350-501 Architecture — 100 Questions

Question 1

An engineer needs to ensure that a core router can forward MPLS packets without checking the IP header. Which forwarding mechanism should be enabled?

Accepted Answer

CEF switching. Cisco Express Forwarding (CEF) is the required switching mechanism for MPLS forwarding. When MPLS is enabled on a router, CEF uses the Label Forwarding Information Base (LFIB) to forward packets based solely on the top label, without inspecting the IP header. This allows core routers (P routers) to perform label switching without IP lookups. Penultimate Hop Popping (PHP) is an optimization that occurs at the penultimate router, but it is not the mechanism that enables label-based forwarding; it relies on CEF. Therefore, enabling CEF switching is necessary for a core router to forward MPLS packets without checking the IP header.

Answer

Link Fragmentation and Interleaving (LFI)

Answer

Per-packet load balancing

Answer

Penultimate Hop Popping (PHP)

Question 2

Which TWO of the following are benefits of using EVPN over traditional VPLS for L2VPN services?

Accepted Answer

EVPN uses BGP for control plane to advertise MAC addresses.. EVPN uses BGP for its control plane to advertise MAC addresses, whereas VPLS relies on data-plane flooding. Option C is correct: EVPN supports active-active multi-homing with load balancing, unlike VPLS which typically uses active/standby.

Answer

EVPN uses a single MAC address per Ethernet segment.

Answer

EVPN requires a full mesh of pseudowires between all PEs.

Answer

EVPN only supports L2 extension, not L3.

Question 3

Which TWO of the following are disadvantages of using VPLS for L2VPN services compared to EVPN?

Accepted Answer

MAC address learning via flooding across all PEs.. VPLS disadvantages compared to EVPN include: D) MAC address learning via flooding across all PEs, which consumes bandwidth and is inefficient; E) Limited to active/standby multi-homing in most implementations, whereas EVPN supports active/active multi-homing for better load balancing and redundancy.

Answer

Provides better scalability than EVPN.

Answer

Requires BGP control plane for signaling.

Answer

Supports only point-to-point service, not multipoint.

Question 4

A service provider wants to deploy network slicing for 5G services. Which THREE of the following are typical requirements for network slicing?

Accepted Answer

End-to-end orchestration and lifecycle management.. Network slicing for 5G requires end-to-end orchestration and lifecycle management (A) to coordinate across domains, dedicated core network functions per slice (C) such as UPF and SMF to provide customized services, and resource isolation (D) in compute, network, and storage to guarantee performance and security. Option B is incorrect because slices do not need separate BGP AS numbers; they can use VRFs or other mechanisms within a shared AS. Option E is incorrect because slices typically share physical infrastructure; dedicated fibers and routers per slice are not required and would be cost-prohibitive.

Answer

Each slice must use a different BGP autonomous system number.

Answer

Dedicated physical fibers and routers per slice.

Question 5

A service provider is designing a new MPLS L3VPN service. The customer requires that their VPN traffic be isolated from other customers and that the provider edge routers maintain separate routing tables for each VPN. Which architectural component is essential for this separation?

Accepted Answer

VRF (Virtual Routing and Forwarding). VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.

Answer

MPLS label stacking

Answer

VLAN tagging on the customer-facing interfaces

Answer

BGP route reflectors

Question 6

An operator notices that a new MPLS-TE tunnel is not being established. The tunnel configuration includes a dynamic path option and a bandwidth of 100 Mbps. The network uses RSVP-TE with CSPF. The link-state database shows sufficient reservable bandwidth on all links along the calculated path. What is the most likely cause of the tunnel establishment failure?

Accepted Answer

RSVP-TE is not enabled on the transit interfaces. RSVP-TE must be explicitly enabled on every interface that will participate in MPLS-TE label-switched path (LSP) signaling. Even if the link-state database shows sufficient reservable bandwidth, without RSVP-TE enabled on transit interfaces, the PATH messages cannot be processed, and the tunnel will fail to establish. This is a common misconfiguration when deploying MPLS-TE.

