350-501 Practice Questions 1 — 50 Questions

Question 1

An engineer is troubleshooting an MPLS network where some routers are not exchanging labels via LDP. Which two steps are most appropriate for diagnosing the issue? (Choose two.)

Accepted Answer

Verify LDP neighbor adjacencies using 'show mpls ldp neighbor'.. Option A is correct because 'show mpls ldp neighbor' displays the state of LDP sessions (Operational, Non-existent, etc.) and the TCP connection status to each peer, which directly reveals whether label distribution adjacencies are forming. Option E is correct because LDP only runs on interfaces where 'mpls ip' (or 'mpls ldp' on some platforms) is enabled, and 'show mpls ldp interface' confirms which interfaces are actively participating in LDP label exchange. Option B is not appropriate because MTU mismatches typically affect data forwarding or IGP adjacency formation, not the LDP session establishment itself. Option C is not appropriate because rebooting routers is a disruptive action that does not diagnose the root cause of failed LDP sessions. Option D is not appropriate because while LDP relies on underlying IP reachability (often provided by OSPF), verifying OSPF adjacencies alone does not confirm LDP-specific configuration or session state.

Answer

Check the MTU size on all interfaces.

Answer

Reboot all routers to reset LDP sessions.

Answer

Verify that OSPF neighbor relationships are established.

Question 2

Which TWO statements about QoS policy propagation via BGP (QPPB) are correct?

Accepted Answer

QPPB can be applied on inbound direction only.. QPPB can be applied on inbound direction only. QPPB uses BGP policy to classify traffic based on IP precedence or QoS group, and the classification is performed on incoming traffic before any routing decision. The outbound direction is not supported for QPPB classification.

Answer

QPPB is an IETF standard.

Answer

It uses MPLS EXP bits to propagate QoS.

Answer

It dynamically adjusts BGP attributes based on QoS policy.

Question 3

Which three of the following are valid methods for protecting a pseudowire in an MPLS network?

Accepted Answer

Multi-segment PW with backup. Multi-segment PW (MS-PW) with backup is a valid protection method because it allows a pseudowire to be established across multiple MPLS segments, with a backup PW path that can take over if the primary MS-PW fails. This provides end-to-end pseudowire redundancy by using a secondary switched path, ensuring service continuity in multi-domain or multi-area MPLS networks.

Answer

Ethernet OAM CFM

Answer

LSP ping for fault detection

Question 4

What is the purpose of NTP authentication in a service provider network?

Accepted Answer

To verify the identity of the NTP server. NTP authentication (RFC 5905) uses symmetric key cryptography (MD5, SHA-1, or SHA-256) to verify that time updates come from a trusted NTP server. Its purpose is to prevent an attacker from spoofing NTP packets and injecting false time, which could disrupt logging, certificates, and routing protocols. It authenticates the source, not the content's confidentiality.

Answer

To encrypt NTP traffic

Answer

To rate-limit NTP packets

Answer

To synchronize time across devices

Question 5

A large enterprise uses MPLS L3VPN to connect multiple sites. They want to implement inter-AS option B (ASBR-to-ASBR MP-eBGP) for scalability. Which statement about this model is correct?

Accepted Answer

ASBRs exchange VPNv4 routes using MP-eBGP. In Inter-AS Option B, ASBRs use MP-eBGP to exchange VPNv4 routes. They do not maintain VRFs (Option A incorrect), and sessions are per address family, not per VRF (Option C incorrect). Option B is incorrect because a full mesh of MP-iBGP between PEs is not required. Option D correctly describes the VPNv4 route exchange using MP-eBGP.

Answer

Each ASB router maintains VRFs for all attached customers

Answer

Inter-AS option B requires a full mesh of MP-iBGP between all PEs

Answer

MP-eBGP sessions are established per VRF between ASBRs

Question 6

A service provider is designing a new MPLS L3VPN service. The customer requires that their VPN traffic be isolated from other customers and that the provider edge routers maintain separate routing tables for each VPN. Which architectural component is essential for this separation?

Accepted Answer

VRF (Virtual Routing and Forwarding). VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.

Answer

MPLS label stacking

Answer

VLAN tagging on the customer-facing interfaces

Answer

BGP route reflectors

Question 7

When implementing MPLS TE tunnels in a service provider core, what is the purpose of the 'affinity' attribute?

Accepted Answer

To define administrative groups for link inclusion/exclusion. The 'affinity' attribute in MPLS TE is used to define administrative groups (also known as link colors) that allow you to include or exclude specific links from a TE tunnel path based on user-defined properties. This enables traffic engineering policies such as forcing traffic to avoid certain links or preferring links with specific characteristics, without modifying the underlying IGP metric.

Answer

To set the color of the tunnel

Answer

To adjust the cost of TE tunnels

Answer

To bind tunnels to specific interfaces

Question 8

During a network migration from EIGRP to OSPF, you notice that some routes are being redistributed incorrectly, causing routing loops. The OSPF domain uses area 0 and area 1. The EIGRP domain uses AS 100. Which configuration change would best prevent loops during the migration?

