350-501 Services — 20 Questions

Question 1

A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?

Accepted Answer

The next-hop must be reachable via the IGP with an MPLS label.. For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.

Answer

The next-hop must be a directly connected interface.

Answer

The PE must have a VPN label for the next-hop.

Answer

The IGP must be IS-IS, not OSPF.

Question 2

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

Accepted Answer

MCAST-VPN address family. In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Answer

MVPN does not use BGP; it uses PIM.

Answer

VPNv4 address family

Answer

IPv4 multicast address family

Question 3

A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?

Accepted Answer

Change the explicit path to 'loose' for the down interface.. Option C is correct because changing the explicit path from 'strict' to 'loose' for the down interface allows the MPLS TE tunnel to use an alternative next-hop that is reachable, even if the specified interface is down. A strict explicit path requires every hop to be directly connected, so a down interface prevents the tunnel from coming up. By making the hop loose, the router can route around the failed link using the IGP's best path to the next specified node.

Answer

Increase the path-option preference value.

Answer

Disable path protection on the tunnel.

Answer

Configure an affinity constraint to exclude the down interface.

Question 4

Which TWO statements about BGP FlowSpec (RFC 8955) are correct?

Accepted Answer

FlowSpec can be deployed in BGP sessions between a route reflector and a client.. Option A is correct because BGP FlowSpec (RFC 8955) can be deployed between a route reflector and its clients. The route reflector propagates FlowSpec NLRI (Network Layer Reachability Information) to its clients, allowing the clients to install traffic filtering rules without requiring a full BGP mesh. This is a common deployment model in service provider networks to distribute flow-spec routes efficiently.

Answer

FlowSpec uses a separate BGP session from the regular IPv4 unicast session.

Answer

FlowSpec is designed to replace ACLs on provider edge routers.

Answer

FlowSpec requires MPLS forwarding to operate.

Question 5

Which THREE characteristics apply to the BGP-LS (BGP Link State) protocol?

Accepted Answer

It uses a separate address family from VPNv4.. BGP-LS uses a separate address family (AFI 16388 / SAFI 71) from VPNv4 (AFI 1 / SAFI 128) to carry link-state information. This separation allows BGP-LS to operate independently from VPNv4 routes, enabling the collection and distribution of IGP topology data without interfering with MPLS VPN signaling.

Answer

It supports only IS-IS, not OSPF.

Answer

It carries traffic-engineering parameters in the NLRI.

Question 6

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

Accepted Answer

The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.. The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Answer

The priority level is set too low; voice should be priority level 4.

Answer

The 'bandwidth remaining ratio' command under class-default is starving the priority queue.

Answer

The policy is applied in the output direction; it should be input.

Question 7

Refer to the exhibit. A network engineer is troubleshooting MPLS forwarding for prefix 10.10.10.0/24. The router shows two entries. What does the 'Pop tag' in the outgoing tag indicate?

Accepted Answer

The router will pop the MPLS label before forwarding the packet.. The 'Pop tag' in the outgoing tag indicates that the router is the penultimate hop in the MPLS LSP. According to Penultimate Hop Popping (PHP) behavior, the penultimate router removes (pops) the top label before forwarding the IP packet to the egress LSR, so the egress router receives a pure IP packet and does not need to perform a label lookup. This is standard MPLS behavior defined in RFC 3031.

Answer

The router will swap the label with the local label 16.

Answer

The router has received an error in label distribution.

Answer

The router will forward the packet without an MPLS label.

Question 8

A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?

Accepted Answer

mpls l2transport route 10.1.1.2 100. Option B is correct because the `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.

Answer

l2vpn xconnect context

Answer

neighbor 10.1.1.2 remote-as 100

Answer

pseudowire 10.1.1.2 100 encapsulation mpls

Question 9

A service provider is troubleshooting BGP route advertisement for a VPNv4 prefix. The PE router receives the prefix from the route reflector but does not install it in the VRF routing table. The BGP table shows the prefix as valid but not best. What is the most likely cause?