Answer

The path option is misconfigured with a strict explicit path

Answer

MPLS LDP is not enabled on the core routers

Answer

The tunnel source interface is not configured with an IP address

Question 7

Which network architecture model separates the control plane and data plane in a way that allows for centralized control and distributed forwarding?

Accepted Answer

SDN architecture. Software-Defined Networking (SDN) architecture explicitly separates the control plane from the data plane, centralizing network intelligence in a controller while leaving packet forwarding to distributed switches and routers. This decoupling enables programmatic, centralized control of the network, with the controller (e.g., OpenDaylight, Cisco APIC) making forwarding decisions and pushing flow entries to devices via protocols like OpenFlow or OpFlex. The result is a logically centralized brain with physically distributed forwarding, which is the defining characteristic of SDN.

Answer

MPLS architecture

Answer

VPN architecture

Answer

QoS architecture

Question 8

A service provider is troubleshooting a BGP route advertisement issue. Routes from a customer are not being advertised to the upstream provider. The PE router is configured with 'neighbor 10.0.0.1 route-map RMAP out'. The route-map RMAP permits the customer prefix. However, the BGP table on the PE shows the prefix as valid but not advertised. What is a likely cause?

Accepted Answer

The next-hop is not reachable from the upstream provider. The BGP table shows the prefix as valid but not advertised, which indicates that BGP has the route but is not sending it to the upstream neighbor. A common cause is that the next-hop for the customer prefix is not reachable from the PE router via the interface used to reach the upstream provider. BGP will not advertise a route if the next-hop is not reachable in the routing table (unless 'neighbor x.x.x.x next-hop-self' is configured), because the upstream router would be unable to forward traffic to that next-hop.

Answer

The BGP session to the upstream provider is flapping

Answer

The prefix is not in the global routing table

Answer

The route-map is applied inbound instead of outbound

Question 9

In a carrier's network, MPLS-TE tunnels are used to steer traffic away from congested links. The operator configures a tunnel with a bandwidth of 200 Mbps and a dynamic path. The CSPF computation shows a path with sufficient bandwidth, but the tunnel fails to come up. The RSVP neighbor is established. What is the most likely cause?

Accepted Answer

The path message is rejected due to resource reservation failure. The tunnel fails to come up because the CSPF-computed path cannot reserve the requested 200 Mbps bandwidth. Even though the path has sufficient bandwidth on paper, the RSVP resource reservation process may fail due to a lack of available bandwidth at the exact time of reservation, or due to a mismatch in bandwidth pool configuration (e.g., global vs. subpool). Since the RSVP neighbor is established, the issue is specifically with the reservation step, not with reachability or LDP.

Answer

The tunnel destination is not reachable via IGP

Answer

The tunnel interface is down

Answer

MPLS LDP is not configured

Question 10

A service provider wants to offer Layer 2 VPN services using MPLS. Which technology should be used to transport Ethernet frames across the MPLS core?

Accepted Answer

Pseudowire. Pseudowire (A) is the correct technology because it provides a point-to-point Layer 2 circuit over an MPLS core, allowing Ethernet frames to be encapsulated and transported transparently. This is defined in RFC 4448 (Ethernet over MPLS) and enables service providers to offer E-Line services. Pseudowire uses MPLS labels to forward frames across the core without requiring the core routers to participate in the customer's Layer 2 control plane.

Answer

LDP

Answer

VPLS

Answer

L3VPN

Question 11

An engineer is designing an MPLS L3VPN solution and must ensure that the provider edge (PE) routers can handle routing updates for multiple customers without interfering with each other. Which mechanism should be used on the PE routers?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding) is the correct mechanism because it allows a single PE router to maintain multiple separate routing tables (VRFs), each dedicated to a different customer. This ensures that routing updates for one customer are isolated from another, preventing interference. VRF-Lite achieves this without MPLS, using only IP forwarding and per-VRF routing instances.

