There isn't really such category as a tor 'enter' node. Any node can be the first node of the chain, but it has no idea whether it is the first or one in the middle of the chain. Essentially, it's as if the 'entrance node' is running on your computer.

That means that no node knows the source of the traffic, and only the exit node knows the destination.

For the NSA to effectively monitor Tor, they'd need to run a large proportion of the nodes - one paper thought it would require an attacker to run at least one third of the network.