350-501 Practice Exam 2 — 20 Questions

Question 1

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS

Question 2

A network operator wants to distribute traffic filtering rules to multiple routers dynamically during a DDoS attack. Which technology should be used?

Accepted Answer

BGP FlowSpec. BGP FlowSpec (RFC 5575) allows a network operator to distribute flow specification rules — matching on source/destination prefix, protocol, port, packet length, and other fields — along with actions such as drop, rate-limit, or redirect, to multiple routers via BGP. This makes it ideal for dynamically propagating DDoS traffic filtering rules to many routers at once during an attack.

Answer

uRPF

Answer

S/RTBH

Answer

ACLs

Question 3

Drag and drop the steps to configure OSPF on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then enable the OSPF process with 'router ospf' command, then advertise networks under the OSPF process using 'network' command.. OSPF configuration requires entering global config mode, enabling the OSPF process, and then advertising networks under the OSPF process.

Answer

Advertise networks using 'network' command, then enter global config mode, then enable OSPF process.

Answer

Enable OSPF process, then advertise networks, then enter global config mode.

Answer

Enter global configuration mode, then advertise networks, then enable OSPF process.

Question 4

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

Accepted Answer

MCAST-VPN address family. In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Answer

MVPN does not use BGP; it uses PIM.

Answer

VPNv4 address family

Answer

IPv4 multicast address family

Question 5

In SP automation, which protocol is used by NSO to communicate with network devices for configuration management?

Accepted Answer

NETCONF. NSO (Network Services Orchestrator) uses NETCONF as its primary southbound protocol to communicate with network devices for configuration management. NETCONF provides a standardized, transactional, and model-driven (YANG) interface that allows NSO to push, validate, and roll back configuration changes reliably across multivendor devices.

Answer

RESTCONF

Answer

SNMP

Answer

CLI

Question 6

In EVPN-VPWS, which component is used to identify a multi-homed Ethernet segment and enable load balancing and fast convergence?

Accepted Answer

Ethernet Segment Identifier (ESI). The Ethernet Segment Identifier (ESI) is a unique identifier for an Ethernet segment that is multi-homed to two or more PEs. ESI is used for DF election and aliasing.

Answer

Ethernet Tag ID

Answer

MAC address

Answer

EVPN Route Target

Question 7

In Cisco IOS XR architecture, using Secure Domain Routers (SDRs) allows partitioning a physical router into multiple logical routers. Which statement about admin plane and SDRs is correct?

Accepted Answer

The admin plane is a separate SDR that manages hardware resources and system-level functions, while the default SDR handles routing and forwarding.. In Cisco IOS XR, the admin plane is a separate Secure Domain Router (SDR) that manages hardware resources and system-level functions, while the default SDR handles routing and forwarding. The admin plane is responsible for chassis management, software installation, and other system-wide tasks, and it is isolated from the default SDR for security and stability.

Answer

The admin plane runs only on route processor cards, while default SDR runs on line cards.

Answer

The admin plane and default SDR are the same logical entity and share all configuration.

Answer

SDRs are only supported on Cisco CRS, not on ASR 9000.

Question 8

Drag and drop the steps to configure a Layer 3 interface on a Cisco switch (SVI) into the correct order.

Accepted Answer

Create the VLAN, then enter interface VLAN mode, then assign IP address, then enable the interface.. SVI configuration requires creating the VLAN, then the interface VLAN, assigning an IP, and enabling it.

Answer

Enter interface VLAN mode, then assign IP address, then enable the interface, then create the VLAN.

Answer

Create the VLAN, then assign IP address, then enter interface VLAN mode, then enable the interface.

Answer

Create the VLAN, then enable the interface, then enter interface VLAN mode, then assign IP address.

Question 9

In MPLS, which label operation is performed by a Penultimate Hop Popping (PHP) router?

Accepted Answer

Pop the top label from the stack. In PHP, the penultimate router pops the label before forwarding to the egress, reducing the egress router's work.

Answer

Swap the top label with a new label

Answer

Push a new label onto the stack

Answer

Swap and push an additional label

Question 10

To secure NTP in a service provider network, which feature should be enabled on IOS XR routers to prevent time synchronization with unauthorized NTP servers?

Accepted Answer

NTP authentication with MD5 keys. NTP authentication with MD5 (or SHA) keys ensures that a router only synchronizes with NTP servers that possess the correct symmetric key, preventing spoofed or rogue time sources. On IOS XR, you configure ntp authentication-key and ntp trusted-key, then associate the key with the server via the key keyword. This directly addresses the requirement to prevent synchronization with unauthorized NTP servers.

Answer

NTP symmetric active mode

Answer

NTP broadcast client mode

Answer

NTP access group with read-only community

Question 11

Which three BGP attributes are considered in the route selection process before comparing MED? (Choose three.)

Accepted Answer

Weight. The order: weight, local pref, originate (locally originated), AS_PATH length, ORIGIN, MED. So weight, local pref, and AS_PATH length are before MED.

Answer

MED

Answer

Router ID

Question 12

A service provider is implementing 6PE to carry IPv6 traffic over an existing MPLS IPv4 core. Which BGP extension is required on the provider edge (PE) routers to exchange IPv6 prefixes with an IPv4 next-hop?

Accepted Answer

MP-BGP for the IPv6 address family with an IPv4 next-hop encoded in the MP_REACH_NLRI. 6PE uses BGP multiprotocol extensions (MP-BGP) with the IPv6 Address Family Identifier (AFI) and subsequent AFI (SAFI) to carry IPv6 prefixes. The next-hop is encoded as an IPv4 address using the 'next-hop' attribute with an IPv4 address. This is done via MP_REACH_NLRI for IPv6 with an IPv4 next-hop.

