350-501 Practice Exam 53 — 20 Questions

Question 1

Which IOS XR feature allows an administrator to grant specific commands to a user based on their role, using task groups?

Accepted Answer

Role-based access control (RBAC) with task groups. IOS XR uses task groups (e.g., cisco-support, cisco-config) to define sets of commands or operations. Users are assigned to task groups to control access to specific router functions.

Answer

SNMPv3

Answer

IP access lists

Answer

AAA with RADIUS

Question 2

An SP is migrating from an MPLS LDP-based network to Segment Routing. They want to ensure that existing LDP LSPs continue to work alongside SR LSPs during the migration. Which mechanism should be configured?

Accepted Answer

LDP-SR interworking. LDP-SR interworking (RFC 8661) allows LDP and Segment Routing LSPs to coexist and interoperate during migration. It enables LDP-signaled LSPs to stitch with SR LSPs by mapping LDP labels to SR prefix-SIDs, ensuring end-to-end MPLS forwarding without service disruption. This mechanism is specifically designed for seamless coexistence without requiring a full network cutover.

Answer

SRGB

Answer

BGP-LU

Answer

MPLS TE

Question 3

Refer to the exhibit. A network engineer notices that the local label 19 for prefix 10.4.4.0/24 shows 'Untagged' in the outgoing label column. What is the most likely cause?

Accepted Answer

LDP is not enabled on the interface toward 192.168.3.3.. When LDP is not enabled on the interface toward the next-hop router (192.168.3.3), the local router cannot exchange label bindings with that neighbor. As a result, the local label for prefix 10.4.4.0/24 remains in the LIB but is not programmed into the LFIB with an outgoing label, showing 'Untagged' because the router must pop the label (or forward as IP) when sending traffic to that next hop.

Answer

The next-hop router 192.168.3.3 is unreachable.

Answer

Penultimate Hop Popping is enabled on the next-hop router.

Answer

The MTU on interface Gi0/0/2 is too small.

Question 4

A network operator is deploying segment routing in an MPLS network. They want to use a centralized controller to compute paths based on traffic demand and network constraints. Which architecture is being used?

Accepted Answer

Segment Routing Path Computation Element (SR-PCE). The scenario describes a centralized controller computing paths based on traffic demand and network constraints, which is the definition of a Path Computation Element (PCE) architecture. In Segment Routing, the SR-PCE (Segment Routing Path Computation Element) is the centralized controller that calculates optimal paths using traffic engineering constraints and then communicates the path information (via PCEP) to the headend router. This is distinct from distributed control plane approaches like LDP or SR-BE, and from SR-TE which is the overall traffic engineering mechanism but not the specific centralized controller architecture.

Answer

LDP-based MPLS

Answer

Segment Routing Traffic Engineering (SR-TE)

Answer

Segment Routing Best Effort (SR-BE)

Question 5

An SP network engineer is hardening management plane access on IOS XR routers. They require authentication, authorization, and accounting (AAA) with per-command authorization and role-based access control. Which combination should be used?

Accepted Answer

SSH with TACACS+ authentication and authorization, and task groups for role-based access. For per-command authorization and role-based access, TACACS+ is preferred over RADIUS. IOS XR uses task groups to define roles. SSH provides encrypted management access.

Answer

SSH with local authentication and privilege levels

Answer

Telnet with RADIUS authentication and authorization

Answer

SNMPv3 with RADIUS authentication

Question 6

A service provider is deploying an MPLS L3VPN solution for a customer with two sites. The PE routers are running OSPF as the IGP and LDP for label distribution. The provider wants to ensure that customer traffic is load-balanced across two equal-cost paths between the PEs. The network team notices that all traffic is taking only one path despite the IGP showing equal-cost routes. The team has verified that the MPLS forwarding table on the P router shows only one label entry for the BGP next-hop. The team suspects a load-balancing issue. Which action best resolves the problem?

Accepted Answer

Enable per-flow load balancing on all routers with 'load-balance per-flow'. The issue is that MPLS L3VPN traffic is not being load-balanced despite equal-cost IGP paths. This typically occurs when the MPLS forwarding table on the P router has only one label entry for the BGP next-hop, indicating that per-flow load balancing is not enabled. Enabling 'load-balance per-flow' on all routers ensures that the CEF (Cisco Express Forwarding) uses per-flow hashing to distribute traffic across multiple equal-cost LSPs (Label Switched Paths), rather than per-packet or default behavior that may favor a single path.

Answer

Increase the OSPF maximum-paths value to 4

Answer

Enable BGP additional-paths on the PE routers

Answer

Configure LDP to use the 'mpls ldp igp sync' command

Question 7

A customer requires MPLS Layer 2 VPN connectivity between two sites using Pseudowire. Which control protocol is used to signal the pseudowire label?

