350-501 Architecture Practice Test 9 — 15 Questions

Question 1

A service provider is implementing EVPN for its VPLS replacement. They have configured BGP EVPN on all PEs and have set up an EVPN instance for a customer requiring broadcast, unknown unicast, and multicast (BUM) traffic. The customer reports that broadcast traffic from one site is not being received at another site. The engineer checks the EVPN configuration and finds that the EVI is configured correctly, the route-target matches, and the BGP sessions are established. The engineer also checks the MAC address table on the receiving PE and sees that the source MAC of the broadcast frame is learned on the local interface, but not from the remote VTEP. The engineer suspects an issue with the IMET (Inclusive Multicast Ethernet Tag) route. Which action should the engineer take to verify the IMET route?

Accepted Answer

Check the BGP EVPN route table for IMET (route-type 3) routes using 'show bgp l2vpn evpn route-type 3'.. Option A is correct because the 'show bgp l2vpn evpn route-type 3' command displays IMET routes, which are needed for BUM traffic forwarding. Option B is wrong because route-type 2 is for MAC/IP advertisement. Option C is wrong because 'show evpn instance detail' shows local configuration but not remote routes. Option D is wrong because 'show l2vpn vfi' is for VPLS, not EVPN.

Answer

Use 'show evpn instance detail' to check the EVI configuration.

Answer

Use 'show bgp l2vpn evpn route-type 2' to verify MAC/IP routes.

Answer

Use 'show l2vpn vfi' to verify the VPLS forwarding instance.

Question 2

A service provider is designing an MPLS L3VPN network to provide Layer 3 VPN services to multiple customers. Which two statements correctly describe the roles of the Provider Edge (PE) and Customer Edge (CE) routers in this architecture?

Accepted Answer

PE routers advertise customer routes via MP-BGP with route distinguishers and route targets.. PE routers maintain separate VRF tables for each customer VPN and advertise customer routes via MP-BGP with route distinguishers and route targets. CE routers do not participate in the service provider's IGP.

Answer

P routers store all customer VPN routes in their global routing table.

Answer

CE routers perform MPLS label switching between PE routers.

Answer

CE routers participate in the service provider's IGP to exchange loopback addresses.

Question 3

An SP is migrating its core network to Segment Routing (SR-MPLS). The network uses IS-IS as the IGP with SR extensions. Which three statements about SR-MPLS architecture are correct?

Accepted Answer

Adjacency SIDs are local to a router and indicate a specific link.. Segment IDs (SIDs) are allocated from the SRGB and advertised via IS-IS; a prefix SID is a global label identifying a specific prefix; adjacency SIDs are local to a router. The SRGB does not have to be identical across all routers, and OSPF also supports SR.

Answer

The OSPF protocol cannot be used for SR-MPLS because it does not support SR extensions.

Answer

The SRGB must be identical across all routers in the domain to ensure global uniqueness.

Question 4

A large service provider operates an MPLS L3VPN network with multiple Route Reflectors (RRs) in the core. The network uses BGP as the control plane for both IPv4 unicast and VPNv4 routes. Recently, one of the RRs started flapping, causing route withdrawals to many clients. The network architect wants to improve stability. The RRs are fully meshed with each other and clients are configured as route-reflector clients. The RRs have both IPv4 and VPNv4 address families enabled. Which action should be taken to minimize the impact of an RR failure?

Accepted Answer

Configure client-to-client reflection on the RRs and ensure that each PE is a client of at least two RRs.. Configuring client-to-client reflection on the RRs and ensuring each PE is a client of at least two RRs provides redundancy; if one RR fails, routes are still available via the other RR. BGP PIC helps fast failover but does not prevent route withdrawal impact; add-paths increases paths but not redundancy; same cluster ID reduces redundancy.

Answer

Configure BGP prefix-independent convergence (PIC) on all PE routers.

Answer

Implement BGP add-paths capability on RRs to advertise multiple paths to clients.

Answer

Deploy redundant RRs with the same cluster ID and use the 'bgp cluster-id' command to ensure clients only accept routes from one RR at a time.

Question 5

An SP is deploying a Quality of Service (QoS) architecture in its core network to support multiple services: voice, video, and data. The core routers use MPLS and implement QoS based on the MPLS EXP bits. The architecture must ensure that voice packets are never dropped, even during congestion, while allowing video to have higher priority than data. The current design marks voice with EXP 4, video with EXP 3, and data with EXP 0. During a traffic burst, voice traffic is being dropped, which should not happen. The core routers have the following queue configuration: (1) a priority queue (PQ) for EXP 4+5, (2) a bandwidth queue for EXP 2-3, (3) a default queue for EXP 0-1. What is most likely the cause of voice drops?

Accepted Answer

The priority queue is rate-limited by a policer that shapes traffic to a certain bandwidth.. Voice drops occur because the priority queue is often rate-limited by a policer to prevent starvation of other queues. If the policer rate is set too low, voice packets are dropped during bursts. Strict priority without policing does not drop, but policing is common in SP core to protect other queues. The bandwidth queue and default queue are not the issue.