Accepted Answer

Use route-maps to tag EIGRP routes and filter them on OSPF routers.. Route-maps allow you to tag redistributed EIGRP routes with a specific tag value (e.g., 'tag 100') and then filter those tagged routes on OSPF routers using a distribute-list in or prefix-list combined with the route-map. This prevents the redistributed routes from being re-injected back into EIGRP, breaking the redistribution loop. Without such tagging and filtering, mutual redistribution between EIGRP and OSPF can cause routing loops due to the two-way redistribution of routes.

Answer

Implement OSPF stub areas to limit external routes.

Answer

Use distribute-list in EIGRP to block OSPF routes.

Answer

Set a high administrative distance on redistributed routes in OSPF.

Question 9

An MPLS core network uses LDP to distribute labels. An engineer wants to verify that the LDP session between two routers is up and exchanging labels. Which command should be used?

Accepted Answer

show mpls ldp neighbor. The command 'show mpls ldp neighbor' displays the status of LDP sessions, including the neighbor's IP address, session state (e.g., Operational), and label exchange activity. Since LDP is the protocol used to distribute labels in this MPLS core network, this command directly verifies that the session is up and exchanging labels between the two routers.

Answer

show mpls interfaces

Answer

show mpls l2transport binding

Answer

show mpls forwarding-table

Question 10

Which OSPF network type elects a Designated Router (DR) and Backup Designated Router (BDR) to reduce the number of adjacencies on a multi-access segment?

Accepted Answer

Broadcast. The OSPF broadcast network type is designed for multi-access segments like Ethernet, where multiple routers can communicate directly. On broadcast networks, OSPF elects a Designated Router (DR) and Backup Designated Router (BDR) to reduce the number of adjacencies from O(n²) to O(n), since all non-DR routers form adjacencies only with the DR and BDR. This is the defining behavior of the broadcast network type.

Answer

Point-to-point

Answer

Loopback

Answer

Point-to-multipoint

Question 11

Refer to the exhibit. The router has three LDP neighbors established. A network administrator notices that MPLS labels for the prefix 10.4.4.0/24 are not being advertised from this router to its neighbors, although the prefix is present in the routing table. Which is the most likely cause?

Accepted Answer

The route to 10.4.4.0/24 is not the best path in the routing table.. LDP only advertises labels for prefixes that are the best path in the routing table (unless label advertisement is configured for all routes). If 10.4.4.0/24 is present but not the best path (e.g., a backup route or a route with a higher administrative distance), LDP will not allocate and advertise a label for it. This matches the symptom of the prefix being in the table but no label being advertised.

Answer

The LDP session to 10.3.3.3 is down.

Answer

The 'mpls ldp' command has not been applied globally.

Answer

The multicast routing table is empty for the prefix.

Question 12

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

1. Enter global configuration mode (configure terminal)
2. Configure the static route using the ip route command with destination network, subnet mask, and next-hop address or exit interface
3. Verify the configuration (e.g., show ip route)
4. Exit configuration mode (end or exit). Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

1. Enter global configuration mode (configure terminal)
2. Verify the configuration (e.g., show ip route)
3. Configure the static route using the ip route command
4. Exit configuration mode (end or exit)

Answer

1. Configure the static route using the ip route command
2. Enter global configuration mode (configure terminal)
3. Verify the configuration (e.g., show ip route)
4. Exit configuration mode (end or exit)

Answer

1. Exit configuration mode (end or exit)
2. Enter global configuration mode (configure terminal)
3. Configure the static route using the ip route command
4. Verify the configuration (e.g., show ip route)

Question 13

An SP deploys EVPN to provide L2VPN services with multi-homing. The customer CE is dual-homed to two different PE routers. Which EVPN mechanism ensures that only one PE forwards traffic to the CE for a given Ethernet segment, preventing loops?

Accepted Answer

Designated Forwarder election based on ESI. Ethernet Segment Identifier (ESI) and designated forwarder (DF) election in EVPN ensure that only one PE forwards traffic to the CE for a given Ethernet segment, preventing loops.

Answer

BGP Route Reflector

Answer

MAC learning via data plane

Answer

Split horizon groups

Question 14

A service provider is implementing EVPN for its VPLS replacement. They have configured BGP EVPN on all PEs and have set up an EVPN instance for a customer requiring broadcast, unknown unicast, and multicast (BUM) traffic. The customer reports that broadcast traffic from one site is not being received at another site. The engineer checks the EVPN configuration and finds that the EVI is configured correctly, the route-target matches, and the BGP sessions are established. The engineer also checks the MAC address table on the receiving PE and sees that the source MAC of the broadcast frame is learned on the local interface, but not from the remote VTEP. The engineer suspects an issue with the IMET (Inclusive Multicast Ethernet Tag) route. Which action should the engineer take to verify the IMET route?

Accepted Answer

Check the BGP EVPN route table for IMET (route-type 3) routes using 'show bgp l2vpn evpn route-type 3'.. In BGP EVPN, the IMET (Inclusive Multicast Ethernet Tag) route is a Type-3 route used to build the multicast tunnel for BUM (broadcast, unknown unicast, multicast) traffic. If BUM traffic from one site is not reaching another, and the MAC table shows the source MAC learned locally but not from the remote VTEP, the IMET route is likely missing or not being advertised/received. The correct verification is to inspect the BGP EVPN route table specifically for Type-3 routes using 'show bgp l2vpn evpn route-type 3'.

