350-501 Practice Test 7 — 10 Questions

Question 1

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 2

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS

Question 3

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0

Question 4

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 5

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

Accepted Answer

The route-target on the new PEs does not match the existing VPLS context. B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Answer

The BGP neighbor is not activated under the VPLS address-family

Answer

The MTU mismatch between PEs

Answer

The VFI name is not consistent across PEs

Question 6

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. SSH provides encrypted remote access, and SNMPv3 with encryption and authentication secures monitoring. Telnet and SNMPv2c are insecure. Disabling all access is not practical.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access

Question 7

An ISP is implementing 6PE to provide IPv6 connectivity over an MPLS network that only supports IPv4 in the core. In 6PE, how are IPv6 prefixes carried across the MPLS backbone?

Accepted Answer

IPv6 prefixes are carried as IPv6 prefixes in MP-BGP with an IPv4 next-hop. 6PE uses MP-BGP to carry IPv6 prefixes (using the IPv6 unicast address family, AFI=2 SAFI=1) with an IPv4 next-hop address (the loopback of the peer 6PE router). The BGP session is over IPv4, but the NLRI carries IPv6 prefixes. MPLS labels are used to forward traffic across the IPv4-only core. It is important to note that 6PE does not use the VPNv6 address family (AFI=1 SAFI=128) — that is used for MPLS L3VPN.

Answer

IPv6 prefixes are transported over an IPv6 MPLS core using LDPv6

Answer

IPv6 prefixes are encapsulated in IPv4 tunnels with GRE

Answer

IPv6 prefixes are converted to IPv4 using NAT64 before MPLS forwarding

Question 8

An SP engineer is implementing DSCP classification at the edge. Which two AF classes are typically used for mission-critical data? (Choose two.)

Accepted Answer

AF41. AF4x (e.g., AF41/AF42/AF43) and AF3x (e.g., AF31/AF32/AF33) are used for high-priority data. AF1x is low-priority.

Answer

CS0

Answer

AF11

Answer

AF22

Question 9

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

Accepted Answer

NAT with VRF awareness. NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

Answer

Static default route from VRF to global

Answer

Route leaking between VRF and global

Answer

VRF-Aware Firewall

Question 10

An SP engineer is configuring QoS on a router and needs to drop traffic that exceeds a certain rate while allowing bursts up to a specified amount. Which QoS feature should be used?

Accepted Answer

Policing. Policing is the correct QoS feature because it drops traffic that exceeds a configured rate while allowing bursts up to a specified amount. Unlike shaping, which buffers excess traffic, policing enforces a rate limit by immediately dropping or re-marking packets that exceed the configured committed information rate (CIR) and burst size (Bc/Be). This matches the requirement to drop traffic that exceeds a certain rate while permitting bursts.

Answer

Shaping

Answer

WRED

Answer

Queueing