350-501 Practice Exam 52 — 20 Questions

Question 1

In an SP MPLS core, a PE router maps incoming DSCP values to MPLS EXP bits. Which statement about EXP marking is accurate when using the DiffServ Tunneling Model?

Accepted Answer

In Short Pipe model, the egress PE uses the original IP DSCP for queuing decisions, not the EXP.. In the DiffServ Tunneling Model, the Short Pipe model specifically instructs the egress PE to ignore the MPLS EXP bits for queuing and instead use the original IP DSCP value. This preserves the end-to-end QoS marking across the MPLS core, making option D correct. The Pipe model, by contrast, uses the EXP bits at the egress PE, which is why option B is incorrect.

Answer

EXP bits are always copied from the IP DSCP at the ingress PE.

Answer

In Pipe model, the egress PE uses EXP bits for queuing.

Answer

The MPLS EXP field is 6 bits, same as DSCP.

Question 2

Which tool is used to validate YANG data models against device capabilities and to generate Python bindings for automation scripts?

Accepted Answer

pyang. B is correct because pyang is a YANG data modeling language validator and converter that can validate YANG modules against device capabilities (e.g., via RFC 7895 YANG Library) and generate Python bindings (e.g., using the `--plugindir` or `pyang --format pybind` options) for use in automation scripts. It directly supports the task of validating YANG models and producing Python code, unlike the other options which are protocols or automation frameworks.

Answer

RESTCONF

Answer

Ansible

Answer

NETCONF

Question 3

A service provider is migrating from OSPF to IS-IS in the core. During the migration, both protocols are running. Some prefixes are learned via both OSPF and IS-IS. The network uses BGP for external routes and MPLS for VPNs. The engineer notices that BGP routes are pointing to a next-hop that is reachable via OSPF but not via IS-IS, causing traffic to be dropped. What is the best course of action to ensure that during the migration, BGP uses only one IGP protocol?

Accepted Answer

Increase the administrative distance of IS-IS to be higher than OSPF. Increasing the administrative distance of IS-IS to be higher than OSPF (e.g., from 115 to 120) makes OSPF routes preferred over IS-IS routes in the routing table. Since BGP uses the IGP route to resolve its next-hop, this ensures BGP always selects the OSPF path, preventing traffic drops when the next-hop is only reachable via OSPF. This is a simple, protocol-agnostic way to control IGP preference during a migration without altering route redistribution or tunneling.

Answer

Use BGP next-hop tracking to prefer IS-IS routes

Answer

Configure a route-map to selectively distribute routes

Answer

Implement MPLS TE tunnels for BGP next-hops

Question 4

Refer to the exhibit. A network engineer is configuring a segment routing traffic engineering policy. The output shows two candidate paths. Why is path1 selected as the active path even though path2 has a bandwidth constraint?

Accepted Answer

path2 has a lower preference value.. Path1 is selected as the active path because it has a higher preference value (200) compared to path2 (100). In segment routing traffic engineering, the preference value is the primary tie-breaker for candidate paths; the path with the highest preference is chosen regardless of bandwidth constraints. Bandwidth constraints are only evaluated after preference, and a path with a lower preference is not considered for activation even if it has a bandwidth constraint configured.

Answer

path1 has a shorter segment list.

Answer

path2 is down due to insufficient bandwidth.

Answer

path1 is explicit and always preferred over dynamic paths.

Question 5

Refer to the exhibit. An engineer configures IP SLA for UDP jitter. The operation completes successfully, but the customer reports voice quality issues. What should the engineer check next?

Accepted Answer

The threshold is set too high. The IP SLA UDP jitter operation completed successfully, meaning the destination is reachable and the operation is running. However, if the threshold is set too high, the IP SLA will not trigger a reaction (e.g., an SNMP trap or route change) even when jitter exceeds acceptable levels for voice quality. The customer reports voice quality issues, so the engineer must check if the jitter threshold is configured too high, masking the problem.

Answer

The packet loss is 0%

Answer

The frequency is too low

Answer

The jitter value is within threshold

Answer

The destination is unreachable

Question 6

A service provider is designing a Layer 3 MPLS VPN for a customer with two sites. The customer requires fast convergence in case of a PE-CE link failure. Which routing protocol should be used between PE and CE to achieve the fastest convergence?

Accepted Answer

EBGP with BFD. EBGP with BFD provides the fastest convergence for PE-CE link failures because BFD can detect link failures in sub-second intervals (as low as 50 ms) and trigger BGP to withdraw routes immediately, without waiting for routing protocol timers. This is critical for Layer 3 MPLS VPNs where fast failover is required, and EBGP is commonly used as the PE-CE routing protocol in service provider environments.