Accepted Answer

LDP. B is correct because LDP (Label Distribution Protocol) is the standard control protocol used to signal pseudowire labels in MPLS Layer 2 VPNs. Specifically, the Targeted LDP (T-LDP) session between the two Provider Edge (PE) routers exchanges the Virtual Circuit (VC) label, which is the inner label used to identify the pseudowire. This is defined in RFC 4447 and is the default signaling mechanism for AToM (Any Transport over MPLS).

Answer

RSVP-TE

Answer

BGP

Answer

OSPF

Question 8

A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?

Accepted Answer

mpls l2transport route 10.1.1.2 100. The `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.

Answer

l2vpn xconnect context

Answer

neighbor 10.1.1.2 remote-as 100

Answer

pseudowire 10.1.1.2 100 encapsulation mpls

Question 9

Refer to the exhibit. A PE router in an MPLS L3VPN network shows the above output. The VRF CUSTOMER contains two routes. Which statement about forwarding for these routes is true?

Accepted Answer

Traffic to 10.1.1.0/24 will be label-switched with an implicit null label.. The output shows that for the VRF CUSTOMER, the route to 10.1.1.0/24 has a next hop of 192.168.1.2 and is associated with label 3 (implicit null). In MPLS L3VPN, label 3 instructs the upstream router to pop the MPLS label and forward the packet using IP routing to the directly connected next hop. Therefore, traffic to 10.1.1.0/24 will be label-switched with an implicit null label, meaning the label is removed before forwarding to the CE router.

Answer

Both routes are reachable via MPLS.

Answer

Traffic to 10.2.2.0/24 will be forwarded using the BGP next hop label.

Answer

Traffic to 10.2.2.0/24 will be forwarded using IP routing.

Question 10

An engineer is configuring LDP in an MPLS network. Which THREE are valid label distribution modes for LDP?

Accepted Answer

Downstream on Demand with Independent Label Distribution Control. Downstream on Demand (DoD) with Independent Label Distribution Control allows a router to request a label mapping only when needed and to advertise bindings independently, as defined in RFC 5036. Option B is correct because Downstream Unsolicited (DU) with Conservative Label Retention means a router learns all label mappings but only stores those for routes it actively uses, which is a supported mode in MPLS LDP implementations. Option C is correct because Downstream Unsolicited with Liberal Label Retention is the default and most common mode, where a router stores all label mappings received from neighbors. Options D and E are incorrect because Ordered Label Distribution Control is typically used with DoD, not DU, and Liberal Label Retention is rarely paired with DoD due to resource waste.

Answer

Downstream Unsolicited with Ordered Label Distribution Control

Answer

Downstream on Demand with Liberal Label Retention

Question 11

A customer reports that CE routers attached to PE1 and PE2 in the same VRF cannot ping each other. Based on the exhibit, what is the most likely cause?

Accepted Answer

LDP is not enabled on the core interfaces between PE1 and PE2. B is correct because LDP must be enabled on the core interfaces between PE1 and PE2 to establish LDP sessions, which are required to exchange MPLS labels for the transport LSP. Without LDP, the MPLS forwarding path between the PEs is broken, preventing CE-to-CE ping even if BGP VPNv4 routes are correctly advertised.

Answer

Missing address-family ipv4 for BGP neighbor

Answer

Mismatched route distinguisher (RD) values on PE1 and PE2

Answer

Route target (RT) import/export mismatch

Question 12

Which TWO statements about MPLS label operations in a service provider core are correct? (Choose two.)

Accepted Answer

The ingress router pushes a label stack onto the IP packet. The ingress router (LER) in an MPLS network performs a push operation, adding a label stack (typically one or more labels) onto the incoming IP packet. This label stack is used to direct the packet along a Label Switched Path (LSP) through the core, enabling MPLS forwarding based on labels rather than IP routing.

Answer

The egress router receives an MPLS packet with two labels by default

Answer

The penultimate hop performs label swap for the top label

Answer

The penultimate hop is disabled by default in MPLS networks

Question 13

An ISP is designing an MPLS core network and needs to choose an IGP that supports fast convergence. Which IGP meets this requirement and is most commonly used in MPLS core networks?

Accepted Answer

IS-IS. IS-IS is the correct choice because it is a link-state IGP that inherently supports fast convergence through mechanisms like incremental SPF (iSPF) and prefix-independent convergence (PIC). It is widely deployed in MPLS core networks due to its scalability, extensibility via TLVs, and native support for MPLS Traffic Engineering (MPLS-TE) without requiring additional protocol extensions like OSPF's opaque LSA.

Answer

OSPFv3

Answer

EIGRP

Answer

RIPng

Question 14

An SP engineer configures a QoS policy on an IOS XR router to re-mark DSCP from AF11 to AF22 for traffic matching a specific ACL. The policy compiles successfully but traffic is not re-marked. What is a likely reason?

