350-501 Practice Test 37 — 15 Questions

Question 1

Which TWO actions are required to implement QoS trust boundaries correctly in a service provider network?

Accepted Answer

Configure classification at the edge. Classification must be performed at the network edge to establish the trust boundary and enforce QoS policies. Option D is correct because setting trust to CoS on access ports allows the switch to accept the priority markings from trusted devices like IP phones or routers, which is essential for maintaining the trust boundary. Option B is incorrect because Auto QoS is not a mandatory requirement for trust boundaries; it is an optional feature that automates QoS configuration. Option C is incorrect because shaping is applied at customer premises and is not directly related to trust boundary implementation. Option E is incorrect because MPLS EXP bits are used for core marking, not for configuring trust boundaries at the access layer.

Answer

Enable auto QoS on all interfaces

Answer

Apply shaping at customer premises

Answer

Use MPLS EXP bits for core marking

Question 2

A service provider is experiencing congestion on a core link connecting two P routers. The customer traffic is classified into three classes: voice (low latency), video (low loss), and data (best effort). The current configuration uses DSCP-based classification at the PE ingress, but many customers are remarking DSCP values to gain better service, bypassing the provider's QoS policy. The provider wants to enforce a strict trust boundary at the PE and re-mark all traffic according to a per-customer contract. Additionally, the provider must offer per-customer bandwidth guarantees, ensuring that one customer's traffic does not starve another customer's traffic on the congested core link. The solution must be scalable to hundreds of customers. What should the designer recommend?

Accepted Answer

Implement hierarchical QoS on the PE egress to customer-facing interfaces, with parent-level shaping per customer and child-level policing per class, and set a trust boundary to mark all traffic based on the customer contract at ingress.. Hierarchical QoS allows per-customer shaping at the parent level to enforce per-customer bandwidth limits, and per-class policing at the child level to enforce per-class contracts. This provides the required trust boundary and per-customer guarantees. Option A is wrong because a flat policy on core interfaces does not allow per-customer differentiation and cannot enforce per-customer guarantees. Option B is wrong because auto-qos does not provide per-customer granularity and relies on trust which is already broken. Option D is wrong because MPLS TE tunnels reserve bandwidth but do not solve the trust boundary issue; also resetting EXP is complex.

Answer

Apply a flat QoS policy on the core interfaces that polices each DSCP value to a fixed rate; trust is not needed because the core enforces its own limits.

Answer

Use auto-qos on all PE interfaces and rely on CoS trust; the core uses MPLS EXP derived from CoS to ensure proper queuing.

Answer

Configure MPLS Traffic Engineering tunnels on the core with bandwidth reservation per customer class; use EXP-null to preserve markings end-to-end.

Question 3

Which THREE steps are required when configuring MPLS L3VPN on a PE router? (Choose three.)

Accepted Answer

Create a VRF definition. Creating a VRF definition on the PE router is required to separate customer routing tables and forwarding instances in an MPLS L3VPN. The VRF provides the logical isolation needed to keep each customer's routes and traffic distinct, and it is the foundation for associating interfaces, route targets, and VRF-specific routing processes.

Answer

Configure BGP on the CE router to advertise routes to PE

Answer

Configure route-target import/export using route-map

Question 4

What is the main difference between traffic shaping and traffic policing?

Accepted Answer

Shaping buffers excess traffic; policing drops or re-marks. Traffic shaping buffers excess traffic that exceeds the configured rate, smoothing bursts and delaying packets to conform to the desired rate. Traffic policing, on the other hand, immediately drops or re-marks packets that exceed the rate limit, without buffering. This fundamental difference in handling excess traffic—buffering versus dropping/re-marking—is the key distinction between the two QoS mechanisms.

Answer

Shaping is only for ingress; policing for egress

Answer

Shaping drops excess traffic; policing buffers it

Answer

Both perform the same function

Question 5

In an MPLS network, a PE router receives a VPNv4 route from a route reflector. The route is not being installed in the VRF table. Which condition could cause this?

Accepted Answer

The route target does not match the VRF import map.. A VPNv4 route is installed into a VRF table only if its Route Target (RT) matches an import statement in the VRF's route-target import list or import map. If the RT does not match, the PE router will not import the route into the VRF, even though the route is valid in the BGP VPNv4 table. This is the most common cause for a VPNv4 route being present in BGP but missing from the VRF.

Answer

The MPLS label is missing.

Answer

The route distinguisher is incorrect.

Answer

The next-hop is unreachable.

Question 6

Which TWO statements about YANG data models are true? (Choose two.)

Accepted Answer

YANG models are used to model data for NETCONF and RESTCONF.. YANG (RFC 6020/7950) is a data modeling language specifically designed to model configuration and state data for network management protocols like NETCONF and RESTCONF. YANG defines the structure, constraints, and semantics of data that can be exchanged via these protocols, making it the standard for model-driven network automation.

Answer

YANG models can be directly converted to SNMP MIBs.

Answer

YANG models define only configuration data, not state data.

Answer

YANG models define CLI commands.

Question 7

An engineer is designing an MPLS L3VPN for a customer with multiple sites. The customer requires overlapping IP addresses between sites. Which method allows the provider to support overlapping customer addresses?

