JN0-452 Questions and Answers

In Juniper Networks Mist AI Wireless, access points discover upstream switch and port information using Link Layer Discovery Protocol (LLDP). LLDP is an IEEE-standard, vendor-neutral Layer 2 discovery protocol designed specifically to allow network devices to advertise and learn information about directly connected neighbors.

When a Juniper Mist AP connects to a wired switch, it uses LLDP to exchange information such as:

Switch hostname and chassis ID

Switch port identifier

VLAN details

Power over Ethernet (PoE) capabilities and power allocation

This information is critical for Mist operations and visibility. It enables the Mist cloud to accurately display AP-to-switch mappings, identify the exact switch port an AP is connected to, validate PoE delivery, and assist with troubleshooting wired-side issues that impact wireless performance. LLDP data is also leveraged by Mist AI and Marvis to correlate wired and wireless events, improving root-cause analysis.

The other options are incorrect for the following reasons:

CDP (Cisco Discovery Protocol) is a Cisco-proprietary protocol and is not used by Juniper Mist APs for switch discovery.

ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses and does not provide device or port identity information.

SNMP is a management and monitoring protocol used by controllers or management systems, not by APs for neighbor discovery.

Because LLDP is standards-based, lightweight, and designed for neighbor discovery, it is the correct and supported protocol used by Juniper Mist APs to learn switch information.

Therefore, the correct answer is D. LLDP.

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It typically establishes a barrier between a trusted internal network and an untrusted external network, such as the Internet .

When deploying a Juniper Mist Edge VM (Virtual Machine), the networking architecture is designed to separate different types of traffic to ensure security, scalability, and efficient data handling. Unlike a traditional hardware controller that might use a single trunk port for all traffic, a Mist Edge VM specifically utilizes three primary logical interfaces to function within a data center environment.

The Out-of-Band (OOB) interface (A) is used exclusively for management and control plane traffic. This interface is what connects the Mist Edge to the Mist Cloud via an encrypted tunnel. It is through this port that the Mist Edge receives configuration updates, reports telemetry data to the AI engine, and allows administrators to monitor the health of the VM. By keeping this traffic out-of-band, Juniper ensures that management tasks do not compete with user data throughput.

The Upstream interface (D) is the "northbound" connection. Its primary role is to connect the Mist Edge to the core network or the internet for user data egress. When client traffic is tunneled from the Access Points (APs) to the Mist Edge, the Upstream interface is where that traffic is de-encapsulated and forwarded to the local network resources or the internet gateway. This interface typically connects to a core switch or a DMZ.

The Downstream interface (B) is the "southbound" connection. This is the entry point for the L2TPv3 or Mist Tunnel traffic coming from the Access Points. The APs establish a secure tunnel to this specific interface to transport user data across the Layer 3 network. This separation allows for granular firewall policies and ensures that the tunnel termination point is distinct from the management plane. While the term "Revenue" (E) is often used in carrier-grade routing to describe data-carrying ports, Mist documentation specifically uses the terms Upstream and Downstream to define the data path.

Mist Radio Resource Management (RRM) performs several functions including transmit power control and channel assignment which help optimize wireless network performance by dynamically adjusting radio settings based on changing environmental conditions.So,the correct answers are A.transmit power control and C.channel assignment

According to the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide1, two functions of Mist Radio Resource Management (RRM) are:

Transmit power control, which adjusts the transmit power of APs based on their coverage area and interference level.

Channel assignment, which assigns channels to APs based on their location and interference level.

Basic data rates are the required data rates that all devices on a wireless network must support in order to connect to the network. These rates are used for management and control frames and can affect the performance of the network.

According to the Lecture 3 - Radio Frequency and Antenna Fundamentals - Part 2 document2, basic data rates are required data rates that all devices must support to communicate on a WLAN.

According to the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide3, three types of devices that are counted by default for occupancy analytics are:

Mobile app clients, which are devices that have a mobile app installed with the Mist SDK or BLE beaconing enabled.

Cellular clients, which are devices that have cellular connectivity and can be detected by Mist APs using LTE sensing.

Wi-Fi clients, which are devices that have Wi-Fi connectivity and can be detected by Mist APs using Wi-Fi scanning.

In Juniper Networks Mist AI Wireless, Service Level Expectations (SLEs) are used to measure and assure real user experience across the wireless network. Each SLE is built on specific classifiers, which break down failures into root causes such as DHCP, DNS, authentication, RF conditions, or application issues. Understanding which SLEs rely on DHCP classification is essential for accurate troubleshooting.

