350-501 Practice Questions 2 — 50 Questions

Question 1

A service provider is deploying MPLS L3VPN and wants to ensure that routes from a specific customer VRF are only advertised to a specific remote PE. Which mechanism should be used?

Accepted Answer

Applying a route-map to the VRF export statement. A route-map applied to the VRF export statement allows granular control over which routes are advertised to specific BGP VPNv4 neighbors. By matching on route targets or other attributes, the route-map can filter outbound routes per neighbor, ensuring that routes from a specific customer VRF are only sent to a designated remote PE.

Answer

Configuring a separate VPNv4 address-family for that PE

Answer

Using a unique route-distinguisher per VRF

Answer

Setting the next-hop-self on the PE

Question 2

An engineer is designing an MPLS L3VPN solution and must ensure that the provider edge (PE) routers can handle routing updates for multiple customers without interfering with each other. Which mechanism should be used on the PE routers?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding) is the correct mechanism because it allows a single PE router to maintain multiple separate routing tables (VRFs), each dedicated to a different customer. This ensures that routing updates for one customer are isolated from another, preventing interference. VRF-Lite achieves this without MPLS, using only IP forwarding and per-VRF routing instances.

Answer

Route distinguishers

Answer

Route reflectors

Answer

MPLS-TE

Question 3

A network operator wants to prefer a specific BGP route from a peer for a prefix. After applying a route-map to set local preference to 200, the route is still not preferred over a route from another peer with local preference 150. What could be the issue?

Accepted Answer

The prefix was received with a higher weight.. BGP uses multiple attributes in a specific order of precedence when selecting the best path. Weight (Cisco-proprietary) is checked first, before local preference. If the peer's route has a higher weight (e.g., 32768 for locally injected routes or a manually set value), it will be preferred over a route with a local preference of 200, even if the other route's local preference is only 150.

Answer

The neighbor address-family is not correct.

Answer

The route-map was applied on the wrong BGP neighbor direction.

Answer

The route is received via an IBGP session.

Question 4

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Accepted Answer

6VPE. 6VPE (IPv6 VPN Provider Edge) requires a dedicated control plane per VPN instance because it uses separate per-VPN routing tables and a distinct BGP session (typically MP-BGP with the IPv6 address family) to exchange IPv6 VPN routes. This ensures that each customer's IPv6 routing information is isolated and processed independently, which is a core requirement for L3VPN services that maintain per-VPN forwarding and control plane separation.

Answer

VPLS

Answer

MDT VPN

Question 5

An SP network is implementing BGP PIC (Prefix Independent Convergence) for fast failover. What is the primary mechanism used by BGP PIC to achieve sub-second convergence?

Accepted Answer

It pre-computes and installs a backup path in the FIB for each prefix. BGP PIC uses a backup path (often a pre-computed alternate path) that is installed in the FIB along with the primary path. Upon failure of the primary path, traffic is switched to the backup path without waiting for BGP convergence.

Answer

It uses route summarization to reduce the number of prefixes

Answer

It implements BGP multipath to load balance traffic

Answer

It relies on BFD to detect failures quickly

Question 6

A network engineer is designing a Layer 2 VPN using EVPN with MPLS data plane. The customer requires all-hub multipoint connectivity with optimal multicast replication. Which EVPN route type is used to advertise multicast group membership?

Accepted Answer

Route Type 6 (Selective Multicast Ethernet Tag). Route Type 6 (Selective Multicast Ethernet Tag) is used in EVPN to advertise multicast group membership for selective multicast replication. This allows the provider edge (PE) routers to build optimal multicast trees for specific groups, enabling efficient all-hub multipoint connectivity with EVPN-MPLS data plane.

Answer

Route Type 3 (Inclusive Multicast Ethernet Tag)

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 4 (Ethernet Segment)

Question 7

In SRv6, which SID behavior is used to achieve L3VPN IPv6 VPN forwarding, where the SID points to a VPN instance and performs decapsulation and IPv6 lookup?

Accepted Answer

End.DT6. End.DT6 is the SRv6 endpoint behavior for L3VPN over IPv6, performing decapsulation and lookup in the appropriate VPN routing table.

