350-501 Practice Test 27 — 15 Questions

Question 1

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement CoPP by creating a class-map for ICMP and applying a police rate under a control-plane policy-map. CoPP (Control Plane Policing) on IOS XR uses class maps and policy maps to classify and rate-limit control plane traffic, including ICMP. ACL-based policing is less granular, and MPLS TE or BGP prefix filtering do not apply.

Answer

Enable MPLS traffic engineering to reroute ICMP

Answer

Use BGP prefix filtering to block ICMP routes

Answer

Configure an ACL to deny ICMP on all interfaces

Question 2

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). BGP FlowSpec can specify actions like traffic-rate (rate-limiting), redirect (to a next-hop or VRF), and drop (discard). Marking DSCP is not typical; sample is used for traffic analysis but not a standard action in FlowSpec.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 3

A service provider is using Cisco Peakflow for DDoS detection. Peakflow identifies anomalies based on network traffic telemetry. Which data collection method does Peakflow primarily use?

Accepted Answer

NetFlow/IPFIX. Peakflow uses NetFlow (or IPFIX) data exported from routers to analyze traffic patterns and detect anomalies.

Answer

Syslog

Answer

SNMP polling

Answer

Packet capture

Question 4

What is the purpose of NTP authentication in a service provider network?

Accepted Answer

To verify the identity of the NTP server. NTP authentication ensures that time synchronization messages are from a trusted source, preventing spoofed NTP packets that could cause time changes affecting logs, protocols, and security.

Answer

To encrypt NTP traffic

Answer

To rate-limit NTP packets

Answer

To synchronize time across devices

Question 5

An engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a provider edge (PE) router to mitigate IP spoofing. The customer-facing interface has a single static default route. Which uRPF mode should be used to provide anti-spoofing without causing false drops?

Accepted Answer

Loose mode. With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Answer

VRF mode

Answer

Strict mode

Answer

Feasible mode

Question 6

A service provider is deploying uRPF on peering edges with multiple upstream providers and asymmetric routing. Which two statements are true about uRPF operation in this scenario? (Choose two.)

Accepted Answer

Loose mode may drop traffic if no route to the source exists in the FIB. Loose uRPF only checks that a route to the source exists, suitable for asymmetric routing. Strict uRPF requires the incoming interface to match the best return route, which can drop legitimate traffic with asymmetric routing. Default routes do not affect loose mode.

Answer

uRPF requires CEF to be disabled

Answer

Loose mode requires a default route to function

Answer

Strict mode is preferred for asymmetric routing environments

Question 7

Refer to the exhibit. Which statement is true about this configuration?

Accepted Answer

LDP is automatically enabled on the interface. The `mpls ip` command under interface configuration enables LDP on that interface, allowing it to automatically discover LDP neighbors and exchange label bindings. This command implicitly enables LDP without requiring manual neighbor configuration, which is the default behavior for label distribution in many MPLS deployments.

Answer

LDP is manually configured

Answer

MPLS VPN is enabled

Answer

MPLS forwarding is disabled

Question 8

A service provider has recently deployed MPLS L3VPN to provide IP connectivity to multiple enterprise customers. One customer reports that they cannot reach a remote site that is connected to a different PE router. The engineer checks the BGP VPNv4 table on the customer's PE and sees the route for the remote site, but the next-hop is unreachable. The interface between the PE and P routers is up/up, and IGP reachability to the PE's loopback is fine. What is the most likely cause? Consider that the network uses LDP for label distribution and OSPF as the IGP.

Accepted Answer

MPLS LDP is not enabled on the interface connecting to the P router. Since the interface between the PE and P routers is up/up and IGP reachability to the PE's loopback is fine, the issue is that MPLS LDP is not enabled on that interface. Without LDP, the PE cannot advertise a label for its loopback to the P router, so the P router cannot push the correct label for packets destined to the remote PE. This makes the BGP VPNv4 next-hop unreachable even though the route itself is present in the table.

Answer

BGP next-hop-self is not configured on the PE

Answer

The VRF route-target import/export is misconfigured

Answer

The PE router does not have an LSP to the remote PE

Question 9

An SP is deploying EVPN to provide both L2 and L3 VPN services. Which advantage does EVPN offer over traditional VPLS for multi-homing?

