350-501 Practice Test 2 — 25 Questions

Question 1

An SP detects a volumetric DDoS attack targeting a customer network. The SP uses Cisco's S/RTBH technique to drop attack traffic. Which action is performed by the edge routers upon receiving a BGP route with a specific community?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The edge router installs a /32 route pointing to a discard interface. S/RTBH works by advertising a /32 prefix (the victim's IP) with a special BGP community (e.g., NO_EXPORT) and a next-hop of the discard interface (e.g., Null0). Edge routers install the route pointing to Null0, dropping traffic to that IP.

Answer

The edge router applies a BGP FlowSpec rule to rate-limit the traffic

Answer

The edge router forwards the attack traffic to a scrubbing center

Answer

The edge router sends ICMP unreachable messages to the attacker

Question 2

In an MPLS-based service provider core network, the aggregation layer typically connects to the core backbone. Which technology is primarily used at the aggregation layer to scale Ethernet services for many customers while preserving VLAN separation?

Accepted Answer

Q-in-Q (IEEE 802.1ad). Q-in-Q (802.1ad) allows service providers to stack a customer VLAN tag on top of a service VLAN tag, enabling scalable customer separation in metro Ethernet networks.

Answer

IEEE 802.1ah (MAC-in-MAC)

Answer

IEEE 802.3ad (Link Aggregation)

Answer

IEEE 802.1x (Port-based Network Access Control)

Question 3

Which Cisco automation tool uses service models in YANG and communicates via NETCONF to orchestrate device configurations and lifecycle management?

Accepted Answer

Cisco Network Services Orchestrator (NSO). NSO (Network Services Orchestrator) uses YANG models and NETCONF for configuration management. Ansible, Cisco DNA Center, and Chef are other tools but NSO is specifically for service orchestration.

Answer

Ansible

Answer

Chef

Answer

Cisco DNA Center

Question 4

An engineer is configuring MPLS VPN and needs to ensure that customer traffic is automatically marked with a specific QoS policy based on the VPN. Which method should be used to propagate QoS markings across the MPLS network?

Accepted Answer

Use MPLS EXP bits to mark traffic at the ingress PE and map to QoS at egress. In an MPLS VPN environment, QoS markings must be preserved across the MPLS backbone. MPLS EXP (Experimental) bits are the standard mechanism to carry QoS information within the MPLS label stack. At the ingress PE, customer traffic is classified and marked with the appropriate EXP bits based on the VPN or other criteria. The egress PE then uses these EXP bits to map traffic to the correct QoS policy, ensuring end-to-end QoS treatment.

Answer

Use 802.1p CoS on the CE-PE link and preserve it across the MPLS backbone

Answer

Use IP ToS bits to mark traffic and rely on MPLS to preserve them

Answer

Set DSCP at the ingress PE and preserve it across the MPLS backbone

Question 5

In IS-IS, which type of LSP is used to advertise prefix information for IPv4 and IPv6 in a modern SP network that supports traffic engineering?

Accepted Answer

TLV 135 (Extended IP Reachability). TLV 135 for IPv4 (extended IP reachability) and TLV 236 for IPv6 (IPv6 reachability) are used in IS-IS for prefix advertisement.

Answer

TLV 2 (IS Neighbors)

Answer

TLV 1 (Area Addresses)

Answer

TLV 22 (IS Extended Neighbors)

Question 6

Drag and drop the steps to configure a Layer 3 interface on a Cisco switch (SVI) into the correct order.

Accepted Answer

Create the VLAN, then enter interface VLAN mode, then assign IP address, then enable the interface.. SVI configuration requires creating the VLAN, then the interface VLAN, assigning an IP, and enabling it.

Answer

Enter interface VLAN mode, then assign IP address, then enable the interface, then create the VLAN.

Answer

Create the VLAN, then assign IP address, then enter interface VLAN mode, then enable the interface.

Answer

Create the VLAN, then enable the interface, then enter interface VLAN mode, then assign IP address.

Question 7

A service provider wants to provide Layer 3 VPN services to customers using MPLS. Which technology is used to distribute VPNv4 routes between PE routers?

Accepted Answer

MP-BGP. MP-BGP is used to carry VPNv4 routes between PE routers. OSPF, EIGRP, and IS-IS are IGPs and do not carry VPNv4 routes.

Answer

IS-IS

Answer

OSPF

Answer

EIGRP

Question 8

In a multicast environment, a PE router is not receiving multicast traffic from a source behind a CE. The PIM neighbors are established. The RP is reachable. What is the most likely issue?

