350-501 Architecture Practice Test 4 — 15 Questions

Question 1

In a Carrier Supporting Carrier (CSC) architecture, which condition is necessary for the customer carrier's BGP routes to be carried over the provider carrier's MPLS backbone?

Accepted Answer

The BGP next-hop on the customer carrier's routes must be reachable via IGP in the provider carrier.. In a Carrier Supporting Carrier (CSC) architecture, the provider carrier's MPLS backbone must be able to forward packets toward the BGP next-hop of the customer carrier's routes. For this to happen, the BGP next-hop (typically a loopback interface on the customer carrier's PE router) must be reachable via an IGP (e.g., OSPF or IS-IS) running within the provider carrier's core. Without IGP reachability to that next-hop, the provider carrier's P routers cannot perform MPLS label switching to deliver traffic to the customer carrier's egress router, breaking end-to-end connectivity.

Answer

The provider carrier's VRF must have the route-target matching the customer carrier's.

Answer

The provider carrier must be in the same AS as the customer carrier.

Answer

The customer carrier must use LDP for label distribution.

Question 2

Which TWO are benefits of using Segment Routing over LDP in a service provider core?

Accepted Answer

Label allocation is per-prefix, not per-interface.. Option B is correct because Segment Routing assigns a single SID (label) per prefix advertised by the IGP, rather than LDP's per-interface label binding model, which reduces label churn and simplifies the LFIB when links flap. Option E is correct because SR natively integrates with TI-LFA (Topology-Independent Loop-Free Alternate), providing sub-50 ms fast reroute with full topology protection for any failure scenario, whereas LDP relies on LFA/RLFA with limited coverage. Option A is not a stated benefit since SR still requires label/SID allocation in the control plane; the reduction is in state, not necessarily label count. Option C is wrong because SR still depends on IGP convergence for prefix/SID reachability. Option D is wrong because SR does simplify some TE use cases, but the question asks about SR vs LDP benefits, and TE tunnel configuration simplification is not the defining advantage over LDP.

Answer

Reduces the number of labels in the control plane.

Answer

Eliminates the need for IGP convergence for label distribution.

Answer

Simplifies MPLS TE tunnel configuration.

Question 3

When configuring EVPN VPWS, which TWO parameters must match between the two endpoints of the pseudowire?

Accepted Answer

EVI (Ethernet VPN Instance). In EVPN VPWS, the EVI (Ethernet VPN Instance) must match on both endpoints because it defines the common EVPN instance that binds the two attachment circuits into the same emulated point-to-point service, so option A is correct. The route-target must also match, since matching route-target import/export values allow each PE to import the other's EVPN routes (e.g., Ethernet A-D per-EVI/per-ES routes) and correctly establish the pseudowire, making option B correct. ESI (option C) is used for multihoming and all-active redundancy, not for a basic point-to-point VPWS, and it does not need to match between the two endpoints. The VLAN ID of the attachment circuit (option D) is locally significant and can differ on each PE because the service is defined by the EVI and route-target, not by the customer VLAN tag. The IMET group address (option E) is used for EVPN multicast/broadcast inclusive delivery in multipoint services, not for VPWS pseudowire establishment.

Answer

ESI (Ethernet Segment Identifier)

Answer

VLAN ID of the attachment circuit

Answer

IMET group address

Question 4

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

Accepted Answer

Add the 'sr-protect' option under the fast-reroute configuration to enable node protection. For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence. Option D is wrong because there is no need for an additional LDP backup.

Answer

Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

Answer

Reduce the IGP timers and enable incremental SPF to accelerate convergence

Answer

Deploy LDP as a fallback label distribution protocol to provide additional backup paths

Question 5

A small service provider is deploying MPLS in its core network for the first time. They have a simple topology: three P routers in the core and two PE routers connecting customers. They have configured LDP on all interfaces and OSPF as the IGP. They also configured a basic L3VPN for a customer with a single CE attached to each PE. The customer reports that they can ping between CEs for a few minutes, but then the connectivity drops. After a few seconds, it returns. This pattern repeats every few minutes. The engineer checks the LDP neighbors and sees that all LDP sessions are up. The OSPF adjacencies are stable. The engineer also notices that the pings time out exactly when the LDP graceful restart timer is expiring on one of the P routers. What is the most likely cause?

Accepted Answer

The BGP session between the PEs is flapping due to a hold timer mismatch or connectivity issue.. The most likely cause is that the BGP session between the PEs is flapping due to a hold timer mismatch or connectivity issue. In an L3VPN, BGP is used to exchange VPNv4 routes between PEs. If the BGP session flaps, the VPN routes are withdrawn and re-advertised, causing intermittent connectivity. The timing coinciding with the LDP graceful restart timer expiring suggests that the LDP session may be resetting, which can indirectly affect BGP if BGP is using LDP for next-hop resolution, but the root cause is the BGP session instability.

Answer

The LDP graceful restart timer is causing periodic re-establishment of LDP sessions.

Answer

The OSPF network type on the core links is set to point-to-point, causing SPF recalculation every 5 minutes.

Answer

One of the core interfaces is flapping due to a hardware issue, triggering IGP and LDP convergence.

Question 6

A large service provider operates an MPLS L3VPN network with multiple Route Reflectors (RRs) in the core. The network uses BGP as the control plane for both IPv4 unicast and VPNv4 routes. Recently, one of the RRs started flapping, causing route withdrawals to many clients. The network architect wants to improve stability. The RRs are fully meshed with each other and clients are configured as route-reflector clients. The RRs have both IPv4 and VPNv4 address families enabled. Which action should be taken to minimize the impact of an RR failure?