Accepted Answer

EVPN provides faster convergence and active-active multi-homing using Ethernet Segment Identifier (ESI) and Designated Forwarder (DF) election.. EVPN uses ESI-based multi-homing with BGP control plane, offering faster convergence and active-active load balancing compared to VPLS's active/standby model.

Answer

EVPN uses a single MAC address per PE to reduce forwarding table size.

Answer

EVPN supports only active/standby redundancy, similar to VPLS.

Answer

EVPN requires MPLS in the core, whereas VPLS can use IP-only.

Question 10

A service provider is deploying Segment Routing Traffic Engineering (SR-TE) with a Path Computation Element (PCE). The PCE fails to compute a path for an SR-TE policy configured with constraint 'avoid nodes in affinity red'. The core network has red affinity assigned to several nodes. Which is the most likely cause?

Accepted Answer

The PCE does not have the updated link-state database with the affinity attributes. The PCE computes paths based on the link-state database (LSDB) it receives from the IGP (e.g., OSPF or IS-IS). If the LSDB does not include the affinity (color) attributes for the nodes, the PCE cannot evaluate the 'avoid nodes in affinity red' constraint. This results in a path computation failure, even though the affinities are correctly configured on the network devices.

Answer

The headend router does not have the SR-TE policy configured with the correct path

Answer

The PCE is not reachable from the headend router

Answer

The SR-TE policy is configured with a strict explicit path that conflicts with the constraint

Answer

The red affinity is not properly configured in the network

Question 11

An MPLS-TE tunnel is configured with Fast Reroute using link protection. The primary path traverses links A-B and B-C. If link B-C fails, which action does the head-end router take?

Accepted Answer

The router at node B switches traffic to a pre-computed backup tunnel around link B-C.. MPLS-TE Fast Reroute (FRR) with link protection pre-computes a backup tunnel that bypasses the protected link. When link B-C fails, the router at node B (the Point of Local Repair, or PLR) immediately switches traffic to this pre-established backup tunnel, ensuring sub-50ms failover without involving the head-end router.

Answer

The head-end router immediately switches to a secondary explicit path.

Answer

RSVP-TE signals a new LSP from the head-end after detecting the failure.

Answer

Traffic is dropped until the IGP converges on the new topology.

Question 12

In a CBWFQ policy with LLQ, which statement is true regarding the bandwidth command for non-priority classes?

Accepted Answer

The sum of bandwidth for all classes must be less than 100%. The bandwidth command can specify a percentage or absolute bandwidth, but the sum must not exceed the available bandwidth (interface bandwidth minus LLQ).

Answer

The bandwidth can exceed the interface speed if shaped

Answer

Bandwidth is not used if LLQ is present

Answer

The bandwidth command is optional in CBWFQ

Question 13

A large SP network uses Segment Routing (SR) with MPLS data plane. They want to enforce a strict path for certain traffic flows across the core while using shortest-path for others. Which technique should be used?

Accepted Answer

SR-TE with explicit path using segment list. SR-TE with an explicit path using a segment list allows the operator to define a strict, ordered list of MPLS labels (segments) that the traffic must follow, overriding the default IGP shortest-path behavior. This is the correct technique for enforcing a strict path across the core while leaving other traffic to use shortest-path forwarding.

Answer

Using TI-LFA

Answer

Configuring bandwidth reservation on all links

Answer

Using SR policies with color extended community based on BGP

Question 14

An engineer configures a class-map to match traffic with DSCP AF41. What is the numerical DSCP value for AF41?

Accepted Answer

34. AF41 is Assured Forwarding class 4, low drop probability, with DSCP decimal value 34 (binary 100010).

Answer

38

Answer

36

Answer

32

Question 15

An SP network engineer is reviewing a QoS configuration on a PE router. The policy-map uses a class for voice with the 'priority' command, and a class for video with 'bandwidth remaining percent 30'. What is the purpose of the 'bandwidth remaining percent' command?

Accepted Answer

It allocates a percentage of the bandwidth left after priority queues are served.. 'bandwidth remaining percent' allocates a percentage of the remaining bandwidth after the priority queue is serviced. This ensures other classes share leftover bandwidth.

Answer

It sets the maximum bandwidth for the class.

Answer

It guarantees a minimum bandwidth for the class.

Answer

It enables Weighted Random Early Detection on the class.