350-501 Architecture — 20 Questions

Question 1

A service provider is troubleshooting a BGP route advertisement issue. Routes from a customer are not being advertised to the upstream provider. The PE router is configured with 'neighbor 10.0.0.1 route-map RMAP out'. The route-map RMAP permits the customer prefix. However, the BGP table on the PE shows the prefix as valid but not advertised. What is a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The next-hop is not reachable from the upstream provider. The BGP table shows the prefix as valid but not advertised, which indicates that BGP has the route but is not sending it to the upstream neighbor. A common cause is that the next-hop for the customer prefix is not reachable from the PE router via the interface used to reach the upstream provider. BGP will not advertise a route if the next-hop is not reachable in the routing table (unless 'neighbor x.x.x.x next-hop-self' is configured), because the upstream router would be unable to forward traffic to that next-hop.

Answer

The BGP session to the upstream provider is flapping

Answer

The prefix is not in the global routing table

Answer

The route-map is applied inbound instead of outbound

Question 2

A service provider wants to offer Layer 2 VPN services using MPLS. Which technology should be used to transport Ethernet frames across the MPLS core?

Accepted Answer

Pseudowire. Pseudowire (A) is the correct technology because it provides a point-to-point Layer 2 circuit over an MPLS core, allowing Ethernet frames to be encapsulated and transported transparently. This is defined in RFC 4448 (Ethernet over MPLS) and enables service providers to offer E-Line services. Pseudowire uses MPLS labels to forward frames across the core without requiring the core routers to participate in the customer's Layer 2 control plane.

Answer

LDP

Answer

VPLS

Answer

L3VPN

Question 3

An engineer is designing an MPLS L3VPN solution and must ensure that the provider edge (PE) routers can handle routing updates for multiple customers without interfering with each other. Which mechanism should be used on the PE routers?

Accepted Answer

VRF-Lite. VRF-Lite (Virtual Routing and Forwarding) is the correct mechanism because it allows a single PE router to maintain multiple separate routing tables (VRFs), each dedicated to a different customer. This ensures that routing updates for one customer are isolated from another, preventing interference. VRF-Lite achieves this without MPLS, using only IP forwarding and per-VRF routing instances.

Answer

Route distinguishers

Answer

Route reflectors

Answer

MPLS-TE

Question 4

A network operator is deploying segment routing in an MPLS network. They want to use a centralized controller to compute paths based on traffic demand and network constraints. Which architecture is being used?

Accepted Answer

Segment Routing Path Computation Element (SR-PCE). The scenario describes a centralized controller computing paths based on traffic demand and network constraints, which is the definition of a Path Computation Element (PCE) architecture. In Segment Routing, the SR-PCE (Segment Routing Path Computation Element) is the centralized controller that calculates optimal paths using traffic engineering constraints and then communicates the path information (via PCEP) to the headend router. This is distinct from distributed control plane approaches like LDP or SR-BE, and from SR-TE which is the overall traffic engineering mechanism but not the specific centralized controller architecture.

Answer

LDP-based MPLS

Answer

Segment Routing Traffic Engineering (SR-TE)

Answer

Segment Routing Best Effort (SR-BE)

Question 5

You are a network architect for a large service provider. The network consists of multiple core routers (P routers) and edge routers (PE routers) supporting both L3VPN and L2VPN services. The network currently uses LDP for label distribution and has a flat IGP (OSPF) design. Recently, there have been scalability issues: the IGP convergence time has increased significantly, and the OSPF link-state database (LSDB) has grown large, causing high CPU utilization on core routers. Additionally, the LDP sessions are taking longer to establish after a router reboot. You are tasked with redesigning the network to improve scalability and convergence. The budget allows for significant changes but cannot replace all hardware. Which approach best addresses the scalability issues while minimizing disruption?

Accepted Answer

Implement Segment Routing (SR-MPLS) to replace LDP and reduce IGP overhead. Segment Routing (SR-MPLS) eliminates the need for LDP by encoding MPLS labels directly in the IGP (OSPF or IS-IS) using extensions, which reduces control-plane overhead and speeds up convergence. This directly addresses the large OSPF LSDB and slow LDP session establishment because SR-MPLS does not require a separate label distribution protocol and can leverage a single IGP for both routing and label information, improving scalability without hardware replacement.

