350-501 Architecture Practice Test 3 — 15 Questions

Question 1

A service provider uses BGP communities to influence routing policies. An administrator wants to prevent a specific prefix from being advertised to any external AS. Which BGP community should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NO_EXPORT. The NO_EXPORT community (well-known community 0xFFFFFF01) tells the router not to advertise the prefix to any external BGP peer (eBGP), but allows it to be advertised within the same AS (iBGP). This matches the requirement to prevent the prefix from being advertised to any external AS, as NO_EXPORT is specifically designed to keep routes confined to the local autonomous system.

Answer

NO_ADVERTISE

Answer

INTERNET

Answer

LOCAL_AS

Answer

NONE

Question 2

In an MPLS VPN, what label operation does the egress PE perform on the VPN packet before forwarding it to the CE?

Accepted Answer

Pop the label stack. In an MPLS VPN, the egress PE (Provider Edge) router receives a packet with a label stack typically consisting of a transport label (IGP label) and a VPN label. Before forwarding the IP packet to the CE (Customer Edge), the egress PE must remove the entire MPLS label stack because the CE is an IP-only device that does not understand MPLS labels. This operation is called 'pop the label stack' (also known as penultimate hop popping, though at the egress PE it is explicit label removal).

Answer

Swap the top label

Answer

Impose a VPN label

Answer

Push a new label

Answer

Replace the transport label

Question 3

In Inter-AS MPLS Option B, which routers exchange labeled VPNv4 prefixes directly?

Accepted Answer

ASBR routers. In Inter-AS MPLS Option B, ASBR routers (Autonomous System Boundary Routers) exchange labeled VPNv4 prefixes directly across the AS boundary. This is achieved by having each ASBR perform two label operations: it pops the outer transport label from the VPNv4 prefix received from its own AS, then swaps the inner VPN label and forwards the labeled VPNv4 prefix to the neighboring ASBR in the adjacent AS. This direct exchange eliminates the need for end-to-end LSPs or MP-eBGP sessions between PE routers across different ASes.

Answer

PE routers

Answer

P routers

Answer

CE routers

Answer

Route reflectors

Question 4

An engineer is configuring LDP in an MPLS network. Which THREE are valid label distribution modes for LDP?

Accepted Answer

Downstream on Demand with Independent Label Distribution Control. LDP label distribution modes are defined by combining a distribution method (Downstream Unsolicited or Downstream on Demand) with a label retention mode (Liberal or Conservative) and a label distribution control mode (Independent or Ordered). Option A is valid because Downstream on Demand can be paired with Independent Label Distribution Control, where each LSR advertises labels for prefixes independently when requested by a downstream neighbor. Option B is valid because Downstream Unsolicited with Conservative Label Retention is a standard LDP mode where labels are advertised without being requested, but only labels from the next hop toward a destination are retained. Option C is valid because Downstream Unsolicited with Liberal Label Retention is also a standard LDP mode, where unsolicited labels are advertised and all received labels are retained regardless of whether the sender is the next hop. Option D is not correct because Ordered Label Distribution Control is used with Downstream on Demand, not Downstream Unsolicited, since ordered control requires waiting for a label from the downstream next hop before advertising. Option E is not correct because Liberal Label Retention is not used with Downstream on Demand in standard LDP mode combinations; Downstream on Demand typically uses Conservative Label Retention.

Answer

Downstream Unsolicited with Ordered Label Distribution Control

Answer

Downstream on Demand with Liberal Label Retention

Question 5

A service provider is designing its core network to carry both IPv4 and IPv6 traffic. Which BGP approach best minimizes routing table size on core routers while maintaining full reachability?

Accepted Answer

Use iBGP with route reflectors. iBGP with route reflectors minimizes the number of BGP sessions required in the core network, reducing routing table size and control-plane overhead while still maintaining full IPv4 and IPv6 reachability. Route reflectors allow iBGP speakers to advertise routes learned from other iBGP peers without requiring a full mesh, which is essential for scalability in large service provider cores.

Answer

Use eBGP between all core routers

Answer

Use static routing for all prefixes

Answer

Rely on OSPF for external routes

Question 6

An engineer notices that an MPLS LSP in the core is not establishing. Which troubleshooting step should be performed first?

