350-501 Practice Exam 63 — 20 Questions

Question 1

Refer to the exhibit. This JSON policy is used for Segment Routing Traffic Engineering. What is the purpose of the 'color' attribute?

Accepted Answer

It identifies a specific SR-TE policy to be used for traffic steering. In Segment Routing Traffic Engineering (SR-TE), the 'color' attribute is a 32-bit numerical value that, combined with the destination prefix, uniquely identifies an SR-TE policy. This allows traffic to be steered into a specific policy based on color, enabling advanced traffic engineering use cases such as multi-topology routing or service-level agreement (SLA) differentiation.

Answer

It sets the metric type for the path calculation

Answer

It defines the preference value for the candidate path

Answer

It specifies the link affinity constraint for the path

Question 2

Which TWO statements correctly describe differences between PIM dense mode and PIM sparse mode? (Choose two.)

Accepted Answer

PIM-DM assumes all downstream routers want to receive multicast traffic, so it initially floods traffic.. PIM-DM operates on the assumption that every downstream router wants to receive multicast traffic for a given group. It initially floods multicast traffic out all PIM-enabled interfaces, then prunes back branches that do not have interested receivers. This flood-and-prune behavior is fundamental to PIM-DM's design for dense multicast environments.

Answer

PIM-DM supports the use of a bootstrap router (BSR) for RP discovery.

Answer

PIM-SM is more bandwidth efficient for high density groups.

Answer

PIM-DM uses explicit join messages, while PIM-SM uses flood and prune.

Question 3

A customer has a 100 Mbps access link and wants to limit traffic to 95 Mbps with burst allowance up to 100 Mbps. Which QoS action should be applied on the egress interface?

Accepted Answer

police. Police is the correct QoS action because it allows you to enforce a maximum traffic rate (95 Mbps) while permitting bursts up to 100 Mbps, dropping or remarking excess traffic. Unlike shaping, policing does not buffer traffic, so it can enforce a hard limit on egress without introducing delay, which matches the requirement to limit traffic with a burst allowance.

Answer

shape

Answer

priority

Answer

bandwidth

Question 4

Which TWO protocols are supported by a BNG (Broadband Network Gateway) for subscriber session establishment? (Choose two)

Accepted Answer

PPPoE. BNG supports PPPoE and IPoE (DHCP) for subscriber access. PPPoA is asynchronous transfer mode, not typically used in modern BNG.

Answer

IPSec

Answer

L2TP

Answer

PPPoA

Question 5

A service provider wants to offer a service where a customer site can communicate with multiple other sites in a full mesh over MPLS. Which L2VPN technology is most appropriate?

Accepted Answer

VPLS. VPLS (Virtual Private LAN Service) provides multipoint-to-multipoint Ethernet connectivity over MPLS, emulating a LAN.

Answer

L3VPN

Answer

VPWS

Answer

E-Tree

Question 6

Refer to the exhibit. The router has three LDP neighbors established. A network administrator notices that MPLS labels for the prefix 10.4.4.0/24 are not being advertised from this router to its neighbors, although the prefix is present in the routing table. Which is the most likely cause?

Accepted Answer

The route to 10.4.4.0/24 is not the best path in the routing table.. The LDP neighbor for 10.4.4.4 (via 10.3.3.3) is up, but the router does not have a label for 10.4.4.0/24. This suggests the route is not being used for forwarding because of the IGP metric or administrative distance. Option A is wrong because the neighbor is up. Option C is wrong because LDP has been configured globally. Option D is wrong because there is no indication of an mroute issue.

Answer

The LDP session to 10.3.3.3 is down.

Answer

The 'mpls ldp' command has not been applied globally.

Answer

The multicast routing table is empty for the prefix.

Question 7

Which TWO are benefits of using Segment Routing over LDP in a service provider core?

Accepted Answer

Label allocation is per-prefix, not per-interface.. Segment Routing (SR) uses a centralized control plane (via PCE or BGP-LS) to allocate labels per prefix, unlike LDP which allocates labels per interface on a hop-by-hop basis. This reduces the number of labels in the control plane and simplifies label management, as SR-MPLS uses a single label stack entry per segment rather than per-interface labels.

Answer

Reduces the number of labels in the control plane.

Answer

Eliminates the need for IGP convergence for label distribution.

Answer

Simplifies MPLS TE tunnel configuration.

Question 8

You are a network automation engineer for a large service provider. Your team is tasked with automating the provisioning of new MPLS L3VPN services across a multi-vendor environment (Cisco and Juniper). The automation framework uses Ansible with Jinja2 templates and NETCONF as the transport protocol. During a pilot deployment, the automation successfully configures the Cisco devices but fails on Juniper devices with a 'syntax error' when applying the generated XML configuration. The Jinja2 templates are designed to generate Cisco-style configuration. You need to modify the automation to support both vendors. Which approach is most effective?

