JNCIS-ENT Exam Domains 2026: Complete Guide to All 9 Content Areas

How the JN0-352 Outline Is Organized

The Juniper Networks Certified Specialist, Enterprise Routing and Switching (JNCIS-ENT) exam, code JN0-352, is built on an official objectives outline with nine top-level headings: Layer 2 Switching or VLANs, Spanning Tree, Layer 2 Security, Protocol Independent Routing, OSPF, IS-IS, BGP, Tunnels, and High Availability. Juniper describes the outline as a high-level view of the skillset, which means it is not an exhaustive task analysis. Treat it as a floor for your preparation rather than a ceiling.

Two structural features matter for how you study. First, no percentage weights are published for any heading, so you cannot responsibly decide that one domain is "worth" more than another. Any site claiming a precise domain breakdown is inventing it. Second, almost every domain splits its objectives into two kinds of knowledge: conceptual understanding (how a protocol or feature works and why it exists) and configuration, monitoring, and troubleshooting knowledge (how you would set it up, verify it, and diagnose it in Junos OS). Both kinds are fair game on a written exam, and neither converts a multiple-choice test into a hands-on assessment.

If you are still orienting yourself on what the credential is and how it fits the Junos enterprise track, start with what JNCIS-ENT certification is, then return here for the content map.

Domains 1-3: The Layer 2 Block

Domain 1: Layer 2 Switching or VLANs

The trap here is treating this as review material. Because the prerequisite is JNCIA-Junos, candidates assume the basics are covered. In practice, the specialist exam expects you to reason about how frames are processed on a Junos device, what happens to tagged versus untagged traffic on a trunk with a native VLAN, and how a voice VLAN differs from a data VLAN on the same access port. Inter-VLAN routing appears in both the concept and the configuration bullets, so expect questions about the routed interface construct as well as the decision of when routing between VLANs is required at all.

Domain 2: Spanning Tree

Spanning tree questions reward precision about roles versus states. A port role (root, designated, alternate, backup) is not the same thing as a port state (such as discarding or forwarding), and the difference between classic STP and RSTP behavior during reconvergence is a recurring conceptual theme. Know what information BPDUs carry and how a topology change propagates, because the exam can ask you to predict which port ends up in which role after a change.

Domain 3: Layer 2 Security

Candidates routinely under-study this domain because it reads like a feature checklist. Do not skip MACsec, and do not collapse the port-security examples into a single idea: MAC limiting, DHCP snooping, DAI, and IP source guard each address a different attack or misbehavior and several depend on one another (DAI and IP source guard lean on the binding information DHCP snooping builds). Firewall filter processing order is a classic source of wrong answers; know how terms are evaluated and what the implicit behavior is when nothing matches.

Domains 4-7: Routing Fundamentals and Protocols

Domain 4: Protocol Independent Routing

Notice what is conceptual-only. Martian addresses and routing instances, including RIB groups, appear in the concept list but not in the configuration bullets, so expect "what is this and why does it exist" rather than "which stanza configures it." The distinction between aggregate routes and generated routes is a favorite: both summarize, but they behave differently with respect to contributing routes and next-hop treatment. Load balancing in Junos is another place where candidates carry over assumptions from other vendors; study how Junos handles per-prefix versus per-packet behavior as the platform documents it.

Domain 5: OSPF

Note that "Realms" is a published topic in this domain; make sure the study material you use actually addresses it rather than stopping at area and router types. The LSA types and which area types suppress which of them is the densest memorization load. Pair it with an understanding of why DR/BDR election exists on broadcast segments and what state an adjacency must reach before routes are exchanged.

Domain 6: IS-IS

IS-IS is where candidates with a Cisco or OSPF-heavy background lose points, because the instincts do not transfer cleanly. Levels (Level 1, Level 2, and both) take the place of OSPF area types, the DIS replaces the DR/BDR concept with different election behavior, and TLVs are the extensible container for what OSPF carries in LSAs. Existing community tutorials on IS-IS are useful for the concepts, but verify anything you read against the Junos 23.1 scope rather than assuming a years-old post matches the current exam.

