To make the IP fabric a valid IP fabric, the connection between the two spine nodes must be removed. This is because an IP fabric is a network topology that uses a spine-leaf architecture, where the spine devices are only connected to the leaf devices, and the leaf devices are only connected to the spine devices. This creates a non-blocking, high-performance, and scalable network that supports Layer 3 routing protocols such as BGP or OSPF. The connection between the two spine nodes in the exhibit violates the spine-leaf design principle and introduces unnecessary complexity and potential loops in the network. The other options are incorrect because:

• A. The IP fabric must consist of only one device model throughout the fabric is wrong because an IP fabric can support different device models as long as they are compatible and interoperable. The exhibit shows two different models of QFX switches, which are both supported by Juniper Networks for IP fabric deployments.
• B. The connection between the two spine nodes must be increased to 40 Gbps is wrong because increasing the speed of the connection does not make the IP fabric valid. The connection between the two spine nodes should be removed, as explained above.
• C. The IP fabric connections must be increased to a speed greater than 10 Gbps is wrong because the speed of the connections does not affect the validity of theIP fabric. The IP fabric can use any speed that meets the bandwidth and performance requirements of the network. 10 Gbps is a common speed for IP fabric connections, but higher or lower speeds can also be used depending on the network design and devices. References:
• IP Fabric Underlay Network Design and Implementation
• IP Fabric Overview
• IP Fabric: Automated Network Assurance Platform

A configlet is a small piece of configuration that can be applied to a device or a group of devices to make persistent changes that are not overwritten by Apstra. Configlets can be used to install manual changes that are not part of the Apstra rendered configuration, such as custom commands, scripts, or features. Configlets can be created, edited, and deleted from the Apstra GUI or CLI12. References:

• Configlets Overview
• Configlets User Guide

According to the Juniper documentation1, an ESI-LAG is a link aggregation group (LAG) that spans two or more devices and is identified by an Ethernet segment identifier (ESI). An ESI-LAG provides redundancy and load balancing for a multihomed server in an EVPN-VXLAN network. To configure an ESI-LAG, you need to ensure that the following requirements are met:

• The LACP system ID on both devices must be the same. This ensures that the LACP protocol can negotiate the LAG parameters and form a single logical interface for the server.
• The ESI ID on both devices must be the same. This ensures that the EVPN control plane can advertise the ESI-LAG as a single Ethernet segment and synchronize the MAC and IP addresses of the server across the devices.
• The VLAN ID and VNI on both devices must be the same. This ensures that the server can communicate with other hosts in the same virtual network and that the VXLAN encapsulation and decapsulation can work properly.

In the exhibit, the LACP system ID and the ESI ID on both devices are different, which prevents the ESI-LAG from coming up as multihomed. Therefore, the correct answer is B and D. The LACP system ID on both devices must be the same and the ESI ID on both devices must be the same. References: ESI-LAG Made Easier with EZ-LAG, Example: Configuring an ESI on a Logical Interface With EVPN-MPLS Multihoming, Introduction to EVPN LAG Multihoming

Juniper Apstra supports three deploy modes for devices: Deploy, Drain, and Ready. These modes determine the configuration and state of the devices in the data center fabric12.

• Deploy: This mode applies the full Apstra-rendered configuration to the device, according to the Apstra Reference Design. The device state becomes IS-ACTIVE and the device is ready to carry traffic in the fabric12.
• Drain: This mode adds a “drain” configuration to the device, which prevents any new traffic from entering the device. The device state becomes IS-READY and the device is prepared for maintenance or decommissioning12.
• Ready: This mode removes the Apstra-rendered configuration from the device, leaving only the basic configuration such as device hostname, interface descriptions, and port speed/breakout. The device state becomes IS-READY and the device is not part of the fabric12. References:
• Device Configuration Lifecycle
• Set Deploy Mode (Datacenter)

The graph query output shown in the exhibit is a JSON representation of an interface node and its properties in the Apstra graph database. Based on the output, we can infer the following statements:

• The output shows a LAG connection. This is true because the interface node has a property called lag_mode which is set to lacp_active, indicating that the interface is part of a link aggregation group (LAG) that uses the Link Aggregation Control Protocol (LACP) to negotiate the link state and parameters12.
• The switch in the output is a Juniper device. This is true because the interface node has a property called if_name which is set to ae2, indicating that the interface name follows the Juniper naming convention for aggregated Ethernet interfaces34.
• The interface has an IP address assigned to it. This is false because the interface node has properties called ipv4_addr and ipv6_addr which are both set to null, indicating that the interface does not have any IPv4 or IPv6 address configured2.
• The interface has tags assigned to it. This is false because the interface node has a property called tags which is set to null, indicating that the interface does not have any tags associated with it2. References:
• Link Aggregation Overview
• Processor: Generic Graph Collector
• Understanding Aggregated Ethernet Interfaces and LACP
• Graph

According to the Juniper documentation1, a VXLAN virtual network is a collection of Layer 2 forwarding domains that span multiple racks in a fabric. A VXLAN virtual network requires a name and a VXLAN network identifier (VNI), which is a 24-bit number that identifies the virtual network. The VNI can be either explicitly assigned or auto-assigned from a resource pool. A VXLAN virtual network can also have Layer 3 connectivity, which enables routing between different VNIs within a routing zone. A routing zone is an L3 domain that isolates the IP traffic of different tenants. A routing zone can have one or more VNIs associated with it. To enable Layer 3 connectivity, a VXLAN virtual network needs an IP subnet, which is a range of IP addresses that can be assigned to the hosts in the virtual network. The IP subnet can be either explicitly assigned or auto-assigned from a resource pool. Therefore, the correct answer is A and C. IP subnet and VXLAN VNI are two components that would be automatically derived when enabling a new VXLAN virtual network using Juniper Apstra. References: Virtual Networks | Apstra 4.1 | Juniper Networks

Juniper Apstra role-based access control (RBAC) is a feature that allows you to specify access permissions for different users based on their roles. RBAC servers are remote network servers that authenticate and authorize network access based on roles assigned to individual users within an enterprise1. Juniper Apstra has four predefined user roles: administrator, device_ztp, user, and viewer2. The administrator role is the most powerful role, and it can see all permissions and perform all actions in the Apstra software application. The administrator role can also create, clone, edit, and delete user roles, except for the four predefined user roles, which cannot be modified2. Therefore, the statement that the administrator role can see all permissions is correct.

The following three statements are incorrect in this scenario:

• The viewer role is predefined and can be deleted. This is not true, because the viewer role is one of the four predefined user roles, and it cannot be deleted. The viewer role is the most restricted role, and it can only view the network information and configuration, but not make any changes2.
• The user role can create roles. This is not true, because the user role is one of the four predefined user roles, and it cannot create roles. The user role can perform most of the network configuration and management tasks, but it cannot access the platform settings or the user management features2.
• The administrator role is the only predefined role. This is not true, because there are four predefined user roles, not just one. The other three predefined user roles are device_ztp, user, and viewer2.

References:

• Providers — Apstra 3.3.0 documentation
• User/Role Management (Platform)