Answer

Route distinguishers

Answer

Route reflectors

Answer

MPLS-TE

Question 12

A network operator is deploying segment routing in an MPLS network. They want to use a centralized controller to compute paths based on traffic demand and network constraints. Which architecture is being used?

Accepted Answer

Segment Routing Path Computation Element (SR-PCE). The scenario describes a centralized controller computing paths based on traffic demand and network constraints, which is the definition of a Path Computation Element (PCE) architecture. In Segment Routing, the SR-PCE (Segment Routing Path Computation Element) is the centralized controller that calculates optimal paths using traffic engineering constraints and then communicates the path information (via PCEP) to the headend router. This is distinct from distributed control plane approaches like LDP or SR-BE, and from SR-TE which is the overall traffic engineering mechanism but not the specific centralized controller architecture.

Answer

LDP-based MPLS

Answer

Segment Routing Traffic Engineering (SR-TE)

Answer

Segment Routing Best Effort (SR-BE)

Question 13

Which TWO of the following are characteristics of MPLS L3VPN architecture? (Choose two.)

Accepted Answer

Each customer has a separate VRF on the PE router. In MPLS L3VPN, each customer is assigned a separate Virtual Routing and Forwarding (VRF) instance on the Provider Edge (PE) router. This VRF maintains a unique routing table and forwarding table per customer, ensuring complete isolation between different VPN customers on the same PE.

Answer

All traffic is forwarded using MPLS label switching only

Answer

LDP is required for label distribution in the core

Answer

The P routers maintain a full routing table for each VPN

Question 14

Which TWO of the following are advantages of segment routing over traditional LDP-based MPLS? (Choose two.)

Accepted Answer

Eliminates the need for the LDP protocol. Segment routing (SR-MPLS) eliminates the need for the LDP protocol by encoding MPLS labels directly in the IGP (e.g., OSPF or IS-IS) using extensions like RFC 8665 and RFC 8667. This simplifies the control plane by removing an entire protocol (LDP) and its associated state, reducing operational complexity and convergence time.

Answer

Reduces the number of BGP peers required

Answer

Requires RSVP-TE for traffic engineering

Answer

Eliminates the need for IGP

Question 15

Which THREE of the following are key components of an MPLS L3VPN architecture? (Choose three.)

Accepted Answer

VRF on PE routers. VRF (Virtual Routing and Forwarding) on PE routers is a key component because it isolates customer routing tables and forwarding planes within the provider edge, allowing multiple customers to share the same physical infrastructure while maintaining separate routing domains. Each VRF maintains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, which is fundamental to L3VPN separation.

Answer

RSVP-TE for traffic engineering

Answer

P routers with full VPN routing tables

Question 16

Refer to the exhibit. A network engineer configures a BGP route-map to set communities on routes advertised to a neighbor. After applying the configuration, the engineer checks the BGP table on the neighbor router and does not see the communities. What is the most likely reason?

Accepted Answer

The neighbor is missing the 'send-community' command. C is correct because BGP communities are not sent to a neighbor by default. Even if a route-map sets the community values correctly, the neighbor will not receive them unless the 'send-community' command is configured under the neighbor statement. This command enables the advertisement of the community attribute in BGP updates.

Answer

The prefix-list does not match the exact prefix

Answer

The community values are not in the format 'AA:NN'

Answer

The route-map needs to be applied inbound

Question 17

Refer to the exhibit. An engineer configures MPLS LDP on a router. The router has two interfaces with IP addresses 10.0.0.1/30 and 10.0.0.5/30. The engineer notices that LDP sessions are not established. The OSPF neighbor adjacencies are up. What is the most likely cause?

