350-501 Practice Test 36 — 15 Questions

Question 1

You are a network architect for a large service provider. The network consists of multiple core routers (P routers) and edge routers (PE routers) supporting both L3VPN and L2VPN services. The network currently uses LDP for label distribution and has a flat IGP (OSPF) design. Recently, there have been scalability issues: the IGP convergence time has increased significantly, and the OSPF link-state database (LSDB) has grown large, causing high CPU utilization on core routers. Additionally, the LDP sessions are taking longer to establish after a router reboot. You are tasked with redesigning the network to improve scalability and convergence. The budget allows for significant changes but cannot replace all hardware. Which approach best addresses the scalability issues while minimizing disruption?

Accepted Answer

Implement Segment Routing (SR-MPLS) to replace LDP and reduce IGP overhead. Segment Routing (SR-MPLS) eliminates the need for LDP by encoding MPLS labels directly in the IGP (OSPF or IS-IS) using extensions, which reduces control-plane overhead and speeds up convergence. This directly addresses the large OSPF LSDB and slow LDP session establishment because SR-MPLS does not require a separate label distribution protocol and can leverage a single IGP for both routing and label information, improving scalability without hardware replacement.

Answer

Upgrade OSPF to OSPFv3 to support IPv6 and improve performance

Answer

Introduce IS-IS as a second IGP to offload traffic from OSPF, and use route redistribution between the two protocols

Answer

Replace OSPF with BGP as the core IGP to reduce link-state overhead

Question 2

You are a network automation engineer for a large service provider. Your team is tasked with automating the provisioning of new MPLS L3VPN services across a multi-vendor environment (Cisco and Juniper). The automation framework uses Ansible with Jinja2 templates and NETCONF as the transport protocol. During a pilot deployment, the automation successfully configures the Cisco devices but fails on Juniper devices with a 'syntax error' when applying the generated XML configuration. The Jinja2 templates are designed to generate Cisco-style configuration. You need to modify the automation to support both vendors. Which approach is most effective?

Accepted Answer

Use IETF YANG models and create separate Jinja2 templates for Cisco and Juniper that map to their respective native YANG models.. Option A is correct because using IETF YANG models (e.g., RFC 8299 for L3VPN) provides a vendor-neutral data model that both Cisco and Juniper support via NETCONF. Creating separate Jinja2 templates for each vendor ensures the generated XML conforms to each device's native YANG models, avoiding syntax errors. This approach maintains automation consistency while respecting vendor-specific implementations.

Answer

Write a Python script that translates Cisco XML to Juniper XML before sending.

Answer

Switch to CLI-based automation using SSH to avoid XML syntax issues.

Answer

Create a single Jinja2 template that uses conditional statements to generate different XML for each vendor.

Question 3

A service provider has a network with PE1, P1, P2, and PE2 connected in a chain: PE1-P1-P2-PE2. The IGP is IS-IS with wide metrics, and MPLS LDP is enabled on all interfaces. The goal is to provide L3VPN services between PE1 and PE2. The engineer has configured MP-iBGP between PE1 and PE2, and the VPNv4 routes are exchanged. However, when a CE router behind PE1 tries to reach the CE behind PE2, the traffic fails. The engineer checks the MPLS forwarding table on PE1 and sees that the label for the BGP next-hop (PE2's loopback) is 'Untagged'. The BGP next-hop is reachable via ICMP. What is the most likely cause of this issue?

Accepted Answer

LDP is not enabled on the interface between PE1 and P1.. The MPLS forwarding table on PE1 shows the label for PE2's loopback as 'Untagged', which indicates that LDP has not assigned a label for that prefix on the incoming interface. Since LDP is responsible for distributing labels for IGP routes (like loopbacks) in an MPLS LDP-enabled network, the missing label means LDP is not operational on the link between PE1 and P1. Without a label, PE1 cannot push an MPLS label for the BGP next-hop, causing the VPNv4 traffic to be dropped or forwarded as IP, which fails because the core routers (P1, P2) do not have the VPN route.

Answer

The IS-IS metric between PE1 and P1 is too high, causing suboptimal routing.

Answer

The MPLS TTL propagation is disabled, causing packets to be dropped.

Answer

The MTU on the link between PE1 and P1 is set to 1500, causing fragmentation.

Question 4

A network operator is migrating from traditional MPLS LDP to Segment Routing (SR) with IS-IS. The network consists of four routers (R1-R4) in a square topology. The engineer has enabled SR on all routers and configured prefix-SIDs for loopbacks. However, when checking the MPLS forwarding table on R1, the engineer sees that some prefixes have label values that are not the prefix-SIDs. For example, the prefix for R4's loopback shows label 16004 instead of the expected 16004 (which is correct). But for another prefix, the label is 16003 instead of 16003 (correct). The engineer does not see any labels for some external routes. What is the most likely reason that some labels are missing?

