350-501 Hard Questions — 25 Difficult Questions

Question 1

A service provider is implementing 6VPE to provide IPv6 L3VPN services. Which two statements about 6VPE are true?

Accepted Answer

6VPE supports overlapping IPv6 address spaces between different VPNs.. 6VPE uses MP-BGP extensions with AFI 2 (IPv6) and SAFI 128 (MPLS-labeled VPN address family) to exchange VPN-IPv6 routes. It supports overlapping IPv6 address spaces between different VPNs by using route distinguishers. PE routers do not require IPv6 connectivity to the MPLS core; the core can be IPv4-only with MPLS. 6VPE does not require a full IPv6 routing table on the PE, and it uses MPLS encapsulation, not GRE.

Answer

6VPE PE routers must have IPv6 connectivity to the MPLS core.

Answer

6VPE requires a full IPv6 routing table on the PE router.

Answer

6VPE encapsulates IPv6 packets using GRE tunnels.

Question 2

In a hierarchical QoS policy applied to a subscriber aggregation interface, the parent policy shapes to 100 Mbps and the child policy allocates 50% bandwidth to voice and 50% to data. If voice traffic exceeds 50 Mbps, what happens to the excess?

Accepted Answer

Excess voice is dropped or re-marked. The child policy's police command within LLQ drops or re-marks voice traffic exceeding the configured bandwidth to prevent starvation of other queues.

Answer

Excess voice is queued in the data queue

Answer

Excess voice is shaped by the parent policy

Answer

Excess voice is forwarded with best effort

Question 3

An SP is troubleshooting an MPLS L2VPN VPLS network where MAC flapping is occurring between two PEs. Which mechanism in VPLS prevents loops and ensures that a broadcast frame from one PE is not reflected back to the originating PE?

Accepted Answer

Split horizon. In a VPLS environment, split horizon is the mechanism that prevents loops by ensuring that a broadcast, multicast, or unknown unicast frame received from a pseudowire (PW) is never forwarded back to any other PW on the same PE. This rule, defined in RFC 4761 and RFC 4762, stops the originating PE from receiving its own reflected frames, thus eliminating the MAC flapping that would occur if the frame were looped through the MPLS core.

Answer

Spanning Tree Protocol (STP)

Answer

Rapid Spanning Tree Protocol (RSTP)

Answer

MAC address aging

Question 4

An engineer configures an SR-TE policy with a segment list containing adjacency SIDs. The required path includes a strict loose hop through a specific router. Which segment type should be used for the strict hop?

Accepted Answer

Adjacency SID for the desired link.. Adjacency SIDs force the packet to traverse a specific link. For a strict hop, the adjacency SID ensures the packet goes through that exact link. A Node SID would allow any path to the node.

Answer

Anycast SID for the group containing the router.

Answer

Binding SID (BSID) of another policy.

Answer

Node SID (Prefix SID) of the router.

Question 5

Refer to the exhibit. Which statement about this BGP configuration is true?

Accepted Answer

The next-hop-self command ensures that the PE sets itself as the next-hop for routes advertised to the route reflector.. The `next-hop-self` command under the VRF address-family instructs the PE router to set its own IP address as the next-hop for routes advertised to the route reflector. This is necessary in MPLS L3VPN environments to ensure that the route reflector (and other PEs) can reach the customer prefix via the advertising PE, avoiding reachability issues when the original next-hop is not directly connected across the MPLS core.

Answer

The no synchronization command is invalid under address-family ipv4 vrf.

Answer

The send-community extended command is only needed for IPv4 unicast address family.

Answer

The redistribute ospf command will import OSPF routes into the VRF but not into BGP.

Question 6

An SP deploys EVPN to provide L2VPN services with multi-homing. The customer CE is dual-homed to two different PE routers. Which EVPN mechanism ensures that only one PE forwards traffic to the CE for a given Ethernet segment, preventing loops?

Accepted Answer

Designated Forwarder election based on ESI. Ethernet Segment Identifier (ESI) and designated forwarder (DF) election in EVPN ensure that only one PE forwards traffic to the CE for a given Ethernet segment, preventing loops.

