350-501 Practice Test 35 — 15 Questions

Question 1

A service provider operates a large MPLS VPN network using OSPF as the IGP and LDP for label distribution. The PE routers (PE1, PE2, PE3) are connected to a core of P routers. Recently, a new link was added between P2 and P3. After the link came up, the engineering team noticed that several VPN routes that were previously reachable via PE2 are now being blackholed when traffic is sent from PE1 to those prefixes. The teams verify that the VPNv4 routes are present in the BGP table on PE1 with valid next-hops, but traffic fails. The traceroute from PE1 to the CE behind PE2 stops at P2. The show mpls forwarding-table on P2 shows the correct label for the VPN prefix, but the outgoing interface is null. Which action should the engineer take to resolve the issue without causing additional disruption?

Accepted Answer

Clear LDP neighbor sessions on P2 to re-initiate label exchange.. The issue is that P2 has a label for the VPN prefix but a null outgoing interface, indicating an LDP label mapping problem. Clearing LDP neighbor sessions on P2 forces re-establishment of LDP sessions and re-exchange of label bindings, which should resolve the missing or incorrect label mapping for the BGP next-hop without disrupting other services.

Answer

Add a static route on P2 for the BGP next-hop pointing to Null0.

Answer

Shut down the new link between P2 and P3.

Answer

Clear BGP sessions on PE1 to force re-advertisement of VPN routes.

Question 2

A service provider has implemented model-driven telemetry to monitor the health of its core network. The telemetry collector is a single server running a custom application that receives and processes gRPC streams from 200 routers. The collector is experiencing high CPU usage and is falling behind in processing data, causing some telemetry data to be dropped. The engineer decides to offload processing to multiple collectors. The routers support dial-out mode and can be configured with a list of collector IPs. The engineer wants to distribute the load evenly across collectors without manual configuration per router. Which should the engineer implement?

Accepted Answer

Use a load balancer in front of the collectors and configure all routers to send to the load balancer VIP.. Option A is correct because a load balancer distributes incoming gRPC streams from all 200 routers across multiple collectors based on a configured algorithm (e.g., round-robin or least connections), achieving even load distribution without per-router configuration. The routers simply send telemetry to a single virtual IP (VIP), and the load balancer forwards each stream to an available collector, preventing any single collector from being overwhelmed. This matches the requirement to offload processing and avoid manual configuration per router.

Answer

Use a multicast address for telemetry subscription so all collectors receive all data.

Answer

Configure each router with a round-robin DNS name that resolves to multiple collector IPs.

Answer

Divide the routers into groups and assign each group to a different collector IP via the router configuration.

Question 3

A network engineer at a service provider is using Cisco NSO to automate the provisioning of VLANs on thousands of access devices. The engineer creates a service using a custom YANG model and deploys it to a set of devices. However, the deployment fails with a 'failed to reach devices' error for some devices, while others succeed. The engineer checks device connectivity and confirms all devices are reachable via SSH and NETCONF. The engineer also verifies that the NSO device list is accurate and includes all target devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in sync with NSO.. When NSO deploys a service, it first checks whether the target devices are in sync with the NSO CDB (configuration database). If a device is out of sync (e.g., its running configuration differs from what NSO expects), NSO will refuse to push the new service configuration and will report a 'failed to reach devices' error, even though the device is reachable via SSH/NETCONF. This is a safety mechanism to prevent configuration conflicts or overwriting unmanaged changes.

Answer

The service model uses an unsupported feature on those devices.

Answer

The devices have insufficient memory to accept the configuration.

Answer

The NSO package is not loaded on those devices.

Question 4

A service provider is deploying multicast service for IPTV using PIM-SM with a single RP. During high traffic periods, the RP becomes overloaded. What is the most scalable solution to distribute the load across multiple RPs?

Accepted Answer

Use Anycast-RP. Anycast-RP allows multiple RPs to share the same IP address, enabling load distribution and redundancy. In PIM-SM, sources register with the nearest RP via unicast routing, and receivers join toward the same Anycast-RP address, which is routed to the closest physical RP. This distributes the registration and join processing load across multiple RPs without requiring protocol changes.

Answer

Use Bidirectional PIM

Answer

Increase the RP's memory and CPU

Answer

Use PIM-DM

Question 5

A service provider has recently deployed MPLS L3VPN to provide IP connectivity to multiple enterprise customers. One customer reports that they cannot reach a remote site that is connected to a different PE router. The engineer checks the BGP VPNv4 table on the customer's PE and sees the route for the remote site, but the next-hop is unreachable. The interface between the PE and P routers is up/up, and IGP reachability to the PE's loopback is fine. What is the most likely cause? Consider that the network uses LDP for label distribution and OSPF as the IGP.

