350-501 Practice Test 24 — 15 Questions

Question 1

Refer to the exhibit. What is the role of this router for prefix 10.0.1.0/24?

Accepted Answer

Penultimate hop.. The router is the penultimate hop for prefix 10.0.1.0/24 because it performs a 'Pop tag' operation (implicit null label). In MPLS, the penultimate hop pops the label before forwarding the unlabeled IP packet to the egress LSR. Therefore, this router is not the egress; it is the penultimate Label Switching Router (LSR).

Answer

Transit LSR.

Answer

Egress LSR.

Answer

Ingress LSR.

Question 2

Which two statements about LDP liberal label retention are true? (Choose two.)

Accepted Answer

It allows faster convergence after a topology change.. Option B is correct because liberal label retention keeps labels received from all LDP neighbors in the LIB, so if a topology change causes a new next hop to be selected, the label for that neighbor is already available and forwarding can be restored without waiting for a new label mapping, enabling faster convergence. Option D is correct because liberal label retention is defined by retaining all received label bindings from every LDP neighbor, even if those labels are not currently used in the LFIB for forwarding. Option A is incorrect because liberal label retention is the default LDP behavior in Cisco IOS and does not require explicit configuration of the retention mode. Option C is incorrect because conserving memory by storing labels only for next-hop neighbors describes conservative label retention, not liberal retention. Option E is incorrect because manual label filtering is not required for liberal label retention; it is an optional control mechanism and not a defining requirement.

Answer

It requires explicit configuration of the label retention mode in Cisco IOS.

Answer

It conserves memory by only storing labels for next-hop neighbors.

Answer

It requires manual configuration of label filtering.

Question 3

A service provider needs to offer L3VPN services to multiple customers, each with overlapping IP addresses. The provider plans to use MPLS VPNs with VRFs. Which statement is TRUE regarding the configuration of VRFs on the PE routers?

Accepted Answer

Route targets (RTs) are used to control the import and export of VPNv4 routes between VRFs. Route targets (RTs) are extended BGP community attributes attached to VPNv4 routes that control which VRFs import and export those routes. In an MPLS L3VPN, the route distinguisher (RD) makes the customer prefix unique within the provider's BGP table, but it is the RT that determines the actual VPN membership and route leaking between VRFs. This allows overlapping customer IP addresses to be kept separate while still enabling controlled import/export policies.

Answer

The VRF must run OSPF to exchange routes with the CE router

Answer

MPLS labels are assigned per prefix inside a VRF by manual configuration

Answer

Each VRF must have a unique route distinguisher across the entire provider network

Question 4

Which THREE of the following are key components of an MPLS L3VPN architecture? (Choose three.)

Accepted Answer

VRF on PE routers. Option B is correct because a VRF (Virtual Routing and Forwarding) instance on PE routers is the fundamental construct that isolates each customer's routing table and allows overlapping address spaces in an MPLS L3VPN. Option C is correct because LDP (Label Distribution Protocol) is the standard mechanism used to distribute labels for the transport (core) LSPs between P and PE routers, enabling label switching of VPN traffic across the provider backbone. Option E is correct because MP-BGP (Multiprotocol BGP) with the VPNv4 address family is the protocol used to exchange customer VPN routes between PE routers, carrying the route distinguisher and route target extended communities. Option A is not a key component of a basic L3VPN architecture; RSVP-TE is an optional traffic-engineering mechanism for MPLS, not required for VPN operation. Option D is incorrect because P routers only switch labeled packets and do not maintain customer VPN routing tables — that is the role of the PE routers.

Answer

RSVP-TE for traffic engineering

Answer

P routers with full VPN routing tables

Question 5

Which DSCP value is recommended for Expedited Forwarding (EF) per-hop behavior, commonly used for voice traffic?

Accepted Answer

DSCP 46. Expedited Forwarding (EF) per-hop behavior is defined in RFC 3246 and is designed for low-loss, low-latency, and low-jitter services such as voice traffic. The recommended DSCP value for EF is 46 (binary 101110), which corresponds to the PHB that ensures a dedicated forwarding treatment with a minimal queueing delay. This value is widely adopted in Cisco QoS deployments for voice payloads to guarantee strict priority queuing.