Accepted Answer

The PE does not have the multicast VRF enabled. The most likely issue is that the PE router does not have the multicast VRF enabled. In a multicast VPN (MVPN) environment, even if PIM neighbors are established and the RP is reachable, the PE must have multicast routing explicitly enabled within the VRF using the 'ip multicast-routing vrf <name>' command. Without this, the PE will not process multicast traffic for that VRF, causing it to drop or ignore multicast packets from the source behind the CE.

Answer

The CE is not sending IGMP joins

Answer

The source address is not in the VRF

Answer

The RP is not configured in the VRF

Question 9

An SP network is running OSPFv3 for IPv6 and needs to support traffic engineering extensions for RSVP-TE. Which three statements about OSPFv3 TE extensions are true?

Accepted Answer

OSPFv3 TE uses TLV 1 (Router Address) in Opaque LSAs.. OSPFv3 uses Opaque LSA types 9, 10, and 11 for TE, with Type 10 carrying TE information link-state. OSPFv3 TE requires the OSPFv3 process to be configured for TE.

Answer

OSPFv3 TE requires the use of wide metrics.

Answer

OSPFv3 TE only supports point-to-point links.

Question 10

A service provider is implementing Multicast VPN (MVPN) in an MPLS backbone. They use Rosen GRE (draft-rosen) for multicast transport. What is the primary limitation of Rosen GRE compared to mLDP-based MVPN?

Accepted Answer

All multicast traffic is sent to every PE in the VPN, even if no receiver exists.. In Rosen GRE (draft-rosen) MVPN, a default MDT (Multicast Distribution Tree) is built using a shared PIM-SM group across all PEs in the VPN. All multicast traffic from any source in the VPN is encapsulated in GRE and sent to this default MDT group, meaning every PE receives the traffic regardless of whether it has any local receivers. This is the primary limitation because it wastes bandwidth and processing on PEs that do not need the traffic, unlike mLDP-based MVPN which builds trees only to PEs with receivers.

Answer

It requires full-mesh of GRE tunnels between all PEs.

Answer

It cannot use Source-Specific Multicast (SSM).

Answer

It does not support Protocol Independent Multicast (PIM).

Question 11

Refer to the exhibit. An engineer pushes this XML configuration via NETCONF, but the device rejects it with an error stating 'invalid policy-map structure'. What is the problem?

Accepted Answer

The class name must be defined in a class-map before being referenced in the policy-map. The error 'invalid policy-map structure' occurs because the policy-map references a class name that has not been defined in a class-map beforehand. In Cisco IOS, a class-map must exist before it can be used inside a policy-map; otherwise, the device rejects the configuration as structurally invalid.

Answer

The configuration is missing the class-default class

Answer

The YANG model does not support the 'police' keyword

Answer

The priority and police commands cannot coexist in the same class

Question 12

Which TWO are characteristics of Segment Routing?

Accepted Answer

Source routing capability. Segment Routing (SR) is a source-routing paradigm where the ingress node encodes a list of segments (instructions) into the packet header, guiding the packet through the network without intermediate routers needing to maintain per-flow state. Option B is correct because SR inherently provides source routing capability: the source node determines the path by stacking segment identifiers (SIDs), and transit nodes simply forward based on the top SID.

Answer

Uses only IPv6 data plane

Answer

Requires RSVP-like signaling for path setup

Answer

Requires a centralized SDN controller

Question 13

An SP engineer notices that BGP routes from a CE are not being installed in the VRF routing table, although the BGP session is established. The VRF configuration includes route-target import 100:1. The CE is sending routes with RT 100:1. What is the most likely cause?

Accepted Answer

The route is not matching any import map. Even though the BGP session is up and the CE is sending routes with the correct route-target (RT 100:1), the VRF may have an import map applied. An import map filters which received VPN routes are actually installed into the VRF routing table. If the route does not match the conditions defined in that import map, it will be accepted by BGP but not installed, which explains the symptom.

Answer

The BGP route is suppressed due to route update delay

Answer

The VRF name does not match

Answer

The RD is not configured

Question 14

Match each service provider architecture term to its description.

Accepted Answer

Provider Edge (PE) router: Connects to customer edge routers and provides MPLS VPN services.. The correct matches are: PE connects to customer edge, P is MPLS core, ASBR connects to other ASes. Common confusions: mistaking P for CE or confusing Route Reflector with ASBR.

Answer

Customer Edge (CE) router: Core router that forwards packets based on MPLS labels without customer awareness.

Answer

Route Reflector: Router that exchanges routing information with another autonomous system.

