Reinforce 350-501 concepts with active-recall study cards covering all 8 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For 350-501 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the 350-501 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your 350-501 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real 350-501 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass 350-501.
Sample cards from the 350-501 flashcard bank. Read the question, think of the answer, then read the explanation below.
An engineer is troubleshooting an MPLS L3VPN where customers behind CE1 cannot reach a specific prefix behind CE2. The PE routers are using OSPF as the IGP and LDP for label distribution. On PE2, the prefix is present in the VRF routing table, but not in the VRF forwarding table. What is the most likely cause?
The route is missing a label in the LFIB on PE2.
The prefix is present in the VRF routing table (RIB) but missing from the VRF forwarding table (FIB) on PE2. This indicates that the route has been learned via BGP and installed in the RIB, but the MPLS VPN label (the inner label) required to forward the packet across the MPLS core is absent. Without a valid label in the LFIB, the CEF (FIB) cannot install the route, causing the reachability failure. Option D correctly identifies this missing label in the LFIB as the root cause.
A service provider is designing a new MPLS core network using Segment Routing with MPLS data plane. They require traffic engineering capabilities to optimize bandwidth utilization. Which technology should be used to compute optimal paths based on IGP link attributes and bandwidth constraints?
SR-TE (Segment Routing Traffic Engineering)
SR-TE (Segment Routing Traffic Engineering) is the correct choice because it uses a centralized or distributed controller to compute optimal paths based on IGP link attributes (such as metric, TE metric, affinity) and bandwidth constraints, encoding the path as a segment list in the packet header. Unlike RSVP-TE, SR-TE does not require per-flow state in the core routers, making it more scalable for bandwidth optimization in an MPLS Segment Routing network.
An engineer is deploying MPLS in the core and wants to ensure that all core routers use the same label for a specific prefix, regardless of which router originated it. Which MPLS label allocation mode should be used?
Per-prefix label mode
Per-prefix label mode (option C) is correct because it assigns a single label for a specific prefix across all core routers, regardless of which router originated the route. This ensures label consistency, which is critical for proper MPLS forwarding and troubleshooting. In contrast, per-next-hop or per-interface modes would create different labels for the same prefix based on the next hop or interface, breaking the requirement for uniform label allocation.
In the DiffServ model, which DSCP value is used for Expedited Forwarding (EF) to support voice traffic?
DSCP 46
EF is defined by DSCP 46 (binary 101110) to provide low-loss, low-latency service for voice.
A service provider is designing a new MPLS L3VPN service. The customer requires that their VPN traffic be isolated from other customers and that the provider edge routers maintain separate routing tables for each VPN. Which architectural component is essential for this separation?
VRF (Virtual Routing and Forwarding)
VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.
An operator notices that a new MPLS-TE tunnel is not being established. The tunnel configuration includes a dynamic path option and a bandwidth of 100 Mbps. The network uses RSVP-TE with CSPF. The link-state database shows sufficient reservable bandwidth on all links along the calculated path. What is the most likely cause of the tunnel establishment failure?
RSVP-TE is not enabled on the transit interfaces
RSVP-TE must be explicitly enabled on every interface that will participate in MPLS-TE label-switched path (LSP) signaling. Even if the link-state database shows sufficient reservable bandwidth, without RSVP-TE enabled on transit interfaces, the PATH messages cannot be processed, and the tunnel will fail to establish. This is a common misconfiguration when deploying MPLS-TE.
A service provider is deploying MPLS L3VPN over an OSPF backbone. The PE routers are configured with OSPF as the IGP. The CE router of customer A is connected to two PEs for redundancy. Which configuration is required on the PE routers to ensure that the CE router can load-balance traffic across both PEs without loops?
Configure OSPF with the capability vrf-lite and enable the down-bit on the PE-CE link.
Configuring OSPF with the capability vrf-lite and enabling the down-bit on the PE-CE link prevents routing loops in a multi-homed CE scenario. The down-bit is set by the PE when redistributing routes into OSPF, ensuring that the CE does not re-advertise those routes back to another PE, which would cause a loop. The vrf-lite capability allows the CE to understand the down-bit without requiring full MPLS/VPN functionality, enabling load-balancing across both PEs safely.
An ISP is designing an MPLS core network and needs to choose an IGP that supports fast convergence. Which IGP meets this requirement and is most commonly used in MPLS core networks?
IS-IS
IS-IS is the correct choice because it is a link-state IGP that inherently supports fast convergence through mechanisms like incremental SPF (iSPF) and prefix-independent convergence (PIC). It is widely deployed in MPLS core networks due to its scalability, extensibility via TLVs, and native support for MPLS Traffic Engineering (MPLS-TE) without requiring additional protocol extensions like OSPF's opaque LSA.