The two Wireless Assurance SLEs that include a DHCP classifier are Successful Connects and Time to Connect.

The Successful Connects SLE measures whether client devices are able to complete the full connection process successfully. This process includes association, authentication, and critically, DHCP address assignment. If a client fails to obtain an IP address, the connection is considered unsuccessful, and the failure is explicitly classified as a DHCP issue within this SLE.

The Time to Connect SLE measures how long it takes for a client to connect from the moment it initiates association until it is fully usable on the network. One of the key components of this timeline is the DHCP transaction time. Slow DHCP responses, retransmissions, or server delays directly increase the overall connection time, and Mist classifies these delays under DHCP within the Time to Connect SLE.

The other options are incorrect for the following reasons:

Roaming SLE focuses on re-association, authentication, and mobility events, not DHCP, since IP addressing is typically retained during roaming.

Coverage SLE evaluates RF signal strength, SNR, and cell overlap, with no dependency on DHCP.

Throughput SLE measures data transfer performance after connectivity is established and does not analyze DHCP behavior.

Therefore, the correct answer is Successful Connects and Time to Connect, as both SLEs directly depend on and classify DHCP-related performance and failures within Mist Wireless Assurance.

According to the VLANs (Static & Dynamic) - Mist document3, you can define VLANs as untagged, tagged, or using VLAN pooling in the WLAN settings in the Juniper Mist UI. A WLAN is a wireless network that defines parameters such as SSID, security type, and VLAN.

In a traditional deployment, a Juniper Mist Access Point is a "cloud-first" device, meaning it expects a constant connection to the Mist Cloud to receive configuration updates and report telemetry. When performing an "AP-on-a-Stick" (APoS) site survey, the AP is often powered by a battery pack and moved to various locations where an active Ethernet backhaul or Internet connection is unavailable.3 To ensure the AP continues to broadcast the required SSIDs for signal measurement in this "disconnected" state, two specific settings must be adjusted within the Mist dashboard.

First, AP Config Persistence must be enabled. By default, Mist APs store their configuration in volatile memory; if an AP reboots (which happens when switching battery packs or moving locations) and cannot reach the Mist Cloud, it may fail to reload its previous configuration. Enabling Config Persistence ensures that the AP writes its current configuration to non-volatile flash memory, allowing it to boot up and start broadcasting the programmed SSIDs even in the absence of a cloud connection.4

Second, AP Uplink Monitoring must be disabled. Mist APs are designed with a safety mechanism where, if the AP loses its gateway connectivity (eth0 link or ping to the gateway), it will stop broadcasting SSIDs to prevent "black-holing" client traffic. In a site survey scenario, the Ethernet port is typically connected only to a battery or a passive PoE injector with no data path.5 If Uplink Monitoring remains active, the AP will detect the lack of a backhaul and disable its radios, making the survey impossible. By disabling this feature, the AP is forced to keep its radios active regardless of the uplink status. Together, these two settings allow the AP to function as a standalone signal source, which is essential for accurate RF environment mapping and pre-deployment validation using Mist AI hardware.

In the context of Juniper Mist WxLAN Security and Rogue AP detection, Mist AI categorizes surrounding access points into specific buckets based on their behavior and their connection to the local network infrastructure. Understanding the distinction between a Rogue AP and a Honeypot AP is essential for proper security posture.

A Honeypot AP (C) is specifically defined as an unauthorized access point that is broadcasting one of your organization's protected SSIDs (or a very similar one) but is not physically connected to your wired network. This is a classic "Evil Twin" attack where a malicious actor attempts to trick corporate users into connecting to a fake signal. Because the clients’ devices are often programmed to auto-associate with known SSIDs, they may unknowingly connect to the Honeypot AP, allowing the attacker to intercept traffic, perform man-in-the-middle attacks, or harvest credentials. Mist APs use their dedicated scanning radio (found in the AP43, AP45, and similar models) to constantly monitor the airwaves for these spoofed SSIDs.

In contrast, a Rogue AP (D) is an unauthorized AP that is physically connected to your corporate wired network (LAN). Mist identifies these by correlating the MAC addresses seen on the air with those seen on the wired switch ports. A Neighbor AP (B) is simply an AP from a nearby business that is broadcasting its own unique SSID and is not connected to your network; these are ignored by security alerts.