Accepted Answer

Verify LDP neighbor adjacency. The first step in troubleshooting an MPLS LSP that is not establishing is to verify LDP neighbor adjacency because LDP is the protocol responsible for distributing labels across the MPLS domain. Without a working LDP session between adjacent LSRs, label bindings cannot be exchanged, and the LSP cannot be built. This is the foundational layer for MPLS forwarding, so it must be checked before higher-layer issues like routing or reachability.

Answer

Ping the far-end loopback interface

Answer

Check BGP IPv4 unicast neighbors

Answer

Check OSPF neighbor adjacency on all links

Question 7

Which QoS mechanism is most effective for preventing congestion on a service provider edge link when traffic exceeds the link capacity?

Accepted Answer

Traffic shaping. Traffic shaping is the most effective QoS mechanism for preventing congestion on a service provider edge link when traffic exceeds link capacity because it buffers excess packets and smooths the transmission rate to match the configured committed information rate (CIR). Unlike policing, which drops or re-marks packets, shaping avoids tail drops and packet loss by queuing bursts, making it ideal for edge links where preserving traffic integrity is critical. Cisco IOS uses the Generic Traffic Shaping (GTS) or Class-Based Shaping (CB-Shaping) to enforce a rate limit while maintaining TCP fairness and reducing retransmissions.

Answer

Priority queuing

Answer

Traffic policing

Answer

WRED

Question 8

An SP engineer notices that BGP routes from a CE are not being installed in the VRF routing table, although the BGP session is established. The VRF configuration includes route-target import 100:1. The CE is sending routes with RT 100:1. What is the most likely cause?

Accepted Answer

The route is not matching any import map. Even though the BGP session is up and the CE is sending routes with the correct route-target (RT 100:1), the VRF may have an import map applied. An import map filters which received VPN routes are actually installed into the VRF routing table. If the route does not match the conditions defined in that import map, it will be accepted by BGP but not installed, which explains the symptom.

Answer

The BGP route is suppressed due to route update delay

Answer

The VRF name does not match

Answer

The RD is not configured

Question 9

An SP network uses NTP for synchronization. To secure NTP, which authentication mode should be used?

Accepted Answer

NTPv4 autokey. NTPv4 autokey (Option A) is the correct answer because it provides a secure, automated key distribution mechanism using public-key cryptography (RFC 5906). This eliminates the need for manual key exchange, making it the recommended authentication mode for securing NTP in service provider networks.

Answer

NTPv3 symmetric key

Answer

NTPv4 with SHA-1

Answer

NTPv4 with MD5

Question 10

An SP is using NETCONF with YANG to automate VRF provisioning. The engineer notices that the NETCONF session is established but configuration changes are not applied. Which issue is most likely?

Accepted Answer

The NETCONF capability :candidate is not advertised. NETCONF uses datastores to manage configuration. The `:candidate` capability allows changes to be made to a candidate configuration before committing them. If this capability is not advertised, the device defaults to the `:writable-running` capability, which requires changes to be applied directly to the running datastore. Since the engineer is likely using a candidate-based workflow (e.g., `edit-config` with target `candidate`), the session establishes but changes are silently ignored or rejected because the device does not support a separate candidate datastore.

Answer

The YANG model does not support the target configuration datastore

Answer

The device does not support :url capability

Answer

The user does not have write access to the candidate datastore

Question 11

A service provider is troubleshooting an L2VPN where a CE is unable to ping the remote CE. The PE-CE interfaces are up, and the pseudowire status shows 'up'. Which two actions should be taken to further isolate the issue? (Choose two.)

Accepted Answer

Verify the VC ID match on both PEs. Option D is correct because a pseudowire is formed only when both PEs are configured with the same VC ID (virtual circuit identifier); a mismatch in VC ID will prevent the two attachment circuits from being bound into the same emulated circuit even though the LDP session and pseudowire status may appear up, so verifying the VC ID match on both PEs is a key isolation step. Option E is correct because an MTU mismatch on the pseudowire can silently drop larger frames (especially with fragmentation/DF-bit issues), causing ping failures even when the control plane shows the pseudowire as up, so checking MTU consistency across the attachment circuits and the emulated VC is a valid troubleshooting action. Option A is not appropriate because the CE MAC address table only reflects local CE learning and does not validate the provider's L2VPN forwarding path. Option B is not the best next step because the pseudowire status already shows 'up', implying the LDP session between PEs is established. Option C is not the primary check here since a VFI is used for VPLS (multipoint) rather than a point-to-point L2VPN pseudowire, and the scenario describes a basic L2VPN with a pseudowire.

