350-501 Practice Test 40 — 15 Questions

Question 1

A service provider is deploying Segment Routing (SR) with TI-LFA for fast convergence. Which mechanism does TI-LFA use to repair a link failure in a node segment path?

Accepted Answer

Precomputes a backup path using a segment list (label stack) that avoids the failed link. TI-LFA (Topology Independent Loop-Free Alternate) precomputes a backup path using a segment list (label stack) that explicitly avoids the failed link. This is achieved by encoding a repair path as a sequence of adjacency and node segments, ensuring that traffic is steered around the failure without loops, regardless of the network topology. The backup path is installed in the forwarding table before the failure occurs, enabling sub-50ms convergence.

Answer

Uses loop-free alternate (LFA) as defined in IPFRR

Answer

Uses RSVP-TE to signal a protected LSP

Answer

Relies on BFD to trigger a backup path in the forwarding table

Question 2

What is the primary function of the NED (Network Element Driver) in NSO?

Accepted Answer

Abstract the device configuration and map YANG to device CLI. The NED (Network Element Driver) in Cisco NSO is the component that abstracts the native device configuration and translates YANG data models into device-specific CLI commands or protocols (e.g., SNMP, NETCONF). This allows NSO to manage heterogeneous devices using a unified YANG-based service model, making option A correct.

Answer

Provide RESTCONF endpoints

Answer

Store the configuration database

Answer

Handle northbound API requests

Question 3

A network engineer is troubleshooting QoS on a Cisco ASR 1000 router. The router has a service-policy applied on the ingress interface GigabitEthernet0/0/0. The policy uses a class-map to match traffic based on NBAR protocol discovery for 'cisco-jabber'. The goal is to mark the traffic with DSCP AF41. However, when the engineer checks the policy statistics, the class 'jabber' shows zero matches, even though the users are actively using Cisco Jabber. The NBAR protocol discovery is enabled globally and on the interface. The engineer verifies that the NBAR protocol pack is up-to-date. What is the most likely reason for the class-map not matching?

Accepted Answer

Cisco Jabber traffic is encrypted, so NBAR cannot identify it. Cisco Jabber uses encrypted signaling and media (SRTP/TLS), which prevents NBAR from performing deep packet inspection to identify the application. Even with an up-to-date protocol pack, NBAR cannot match encrypted traffic unless decryption is performed elsewhere. Therefore, the class-map matching 'cisco-jabber' via NBAR protocol discovery will show zero matches.

Answer

The service-policy should be applied on the egress interface instead

Answer

The class-map is using 'match access-group' instead of 'match protocol'

Answer

The NBAR protocol pack is not activated on this interface

Question 4

An SP is deploying Inter-AS MPLS VPN option B. Which design characteristic is unique to Option B compared to Option A?

Accepted Answer

ASBRs exchange VPNv4 routes directly via MP-EBGP. In Option B, ASBRs exchange VPNv4 routes directly via MP-EBGP without requiring a full mesh of MP-IBGP sessions between PEs. This eliminates the need for per-VPN VRF configuration on ASBRs, as they only carry labeled VPNv4 routes and perform label allocation per next-hop, not per VPN.

Answer

Requires a full mesh of MP-IBGP sessions between all PEs

Answer

ASBRs maintain separate VRF for each VPN

Answer

Traffic is forwarded using IP, not MPLS

Question 5

A network engineer is troubleshooting MPLS LSP connectivity. The MPLS LDP session is up on both endpoints, but some MPLS labels are missing in the LFIB. Which configuration change would most likely resolve the issue?

Accepted Answer

Enable 'mpls ldp advertise-labels'. The 'mpls ldp advertise-labels' command ensures that LDP advertises label bindings to its peers. If this is disabled (default is enabled, but can be overridden), LDP sessions may be up but no labels are distributed, resulting in missing labels in the LFIB. Re-enabling it forces LDP to send label mappings for all FECs, resolving the connectivity issue.

Answer

Configure 'label protocol ldp' on all routers

Answer

Configure 'mpls ip' on all interfaces

Answer

Enable 'mpls ldp explicit-null' on the ingress

Question 6

Which LISP feature allows a device to register its location to a mapping system so that another device can find it?

Accepted Answer

ETR. The Egress Tunnel Router (ETR) is the LISP device that registers its location (RLOC) to the mapping system (Map-Server) so that other devices can resolve the endpoint identifier (EID) to that RLOC. This registration process populates the mapping database, enabling remote Ingress Tunnel Routers (ITRs) to find and forward traffic to the ETR. Without ETR registration, the mapping system would have no location information for the EID.

Answer

Map-Resolver (MR)

Answer

Proxy ITR (PITR)

Answer

xTR

Question 7

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

Accepted Answer

The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.. The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Answer

The priority level is set too low; voice should be priority level 4.

Answer

The 'bandwidth remaining ratio' command under class-default is starving the priority queue.

Answer

The policy is applied in the output direction; it should be input.

Question 8

A network engineer is designing a new MPLS core. Which three of the following are recommended best practices for MPLS LDP configuration? (Choose three.)