By classifying the threat as a Honeypot, Mist AI informs the administrator that the threat is external to the wired infrastructure but poses a direct risk to client data. Mist can even be configured to take automated action, such as sending de-authentication frames to prevent clients from successfully staying connected to the malicious Honeypot AP.

Referring to the exhibit and considering that it is in the USA, the WLAN with SSID Eero1234 is not configured to industry best practices while the WLAN with SSID NETGEAR24 is configured to industry best practices.

According to the JNCIS-MistAI Certification page3, a Marvis Actions Missing VLAN notification indicates that an access point is missing a VLAN that is configured on other access points in the same site.

In Juniper Networks Mist AI Wireless, Radio Resource Management (RRM) uses multiple decision-making systems to adapt the RF environment intelligently. A channel change triggered by the detection of RADAR on a DFS (Dynamic Frequency Selection) channel is a clear example of an event-driven RRM action.

DFS channels are regulated frequencies that must be shared with weather, military, and aviation radar systems. Regulatory bodies require wireless devices to immediately vacate a DFS channel when radar activity is detected. When a Juniper Mist AP operating on a DFS channel detects radar signatures, it generates a real-time RF event. This event forces the AP to immediately stop transmitting on that channel and move to a new, non-DFS or alternate DFS channel.

Mist classifies this behavior as event-driven RRM because:

The channel change is reactive, not predictive

It is triggered by a specific external RF event (radar detection)

It requires immediate action to maintain regulatory compliance and avoid interference

The other options are incorrect for the following reasons:

FCC compliance defines why the change is required, but it is not an RRM system or decision model.

Global optimization refers to long-term RF tuning across the network based on historical performance data, not immediate forced changes.

Reinforcement learning is used by Mist to optimize RF parameters over time through continuous learning, not for mandatory, instantaneous responses to radar events.

Mist RRM combines event-driven actions, AI-based global optimization, and reinforcement learning to deliver both compliance and performance. In the case of radar detection on a DFS channel, the AP’s channel change is driven by a real-time RF event, making event-driven RRM the correct answer.

In the IEEE 802.1X authentication process, the AP acts as an authenticator.

According to the Lecture 5 - Security - Part 1 document, the AP’s role in the IEEE 802.1X authentication process is to act as an authenticator. This means that the AP acts as a gatekeeper between the client device (supplicant) and the RADIUS server (authentication server). The AP forwards authentication messages between the supplicant and the server and grants or denies network access based on the server’s response.

According to the Mist documentation1, asset tracking is a service that allows you to find key assets and people with detailed analytics based on their location using Mist-supported third-party BLE beacons. To enable asset tracking, you need to configure both the BLE beacons and the Mist cloud settings.

The Show assets check box is a setting in Live View that allows you to display or hide the assets on the floor plan2. If this check box is not selected, you will not be able to see the third-party beacons on Live View.

The Locate this Client as an Asset check box is a setting at the BLE client level that allows you to treat a BLE client as an asset for location purposes3. If this check box is not selected, you will not be able to track the BLE client as an asset.

Text Description automatically generated with low confidence

In Juniper Networks Mist AI Wireless, understanding modulation schemes is essential for designing and operating high-performance Wi-Fi 6 (802.11ax) networks. Modulation directly affects how much data can be transmitted per symbol, and therefore determines the maximum achievable data rates under optimal RF conditions.

802.11ax introduces 1024-QAM (Quadrature Amplitude Modulation) as its highest supported modulation scheme. With 1024-QAM, each symbol encodes 10 bits of data, which represents a significant increase compared to earlier standards. For reference:

64-QAM (used in earlier standards) carries 6 bits per symbol

256-QAM (introduced in 802.11ac) carries 8 bits per symbol

1024-QAM increases this to 10 bits per symbol

This higher bit density allows Wi-Fi 6 devices to achieve higher peak throughput, especially in environments with excellent signal quality. However, 1024-QAM requires very high Signal-to-Noise Ratio (SNR) and low interference to function reliably. As a result, it is typically achieved only when clients are close to the access point and RF conditions are clean.

Mist AI Wireless continuously monitors client RSSI, SNR, retransmissions, and modulation rates through advanced telemetry. Using this data, Mist can determine whether clients are successfully operating at higher modulation levels like 1024-QAM or are falling back to lower schemes due to RF impairments. This insight directly feeds into SLEs and AI-driven recommendations for RF tuning, AP placement, and channel planning.

The incorrect options are explained as follows:

64-QAM and 256-QAM are valid modulation schemes but do not provide the highest data rates in 802.11ax.