Accepted Answer

Use IETF YANG models and create separate Jinja2 templates for Cisco and Juniper that map to their respective native YANG models.. Using IETF YANG models (e.g., RFC 8299 for L3VPN) provides a vendor-neutral data model that both Cisco and Juniper support via NETCONF. Creating separate Jinja2 templates for each vendor ensures the generated XML conforms to each device's native YANG models, avoiding syntax errors. This approach maintains automation consistency while respecting vendor-specific implementations.

Answer

Write a Python script that translates Cisco XML to Juniper XML before sending.

Answer

Switch to CLI-based automation using SSH to avoid XML syntax issues.

Answer

Create a single Jinja2 template that uses conditional statements to generate different XML for each vendor.

Question 9

An engineer is troubleshooting an MPLS L3VPN where customers behind CE1 cannot reach a specific prefix behind CE2. The PE routers are using OSPF as the IGP and LDP for label distribution. On PE2, the prefix is present in the VRF routing table, but not in the VRF forwarding table. What is the most likely cause?

Accepted Answer

The route is missing a label in the LFIB on PE2.. The prefix is present in the VRF routing table (RIB) but missing from the VRF forwarding table (FIB) on PE2. This indicates that the route has been learned via BGP and installed in the RIB, but the MPLS VPN label (the inner label) required to forward the packet across the MPLS core is absent. Without a valid label in the LFIB, the CEF (FIB) cannot install the route, causing the reachability failure. Option D correctly identifies this missing label in the LFIB as the root cause.

Answer

MTU mismatch is causing the VPN label to be dropped.

Answer

OSPF is not redistributing the BGP routes into the IGP on PE2.

Answer

The VRF is not properly configured on PE2's interface toward CE2.

Question 10

A service provider is automating the provisioning of MPLS L3VPNs across multiple devices using NETCONF. During a deployment, the automation script fails with an error indicating that the device does not support the required YANG model. Which action should the engineer take to verify device capabilities?

Accepted Answer

Use the hello message exchange to check supported YANG modules via capabilities.. NETCONF hello message exchange includes the list of supported YANG modules in the capabilities. This is the standard way to discover device capabilities. Other options are either not standard or would not provide the required information.

Answer

Use CLI show command to list YANG models.

Answer

Use RESTCONF with GET to retrieve device capabilities.

Answer

Use SNMP to check device OID.

Question 11

Refer to the exhibit. The policy above is applied on a PE router. The customer complains that voice quality is poor. Based on the exhibit, what is the most likely cause?

Accepted Answer

The police rate for voice is too low for the offered traffic. The police rate for voice is too low for the offered traffic. Voice traffic requires a guaranteed bandwidth to maintain low jitter and packet loss; if the policer rate is set below the actual voice flow rate, packets are dropped or marked down, causing poor voice quality. In the exhibit, the voice class has a police rate that is insufficient for the offered load, leading to excessive drops.

Answer

The policy is applied to the wrong direction

Answer

The class-default is empty

Answer

The DATA class is not matching any traffic

Question 12

A service provider is deploying segment routing (SR) with MPLS data plane. The network uses OSPF as the IGP. Which configuration is required to enable SR-MPLS and ensure that routers advertise prefix-SIDs for their loopback interfaces?

Accepted Answer

Configure 'segment-routing mpls' globally and assign a prefix-SID to the loopback interface under OSPF.. To enable SR-MPLS with OSPF, you must globally enable segment routing with the 'segment-routing mpls' command, and then assign a prefix-SID to the loopback interface under the OSPF process using the 'prefix-sid' command. This ensures that routers advertise the prefix-SID for their loopback via OSPF extensions, which is the fundamental requirement for SR-MPLS operation without LDP.

Answer

Configure 'mpls ip' on all interfaces and 'router ospf 1 mpls ldp auto-config'.

Answer

Configure 'label mode per-prefix' under the OSPF process and assign a label to the loopback.

Answer

Configure 'segment-routing global-block 16000 23999' globally and enable 'mpls ip' on all interfaces.

Question 13

Refer to the exhibit. Which of the following is true about the BGP table?

Accepted Answer

The prefix 192.168.3.0/24 has two paths, with the best path selected based on some attribute.. The exhibit shows two paths for prefix 192.168.3.0/24: one via 10.4.4.4 with AS path 300 400 and one via 10.5.5.5 with AS path 300 500. BGP selects the best path based on a sequence of attributes (e.g., weight, local preference, AS path length, origin code, MED, etc.). Option B is correct because the prefix has two paths and BGP will choose one as best based on these attributes.

Answer

The route to 192.168.3.0/24 with path 300 400 has an origin of IGP.

Answer

The prefix 192.168.2.0/24 is not the best path because it has a lower local preference.

Answer

The route to 192.168.3.0/24 via 10.4.4.4 is the best path because it has a shorter AS path.

