350-501 Practice Test 29 — 15 Questions

Question 1

In an MPLS VPN, what label operation does the egress PE perform on the VPN packet before forwarding it to the CE?

Accepted Answer

Pop the label stack. In an MPLS VPN, the egress PE (Provider Edge) router receives a packet with a label stack typically consisting of a transport label (IGP label) and a VPN label. Before forwarding the IP packet to the CE (Customer Edge), the egress PE must remove the entire MPLS label stack because the CE is an IP-only device that does not understand MPLS labels. This operation is called 'pop the label stack' (also known as penultimate hop popping, though at the egress PE it is explicit label removal).

Answer

Swap the top label

Answer

Impose a VPN label

Answer

Push a new label

Answer

Replace the transport label

Question 2

Which TWO are possible causes for a NETCONF session failing to establish with a Cisco IOS-XE device?

Accepted Answer

TCP port 830 is blocked by a firewall. NETCONF uses TCP port 830 as its default transport port (per RFC 6242). If a firewall blocks this port, the TCP three-way handshake cannot complete, preventing the NETCONF session from establishing. This is a common network-layer cause of session failure.

Answer

The device is running IOS-XR

Answer

The YANG module namespace is incorrect

Answer

NTP is not synchronized

Question 3

During QoS troubleshooting, you capture traffic and see that DSCP markings are not being applied as configured. Which two common misconfigurations could cause this? (Choose two.)

Accepted Answer

The policy-map is not applied to the correct interface direction (input vs output). A policy-map must be applied in the correct direction (input or output) for the marking to take effect. If a marking policy is applied to the wrong direction, the packets will not be processed by the policy, and DSCP values will remain unchanged. This is a common misconfiguration when the intended marking should occur on ingress but the policy is applied to egress, or vice versa.

Answer

The policy-map is applied to a loopback interface

Answer

The marking is configured under the wrong policy-map

Answer

The device is running out of TCAM space

Question 4

While troubleshooting a customer complaint about slow data transfers, you notice that traffic from a specific site is being dropped. The QoS policy on the PE router includes a police command for the customer's traffic. The observed drop rate is exactly half of the configured police rate. What is the most probable reason?

Accepted Answer

The police is using a token-bucket algorithm with a small burst size that is being exceeded. The observed drop rate being exactly half the configured police rate strongly suggests that the token-bucket algorithm is operating with a burst size that is too small. When the burst size is insufficient, the bucket empties quickly under sustained traffic, causing packets to be marked as exceeding the rate and dropped. The police command in Cisco IOS uses a single-rate two-color marker (RFC 2697) or a two-rate three-color marker (RFC 2698), and a small burst size leads to premature drops even when the average rate is below the configured police rate.

Answer

The police rate is configured in bits per second but the traffic is measured in bytes per second

Answer

The traffic is using a different DSCP value than expected

Answer

The police action is set to drop, but the exceed-action is transmit

Question 5

A service provider is deploying IGMPv3 snooping on an MVPN network to optimize multicast forwarding. After configuration, multicast traffic is not reaching receivers. The source is sending to group 239.1.1.1. The PE router has received the IGMP report from the receiver, and the MDT is established. What is the most likely reason?

Accepted Answer

The source-specific multicast (SSM) range is applied but the receiver sent a (*,G) report. IGMPv3 snooping on the PE router processes the receiver's IGMPv3 report. If the SSM range (232.0.0.0/8) is applied to group 239.1.1.1, the receiver must send an IGMPv3 (S,G) report to join a specific source. However, if the receiver sends a (*,G) report (which is allowed only in ASM mode), the IGMP snooping will not install the forwarding entry, causing multicast traffic to be dropped even though the MDT is established.

Answer

The RP for the group is not configured

Answer

The IGMP snooping is filtering the multicast traffic because of wrong VLAN configuration

Answer

The multicast routing is not enabled globally

Question 6

An SP uses BGP FlowSpec to mitigate DDoS attacks. They also want to rate-limit the traffic per FlowSpec rule. Which configuration is required to enable policing within a FlowSpec action?

Accepted Answer

Include the 'rate-limit' action in the FlowSpec rule using the 'action' clause.. BGP FlowSpec allows the inclusion of a 'rate-limit' action within the FlowSpec rule's 'action' clause to enforce policing. This action directly applies a traffic rate limit (in bits per second) to the matched flow, enabling DDoS mitigation without requiring external QoS policies or MPLS TE reservations.

Answer

Configure MPLS TE bandwidth reservation for the FlowSpec routes.

Answer

Use policy-based routing (PBR) to set QoS parameters.

Answer

Apply a QoS policy-map to the interface and match the FlowSpec destination.

Question 7

Which TWO of the following are characteristics of MPLS L3VPN architecture? (Choose two.)

Accepted Answer

Each customer has a separate VRF on the PE router. In MPLS L3VPN, each customer is assigned a separate Virtual Routing and Forwarding (VRF) instance on the Provider Edge (PE) router. This VRF maintains a unique routing table and forwarding table per customer, ensuring complete isolation between different VPN customers on the same PE.