Answer

Check the MAC address table on the CE

Answer

Check the LDP session between PEs

Answer

Verify the VFI configuration on the PE

Question 12

A network engineer is designing a new MPLS core. Which three of the following are recommended best practices for MPLS LDP configuration? (Choose three.)

Accepted Answer

Enable LDP authentication using MD5. Option C is correct because enabling LDP authentication with MD5 (via mpls ldp password or equivalent) protects the TCP-based LDP session on port 646 from spoofing and session hijacking, which is a standard hardening practice in an MPLS core. Option D is correct because LDP must be enabled on all core-facing interfaces so that label bindings are exchanged consistently across every possible path, ensuring end-to-end LSP establishment and avoiding black-holed or unlabeled traffic. Option E is correct because label filtering (for example, using mpls ldp label allocate or access lists to control which prefixes get labels) limits label distribution to only the required prefixes, reducing label space consumption and preventing unnecessary label advertisement. Option A is not recommended as a general best practice because explicit-null is typically used only in specific inter-AS or QoS/pipe-model scenarios, not universally for BGP prefixes in a new core. Option B is not a standard recommendation because the LDP session holdtime is normally derived from the hello holdtime and defaults (such as 15 seconds hello / 180 seconds session in some implementations) should not be arbitrarily mandated as a design best practice.

Answer

Use explicit null label for BGP prefixes

Answer

Set the LDP session holdtime to 180 seconds

Question 13

A service provider is implementing Segment Routing (SR) with MPLS. Which three statements are true regarding SR-MPLS? (Choose three.)

Accepted Answer

SR-MPLS does not require LDP or RSVP-TE. Option B is correct because SR-MPLS replaces the label-distribution protocols LDP and RSVP-TE by encoding the path as an ordered list of SIDs in the MPLS label stack, so no separate label signaling protocol is needed. Option C is correct because the Segment Routing Global Block (SRGB) defines the label range from which global SIDs (Prefix-SIDs) are allocated, and it must be consistent and globally unique across the SR domain so that the same index maps to the same label on every node. Option E is correct because a Prefix-SID is a global SID typically associated with a node's loopback address (its prefix), allowing any node to reach that prefix via the shortest path using the corresponding MPLS label. Option A is wrong because SR-MPLS supports distributed traffic engineering using adjacency SIDs and policies without requiring a central controller, though a controller may optionally be used. Option D is wrong because Adjacency SIDs are advertised via IGP extensions (IS-IS or OSPF) and can be exported via BGP-LS, but they are not advertised via BGP-LS as their native distribution mechanism.

Answer

SR-MPLS supports traffic engineering only with a central controller

Answer

Adjacency SIDs are advertised via BGP-LS

Question 14

Refer to the exhibit. Based on the exhibit, what is the most likely reason for no label bindings?

Accepted Answer

The remote peer has label filtering applied. The exhibit shows that the local router has not received any label bindings from the remote peer (as evidenced by the empty 'show mpls ldp bindings' output), which indicates that the remote peer is not advertising labels. This is typically due to an outbound label filtering policy applied on the remote peer, such as 'mpls ldp neighbor [neighbor-id] label-filter' or 'mpls ldp label-filter' that rejects label advertisements to the local router. The local router's LDP session may be established (based on 'show mpls ldp neighbor'), but the remote peer is actively preventing label distribution.

Answer

The local router has disabled label advertisements

Answer

The IGP routes are not present in the routing table

Answer

The LDP session is not fully established

Question 15

A network engineer is configuring MPLS LDP on a new router. After enabling LDP globally and on the interface, the LDP session does not establish. The IGP (OSPF) is fully operational. What should the engineer verify first?

Accepted Answer

The interface has 'mpls ip' enabled.. The most common reason LDP fails to establish after global and interface configuration is that the interface is not enabled for MPLS forwarding. The command 'mpls ip' on the interface is required to activate LDP hello messages and label binding on that link. Without it, LDP remains disabled on the interface even if LDP is enabled globally and OSPF is working.

Answer

The LDP password matches.

Answer

The router-id is a loopback.

Answer

The IGP metric is set.