Design, Associate (JNCIA-DESIGN) Practice Questions

Micro-segmentation is a security technique specifically designed to control East-West (server-to-server) traffic within a data center. By deploying distributed firewalls, such as the vSRX virtual firewall, policies can be enforced at a granular level between individual virtual machines or application tiers, even if they reside on the same physical host or in the same subnet. This effectively creates secure zones around each workload, preventing lateral movement of threats.

The capacity planning calculation is as follows:

1. Calculate peak user bandwidth: 500 students * 5 Mbps/student = 2500 Mbps or 2.5 Gbps.
2. Calculate the required headroom for growth: 2.5 Gbps * 40% (0.40) = 1.0 Gbps.
3. Add the peak bandwidth and the headroom to find the total minimum capacity: 2.5 Gbps + 1.0 Gbps = 3.5 Gbps.
   Therefore, the network core must be designed to handle at least 3.5 Gbps of aggregate traffic.

One of the main drivers for SD-WAN adoption is cost reduction. SD-WAN allows organizations to leverage multiple, inexpensive transport options like broadband, fiber internet, and LTE/5G, either to replace or augment expensive MPLS circuits. The technology intelligently steers application traffic over the best available path, providing a good user experience without relying solely on costly private links.

Junos OS provides a powerful on-box automation framework using event policies and scripts. The engineer can create an event script (written in SLAX or Python) that performs the configuration archive action. Then, an event policy can be configured to trigger this script based on a time-of-day event (using the time-of-day command), effectively creating a cron-like job directly on the device. The other options are all examples of off-box automation.

East-West traffic refers to communication that occurs between servers within the data center. The interaction between an application server and a database server is a classic example of this. In contrast, North-South traffic refers to communication that enters or leaves the data center, such as a user on the internet accessing the web server.

Using eBGP for the underlay is a common and highly scalable design pattern for IP fabrics. Assigning a unique ASN to each leaf and a common ASN to the spines simplifies the configuration, as it eliminates the need for an IGP like OSPF or IS-IS and avoids the complexity of iBGP route reflectors. This design leverages BGP's path selection capabilities and is inherently loop-free, meeting the goals of simplicity and scalability.

A core pillar of any SASE architecture is a comprehensive, cloud-delivered security stack, often called the Security Service Edge (SSE). This includes services like Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA).

The second fundamental pillar of SASE is a flexible and intelligent network fabric that connects users and devices to the cloud security services. Juniper provides this through its AI-driven SD-WAN, which optimizes application routing over any available transport.

VTEPs (VXLAN Tunnel Endpoints) are the core components of a VXLAN overlay. Their primary role is to encapsulate the original Layer 2 Ethernet frame from an endpoint into a UDP packet, which is then routed over the Layer 3 IP underlay network. This process allows Layer 2 segments to be extended across routed boundaries, effectively replacing the need for STP to manage Layer 2 loops. The EVPN control plane manages MAC address learning and distribution.

ESI-LAG is the standard-based solution within an EVPN-VXLAN fabric for active-active server multihoming. By configuring the same ESI on the aggregated Ethernet interfaces of both Leaf-1 and Leaf-2 that connect to the server, the EVPN control plane recognizes them as a single logical connection point. This allows the server to form a standard LACP bond that is actively used by both leaf switches simultaneously. EVPN's aliasing and mass-withdraw features ensure that if one leaf fails, traffic is immediately redirected to the other without black-holing. While MC-LAG and Virtual Chassis can provide multihoming, ESI-LAG is the native and most scalable method specifically for EVPN-VXLAN fabrics.

The term "brownfield" refers to a deployment scenario where a new system or components are introduced into an environment with existing legacy systems. This contrasts with a "greenfield" deployment, which starts from a clean slate with no pre-existing infrastructure to consider. Brownfield projects typically involve more complex planning around migration, interoperability, and phased rollouts.