Answer

BGP Route Reflector

Answer

MAC learning via data plane

Answer

Split horizon groups

Question 7

In an MPLS L3VPN network with route reflectors, what is the default behavior regarding the BGP next-hop attribute for reflected VPNv4 routes?

Accepted Answer

It leaves the next-hop unchanged from the originating PE.. In an MPLS L3VPN network with route reflectors, the default behavior for VPNv4 routes is that the route reflector does not modify the BGP next-hop attribute. This is because the next-hop should remain the address of the originating PE router to ensure proper MPLS label switching and reachability. Changing the next-hop would break the MPLS forwarding path, as the P routers rely on the IGP to reach the PE's loopback, not the route reflector's.

Answer

It sets the next-hop to 0.0.0.0.

Answer

It removes the next-hop attribute.

Answer

It sets the next-hop to the route reflector's loopback.

Question 8

A service provider is deploying a new MPLS core with Segment Routing and requires fast convergence upon link failure. They plan to use TI-LFA (Topology Independent Loop-Free Alternate). What is a prerequisite for TI-LFA to provide protection against any single link failure?

Accepted Answer

IGP must be a link-state protocol with complete topology information (OSPF or IS-IS).. TI-LFA relies on the IGP having a complete view of the network topology to compute a post-convergence path that avoids the failed link. OSPF and IS-IS are link-state protocols that flood link-state advertisements (LSAs) or link-state packets (LSPs) to provide this full topology database, which is essential for TI-LFA to calculate a loop-free backup path for any single link failure.

Answer

BGP-LU must be enabled for label distribution.

Answer

LDP must be enabled on all interfaces.

Answer

RSVP-TE must be configured with FRR.

Question 9

An operator is deploying EVPN-VPWS over an MPLS network. Which component uniquely identifies a multihomed Ethernet segment in EVPN?

Accepted Answer

Ethernet Segment Identifier (ESI). The Ethernet Segment Identifier (ESI) is a unique identifier for a multihomed segment. It is used for DF election, aliasing, and split-horizon.

Answer

Ethernet Tag ID

Answer

Route Distinguisher (RD)

Answer

MPLS Label

Question 10

An SP detects a volumetric DDoS attack targeting a customer network. The SP uses Cisco's S/RTBH technique to drop attack traffic. Which action is performed by the edge routers upon receiving a BGP route with a specific community?

Accepted Answer

The edge router installs a /32 route pointing to a discard interface. S/RTBH works by advertising a /32 prefix (the victim's IP) with a special BGP community (e.g., NO_EXPORT) and a next-hop of the discard interface (e.g., Null0). Edge routers install the route pointing to Null0, dropping traffic to that IP.

Answer

The edge router applies a BGP FlowSpec rule to rate-limit the traffic

Answer

The edge router forwards the attack traffic to a scrubbing center

Answer

The edge router sends ICMP unreachable messages to the attacker

Question 11

Refer to the exhibit. An engineer pushes this XML configuration via NETCONF, but the device rejects it with an error stating 'invalid policy-map structure'. What is the problem?

Accepted Answer

The class name must be defined in a class-map before being referenced in the policy-map. The error 'invalid policy-map structure' occurs because the policy-map references a class name that has not been defined in a class-map beforehand. In Cisco IOS, a class-map must exist before it can be used inside a policy-map; otherwise, the device rejects the configuration as structurally invalid.

Answer

The configuration is missing the class-default class

Answer

The YANG model does not support the 'police' keyword

Answer

The priority and police commands cannot coexist in the same class

Question 12

Based on the exhibit, what is the purpose of the 'mpls ldp neighbor ... password cisco' commands?

Accepted Answer

To authenticate the LDP session using MD5.. The 'mpls ldp neighbor ... password cisco' command configures a Message Digest 5 (MD5) authentication password for the LDP session with a specific neighbor. This ensures that the TCP connection used for LDP exchanges is authenticated, preventing spoofed or unauthorized LDP messages from being accepted, as defined in RFC 5036.

Answer

To synchronize LDP and IGP convergence.

Answer

To control the label allocation for prefixes from that neighbor.

Answer

To enable LDP session protection for the neighbor.

Question 13

Based on the exhibit, why is the route 10.10.10.0/24 from remote PE not installed in the VRF Customer-A on PE1?