Accepted Answer

The next-hop is not reachable via the IGP with an MPLS label.. For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

Answer

The VRF does not have the correct route-target import.

Answer

The BGP table is full and cannot accept more prefixes.

Answer

The MPLS label is missing in the BGP update.

Question 10

A service provider is deploying MPLS Layer 3 VPNs and wants to ensure that customer traffic is not dropped when a PE-CE link fails. The CE router is using static routing. Which design should be implemented to provide fast convergence?

Accepted Answer

Enable BFD on the PE-CE interface and associate it with the static route.. Option D is correct because BFD (Bidirectional Forwarding Detection) provides sub-second failure detection on the PE-CE link, and when associated with a static route, it allows the PE to quickly remove the failed route from the routing table. This triggers fast convergence without waiting for routing protocol timers, which is critical for MPLS Layer 3 VPNs using static routing on the CE side.

Answer

Configure OSPF on the PE-CE link and set hello timers to 1 second.

Answer

Use IP SLA tracking to monitor the CE and adjust the static route.

Answer

Increase the administrative distance of the static route to 255.

Question 11

Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?

Accepted Answer

Only routes matching 10.1.0.0/16 or more specific will have the community added; other routes remain unchanged.. The configuration uses a route-map applied to the neighbor with a match clause referencing a prefix-list that permits 10.1.0.0/16 le 32. This matches the exact prefix and any more specific prefix (up to /32). The set community 65000:100 action adds the community without using the additive keyword, but because the route-map does not contain a deny clause for non-matching routes, all routes are still accepted; only matching routes have the community added. Thus, only routes matching 10.1.0.0/16 or more specific will have community 65000:100 added, and other routes remain unchanged.

Answer

Routes with a mask longer than /24 will be rejected by the prefix-list.

Answer

All routes from the customer will have their communities replaced with 65000:100.

Answer

Routes not matching the prefix-list will be denied and not installed.

Question 12

A service provider is planning to offer L2VPN services using MPLS. Which TWO statements are true regarding Ethernet over MPLS (EoMPLS) and Virtual Private LAN Service (VPLS)?

Accepted Answer

EoMPLS provides a point-to-point pseudowire between two PE routers.. EoMPLS (Ethernet over MPLS) is correct because it establishes a point-to-point pseudowire (Martini draft, RFC 4448) between two PE routers, transporting Layer 2 Ethernet frames across an MPLS core without MAC learning or multipoint capabilities.

Answer

VPLS requires all PE routers to be in the same VLAN.

Answer

VPLS uses a hub-and-spoke topology to interconnect multiple sites.

Answer

EoMPLS supports MAC address learning between sites.

Question 13

A service provider has a network with multiple PE routers providing MPLS L3VPN services. Customers are complaining that some remote sites are unreachable after a recent software upgrade on PE1. Upon investigation, you notice that PE1 is receiving BGP VPNv4 routes from the route reflector, but some routes are not being installed in the VRF routing table. PE1 is configured with BGP additional-path capability and has a route policy that selects only the best path. The VRF on PE1 has import and export route targets configured correctly. The missing routes have a higher local preference but are not selected due to a tie-break in BGP path selection. Which action should be taken to ensure that all valid routes are installed in the VRF?

Accepted Answer

Configure BGP additional-paths for the VRF and adjust the route policy to allow multiple paths.. B is correct because the issue is that PE1 is configured with BGP additional-path capability but has a route policy that selects only the best path. When BGP path selection ties on local preference and other attributes, additional-path send/receive capability allows multiple paths to be considered, but the route policy must be adjusted to permit multiple paths into the VRF. Without this, only the single best path is installed, even if valid alternative paths exist.

Answer

Reset the BGP session between PE1 and the route reflector.

Answer

Disable route target filtering on PE1 to import all routes.

Answer

Increase the local preference on the route reflector for the missing routes.

Question 14

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Accepted Answer

6VPE. 6VPE (IPv6 VPN Provider Edge) requires a dedicated control plane per VPN instance because it uses separate per-VPN routing tables and a distinct BGP session (typically MP-BGP with the IPv6 address family) to exchange IPv6 VPN routes. This ensures that each customer's IPv6 routing information is isolated and processed independently, which is a core requirement for L3VPN services that maintain per-VPN forwarding and control plane separation.

