350-501 Multiple Select — 20 Questions

Question 1

An engineer is troubleshooting an MPLS network where some routers are not exchanging labels via LDP. Which two steps are most appropriate for diagnosing the issue? (Choose two.)

Accepted Answer

Verify LDP neighbor adjacencies using 'show mpls ldp neighbor'.. Option A is correct because 'show mpls ldp neighbor' displays the state of LDP sessions (Operational, Non-existent, etc.) and the TCP connection status to each peer, which directly reveals whether label distribution adjacencies are forming. Option E is correct because LDP only runs on interfaces where 'mpls ip' (or 'mpls ldp' on some platforms) is enabled, and 'show mpls ldp interface' confirms which interfaces are actively participating in LDP label exchange. Option B is not appropriate because MTU mismatches typically affect data forwarding or IGP adjacency formation, not the LDP session establishment itself. Option C is not appropriate because rebooting routers is a disruptive action that does not diagnose the root cause of failed LDP sessions. Option D is not appropriate because while LDP relies on underlying IP reachability (often provided by OSPF), verifying OSPF adjacencies alone does not confirm LDP-specific configuration or session state.

Answer

Check the MTU size on all interfaces.

Answer

Reboot all routers to reset LDP sessions.

Answer

Verify that OSPF neighbor relationships are established.

Question 2

Which TWO statements about QoS policy propagation via BGP (QPPB) are correct?

Accepted Answer

QPPB can be applied on inbound direction only.. QPPB can be applied on inbound direction only. QPPB uses BGP policy to classify traffic based on IP precedence or QoS group, and the classification is performed on incoming traffic before any routing decision. The outbound direction is not supported for QPPB classification.

Answer

QPPB is an IETF standard.

Answer

It uses MPLS EXP bits to propagate QoS.

Answer

It dynamically adjusts BGP attributes based on QoS policy.

Question 3

Which three of the following are valid methods for protecting a pseudowire in an MPLS network?

Accepted Answer

Multi-segment PW with backup. Multi-segment PW (MS-PW) with backup is a valid protection method because it allows a pseudowire to be established across multiple MPLS segments, with a backup PW path that can take over if the primary MS-PW fails. This provides end-to-end pseudowire redundancy by using a secondary switched path, ensuring service continuity in multi-domain or multi-area MPLS networks.

Answer

Ethernet OAM CFM

Answer

LSP ping for fault detection

Question 4

Which three BGP attributes are considered in the route selection process before comparing MED? (Choose three.)

Accepted Answer

Weight. The order: weight, local pref, originate (locally originated), AS_PATH length, ORIGIN, MED. So weight, local pref, and AS_PATH length are before MED.

Answer

MED

Answer

Router ID

Question 5

Which two statements correctly describe the use of DSCP values in the DiffServ model? (Choose two.)

Accepted Answer

DSCP is a 6-bit field allowing 64 distinct values.. DSCP is a 6-bit field with 64 possible values. Per-hop behaviors (PHBs) like EF and AF are defined by DSCP values.

Answer

DSCP values are mapped to MPLS EXP bits at the egress PE.

Answer

DSCP values are used only for voice traffic.

Answer

DSCP value 0 indicates low latency traffic.

Question 6

Which TWO are benefits of using EVPN over traditional VPLS for L2VPN services? (Choose two.)

Accepted Answer

Provides MAC address learning via control plane. EVPN offers better control plane (BGP) and supports multi-homing with all-active load balancing.

Answer

Uses LDP for label distribution

Answer

Requires full mesh of pseudowires

Answer

Simpler configuration than VPLS

Question 7

Which THREE of the following are benefits of using EVPN over traditional VPLS for L2VPN services? (Select three.)

Accepted Answer

Integrated L2 and L3 services (e.g., IRB). EVPN offers BGP control plane, multi-homing with ESI, and integrated L2/L3 services.

Answer

Supports only point-to-point pseudowires

Answer

Eliminates the need for VPLS

Question 8

A service provider is designing an OSPF network with multiple areas. Which TWO area types allow external routes (Type 5 LSAs) to be injected into the area? (Choose two.)