Accepted Answer

Use separate VRF per site with route distinguisher.. B is correct because a separate VRF per site with a unique route distinguisher (RD) allows the provider to maintain isolated routing tables for each customer site. This isolation enables overlapping IP addresses between sites, as each VRF treats its prefixes as unique within the MPLS L3VPN backbone, regardless of address duplication.

Answer

Implement VPLS instead of L3VPN.

Answer

Use BGP communities to control route distribution.

Answer

Use the same VRF for all sites with different route targets.

Question 8

An SP network operator needs to ensure that voice traffic always gets priority access to the output link. Which queuing mechanism is designed to provide a strict priority queue while preventing starvation of other queues?

Accepted Answer

LLQ. LLQ provides a strict priority queue for EF traffic and includes a policer to limit the priority traffic rate, preventing starvation of other queues.

Answer

CBWFQ

Answer

FIFO

Answer

WRED

Question 9

When implementing RPKI for BGP origin validation, which three states can a route be marked as? (Choose three.)

Accepted Answer

Invalid. RPKI validation results in three states: valid (matches a ROA), invalid (conflicts with a ROA), and not-found (no ROA exists). These states are used to influence BGP decision.

Answer

Trusted

Answer

Unknown

Question 10

Which THREE YANG data nodes are part of the Cisco-IOS-XR-qos-ma-cfg module for defining a QoS policy-map? (Choose three.)

Accepted Answer

class. The 'class' YANG data node is defined in the Cisco-IOS-XR-qos-ma-cfg module to specify a traffic class within a QoS policy-map. This node allows you to associate a class-map with the policy, enabling differentiated treatment of traffic based on classification criteria.

Answer

urn:cisco:params:xml:ns:yang:Cisco-IOS-XR-qos-ma-cfg

Answer

interface

Question 11

Which OSPF neighbor state indicates that a router has received a hello packet from a neighbor but the neighbor's Router ID is not yet seen in its own hello packet?

Accepted Answer

Init. The Init state is the first step in OSPF neighbor formation after the Down state. A router enters Init when it receives a Hello packet from a neighbor but does not yet see its own Router ID in the neighbor's Hello packet, indicating that bidirectional communication is not yet confirmed.

Answer

Down

Answer

Two-way

Answer

ExStart

Question 12

A service provider wants to deploy DDoS mitigation using BGP FlowSpec. Which two actions can FlowSpec rules specify? (Choose two.)

Accepted Answer

Redirect to a nexthop. FlowSpec actions include 'traffic-rate' (rate-limit), 'traffic-action' (drop), 'redirect', etc. The correct actions among the options are rate-limiting and dropping.

Answer

Advertise a static route

Answer

Log traffic

Answer

Set BGP community

Question 13

Which THREE of the following are characteristics of Segment Routing (SR-MPLS) compared to traditional MPLS with LDP?

Accepted Answer

The IGP (IS-IS or OSPF) is used to advertise prefix SIDs.. In Segment Routing (SR-MPLS), the IGP (IS-IS or OSPF) is extended to advertise prefix Segment Identifiers (SIDs), which are used to build MPLS labels directly from the IGP database. This eliminates the need for a separate label distribution protocol like LDP, as the IGP itself carries the label information within its link-state advertisements.

Answer

It can only be used for transit, not for egress routers.

Answer

Labels are distributed via multicast to all routers.

Question 14

A company is connecting two sites using MPLS L3VPN. The PE routers are running both LDP and Segment Routing (SR-MPLS) in the core. The CE router at Site A cannot reach the CE at Site B. On the PEs, the VRF routes are present. Which command would you use to verify the MPLS forwarding path for the VPN traffic?

Accepted Answer

show mpls forwarding-table vrf VPN-A 10.1.1.0. The 'show mpls forwarding-table vrf VPN-A 10.1.1.0' command displays the MPLS label stack that will be imposed on packets destined for the VPN prefix, including the inner VPN label and the outer transport label (LDP or SR-MPLS). This directly verifies the end-to-end MPLS forwarding path for VPN traffic, which is necessary when VRF routes are present but connectivity fails due to label issues.

Answer

show mpls ldp bindings

Answer

show ip route vrf VPN-A 10.1.1.0

Answer

show bgp vpnv4 unicast labels

Question 15

A service provider is deploying EVPN-MPLS for L2VPN services. The customer requires that MAC addresses learned from one PE are not advertised to other PEs unless they are active. Which EVPN route type is used for MAC address withdrawal?

Accepted Answer

Route Type 2: MAC/IP Advertisement. EVPN Route Type 2 (MAC/IP Advertisement) carries both MAC addresses and their associated IP addresses, and it supports a 'sticky' or 'withdraw' mechanism via the BGP Withdraw message. When a MAC address becomes inactive on a PE, the PE sends a BGP Withdraw for the specific Route Type 2 route, effectively removing that MAC from the control plane of other PEs. This ensures that only active MAC addresses are advertised, meeting the customer requirement.

Answer

Route Type 5: IP Prefix

Answer

Route Type 1: Ethernet Auto-Discovery (A-D)

Answer

Route Type 3: Inclusive Multicast Ethernet Tag