Answer

Use 'show evpn instance detail' to check the EVI configuration.

Answer

Use 'show bgp l2vpn evpn route-type 2' to verify MAC/IP routes.

Answer

Use 'show l2vpn vfi' to verify the VPLS forwarding instance.

Question 15

An automation engineer uses RESTCONF to configure a Cisco ASR 9000 router. When sending a PATCH request to update an interface description, the API returns 404 Not Found. What is the most probable issue?

Accepted Answer

The interface does not exist on the device.. A 404 Not Found response to a RESTCONF PATCH request targeting a specific interface indicates that the resource (the interface) does not exist at the given URI. RESTCONF uses the URI path to identify the exact YANG data node; if the interface name in the URI does not match any configured interface on the Cisco ASR 9000, the server returns 404. This is consistent with RFC 8040, where 404 is used when the target resource cannot be found.

Answer

HTTP authentication is required.

Answer

The YANG module is not supported.

Answer

The RESTCONF username/password is incorrect.

Question 16

An engineer is configuring IS-IS fast convergence. Which mechanism provides sub-second failure detection independently of the routing protocol?

Accepted Answer

BFD. BFD (Bidirectional Forwarding Detection) provides fast failure detection at the link layer, triggering routing protocol convergence.

Answer

LSP fast flooding

Answer

PRC (Partial Route Computation)

Answer

iSPF (incremental SPF)

Question 17

A service provider needs to prioritize voice traffic over best-effort data in an MPLS VPN. The PE router uses a QoS policy applied to the ingress interface. Which action ensures that voice packets are marked with the correct DSCP value before entering the MPLS core?

Accepted Answer

Apply a policy-map that matches voice traffic using a class-map and the 'set dscp ef' action.. The question specifies that the PE router must mark voice packets with the correct DSCP value before they enter the MPLS core. The 'set dscp ef' action in a policy-map applied to the ingress interface explicitly sets the DSCP field to EF (46) for voice traffic matched by a class-map, ensuring proper classification and treatment across the MPLS network. This is the standard method for marking IP packets at the edge before MPLS encapsulation.

Answer

Configure the ingress interface with 'mls qos trust dscp' to preserve the customer marking.

Answer

Use a policy-map with the 'set mpls experimental 5' command.

Answer

Apply a police action to drop traffic exceeding the voice bandwidth.

Question 18

An ISP is implementing 6PE to provide IPv6 connectivity over an MPLS network that only supports IPv4 in the core. In 6PE, how are IPv6 prefixes carried across the MPLS backbone?

Accepted Answer

IPv6 prefixes are carried as IPv6 prefixes in MP-BGP with an IPv4 next-hop. 6PE uses MP-BGP to carry IPv6 prefixes (using the IPv6 unicast address family, AFI=2 SAFI=1) with an IPv4 next-hop address (the loopback of the peer 6PE router). The BGP session is over IPv4, but the NLRI carries IPv6 prefixes. MPLS labels are used to forward traffic across the IPv4-only core. It is important to note that 6PE does not use the VPNv6 address family (AFI=1 SAFI=128) — that is used for MPLS L3VPN.

Answer

IPv6 prefixes are transported over an IPv6 MPLS core using LDPv6

Answer

IPv6 prefixes are encapsulated in IPv4 tunnels with GRE

Answer

IPv6 prefixes are converted to IPv4 using NAT64 before MPLS forwarding

Question 19

During a maintenance window, an automation script pushed a QoS policy that inadvertently changed the marking for all inbound traffic on a core interface. The change was rolled back, but performance reports show that some traffic is still being marked incorrectly. What is the most logical explanation?

Accepted Answer

The rolled back policy was applied inbound, but the outbound policy that also applies marking was not rolled back. QoS policies can be applied independently in the inbound and outbound directions on an interface. If the original automation script modified the inbound marking policy, and the rollback only reverted that inbound policy, any outbound policy that also performs marking would remain unchanged and continue to incorrectly mark traffic. This explains why some traffic still shows incorrect marking after the rollback.

Answer

The automation script used RESTCONF which requires a commit to finalize

Answer

The device requires a reload to clear the old marking

Answer

The rollback script only applied to the outbound direction

Question 20

In MPLS-TE Fast Reroute (FRR), what is a 'detour'?

Accepted Answer

A backup LSP that protects a single primary LSP. In MPLS-TE Fast Reroute (FRR), a detour is a pre-established backup Label Switched Path (LSP) that protects a single primary LSP. It is created by the Point of Local Repair (PLR) and merges back into the primary LSP downstream of the protected link or node. Detours are 1:1 protection, meaning each primary LSP has its own dedicated detour, which allows for sub-50ms recovery upon failure.

Answer

A secondary path for load balancing

Answer

A bypass tunnel that protects multiple LSPs

Answer

A mechanism to reroute traffic after failure detection