Accepted Answer

MPLS LDP is not enabled on the interface connecting to the P router. The correct answer is A. Since the interface between the PE and P routers is up/up and IGP reachability to the PE's loopback is fine, the issue is that MPLS LDP is not enabled on that interface. Without LDP, the PE cannot advertise a label for its loopback to the P router, so the P router cannot push the correct label for packets destined to the remote PE. This makes the BGP VPNv4 next-hop unreachable even though the route itself is present in the table.

Answer

BGP next-hop-self is not configured on the PE

Answer

The VRF route-target import/export is misconfigured

Answer

The PE router does not have an LSP to the remote PE

Question 6

A service provider is migrating from OSPF to IS-IS in the core. During the migration, both protocols are running. Some prefixes are learned via both OSPF and IS-IS. The network uses BGP for external routes and MPLS for VPNs. The engineer notices that BGP routes are pointing to a next-hop that is reachable via OSPF but not via IS-IS, causing traffic to be dropped. What is the best course of action to ensure that during the migration, BGP uses only one IGP protocol?

Accepted Answer

Increase the administrative distance of IS-IS to be higher than OSPF. Option C is correct because increasing the administrative distance of IS-IS to be higher than OSPF (e.g., from 115 to 120) makes OSPF routes preferred over IS-IS routes in the routing table. Since BGP uses the IGP route to resolve its next-hop, this ensures BGP always selects the OSPF path, preventing traffic drops when the next-hop is only reachable via OSPF. This is a simple, protocol-agnostic way to control IGP preference during a migration without altering route redistribution or tunneling.

Answer

Use BGP next-hop tracking to prefer IS-IS routes

Answer

Configure a route-map to selectively distribute routes

Answer

Implement MPLS TE tunnels for BGP next-hops

Question 7

A service provider's network core runs IS-IS as the IGP. After adding a new router, some routers have incomplete LSP databases. The new router's interfaces are up, and IS-IS adjacency is up with neighbors. What is the cause? The network has a mix of interface MTUs, with some links having MTU 1500 and others 4470.

Accepted Answer

MTU mismatch on the interface. The correct answer is A because an MTU mismatch on the interface causes incomplete LSP databases. IS-IS uses a maximum LSP size derived from the interface MTU minus the IS-IS header overhead (typically 3 bytes for the LSP header). When a router with a smaller MTU (e.g., 1500) receives an LSP that was generated on a larger MTU link (e.g., 4470), the LSP may be too large to be stored or processed, leading to fragmentation or rejection. This results in an incomplete LSP database on some routers, even though adjacencies are up.

Answer

IS-IS overload bit set on the new router

Answer

IS-IS LSP flooding is inhibited on the new router

Answer

The new router's system-id is a duplicate

Question 8

A service provider is deploying IGMPv3 snooping on an MVPN network to optimize multicast forwarding. After configuration, multicast traffic is not reaching receivers. The source is sending to group 239.1.1.1. The PE router has received the IGMP report from the receiver, and the MDT is established. What is the most likely reason?

Accepted Answer

The source-specific multicast (SSM) range is applied but the receiver sent a (*,G) report. Option C is correct because IGMPv3 snooping on the PE router processes the receiver's IGMPv3 report. If the SSM range (232.0.0.0/8) is applied to group 239.1.1.1, the receiver must send an IGMPv3 (S,G) report to join a specific source. However, if the receiver sends a (*,G) report (which is allowed only in ASM mode), the IGMP snooping will not install the forwarding entry, causing multicast traffic to be dropped even though the MDT is established.

Answer

The RP for the group is not configured

Answer

The IGMP snooping is filtering the multicast traffic because of wrong VLAN configuration

Answer

The multicast routing is not enabled globally

Question 9

A service provider is deploying QoS on a Cisco ASR 9000 router to support a triple-play service (voice, video, data) over an Ethernet access network. The network engineer must ensure that voice traffic (EF) is prioritized, video traffic (AF41) is treated with low loss, and data traffic (default) gets best-effort service. Additionally, the engineer must implement a hierarchical QoS policy to shape the aggregate subscriber traffic to 100 Mbps on a GigabitEthernet interface, with the following per-class bandwidth allocations: voice 10 Mbps, video 40 Mbps, and data 50 Mbps. During testing, voice packets are being dropped under congestion, and video traffic is experiencing jitter. The current QoS configuration is as follows:

policy-map CHILD
 class VOICE
  priority level 1
  police rate 10 mbps
 class VIDEO
  bandwidth remaining ratio 40
 class DATA
  bandwidth remaining ratio 50
!
policy-map PARENT
 class class-default
  shape average 100 mbps
  service-policy CHILD
!

