350-501 Automation and Quality of Service — 30 Questions

Question 1

A service provider is deploying QoS on a Cisco ASR 9000 router to support a triple-play service (voice, video, data) over an Ethernet access network. The network engineer must ensure that voice traffic (EF) is prioritized, video traffic (AF41) is treated with low loss, and data traffic (default) gets best-effort service. Additionally, the engineer must implement a hierarchical QoS policy to shape the aggregate subscriber traffic to 100 Mbps on a GigabitEthernet interface, with the following per-class bandwidth allocations: voice 10 Mbps, video 40 Mbps, and data 50 Mbps. During testing, voice packets are being dropped under congestion, and video traffic is experiencing jitter. The current QoS configuration is as follows:

policy-map CHILD

class VOICE

priority level 1 police rate 10 mbps

class VIDEO

bandwidth remaining ratio 40

class DATA

bandwidth remaining ratio 50 ! policy-map PARENT

class class-default

shape average 100 mbps service-policy CHILD !

Which action should the engineer take to resolve the issues while maintaining the design objectives?

policy-map CHILD
 class VOICE
  priority level 1
  police rate 10 mbps
 class VIDEO
  bandwidth remaining ratio 40
 class DATA
  bandwidth remaining ratio 50
!
policy-map PARENT
 class class-default
  shape average 100 mbps
  service-policy CHILD
!

Which action should the engineer take to resolve the issues while maintaining the design objectives?

Accepted Answer

Remove the police from the voice class and add 'priority level 1' without police; this ensures voice is priority queued without dropping.. The current configuration uses a police rate of 10 Mbps under the voice priority class, which causes voice packets to be dropped when they exceed that rate, even though priority queuing should guarantee low latency. Removing the police and keeping 'priority level 1' allows voice traffic to be strictly prioritized without a hard rate limit, ensuring no drops for voice while still allowing the parent shaper to enforce the aggregate 100 Mbps. This resolves the voice drops and, by preventing voice from being policed, reduces jitter for video traffic that might otherwise be affected by bursty voice drops.

Answer

Change the video class to 'priority level 2' to give it preferential treatment over data.

Answer

Add a 'police' to the video class with a CIR of 40 Mbps and 'conform-action transmit exceed-action drop' to protect voice.

Answer

Change the voice class to use 'bandwidth remaining percent 10' and remove the police.

Question 2

A service provider has deployed a new MPLS L3VPN service for a customer with multiple sites. The customer reports intermittent voice quality issues during peak hours. The provider uses a DiffServ QoS model with MPLS EXP markings. The PE routers apply the following policy on the customer-facing interfaces:

policy-map CUSTOMER-OUT
 class VOICE
  priority percent 10
  set mpls experimental topmost 5
 class VIDEO
  bandwidth remaining percent 30
  set mpls experimental topmost 4
 class DATA
  bandwidth remaining percent 70
  set mpls experimental topmost 0

The core network has a simple policy that maps EXP 5 to PQ, EXP 4 to a low-latency queue, and EXP 0 to best effort. The provider monitors the network and finds that the PE-CE interfaces are not congested (average utilization is 40%), but the voice packets are experiencing jitter. The customer's voice traffic is about 5% of the link capacity. Which action is most likely to reduce the jitter?

Accepted Answer

Add a police command under the VOICE class to limit voice traffic to 5% and shape the priority queue.. The voice traffic is only 5% of link capacity, but the priority percent 10 command allows up to 10% of the link to be treated as priority. During peak hours, if other traffic (e.g., video or data) bursts and exceeds the remaining bandwidth, the priority queue can still be policed implicitly by the scheduler, but jitter arises because the priority queue is not rate-limited. Adding a police command under the VOICE class to limit voice to 5% and shaping the priority queue ensures that voice traffic does not exceed its actual rate, preventing microbursts that cause jitter in the priority queue.

Answer

Configure the core routers to map EXP 5 to a low latency queue instead of PQ.

Answer

Increase the priority percent to 20 for voice traffic.

