350-501 Practice Questions 2 — 50 Questions

Question 1

A customer is using a Cisco ASR 9000 router with hierarchical QoS (HQoS) on a subscriber interface. The parent policy sets a shape rate of 10 Mbps, but the observed traffic rate is only 8 Mbps. What is a common misconfiguration that would cause this?

Accepted Answer

The child policy includes a police command that is limiting traffic below the parent shaper rate. In hierarchical QoS (HQoS) on a Cisco ASR 9000, the parent policy shapes traffic to a specified rate, but if the child policy includes a police command, that policer can independently drop or mark down traffic before it reaches the parent shaper. This causes the observed traffic rate to be lower than the parent shape rate, as the child policer is the actual bottleneck. The correct answer is A because the police command in the child policy is limiting traffic below the 10 Mbps parent shaper, resulting in only 8 Mbps observed.

Answer

The child policy uses 'bandwidth remaining' instead of 'bandwidth'

Answer

The child policy includes a bandwidth command that exceeds the parent shaper rate

Answer

The parent shaper uses 'shape peak' instead of 'shape average'

Question 2

In an MPLS network, which field in the MPLS label header is used to carry QoS information between LSRs?

Accepted Answer

EXP bits. In MPLS, the EXP (Experimental) bits, also known as the Traffic Class (TC) field per RFC 5462, are 3 bits in the MPLS label header used to carry Quality of Service (QoS) information between Label Switch Routers (LSRs). These bits allow LSRs to apply per-hop behaviors (PHBs) such as queuing and scheduling based on the packet's QoS class, enabling differentiated services across the MPLS network.

Answer

ToS

Answer

IP Precedence

Answer

DSCP

Question 3

Which congestion avoidance technique drops packets probabilistically before the queue becomes full?

Accepted Answer

WRED. WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that monitors the average queue depth and, when it exceeds a configured threshold, begins dropping packets probabilistically before the queue becomes completely full. This proactive dropping signals TCP senders to reduce their transmission rates, thereby preventing tail drop and global synchronization.

Answer

FIFO

Answer

Priority Queuing

Answer

Custom Queuing

Question 4

Which TWO conditions cause a router to drop packets when a police action is configured?

Accepted Answer

exceed action is drop. When a police action is configured, the router uses a token bucket model to meter traffic. If traffic exceeds the committed information rate (CIR) and burst size, it falls into the 'exceed' or 'violate' category depending on the configured conform and exceed burst parameters. The 'drop' action for exceed or violate conditions explicitly instructs the router to discard those packets, enforcing traffic shaping or policing at the hardware or software level.

Answer

conform action is drop

Answer

no bandwidth is reserved

Answer

queue is full

Question 5

Which THREE QoS mechanisms can be used for traffic policing?

Accepted Answer

dual-rate three-color. Traffic policing uses token bucket mechanisms to measure and enforce traffic rates. Dual-rate three-color (RFC 2698) uses two token buckets (CIR/PIR) to mark packets as green, yellow, or red, allowing separate policing of committed and peak rates. Single-rate two-color (RFC 2697) uses one token bucket to mark packets as either conforming (green) or exceeding (red). Both are standard policing implementations.

Answer

WRED

Answer

shaping

Question 6

A customer has a 100 Mbps access link and wants to limit traffic to 95 Mbps with burst allowance up to 100 Mbps. Which QoS action should be applied on the egress interface?

Accepted Answer

police. Police is the correct QoS action because it allows you to enforce a maximum traffic rate (95 Mbps) while permitting bursts up to 100 Mbps, dropping or remarking excess traffic. Unlike shaping, policing does not buffer traffic, so it can enforce a hard limit on egress without introducing delay, which matches the requirement to limit traffic with a burst allowance.

Answer

shape

Answer

priority

Answer

bandwidth

Question 7

An enterprise uses IPsec VPN to connect branch offices. They apply QoS policies on the tunnel interface but notice that original DSCP markings are not preserved after encryption. Which feature should be enabled to maintain end-to-end QoS?

Accepted Answer

QoS pre-classify. When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.

Answer

AutoQoS

Answer

MPLS TE

Answer

NBAR

Question 8

A large enterprise recently implemented centralized QoS policies using Cisco DNA Center. The policies are pushed via RESTCONF to the branch routers. After the deployment, the branch office reports that critical business applications (like ERP) are being delayed. The network team verifies that the QoS policy is applied correctly on the WAN interface (Serial0/0/0) with a shape of 10 Mbps. The policy-map has a class for 'critical-data' with bandwidth 5 Mbps and another class for 'transactional-data' with bandwidth 3 Mbps. The remaining traffic is in class-default with fair-queue. The branch router's CPU utilization is normal. The interface output shows that the queue for critical-data is rarely full, but packets are experiencing high latency. The engineer pings from the branch server to the central site and sees 200 ms RTT normally, but up to 500 ms during peak hours. What is the most likely cause of the high latency for critical-data?