Accepted Answer

LDP is not enabled on the interfaces. D is correct because MPLS LDP requires explicit interface-level activation under the `mpls ip` command. Even if OSPF adjacencies are up and the global LDP process is configured, LDP will not form sessions on interfaces where `mpls ip` is missing. The engineer likely enabled LDP globally but forgot to enable it on the specific interfaces, which is a common oversight.

Answer

The OSPF network statements do not cover the interfaces correctly

Answer

The MPLS MTU is set to 1500, which is too low

Answer

The label range is too small

Question 18

You are a network architect for a large service provider. The network consists of multiple core routers (P routers) and edge routers (PE routers) supporting both L3VPN and L2VPN services. The network currently uses LDP for label distribution and has a flat IGP (OSPF) design. Recently, there have been scalability issues: the IGP convergence time has increased significantly, and the OSPF link-state database (LSDB) has grown large, causing high CPU utilization on core routers. Additionally, the LDP sessions are taking longer to establish after a router reboot. You are tasked with redesigning the network to improve scalability and convergence. The budget allows for significant changes but cannot replace all hardware. Which approach best addresses the scalability issues while minimizing disruption?

Accepted Answer

Implement Segment Routing (SR-MPLS) to replace LDP and reduce IGP overhead. Segment Routing (SR-MPLS) eliminates the need for LDP by encoding MPLS labels directly in the IGP (OSPF or IS-IS) using extensions, which reduces control-plane overhead and speeds up convergence. This directly addresses the large OSPF LSDB and slow LDP session establishment because SR-MPLS does not require a separate label distribution protocol and can leverage a single IGP for both routing and label information, improving scalability without hardware replacement.

Answer

Upgrade OSPF to OSPFv3 to support IPv6 and improve performance

Answer

Introduce IS-IS as a second IGP to offload traffic from OSPF, and use route redistribution between the two protocols

Answer

Replace OSPF with BGP as the core IGP to reduce link-state overhead

Question 19

You are a network engineer at a service provider that offers L3VPN services. A customer complains that their VPN traffic is intermittently dropping. The network uses OSPF as the IGP, LDP for label distribution, and MP-BGP for VPNv4 route exchange. The PE routers are connected to two core routers (P1 and P2) in a redundant design. Upon investigation, you find that the BGP next-hop for some VPN prefixes is set to the loopback interface of the remote PE, but the route to that loopback is sometimes unreachable due to a flapping link between P1 and P2. The IGP converges, but the BGP prefixes take longer to recover. What is the most likely cause of the intermittent drops?

Accepted Answer

BGP next-hop tracking is not enabled, causing BGP to rely on IGP convergence only. The intermittent drops occur because BGP next-hop tracking (NHT) is not enabled. Without NHT, BGP relies solely on IGP convergence to detect reachability changes for the BGP next-hop (the remote PE loopback). When the link between P1 and P2 flaps, OSPF converges quickly, but BGP does not immediately re-evaluate its next-hop reachability; it waits for the next BGP scan interval (default 60 seconds) or until a BGP update is received. This delay causes the VPN prefixes to remain installed with an unreachable next-hop, leading to traffic drops until BGP eventually withdraws or re-advertises the routes.

Answer

The OSPF network type is incorrectly set to point-to-point

Answer

The BGP timers are set too low, causing premature route withdrawal

Answer

The LDP session between the PEs is down

Question 20

A service provider is redesigning its MPLS core to support both L3VPN and L2VPN services. They want to minimize the number of labels in the forwarding table while maintaining per-VRF label allocation. Which label allocation mode should be used for the L3VPN service?

Accepted Answer

Per-VRF label allocation. Per-VRF label allocation assigns a single MPLS label per VRF, meaning all routes within a VRF share the same label. This minimizes the number of labels in the forwarding table compared to per-prefix allocation, while still maintaining per-VRF isolation for L3VPN services. It is the recommended mode when the goal is to reduce label consumption without sacrificing VPN separation.

Answer

Per-CE label allocation

Answer

Per-prefix label allocation

Answer

Per-instance label allocation