Answer

Change the set mpls experimental topmost to set ip dscp ef for voice.

Question 3

Drag and drop the steps to configure MPLS LDP on a Cisco router into the correct order.

Accepted Answer

Step 1: Enable CEF (ip cef), Step 2: Configure LDP router-id (mpls ldp router-id), Step 3: Enable MPLS on interfaces (mpls ip). MPLS LDP requires CEF, enabling MPLS on interfaces, and setting the LDP router-id.

Answer

Step 1: Enable MPLS on interfaces (mpls ip), Step 2: Enable CEF (ip cef), Step 3: Configure LDP router-id (mpls ldp router-id)

Answer

Step 1: Configure LDP router-id (mpls ldp router-id), Step 2: Enable CEF (ip cef), Step 3: Enable MPLS on interfaces (mpls ip)

Answer

Step 1: Enable CEF (ip cef), Step 2: Enable MPLS on interfaces (mpls ip), Step 3: Configure LDP router-id (mpls ldp router-id)

Question 4

Match each BGP attribute to its category or purpose.

Accepted Answer

Local Preference: Well-known discretionary attribute used for outbound traffic influence. Correct matches associate BGP attributes with their standard categories and purposes. Local Preference and Next Hop are well-known discretionary and mandatory respectively, while MED is optional nontransitive. Common confusions include misclassifying attribute categories or purposes.

Answer

Local Preference: Optional transitive attribute used to tag routes

Answer

AS Path: Optional nontransitive attribute used for inbound traffic influence

Question 5

Match each network automation tool to its primary use.

Accepted Answer

Ansible: An agentless automation tool that uses YAML playbooks for configuration management and application deployment.. These are key automation and programmability tools for service provider networks.

Answer

Ansible: A configuration management tool that uses a declarative language and a client-server model.

Answer

Puppet: A tool that uses YAML playbooks for automation.

Question 6

An SP uses BGP FlowSpec to mitigate DDoS attacks. They also want to rate-limit the traffic per FlowSpec rule. Which configuration is required to enable policing within a FlowSpec action?

Accepted Answer

Include the 'rate-limit' action in the FlowSpec rule using the 'action' clause.. BGP FlowSpec allows the inclusion of a 'rate-limit' action within the FlowSpec rule's 'action' clause to enforce policing. This action directly applies a traffic rate limit (in bits per second) to the matched flow, enabling DDoS mitigation without requiring external QoS policies or MPLS TE reservations.

Answer

Configure MPLS TE bandwidth reservation for the FlowSpec routes.

Answer

Use policy-based routing (PBR) to set QoS parameters.

Answer

Apply a QoS policy-map to the interface and match the FlowSpec destination.

Question 7

An SP's core router experiences excessive packet drops on a congested link. The QoS policy uses CBWFQ with 4 queues. The drops occur only in the queue for a premium business class. Which is the most likely cause?

Accepted Answer

The premium class is configured with a police action that drops traffic when it exceeds the committed information rate.. The premium business class queue is experiencing excessive packet drops because a police action configured with a 'drop' exceed-action is discarding traffic that exceeds the committed information rate (CIR). Unlike congestion management (queuing), policing is a congestion avoidance mechanism that drops packets immediately when the traffic rate surpasses the configured CIR, regardless of the queue depth or available bandwidth. This explains why drops occur only in the premium class queue, as the policer is explicitly dropping excess packets before they even enter the CBWFQ scheduler.

Answer

The 'bandwidth remaining' command is missing from the policy-map.

Answer

The interface is using MLP with interleaving.

Answer

The queue is using tail-drop without WRED.

Question 8

An SP uses model-driven telemetry to monitor queue depths on core interfaces. They observe periodic spikes in the queue depth for EF traffic, causing increased latency. Which automation technique could dynamically adjust the QoS policy to mitigate the spikes?