Accepted Answer

The shape rate is too low; increase it to match the access link speed (e.g., 20 Mbps).. The correct answer is A because the shape rate of 10 Mbps is the bottleneck. Even though the critical-data class has a bandwidth guarantee of 5 Mbps, the overall interface is shaped to 10 Mbps. During peak hours, when the sum of all traffic (critical, transactional, and default) exceeds 10 Mbps, packets are queued at the shaper. This queueing introduces additional delay (up to 500 ms) for all classes, including critical-data, because the shaper enforces a single token bucket for the entire interface. Increasing the shape rate to match the actual access link speed (e.g., 20 Mbps) would reduce the queuing delay by allowing more traffic to be transmitted immediately.

Answer

The critical-data class needs a priority command to reduce latency.

Answer

The queue-limit for critical-data is too high; reduce it to force early drops.

Answer

The bandwidth command in critical-data should be increased above 5 Mbps.

Question 9

A service provider is configuring BGP community propagation in an MPLS VPN network. Which two actions are necessary to ensure that communities are passed from CE to remote PE?

Accepted Answer

Configure send-community on the CE-to-PE BGP session. B is correct because the `send-community` command must be configured on the CE-to-PE BGP session to allow standard BGP communities (e.g., NO_EXPORT) to be propagated from the CE router into the MPLS VPN network. Without this, the PE router will strip communities from incoming BGP updates, preventing them from reaching the remote PE.

Answer

Configure no bgp default community-mode

Answer

Configure vrf forwarding with route-target both

Answer

Configure route-map to filter communities

Question 10

A network operator uses gRPC Network Management Interface (gNMI) to collect telemetry data from routers. They notice that some updates are missing. Which gNMI mode should be used to ensure that all state changes are captured?

Accepted Answer

ON_CHANGE. ON_CHANGE mode in gNMI ensures that the target device sends a telemetry update immediately whenever a state change occurs, guaranteeing that no updates are missed. This is in contrast to SAMPLE mode, which only sends periodic snapshots and can miss transient changes between intervals. Therefore, to capture all state changes, ON_CHANGE is the correct subscription mode.

Answer

TARGET_DEFINED

Answer

POLL

Answer

SAMPLE

Question 11

Which tool is used to validate YANG data models against device capabilities and to generate Python bindings for automation scripts?

Accepted Answer

pyang. B is correct because pyang is a YANG data modeling language validator and converter that can validate YANG modules against device capabilities (e.g., via RFC 7895 YANG Library) and generate Python bindings (e.g., using the `--plugindir` or `pyang --format pybind` options) for use in automation scripts. It directly supports the task of validating YANG models and producing Python code, unlike the other options which are protocols or automation frameworks.

Answer

RESTCONF

Answer

Ansible

Answer

NETCONF

Question 12

A service provider is deploying MPLS L3VPN over an OSPF backbone. The PE routers are configured with OSPF as the IGP. The CE router of customer A is connected to two PEs for redundancy. Which configuration is required on the PE routers to ensure that the CE router can load-balance traffic across both PEs without loops?

Accepted Answer

Configure OSPF with the capability vrf-lite and enable the down-bit on the PE-CE link.. Option C is correct because configuring OSPF with the capability vrf-lite and enabling the down-bit on the PE-CE link prevents routing loops in a multi-homed CE scenario. The down-bit is set by the PE when redistributing routes into OSPF, ensuring that the CE does not re-advertise those routes back to another PE, which would cause a loop. The vrf-lite capability allows the CE to understand the down-bit without requiring full MPLS/VPN functionality, enabling load-balancing across both PEs safely.

Answer

Use OSPF sham-links between the two PEs.

Answer

Use the BGP cost community to adjust the path selection on the CE.

Answer

Disable the DN-bit on the PE-CE OSPF interface.

Question 13

An engineer is troubleshooting a BGP peering issue between two routers. The peering is established, but routes are not being exchanged. On router R1, 'show bgp neighbors 192.0.2.2' shows the neighbor state as 'Established' but the 'Prefixes received' counter is zero. What is most likely the cause?

Accepted Answer

An outbound route-map on the neighbor is filtering all routes.. The neighbor state is 'Established', confirming that the TCP session and BGP open messages have been successfully exchanged. However, zero prefixes received indicates that R1 is not receiving any routes from the neighbor. An outbound route-map applied on the neighbor (the router sending routes to R1) can filter all prefixes before they are advertised, resulting in zero received prefixes while the session remains up.

Answer

The 'maximum-prefix' limit is exceeded, causing the session to reset.

Answer

The BGP session is in the Idle state due to a misconfigured update-source.

Answer

The 'next-hop-self' command is missing on R1.

Question 14

A network engineer is troubleshooting a BGP route selection issue on a router that receives the same prefix from two different peers. Which THREE BGP attributes are considered in the route selection process before the 'prefer the route with the lowest metric' step?