Which action should the engineer take to resolve the issues while maintaining the design objectives?

Accepted Answer

Remove the police from the voice class and add 'priority level 1' without police; this ensures voice is priority queued without dropping.. Option B is correct because the current configuration uses a police rate of 10 Mbps under the voice priority class, which causes voice packets to be dropped when they exceed that rate, even though priority queuing should guarantee low latency. Removing the police and keeping 'priority level 1' allows voice traffic to be strictly prioritized without a hard rate limit, ensuring no drops for voice while still allowing the parent shaper to enforce the aggregate 100 Mbps. This resolves the voice drops and, by preventing voice from being policed, reduces jitter for video traffic that might otherwise be affected by bursty voice drops.

Answer

Change the video class to 'priority level 2' to give it preferential treatment over data.

Answer

Add a 'police' to the video class with a CIR of 40 Mbps and 'conform-action transmit exceed-action drop' to protect voice.

Answer

Change the voice class to use 'bandwidth remaining percent 10' and remove the police.

Question 10

A service provider has a network with multiple PE routers providing MPLS L3VPN services. Customers are complaining that some remote sites are unreachable after a recent software upgrade on PE1. Upon investigation, you notice that PE1 is receiving BGP VPNv4 routes from the route reflector, but some routes are not being installed in the VRF routing table. PE1 is configured with BGP additional-path capability and has a route policy that selects only the best path. The VRF on PE1 has import and export route targets configured correctly. The missing routes have a higher local preference but are not selected due to a tie-break in BGP path selection. Which action should be taken to ensure that all valid routes are installed in the VRF?

Accepted Answer

Configure BGP additional-paths for the VRF and adjust the route policy to allow multiple paths.. B is correct because the issue is that PE1 is configured with BGP additional-path capability but has a route policy that selects only the best path. When BGP path selection ties on local preference and other attributes, additional-path send/receive capability allows multiple paths to be considered, but the route policy must be adjusted to permit multiple paths into the VRF. Without this, only the single best path is installed, even if valid alternative paths exist.

Answer

Reset the BGP session between PE1 and the route reflector.

Answer

Disable route target filtering on PE1 to import all routes.

Answer

Increase the local preference on the route reflector for the missing routes.

Question 11

You are a network engineer at a service provider. Your network uses MPLS L3VPN with OSPF as the IGP and LDP for label distribution. A customer has two sites connected to different PEs (PE1 and PE2) in the same VPN. The customer's CE routers are running eBGP with the PEs. Recently, the customer reports that traffic between the two sites is intermittently dropping. Upon investigation, you find that the BGP session between PE1 and the CE at site A goes down briefly every few minutes. The logs on PE1 show BGP notifications with error code 'Hold Timer Expired'. The CE router at site A is a low-end device with limited CPU. What is the most likely cause and the best course of action?

Accepted Answer

Increase the BGP hold time on PE1 to 180 seconds.. The BGP session drops due to 'Hold Timer Expired' because the low-end CE router's CPU is overloaded, causing it to fail sending BGP keepalives within the default 90-second hold time. Increasing the hold time on PE1 to 180 seconds (option D) gives the CE more time to send keepalives, reducing false timeouts. This directly addresses the root cause—insufficient CPU to maintain timely keepalives—without changing routing protocols or suppressing routes.

Answer

Configure BGP route dampening on PE1 to suppress flapping routes.

Answer

Disable LDP on the link between PE1 and CE1.

Answer

Change the IGP from OSPF to IS-IS to reduce routing updates.

Question 12

A service provider is deploying a point-to-point Layer 2 VPN across an MPLS network using Ethernet over MPLS (EoMPLS) with Martini encapsulation. The customer requires transparent transport of VLAN tags (Q-in-Q) between two sites. The provider configures the attachment circuits on the PE routers as VLAN subinterfaces with dot1q encapsulation. After configuration, the customer reports that only untagged frames pass through the pseudowire; double-tagged frames are dropped at the egress PE. Which action resolves the issue?