Answer

All traffic is forwarded using MPLS label switching only

Answer

LDP is required for label distribution in the core

Answer

The P routers maintain a full routing table for each VPN

Question 8

A service provider plans to deploy automation using Cisco NSO. Which two benefits does NSO provide for service lifecycle management? (Choose two.)

Accepted Answer

Automatic rollback on failed deployment.. Cisco NSO provides a built-in transaction management system that automatically rolls back a service deployment to its previous state if any part of the deployment fails. This ensures service lifecycle integrity by preventing partial or inconsistent configurations across devices.

Answer

On-device scripting engine.

Answer

Real-time traffic monitoring.

Answer

Built-in configuration compliance checks.

Question 9

Which TWO types of SIDs are defined in Segment Routing? (Select two.)

Accepted Answer

Adjacency-SID. Segment Routing (SR) defines two primary types of Segment Identifiers (SIDs): the Prefix-SID and the Adjacency-SID. A Prefix-SID is a global or local label associated with an IGP prefix (e.g., a loopback), enabling shortest-path forwarding toward that prefix. An Adjacency-SID is a local label associated with a specific adjacency (link) between two routers, forcing traffic out that exact interface regardless of the IGP shortest path.

Answer

TI-LFA SID

Answer

Service-SID

Answer

Node-SID

Question 10

A customer reports intermittent packet loss on a MPLS L3VPN connection. The PE router shows 'show mpls forwarding' entries for the CE prefix, but ping from the PE to the CE fails intermittently. Which action should be taken to isolate the issue?

Accepted Answer

Check 'show ip route vrf CUSTOMER' and 'show bgp vpnv4 unicast vrf CUSTOMER' to confirm the VRF routes.. The intermittent packet loss suggests a control-plane issue rather than a data-plane problem. By checking 'show ip route vrf CUSTOMER' and 'show bgp vpnv4 unicast vrf CUSTOMER', you can verify that the VRF route for the CE prefix is present in the routing table and that BGP is advertising the correct VPNv4 route with the proper next-hop and label. This isolates whether the failure is due to missing or incorrect route propagation, which is a common cause of intermittent reachability in MPLS L3VPN.

Answer

Use 'show mpls lsp' to verify the LSP to the CE's PE.

Answer

Examine the 'show mpls forwarding vrf CUSTOMER' output to see label operations.

Answer

Review the 'show bgp vpnv4 unicast all' output to verify route advertisement.

Question 11

A service provider wants to prevent IP spoofing attacks from customer edge devices connected to a PE router. The customer prefixes are known and asymmetric routing is not present. Which uRPF mode should be configured on the PE-CE interface?

Accepted Answer

Strict mode uRPF. Strict mode uRPF checks that the source IP address is reachable via the same interface the packet arrived on, and that the route points back to that interface. This is suitable when symmetric routing is guaranteed, as on PE-CE links in L3VPN.

Answer

No uRPF needed because BGP prefix filtering prevents spoofing

Answer

VRF-aware uRPF

Answer

Loose mode uRPF

Question 12

A service provider is implementing RPKI to validate BGP routes. Which THREE components are necessary for a complete RPKI deployment on routers? (Choose three)

Accepted Answer

RPKI cache server (Relying Party). RPKI requires three components: Route Origin Authorization (ROA) records created by RIRs to authorize AS origins, an RPKI cache server (Relying Party) that collects ROAs and validates them, and the BGP Origin Validation feature on routers that uses the Relying Party's VRP data to filter invalid routes. The cache server communicates with routers via RTR protocol. Components like prefix-lists or local preference manipulation are not part of RPKI itself.

Answer

Prefix-list for filtering

Answer

BGP path manipulation using local preference

Question 13

Which DSCP value corresponds to Best Effort (DF) per-hop behavior?

Accepted Answer

DSCP 0. Best Effort (DF, Default Forwarding) is DSCP 0.

Answer

DSCP 10

Answer

DSCP 8

Answer

DSCP 46

Question 14

Refer to the exhibit. The router cannot form a full OSPF adjacency with 10.0.0.2. Which is the most likely cause?

Accepted Answer

Mismatched MTU.. The most likely cause is a mismatched MTU because OSPF uses the interface MTU to determine whether to form an adjacency. If the MTU on one side is smaller than the size of the Database Description (DBD) packet, the neighbor will reject the packet and remain in the EXSTART state, preventing full adjacency. This is a common issue when connecting interfaces with different MTU values, such as a default 1500 bytes on one side and a lower value on the other.

Answer

Duplicate router IDs.

Answer

Mismatched authentication.

Answer

Mismatched hello interval.

Question 15

Refer to the exhibit. The output shows an MPLS forwarding entry with FRR protection. What is the purpose of the backup path shown?

Accepted Answer

To forward traffic if the primary outgoing interface fails.. The backup path in an MPLS Fast Reroute (FRR) configuration is precomputed and installed in the forwarding table to provide sub-50ms protection against link or node failures. When the primary outgoing interface fails, traffic is immediately switched to the backup path without waiting for IGP convergence, ensuring minimal packet loss.

Answer

To handle penultimate hop popping for the primary path.

Answer

To provide a load-balancing alternative for the primary path.

Answer

To carry the VPN label separately.