350-501 Practice Test 5 — 25 Questions

Question 1

An enterprise uses IPsec VPN to connect branch offices. They apply QoS policies on the tunnel interface but notice that original DSCP markings are not preserved after encryption. Which feature should be enabled to maintain end-to-end QoS?

Accepted Answer

QoS pre-classify. When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.

Answer

AutoQoS

Answer

MPLS TE

Answer

NBAR

Question 2

A large enterprise recently implemented centralized QoS policies using Cisco DNA Center. The policies are pushed via RESTCONF to the branch routers. After the deployment, the branch office reports that critical business applications (like ERP) are being delayed. The network team verifies that the QoS policy is applied correctly on the WAN interface (Serial0/0/0) with a shape of 10 Mbps. The policy-map has a class for 'critical-data' with bandwidth 5 Mbps and another class for 'transactional-data' with bandwidth 3 Mbps. The remaining traffic is in class-default with fair-queue. The branch router's CPU utilization is normal. The interface output shows that the queue for critical-data is rarely full, but packets are experiencing high latency. The engineer pings from the branch server to the central site and sees 200 ms RTT normally, but up to 500 ms during peak hours. What is the most likely cause of the high latency for critical-data?

Accepted Answer

The shape rate is too low; increase it to match the access link speed (e.g., 20 Mbps).. The correct answer is A because the shape rate of 10 Mbps is the bottleneck. Even though the critical-data class has a bandwidth guarantee of 5 Mbps, the overall interface is shaped to 10 Mbps. During peak hours, when the sum of all traffic (critical, transactional, and default) exceeds 10 Mbps, packets are queued at the shaper. This queueing introduces additional delay (up to 500 ms) for all classes, including critical-data, because the shaper enforces a single token bucket for the entire interface. Increasing the shape rate to match the actual access link speed (e.g., 20 Mbps) would reduce the queuing delay by allowing more traffic to be transmitted immediately.

Answer

The critical-data class needs a priority command to reduce latency.

Answer

The queue-limit for critical-data is too high; reduce it to force early drops.

Answer

The bandwidth command in critical-data should be increased above 5 Mbps.

Question 3

In an IS-IS segment routing network, after the global 'segment-routing mpls' configuration, which IS-IS configuration is mandatory for label allocation?

Accepted Answer

segment-routing mpls under router isis. The global 'segment-routing mpls' command enables MPLS Segment Routing on the device, but it does not automatically enable label allocation under IS-IS. The mandatory IS-IS configuration to trigger label allocation is 'segment-routing mpls' under the 'router isis' process. Without this sub-mode command, IS-IS will not allocate MPLS labels for prefixes, even if prefix-SIDs are configured on interfaces.

Answer

mpls label protocol sr

Answer

prefix-sid under the loopback interface

Answer

is-type level-1-2

Question 4

In a Carrier Supporting Carrier (CSC) architecture, which condition is necessary for the customer carrier's BGP routes to be carried over the provider carrier's MPLS backbone?

Accepted Answer

The BGP next-hop on the customer carrier's routes must be reachable via IGP in the provider carrier.. In a Carrier Supporting Carrier (CSC) architecture, the provider carrier's MPLS backbone must be able to forward packets toward the BGP next-hop of the customer carrier's routes. For this to happen, the BGP next-hop (typically a loopback interface on the customer carrier's PE router) must be reachable via an IGP (e.g., OSPF or IS-IS) running within the provider carrier's core. Without IGP reachability to that next-hop, the provider carrier's P routers cannot perform MPLS label switching to deliver traffic to the customer carrier's egress router, breaking end-to-end connectivity.

Answer

The provider carrier's VRF must have the route-target matching the customer carrier's.

Answer

The provider carrier must be in the same AS as the customer carrier.

Answer

The customer carrier must use LDP for label distribution.

Question 5

In an SR network, which configuration is required to activate TI-LFA for link protection?

Accepted Answer

fast-reroute per-prefix ti-lfa under the IGP process. Option C is correct because TI-LFA (Topology Independent Loop-Free Alternate) is activated under the IGP process using the 'fast-reroute per-prefix ti-lfa' command. This enables segment routing to compute a backup path that provides link protection without relying on the topology of the failure, ensuring 50-msec convergence.

Answer

metric delay interface configuration

Answer

label-preferred under the interface

Answer

mpls traffic-eng auto-tunnel primary

Question 6

An SP is managing a large MPLS network and needs to verify the MPLS forwarding entries for a specific VRF. Which command provides the most complete information for the VRF?

Accepted Answer

show mpls forwarding-table vrf . Option B is correct because the 'show mpls forwarding-table vrf ' command displays the complete MPLS forwarding entries for a specific VRF, including the incoming label, outgoing label, next-hop, and outgoing interface. This command is specifically designed to verify MPLS label-switched paths (LSPs) for a VRF, which is essential for troubleshooting MPLS VPN forwarding. It provides the most complete information for MPLS forwarding, as it shows both the label operations (swap, pop, push) and the VRF-specific forwarding details.

