350-501 Practice Exam 4 — 20 Questions

Question 1

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 2

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS

Question 3

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0

Question 4

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 5

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

Accepted Answer

The route-target on the new PEs does not match the existing VPLS context. B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Answer

The BGP neighbor is not activated under the VPLS address-family

Answer

The MTU mismatch between PEs

Answer

The VFI name is not consistent across PEs

Question 6

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. SSH provides encrypted remote access, and SNMPv3 with encryption and authentication secures monitoring. Telnet and SNMPv2c are insecure. Disabling all access is not practical.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access

Question 7

An ISP is implementing 6PE to provide IPv6 connectivity over an MPLS network that only supports IPv4 in the core. In 6PE, how are IPv6 prefixes carried across the MPLS backbone?

Accepted Answer

IPv6 prefixes are carried as IPv6 prefixes in MP-BGP with an IPv4 next-hop. 6PE uses MP-BGP to carry IPv6 prefixes (using the IPv6 unicast address family, AFI=2 SAFI=1) with an IPv4 next-hop address (the loopback of the peer 6PE router). The BGP session is over IPv4, but the NLRI carries IPv6 prefixes. MPLS labels are used to forward traffic across the IPv4-only core. It is important to note that 6PE does not use the VPNv6 address family (AFI=1 SAFI=128) — that is used for MPLS L3VPN.

Answer

IPv6 prefixes are transported over an IPv6 MPLS core using LDPv6

Answer

IPv6 prefixes are encapsulated in IPv4 tunnels with GRE

Answer

IPv6 prefixes are converted to IPv4 using NAT64 before MPLS forwarding

Question 8

An SP engineer is implementing DSCP classification at the edge. Which two AF classes are typically used for mission-critical data? (Choose two.)

Accepted Answer

AF41. AF4x (e.g., AF41/AF42/AF43) and AF3x (e.g., AF31/AF32/AF33) are used for high-priority data. AF1x is low-priority.

Answer

CS0

Answer

AF11

Answer

AF22

Question 9

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

Accepted Answer

NAT with VRF awareness. NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

Answer

Static default route from VRF to global

Answer

Route leaking between VRF and global

Answer

VRF-Aware Firewall

Question 10

An SP engineer is configuring QoS on a router and needs to drop traffic that exceeds a certain rate while allowing bursts up to a specified amount. Which QoS feature should be used?

Accepted Answer

Policing. Policing is the correct QoS feature because it drops traffic that exceeds a configured rate while allowing bursts up to a specified amount. Unlike shaping, which buffers excess traffic, policing enforces a rate limit by immediately dropping or re-marking packets that exceed the configured committed information rate (CIR) and burst size (Bc/Be). This matches the requirement to drop traffic that exceeds a certain rate while permitting bursts.

Answer

Shaping

Answer

WRED

Answer

Queueing

Question 11

A service provider is implementing MPLS TE to optimize bandwidth utilization. The engineer notices that tunnels are not using the explicitly configured path. What is the most likely reason?

Accepted Answer

The explicit path contains a link that is down. When an MPLS TE tunnel is configured with an explicit path, the headend router uses RSVP to signal the path and verify that all links in the path are operational. If any link in the explicit path is down, RSVP signaling fails for that path, and the tunnel may fall back to dynamic path computation or remain down, rather than using the explicitly configured path. This is the most common reason for a tunnel not using its explicit path.

Answer

RSVP is not enabled on the headend

Answer

The tunnel destination is not reachable via IGP

Answer

The tunnel is configured with 'autoroute announce'

Question 12

In EVPN-VPWS, which component is used to identify a multi-homed Ethernet segment and enable load balancing and fast convergence?

Accepted Answer

Ethernet Segment Identifier (ESI). The Ethernet Segment Identifier (ESI) is a unique identifier for an Ethernet segment that is multi-homed to two or more PEs. ESI is used for DF election and aliasing.

Answer

Ethernet Tag ID

Answer

MAC address

Answer

EVPN Route Target

Question 13

An enterprise uses IPsec VPN to connect branch offices. They apply QoS policies on the tunnel interface but notice that original DSCP markings are not preserved after encryption. Which feature should be enabled to maintain end-to-end QoS?

Accepted Answer

QoS pre-classify. When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.

Answer

AutoQoS

Answer

MPLS TE

Answer

NBAR

Question 14

Refer to the exhibit. The router has an outgoing label of 'Pop' for prefix ***********. What does this imply?