Answer

BGP IPv6 unicast address family with IPv6 next-hop

Answer

BGP IPv4 unicast address family with the IPv6 prefix as a label

Answer

BGP VPNv4 address family

Question 13

An SP is implementing BGP FlowSpec to mitigate DDoS. The FlowSpec rule should match traffic with destination port 80 and DSCP value 0. Which FlowSpec component is used to specify the destination port?

Accepted Answer

Type 3: Destination Port. FlowSpec defines traffic matching criteria using components like destination port (type 3), source port (type 2), etc. Destination port is type 3.

Answer

Type 2: Source Port

Answer

Type 4: ICMP Type

Answer

Type 1: Destination Prefix

Question 14

Which MQC component is used to match traffic based on criteria such as DSCP or IP precedence?

Accepted Answer

Class-map. In the Modular QoS CLI (MQC), the class-map component is used to define traffic classes by matching packets based on criteria such as DSCP (Differentiated Services Code Point) or IP precedence values. The class-map uses match statements (e.g., match ip dscp, match ip precedence) to classify traffic, which is then applied within a policy-map for QoS actions. This makes class-map the correct MQC component for traffic matching.

Answer

Service-policy

Answer

Policy-map

Answer

Access-list

Question 15

A service provider uses a centralized automation system to manage QoS policies via NETCONF and YANG. When attempting to push a new policy-map, the device returns an error indicating that the policy-map type is not supported in the specified location. What is the most likely cause?

Accepted Answer

The policy-map is being applied to an interface that does not support hierarchical QoS. The error indicates that the policy-map type is not supported in the specified location. This typically occurs when a policy-map is applied to an interface that does not support hierarchical QoS (HQoS), such as a physical interface that requires a service-policy under a parent policy-map. The NETCONF/YANG operation succeeds in syntax but fails due to device-level capability constraints.

Answer

The YANG module for QoS is not installed on the device

Answer

The NETCONF session is not authenticated

Answer

The automation system is using the wrong namespace

Question 16

Which LDP mode uses downstream unsolicited label distribution and liberal label retention?

Accepted Answer

Downstream unsolicited with liberal retention. Downstream unsolicited (DU) label distribution is the default mode in LDP, where each LSR advertises labels for all its directly connected prefixes to its neighbors without waiting for a request. Liberal label retention means the LSR stores all received label bindings, even if they are not currently used for forwarding, which enables rapid convergence upon topology changes.

Answer

Downstream on demand with liberal retention

Answer

Upstream unsolicited with liberal retention

Answer

Downstream on demand with conservative retention

Question 17

An engineer is configuring MPLS VPN and needs to ensure that customer traffic is automatically marked with a specific QoS policy based on the VPN. Which method should be used to propagate QoS markings across the MPLS network?

Accepted Answer

Use MPLS EXP bits to mark traffic at the ingress PE and map to QoS at egress. In an MPLS VPN environment, QoS markings must be preserved across the MPLS backbone. MPLS EXP (Experimental) bits are the standard mechanism to carry QoS information within the MPLS label stack. At the ingress PE, customer traffic is classified and marked with the appropriate EXP bits based on the VPN or other criteria. The egress PE then uses these EXP bits to map traffic to the correct QoS policy, ensuring end-to-end QoS treatment.

Answer

Use 802.1p CoS on the CE-PE link and preserve it across the MPLS backbone

Answer

Use IP ToS bits to mark traffic and rely on MPLS to preserve them

Answer

Set DSCP at the ingress PE and preserve it across the MPLS backbone

Question 18

A customer is using a Cisco ASR 9000 router with hierarchical QoS (HQoS) on a subscriber interface. The parent policy sets a shape rate of 10 Mbps, but the observed traffic rate is only 8 Mbps. What is a common misconfiguration that would cause this?

Accepted Answer

The child policy includes a police command that is limiting traffic below the parent shaper rate. In hierarchical QoS (HQoS) on a Cisco ASR 9000, the parent policy shapes traffic to a specified rate, but if the child policy includes a police command, that policer can independently drop or mark down traffic before it reaches the parent shaper. This causes the observed traffic rate to be lower than the parent shape rate, as the child policer is the actual bottleneck. The correct answer is A because the police command in the child policy is limiting traffic below the 10 Mbps parent shaper, resulting in only 8 Mbps observed.

Answer

The child policy uses 'bandwidth remaining' instead of 'bandwidth'

Answer

The child policy includes a bandwidth command that exceeds the parent shaper rate

Answer

The parent shaper uses 'shape peak' instead of 'shape average'

Question 19

What is the primary function of the NED (Network Element Driver) in NSO?

Accepted Answer

Abstract the device configuration and map YANG to device CLI. The NED (Network Element Driver) in Cisco NSO is the component that abstracts the native device configuration and translates YANG data models into device-specific CLI commands or protocols (e.g., SNMP, NETCONF). This allows NSO to manage heterogeneous devices using a unified YANG-based service model, making option A correct.

Answer

Provide RESTCONF endpoints

Answer

Store the configuration database

Answer

Handle northbound API requests

Question 20

An engineer is configuring RSVP-TE fast reroute for link protection. Which protection method uses a pre-configured bypass tunnel that protects multiple LSPs on the same link?

Accepted Answer

Facility backup. In RSVP-TE FRR, facility backup uses a bypass tunnel that can protect multiple LSPs on the same link. In contrast, 1:1 detour creates a separate detour LSP for each protected LSP.

Answer

Local Path Protection

Answer

Global Repair

Answer

1:1 detour