Accepted Answer

Standard area. Option B (Standard area) is correct because a standard OSPF area accepts all LSA types, including Type 5 external LSAs originated by ASBRs, so external routes can be injected and flooded throughout it. Option D (Backbone area, Area 0) is correct because the backbone is a normal (non-stub) area that permits Type 5 LSAs; in fact, external routes are typically injected at an ASBR and propagated across Area 0 to other areas. The unmarked options do not belong: an NSSA (A) blocks Type 5 LSAs and instead uses Type 7 LSAs that are translated to Type 5 only at the ABR, a stub area (C) blocks Type 5 LSAs entirely, and a totally stubby area (E) blocks Type 5 LSAs as well as Type 3 and Type 4 LSAs, relying solely on a default route.

Answer

NSSA

Answer

Stub area

Answer

Totally stubby area

Question 9

A service provider is implementing MAP-T (Mapping of Address and Port using Translation) to transition customers from IPv4 to IPv6. Which two characteristics of MAP-T are true? (Choose two.)

Accepted Answer

MAP-T employs a Border Router that performs translation between IPv4 and IPv6. MAP-T uses stateful or stateless translation between IPv4 and IPv6, and it uses a Border Router (BR) that performs translation. MAP-T does not use encapsulation; it uses translation (NAT). MAP-T also uses a Domain Name System (DNS) but that is not unique. The key characteristics: it uses a BR for translation and can be stateless.

Answer

MAP-T is primarily used for IPv6-to-IPv4 communication only

Answer

MAP-T requires a dedicated IPv6 prefix for each customer

Answer

MAP-T uses encapsulation to transport IPv4 packets over an IPv6 network

Question 10

An engineer is configuring EVPN IRB (Integrated Routing and Bridging) to provide IP connectivity between tenants across a service provider network. Which THREE components are essential for EVPN IRB operation? (Choose three.)

Accepted Answer

IP-VRF for each tenant.. Option B is correct because EVPN IRB requires an IP-VRF (Layer 3 VRF) per tenant to hold the tenant's IP routing table and to import/export IP prefixes via EVPN Type 5 (IP Prefix) routes, enabling inter-subnet routing across the fabric. Option C is correct because the IRB interface (Bridge Domain Interface / BDI) acts as the distributed anycast Layer 3 gateway for the tenant subnet, tying the Layer 2 bridge domain to the IP-VRF and sourcing the MAC/IP Advertisement (Type 2) routes used for ARP suppression and host mobility. Option E is correct because each tenant needs an Ethernet VPN Instance (EVI) with a unique Route Distinguisher (and typically a Route Target) to keep tenant MAC/IP and IP-prefix routes separate in BGP EVPN, ensuring proper isolation and import/export of routes. Option A is not essential because EVPN IRB relies on BGP EVPN for MAC/IP and IP-prefix signaling, not on LDP or SR for label distribution; MPLS or VXLAN encapsulation can be used, but LDP/SR is not a required component. Option D is not essential because MPLS-TE tunnels are an optional transport optimization and are not required for EVPN IRB operation, which can run over plain MPLS, VXLAN, or other underlays.

Answer

LDP or SR for label distribution.

Answer

MPLS-TE tunnels for transport.

Question 11

Which TWO statements about MPLS label operations are correct? (Choose two.)

Accepted Answer

At the ingress LSR, a label is pushed onto the packet.. Option B is correct because the ingress LSR (ingress edge router of the MPLS domain) imposes a label on the incoming IP packet, an operation known as a label push, before forwarding it into the MPLS core. Option E is correct because an intermediate LSR (transit router) performs a label swap, replacing the incoming label with the outgoing label found in its LFIB (Label Forwarding Information Base) entry for that FEC. Options A, C, and D are incorrect: label operations in the MPLS core are driven by the incoming label value, not the IP destination address; the ingress LSR pushes rather than pops labels; and the egress LSR pops (removes) the label rather than swapping it.

Answer

Label operations are performed based on the IP destination address.

Answer

At the ingress LSR, the label is popped.

Answer

At the egress LSR, a label is swapped.

Question 12

Which TWO of the following are characteristics of MPLS L3VPN architecture? (Choose two.)

