When working with logical devices, you specify where each port group is connected by selecting the port group layout and the port speed and role (s) for each port group.  The Juniper Apstra UI offers two options to the operator for the port group role:  unused  and  generic 1 .

Unused : This option means that the port group is not configured or used by Apstra.  This can be useful for ports that are faulty, reserved, or not part of the data center fabric 1 .

Generic : This option means that the port group is configured with a generic role that is not specific to any device type or function.  This can be useful for ports that are used for testing, troubleshooting, or custom purposes 1 .  References :

Logical Devices

In the Juniper Apstra UI, you can create VNI pools for virtual networks that use VXLAN encapsulation in the overlay network. A VNI pool is a resource pool that contains a range of VNIs that can be assigned to the virtual networks.  The valid VNI range for a VNI pool is 4096 through 16777214, according to the VXLAN standard 1 . Therefore, the statement B is correct in this scenario.

The following three statements are incorrect in this scenario:

Any range is acceptable for the VNI pool.  This is not true, because the VNI range has a lower and upper limit defined by the VXLAN standard 1 . The lower limit is 4096, and the upper limit is 16777214. Any VNI outside this range is invalid and cannot be used for VXLAN encapsulation.

The valid VNI range is 2 through 4096. This is not true, because the VNI range does not start from 2, but from 4096.  The VNIs from 2 to 4095 are reserved and cannot be used for VXLAN encapsulation 1 .

The valid VNI range is 1 through 10000.  This is not true, because the VNI range does not include 1, which is also reserved and cannot be used for VXLAN encapsulation 1 .  The VNI range also does not end at 10000, but at 16777214, which is the maximum possible value for a 24-bit VNI field 1 .

References :

VNI Pools (Resources)

According to the Juniper documentation 1 , an interface map is a configuration template that maps interfaces between logical devices and physical hardware devices (represented with device profiles) while adhering to vendor specifications. An interface map can be either predefined or custom. A predefined interface map is one that ships with Apstra software and supports most qualified Juniper devices. A custom interface map is one that is created by the user to meet specific requirements. An interface map can be stored in either the global catalog or the blueprint catalog. The global catalog contains all the interface maps that are available for use in any blueprint. The blueprint catalog contains the interface maps that are imported from the global catalog and used in a specific blueprint.

When a member of your organization makes changes to a predefined interface map, the following statements are correct:

Changes to interface maps in the global catalog do not affect interface maps that have already been imported into blueprint catalogs. This means that the existing blueprints that use the original version of the interface map will not be impacted by the changes. However, if you want to use the updated version of the interface map in a new or existing blueprint, you need to import it again from the global catalog.

Any changes made to predefined interface maps are discarded when Apstra is upgraded. This means that the changes will not be preserved across different versions of Apstra software. If you want to retain a customized interface map through Apstra upgrades, you need to clone the predefined interface map, give it a unique name, and customize it instead of changing the predefined one directly.

Therefore, the correct answer is A and B. Changes to interface maps in the global catalog do not affect interface maps that have already been imported into blueprint catalogs and any changes made to predefined interface maps are discarded when Apstra is upgraded.  References :  Edit Interface Map | Apstra 4.2 | Juniper Networks

To apply a configlet to a specific device using Juniper Apstra, you need to specify the device’s hostname and tags. The hostname is the unique identifier of the device in the Apstra system, and the tags are the labels that you can assign to the device to group it with other devices that share the same characteristics.  You can use the hostname and tags to filter the devices that you want to apply the configlet to in the blueprint catalog 1 2 .  References :

Configlets Overview

Terraform Registry

When an agent installation is successful, devices are placed into the Out of Service Quarantined (OOS-QUARANTINED) state using the Juniper Apstra UI. This state means that the device is not yet managed by Apstra and has not been assigned to any blueprint. The device configuration at this point is called Pristine Config.  To make the device ready for use in a blueprint, you need to acknowledge the device, which changes its state to Out of Service Ready (OOS-READY) 1 2 .  References :

Managing Devices

AOS Device Configuration Lifecycle

Juniper Apstra role-based access control (RBAC) is a feature that allows you to specify access permissions for different users based on their roles.  RBAC servers are remote network servers that authenticate and authorize network access based on roles assigned to individual users within an enterprise 1 .  Juniper Apstra has four predefined user roles: administrator, device_ztp, user, and viewer 2 . The administrator role is the most powerful role, and it can see all permissions and perform all actions in the Apstra software application.  The administrator role can also create, clone, edit, and delete user roles, except for the four predefined user roles, which cannot be modified 2 . Therefore, the statement that the administrator role can see all permissions is correct.