Answer

VPLS

Answer

MDT VPN

Question 15

Refer to the exhibit. CE1 is not receiving the VPNv4 route for the 192.168.1.0/24 subnet. What is the most likely cause?

Accepted Answer

PE1 is missing the neighbor statement under address-family ipv4 vrf CUSTOMER_A. For CE1 to receive the VPNv4 route for 192.168.1.0/24, PE1 must redistribute the route from the VRF into BGP. The neighbor statement under address-family ipv4 vrf CUSTOMER_A is required to establish an eBGP peering with CE1 and exchange IPv4 routes within that VRF. Without it, PE1 will not send any routes to CE1, even if the VRF and route targets are correctly configured.

Answer

PE1 is missing the VRF configuration for CUSTOMER_A

Answer

CE1 is missing the network statement under router bgp 65001

Answer

The neighbor 10.0.0.2 is using an incorrect update-source

Question 16

A service provider is deploying a point-to-point Layer 2 VPN across an MPLS network using Ethernet over MPLS (EoMPLS) with Martini encapsulation. The customer requires transparent transport of VLAN tags (Q-in-Q) between two sites. The provider configures the attachment circuits on the PE routers as VLAN subinterfaces with dot1q encapsulation. After configuration, the customer reports that only untagged frames pass through the pseudowire; double-tagged frames are dropped at the egress PE. Which action resolves the issue?

Accepted Answer

Change the encapsulation on the PE subinterfaces to dot1q second-dot1q and enable the preservation of the outer VLAN tag at the ingress PE. Option D is correct because EoMPLS with Martini encapsulation (RFC 4448) supports Q-in-Q transparent transport only when the ingress PE is configured to preserve the outer VLAN tag. Using 'dot1q second-dot1q' encapsulation on the subinterface tells the PE to treat the outer tag as part of the payload and not strip it, allowing both tags to be carried across the pseudowire. Without this, the default dot1q encapsulation strips the outer tag, causing double-tagged frames to be dropped at the egress PE.

Answer

Replace the attachment circuit with a port-mode Layer 2 interface and disable VLAN tagging on the PE

Answer

Configure the pseudowire to use the 'tag-imposition' keyword to allow double tagging

Answer

Configure the PE routers to use VLAN translation to map both tags to a single tag before encapsulation

Question 17

Drag and drop the steps to configure a GRE tunnel on a Cisco router into the correct order.

Question 18

Match each Segment Routing component to its function.

Question 19

A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?

Accepted Answer

SR-TE. Option C is correct because Segment Routing offers traffic engineering capabilities via a centralized controller (e.g., PCE) or distributed policies using SR-TE policies, eliminating the need for RSVP-TE. Option A is wrong because LDP does not support traffic engineering. Option B is wrong because BGP-LU only provides LSP labels, not TE. Option D is wrong because MPLS-TE is synonymous with RSVP-TE.

Answer

LDP

Answer

MPLS-TE (RSVP-TE)

Answer

BGP-LU

Question 20

A service provider is deploying EVPN-VPWS to replace legacy pseudowire connections for point-to-point Layer 2 services. They notice that MAC addresses learned from a CE device are not properly advertised to the remote PE. Which EVPN route type is responsible for advertising MAC address reachability information in a VPWS scenario?

Accepted Answer

Route Type 1 (Ethernet Auto-Discovery). Option A is correct because Route Type 1 (Ethernet Auto-Discovery) is used for VPWS per-EVI and per-ES AD routes, which include MAC mobility information. Route Type 2 is for MAC/IP advertisement, but in VPWS, MAC learning is not required typically; however, Route Type 1 carries the MAC address for split-horizon filtering. Option B (RT-2) is for MAC/IP but not the primary for VPWS. Option C (RT-3) is for inclusive multicast. Option D (RT-5) is for IP prefix.

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 5 (IP Prefix)

Answer

Route Type 3 (Inclusive Multicast)