Domain 7: BGP

Path selection is the centerpiece. You should be able to take a set of candidate routes with differing attributes and determine which wins, and explain why IBGP and EBGP peers treat the same attribute differently. In Junos, BGP configuration is organized around groups and peers, so be comfortable reading how group-level and neighbor-level settings interact. Routing policy application ties Domains 5, 6, and 7 together, which is a good reason to learn Junos policy once and reuse it.

Domains 8-9: Tunnels and High Availability

Domain 8: Tunnels

Because the domain is compact, a few questions can hinge on small details: what each encapsulation adds, what the tunnel endpoints need in terms of reachability, and the considerations that make a tunnel behave badly (such as a recursive routing problem or an MTU mismatch). Do not assume a small objective list means few questions; with no published weights, you cannot know.

Domain 9: High Availability

Two scoping details are worth noticing. BFD appears in the concept list but is not repeated in the configuration bullets, so study it as a mechanism (fast failure detection that protocols can lean on) rather than a configuration drill. And the High Availability troubleshooting list names traceoptions, show commands, and logging only; ping and traceroute are not listed here, unlike the four protocol and tunnel domains. The most common conceptual confusion is among GRES, graceful restart, NSR, and NSB: each protects a different layer of the control and forwarding behavior, and exam questions often ask which feature addresses a stated failure scenario.

Junos 23.1 and the Old-Material Trap

The exam is tied to Junos 23.1, and the current exam code is JN0-352. Older third-party offerings still circulate under earlier codes such as JN0-351, and some course catalogs continue to carry those labels. A course that carries an older exam code is a historical offering, not verified coverage of the current objectives. Networking fundamentals do not expire, so much of that material remains conceptually useful, but you cannot assume it addresses every current topic, and adding a year to a product title does not update its contents.

For more on how much effort the material typically demands, read how hard the JNCIS-ENT exam is.

Sequencing the Nine Domains Across Your Prep

Because the outline is unweighted, sequence by dependency, not by guessed importance. Layer 2 foundations feed security; routing fundamentals feed every protocol; the protocols feed high availability. One short plan that follows that logic:

Adjust the length to your own background; this is a template to bend, not a guarantee. The point is the ordering. For a fuller week-by-week framework, see our JNCIS-ENT study guide, and when you are ready to test recall under time pressure, use the JNCIS-ENT practice test to find which domains need another pass.

Exam Mechanics That Frame the Domains

The domains only matter in the context of the delivery format. JN0-352 is a written, multiple-choice exam of 65 questions with a 90-minute time limit, delivered through Pearson VUE either at a test center or via OnVUE online proctoring, in English only. That averages a little over a minute per question, so you need quick recognition of concepts rather than long derivations. The exam page does not publish a scored versus unscored split, and nothing indicates an adaptive format.

A few facts candidates often get wrong:

• Prerequisite: an active JNCIA-Junos certification is required. Equivalent knowledge does not substitute, and an expired certification cannot satisfy the prerequisite. Details are in the JNCIS-ENT requirements guide.
• Passing score: not publicly published; the score report for your attempt includes its threshold, and thresholds can differ between tests. See the passing score breakdown.
• Fee: an exact current price was not verified, so check the provider's voucher store directly rather than trusting a quoted figure. More context is in the certification cost article.
• Results: pass/fail is shown immediately, but results are provisional pending security validation, with valid results posted to CertMetrics within three business days.
• Retakes: no waiting period after a first failed attempt; after a second or later failure, a 14 calendar day wait applies. After passing, wait at least 18 months before taking the same exam again.
• Validity: three years, with renewal through an appropriate current-level exam, a higher-level certification in the same track, or the specified course route.

For OnVUE delivery, expect a system check, a private testing environment, matching government-issued photo identification, and no books or notes. Scheduling specifics are covered in the exam dates guide.

Frequently Asked Questions