Answer

Upgrade OSPF to OSPFv3 to support IPv6 and improve performance

Answer

Introduce IS-IS as a second IGP to offload traffic from OSPF, and use route redistribution between the two protocols

Answer

Replace OSPF with BGP as the core IGP to reduce link-state overhead

Question 6

You are a network engineer at a service provider that offers L3VPN services. A customer complains that their VPN traffic is intermittently dropping. The network uses OSPF as the IGP, LDP for label distribution, and MP-BGP for VPNv4 route exchange. The PE routers are connected to two core routers (P1 and P2) in a redundant design. Upon investigation, you find that the BGP next-hop for some VPN prefixes is set to the loopback interface of the remote PE, but the route to that loopback is sometimes unreachable due to a flapping link between P1 and P2. The IGP converges, but the BGP prefixes take longer to recover. What is the most likely cause of the intermittent drops?

Accepted Answer

BGP next-hop tracking is not enabled, causing BGP to rely on IGP convergence only. The intermittent drops occur because BGP next-hop tracking (NHT) is not enabled. Without NHT, BGP relies solely on IGP convergence to detect reachability changes for the BGP next-hop (the remote PE loopback). When the link between P1 and P2 flaps, OSPF converges quickly, but BGP does not immediately re-evaluate its next-hop reachability; it waits for the next BGP scan interval (default 60 seconds) or until a BGP update is received. This delay causes the VPN prefixes to remain installed with an unreachable next-hop, leading to traffic drops until BGP eventually withdraws or re-advertises the routes.

Answer

The OSPF network type is incorrectly set to point-to-point

Answer

The BGP timers are set too low, causing premature route withdrawal

Answer

The LDP session between the PEs is down

Question 7

A service provider is deploying EVPN-MPLS for L2VPN services. The customer requires that MAC addresses learned from one PE are not advertised to other PEs unless they are active. Which EVPN route type is used for MAC address withdrawal?

Accepted Answer

Route Type 2: MAC/IP Advertisement. EVPN Route Type 2 (MAC/IP Advertisement) carries both MAC addresses and their associated IP addresses, and it supports a 'sticky' or 'withdraw' mechanism via the BGP Withdraw message. When a MAC address becomes inactive on a PE, the PE sends a BGP Withdraw for the specific Route Type 2 route, effectively removing that MAC from the control plane of other PEs. This ensures that only active MAC addresses are advertised, meeting the customer requirement.

Answer

Route Type 5: IP Prefix

Answer

Route Type 1: Ethernet Auto-Discovery (A-D)

Answer

Route Type 3: Inclusive Multicast Ethernet Tag

Question 8

A customer reports that CE routers attached to PE1 and PE2 in the same VRF cannot ping each other. Based on the exhibit, what is the most likely cause?

Accepted Answer

LDP is not enabled on the core interfaces between PE1 and PE2. B is correct because LDP must be enabled on the core interfaces between PE1 and PE2 to establish LDP sessions, which are required to exchange MPLS labels for the transport LSP. Without LDP, the MPLS forwarding path between the PEs is broken, preventing CE-to-CE ping even if BGP VPNv4 routes are correctly advertised.

Answer

Missing address-family ipv4 for BGP neighbor

Answer

Mismatched route distinguisher (RD) values on PE1 and PE2

Answer

Route target (RT) import/export mismatch

Question 9

Based on the exhibit, which label operation will occur when a packet destined to 10.2.2.1 enters PE1 with label 17?

Accepted Answer

Swap label 17 to label 18. The exhibit shows an MPLS VPN scenario where PE1 receives a labeled packet destined for 10.2.2.1. The incoming label 17 corresponds to the VPNv4 route for 10.2.2.1/32, and the LFIB on PE1 indicates a swap operation to label 18, which is the transport label used to forward the packet across the MPLS core toward the next-hop PE.

Answer

Forward with no label (Untagged)

Answer

Pop the label and forward as IP

Answer

Push label 17 onto the packet

Question 10

Refer to the exhibit. The router is configured as a PE router in an MPLS VPN network. Which option correctly identifies a configuration error that would prevent proper operation?