Answer

Static routing with object tracking

Answer

IS-IS with SPF tuning

Answer

EIGRP

Answer

OSPF with fast hello timers

Question 7

A service provider is deploying L3VPN using BGP/MPLS. Which mechanism ensures customer isolation in the provider network?

Accepted Answer

Virtual Routing and Forwarding (VRF). VRF (Virtual Routing and Forwarding) creates separate routing tables per customer, ensuring isolation.

Answer

Pseudowire

Answer

MP-BGP

Answer

MPLS labels

Question 8

A service provider wants to use NETCONF to manage devices. Which two statements are true about NETCONF operations? (Choose two.)

Accepted Answer

edit-config is used to modify configuration datastores.. NETCONF uses RPCs like get-config and edit-config; it runs over SSH (RFC 6242) and uses XML encoding.

Answer

get retrieves only operational state data.

Answer

NETCONF uses HTTP methods like POST and GET.

Answer

NETCONF uses JSON encoding by default.

Question 9

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 10

When configuring an MPLS-TE tunnel with affinity/constraint-based routing, what is the effect of assigning a link attribute of 'red' and setting the tunnel's affinity to include 'red' with the 'include-all' keyword?

Accepted Answer

The tunnel must use only links that have the 'red' attribute.. The 'include-all' affinity means the tunnel path must include all links that have the specified color attribute. If a link does not have 'red' attribute, it is excluded from the CSPF computation.

Answer

The tunnel will prefer links with 'red' but may use others if necessary.

Answer

The tunnel will use a strict explicit path.

Answer

The tunnel will avoid links with 'red'.

Question 11

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted access, TACACS+ centralizes AAA with encryption, and IOS XR task groups allow fine-grained RBAC. Telnet and SNMPv2c are insecure; SNMPv3 is required for security.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 12

A service provider is designing an MPLS L3VPN network to provide Layer 3 VPN services to multiple customers. Which two statements correctly describe the roles of the Provider Edge (PE) and Customer Edge (CE) routers in this architecture?

Accepted Answer

PE routers advertise customer routes via MP-BGP with route distinguishers and route targets.. In an MPLS L3VPN, PE routers use MP-BGP (Multiprotocol BGP) to exchange customer VPN routes. Each VPN route is uniquely identified by a Route Distinguisher (RD) to maintain global uniqueness, and Route Targets (RTs) control the import/export of routes between VRFs. This allows the PE to separate customer routing domains while still using a shared MPLS backbone.

Answer

P routers store all customer VPN routes in their global routing table.

Answer

CE routers perform MPLS label switching between PE routers.

Answer

CE routers participate in the service provider's IGP to exchange loopback addresses.

Question 13

Which TWO conditions must be met for a BGP route to be considered valid and used for forwarding?

Accepted Answer

The route must be the best path selected by BGP.. BGP only installs the best path into the routing table for forwarding. BGP selects a single best path from all available paths for a given prefix based on its path selection algorithm (e.g., highest weight, local preference, shortest AS path). Only this best path is considered valid for forwarding, even if multiple paths exist in the BGP table.

Answer

The BGP synchronization must be enabled.

Answer

The AS path must not contain the router's own AS.

Answer

The prefix must be in the BGP table.

Question 14

A service provider uses MP-BGP with IPv6 address family. They notice that routes redistributed from OSPFv3 are not being advertised to iBGP peers. The OSPF routes are internal. What is a likely reason?

Accepted Answer

The next-hop is not resolved for IPv6.. In MP-BGP for IPv6, the next-hop address for iBGP peers must be reachable via an IPv6 route in the global routing table or the appropriate VRF. When OSPFv3 redistributes internal routes into BGP, the next-hop is often set to the OSPFv3 router's own IPv6 address; if that address is not reachable (e.g., because the interface is not in the IPv6 unicast routing table or the next-hop is link-local), iBGP peers will not install the routes. This is a common cause of routes being learned but not advertised to iBGP peers.

Answer

The network command is missing under IPv6 address family.

Answer

The bgp default ipv4-unicast command is disabled.

Answer

The routes are not in the IPv6 unicast table.

Question 15

An engineer is troubleshooting MPLS forwarding. On a router, the 'show mpls forwarding-table' command displays that for a specific FEC, the outgoing label is 'Untagged'. What does this indicate?

