JN0-460 Questions and Answers

Anorganization-level configuration templatecan only be applied tosite groups, not to individual sites.

Therefore, a single site such as Site A cannot be directly specified inside an org-level template.

WhenMarvis Actionsdisplay “AI Validated,” it indicates the issue was detected earlier but is nowresolved.

Marvis automatically validates remediation and marks the action closed once the anomaly clears.

According toJuniper Mist Wired Assurance documentation, three built-in diagnostic tools available for testing switch functionality areBounce Port,Ping, andCable Test.

Bounce Portallows you to disable and re-enable a port to reset connectivity.

Pingverifies Layer 3 reachability between the switch and target IPs.

Cable Testperforms diagnostics to detect wiring faults, impedance mismatches, or cable lengths.

These tools are accessed directly from theSwitch Testing Toolssection in the Mist dashboard and are available for EX Series and QFX Series switches onboarded to the Mist cloud.

According to Juniper’s Validated Designs (JVD) for campus fabrics, the Campus Fabric IP Clos (often referred to as a 5-stage Clos) is the architecture specifically engineered for high-scale environments supporting 10,000+ users. This design is characterized by extending the EVPN control plane and VXLAN data plane all the way to the access layer. By terminating VXLAN tunnels at the access switch—functioning as a Virtual Tunnel Endpoint (VTEP)—the network can seamlessly support both Layer 2 and Layer 3 devices directly at the edge of the fabric.

The primary driver for choosing IP Clos in large-scale deployments is its superior scalability. In this model, the core switches are shielded from the massive table sizes required to learn thousands of individual endpoint MAC and IP addresses. Instead, core devices only need to maintain reachability to the loopback addresses of the access layer switches. This reduction in the "flood and learn" pressure on the core is critical as the number of endpoints grows, ensuring that the core can scale far into the future with predictable growth.

Additionally, the IP Clos architecture provides the most flexible environment for microsegmentation using Group-Based Policies (GBP) and macrosegmentation using Virtual Routing and Forwarding (VRF) instances. Since routing occurs at the access device, "east-west" traffic between local endpoints remains efficient and does not need to traverse the distribution or core tiers. While EVPN Multihoming and Core-Distribution (CRB/ERB) models are effective for smaller sites or brownfield environments where access switches are legacy Layer 2-only devices, only the IP Clos architecture provides the end-to-end VXLAN capability required for high-density, future-proof campus fabrics.

When a switch is claimed into a Mist organization, it appears in one of several states depending on connectivity and site assignment.

“After claiming, switches initially appear asUnassignedif they are not yet linked to a site. Once online and connected to Mist Cloud, they transition toConnectedstatus and begin receiving configurations and telemetry.”

Option A (Connected):Correct— indicates the switch is online and communicating with Mist Cloud.

Option B (Inactive):Incorrect — not a valid device state in Mist.

Option C (Active):Incorrect — “Active” is not a device state label in Mist.

Option D (Unassigned):Correct— indicates the switch has been claimed but not yet assigned to a site.

Creating a new site requires asite nameandtime zone.

Other parameters (like templates or location data) are optional but recommended for proper reporting.

According to theJuniper Mist AI for Wired – Campus Fabric IP Clos Deployment Workflow, deploying a campus fabric involves a defined sequence of planning and configuration steps within the Mist Cloud interface. The key stages include:

“To deploy a campus fabric, you must first define the topology type, identify the physical connections between devices, and define the networks of interest that will be extended across the fabric.”

Breaking this down:

Choose the topology (D):Selecting the correct fabric type (3-Stage or 5-Stage IP Clos) determines how access, distribution, and core switches will interconnect.

Define the physical connections (A):This step involves specifying the uplink and downlink relationships between switches so that Mist can auto-generate EVPN-VXLAN and routing configurations.

Define the networks of interest (B):These are the VLANs and subnets that need to be extended across the fabric for user and device connectivity.

Steps such asconfiguring DNS serversordefining GBP tagsarenot part of the campus fabric deployment workflowin Mist Wired; they are optional or separate configurations outside the main deployment flow.

InJuniper Mist Cloud, configuration hierarchy includesorganization-level templates,site-level configurations, andindividual switch configuration. Site and organization levels provide shared settings, while per-device details such as hostname or role are set individually.

“Device-specific attributes such as hostname, role, or management IP are configured under the individual switch configuration menu. Templates and site configurations apply globally, while individual configurations override device-level parameters.”

Option A:Incorrect — site configuration applies to all switches at a site, not unique details.

Option B:Incorrect — CLI configuration is not used when switches are managed by Mist Cloud.

Option C:Correct— each switch’s name and role are configured individually underSwitches → Switch Configuration.

Option D:Incorrect — organization templates define global settings, not per-switch names.

RadSec(RADIUS over TLS) enhances traditional RADIUS authentication security by encapsulating RADIUS messages withinTCP and TLSinstead of UDP.

This ensures encrypted, reliable, and authenticated transmission between network devices (such as Juniper EX switches) and RADIUS servers.