Answer

show ip cef vrf <name>

Answer

show mpls vrf <name>

Answer

show bgp vpnv4 unicast all labels

Question 7

Which TWO are benefits of using Segment Routing over LDP in a service provider core?

Accepted Answer

Label allocation is per-prefix, not per-interface.. Option B is correct because Segment Routing (SR) uses a centralized control plane (via PCE or BGP-LS) to allocate labels per prefix, unlike LDP which allocates labels per interface on a hop-by-hop basis. This reduces the number of labels in the control plane and simplifies label management, as SR-MPLS uses a single label stack entry per segment rather than per-interface labels.

Answer

Reduces the number of labels in the control plane.

Answer

Eliminates the need for IGP convergence for label distribution.

Answer

Simplifies MPLS TE tunnel configuration.

Question 8

A service provider is designing an MPLS L3VPN network to provide Layer 3 VPN services to multiple customers. Which two statements correctly describe the roles of the Provider Edge (PE) and Customer Edge (CE) routers in this architecture?

Accepted Answer

PE routers advertise customer routes via MP-BGP with route distinguishers and route targets.. Option C is correct because in an MPLS L3VPN, PE routers use MP-BGP (Multiprotocol BGP) to exchange customer VPN routes. Each VPN route is uniquely identified by a Route Distinguisher (RD) to maintain global uniqueness, and Route Targets (RTs) control the import/export of routes between VRFs. This allows the PE to separate customer routing domains while still using a shared MPLS backbone.

Answer

P routers store all customer VPN routes in their global routing table.

Answer

CE routers perform MPLS label switching between PE routers.

Answer

CE routers participate in the service provider's IGP to exchange loopback addresses.

Question 9

A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?

Accepted Answer

SR-TE. C is correct because Segment Routing Traffic Engineering (SR-TE) allows the service provider to perform traffic engineering without RSVP-TE by using segment lists (label stacks) to steer traffic along explicit paths. SR-TE leverages the IGP (OSPF or IS-IS) to distribute segment IDs (SIDs) and uses a centralized controller or headend node to compute and enforce TE policies, eliminating the need for RSVP-TE's per-flow signaling and state maintenance.

Answer

LDP

Answer

MPLS-TE (RSVP-TE)

Answer

BGP-LU

Question 10

Which THREE of the following are correct statements about EVPN-VXLAN in a data center fabric? (Select three.)

Accepted Answer

EVPN route type 3 is used for BUM traffic forwarding.. EVPN route type 3 (Inclusive Multicast Ethernet Tag Route) is used to advertise the VTEP addresses that participate in a given broadcast domain (EVI). This enables the underlay to forward BUM (Broadcast, Unknown unicast, Multicast) traffic by building a head-end replication list or by signaling multicast group membership, ensuring that BUM frames are delivered to all remote VTEPs in the same VXLAN segment.

Answer

VXLAN is a Layer 3 overlay that requires an IGP in the overlay.

Answer

VXLAN always requires IP multicast in the underlay for BUM traffic.

Question 11

A service provider is deploying EVPN-VPWS to replace legacy pseudowire connections for point-to-point Layer 2 services. They notice that MAC addresses learned from a CE device are not properly advertised to the remote PE. Which EVPN route type is responsible for advertising MAC address reachability information in a VPWS scenario?

Accepted Answer

Route Type 1 (Ethernet Auto-Discovery). In EVPN-VPWS, Route Type 1 (Ethernet Auto-Discovery) is used to advertise MAC address reachability for point-to-point services. Unlike EVPN-MPLS for multipoint, VPWS relies on per-EVI auto-discovery routes that carry the MAC address and label information for the pseudowire, enabling the remote PE to forward traffic correctly. This route type ensures that MAC addresses learned from the CE are advertised to the remote PE, replacing legacy pseudowire signaling.

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 5 (IP Prefix)

Answer

Route Type 3 (Inclusive Multicast)

Question 12

A network engineer is configuring QoS on a Cisco ASR 9000 router to support multiple traffic classes. The policy must ensure that real-time traffic (EF) is not starved by high-volume bulk data (AF11). Which queuing strategy should be applied to the EF class to provide low latency and strict priority?

Accepted Answer

Priority Queuing (LLQ). Low Latency Queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that EF (real-time) traffic is always served before other queues. This prevents starvation of delay-sensitive traffic by bulk data (AF11) while still allowing fair treatment of other classes. LLQ is the standard Cisco mechanism for supporting real-time traffic like VoIP with guaranteed low latency.

Answer

Weighted Round Robin (WRR)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In-First-Out (FIFO)

Question 13

A service provider is implementing Multicast VPN (MVPN) in an MPLS backbone. They use Rosen GRE (draft-rosen) for multicast transport. What is the primary limitation of Rosen GRE compared to mLDP-based MVPN?

Accepted Answer

All multicast traffic is sent to every PE in the VPN, even if no receiver exists.. In Rosen GRE (draft-rosen) MVPN, a default MDT (Multicast Distribution Tree) is built using a shared PIM-SM group across all PEs in the VPN. All multicast traffic from any source in the VPN is encapsulated in GRE and sent to this default MDT group, meaning every PE receives the traffic regardless of whether it has any local receivers. This is the primary limitation because it wastes bandwidth and processing on PEs that do not need the traffic, unlike mLDP-based MVPN which builds trees only to PEs with receivers.