Accepted Answer

Each customer has a separate VRF on the PE router. Option B is correct because in an MPLS L3VPN, each customer (or VPN) is mapped to a separate VRF on the PE router, which isolates customer routing tables and allows overlapping IP address spaces to coexist. Option E is correct because customer IP prefixes are distributed between PE routers as VPNv4 routes via MP-BGP (multiprotocol BGP) using route targets and route distinguishers to maintain VPN membership. Option A is incorrect because MPLS L3VPN traffic is not forwarded by label switching alone; PE routers perform IP lookup within the VRF and impose labels, and the first hop may be IP-based. Option C is incorrect because LDP is not strictly required in the core; label distribution can be provided by RSVP-TE, SR (Segment Routing), or other mechanisms. Option D is incorrect because P routers only maintain the global IGP routing table and forward labeled packets; they do not hold per-VPN routing tables, which reside on PE routers.

Answer

All traffic is forwarded using MPLS label switching only

Answer

LDP is required for label distribution in the core

Answer

The P routers maintain a full routing table for each VPN

Question 13

An SP uses NSO for automation. Which TWO protocols can NSO use as southbound interfaces to communicate with network devices? (Choose two.)

Accepted Answer

RESTCONF. RESTCONF is a southbound interface that NSO uses to communicate with network devices. It is a RESTful protocol that uses HTTP methods (GET, POST, PUT, DELETE) to access YANG-defined data models, making it suitable for modern programmable devices. NSO leverages RESTCONF to configure and manage devices that support this protocol, providing a standardized, stateless interface for automation.

Answer

gRPC

Answer

SNMP

Answer

HTTP

Question 14

During QoS troubleshooting, you capture traffic and see that DSCP markings are not being applied as configured. Which two common misconfigurations could cause this? (Choose two.)

Accepted Answer

The policy-map is not applied to the correct interface direction (input vs output). A policy-map must be applied in the correct direction (input or output) for the marking to take effect. If a marking policy is applied to the wrong direction, the packets will not be processed by the policy, and DSCP values will remain unchanged. This is a common misconfiguration when the intended marking should occur on ingress but the policy is applied to egress, or vice versa.

Answer

The policy-map is applied to a loopback interface

Answer

The marking is configured under the wrong policy-map

Answer

The device is running out of TCAM space

Question 15

Which TWO are characteristics of Segment Routing (SR-MPLS)? (Choose two.)

Accepted Answer

It relies on source routing. Option A is correct because SR-MPLS is fundamentally a source-routing architecture: the ingress node (headend) encodes the entire path as an ordered list of SIDs in the MPLS label stack, so intermediate nodes simply forward based on the top label without needing per-flow state. Option E is correct because Segment Routing is data-plane agnostic and can be instantiated over an MPLS data plane (SR-MPLS, using MPLS labels as SIDs) or over an IPv6 data plane (SRv6, using IPv6 addresses as SIDs), which is a defining characteristic of the SR architecture. Option B is incorrect because SR-MPLS does not require a centralized controller; distributed path computation via IGP (IS-IS/OSPF) extensions is sufficient, and a controller (e.g., PCE/SR-PCE) is optional for advanced TE. Option C is incorrect because SR-MPLS forwards based on the top MPLS label (SID) in the stack, not by performing a destination-IP lookup at each hop. Option D is incorrect because SR-MPLS explicitly removes the need for LDP; label/SID distribution is handled by IGP extensions (or BGP), making LDP unnecessary.

Answer

It requires a centralized controller for traffic engineering

Answer

It forwards packets based on destination IP address at each hop

Answer

It requires MPLS LDP for label distribution

Question 16

Which TWO protocols are supported by a BNG (Broadband Network Gateway) for subscriber session establishment? (Choose two)

Accepted Answer

PPPoE. PPPoE (A) is correct because a BNG terminates PPPoE sessions, using PPP negotiation (LCP, authentication via PAP/CHAP, IPCP) to establish and manage each subscriber session over Ethernet access networks. IPoE (DHCP) (B) is also correct because a BNG supports IPoE subscriber sessions where DHCP (with Option 82 or similar) is used to assign addresses and trigger session creation, often with per-subscriber policies. IPSec (C) is a security protocol suite for VPNs, not a subscriber session establishment method on a BNG. L2TP (D) is a tunneling protocol often used with LAC/LNS architectures, not a native BNG subscriber session type. PPPoA (E) is used over ATM access, not supported as a BNG subscriber session establishment protocol in this context.