Answer

Voice traffic is being marked with EXP 4 but the priority queue also includes EXP 5, which may cause policing.

Answer

The bandwidth queue for video is configured to borrow from the priority queue.

Answer

The priority queue is not strictly priority; it shares bandwidth with other queues.

Question 6

A service provider is deploying EVPN-VXLAN in its data center to provide Layer 2 and Layer 3 overlay services. The underlay uses an eBGP-based CLOS fabric with spine and leaf switches. The leaf switches act as VTEPs and run EVPN for MAC/VXLAN advertisement. One of the tenants, a financial customer, requires that their traffic between two leaf-connected servers is always forwarded through a firewall for inspection, even when the servers are on the same leaf. The firewall is connected to a service leaf. The architect proposes using EVPN integrated routing and bridging (IRB) with asymmetric IRB. However, traffic between two VMs on the same leaf is bypassing the firewall. Which architectural change ensures that all inter-VM traffic within the same leaf goes through the firewall?

Accepted Answer

Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.. Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.

Answer

Configure a gateway on the firewall and use static routes on the leaf to forward traffic to the firewall.

Answer

Use EVPN symmetric IRB and ensure the firewall is attached as a Layer 2 extension.

Answer

Enable 'split-horizon' on the leaf switches to prevent direct forwarding.

Question 7

A service provider offers Carrier Ethernet services using MPLS-TP in the access and aggregation layers. The network uses MPLS-TP tunnels with static LSPs and protection via 1:1 linear protection with APS. One customer reports intermittent connectivity issues on their E-LINE service. The operations team observes that the protection switchover is occurring frequently due to apparent signal failures on the working path. However, the physical layer shows no errors. The protection switching is configured with revertive mode. The working LSP has an RDI (Remote Defect Indication) configured. Upon further investigation, the team finds that the working LSP's OAM continuity check messages (CCMs) are being lost occasionally, triggering a protection switch. What is the most likely misconfiguration?

Accepted Answer

The CCM interval is too short, causing frequent false failures due to transient congestion.. A short CCM interval makes the system sensitive to minor delays, causing false failures and frequent protection switches. A longer interval would reduce sensitivity but increase detection time. Priority and OAM rate differences are not typical causes.

Answer

The CCM interval is too long, causing delayed detection.

Answer

The working path uses a higher MPLS-TP OAM rate than the protection path.

Answer

The protection path has a lower priority than the working path.

Question 8

A service provider is building a new network slicing architecture to offer differentiated services to enterprise customers. The architecture uses SRv6 with network slices identified by slice IDs embedded in the SRv6 SID. The underlay is an IP network with ISIS. Each slice will have dedicated resources in the core, including guaranteed bandwidth and low latency. The plan is to use the SRv6 network programming concept to steer traffic into different slices. The provider wants to ensure that slice isolation is maintained end-to-end, including at the egress PE where traffic is handed off to the customer. However, during testing, they observe that traffic from one slice is incorrectly entering another slice's queue on an intermediate node, causing performance interference. The intermediate node is a transit router that does not terminate SRv6 but performs 'SID-based forwarding'. Which mechanism is most likely missing to ensure slice isolation on transit nodes?

Accepted Answer

The transit nodes are not configured to enforce per-slice QoS policies based on the slice ID in the SID.. Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.

Answer

The SRv6 SID does not carry the slice ID; it only carries the locator.

Answer

The egress PE is misconfigured to strip the slice ID before forwarding.

Answer

The ingress PE is not setting the slice ID correctly.

Question 9

A service provider offers IPTV services using multicast. The network uses Multicast VPN (MVPN) with Rosen GRE encapsulation (Profile 1) in an MPLS L3VPN environment. The Provider Edge (PE) routers participate in both the default MDT and data MDT for high-bandwidth streams. Recently, a new channel was added, and it uses a data MDT. The content server is attached to a PE that is acting as a multicast source. Other PEs are receivers. Upon adding the channel, some receivers report missing packets. The network engineer checks the PEs and notices that the data MDT group address is being advertised via BGP as an MDT SAFI route, but some PEs are not joining the data MDT. The source PE's multicast routing table shows that it believes data MDT is active. Which architecture issue is most likely preventing some PEs from joining the data MDT?

Accepted Answer

The data MDT group is not within the configured data MDT group range on the receiving PEs.. The data MDT group must be within the configured data-MDT group range on each PE; if not, the PE will ignore the BGP MDT SAFI route and not join the data MDT. Source PE IGMP joins are not relevant; default MDT issues are separate; PIM RP reachability might affect default MDT but not data MDT join if using SSM.

Answer

The source PE is not sending IGMP joins for the data MDT group.

Answer

The default MDT group is flapping.

Answer

The PIM sparse mode RP is not reachable.

Question 10

A service provider is troubleshooting an MPLS L3VPN where customers behind CE-A cannot reach CE-B. The PE routers are Cisco ASR 9000 series. On PE-A, the show cef vrf CUSTOMER prefix 10.1.1.0/24 command displays 'punt' as the forwarding path. What is the most likely cause?