Accepted Answer

The VRF imports route-target 200:200, but the route has RT 100:100. The route has RT 100:100, but VRF Customer-A imports RT 200:200. Thus, the route is not imported. Option A is wrong because the localpref is 100, which is default and not an issue. Option C is wrong because the RD mismatch is between VRFs, but RD does not affect import; RT does. Option D is wrong because label allocation is working fine (vpn-label:24000).

Answer

The localpref is too low (100)

Answer

The MPLS label allocation failed on the remote PE

Answer

The route distinguisher on the VRF (100:1) does not match the remote RD

Question 14

An SP router is configured with a hierarchical QoS policy (parent policy shaper, child policy with CBWFQ). When applying this policy to an interface, the router reports 'Policy map not found' error. What is the most likely cause?

Accepted Answer

The child policy-map specified in the parent's 'service-policy' command does not exist.. The 'Policy map not found' error occurs when the parent policy-map references a child policy-map via the 'service-policy' command, but that child policy-map does not exist in the router's configuration. Hierarchical QoS requires both the parent and child policy-maps to be created and correctly named; a missing child policy-map prevents the router from applying the nested policy.

Answer

The interface speed is not configured.

Answer

The interface is not part of a bridge domain.

Answer

The shape average command in the parent policy uses an unsupported value.

Question 15

During a maintenance window, an automation script pushed a QoS policy that inadvertently changed the marking for all inbound traffic on a core interface. The change was rolled back, but performance reports show that some traffic is still being marked incorrectly. What is the most logical explanation?

Accepted Answer

The rolled back policy was applied inbound, but the outbound policy that also applies marking was not rolled back. QoS policies can be applied independently in the inbound and outbound directions on an interface. If the original automation script modified the inbound marking policy, and the rollback only reverted that inbound policy, any outbound policy that also performs marking would remain unchanged and continue to incorrectly mark traffic. This explains why some traffic still shows incorrect marking after the rollback.

Answer

The automation script used RESTCONF which requires a commit to finalize

Answer

The device requires a reload to clear the old marking

Answer

The rollback script only applied to the outbound direction

Question 16

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Accepted Answer

6VPE. 6VPE (IPv6 VPN Provider Edge) requires a dedicated control plane per VPN instance because it uses separate per-VPN routing tables and a distinct BGP session (typically MP-BGP with the IPv6 address family) to exchange IPv6 VPN routes. This ensures that each customer's IPv6 routing information is isolated and processed independently, which is a core requirement for L3VPN services that maintain per-VPN forwarding and control plane separation.

Answer

VPLS

Answer

MDT VPN

Question 17

A network engineer is designing a Layer 2 VPN using EVPN with MPLS data plane. The customer requires all-hub multipoint connectivity with optimal multicast replication. Which EVPN route type is used to advertise multicast group membership?

Accepted Answer

Route Type 6 (Selective Multicast Ethernet Tag). Route Type 6 (Selective Multicast Ethernet Tag) is used in EVPN to advertise multicast group membership for selective multicast replication. This allows the provider edge (PE) routers to build optimal multicast trees for specific groups, enabling efficient all-hub multipoint connectivity with EVPN-MPLS data plane.

Answer

Route Type 3 (Inclusive Multicast Ethernet Tag)

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 4 (Ethernet Segment)

Question 18

In SRv6, which SID behavior is used to achieve L3VPN IPv6 VPN forwarding, where the SID points to a VPN instance and performs decapsulation and IPv6 lookup?

Accepted Answer

End.DT6. End.DT6 is the SRv6 endpoint behavior for L3VPN over IPv6, performing decapsulation and lookup in the appropriate VPN routing table.

Answer

End.X

Answer

End.DT2U

Answer

End.DT4

Question 19

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

Accepted Answer

Add the 'sr-protect' option under the fast-reroute configuration to enable node protection. For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence. Option D is wrong because there is no need for an additional LDP backup.

Answer

Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

Answer

Reduce the IGP timers and enable incremental SPF to accelerate convergence

Answer

Deploy LDP as a fallback label distribution protocol to provide additional backup paths

Question 20

A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?

Accepted Answer

VPWS. VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.

Answer

EVPN

Answer

L3VPN

Answer

VPLS