Question 15

You are a network engineer at a service provider that offers L3VPN services. A customer complains that their VPN traffic is intermittently dropping. The network uses OSPF as the IGP, LDP for label distribution, and MP-BGP for VPNv4 route exchange. The PE routers are connected to two core routers (P1 and P2) in a redundant design. Upon investigation, you find that the BGP next-hop for some VPN prefixes is set to the loopback interface of the remote PE, but the route to that loopback is sometimes unreachable due to a flapping link between P1 and P2. The IGP converges, but the BGP prefixes take longer to recover. What is the most likely cause of the intermittent drops?

Accepted Answer

BGP next-hop tracking is not enabled, causing BGP to rely on IGP convergence only. The intermittent drops occur because BGP next-hop tracking (NHT) is not enabled. Without NHT, BGP relies solely on IGP convergence to detect reachability changes for the BGP next-hop (the remote PE loopback). When the link between P1 and P2 flaps, OSPF converges quickly, but BGP does not immediately re-evaluate its next-hop reachability; it waits for the next BGP scan interval (default 60 seconds) or until a BGP update is received. This delay causes the VPN prefixes to remain installed with an unreachable next-hop, leading to traffic drops until BGP eventually withdraws or re-advertises the routes.

Answer

The OSPF network type is incorrectly set to point-to-point

Answer

The BGP timers are set too low, causing premature route withdrawal

Answer

The LDP session between the PEs is down

Question 16

Based on the exhibit, what is the purpose of the 'mpls ldp neighbor ... password cisco' commands?

Accepted Answer

To authenticate the LDP session using MD5.. The 'mpls ldp neighbor ... password cisco' command configures a Message Digest 5 (MD5) authentication password for the LDP session with a specific neighbor. This ensures that the TCP connection used for LDP exchanges is authenticated, preventing spoofed or unauthorized LDP messages from being accepted, as defined in RFC 5036.

Answer

To synchronize LDP and IGP convergence.

Answer

To control the label allocation for prefixes from that neighbor.

Answer

To enable LDP session protection for the neighbor.

Question 17

Based on the exhibit, why is the route 10.10.10.0/24 from remote PE not installed in the VRF Customer-A on PE1?

Accepted Answer

The VRF imports route-target 200:200, but the route has RT 100:100. The route has RT 100:100, but VRF Customer-A imports RT 200:200. Thus, the route is not imported. Option A is wrong because the localpref is 100, which is default and not an issue. Option C is wrong because the RD mismatch is between VRFs, but RD does not affect import; RT does. Option D is wrong because label allocation is working fine (vpn-label:24000).

Answer

The localpref is too low (100)

Answer

The MPLS label allocation failed on the remote PE

Answer

The route distinguisher on the VRF (100:1) does not match the remote RD

Question 18

Which TWO of the following are characteristics of MPLS-TE (Traffic Engineering)?

Accepted Answer

Uses explicit paths to route traffic away from shortest-path IGP.. MPLS-TE uses explicit paths (either strict or loose) to direct traffic away from the shortest path determined by the IGP (e.g., OSPF or IS-IS). This allows network operators to engineer traffic flows based on administrative policies, such as load balancing or avoiding congested links, rather than relying solely on the IGP's metric-based shortest path.

Answer

Uses LDP for label distribution along the TE tunnel.

Answer

Requires per-platform label space for TE tunnels.

Answer

Requires all routers in the TE tunnel to be in the same OSPF area.

Question 19

Match each BGP attribute to its category or purpose.

Accepted Answer

Local Preference: Well-known discretionary attribute used for outbound traffic influence. Correct matches associate BGP attributes with their standard categories and purposes. Local Preference and Next Hop are well-known discretionary and mandatory respectively, while MED is optional nontransitive. Common confusions include misclassifying attribute categories or purposes.

Answer

Local Preference: Optional transitive attribute used to tag routes

Answer

AS Path: Optional nontransitive attribute used for inbound traffic influence

Question 20

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

1. Enter global configuration mode (configure terminal)
2. Configure the static route using the ip route command with destination network, subnet mask, and next-hop address or exit interface
3. Verify the configuration (e.g., show ip route)
4. Exit configuration mode (end or exit). Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

1. Enter global configuration mode (configure terminal)
2. Verify the configuration (e.g., show ip route)
3. Configure the static route using the ip route command
4. Exit configuration mode (end or exit)

Answer

1. Configure the static route using the ip route command
2. Enter global configuration mode (configure terminal)
3. Verify the configuration (e.g., show ip route)
4. Exit configuration mode (end or exit)

Answer

1. Exit configuration mode (end or exit)
2. Enter global configuration mode (configure terminal)
3. Configure the static route using the ip route command
4. Verify the configuration (e.g., show ip route)