Accepted Answer

Highest weight. Weight is a Cisco-proprietary BGP attribute that is locally significant to the router and is checked first in the BGP best-path selection process. A route with a higher weight is preferred over all other attributes, including local preference and AS_PATH length, making it the most influential attribute for inbound traffic engineering on a single router.

Answer

Shortest AS_PATH

Answer

Lowest origin type (IGP < EGP < incomplete)

Question 15

A service provider is deploying MPLS L3VPN to connect multiple customer sites. The PE router receives a route from a CE router via MP-BGP. Which attribute must the PE router add to the route before advertising it to the route reflector?

Accepted Answer

Route distinguisher (RD). When a PE router receives a customer route from a CE router via MP-BGP, it must first make the route unique within the MPLS VPN context by adding a Route Distinguisher (RD). The RD prepended to the IPv4 prefix creates a VPNv4 address (per RFC 4364), which is the format required for advertisement to a route reflector. Without the RD, the route would not be distinguishable from other customers' overlapping IP prefixes in the BGP table.

Answer

MPLS label

Answer

Route target (RT)

Answer

IGP metric

Question 16

An engineer is deploying MPLS in the core and wants to ensure that all core routers use the same label for a specific prefix, regardless of which router originated it. Which MPLS label allocation mode should be used?

Accepted Answer

Per-prefix label mode. Per-prefix label mode (option C) is correct because it assigns a single label for a specific prefix across all core routers, regardless of which router originated the route. This ensures label consistency, which is critical for proper MPLS forwarding and troubleshooting. In contrast, per-next-hop or per-interface modes would create different labels for the same prefix based on the next hop or interface, breaking the requirement for uniform label allocation.

Answer

Per-interface label mode

Answer

Per-next-hop label mode

Answer

Per-VRF label mode

Question 17

A network administrator is configuring a Cisco ASR 9000 router for MPLS L3VPN. The PE receives customer routes via eBGP from the CE. Which command is required to redistribute these routes into the VPNv4 BGP table on the PE?

Accepted Answer

Configure 'address-family ipv4 unicast' under the VRF configuration and then 'address-family vpnv4 unicast' under the BGP process.. Option A is correct because in MPLS L3VPN, customer routes learned via eBGP from the CE must be placed into the VRF's IPv4 unicast table first, and then the 'address-family vpnv4 unicast' under BGP is required to redistribute those VRF routes into the VPNv4 BGP table, which carries the route with its route distinguisher (RD) and extended community. This two-step process ensures the PE can advertise the route as a VPNv4 prefix to other PEs via MP-BGP.

Answer

Configure 'address-family ipv4 vrf CUSTOMER' under the BGP process and activate the neighbor.

Answer

Enter 'vrf CUSTOMER' in the BGP process and then 'address-family ipv4 unicast' under the VRF.

Answer

Enter 'redistribute bgp 100' under the VRF's OSPF or static route configuration.

Question 18

A service provider is designing a Layer 2 MPLS VPN to connect multiple customer sites. Which technology should be used to provide end-to-end Ethernet service with MAC address transparency and support for multiple customer VLANs?

Accepted Answer

VPLS (Virtual Private LAN Service). VPLS (Virtual Private LAN Service) is the correct choice because it emulates an Ethernet bridge across an MPLS core, providing MAC address transparency and supporting multiple customer VLANs through a multipoint-to-multipoint topology. Unlike point-to-point services, VPLS learns MAC addresses and forwards frames based on them, enabling end-to-end Ethernet service across distributed sites.

Answer

MPLS Traffic Engineering (MPLS TE)

Answer

VPWS (Virtual Private Wire Service)

Answer

RSVP-TE signaling

Question 19

Which TWO statements correctly describe the use of OSPF in a service provider network?

Accepted Answer

OSPF uses different LSA types to advertise different types of routing information.. Option B is correct because OSPF uses different LSA types (e.g., Type 1 Router LSA, Type 2 Network LSA, Type 3 Summary LSA, Type 5 AS-External LSA) to advertise different categories of routing information, such as router links, network links, inter-area routes, and external routes. This LSA-type differentiation is fundamental to OSPF's link-state architecture, enabling efficient flooding and route computation within and across areas.

Answer

OSPF uses the Bellman-Ford algorithm to compute routes.

Answer

OSPF is a distance-vector routing protocol.

Answer

OSPF uses TLVs to encode routing information.

Question 20

A network administrator is designing an MPLS TE tunnel for a service provider backbone. The goal is to provide bandwidth protection for voice traffic. Which MPLS TE feature should be configured?

Accepted Answer

Fast Reroute (FRR). MPLS TE Fast Reroute (FRR) provides sub-50 ms protection against link or node failures by pre-computing and pre-signaling a backup tunnel that bypasses the protected element. This meets the requirement for bandwidth protection of voice traffic, which is sensitive to packet loss and delay during network convergence.

Answer

Autoroute announce

Answer

Path-option

Answer

Bandwidth protection