Accepted Answer

The OSPF network statement uses an incorrect wildcard mask. The OSPF network statement uses a wildcard mask of 0.0.0.0, which matches only the exact IP address 10.1.1.1, but the interface has a /30 prefix (255.255.255.252), so the correct wildcard mask should be 0.0.0.3 to include the entire subnet. This misconfiguration prevents OSPF from advertising the correct network, breaking MPLS VPN CE-to-PE routing.

Answer

The neighbor remote-as should be the same AS number for iBGP

Answer

The interface lacks the 'mpls ip' command

Answer

The BGP network statement does not match the interface prefix

Question 11

A service provider is deploying an MPLS L3VPN solution for a customer with two sites. The PE routers are running OSPF as the IGP and LDP for label distribution. The provider wants to ensure that customer traffic is load-balanced across two equal-cost paths between the PEs. The network team notices that all traffic is taking only one path despite the IGP showing equal-cost routes. The team has verified that the MPLS forwarding table on the P router shows only one label entry for the BGP next-hop. The team suspects a load-balancing issue. Which action best resolves the problem?

Accepted Answer

Enable per-flow load balancing on all routers with 'load-balance per-flow'. The issue is that MPLS L3VPN traffic is not being load-balanced despite equal-cost IGP paths. This typically occurs when the MPLS forwarding table on the P router has only one label entry for the BGP next-hop, indicating that per-flow load balancing is not enabled. Enabling 'load-balance per-flow' on all routers ensures that the CEF (Cisco Express Forwarding) uses per-flow hashing to distribute traffic across multiple equal-cost LSPs (Label Switched Paths), rather than per-packet or default behavior that may favor a single path.

Answer

Increase the OSPF maximum-paths value to 4

Answer

Enable BGP additional-paths on the PE routers

Answer

Configure LDP to use the 'mpls ldp igp sync' command

Question 12

An engineer is troubleshooting a BGP route propagation issue. The customer is receiving a default route from upstream provider, but the route is not being installed in the routing table. The BGP table shows the route is valid but not best. What is the most likely cause?

Accepted Answer

A static default route with lower administrative distance exists. A static default route with a lower administrative distance (e.g., 1) will be preferred over a BGP default route (AD 20 for eBGP). Even though the BGP route is valid in the BGP table, it is not installed in the routing table because the static route is more trustworthy. This is a common scenario where the routing table already has a better path, preventing the BGP route from becoming 'best' and being installed.

Answer

The next-hop is unreachable

Answer

The route is filtered by an inbound route-map

Answer

The BGP session is not established

Question 13

A network engineer is designing a Layer 2 VPN using EVPN with MPLS data plane. The customer requires all-hub multipoint connectivity with optimal multicast replication. Which EVPN route type is used to advertise multicast group membership?

Accepted Answer

Route Type 6 (Selective Multicast Ethernet Tag). Route Type 6 (Selective Multicast Ethernet Tag) is used in EVPN to advertise multicast group membership for selective multicast replication. This allows the provider edge (PE) routers to build optimal multicast trees for specific groups, enabling efficient all-hub multipoint connectivity with EVPN-MPLS data plane.

Answer

Route Type 3 (Inclusive Multicast Ethernet Tag)

Answer

Route Type 2 (MAC/IP Advertisement)

Answer

Route Type 4 (Ethernet Segment)

Question 14

A service provider is implementing MPLS TE to optimize bandwidth utilization. The engineer notices that tunnels are not using the explicitly configured path. What is the most likely reason?

Accepted Answer

The explicit path contains a link that is down. When an MPLS TE tunnel is configured with an explicit path, the headend router uses RSVP to signal the path and verify that all links in the path are operational. If any link in the explicit path is down, RSVP signaling fails for that path, and the tunnel may fall back to dynamic path computation or remain down, rather than using the explicitly configured path. This is the most common reason for a tunnel not using its explicit path.

Answer

RSVP is not enabled on the headend

Answer

The tunnel destination is not reachable via IGP

Answer

The tunnel is configured with 'autoroute announce'

Question 15

Drag and drop the steps to configure EIGRP on a Cisco router into the correct order.