Accepted Answer

The router is the penultimate hop and will remove the label before forwarding. When a router has an outgoing label of 'Pop' for a prefix in MPLS, it indicates that the router is the penultimate hop (PHP) in the LSP. PHP means the router will remove (pop) the top label before forwarding the packet to the next hop, reducing the burden on the egress LSR. This is standard MPLS behavior as per RFC 3031, where the egress router signals an implicit null label (label 3) to its upstream neighbor.

Answer

The router has not learned a label for that prefix

Answer

The router will not forward traffic for that prefix

Answer

The router will push a new label for that prefix

Question 15

A service provider is implementing QoS policies on an access aggregation router. They want to shape traffic to a downstream DSLAM to 10 Mbps, but they do not want to exceed the shaping rate even if the line rate is higher. Which QoS tool should be used on the interface facing the DSLAM?

Accepted Answer

Shaping. Shaping is the correct tool because it buffers excess traffic and smooths the output rate to a configured target (10 Mbps) without exceeding it, even if the physical line rate is higher. Unlike policing, shaping does not drop or re-mark packets when the rate is exceeded, ensuring the downstream DSLAM receives traffic at or below the shaped rate.

Answer

Queuing

Answer

Marking

Answer

Policing

Question 16

In EVPN multi-homing, which two mechanisms are used to avoid duplicate packets and ensure efficient forwarding? (Choose two.)

Accepted Answer

Split-horizon filtering. Designated Forwarder (DF) election ensures only one PE forwards traffic to the CE for broadcast/multicast/unknown unicast, and split-horizon prevents a PE from forwarding packets back to the ES from which they were received.

Answer

MAC mobility

Answer

Aliasing

Answer

ARP suppression

Question 17

In IS-IS, which TWO are types of Link State PDUs (LSPs)?

Accepted Answer

Level 2 LSP. In IS-IS, Link State PDUs (LSPs) are the fundamental building blocks of the link-state database. They carry topology and prefix information and are generated by each router. There are two distinct types: Level 1 LSPs, which advertise information within the same area, and Level 2 LSPs, which advertise information between areas. Options B and E correctly identify these two types.

Answer

Partial Sequence Numbers PDU (PSNP)

Answer

Hello LSP

Answer

Complete Sequence Numbers PDU (CSNP)

Question 18

Which TWO statements correctly describe the use of OSPF in a service provider network?

Accepted Answer

OSPF uses different LSA types to advertise different types of routing information.. OSPF uses different LSA types (e.g., Type 1 Router LSA, Type 2 Network LSA, Type 3 Summary LSA, Type 5 AS-External LSA) to advertise different categories of routing information, such as router links, network links, inter-area routes, and external routes. This LSA-type differentiation is fundamental to OSPF's link-state architecture, enabling efficient flooding and route computation within and across areas.

Answer

OSPF uses the Bellman-Ford algorithm to compute routes.

Answer

OSPF is a distance-vector routing protocol.

Answer

OSPF uses TLVs to encode routing information.

Question 19

In a carrier-supporting carrier (CSC) architecture, the customer carrier runs MPLS in its network. Which technology is used to exchange VPN routes between the provider carrier and the customer carrier?

Accepted Answer

MP-BGP with VPNv4 address family. In a carrier-supporting-carrier (CSC) architecture, the customer carrier runs MPLS in its network and needs to exchange VPN routes (e.g., customer VPN prefixes) with the provider carrier. MP-BGP with the VPNv4 address family is the correct technology because it carries both the IPv4 prefix and the Route Distinguisher (RD), enabling the provider carrier to distinguish overlapping VPN routes from different customer VPNs. This is defined in RFC 4364 and is the standard inter-AS VPN option for CSC scenarios.

Answer

OSPF

Answer

EIGRP

Answer

IPv4 BGP

Question 20

Which THREE of the following are key components of an MPLS L3VPN architecture? (Choose three.)

Accepted Answer

VRF on PE routers. VRF (Virtual Routing and Forwarding) on PE routers is a key component because it isolates customer routing tables and forwarding planes within the provider edge, allowing multiple customers to share the same physical infrastructure while maintaining separate routing domains. Each VRF maintains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, which is fundamental to L3VPN separation.

Answer

RSVP-TE for traffic engineering

Answer

P routers with full VPN routing tables