Accepted Answer

External routes are not covered by prefix-SIDs; they require LDP or another label distribution mechanism.. Option D is correct because Segment Routing (SR) with IS-IS only assigns prefix-SIDs to prefixes that are part of the IS-IS domain and explicitly configured with a SID. External routes, such as those redistributed from another protocol (e.g., BGP or OSPF), are not covered by prefix-SIDs and require a separate label distribution mechanism like LDP or a manually configured explicit-null label to be forwarded with MPLS encapsulation. The engineer's observation that some labels are missing for external routes directly points to this limitation.

Answer

The IS-IS wide metrics are not enabled on all interfaces.

Answer

Route redistribution from another protocol is not configured.

Answer

The prefix-SIDs are inconsistent across routers.

Question 5

A service provider has deployed Segment Routing (SR-MPLS) with OSPF as the IGP. They enabled TI-LFA for link protection. During a maintenance window, they shut down a core link between two P routers. Expected behavior is that TI-LFA should provide sub-50ms failover. However, after the shutdown, traffic loss exceeds 10 seconds. Analysis shows that the backup path uses a segment list that includes a node SID from a router that is currently unreachable due to the same failure. The TI-LFA backup path calculation appears to have included a node that is dependent on the failed link. What design issue is most likely causing this?

Accepted Answer

Configure the backup path to use adjacency SIDs instead of node SIDs. TI-LFA calculates backup paths using the post-convergence topology. If the backup path includes a node that is only reachable through the failed link, it means the TI-LFA calculation did not properly exclude nodes that are dependent on the failure. This can happen if the IGP metric on the backup path is not properly set, or if the router does not consider remote node failures correctly. The correct action is to ensure that the IGP metric on the backup path is lower than the direct path, or to implement MICRO-LOOP avoidance. Alternatively, the TI-LFA may need to use adjacency SIDs instead of node SIDs for the backup path.

Answer

Increase the prefix-SID index on all routers to avoid conflicts

Answer

Reduce the IGP metric on the backup links to ensure they are perceived as shorter paths

Answer

Disable TI-LFA and rely on LFA

Question 6

A service provider is troubleshooting an MPLS L3VPN scenario where a customer in VRF Blue cannot reach a server in VRF Blue at a remote site. The PEs are running MPLS with LDP. The VRF on both PEs shows the remote prefix. The PE at the local site shows the label from the remote PE for the prefix in the BGP table. However, when pinging from the CE, the packets are dropped. A packet capture on the core shows MPLS packets with the correct VPN label, but the transport label is missing. Further investigation shows that the LDP session between the two PEs is up, but the LDP label binding for the remote PE's loopback is not present. What is the most likely cause and correct action?

Accepted Answer

Check MPLS LDP interface configuration and enable LDP on all core interfaces. The LDP session is up, but the label binding for the remote loopback is missing. This could be because LDP is not enabled on the underlying interfaces between the PEs, or because the label space is configured incorrectly. Typically, if LDP is enabled on all core interfaces, label bindings for loopbacks are automatically exchanged. The missing binding suggests that either LDP is not configured on some interfaces, or an access-list is blocking LDP. The most direct action is to verify that LDP is enabled on all core interfaces using the command 'show mpls ldp interface'.

Answer

Increase the TTL on the MPLS packets

Answer

Change the transport address in LDP to the loopback IP

Answer

Configure the remote PE's loopback to be advertised via BGP

Question 7

A large service provider runs a dual-stack MPLS core with Segment Routing (SR-MPLS) and IS-IS as the IGP. The network has been operating stably for months. Recently, a new PE router (PE-5) was added and configured with IS-IS and SR. After the addition, some remote prefixes in the VRF on other PEs become unreachable. Troubleshooting reveals that the BGP next hop for those prefixes is the loopback of another PE (PE-3), but the MPLS forwarding table on PE-3 shows no label for the prefix. The IS-IS database on PE-3 shows the prefix-SID for PE-5's loopback, but the forwarding table does not have a label for that prefix. Commands like 'show mpls forwarding-table' show no entry for PE-5's loopback. What is the most likely cause and correct action?

Accepted Answer

Check and adjust the SRGB configuration on PE-5 to match the range used by other routers. The issue is that PE-3 does not have a label for PE-5's loopback because the prefix-SID for PE-5 is not programmed in the LFIB. This commonly happens when the SRGB (Segment Routing Global Block) on PE-5 does not overlap with PE-3's SRGB, or when the label index is not configured correctly. Since the IS-IS database shows the prefix-SID, the IGP is advertising it, but the label may be out of range. The correct action is to check and align the SRGB configuration on all routers. Option B (clear IS-IS adjacency) is a generic reset that might not fix the underlying mismatch. Option C (enable MPLS on the interface) is already done if LDP was used, but SR uses IGP, not LDP. Option D (redistribute into BGP) is not relevant.

