350-501 Timed Hard Questions — 25 Difficult Questions

Question 1

Which THREE components are required to deploy MPLS Layer 3 VPN?

Accepted Answer

VRFs on PE routers. VRFs (Virtual Routing and Forwarding) are required on PE routers to maintain separate, isolated routing tables for each customer VPN. This allows overlapping IP addresses between different customers and ensures that traffic from one VPN does not leak into another. Without VRFs, the PE router cannot distinguish between customer routes, making Layer 3 VPN operation impossible.

Answer

GRE tunneling

Answer

OSPF

Question 2

A network engineer is troubleshooting OSPFv3 on a service provider's IPv6 network. The router shows that OSPFv3 adjacency never reaches FULL, says 'Init'. The neighbor is directly connected over a point-to-point link. What is the most likely cause?

Accepted Answer

Missing 'ipv6 ospf' interface command on one side. The 'Init' state in OSPFv3 indicates that the router has received a Hello packet from the neighbor but the neighbor has not received a Hello packet back. On a point-to-point link, the most common cause is that the 'ipv6 ospf area ' interface command is missing on one side, which prevents OSPFv3 from sending Hellos on that interface. Without this command, the interface is not enabled for OSPFv3, so the neighbor never sees a Hello and the adjacency cannot progress to FULL.

Answer

LSA throttling prevents exchanges

Answer

Mismatched OSPF router-id

Answer

Mismatched area IDs

Question 3

Refer to the exhibit. An engineer is troubleshooting an MPLS LDP session between two routers. The output shows that the LDP session is operational. However, MPLS labels are not being exchanged. What is the most likely cause?

Accepted Answer

The LDP label advertisement mode is 'downstream on demand'.. The exhibit shows that the LDP session is operational (state = Operational), but no labels are being exchanged. In 'downstream on demand' mode, a router does not advertise labels unless explicitly requested by an upstream neighbor via a Label Request message. Since the session is up but no labels are exchanged, this mismatch in label advertisement mode is the most likely cause.

Answer

The peer's addresses are not bound to the LDP Ident.

Answer

The TCP connection is not using port 646.

Answer

The LDP session is not established.

Question 4

Which THREE of the following are benefits of using Segment Routing over LDP in an MPLS network? (Choose three.)

Accepted Answer

Enables traffic engineering without RSVP-TE.. Option A is correct because Segment Routing (SR) can perform traffic engineering using SR-TE policies (via a controller or PCEP) or SR Flexible Algorithm, without requiring RSVP-TE. This eliminates the complexity of RSVP-TE's soft-state signaling and per-LSP state maintenance, relying instead on source-routed segment lists encoded in the packet header.

Answer

Provides inherent security against label spoofing.

Answer

Requires BGP-LU for label distribution.

Question 5

In EVPN multihoming with all-active mode, what is the purpose of the aliasing capability?

Accepted Answer

It enables one PE to advertise MAC addresses for another PE in the same ES.. In EVPN all-active multihoming, the aliasing capability allows a PE that has learned a MAC address via local attachment to the Ethernet Segment (ES) to advertise that MAC address on behalf of other PEs in the same ES. This enables remote PEs to load-balance traffic destined to that MAC across all multihomed PEs, even if only one PE actually learned the MAC locally. Without aliasing, traffic would be forced to the specific PE that learned the MAC, defeating the purpose of all-active redundancy.

Answer

It permits the use of a single ESI label across all PEs in the ES.

Answer

It reduces the number of BGP updates by aggregating MAC routes.

Answer

It allows load balancing of traffic across all PEs.

Question 6

Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?

Accepted Answer

Only routes matching 10.1.0.0/16 or more specific will have the community added; other routes remain unchanged.. The configuration uses a route-map applied to the neighbor with a match clause referencing a prefix-list that permits 10.1.0.0/16 le 32. This matches the exact prefix and any more specific prefix (up to /32). The set community 65000:100 action adds the community without using the additive keyword, but because the route-map does not contain a deny clause for non-matching routes, all routes are still accepted; only matching routes have the community added. Thus, only routes matching 10.1.0.0/16 or more specific will have community 65000:100 added, and other routes remain unchanged.

Answer

Routes with a mask longer than /24 will be rejected by the prefix-list.

Answer

All routes from the customer will have their communities replaced with 65000:100.

Answer

Routes not matching the prefix-list will be denied and not installed.

Question 7

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

Accepted Answer

MCAST-VPN address family. In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Answer

MVPN does not use BGP; it uses PIM.

Answer

VPNv4 address family

Answer

IPv4 multicast address family

Question 8

Which THREE characteristics apply to the BGP-LS (BGP Link State) protocol?

