS instance may be assigned multiple area addresses, which are considered synonymous. Multiple synonymous area addresses are useful when merging or splitting areas in the domain1. In this question, we have a network based on IS-IS with four routers (R1_1, R1_2, R2_1, and R2_2) belonging to area 0001. The area address for area 0001 is 49.0001. The NSEL byte for area 0001 is the last octet of the address, which is 01. The NSEL byte stands for Network Service Access Point Selector (NSAP Selector) and indicates the type of service requested from the network layer2. Therefore, the correct statement in this scenario is that the NSEL byte for area 0001 is 01.

Q32. Which two statements are correct about the customer interface in an LDP-signaled pseudowire? (Choose two)

When the encapsulation is vlan-ccc or extended-vlan-ccc, the configured VLAN tag is not included in the control plane LDP advertisement

When the encapsulation is ethernet-ccc, only frames without a VLAN tag are accepted in the data plane

When the encapsulation is vLan-ccc or extended-vlan-ccc, the configured VLAN tag is included in the control plane LDP advertisement

When the encapsulation is ethemet-ccc, tagged and untagged frames are both accepted in the data plane.

The customer interface in an LDP-signaled pseudowire is the interface on the PE router that connects to the CE device. An LDP-signaled pseudowire is a type of Layer 2 circuit that uses LDP to establish a point-to-point connection between two PE routers over an MPLS network. The customer interface can have different encapsulation types depending on the type of traffic that is carried over the pseudowire. The encapsulation types are ethernet-ccc, vlan-ccc, extended-vlan-ccc, atm-ccc, frame-relay-ccc, ppp-ccc, cisco-hdlc-ccc, and tcc-ccc. Depending on the encapsulation type, the customer interface can accept or reject tagged or untagged frames in the data plane, and include or exclude VLAN tags in the control plane LDP advertisement. The following table summarizes the behavior of different encapsulation types:

Loading …