100+ Free JNCIE-Cloud Practice Questions

Explanation: In Juniper Apstra, all fabric configuration is driven through the Blueprint. A routing zone (equivalent to a VRF) is created within the Blueprint, linked to specific virtual networks (VNI/VLAN mappings), and route policies are defined. Committing the Blueprint causes Apstra to render and push device-specific configurations to all affected devices. Direct CLI modifications bypass Apstra's intent validation.

Explanation: Juniper Contrail Networking (now known as Tungsten Fabric) is an open-source SDN platform that integrates with OpenStack as a Neutron plugin. It manages virtual network creation, routing, and policy enforcement for VMs in OpenStack clouds and connects them to physical network resources through gateway routers and the physical underlay.

Explanation: Contrail DC Gateways (typically Juniper MX or QFX routers) provide the Layer 3 interconnect between Contrail virtual networks and physical/underlay networks. They run BGP EVPN to exchange virtual network routes with the Contrail control nodes and advertise them into the physical routing domain. This enables VMs in Contrail networks to communicate with physical servers and external networks.

Explanation: Juniper Apstra's closed-loop assurance uses streaming telemetry from devices to continuously validate that the network's actual state matches the Blueprint's intended state. Any deviation — a BGP session failure, a physical port going down, a configuration change made directly on a device (drift) — is detected and surfaced as an anomaly with context about what changed, why it matters, and what the expected state is.

Explanation: When deployed as a Kubernetes CNI, Contrail (Tungsten Fabric) creates virtual networks for pod-to-pod communication, enforces Kubernetes NetworkPolicy (and extended Contrail security policies), and manages overlay connectivity across compute nodes using MPLS or VXLAN. Each pod's virtual NIC is connected to a Contrail virtual network, and Contrail handles routing between pods, services, and external networks.

Explanation: Juniper Apstra uses vendor-specific Device Agents to bridge between the abstract Blueprint intent and device-specific configuration syntax. Each agent understands its target device's configuration model (Junos CLI for QFX, EOS CLI for Arista, NX-OS for Cisco) and renders the appropriate configuration. Agents communicate via NETCONF, REST, or vendor-specific APIs.

Explanation: The Contrail Control Node implements the BGP control plane for Contrail virtual networks. It distributes routing information (EVPN/L3VPN routes) to the vRouter agents on each compute node. If VMs cannot communicate, the first step is to verify that the Control Node has correct routes and that vRouter agents have received them. This is the control-plane component for virtual network reachability.

Explanation: In VMware NSX-T environments, vSRX integrates as a partner security service through NSX-T's service insertion framework. Traffic flows are redirected to the vSRX through NSX-T service profiles, allowing stateful inspection, IPS, and AppSecure for specific workloads or micro-segments. This provides north-south and selective east-west security without replacing the NSX-T distributed firewall.

Explanation: The Contrail vRouter is the data-plane component installed on each compute node (as a kernel module or DPDK userspace application). It intercepts all VM network packets, applies forwarding decisions from routes distributed by the Control Node, and encapsulates/decapsulates overlay traffic using MPLS over GRE, MPLS over UDP, or VXLAN. The vRouter implements the actual packet forwarding for virtual networks.

Explanation: Juniper Apstra continuously renders what the device configuration should be (based on the Blueprint) and compares it against the device's actual running configuration. Any discrepancies — whether from direct CLI changes, failed pushes, or hardware differences — are surfaced as anomalies in the Apstra GUI, providing automated drift detection without any manual comparison.