350-501 Practice Test 3 — 10 Questions

Question 1

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS

Question 2

A network operator wants to distribute traffic filtering rules to multiple routers dynamically during a DDoS attack. Which technology should be used?

Accepted Answer

BGP FlowSpec. BGP FlowSpec (RFC 5575) allows a network operator to distribute flow specification rules — matching on source/destination prefix, protocol, port, packet length, and other fields — along with actions such as drop, rate-limit, or redirect, to multiple routers via BGP. This makes it ideal for dynamically propagating DDoS traffic filtering rules to many routers at once during an attack.

Answer

uRPF

Answer

S/RTBH

Answer

ACLs

Question 3

Drag and drop the steps to configure OSPF on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then enable the OSPF process with 'router ospf' command, then advertise networks under the OSPF process using 'network' command.. OSPF configuration requires entering global config mode, enabling the OSPF process, and then advertising networks under the OSPF process.

Answer

Advertise networks using 'network' command, then enter global config mode, then enable OSPF process.

Answer

Enable OSPF process, then advertise networks, then enter global config mode.

Answer

Enter global configuration mode, then advertise networks, then enable OSPF process.

Question 4

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

Accepted Answer

MCAST-VPN address family. In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Answer

MVPN does not use BGP; it uses PIM.

Answer

VPNv4 address family

Answer

IPv4 multicast address family

Question 5

In SP automation, which protocol is used by NSO to communicate with network devices for configuration management?

Accepted Answer

NETCONF. NSO (Network Services Orchestrator) uses NETCONF as its primary southbound protocol to communicate with network devices for configuration management. NETCONF provides a standardized, transactional, and model-driven (YANG) interface that allows NSO to push, validate, and roll back configuration changes reliably across multivendor devices.

Answer

RESTCONF

Answer

SNMP

Answer

CLI

Question 6

In EVPN-VPWS, which component is used to identify a multi-homed Ethernet segment and enable load balancing and fast convergence?

Accepted Answer

Ethernet Segment Identifier (ESI). The Ethernet Segment Identifier (ESI) is a unique identifier for an Ethernet segment that is multi-homed to two or more PEs. ESI is used for DF election and aliasing.

Answer

Ethernet Tag ID

Answer

MAC address

Answer

EVPN Route Target

Question 7

In Cisco IOS XR architecture, using Secure Domain Routers (SDRs) allows partitioning a physical router into multiple logical routers. Which statement about admin plane and SDRs is correct?

Accepted Answer

The admin plane is a separate SDR that manages hardware resources and system-level functions, while the default SDR handles routing and forwarding.. In Cisco IOS XR, the admin plane is a separate Secure Domain Router (SDR) that manages hardware resources and system-level functions, while the default SDR handles routing and forwarding. The admin plane is responsible for chassis management, software installation, and other system-wide tasks, and it is isolated from the default SDR for security and stability.

Answer

The admin plane runs only on route processor cards, while default SDR runs on line cards.

Answer

The admin plane and default SDR are the same logical entity and share all configuration.

Answer

SDRs are only supported on Cisco CRS, not on ASR 9000.

Question 8

Drag and drop the steps to configure a Layer 3 interface on a Cisco switch (SVI) into the correct order.

Accepted Answer

Create the VLAN, then enter interface VLAN mode, then assign IP address, then enable the interface.. SVI configuration requires creating the VLAN, then the interface VLAN, assigning an IP, and enabling it.

Answer

Enter interface VLAN mode, then assign IP address, then enable the interface, then create the VLAN.

Answer

Create the VLAN, then assign IP address, then enter interface VLAN mode, then enable the interface.

Answer

Create the VLAN, then enable the interface, then enter interface VLAN mode, then assign IP address.

Question 9

In MPLS, which label operation is performed by a Penultimate Hop Popping (PHP) router?

Accepted Answer

Pop the top label from the stack. In PHP, the penultimate router pops the label before forwarding to the egress, reducing the egress router's work.

Answer

Swap the top label with a new label

Answer

Push a new label onto the stack

Answer

Swap and push an additional label

Question 10

To secure NTP in a service provider network, which feature should be enabled on IOS XR routers to prevent time synchronization with unauthorized NTP servers?

Accepted Answer

NTP authentication with MD5 keys. NTP authentication with MD5 (or SHA) keys ensures that a router only synchronizes with NTP servers that possess the correct symmetric key, preventing spoofed or rogue time sources. On IOS XR, you configure ntp authentication-key and ntp trusted-key, then associate the key with the server via the key keyword. This directly addresses the requirement to prevent synchronization with unauthorized NTP servers.

Answer

NTP symmetric active mode

Answer

NTP broadcast client mode

Answer

NTP access group with read-only community