Accepted Answer

The IP prefix is not resolved via an MPLS label in the LFIB. Option C is correct because when VRF routes are punted to the CPU, it typically indicates that the label for the next hop is missing or that the FIB resolution failed, often due to missing MPLS label binding. Option A is wrong because BGP VPNv4 routes are not required for local VRF forwarding. Option B is wrong because MTU would cause drop, not punt. Option D is wrong because CE-PE routing is usually static or BGP, not OSPF in most designs.

Answer

The MPLS MTU on the interface is too small

Answer

The VRF is missing the route-target import statement

Answer

The CE is not running OSPF with the PE

Question 11

A network architect is designing a Segment Routing (SR) network for a service provider with a requirement for fast convergence upon node failure. The network uses IS-IS as the IGP with segment routing extensions. Which design choice BEST ensures that the network can achieve sub-50ms convergence without relying on any signaling protocol beyond the IGP?

Accepted Answer

Enable TI-LFA (Topology Independent Loop-Free Alternate) on all ISIS interfaces. Option A is correct because TI-LFA (Topology Independent Loop-Free Alternate) calculates backup paths based solely on IGP and does not require additional signaling. Option B is wrong because RSVP-TE requires TE tunnels and signaling. Option C is wrong because LDP is a separate signaling protocol. Option D is wrong because BFD can be used for fast detection but does not provide a backup path itself; it must be combined with a protection mechanism.

Answer

Deploy BFD with static routes for fast detection

Answer

Configure RSVP-TE with Fast Reroute on all label-switched paths

Answer

Use LDP with LDP FRR and path protection

Question 12

A service provider needs to offer L3VPN services to multiple customers, each with overlapping IP addresses. The provider plans to use MPLS VPNs with VRFs. Which statement is TRUE regarding the configuration of VRFs on the PE routers?

Accepted Answer

Route targets (RTs) are used to control the import and export of VPNv4 routes between VRFs. Option D is correct because route targets (RTs) are used to control the import/export of VPNv4 routes between PE routers, ensuring proper segregation and connectivity. Option A is wrong because RD must match within a VPN to avoid route ambiguity, but it can differ if RTs are properly configured; however, the question asks for TRUE statement. Option B is wrong because MPLS label allocation per VRF is automatic. Option C is wrong because OSPF is not required; any IGP or BGP can be used.

Answer

The VRF must run OSPF to exchange routes with the CE router

Answer

MPLS labels are assigned per prefix inside a VRF by manual configuration

Answer

Each VRF must have a unique route distinguisher across the entire provider network

Question 13

A service provider has deployed QoS on its MPLS backbone to offer different classes of service. The provider notices that EF (Expedited Forwarding) traffic sometimes experiences high jitter during congestion. Following recommended practices, which action is MOST likely to reduce jitter for EF traffic?

Accepted Answer

Use priority queuing (LLQ) for EF traffic with a policer. Option B is correct because priority queuing ensures EF traffic is served before other queues, reducing jitter. Option A is wrong because shaping reduces bandwidth but does not eliminate jitter if congestion exists. Option C is wrong because WRED is for congestion avoidance and can drop EF packets if not excluded. Option D is wrong because changing DSCP does not improve jitter directly; proper queuing is key.

Answer

Apply traffic shaping on all EF packets at the edge

Answer

Change the DSCP value of EF traffic to AF41 to reduce drops

Answer

Apply weighted random early detection (WRED) on the EF queue

Question 14

A multicast service provider is designing an IPv4 PIM Sparse Mode (PIM-SM) network with multiple RPs. The network must support Anycast RP using MSDP. Which THREE statements are correct regarding this design?

Accepted Answer

Anycast RP allows multiple RPs to share the same IP address, providing redundancy and load balancing. Options A, C, and E are correct. Option A: MSDP is used to exchange active source information between anycast RPs. Option C: Anycast RP provides load balancing and redundancy automatically. Option E: Source-specific multicast (SSM) can be used with PIM-SM and Anycast RP if IGMPv3 is supported. Option B is wrong: Anycast RP works with both static and dynamic RP assignments, but Auto-RP is not required. Option D is wrong: MSDP is not needed for SSM because SSM uses (S,G) channels and does not rely on an RP.

Answer

Auto-RP must be used to distribute the RP information to all routers

Answer

MSDP is only required if the network uses Source-Specific Multicast (SSM)

Question 15

Based on the exhibit, why is the route 10.10.10.0/24 from remote PE not installed in the VRF Customer-A on PE1?

Accepted Answer

The VRF imports route-target 200:200, but the route has RT 100:100. Option B is correct: The route has RT 100:100, but VRF Customer-A imports RT 200:200. Thus, the route is not imported. Option A is wrong because the localpref is 100, which is default and not an issue. Option C is wrong because the RD mismatch is between VRFs, but RD does not affect import; RT does. Option D is wrong because label allocation is working fine (vpn-label:24000).

Answer

The localpref is too low (100)

Answer

The MPLS label allocation failed on the remote PE

Answer

The route distinguisher on the VRF (100:1) does not match the remote RD