Accepted Answer

It uses a separate address family from VPNv4.. BGP-LS uses a separate address family (AFI 16388 / SAFI 71) from VPNv4 (AFI 1 / SAFI 128) to carry link-state information. This separation allows BGP-LS to operate independently from VPNv4 routes, enabling the collection and distribution of IGP topology data without interfering with MPLS VPN signaling.

Answer

It supports only IS-IS, not OSPF.

Answer

It carries traffic-engineering parameters in the NLRI.

Question 9

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

Accepted Answer

The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.. The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Answer

The priority level is set too low; voice should be priority level 4.

Answer

The 'bandwidth remaining ratio' command under class-default is starving the priority queue.

Answer

The policy is applied in the output direction; it should be input.

Question 10

A network engineer is automating BGP configuration using the Cisco IOS-XE YANG model. They want to enable the 'always-compare-med' feature under BGP. Which XPath expression correctly targets this leaf?

Accepted Answer

/native/router/bgp/scope/global/always-compare-med. Option B is correct because the Cisco IOS-XE native YANG model (urn:cisco:params:xml:ns:yang:cisco-native) structures BGP configuration under /native/router/bgp/scope/global/always-compare-med. The 'scope' container is required to differentiate between global and VRF-specific BGP settings, and 'always-compare-med' is a leaf within the global scope. This path accurately reflects the hierarchical model used by Cisco for BGP automation.

Answer

/bgp/global/always-compare-med

Answer

/native/router/bgp/always-compare-med

Answer

/router/bgp/global/always-compare-med

Question 11

A service provider is troubleshooting BGP route advertisement for a VPNv4 prefix. The PE router receives the prefix from the route reflector but does not install it in the VRF routing table. The BGP table shows the prefix as valid but not best. What is the most likely cause?

Accepted Answer

The next-hop is not reachable via the IGP with an MPLS label.. For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

Answer

The VRF does not have the correct route-target import.

Answer

The BGP table is full and cannot accept more prefixes.

Answer

The MPLS label is missing in the BGP update.

Question 12

A service provider uses an MPLS-TE tunnel to carry voice and data traffic. The tunnel is experiencing packet loss during congestion. The engineer wants to ensure that voice traffic receives guaranteed bandwidth and low latency while data traffic uses remaining bandwidth. Which QoS configuration should be applied on the tunnel interface?

Accepted Answer

LLQ with a priority queue for voice and a default class for data. Option A is correct because Low Latency Queuing (LLQ) allows you to place voice traffic into a strict priority queue, ensuring guaranteed bandwidth and low latency during congestion, while the default class uses CBWFQ to allocate remaining bandwidth to data traffic. This matches the requirement of prioritizing voice without starving data entirely, as the priority queue is policed to prevent voice from consuming all bandwidth.

Answer

CBWFQ with bandwidth allocation for voice and data

Answer

Policing on voice traffic to limit its rate

Answer

Shaping on the tunnel to 75% of bandwidth with no queuing

Question 13

Refer to the exhibit. An engineer is configuring Segment Routing for BGP (BGP-SR) on a PE router to assign labels to prefixes learned from a CE. The route-policy SET-LABEL is applied to the neighbor under the address-family ipv4 unicast. However, the CE prefix 10.1.1.0/24 is not receiving the label. What is the most likely reason?

Accepted Answer

The neighbor is missing 'send-community extended' under address-family ipv4 unicast.. For BGP-SR (Segment Routing for BGP) to advertise labels for prefixes learned from a CE, the neighbor must be configured with 'send-community extended' under the address-family. This is because BGP-SR uses the BGP Prefix-SID attribute, which is carried as an extended community. Without this command, the PE will not send the label information to the CE, even if the route-policy is correctly applied.

Answer

The route-policy syntax is incorrect; 'destination' should be 'ip prefix-list'.

Answer

The update-source should be the interface facing the CE, not Loopback0.

Answer

The 'set label-index' command should be 'set label' for BGP-SR.

Question 14

A network engineer is designing a Layer 2 VPN using EVPN with MPLS data plane. The customer requires all-hub multipoint connectivity with optimal multicast replication. Which EVPN route type is used to advertise multicast group membership?

Accepted Answer

Route Type 6 (Selective Multicast Ethernet Tag). Route Type 6 (Selective Multicast Ethernet Tag) is used in EVPN to advertise multicast group membership for selective multicast replication. This allows the provider edge (PE) routers to build optimal multicast trees for specific groups, enabling efficient all-hub multipoint connectivity with EVPN-MPLS data plane.

Answer

Route Type 3 (Inclusive Multicast Ethernet Tag)

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 4 (Ethernet Segment)

Question 15

A network engineer needs to design a multicast solution for IPTV distribution across a service provider network. Which protocol is best suited for building a shared distribution tree where the RP is dynamically elected?