Accepted Answer

The router is the penultimate hop, performing PHP.. When the 'show mpls forwarding-table' command shows 'Untagged' for a specific FEC, it indicates that the router is performing Penultimate Hop Popping (PHP). In PHP, the penultimate router (the router before the egress LSR) pops the MPLS label and forwards the packet as an IP packet (untagged) to the egress LSR. This is standard behavior to avoid the egress LSR having to perform a double lookup.

Answer

The label has been explicitly null.

Answer

The router is the egress LSR.

Answer

The next-hop router does not support MPLS.

Question 16

A network engineer is troubleshooting a BGP convergence issue in a large service provider network. After a link failure in the core, BGP sessions between route reflectors take a long time to reconverge. The RRs are receiving updates from many clients. Which technology can be implemented to improve convergence time? The network currently uses standard BGP with default timers.

Accepted Answer

BGP Add-Path. BGP Add-Path allows a route reflector to advertise multiple paths for the same prefix to its clients, which reduces the need for clients to re-advertise updates after a failure. This speeds up convergence by enabling the route reflector to immediately select and propagate an alternate path without waiting for BGP reconvergence from other clients. In large service provider networks with many clients, this minimizes the delay caused by the route reflector having only a single best path per prefix.

Answer

BGP TCP MD5 authentication

Answer

BGP route-refresh

Answer

BGP next-hop-self

Question 17

In the Modular QoS CLI (MQC), which component is used to define traffic classes based on match criteria?

Accepted Answer

class-map. In the Modular QoS CLI (MQC), the class-map is the component used to define traffic classes by specifying match criteria such as IP precedence, DSCP values, or access-group references. The class-map groups packets that match one or more conditions, allowing the policy-map to apply QoS actions (e.g., policing, shaping) to that specific class. Without a class-map, the policy-map cannot differentiate between traffic types.

Answer

policy-map

Answer

access-list

Answer

service-policy

Question 18

A service provider is troubleshooting BGP route selection between two eBGP peers. The router receives a prefix from Peer A with local preference 150 and AS path length 3. From Peer B, the same prefix has local preference 100 and AS path length 2. Which route will be preferred?

Accepted Answer

The route from Peer A because local preference is higher.. B is correct because BGP's route selection process evaluates local preference before AS path length. The route from Peer A has a local preference of 150, which is higher than Peer B's 100, so it is preferred regardless of the shorter AS path from Peer B. Local preference is the second BGP attribute in the decision process (after weight) and is used to influence outbound traffic from an AS.

Answer

The route from Peer A because it has a higher weight.

Answer

Both routes are equally preferred and will be used for load balancing.

Answer

The route from Peer B because AS path is shorter.

Question 19

A customer's MPLS L3VPN has two CE routers connected to two different PEs, but the PEs are not receiving the customer's routes from each other. The PE-CE routing protocol is OSPF. The PEs have the VRF configured with OSPF process, and the routes from CE are in the VRF routing table. The MP-BGP session between PEs is up and the VPNv4 address family is working. On the source PE, the routes show as not advertised to BGP. What is the likely issue?

Accepted Answer

The OSPF process on the PE is not redistributed into BGP VPNv4 under the VRF. In an MPLS L3VPN with OSPF as the PE-CE protocol, the VRF OSPF process must be explicitly redistributed into the MP-BGP VPNv4 address family using the `redistribute ospf <process-id> match internal external` command under the VRF address-family IPv4. Without this redistribution, the OSPF routes learned from the CE remain in the VRF routing table but are never injected into BGP, so they are not advertised to the remote PE, even though the MP-BGP session is up and the VPNv4 address family is working.

Answer

The route-target export on the source PE does not match the import on the remote PE

Answer

The OSPF network type is not set to broadcast

Answer

The next-hop-self is not configured under the VRF OSPF process

Question 20

A junior automation engineer is writing a Python script to configure OSPF on a Cisco IOS-XE router using RESTCONF. The script sends a PUT request to update the OSPF configuration but receives a 401 Unauthorized response. The engineer has configured a local user with privilege 15 on the router and enabled restconf. The engineer verified that the router's RESTCONF API is running on port 443. What is the most likely missing element in the script?

Accepted Answer

The script must use HTTP basic authentication with the correct username and password.. A 401 Unauthorized response indicates the request lacks proper authentication. The engineer likely forgot to include HTTP basic authentication headers with the correct username and password. Other options relate to content types or TLS, which would cause different errors (e.g., 415 Unsupported Media Type).

Answer

The script must include an Accept header.

Answer

The script must include a Content-Type header set to application/yang-data+json.

Answer

The script must use HTTPS with a valid certificate.