A network engineer is verifying MACsec operation on a Junos switch. The engineer runs `show security macsec` and sees that the secure channel is up, but the secure association is not active. What does this indicate?

The pre-shared key is incorrect.

The interface is not configured with MACsec.

The SAK is not installed or has expired.

A network engineer is troubleshooting a MACsec link where the secure channel is up but traffic is not being encrypted. The engineer runs `show security macsec` and sees that the secure association is active. What is the most likely cause?

The interface is configured in promiscuous mode.

The ICV length is set to 0, disabling integrity protection.

The secure association is using a null cipher.

The interface is not configured with the `macsec` statement.

A network engineer is troubleshooting a MACsec link between two switches. The link is up, but `show security macsec` shows that the secure channel is down. The engineer has verified that the pre-shared keys match and that the interface is configured correctly. What is the most likely cause?

The cipher suite is different on the two ends.

The interface is in access mode instead of trunk mode.

The ICV length is set to 0 on one side.

The SAK is not installed because MKA is not enabled.

What is the purpose of the Integrity Check Value (ICV) in a MACsec frame?

To verify frame integrity and authenticity

Juniper NetworksCertified Specialist, Enterprise Routing and Switching (JNCIS-ENT)

Domain 3Objective 3

MACsec JN0-352 Practice Questions (Page 2)

Part of the Layer 2 Security domain, which makes up ~13% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 6–10

6application · medium
A network engineer is verifying MACsec operation on a Junos switch. The engineer runs `show security macsec` and sees that the secure channel is up, but the secure association is not active. What does this indicate?
Select an answer first
7application · medium
A network engineer is troubleshooting a MACsec link where the secure channel is up but traffic is not being encrypted. The engineer runs `show security macsec` and sees that the secure association is active. What is the most likely cause?
Select an answer first
8expert · hard
A network engineer is troubleshooting a MACsec link between two switches. The link is up, but `show security macsec` shows that the secure channel is down. The engineer has verified that the pre-shared keys match and that the interface is configured correctly. What is the most likely cause?
Select an answer first
9foundation · easy
In a MACsec frame, which field is inserted between the Ethernet header and the original payload to carry security information such as the Secure Channel Identifier?
Select an answer first
10foundation · easy
What is the purpose of the Integrity Check Value (ICV) in a MACsec frame?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-352

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-352” is a trademark of its owner, used for identification only.