The following three statements are incorrect in this scenario:

The viewer role is predefined and can be deleted. This is not true, because the viewer role is one of the four predefined user roles, and it cannot be deleted.  The viewer role is the most restricted role, and it can only view the network information and configuration, but not make any changes 2 .

The user role can create roles. This is not true, because the user role is one of the four predefined user roles, and it cannot create roles.  The user role can perform most of the network configuration and management tasks, but it cannot access the platform settings or the user management features 2 .

The administrator role is the only predefined role. This is not true, because there are four predefined user roles, not just one.  The other three predefined user roles are device_ztp, user, and viewer 2 .

References :

Providers — Apstra 3.3.0 documentation

User/Role Management (Platform)

In the EVPN-VXLAN data center fabric bridged overlay architecture shown in the exhibit, the servers are connected to Leaf1 and Leaf6 using the same virtual network identifier (VNI). This means that the servers belong to the same Layer 2 domain and can communicate with each other using VXLAN tunnels across the fabric. The underlay network provides the IP connectivity between the leaf and spine devices, and it uses EBGP as the routing protocol. Therefore, the following two statements are correct in this scenario:

Loopback IPv4 addresses must be advertised into the EBGP underlay from leaf and spine devices. This is because the loopback addresses are used as the source and destination IP addresses for the VXLAN tunnels, and they must be reachable by all the devices in the fabric. The loopback addresses are also used as the router IDs and the BGP peer addresses for the EBGP sessions.

The underlay EBGP peering’s must be established between leaf and spine devices. This is because the EBGP sessions are used to exchange the underlay routing information and the EVPN routes for the overlay network. The EBGP sessions are established using the loopback addresses of the devices, and they follow a spine-and-leaf topology, where each leaf device peers with all the spine devices, and each spine device peers with all the leaf devices.

The following two statements are incorrect in this scenario:

The underlay must use IRB interfaces. This is not true, because the underlay network does not provide any Layer 3 gateway functionality for the overlay network. The IRB interfaces are used to provide inter-VXLAN routing within the fabric, which is not the case in the bridged overlay architecture. The IRB interfaces are used in the edge-routed bridging (ERB) or the centrally-routed bridging (CRB) architectures, which are different from the bridged overlay architecture.

The underlay must be provisioned with PIMv2. This is not true, because the underlay network does not use multicast for the VXLAN tunnels. The VXLAN tunnels are established using EVPN, which uses BGP to distribute the MAC and IP addresses of the end hosts and the VTEP information of the devices. EVPN eliminates the need for multicast in the underlay network, and it provides optimal forwarding and fast convergence for the overlay network.

References :

Exploring EVPN-VXLAN Overlay Architectures – Bridged Overlay

EVPN LAGs in EVPN-VXLAN Reference Architectures

EVPN-VXLAN Configuration Guide

Device profiles are objects that associate a specific vendor model to a logical device in Juniper Apstra. Device profiles contain extensive hardware model details, such as form factor, ASIC, CPU, RAM, ECMP limit, and supported features. Device profiles also define how configuration is generated, how telemetry commands are rendered, and how configuration is deployed on a device.  Device profiles enable the Apstra system to render and deploy the configuration according to the Apstra Reference Design 1 2 .  References :

Device Profiles

Juniper Device Profiles

Juniper Apstra provides four system-defined user roles that are available in the Apstra GUI environment.  They are:  administrator ,  device_ztp ,  viewer , and  user 1 . Based on the web search results, we can infer the following statements:

viewer : This role includes permissions to only view various elements in the Apstra system, such as blueprints, devices, design, resources, external systems, platform, and others.  Users with this role cannot create, edit, or delete any element 1 2 .

user : This role includes permissions to view and edit various elements in the Apstra system, such as blueprints, devices, design, resources, external systems, platform, and others.  Users with this role cannot create or delete any element 1 2 .

authorized : This is not a system-defined user role in Juniper Apstra.  It is a term used to describe users who have been authenticated by an external system, such as LDAP, Active Directory, TACACS+, or RADIUS 3 .

root : This is not a system-defined user role in Juniper Apstra. It is a term used to describe the superuser account on a Linux system, which has full access to all commands and files. Creating a user in the Apstra GUI does not provide that user access to the Apstra platform via SSH.  To access the Apstra platform via SSH, you must create a local Linux system user 4 .  References :

User / Role Management Introduction

User/Role Management (Platform)

AAA Providers

User Profile Management