Accepted Answer

Enable LDP authentication using MD5. C is correct because enabling LDP authentication using MD5 protects the LDP session from spoofing and tampering by verifying the integrity of TCP segments exchanged between LDP peers. This is a recommended security best practice in MPLS networks to prevent unauthorized label distribution and route hijacking.

Answer

Use explicit null label for BGP prefixes

Answer

Set the LDP session holdtime to 180 seconds

Question 9

In a Carrier Supporting Carrier (CSC) architecture, which condition is necessary for the customer carrier's BGP routes to be carried over the provider carrier's MPLS backbone?

Accepted Answer

The BGP next-hop on the customer carrier's routes must be reachable via IGP in the provider carrier.. In a Carrier Supporting Carrier (CSC) architecture, the provider carrier's MPLS backbone must be able to forward packets toward the BGP next-hop of the customer carrier's routes. For this to happen, the BGP next-hop (typically a loopback interface on the customer carrier's PE router) must be reachable via an IGP (e.g., OSPF or IS-IS) running within the provider carrier's core. Without IGP reachability to that next-hop, the provider carrier's P routers cannot perform MPLS label switching to deliver traffic to the customer carrier's egress router, breaking end-to-end connectivity.

Answer

The provider carrier's VRF must have the route-target matching the customer carrier's.

Answer

The provider carrier must be in the same AS as the customer carrier.

Answer

The customer carrier must use LDP for label distribution.

Question 10

In an MPLS L3VPN network, a customer has overlapping IP addresses between two VPNs. The provider edge routers are configured with VRF instances. Which method ensures that traffic from one VPN does not leak into the other when using MPLS labels?

Accepted Answer

Use distinct route targets for import and export per VRF.. Route targets (RTs) control the import and export of VPNv4 routes between VRFs on a PE router. By assigning distinct import and export RTs per VRF, the PE ensures that routes from one VPN are not installed into the routing table of another VPN, even if the customer uses overlapping IP addresses. MPLS labels are allocated per VRF forwarding instance, but the isolation is enforced by the RT-based filtering of BGP VPNv4 routes, not by label ranges or route distinguishers alone.

Answer

Assign different MPLS label ranges to each VRF.

Answer

Apply BGP community strings to filter routes.

Answer

Configure different route distinguishers for each VPN.

Question 11

A service provider is implementing MPLS-TE with FRR (Fast Reroute) using one-to-one backup tunnels. After activation, they notice that the number of labels in the forwarding table has increased significantly. What is the most likely reason for this increase?

Accepted Answer

One-to-one backup creates a unique backup tunnel for each protected LSP. One-to-one backup tunnels in MPLS-TE FRR create a dedicated backup LSP for each protected primary LSP. This means every primary LSP gets its own unique set of labels for the backup path, leading to a significant increase in the number of labels in the forwarding table. In contrast, facility backup shares a single bypass tunnel among multiple protected LSPs, which conserves labels.

Answer

RSVP-TE signaling is not properly aggregating labels

Answer

Penultimate Hop Popping (PHP) is disabled

Answer

Facility backup is being used instead of one-to-one

Question 12

A service provider wants to prevent BGP hijacking of its customer prefixes. The SP implements RPKI with BGP Origin Validation. When a route is received with an origin AS that does not match any ROA, what is the validation state?

Accepted Answer

Not-found. In RPKI, if no ROA exists for the prefix, the state is 'not-found'. If the origin AS matches a ROA, it's 'valid'; if it conflicts, it's 'invalid'.

Answer

Invalid

Answer

Valid

Answer

Unknown

Question 13

Which THREE of the following are benefits of using Segment Routing over LDP in an MPLS network? (Choose three.)

Accepted Answer

Enables traffic engineering without RSVP-TE.. Segment Routing (SR) can perform traffic engineering using SR-TE policies (via a controller or PCEP) or SR Flexible Algorithm, without requiring RSVP-TE. This eliminates the complexity of RSVP-TE's soft-state signaling and per-LSP state maintenance, relying instead on source-routed segment lists encoded in the packet header.

Answer

Provides inherent security against label spoofing.

Answer

Requires BGP-LU for label distribution.

Question 14

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

Accepted Answer

To identify applications regardless of port. DPI inspects packet payloads to identify application-layer protocols (e.g., HTTP, BitTorrent), enabling traffic shaping, QoS, or security policies.

Answer

To block all traffic from a specific IP

Answer

To classify traffic based on port numbers only

Answer

To encrypt traffic

Question 15

Which BGP extended community is used to signal the OSPF domain ID between PE routers in an MPLS L3VPN when OSPF is the PE-CE protocol?

Accepted Answer

OSPF Domain ID. In an MPLS L3VPN where OSPF is the PE-CE protocol, the OSPF Domain ID extended community is used to signal the OSPF domain identifier between PE routers. This allows the receiving PE to determine whether the OSPF route originated from the same OSPF domain (and thus should be redistributed as an intra-area or inter-area route) or from a different domain (requiring a Type 5 LSA). The OSPF Domain ID is carried as a BGP extended community (type 0x0005 or 0x8005) and is critical for maintaining OSPF route type semantics across the MPLS backbone.

Answer

Site of Origin

Answer

OSPF Route Type

Answer

Route Target