Answer

DSCP 10

Answer

DSCP 0

Answer

DSCP 34

Question 6

An SP engineer is configuring IS-IS on a router and specifies a NET address of 49.0001.1921.6800.1001.00. What does the '00' at the end represent?

Accepted Answer

SEL (NSAP Selector). The last two octets of an IS-IS NET address represent the SEL (NSAP Selector), which is always 00 for a router.

Answer

AFI

Answer

System ID

Answer

Area ID

Question 7

A service provider offers IPTV services using multicast. The network uses Multicast VPN (MVPN) with Rosen GRE encapsulation (Profile 1) in an MPLS L3VPN environment. The Provider Edge (PE) routers participate in both the default MDT and data MDT for high-bandwidth streams. Recently, a new channel was added, and it uses a data MDT. The content server is attached to a PE that is acting as a multicast source. Other PEs are receivers. Upon adding the channel, some receivers report missing packets. The network engineer checks the PEs and notices that the data MDT group address is being advertised via BGP as an MDT SAFI route, but some PEs are not joining the data MDT. The source PE's multicast routing table shows that it believes data MDT is active. Which architecture issue is most likely preventing some PEs from joining the data MDT?

Accepted Answer

The data MDT group is not within the configured data MDT group range on the receiving PEs.. In MVPN with Rosen GRE (Profile 1), data MDT groups are configured on PE routers with a specific range. If a receiving PE does not have the data MDT group address within its configured data MDT group range, it will not join that data MDT even though the source PE advertises it via BGP MDT SAFI. This mismatch prevents the receiver from receiving multicast traffic on the data MDT, causing packet loss for high-bandwidth streams.

Answer

The source PE is not sending IGMP joins for the data MDT group.

Answer

The default MDT group is flapping.

Answer

The PIM sparse mode RP is not reachable.

Question 8

A service provider wants to offer a service where a customer site can communicate with multiple other sites in a full mesh over MPLS. Which L2VPN technology is most appropriate?

Accepted Answer

VPLS. VPLS (Virtual Private LAN Service) is an L2VPN technology that emulates a multipoint Ethernet LAN across an MPLS network, allowing multiple customer sites to communicate as if they were on the same switch. This provides the full-mesh any-to-any connectivity the service provider wants without requiring the customer to run a routing protocol. VPWS, by contrast, is point-to-point, so it cannot deliver a full mesh natively.

Answer

L3VPN

Answer

VPWS

Answer

E-Tree

Question 9

An ISP wants to create separate virtual networks over a shared physical infrastructure to serve mobile broadband (eMBB), IoT (mMTC), and mission-critical services (uRLLC). Which technology enables this segmentation with per-slice resource guarantees?

Accepted Answer

Network Slicing using IETF and 3GPP frameworks. Network slicing, standardized by 3GPP (with transport frameworks from IETF), enables multiple logical networks over shared physical infrastructure, each tailored to distinct service requirements like eMBB, mMTC, and uRLLC. It provides per-slice resource guarantees, isolation, and SLA differentiation, which is exactly what the ISP needs for diverse 5G service classes.

Answer

MPLS Traffic Engineering

Answer

L3VPN with VRF

Answer

VPLS

Question 10

Which three are required components for deploying Segment Routing in an MPLS network? (Choose three.)

Accepted Answer

MPLS forwarding capability on routers. Option B is correct because Segment Routing over MPLS still relies on the MPLS data plane, so routers must support MPLS forwarding (label push, swap, and pop operations) to carry SR-labeled packets. Option C is correct because SR-MPLS uses SIDs, specifically Node-SIDs (prefix SIDs) for shortest-path forwarding to a node and Adj-SIDs for forwarding over a specific adjacency, and these must be assigned and advertised for the forwarding instructions to work. Option D is correct because the IGP (OSPF or IS-IS) must be extended with Segment Routing extensions to advertise SID information and build the segment routing topology/label stack. Option A is not required because SR-MPLS does not depend on RSVP-TE signaling; SR replaces the need for RSVP-TE in many designs. Option E is not required because SR-MPLS does not rely on LDP for label distribution; labels/SIDs are distributed via the IGP SR extensions instead.