Accepted Answer

Use a Python script that consumes telemetry data and adjusts the EF bandwith percentage via NETCONF when queue depth exceeds a threshold.. It combines model-driven telemetry (to detect queue depth spikes in real time) with a closed-loop automation approach: a Python script consumes the telemetry data, and when the EF queue depth exceeds a threshold, it dynamically adjusts the EF bandwidth percentage via NETCONF. This directly addresses the periodic spikes by modifying the QoS policy on the fly, reducing latency without manual intervention.

Answer

Deploy NETCONF YANG modules for VRF configuration.

Answer

Configure WRED on the EF queue.

Answer

Implement streaming telemetry to collect data every 5 seconds.

Question 9

An SP engineer configures a QoS policy on an IOS XR router to re-mark DSCP from AF11 to AF22 for traffic matching a specific ACL. The policy compiles successfully but traffic is not re-marked. What is a likely reason?

Accepted Answer

The interface does not have the 'qos' feature enabled, or the policy-map is not attached.. On IOS XR routers, QoS policies require explicit feature enablement via the 'qos' command under the interface configuration, and the policy-map must be attached in the correct direction. Without the 'qos' feature enabled, the router will compile the policy but silently ignore it, resulting in no re-marking of DSCP from AF11 to AF22.

Answer

The ACL cannot match on DSCP values.

Answer

The ACL is applied to the wrong interface.

Answer

The policy is applied in the output direction; marking can only be done on ingress.

Question 10

While troubleshooting a customer complaint about slow data transfers, you notice that traffic from a specific site is being dropped. The QoS policy on the PE router includes a police command for the customer's traffic. The observed drop rate is exactly half of the configured police rate. What is the most probable reason?

Accepted Answer

The police is using a token-bucket algorithm with a small burst size that is being exceeded. The observed drop rate being exactly half the configured police rate strongly suggests that the token-bucket algorithm is operating with a burst size that is too small. When the burst size is insufficient, the bucket empties quickly under sustained traffic, causing packets to be marked as exceeding the rate and dropped. The police command in Cisco IOS uses a single-rate two-color marker (RFC 2697) or a two-rate three-color marker (RFC 2698), and a small burst size leads to premature drops even when the average rate is below the configured police rate.

Answer

The police rate is configured in bits per second but the traffic is measured in bytes per second

Answer

The traffic is using a different DSCP value than expected

Answer

The police action is set to drop, but the exceed-action is transmit

Question 11

A network engineer is implementing QoS on a Cisco ASR 1000 for a customer with multiple service classes. The customer requires that mission-critical data not be starved when voice traffic bursts. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Configure a policer on the voice class to limit its bandwidth. Policing the voice class limits its bandwidth to a configured rate (e.g., using the `police` command under the class-map), preventing voice bursts from starving mission-critical data. This ensures that voice traffic does not exceed its allocated share, leaving enough bandwidth for other classes. Option D is correct because allocating a minimum bandwidth guarantee to the data class (e.g., using the `bandwidth` command under the class-map) ensures that even when voice bursts occur, the data class receives a reserved amount of bandwidth, preventing starvation. Together, these actions enforce admission control and bandwidth reservation, aligning with the customer's requirement.

Answer

Enable WRED on the voice class

Answer

Use tail drop with a high threshold for the data class

Answer

Configure a shape on the voice class to 75% of interface bandwidth

Question 12

Refer to the exhibit. The policy above is applied on a PE router. The customer complains that voice quality is poor. Based on the exhibit, what is the most likely cause?

Accepted Answer

The police rate for voice is too low for the offered traffic. The police rate for voice is too low for the offered traffic. Voice traffic requires a guaranteed bandwidth to maintain low jitter and packet loss; if the policer rate is set below the actual voice flow rate, packets are dropped or marked down, causing poor voice quality. In the exhibit, the voice class has a police rate that is insufficient for the offered load, leading to excessive drops.

Answer

The policy is applied to the wrong direction

Answer

The class-default is empty

Answer

The DATA class is not matching any traffic

Question 13

Refer to the exhibit. An engineer checks the policy and notices that the policing is not working as expected—traffic is not being dropped even when exceeding 1 Mbps. What could be the issue?