Accepted Answer

PIM-SM with BSR. PIM-SM with BSR (Bootstrap Router) is the correct choice because it provides a dynamic, automated mechanism for electing an RP (Rendezvous Point) within a PIM-SM domain. BSR uses a distributed election process where candidate BSRs exchange bootstrap messages to elect a single BSR, which then collects candidate-RP advertisements and distributes the RP-set to all routers, enabling shared distribution trees without manual RP configuration.

Answer

PIM-DM

Answer

PIM-SM with Auto-RP

Answer

MSDP

Question 16

A service provider is designing a QoS policy for a multi-service MPLS VPN network that carries voice, video, and data traffic. The network uses DiffServ and MPLS EXP markings. The design must ensure that voice traffic is given priority over video and data, while video traffic should have better treatment than data but not at the expense of voice. The provider plans to use a hierarchical QoS (HQoS) policy at the PE-CE interfaces. Which configuration approach best meets these requirements?

Accepted Answer

Apply a parent policy with a shape for the total bandwidth and a child policy with LLQ for voice and CBWFQ for video and data.. Option C is correct because hierarchical QoS (HQoS) allows the service provider to enforce a total bandwidth shape at the parent level while using a child policy to apply LLQ for voice (ensuring strict priority) and CBWFQ for video and data (ensuring video gets better treatment than data without starving voice). This meets the requirement that video should not degrade voice, as the parent shape prevents any single class from monopolizing the link, and the child policy’s LLQ guarantees voice priority over all other traffic.

Answer

Mark voice traffic with EXP 5, video with EXP 4, and data with EXP 0, and rely on the core to prioritize based on EXP.

Answer

Use a single-level policy with LLQ for voice and video together, and CBWFQ for data.

Answer

Apply class-based shaping to each traffic class separately on the interface.

Question 17

An SP uses BGP FlowSpec to mitigate DDoS attacks. They also want to rate-limit the traffic per FlowSpec rule. Which configuration is required to enable policing within a FlowSpec action?

Accepted Answer

Include the 'rate-limit' action in the FlowSpec rule using the 'action' clause.. Option D is correct because BGP FlowSpec allows the inclusion of a 'rate-limit' action within the FlowSpec rule's 'action' clause to enforce policing. This action directly applies a traffic rate limit (in bits per second) to the matched flow, enabling DDoS mitigation without requiring external QoS policies or MPLS TE reservations.

Answer

Configure MPLS TE bandwidth reservation for the FlowSpec routes.

Answer

Use policy-based routing (PBR) to set QoS parameters.

Answer

Apply a QoS policy-map to the interface and match the FlowSpec destination.

Question 18

Refer to the exhibit. A network automation engineer uses NETCONF to retrieve the QoS policy 'POLICE-CUSTOMER'. Based on the response, what is the effect of this policy?

Accepted Answer

It polices all traffic to a maximum of 256 kbps and drops excess.. The NETCONF response shows a 'police' configuration under the QoS policy 'POLICE-CUSTOMER' with a committed information rate (CIR) of 256000 bps (256 kbps) and a conform-action of 'transmit' with an exceed-action of 'drop'. This is a standard policing action that meters traffic to the specified rate and drops any packets that exceed it, as defined in RFC 2697 (Single Rate Three Color Marker). Option A correctly identifies this behavior.

Answer

It sets DSCP CS4 on traffic exceeding 256 kbps.

Answer

It guarantees a priority queue for traffic up to 256 kbps.

Answer

It shapes traffic to an average rate of 256 kbps.

Question 19

An SP router is configured with a hierarchical QoS policy (parent policy shaper, child policy with CBWFQ). When applying this policy to an interface, the router reports 'Policy map not found' error. What is the most likely cause?

Accepted Answer

The child policy-map specified in the parent's 'service-policy' command does not exist.. The 'Policy map not found' error occurs when the parent policy-map references a child policy-map via the 'service-policy' command, but that child policy-map does not exist in the router's configuration. Hierarchical QoS requires both the parent and child policy-maps to be created and correctly named; a missing child policy-map prevents the router from applying the nested policy.

Answer

The interface speed is not configured.

Answer

The interface is not part of a bridge domain.

Answer

The shape average command in the parent policy uses an unsupported value.

Question 20

An enterprise uses IPsec VPN to connect branch offices. They apply QoS policies on the tunnel interface but notice that original DSCP markings are not preserved after encryption. Which feature should be enabled to maintain end-to-end QoS?

Accepted Answer

QoS pre-classify. When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.

Answer

AutoQoS

Answer

MPLS TE

Answer

NBAR