Answer

RSVP-TE signaling protocol

Answer

LDP for label distribution

Question 11

An engineer needs to ensure that a core router can forward MPLS packets without checking the IP header. Which forwarding mechanism should be enabled?

Accepted Answer

CEF switching. Cisco Express Forwarding (CEF) is the required switching mechanism for MPLS forwarding. When MPLS is enabled on a router, CEF uses the Label Forwarding Information Base (LFIB) to forward packets based solely on the top label, without inspecting the IP header. This allows core routers (P routers) to perform label switching without IP lookups. Penultimate Hop Popping (PHP) is an optimization that occurs at the penultimate router, but it is not the mechanism that enables label-based forwarding; it relies on CEF. Therefore, enabling CEF switching is necessary for a core router to forward MPLS packets without checking the IP header.

Answer

Link Fragmentation and Interleaving (LFI)

Answer

Per-packet load balancing

Answer

Penultimate Hop Popping (PHP)

Question 12

A service provider is deploying a new metro Ethernet network and needs to support multiple customer VLANs over a single physical link without overlapping VLAN IDs. Which technology should be used at the access layer to achieve this?

Accepted Answer

Q-in-Q (802.1ad) double tagging. Q-in-Q (802.1ad) double tagging encapsulates each customer's 802.1Q VLAN tag inside an additional service-provider VLAN tag, allowing multiple customers to reuse the same VLAN IDs across a shared physical link without conflict. The outer S-VLAN tag identifies the customer or service instance, while the inner C-VLAN tag preserves the customer's own VLAN scheme. This is the standard metro Ethernet access-layer solution for transparent VLAN multiplexing.

Answer

VLAN translation

Answer

MAC-in-MAC (802.1ah)

Answer

VLAN trunking with 802.1Q

Question 13

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted transport for management sessions, TACACS+ provides centralized AAA with per-command authorization, and IOS XR task groups enable granular role-based access control (RBAC) that limits which commands each user can run. Together these form the strongest management-plane hardening combination on IOS XR. TACACS+ is preferred over RADIUS for device administration because it separates authentication, authorization, and accounting and supports command-level authorization.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 14

In a hierarchical QoS policy applied to a subscriber aggregation interface, the parent policy shapes to 100 Mbps and the child policy allocates 50% bandwidth to voice and 50% to data. If voice traffic exceeds 50 Mbps, what happens to the excess?

Accepted Answer

Excess voice is dropped or re-marked. In a hierarchical QoS policy, the child policy's bandwidth allocation (50% to voice) is a guarantee/limit within the parent's shaped rate. If voice traffic exceeds its 50 Mbps share, the excess is not automatically given to the data class — it is either dropped or re-marked (e.g., policed down) depending on the child policy's configuration, because the child classes are bounded by their allocated percentages.

Answer

Excess voice is queued in the data queue

Answer

Excess voice is shaped by the parent policy

Answer

Excess voice is forwarded with best effort

Question 15

In a multicast environment, a PE router is not receiving multicast traffic from a source behind a CE. The PIM neighbors are established. The RP is reachable. What is the most likely issue?

Accepted Answer

The PE does not have the multicast VRF enabled. The most likely issue is that the PE router does not have the multicast VRF enabled. In a multicast VPN (MVPN) environment, even if PIM neighbors are established and the RP is reachable, the PE must have multicast routing explicitly enabled within the VRF using the 'ip multicast-routing vrf <name>' command. Without this, the PE will not process multicast traffic for that VRF, causing it to drop or ignore multicast packets from the source behind the CE.

Answer

The CE is not sending IGMP joins

Answer

The source address is not in the VRF

Answer

The RP is not configured in the VRF