Answer

Clear the IS-IS adjacency between PE-3 and PE-5

Answer

Enable MPLS on the interface connecting to PE-5

Answer

Configure BGP to redistribute IS-IS routes into BGP

Question 8

A service provider offers Carrier Ethernet services using MPLS-TP in the access and aggregation layers. The network uses MPLS-TP tunnels with static LSPs and protection via 1:1 linear protection with APS. One customer reports intermittent connectivity issues on their E-LINE service. The operations team observes that the protection switchover is occurring frequently due to apparent signal failures on the working path. However, the physical layer shows no errors. The protection switching is configured with revertive mode. The working LSP has an RDI (Remote Defect Indication) configured. Upon further investigation, the team finds that the working LSP's OAM continuity check messages (CCMs) are being lost occasionally, triggering a protection switch. What is the most likely misconfiguration?

Accepted Answer

The CCM interval is too short, causing frequent false failures due to transient congestion.. A short CCM interval makes the system sensitive to minor delays, causing false failures and frequent protection switches. A longer interval would reduce sensitivity but increase detection time. Priority and OAM rate differences are not typical causes.

Answer

The CCM interval is too long, causing delayed detection.

Answer

The working path uses a higher MPLS-TP OAM rate than the protection path.

Answer

The protection path has a lower priority than the working path.

Question 9

A service provider is migrating from a legacy MPLS network using LDP to Segment Routing (SR-MPLS). They have enabled SR on all routers and are using IS-IS. The migration plan is to keep LDP running alongside SR during the transition. After enabling SR, some traffic is being forwarded using the SR path, but the network operator notices that some CEs in an L2VPN are experiencing packet loss during failover scenarios. Troubleshooting shows that the primary pseudowire is using SR labels, but the backup pseudowire is still using LDP labels. The backup path is not working correctly. What is the most likely cause?

Accepted Answer

The backup pseudowire is still using LDP labels and the LDP session for the backup path is down. During coexistence of LDP and SR, there might be a mismatch in label switching. The backup pseudowire might be using LDP labels that are not consistent with the SR forwarding plane. The most likely cause is that the backup path is not properly programmed to use SR labels, or the LDP session for the backup path is down. The correct action is to ensure that the pseudowire's backup signaling is using the same transport mechanisms as the primary, or to disable LDP gradually.

Answer

The backup path uses a different IGP metric

Answer

The MTU on the backup path is smaller than on the primary

Answer

The prefix-SID for the remote PE is missing in the SR-TE database

Question 10

A network engineer is configuring an MPLS L3VPN on a PE router. The VRF is configured with route-target import/export. The PE and CE are running eBGP. The CE advertises routes to the PE, and the PE installs them in the VRF routing table. However, the remote PE does not receive these routes via BGP VPNv4. The local PE's BGP table shows the VPNv4 prefixes with the correct next hop and label. The remote PE's BGP table shows no such prefixes. The IGP between the PEs is working, and MPLS LSPs are up. What is the most likely cause and correct action?

Accepted Answer

Check the route-target import/export configuration on both PEs and ensure they match. Despite the local PE having the routes in BGP VPNv4, the remote PE does not receive them. This often indicates that the route-target export on the local PE does not match the route-target import on the remote PE, or that the VPNv4 session is not correctly configured. Since the local PE shows the prefixes in its BGP VPNv4 table, they are being advertised to the BGP peer, but the remote PE's import policy filters them due to mismatched RT. The correct action is to verify the route-target configuration on both PEs.

Answer

Enable the 'soft-reconfiguration inbound' command

Answer

Reset the BGP session between the PEs

Answer

Check the MTU on the link between the PEs

Question 11

A service provider is migrating their MPLS core network to Segment Routing (SR-MPLS). All existing core routers run IOS-XR and are configured with an SRGB of 16000-23999 and OSPF as the IGP. A new router (R5) is added as a PE. The engineer configures R5 with the same SRGB and enables segment-routing under OSPF. However, when configuring an SR-TE policy from R5 to the remote loopback 10.0.0.1 on R1, the policy remains down. Show commands reveal that R5 is not learning the prefix-SID for 10.0.0.1. On R1, the prefix-SID is configured with index 100. The engineer verifies that OSPF adjacencies are up and that R5 can ping 10.0.0.1. What is the most likely cause of the issue?

Accepted Answer

The OSPF process on R5 is not configured with segment-routing mpls.. Option B is correct because without 'segment-routing mpls' under the OSPF process, R5 cannot participate in Segment Routing, meaning it does not advertise its own prefix-SIDs nor learn the prefix-SIDs of other routers. This prevents the SR-TE policy from obtaining the necessary label bindings. Option A is incorrect because index 100 maps to label 16100 (16000+100), which is within the SRGB range. Option C is incorrect because while color is a key attribute in SR-TE policies, the policy can still be defined with a segment-list; however, the primary issue here is the lack of prefix-SID learning. Option D is incorrect because the SRGB is consistent across all routers.