Accepted Answer

Change the encapsulation on the PE subinterfaces to dot1q second-dot1q and enable the preservation of the outer VLAN tag at the ingress PE. Option D is correct because EoMPLS with Martini encapsulation (RFC 4448) supports Q-in-Q transparent transport only when the ingress PE is configured to preserve the outer VLAN tag. Using 'dot1q second-dot1q' encapsulation on the subinterface tells the PE to treat the outer tag as part of the payload and not strip it, allowing both tags to be carried across the pseudowire. Without this, the default dot1q encapsulation strips the outer tag, causing double-tagged frames to be dropped at the egress PE.

Answer

Replace the attachment circuit with a port-mode Layer 2 interface and disable VLAN tagging on the PE

Answer

Configure the pseudowire to use the 'tag-imposition' keyword to allow double tagging

Answer

Configure the PE routers to use VLAN translation to map both tags to a single tag before encapsulation

Question 13

A service provider has deployed a new MPLS L3VPN service for a customer with multiple sites. The customer reports intermittent voice quality issues during peak hours. The provider uses a DiffServ QoS model with MPLS EXP markings. The PE routers apply the following policy on the customer-facing interfaces:

policy-map CUSTOMER-OUT
 class VOICE
  priority percent 10
  set mpls experimental topmost 5
 class VIDEO
  bandwidth remaining percent 30
  set mpls experimental topmost 4
 class DATA
  bandwidth remaining percent 70
  set mpls experimental topmost 0

The core network has a simple policy that maps EXP 5 to PQ, EXP 4 to a low-latency queue, and EXP 0 to best effort. The provider monitors the network and finds that the PE-CE interfaces are not congested (average utilization is 40%), but the voice packets are experiencing jitter. The customer's voice traffic is about 5% of the link capacity. Which action is most likely to reduce the jitter?

Accepted Answer

Add a police command under the VOICE class to limit voice traffic to 5% and shape the priority queue.. The voice traffic is only 5% of link capacity, but the priority percent 10 command allows up to 10% of the link to be treated as priority. During peak hours, if other traffic (e.g., video or data) bursts and exceeds the remaining bandwidth, the priority queue can still be policed implicitly by the scheduler, but jitter arises because the priority queue is not rate-limited. Adding a police command under the VOICE class to limit voice to 5% and shaping the priority queue ensures that voice traffic does not exceed its actual rate, preventing microbursts that cause jitter in the priority queue.

Answer

Configure the core routers to map EXP 5 to a low latency queue instead of PQ.

Answer

Increase the priority percent to 20 for voice traffic.

Answer

Change the set mpls experimental topmost to set ip dscp ef for voice.

Question 14

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

Accepted Answer

The route-target on the new PEs does not match the existing VPLS context. B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Answer

The BGP neighbor is not activated under the VPLS address-family

Answer

The MTU mismatch between PEs

Answer

The VFI name is not consistent across PEs

Question 15

You are responsible for network assurance for a Tier-1 ISP that has deployed model-driven telemetry using gNMI with ON_CHANGE subscriptions on all core routers. Recently, the NMS team reported that some BGP route flaps are not being captured in the telemetry data, even though the routers' syslogs show the flaps occurred. The telemetry subscription is for the path '/bgp/neighbors/neighbor/state/messages/received'. The NMS is using a gNMI collector that supports both ON_CHANGE and SAMPLE subscriptions. You suspect the issue is with the subscription configuration. Upon reviewing the router configuration, you see that the telemetry subscription uses the SAMPLE mode instead of ON_CHANGE. What is the most appropriate action to ensure all BGP route flap events are captured?

Accepted Answer

Modify the subscription to use ON_CHANGE mode for the BGP neighbor paths.. Option D is correct because the gNMI ON_CHANGE subscription mode is designed to stream telemetry updates only when the value of a subscribed path changes. Since the NMS is missing BGP flap events, the subscription must be using SAMPLE mode, which periodically polls the state and can miss transient events between sampling intervals. Changing the subscription to ON_CHANGE ensures that every state transition (e.g., BGP session up/down) is immediately pushed to the collector, capturing all flaps.

Answer

Configure the router to send syslogs to the NMS and parse them for BGP flaps.

Answer

Add a second subscription with ON_CHANGE for the same paths to ensure redundancy.

Answer

Change the subscription to SAMPLE with a 1-second interval to capture flaps more frequently.