Accepted Answer

The shape command is interfering with the police command. The shape command can interfere with police by smoothing traffic, which may prevent the policer from seeing bursts that exceed the committed rate. If the shape rate is set higher than the police rate, the policer may not drop traffic because the shaper is already limiting the output to a lower rate. Additionally, the order of operations in a service policy matters: if shape is applied before police, the policer sees shaped traffic, which may not exceed the rate.

Answer

The service-policy is applied inbound, but police should be applied outbound to be effective

Answer

The police command is missing an exceed-action, so traffic is transmitted instead of dropped

Answer

The police rate is too high compared to interface speed

Question 14

A customer has a 100 Mbps access link and wants to limit traffic to 95 Mbps with burst allowance up to 100 Mbps. Which QoS action should be applied on the egress interface?

Accepted Answer

police. Police is the correct QoS action because it allows you to enforce a maximum traffic rate (95 Mbps) while permitting bursts up to 100 Mbps, dropping or remarking excess traffic. Unlike shaping, policing does not buffer traffic, so it can enforce a hard limit on egress without introducing delay, which matches the requirement to limit traffic with a burst allowance.

Answer

shape

Answer

priority

Answer

bandwidth

Question 15

Which TWO conditions cause a router to drop packets when a police action is configured?

Accepted Answer

exceed action is drop. When a police action is configured, the router uses a token bucket model to meter traffic. If traffic exceeds the committed information rate (CIR) and burst size, it falls into the 'exceed' or 'violate' category depending on the configured conform and exceed burst parameters. The 'drop' action for exceed or violate conditions explicitly instructs the router to discard those packets, enforcing traffic shaping or policing at the hardware or software level.

Answer

conform action is drop

Answer

no bandwidth is reserved

Answer

queue is full

Question 16

Which THREE QoS mechanisms can be used for traffic policing?

Accepted Answer

dual-rate three-color. Traffic policing uses token bucket mechanisms to measure and enforce traffic rates. Dual-rate three-color (RFC 2698) uses two token buckets (CIR/PIR) to mark packets as green, yellow, or red, allowing separate policing of committed and peak rates. Single-rate two-color (RFC 2697) uses one token bucket to mark packets as either conforming (green) or exceeding (red). Both are standard policing implementations.

Answer

WRED

Answer

shaping

Question 17

A service provider operates a large MPLS network with hundreds of PE routers. They have deployed QoS policies to ensure real-time traffic (voice and video) receives priority. The policy uses LLQ with a strict priority queue for voice (DSCP EF) and another for video (DSCP AF41). Each priority queue has a policer to prevent starvation of other classes. Recently, a customer reports that their video calls are experiencing jitter and packet loss. The engineer examines the PE router connected to this customer. The interface is GigabitEthernet0/0/1 with the policy applied in the output direction. Show commands indicate that the video priority queue is frequently dropping packets, while the voice queue has no drops. The police for the video queue is set to 10 Mbps. The customer's contract guarantees 20 Mbps for video traffic. However, the actual video traffic is averaging 15 Mbps with bursts to 18 Mbps. The engineer notes that the video class also has a bandwidth command of 10 Mbps under the priority statement. What is the most likely cause of the video packet loss?

Accepted Answer

The police rate for the video queue is too low; increase it to at least 20 Mbps.. The video priority queue is dropping packets because the police rate (10 Mbps) is lower than the actual traffic rate (15 Mbps average, bursts to 18 Mbps). In LLQ, the priority queue uses a policer to enforce a maximum rate; traffic exceeding the police rate is dropped. The bandwidth command under priority only reserves bandwidth for the queue in the absence of congestion or for shaping purposes, but the policer is the active enforcement mechanism that causes drops. Increasing the police rate to at least 20 Mbps aligns with the customer's guaranteed rate and prevents drops.

Answer

The bandwidth command under priority is too low; increase it to 20 Mbps.

Answer

The video queue is using the wrong queue limit; increase the queue limit to accommodate bursts.

Answer

The video traffic is not being classified correctly; check the class-map match criteria.