4096-QAM is not supported by the 802.11ax standard and is therefore invalid.

Thus, 1024-QAM is the modulation scheme that provides the highest data rate level for 802.11ax devices.

According to the Lecture 3 - Radio Frequency and Antenna Fundamentals - Part 2 document2, an extended service set (ESS) is a group of basic service sets (BSSs) that share a common SSID and are connected by a distribution system (DS). Each BSS within the ESS has its own unique BSSID, which is the MAC address of the AP.

The Wireless Assurance SLE that provides information on whether a user is able to associate to the WLAN is Successful Connect. So the correct answer is A. Successful Connect.

In Juniper Networks Mist AI Wireless, Marvis Minis are purpose-built synthetic clients designed to proactively validate end-user experience by continuously testing the network in the same way a real user device would. To accurately isolate the root cause of connectivity or performance issues, Marvis Minis follow a strict, layered verification sequence that mirrors the logical dependency of network services.

The verification process begins with DHCP. This is the foundational step because, without a valid IP address, no further network communication can occur. Marvis Minis first confirm that the client can successfully complete the DHCP exchange and obtain proper IP configuration, including subnet, gateway, and lease parameters.

Once DHCP is validated, Marvis Minis move to ARP verification. At this stage, the synthetic client confirms it can resolve the MAC address of the default gateway and communicate at Layer 2. ARP issues can prevent traffic from leaving the local network segment even when an IP address is present.

After Layer 2 and Layer 3 reachability are confirmed, Marvis Minis test DNS functionality. DNS resolution is critical for application access, as most modern applications rely on hostname resolution rather than raw IP addresses. Failed or slow DNS responses are a common cause of perceived “application outages.”

Finally, Marvis Minis validate the application layer. This includes testing reachability, response time, and success of specific application transactions such as HTTPS connections, SaaS access, or internal application availability. By the time application testing occurs, all prerequisite network services have already been verified.

The other options are incorrect because they test higher-layer services before validating lower-layer dependencies, which can lead to misleading conclusions. Mist’s ordered approach—DHCP → ARP → DNS → Application—ensures precise fault isolation and actionable insights, allowing Marvis AI to accurately pinpoint where the user experience is breaking down.

In Juniper Networks Mist AI Wireless, a rogue access point (AP) is precisely defined to avoid confusion with external or non-threatening wireless devices. Mist qualifies a rogue AP as an unauthorized access point that is physically connected to your wired network infrastructure.

This distinction is critical from a security perspective. A rogue AP represents a direct threat because it bypasses established security controls by providing wireless access into the enterprise wired network without authorization. Such APs are often installed by users without IT approval or, in more serious cases, by malicious actors attempting to gain internal network access.

Mist APs continuously scan the RF environment and correlate wireless observations with wired-side intelligence. If an AP is detected advertising SSIDs and Mist can confirm—through MAC address correlation and wired discovery—that the device is connected to the enterprise’s wired network but is not claimed or authorized in the Mist cloud, it is classified as a rogue AP. This allows administrators to take immediate remediation actions, such as physical removal or switch-port shutdown.

The other options are incorrect for the following reasons:

Neighbor APs are access points belonging to nearby organizations or environments and are not security threats by default. Mist classifies these separately for RF awareness.

APs close to your network as measured by RSSI may simply be physically nearby but not connected to your infrastructure; proximity alone does not make an AP rogue.

Honeypot APs are intentionally deployed decoy access points used in security research or attack detection and are not Mist’s definition of a rogue AP.

Therefore, Mist correctly defines a rogue AP as an unauthorized AP connected to your wired network, making option A the correct answer.

According to the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide1, there are two ways to access Marvis, which is a virtual network assistant that provides insights and troubleshooting for wireless networks:

Use the conversational assistant, which allows you to ask natural language questions and get answers from Marvis.

Use Actions, which are predefined queries that you can select from a list and get results from Marvis.

According to the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide1, a config template is a configuration object that can be used to apply consistent WxLAN and WLAN policies across all sites within the same organization. A config template can be applied to a site group, which is a collection of sites that share common attributes.

According to the Initial AP Connection and VLANs & Static IP addresses - Mist document1, when a Juniper Mist AP boots up for the first time, it will expect to see a trunked port or the native VLAN=1 and will send a DHCP request on that VLAN. The AP will attempt to connect to the Mist cloud using port 443, which is the default HTTPS port.