Accepted Answer

The interface does not have the 'qos' feature enabled, or the policy-map is not attached.. On IOS XR routers, QoS policies require explicit feature enablement via the 'qos' command under the interface configuration, and the policy-map must be attached in the correct direction. Without the 'qos' feature enabled, the router will compile the policy but silently ignore it, resulting in no re-marking of DSCP from AF11 to AF22.

Answer

The ACL cannot match on DSCP values.

Answer

The ACL is applied to the wrong interface.

Answer

The policy is applied in the output direction; marking can only be done on ingress.

Question 15

An engineer is troubleshooting a BGP route propagation issue. The customer is receiving a default route from upstream provider, but the route is not being installed in the routing table. The BGP table shows the route is valid but not best. What is the most likely cause?

Accepted Answer

A static default route with lower administrative distance exists. A static default route with a lower administrative distance (e.g., 1) will be preferred over a BGP default route (AD 20 for eBGP). Even though the BGP route is valid in the BGP table, it is not installed in the routing table because the static route is more trustworthy. This is a common scenario where the routing table already has a better path, preventing the BGP route from becoming 'best' and being installed.

Answer

The next-hop is unreachable

Answer

The route is filtered by an inbound route-map

Answer

The BGP session is not established

Question 16

A service provider is building a new network slicing architecture to offer differentiated services to enterprise customers. The architecture uses SRv6 with network slices identified by slice IDs embedded in the SRv6 SID. The underlay is an IP network with ISIS. Each slice will have dedicated resources in the core, including guaranteed bandwidth and low latency. The plan is to use the SRv6 network programming concept to steer traffic into different slices. The provider wants to ensure that slice isolation is maintained end-to-end, including at the egress PE where traffic is handed off to the customer. However, during testing, they observe that traffic from one slice is incorrectly entering another slice's queue on an intermediate node, causing performance interference. The intermediate node is a transit router that does not terminate SRv6 but performs 'SID-based forwarding'. Which mechanism is most likely missing to ensure slice isolation on transit nodes?

Accepted Answer

The transit nodes are not configured to enforce per-slice QoS policies based on the slice ID in the SID.. Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.

Answer

The SRv6 SID does not carry the slice ID; it only carries the locator.

Answer

The egress PE is misconfigured to strip the slice ID before forwarding.

Answer

The ingress PE is not setting the slice ID correctly.

Question 17

An SP is designing a metro Ethernet network using Q-in-Q. A customer uses VLAN ID 100 on their network, and the SP assigns service VLAN 200. Which frame format is used on the SP network?

Accepted Answer

Double tag: outer 200, inner 100. Q-in-Q adds an outer (service) VLAN tag (200) while preserving the inner (customer) VLAN tag (100).

Answer

Single tag: VLAN 100

Answer

Double tag: outer 100, inner 200

Answer

Single tag: VLAN 200

Question 18

The CE router behind the VRF interface is unable to reach the remote CE. Which configuration error is most likely the cause?

Accepted Answer

The BGP neighbor is configured with a directly connected interface address but uses update-source Loopback0.. When BGP is configured with a neighbor using a directly connected interface address (e.g., 10.0.0.2) but the update-source is set to Loopback0, the BGP session will attempt to establish using the loopback IP as the source. If the loopback address is not reachable via the directly connected link (e.g., no IGP route for the loopback across the MPLS/VPN core), the BGP session will fail, preventing the CE router behind the VRF from reaching the remote CE. This mismatch between the neighbor address and the update-source is a common misconfiguration in MPLS L3VPN environments.

Answer

The VRF is missing the 'rd' command.

Answer

The 'mpls ip' command is missing on the core interface.

Answer

The VRF interface does not have an IP address.

Question 19

Which THREE statements are true regarding NSO's NED? (Choose three.)

Accepted Answer

NED can support NETCONF, SNMP, or CLI as southbound protocols. NSO's NED (Network Equipment Driver) is the component that abstracts the southbound communication between NSO and network devices. NEDs can use NETCONF, SNMP, or CLI as the southbound protocol to translate NSO's device-independent configuration into device-specific commands, enabling multi-vendor management.

Answer

NED automatically generates YANG models

Answer

NED is used for path computation in SR-TE

Question 20

Which statement about the use of MTU in an MPLS network is correct?

Accepted Answer

MPLS adds a label stack to packets, reducing the payload MTU.. MPLS adds a label stack (typically 4 bytes per label) between the Layer 2 header and the IP packet. This additional overhead reduces the maximum payload size that can be carried without exceeding the interface MTU, effectively lowering the payload MTU available for the IP packet.

Answer

MPLS does not affect the MTU because labels are part of the header.

Answer

MTU must be increased on all MPLS interfaces.

Answer

MPLS eliminates the need for IP fragmentation.