Question 18

A large enterprise recently implemented centralized QoS policies using Cisco DNA Center. The policies are pushed via RESTCONF to the branch routers. After the deployment, the branch office reports that critical business applications (like ERP) are being delayed. The network team verifies that the QoS policy is applied correctly on the WAN interface (Serial0/0/0) with a shape of 10 Mbps. The policy-map has a class for 'critical-data' with bandwidth 5 Mbps and another class for 'transactional-data' with bandwidth 3 Mbps. The remaining traffic is in class-default with fair-queue. The branch router's CPU utilization is normal. The interface output shows that the queue for critical-data is rarely full, but packets are experiencing high latency. The engineer pings from the branch server to the central site and sees 200 ms RTT normally, but up to 500 ms during peak hours. What is the most likely cause of the high latency for critical-data?

Accepted Answer

The shape rate is too low; increase it to match the access link speed (e.g., 20 Mbps).. The shape rate of 10 Mbps is the bottleneck. Even though the critical-data class has a bandwidth guarantee of 5 Mbps, the overall interface is shaped to 10 Mbps. During peak hours, when the sum of all traffic (critical, transactional, and default) exceeds 10 Mbps, packets are queued at the shaper. This queueing introduces additional delay (up to 500 ms) for all classes, including critical-data, because the shaper enforces a single token bucket for the entire interface. Increasing the shape rate to match the actual access link speed (e.g., 20 Mbps) would reduce the queuing delay by allowing more traffic to be transmitted immediately.

Answer

The critical-data class needs a priority command to reduce latency.

Answer

The queue-limit for critical-data is too high; reduce it to force early drops.

Answer

The bandwidth command in critical-data should be increased above 5 Mbps.

Question 19

A network engineer is troubleshooting QoS on a Cisco ASR 1000 router. The router has a service-policy applied on the ingress interface GigabitEthernet0/0/0. The policy uses a class-map to match traffic based on NBAR protocol discovery for 'cisco-jabber'. The goal is to mark the traffic with DSCP AF41. However, when the engineer checks the policy statistics, the class 'jabber' shows zero matches, even though the users are actively using Cisco Jabber. The NBAR protocol discovery is enabled globally and on the interface. The engineer verifies that the NBAR protocol pack is up-to-date. What is the most likely reason for the class-map not matching?

Accepted Answer

Cisco Jabber traffic is encrypted, so NBAR cannot identify it. Cisco Jabber uses encrypted signaling and media (SRTP/TLS), which prevents NBAR from performing deep packet inspection to identify the application. Even with an up-to-date protocol pack, NBAR cannot match encrypted traffic unless decryption is performed elsewhere. Therefore, the class-map matching 'cisco-jabber' via NBAR protocol discovery will show zero matches.

Answer

The service-policy should be applied on the egress interface instead

Answer

The class-map is using 'match access-group' instead of 'match protocol'

Answer

The NBAR protocol pack is not activated on this interface

Question 20

Which TWO actions are required to implement QoS trust boundaries correctly in a service provider network?

Accepted Answer

Configure classification at the edge. To implement QoS trust boundaries correctly in a service provider network, classification must occur at the edge (Option A), because the provider must identify and mark traffic as close to the source as possible before it enters the trusted core, preventing untrusted customer markings from being honored. Option D is also required: setting trust to CoS on access ports allows the provider edge to accept and honor Layer 2 class-of-service markings from the customer or access device, establishing the trust boundary at that ingress point. Option B is incorrect because auto-QoS is a Cisco LAN campus feature, not a service provider trust-boundary mechanism, and it does not define where trust begins. Option C is incorrect because shaping at customer premises is a customer-side traffic-conditioning action, not a provider requirement for establishing the trust boundary. Option E is incorrect because using MPLS EXP bits for core marking is a core QoS marking technique, not an action required to define the trust boundary itself.

Answer

Enable auto QoS on all interfaces

Answer

Apply shaping at customer premises

Answer

Use MPLS EXP bits for core marking