Answer

IPSec

Answer

L2TP

Answer

PPPoA

Question 17

In IS-IS, which TWO are types of Link State PDUs (LSPs)?

Accepted Answer

Level 2 LSP. In IS-IS, Link State PDUs (LSPs) come in two distinct flooding scopes: Level 1 LSPs, which are flooded only within a Level 1 area, and Level 2 LSPs, which are flooded within the Level 2 backbone. Option B (Level 2 LSP) is correct because it is the LSP type used to distribute Level 2 link-state information (TLVs) across the backbone. Option E (Level 1 LSP) is correct because it is the LSP type used to distribute Level 1 link-state information within a single IS-IS area. Options A (PSNP) and D (CSNP) are not LSPs at all; they are Sequence Numbers PDUs used to acknowledge and synchronize the link-state database, and they exist in both Level 1 and Level 2 forms. Option C (Hello LSP) is not a valid IS-IS PDU type; IS-IS uses IIH (IS-IS Hello) PDUs for neighbor discovery, not a 'Hello LSP'.

Answer

Partial Sequence Numbers PDU (PSNP)

Answer

Hello LSP

Answer

Complete Sequence Numbers PDU (CSNP)

Question 18

A service provider is deploying uRPF on peering edges with multiple upstream providers and asymmetric routing. Which two statements are true about uRPF operation in this scenario? (Choose two.)

Accepted Answer

Loose mode may drop traffic if no route to the source exists in the FIB. Option A is correct because loose-mode uRPF only verifies that a route back to the source address exists in the FIB, so if the source prefix is missing from the routing table the packet is dropped even though the return path need not match the incoming interface. Option D is correct because uRPF is supported for both IPv4 (ip verify unicast source reachable-via) and IPv6 (ipv6 verify unicast source reachable-via) on Cisco platforms, making it usable in dual-stack peering designs. Option B is wrong because uRPF depends on Cisco Express Forwarding and the FIB, so CEF must be enabled, not disabled. Option C is wrong because loose mode checks for a specific route to the source in the FIB; a default route alone does not satisfy the check unless it is the matching route. Option E is wrong because strict mode requires the return path to use the same interface the packet arrived on, which breaks in asymmetric routing, so loose mode is preferred there.

Answer

uRPF requires CEF to be disabled

Answer

Loose mode requires a default route to function

Answer

Strict mode is preferred for asymmetric routing environments

Question 19

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. Option A is correct because SNMPv3 with authPriv provides both authentication (MD5/SHA) and encryption (DES/AES) of management traffic, protecting credentials and MIB data from eavesdropping and spoofing, which is the recommended SNMP configuration on IOS XR. Option E is correct because SSH (typically SSHv2) encrypts remote CLI sessions and is the recommended secure replacement for cleartext protocols like Telnet on the management plane. Option B is not recommended because SNMPv2c community strings are sent in cleartext and offer no authentication or privacy. Option C is impractical and unnecessary since secure remote management via SSH is available and preferred. Option D is wrong because Telnet transmits credentials and session data in cleartext and should be disabled in favor of SSH.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access

Question 20

Which THREE are MEF-defined Ethernet service types? (Choose three.)

Accepted Answer

E-LAN. The three MEF-defined Ethernet service types are E-Line, E-Tree, and E-LAN. E-Line (option E) is correct because MEF defines it as a point-to-point Ethernet Virtual Connection (EVC) service, typically used for dedicated point-to-point connectivity such as Ethernet Private Line (EPL) or Ethernet Virtual Private Line (EVPL). E-LAN (option A) is correct because MEF defines it as a multipoint-to-multipoint EVC service, allowing any-to-any connectivity among multiple subscriber sites, as in Ethernet Private LAN (EP-LAN) or Ethernet Virtual Private LAN (EVP-LAN). E-Tree (option D) is correct because MEF defines it as a rooted-multipoint EVC service with one or more root nodes and multiple leaf nodes, where leaves can communicate only with roots, not with each other. The remaining options are not MEF service types: E-Access (option B) is not a MEF-defined Ethernet service type (MEF does define an Access EPL/Access EVPL service, but not 'E-Access'), and E-WAN (option C) is not a MEF service type at all.

Answer

E-Access

Answer

E-WAN