A network engineer is configuring MACsec on a Junos switch and wants to ensure that the ICV is included in every frame. The engineer has configured the interface with `security macsec`. What additional configuration is required to ensure ICV is used?

Set the cipher suite to GCM-AES-128.

Set the ICV length to a non-zero value.

A network engineer is explaining MACsec to a colleague and states that the Secure Channel Identifier (SCI) is used to identify the sender. Which statement correctly describes the SCI?

The SCI is only used in static mode and is not present in dynamic mode.

The SCI is a unique identifier that is included in the SecTAG and is used to identify the sender.

The SCI is the same as the CAK and is used to encrypt the frame.

The SCI is derived from the SAK and changes with each key rotation.

A network administrator is deciding between static MACsec and dynamic MACsec using MKA for a new deployment. The administrator wants automatic key rotation and minimal manual configuration. Which mode should be chosen?

Static MACsec with a key server

Static MACsec with pre-shared keys

A network administrator is troubleshooting a MACsec link between two switches. The link is up, but `show security macsec` displays 'Secure Channel: down'. The administrator has verified that the pre-shared keys match. What is the most likely cause?

The Secure Association is not active because the SAK is not installed.

The MACsec frame format is using an extended SecTAG.

The interface is configured in access mode instead of trunk mode.

The ICV length is set to 0 on one side.

Juniper NetworksCertified Specialist, Enterprise Routing and Switching (JNCIS-ENT)

Domain 3Objective 3

MACsec JN0-352 Practice Questions (Page 5)

Part of the Layer 2 Security domain, which makes up ~13% of our current practice bank. Juniper Networks does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 21–25

21application · medium
A network engineer is configuring MACsec on a Junos switch and wants to ensure that the ICV is included in every frame. The engineer has configured the interface with `security macsec`. What additional configuration is required to ensure ICV is used?
Select an answer first
22expert · hard
A network engineer is explaining MACsec to a colleague and states that the Secure Channel Identifier (SCI) is used to identify the sender. Which statement correctly describes the SCI?
Select an answer first
23application · medium
A network administrator is deciding between static MACsec and dynamic MACsec using MKA for a new deployment. The administrator wants automatic key rotation and minimal manual configuration. Which mode should be chosen?
Select an answer first
24application · medium
A network administrator is troubleshooting a MACsec link between two switches. The link is up, but `show security macsec` displays 'Secure Channel: down'. The administrator has verified that the pre-shared keys match. What is the most likely cause?
Select an answer first
25foundation · easy
Which MACsec term describes the collection of all MACsec-protected ports on a single device that share the same Connectivity Association Key?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to JN0-352

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Juniper Networks. “JN0-352” is a trademark of its owner, used for identification only.