Accepted Answer

Router(config)# router eigrp 100
Router(config-router)# network 10.0.0.0
Router(config-router)# no auto-summary. EIGRP configuration requires entering the EIGRP process, advertising networks, and optionally disabling auto-summary.

Answer

Router(config)# router eigrp 100
Router(config-router)# no auto-summary
Router(config-router)# network 10.0.0.0

Answer

Router(config)# network 10.0.0.0
Router(config)# router eigrp 100
Router(config-router)# no auto-summary

Answer

Router(config)# router eigrp 100
Router(config-router)# no auto-summary
Router(config-router)# network 10.0.0.0
(Router(config-router)# exit)

Question 16

Match each MPLS protection mechanism to its description.

Accepted Answer

MPLS Fast Reroute (FRR): Protects against link or node failures by pre-computing a backup path for each LSP.. The correct matches are: A (MPLS FRR), B (MPLS TE FRR), C (MPLS PW Redundancy), D (MPLS LSP Protection). Distractors E and F swap definitions or use incorrect descriptions.

Answer

MPLS Fast Reroute (FRR): Protects against failures by using a globally reserved bandwidth pool for all backup LSPs.

Answer

MPLS Traffic Engineering Fast Reroute (TE FRR): Protects against failures by relying on IP routing convergence of the IGP.

Question 17

A network engineer is troubleshooting QoS in a service provider environment. Customer traffic is marked with DSCP AF31 (011010) at the CE. On the PE router, the policy maps trust DSCP and sets the CoS to 4. However, core routers remark the DSCP to 0. What is the most likely cause?

Accepted Answer

A policer on the core router is marking down out-of-contract traffic. The core router is likely applying a policer that marks down traffic exceeding the committed information rate (CIR). When traffic is out-of-contract, the policer can re-mark the DSCP to 0 (best effort), which overrides the trusted DSCP AF31 and the CoS 4 set at the PE. This behavior is common in service provider environments where core routers enforce traffic contracts and use policing to penalize excess traffic.

Answer

The core routers use LDP labels and ignore DSCP

Answer

The ingress PE did not set MPLS EXP bits

Answer

The MPLS EXP bits are not copied from DSCP

Question 18

A service provider is implementing EVPN with MPLS data plane. Which encapsulation type is used in MPLS EVPN to carry Ethernet frames across the MPLS network?

Accepted Answer

MPLS label stack with a control word for Ethernet frames. In MPLS EVPN, Ethernet frames are carried across the MPLS network using an MPLS label stack that includes a control word. The control word (4 bytes) is inserted between the MPLS label stack and the Ethernet frame to prevent misordering and to enable proper frame delineation. This encapsulation is defined in RFC 8214 (formerly RFC 7432) and is distinct from older EoMPLS or simple IP/MPLS tunneling.

Answer

Ethernet over MPLS (EoMPLS) with VLAN encapsulation

Answer

EVPN encapsulation defined by IETF RFC 7432

Answer

IP/MPLS tunnel with Ethernet frame inside

Question 19

Which protocol is used to discover MPLS peers for LDP session establishment?

Accepted Answer

UDP. LDP uses UDP multicast (224.0.0.2) on port 646 to discover directly connected MPLS peers, as specified in RFC 5036. This allows LDP to dynamically find neighbors without manual configuration, using UDP for the initial discovery phase before establishing a TCP session for label exchange.

Answer

TCP

Answer

ARP

Answer

ICMP

Question 20

Refer to the exhibit. The router is configured as a route reflector for VPNv4. What is the requirement for the route reflector to propagate VPNv4 routes received from a client to other clients?

Accepted Answer

The route reflector must include the originator ID attribute to prevent loops. The route reflector must include the originator ID attribute to prevent routing loops when reflecting VPNv4 routes between clients. The originator ID is set to the router ID of the originating IBGP speaker, and the route reflector ignores any route with an originator ID equal to its own router ID, thereby preventing loops in a client-to-client reflection scenario.

Answer

The route reflector must filter routes based on route-target communities

Answer

The route reflector must use the same cluster ID for all clients

Answer

The route reflector must set the next-hop to itself for all reflected routes