Answer

The SR-TE policy on R5 is missing the color attribute.

Answer

R1 is not configured with the same SRGB as R5.

Answer

The prefix-SID index 100 is not within the SRGB range of R5 (16000-23999).

Question 12

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

Accepted Answer

Add the 'sr-protect' option under the fast-reroute configuration to enable node protection. Option B is correct because for TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence. Option D is wrong because there is no need for an additional LDP backup.

Answer

Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

Answer

Reduce the IGP timers and enable incremental SPF to accelerate convergence

Answer

Deploy LDP as a fallback label distribution protocol to provide additional backup paths

Question 13

A large service provider operates an MPLS L3VPN network with multiple Route Reflectors (RRs) in the core. The network uses BGP as the control plane for both IPv4 unicast and VPNv4 routes. Recently, one of the RRs started flapping, causing route withdrawals to many clients. The network architect wants to improve stability. The RRs are fully meshed with each other and clients are configured as route-reflector clients. The RRs have both IPv4 and VPNv4 address families enabled. Which action should be taken to minimize the impact of an RR failure?

Accepted Answer

Configure client-to-client reflection on the RRs and ensure that each PE is a client of at least two RRs.. Configuring client-to-client reflection on the RRs and ensuring each PE is a client of at least two RRs provides redundancy; if one RR fails, routes are still available via the other RR. BGP PIC helps fast failover but does not prevent route withdrawal impact; add-paths increases paths but not redundancy; same cluster ID reduces redundancy.

Answer

Configure BGP prefix-independent convergence (PIC) on all PE routers.

Answer

Implement BGP add-paths capability on RRs to advertise multiple paths to clients.

Answer

Deploy redundant RRs with the same cluster ID and use the 'bgp cluster-id' command to ensure clients only accept routes from one RR at a time.

Question 14

A service provider offers L3VPN services to multiple enterprise customers. One customer reports that they cannot reach some remote sites intermittently. The network uses MPLS L3VPN with MP-BGP for VPN route exchange. The PE routers are configured with route-target import and export. The customer's CE router is dual-homed to two different PEs in the same point of presence. The engineer checks the BGP table on both PEs and sees the customer routes with the correct route-target. However, pings from the CE to a remote site fail about 50% of the time, and the flapping pattern suggests load balancing issues. The engineer discovers that the remote site's network prefix is being advertised from both PEs with the same route-target but with different next-hops. The CE has equal-cost paths via both PEs. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The CE is performing per-packet load balancing across the two PEs, causing asymmetric routing.. Option C is correct because when a CE receives two equal-cost paths from two PEs, the CE may perform per-packet load balancing, which can cause out-of-order packets and asymmetric routing, leading to failures. Option A is wrong because BGP timers would cause immediate session drops, not 50% failure. Option B is wrong because MTU mismatch would cause consistent failures, not intermittent. Option D is wrong because route-target mismatch would prevent routes from being learned, not cause intermittent connectivity.

Answer

The route-target import on the remote PE is missing the customer's route-target.

Answer

The BGP timers are misconfigured, causing the session to flap.

Answer

The MTU on the CE-PE links is mismatched.

Question 15

A small service provider is deploying MPLS in its core network for the first time. They have a simple topology: three P routers in the core and two PE routers connecting customers. They have configured LDP on all interfaces and OSPF as the IGP. They also configured a basic L3VPN for a customer with a single CE attached to each PE. The customer reports that they can ping between CEs for a few minutes, but then the connectivity drops. After a few seconds, it returns. This pattern repeats every few minutes. The engineer checks the LDP neighbors and sees that all LDP sessions are up. The OSPF adjacencies are stable. The engineer also notices that the pings time out exactly when the LDP graceful restart timer is expiring on one of the P routers. What is the most likely cause?

Accepted Answer

The BGP session between the PEs is flapping due to a hold timer mismatch or connectivity issue.. Option D is correct because if the BGP session between PEs is going down (e.g., due to a hold timer issue or misconfiguration), the VPN routes would be withdrawn and re-advertised, causing intermittent connectivity. Option A is wrong because LDP graceful restart timer is for LDP session recovery, but LDP sessions are up. Option B is wrong because OSPF network type does not cause periodic drops. Option C is wrong because interface flaps would cause more permanent outages.

Answer

The LDP graceful restart timer is causing periodic re-establishment of LDP sessions.

Answer

The OSPF network type on the core links is set to point-to-point, causing SPF recalculation every 5 minutes.

Answer

One of the core interfaces is flapping due to a hardware issue, triggering IGP and LDP convergence.