It is often used in modernMist-managed wired networksto securely integrate withAccess Assuranceor external authentication systems.

TheMist UI(User Interface) is Juniper’s cloud-based management platform used tomanage both wired and wireless devices, including EX, QFX, and SRX platforms.

It provides centralized visibility, configuration, analytics, and AI-driven insights for the entire enterprise network infrastructure.

WithinWired Assurance, the Mist UI enables device claiming, switch templates, configuration management, and SLE monitoring.

In Juniper Mist campus fabric architectures, thelocation of the Layer 3 gateway (IRB interface)differentiatescentrally-routed bridging (CRB)fromedge-routed bridging (ERB):

InCRB, thegateway resides at the core layer— routing occurs centrally, and access/distribution layers perform Layer 2 bridging.

InERB, thegateway moves to the edge (distribution layer), enabling routing to occur closer to endpoints, improving performance and scalability.

“In a centrally-routed bridging (CRB) topology, Layer 3 gateways reside at the core. When transitioning to an edge-routed bridging (ERB) design, the Layer 3 gateways are moved to the distribution layer, closer to the access switches and clients.”

Therefore, when moving from acore-distribution CRBto anERBmodel, thegateway moves from the distribution to the access layerin campus terms (edge = access).

Option A:Incorrect — ERB gateways are not at the distribution layer only.

Option B:Incorrect — opposite direction.

Option C:Correct— the gateway movesfrom distribution to access (edge).

Option D:Incorrect — this describes CRB, not ERB.

Juniper Mist Wired AssuranceprovidesAI-driven operational visibilityfor EX and QFX switches. It defines and tracksService Level Expectations (SLEs)across multiple performance areas including connectivity, throughput, and switch health.

“Wired Assurance uses AI and telemetry to deliver operational visibility, track service level expectations (SLEs), and monitor throughput, successful connects, and switch health through pre- and post-connection metrics.”

Option A:Correct— accurately describes the full scope of Wired Assurance.

Option B:Incorrect — Wired Assurance provides SLEs specifically for EX and QFX switches.

Option C:Incorrect — both pre- and post-connection SLEs are monitored.

Option D:Incorrect — Wired Assurance monitors both connectivity and device health.

According to Juniper Mist documentation, the Throughput Service Level Expectation (SLE) is the primary metric used to represent the ability of wired users to pass traffic across the network without impedance. This SLE provides a comprehensive oversight of network performance by identifying issues that degrade the user experience, such as storm control events, interface anomalies, and specifically uplink congestion.

Within the Throughput SLE, the Congestion classifier (also referred to as Congestion Uplink) is specifically designed to monitor for buffer saturation and packet drops (TxDrops). When traffic arriving at an interface exceeds its processing or forwarding capacity, packets are queued in a buffer; if this buffer becomes full, the switch begins dropping packets. Juniper Mist utilizes a specific formula considering the ratios of TxDrops to TxPackets, Transmitted bps to Link Speed, and Received Speed to Link Speed to determine if a "Bad User Minute" has occurred due to congestion.

A critical feature of Wired Assurance is the automatic identification of uplink interfaces. Mist identifies these high-capacity ports by analyzing switch telemetry for characteristics such as having a switch or router as an LLDP neighbor, being designated as a Spanning Tree Protocol (STP) root port, or exhibiting significantly higher packet counts compared to access ports. When congestion is detected on an interface identified as an uplink, the system recognizes that this bottleneck impacts every user on that switch. By correlating these drops with the Throughput SLE, network administrators can proactively identify when a site requires more bandwidth or a different fabric architecture to handle current traffic demands, rather than simply monitoring if the link is physically "up" or "down".

According to Juniper Networks' software licensing documentation, Juniper utilizes a tiered subscription model for its Junos OS features on EX and QFX Series switches, specifically designed to align with different network use cases. This model is categorized into three main tiers: Standard, Advanced, and Premium. While basic Layer 2 and Layer 3 functions are included in the base or Standard tiers, advanced fabric technologies are reserved for the highest tier.

The Premium License is explicitly required to enable the full EVPN-VXLAN protocol stack on Juniper switches within a campus or data center fabric. As detailed in the Juniper Licensing User Guide, the Premium license serves as a superset that includes all functionality from the Standard and Advanced tiers, while specifically unlocking the advanced routing and virtualization features necessary for modern fabrics. Specifically, this license entitles the user to configure and run Multiprotocol BGP (MP-BGP) with the EVPN address family—which acts as the control plane—and the VXLAN encapsulation required for the data plane.

In a Juniper Mist Wired Assurance environment, there is a clear distinction between the cloud-based management subscription and the local Junos OS license. While the Wired Assurance subscription provides the AI-driven visibility, SLE monitoring, and automation capabilities through the Mist cloud, the Junos OS Premium license is a prerequisite on the physical hardware to execute the EVPN-VXLAN commands and maintain compliance with Juniper's End User License Agreement (EULA). For instance, on platforms like the EX4650 or QFX5120, attempting to commit a configuration involving EVPN without the appropriate Premium Feature License (PFL) will result in system warnings and protocol limitations, as these features are considered "high-value" software capabilities intended for complex, multitenant campus environments.