Answer

It requires full-mesh of GRE tunnels between all PEs.

Answer

It cannot use Source-Specific Multicast (SSM).

Answer

It does not support Protocol Independent Multicast (PIM).

Question 14

Refer to the exhibit. CE1 is unable to ping the loopback of a remote CE. Which configuration change is required on PE1 to enable communication?

Accepted Answer

Apply the VRF to the interface facing CE and ensure BGP VRF neighbor is activated. Option B is correct because the configuration is missing the VRF forwarding statement on the interface facing CE1 and the BGP VRF neighbor activation under the VRF address-family. Without applying the VRF to the interface, PE1 cannot associate the CE-facing interface with the correct VRF, and without activating the BGP neighbor under the VRF address-family, PE1 will not establish a BGP session with CE1 or exchange routes for that VRF. This prevents CE1 from learning the remote CE's loopback route.

Answer

Add `send-community extended` to the VRF BGP neighbor

Answer

Change the VPNv4 neighbor to point to 192.168.1.2

Answer

Set the CE neighbor remote-as to 65000

Question 15

An SP is designing a MPLS L3VPN service with BGP as the PE-CE routing protocol. They want to ensure that the CE router does not become a transit router between two sites. Which BGP feature should be configured on the PE to prevent the CE from advertising routes received from one site to another?

Accepted Answer

Site of Origin (SoO). The Site of Origin (SoO) BGP community is the correct feature because it prevents routing loops in MPLS L3VPN environments where the same CE router connects to multiple sites. When configured on the PE, SoO tags routes received from a CE with a unique identifier for that site; if the PE receives a route with the same SoO value from another site, it discards the route, ensuring the CE does not become a transit router between sites.

Answer

allowas-in

Answer

disable-connected-check

Answer

as-override

Question 16

During a multicast deployment, some receivers are not receiving the stream. The PIM neighbor table shows the upstream interface is correct. Which command would verify whether the multicast routing table has the correct outgoing interface list?

Accepted Answer

show ip mroute. The 'show ip mroute' command displays the multicast routing table, including the outgoing interface list (OIL) for each multicast group. Since the PIM neighbor table confirms the upstream interface is correct, the issue likely lies in the OIL, which 'show ip mroute' directly verifies. This command shows which interfaces are forwarding multicast traffic and whether they are pruned or in a forwarding state.

Answer

show ip igmp groups

Answer

show ip pim neighbor

Answer

show ip route

Question 17

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

Accepted Answer

NAT with VRF awareness. Option D is correct because NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

Answer

Static default route from VRF to global

Answer

Route leaking between VRF and global

Answer

VRF-Aware Firewall

Question 18

A team uses Ansible to automate configuration of Cisco devices. They want to ensure that configurations are applied only if the device is reachable and the current configuration differs from the intended. Which Ansible module or feature is best suited for this?

Accepted Answer

ios_config with check_mode. Option C is correct because the `ios_config` module with `check_mode` (enabled via the `--check` flag or `check_mode: yes`) allows Ansible to first verify device reachability and then compare the intended configuration against the running configuration without making changes. Only when a difference is detected and `check_mode` is disabled will the module apply the configuration changes. This directly meets the requirement of applying configurations only when the device is reachable and the current configuration differs from the intended.

Answer

ios_system

Answer

net_get

Answer

ios_command

Answer

ios_facts

Question 19

An SP customer reports intermittent voice quality issues. The engineer wants to measure jitter and packet loss between two remote sites using Cisco IP SLA. Which IP SLA operation type should be configured?

Accepted Answer

UDP Jitter. The UDP Jitter operation (option E) is correct because it measures both one-way jitter and packet loss by sending UDP packets with precise timestamps, which is essential for diagnosing voice quality issues. Unlike other IP SLA operations, UDP Jitter specifically tracks inter-packet delay variation (jitter) and loss patterns that directly impact VoIP and real-time traffic.

Answer

DNS Query

Answer

ICMP Echo

Answer

HTTP Get

Answer

TCP Connect

Question 20

A customer is connected to a service provider MPLS L3VPN network using BGP. The CE advertises a prefix 10.1.1.0/24 to the PE. On the PE, the customer's VRF route table shows the route with the next-hop set to the CE. When the PE receives a packet destined to 10.1.1.1, what label stack will the PE apply before forwarding the packet across the MPLS core?

Accepted Answer

Only the MPLS VPN label assigned to the route by the egress PE. Option B is correct because in an MPLS L3VPN, when a PE receives an IP packet from a CE, it must forward it across the MPLS core to the egress PE. The ingress PE imposes a label stack consisting of two labels: an inner VPN label (assigned by the egress PE for the specific VRF route) and an outer transport label (LDP or RSVP) that carries the packet to the egress PE. The VPN label is used by the egress PE to identify the correct VRF and forward the packet to the correct CE.

Answer

Only the transport label (LDP or RSVP) for the egress PE

Answer

No label, because the CE is directly connected

Answer

Both the transport label and the VPN label