Answer

End.X

Answer

End.DT2U

Answer

End.DT4

Question 8

A service provider is deploying Segment Routing in the MPLS core using IS-IS. Which extension is required in IS-IS to advertise the prefix-SID?

Accepted Answer

Sub-TLV 3 (Prefix-SID). In IS-IS, the Prefix-SID is advertised using Sub-TLV 3, which is carried within TLV 135 (Extended IP Reachability). This sub-TLV contains the SID value and flags, enabling Segment Routing in the MPLS core. Without Sub-TLV 3, the prefix-SID cannot be signaled, making it the required extension.

Answer

TLV 22 (Extended IS Reachability)

Answer

TLV 242 (Router Capability)

Answer

TLV 135 (Extended IP Reachability)

Question 9

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

Accepted Answer

Add the 'sr-protect' option under the fast-reroute configuration to enable node protection. For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence. Option D is wrong because there is no need for an additional LDP backup.

Answer

Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

Answer

Reduce the IGP timers and enable incremental SPF to accelerate convergence

Answer

Deploy LDP as a fallback label distribution protocol to provide additional backup paths

Question 10

In a service provider network, the access layer connects end customers. Which technology is commonly used for fibre-based access in GPON deployments?

Accepted Answer

GPON. GPON (Gigabit Passive Optical Network) is a fibre-based access technology standardized by ITU-T.

Answer

DSL

Answer

MPLS

Answer

Metro Ethernet

Question 11

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 12

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS

Question 13

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0

Question 14

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 15

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

Accepted Answer

The route-target on the new PEs does not match the existing VPLS context. B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Answer

The BGP neighbor is not activated under the VPLS address-family

Answer

The MTU mismatch between PEs

Answer

The VFI name is not consistent across PEs

Question 16

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. SSH provides encrypted remote access, and SNMPv3 with encryption and authentication secures monitoring. Telnet and SNMPv2c are insecure. Disabling all access is not practical.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access

Question 17

An ISP is implementing 6PE to provide IPv6 connectivity over an MPLS network that only supports IPv4 in the core. In 6PE, how are IPv6 prefixes carried across the MPLS backbone?

Accepted Answer

IPv6 prefixes are carried as IPv6 prefixes in MP-BGP with an IPv4 next-hop. 6PE uses MP-BGP to carry IPv6 prefixes (using the IPv6 unicast address family, AFI=2 SAFI=1) with an IPv4 next-hop address (the loopback of the peer 6PE router). The BGP session is over IPv4, but the NLRI carries IPv6 prefixes. MPLS labels are used to forward traffic across the IPv4-only core. It is important to note that 6PE does not use the VPNv6 address family (AFI=1 SAFI=128) — that is used for MPLS L3VPN.

Answer

IPv6 prefixes are transported over an IPv6 MPLS core using LDPv6

Answer

IPv6 prefixes are encapsulated in IPv4 tunnels with GRE

Answer

IPv6 prefixes are converted to IPv4 using NAT64 before MPLS forwarding

Question 18

An SP engineer is implementing DSCP classification at the edge. Which two AF classes are typically used for mission-critical data? (Choose two.)

Accepted Answer

AF41. AF4x (e.g., AF41/AF42/AF43) and AF3x (e.g., AF31/AF32/AF33) are used for high-priority data. AF1x is low-priority.

Answer

CS0

Answer

AF11

Answer

AF22

Question 19

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

Accepted Answer

NAT with VRF awareness. NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

Answer

Static default route from VRF to global

Answer

Route leaking between VRF and global

Answer

VRF-Aware Firewall

Question 20

An SP engineer is configuring QoS on a router and needs to drop traffic that exceeds a certain rate while allowing bursts up to a specified amount. Which QoS feature should be used?

Accepted Answer

Policing. Policing is the correct QoS feature because it drops traffic that exceeds a configured rate while allowing bursts up to a specified amount. Unlike shaping, which buffers excess traffic, policing enforces a rate limit by immediately dropping or re-marking packets that exceed the configured committed information rate (CIR) and burst size (Bc/Be). This matches the requirement to drop traffic that exceeds a certain rate while permitting bursts.

Answer

Shaping

Answer

WRED

Answer

Queueing