When deployingJuniper Mist Wired AssuranceinManaged mode, switches are fully integrated with Mist Cloud for configuration, monitoring, and AI-driven operations. Managed mode providescomplete cloud-based management, meaning Mist AI handles configuration, templates, telemetry, and SLE tracking.

“In Managed mode, the switch configuration is fully managed by Mist Cloud. Administrators configure switches, templates, and policies directly through the Mist dashboard. A valid Wired Assurance subscription is required for Managed mode operation.”

Option A:Incorrect — the “Monitor Only” mode is read-only, not Managed.

Option B:Correct— Managed mode requires aWired Assurance subscription.

Option C:Incorrect — subscriptions are mandatory for Mist-managed devices.

Option D:Correct— in Managed mode,all supported EX switches are fully managed by Mist AI, including configuration and telemetry.

Juniper’s official Campus Fabric IP Clos designfor Mist Wired Assurance defines that the3-stage IP Clostopology eliminates the traditionaldistribution layerentirely. This architecture is intended for smaller campus environments that do not need an intermediate distribution layer between the access and core.

“Juniper’s Wired Assurance supports 3-Stage and 5-Stage IP Clos deployments. The 3-Stage IP Clos is targeted towards deployments that do not require a Distribution Layer and have smaller scale requirements.”

Because the distribution layer is not present, the only hierarchical connection in a 3-stage campus fabric is between thecore and access layers. Traffic is routed directly at the access layer, and each access switch acts as a Layer-3 gateway (IRB) for its VLANs.

“In a campus fabric IP Clos architecture, Mist provisions Layer-3 (L3) integrated routing and bridging (IRB) interfaces on the access layer. All the access switches are configured with the same IP address for each L3 subnet.”

Additionally, the Juniper documentation explains that point-to-point links are configuredbetween layers, and in the case of the 3-stage design (with no distribution), this means between thecore and accessdevices:

“The point-to-point links between each layer utilize /31 addressing to conserve addresses.”

Therefore, the correct statement isC: The core layer is connected to the access layer.

OptionsAandBincorrectly mention a distribution layer that does not exist in this topology.

OptionDis incorrect because core (spine) devices in a Clos fabric are not interconnected with each other.

In Juniper Mist, thesyslogfeature allows administrators to forward event messages and alerts from the Mist cloud to an external syslog server.

This is often used for centralized event monitoring, compliance, and correlation with tools like Splunk or SIEM systems.

Syslog operates over UDP or TCP and can capture switch events, system logs, and Marvis actions for both Wired and Wireless networks.

Juniper Mist defines both3-stageand5-stage IP Closarchitectures for campus and data-center fabrics. The5-stage IP Closdesign adds scalability by introducingspineandsuper-spinelayers above the leaf layer, enabling large campus or aggregation environments.

“The 5-stage IP Clos topology extends the 3-stage design by introducing spine and super-spine tiers. It is ideal for large campus environments requiring additional capacity and hierarchical scaling.”

Option A:Incorrect — Clos is a topology, not a routing protocol.

Option B:Incorrect — VXLAN/EVPN encapsulation operates over Clos but does not define it.

Option C:Incorrect — that describes a traditional three-tier campus (core/distribution/access), not a Clos.

Option D:Correct— the5-stage IP Closis a hierarchical, scalable Clos topology withspine and super-spinelayers used in large campus or data-center networks.

Forgreenfield onboarding, switches are newly deployed and must be claimed into Mist Cloud. Juniper Mist offers multiple claim options to simplify large-scale onboarding.

“You can claim switches using the device’s QR claim code, by bulk importing from a sales order, or through API-based automation for large deployments. Each of these methods securely associates the devices to your organization in Mist Cloud.”

Option A:Incorrect — serial number alone is not sufficient for claiming.

Option B:Correct— claim codes (QR) uniquely identify switches.

Option C:Correct— bulk claim from a sale order streamlines large deployments.

Option D:Correct— APIs support automated claiming and provisioning workflows.

Option E:Incorrect — MAC address alone cannot be used to claim devices.

Juniper Mist AI collectstelemetry for Service Level Expectations (SLEs)across wired and wireless devices. This telemetry includes metrics such as time-to-connect, throughput, coverage, and switch performance.

“Service Level Expectation (SLE) data is collected from every device and stored for up toone monthin the Mist Cloud. This allows administrators to analyze historical performance trends and troubleshoot issues based on real-time and historical data.”

Option B (2 months):Incorrect — data is not retained this long.

Option C (7 days):Incorrect — telemetry retention is longer.

Option D (24 hours):Incorrect — too short for Mist SLE analytics.

Option A (1 month):Correct — Mist Cloud retains SLE telemetry for30 days (1 month).