Question 14

A large ISP is designing a multicast architecture to support IPTV, requiring high availability and minimal traffic convergence. Which RP placement design is most appropriate?

Accepted Answer

Anycast-RP with multiple RPs sharing same IP. Anycast-RP with multiple RPs sharing the same IP address is the most appropriate design for a large ISP supporting IPTV because it provides high availability and load sharing without a single point of failure. In the event of an RP failure, traffic automatically converges to the nearest surviving RP using the same anycast address, minimizing disruption. This design also avoids the convergence delays inherent in dynamic RP discovery protocols like Auto-RP or BSR.

Answer

Single static RP placed on the core router

Answer

Auto-RP with one RP mapping agent

Answer

BSR with one candidate RP

Question 15

An SP engineer is configuring NTP authentication on IOS XR routers in the management plane. Which TWO statements about NTP authentication are correct? (Choose two.)

Accepted Answer

NTP authentication uses pre-shared keys to authenticate time sources. NTP authentication uses a symmetric key (MD5 or SHA) to authenticate NTP packets. The key must be trusted on the client. NTP authentication does not encrypt packets; it only provides integrity. Multiple keys can be configured.

Answer

NTP authentication is only supported on IOS XR, not on classic IOS

Answer

Only one NTP authentication key can be configured on a router

Answer

NTP authentication encrypts the NTP packets to ensure confidentiality

Question 16

An engineer is troubleshooting a QoS policy on a Cisco router. The policy is intended to mark voice traffic with DSCP EF and video traffic with DSCP AF41. After applying the policy, voice traffic is correctly marked, but video traffic is marked as DSCP 0. What is the most likely cause?

Accepted Answer

The class map for video traffic does not match the traffic correctly.. The most common reason for video traffic being marked as DSCP 0 (default) while voice traffic is correctly marked is that the class map for video traffic fails to match the intended packets. This could be due to an incorrect match statement (e.g., using the wrong ACL, protocol, or DSCP value) or a misconfigured match criterion that does not capture the video flows. Since voice traffic is marked correctly, the policy itself is applied and functional, isolating the issue to the video class map's matching logic.

Answer

The video traffic is being policed and dropped.

Answer

The trust boundary is set to 'trust dscp' and the incoming video traffic is not marked.

Answer

The policy is not applied to the correct interface direction.

Question 17

When automating service provisioning with NSO, which three components are part of the NSO architecture? (Choose three.)

Accepted Answer

YANG service model. The YANG service model is a core component of NSO architecture. It defines the service logic and data model that translates high-level service requests into device-specific configurations. NSO uses YANG to model both services and devices, enabling automation of service provisioning.

Answer

Java API

Answer

SNMP

Question 18

A service provider is troubleshooting an MPLS L3VPN issue where a CE router is receiving the VPN route from the PE but cannot ping the remote CE's loopback. The PE shows that the VPN label is assigned but cannot route the packets. Which command would help determine if the remote PE is correctly resolving the BGP next-hop via IGP?

Accepted Answer

show ip route bgp. 'show ip route bgp', is correct because the issue is that the remote PE cannot route packets to the BGP next-hop of the VPN route. The CE receives the route, but the PE cannot forward packets, indicating a missing or incorrect IGP route to the next-hop address. This command displays BGP routes in the global routing table, allowing you to verify if the next-hop is reachable via IGP (e.g., OSPF or IS-IS) and if the recursive routing is successful.

Answer

show mpls ldp neighbor

Answer

show ip route vrf CUST

Answer

show mpls forwarding-table vrf CUST

Question 19

An engineer is troubleshooting MPLS traffic engineering tunnels and needs to verify path calculation and RSVP errors. Which command should be used?

Accepted Answer

show mpls traffic-eng tunnels. The 'show mpls traffic-eng tunnels' command displays detailed information about MPLS TE tunnels, including path calculation status, RSVP signaling errors, and tunnel state. This command is specifically designed to verify TE tunnel operations and troubleshoot issues such as path computation failures or RSVP resource reservation problems.

Answer

show ip route

Answer

show mpls ldp neighbor

Answer

debug mpls lfib errors

Question 20

A network engineer is troubleshooting a NETCONF session that fails to establish between a controller and a router. The router supports NETCONF over SSH on port 830. The controller can reach the router but the session fails. What is the most likely cause?

Accepted Answer

The SSH host key of the router is not in the controller's known_hosts file. The most likely cause is that the SSH host key of the router is not in the controller's known_hosts file. NETCONF over SSH (RFC 6242) requires SSH transport, and the controller must authenticate the router's SSH host key during session establishment. If the host key is missing or mismatched, the SSH handshake fails, preventing the NETCONF session from starting, even though the router is reachable and NETCONF is enabled.

Answer

The router's NETCONF capability is disabled

Answer

The controller is using the wrong port (e.g., 22)

Answer

The router does not support YANG models