A network engineer is troubleshooting an MPLS L3VPN where the CE router is receiving the correct VPN prefixes from the PE, but traffic from the CE to those prefixes is being dropped. The PE has a default route pointing to the CE. What is the most likely cause?
The PE does not have a specific route for the destination in its global routing table.
The CE is receiving the correct VPN prefixes from the PE, so the VRF import/export is working. However, when the CE sends traffic to those prefixes, the PE must forward the packets. The PE has a default route pointing to the CE, but if the PE's global routing table lacks a specific route for the destination prefix (which is normal for L3VPN, as VPN routes are in the VRF, not the global table), the PE will drop the traffic because it cannot find a valid next hop in the global table for the outer IP header. This is a classic issue where the PE's global table must have a route to the CE's loopback or the PE-CE link subnet to enable recursive forwarding.
A service provider is deploying segment routing in its MPLS core. Which label allocation method is used by segment routing to distribute prefix SIDs?
IGP (IS-IS or OSPF)
Segment routing uses the IGP (IS-IS or OSPF) to distribute prefix SIDs. The IGP extensions for segment routing (RFC 8665 for OSPF, RFC 8667 for IS-IS) carry the prefix SID sub-TLV within the prefix reachability information, allowing each router to allocate and advertise the SID associated with a prefix. This is the native label allocation method for segment routing, as it leverages the existing IGP database without requiring a separate label distribution protocol.
An engineer is configuring an MPLS L3VPN and needs to ensure that the PE router installs VPNv4 routes from a remote PE into the VRF of a customer. The remote PE sends a VPNv4 route with route-target 100:1. Which configuration on the local PE causes the route to be imported into the VRF?
vrf definition CUSTOMER rd 100:1 route-target import 100:1
The `route-target import 100:1` command under the VRF definition configures the local PE to accept VPNv4 routes that carry the specified route-target (100:1) from the remote PE. This import RT must match the export RT of the remote PE for the route to be installed into the VRF's routing table. The `rd 100:1` defines the route distinguisher, which is separate from the RT and ensures uniqueness of the VPNv4 prefix.
A service provider wants to protect its routers from CPU overload caused by excessive traffic to the control plane. Which mechanism should be configured on IOS XR routers to classify and rate-limit management traffic?
CoPP (Control Plane Protection)
CoPP (Control Plane Protection) on IOS XR uses class maps and policy maps to classify and rate-limit traffic destined to the control plane, protecting the router from CPU overload.
A service provider is implementing QoS on an MPLS network to support voice, video, and data traffic. Which queuing mechanism provides the lowest latency for real-time traffic?
LLQ
LLQ (Low Latency Queuing) is the correct choice because it provides a strict priority queue specifically designed for real-time traffic like voice and video. By placing delay-sensitive packets into a dedicated priority queue that is serviced before all other queues, LLQ ensures minimal and predictable latency, which is essential for maintaining voice quality in an MPLS network.
A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?
The next-hop must be reachable via the IGP with an MPLS label.
For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.
A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?
MCAST-VPN address family
In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.
A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?
Change the explicit path to 'loose' for the down interface.
Changing the explicit path from 'strict' to 'loose' for the down interface allows the MPLS TE tunnel to use an alternative next-hop that is reachable, even if the specified interface is down. A strict explicit path requires every hop to be directly connected, so a down interface prevents the tunnel from coming up. By making the hop loose, the router can route around the failed link using the IGP's best path to the next specified node.
A service provider is implementing network automation using YANG data models. They need to ensure that the automation solution supports both configuration and operational state data retrieval. Which NETCONF operation should be used to retrieve operational state data?
<get>
The <get> NETCONF operation retrieves both configuration and operational state data from a device, making it the correct choice for this requirement. Unlike <get-config>, which only returns configuration data, <get> accesses the running datastore and includes state data such as interface statistics, routing tables, and system status. This aligns with RFC 6241, where <get> is defined as the operation to retrieve combined config and state information.
Which tool is used to validate YANG data models against device capabilities and to generate Python bindings for automation scripts?
pyang
B is correct because pyang is a YANG data modeling language validator and converter that can validate YANG modules against device capabilities (e.g., via RFC 7895 YANG Library) and generate Python bindings (e.g., using the `--plugindir` or `pyang --format pybind` options) for use in automation scripts. It directly supports the task of validating YANG models and producing Python code, unlike the other options which are protocols or automation frameworks.
The 350-501 flashcard bank covers all 8 official blueprint domains published by Cisco. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
MPLS and Segment Routing
Automation and Quality of Services
Architecture
Networking
Security and Services
Automation and Quality of Service
Services
Automation and Assurance
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that 350-501 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.350-501 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective 350-501 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free 350-501 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 971+ original 350-501 flashcards across all 8 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Cisco exam objectives.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official 350-501 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included