Accepted Answer

Configure client-to-client reflection on the RRs and ensure that each PE is a client of at least two RRs.. Configuring client-to-client reflection on the RRs and ensuring each PE is a client of at least two RRs minimizes the impact of an RR failure. Client-to-client reflection allows RRs to reflect routes between clients, reducing the need for full mesh among clients. By having each PE peer with multiple RRs, if one RR fails, the PE still receives routes from the other RR, maintaining connectivity.

Answer

Configure BGP prefix-independent convergence (PIC) on all PE routers.

Answer

Implement BGP add-paths capability on RRs to advertise multiple paths to clients.

Answer

Deploy redundant RRs with the same cluster ID and use the 'bgp cluster-id' command to ensure clients only accept routes from one RR at a time.

Question 7

An SP is deploying a Quality of Service (QoS) architecture in its core network to support multiple services: voice, video, and data. The core routers use MPLS and implement QoS based on the MPLS EXP bits. The architecture must ensure that voice packets are never dropped, even during congestion, while allowing video to have higher priority than data. The current design marks voice with EXP 4, video with EXP 3, and data with EXP 0. During a traffic burst, voice traffic is being dropped, which should not happen. The core routers have the following queue configuration: (1) a priority queue (PQ) for EXP 4+5, (2) a bandwidth queue for EXP 2-3, (3) a default queue for EXP 0-1. What is most likely the cause of voice drops?

Accepted Answer

The priority queue is rate-limited by a policer that shapes traffic to a certain bandwidth.. Voice drops occur because the priority queue is often rate-limited by a policer to prevent starvation of other queues. If the policer rate is set too low, voice packets are dropped during bursts. Strict priority without policing does not drop, but policing is common in SP core to protect other queues. The bandwidth queue and default queue are not the issue.

Answer

Voice traffic is being marked with EXP 4 but the priority queue also includes EXP 5, which may cause policing.

Answer

The bandwidth queue for video is configured to borrow from the priority queue.

Answer

The priority queue is not strictly priority; it shares bandwidth with other queues.

Question 8

A service provider is deploying EVPN-VXLAN in its data center to provide Layer 2 and Layer 3 overlay services. The underlay uses an eBGP-based CLOS fabric with spine and leaf switches. The leaf switches act as VTEPs and run EVPN for MAC/VXLAN advertisement. One of the tenants, a financial customer, requires that their traffic between two leaf-connected servers is always forwarded through a firewall for inspection, even when the servers are on the same leaf. The firewall is connected to a service leaf. The architect proposes using EVPN integrated routing and bridging (IRB) with asymmetric IRB. However, traffic between two VMs on the same leaf is bypassing the firewall. Which architectural change ensures that all inter-VM traffic within the same leaf goes through the firewall?

Accepted Answer

Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.. Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.

Answer

Configure a gateway on the firewall and use static routes on the leaf to forward traffic to the firewall.

Answer

Use EVPN symmetric IRB and ensure the firewall is attached as a Layer 2 extension.

Answer

Enable 'split-horizon' on the leaf switches to prevent direct forwarding.

Question 9

A service provider is troubleshooting an MPLS L3VPN where customers behind CE-A cannot reach CE-B. The PE routers are Cisco ASR 9000 series. On PE-A, the show cef vrf CUSTOMER prefix 10.1.1.0/24 command displays 'punt' as the forwarding path. What is the most likely cause?

Accepted Answer

The IP prefix is not resolved via an MPLS label in the LFIB. The 'punt' forwarding path in CEF indicates that the packet is sent to the control plane for processing rather than being forwarded in hardware. In an MPLS L3VPN, if the IP prefix is not resolved via an MPLS label in the LFIB, the router cannot forward the packet using MPLS and may punt it to the control plane. This typically happens when the label for the prefix is missing or not properly installed, often due to a missing route or label binding.

Answer

The MPLS MTU on the interface is too small

Answer

The VRF is missing the route-target import statement

Answer

The CE is not running OSPF with the PE

Question 10

A multicast service provider is designing an IPv4 PIM Sparse Mode (PIM-SM) network with multiple RPs. The network must support Anycast RP using MSDP. Which THREE statements are correct regarding this design?

Accepted Answer

Anycast RP allows multiple RPs to share the same IP address, providing redundancy and load balancing. Option A is correct because Anycast RP assigns the same RP address (typically a /32 loopback) to multiple RP routers, so sources and receivers are served by the topologically nearest RP, giving redundancy and load balancing. Option C is correct because the anycast RP routers must form MSDP peerings with each other (using unique loopback addresses as MSDP router-IDs) to exchange Source-Active (SA) messages, ensuring that a source registered on one RP is known to the others. Option E is correct because IGMPv3 is required on last-hop routers to support SSM (PIM-SM with SSM range, e.g., 232.0.0.0/8), which can be deployed alongside Anycast RP. Option B is wrong because Auto-RP is not mandatory for Anycast RP; static RP configuration or BSR can be used, and Auto-RP is not a requirement of the design. Option D is wrong because MSDP is not limited to SSM; it is used for inter-domain and anycast RP source discovery in PIM-SM, while SSM itself does not require MSDP.

Answer

Auto-RP must be used to distribute the RP information to all routers

Answer

MSDP is only required if the network uses Source-Specific Multicast (SSM)

Question 11

A service provider operates an MPLS-TE network using RSVP-TE with a full mesh of tunnels between core routers. The network uses OSPF as IGP with traffic engineering extensions. Recently, a new headend router PE-New was added and configured with several TE tunnels to remote destinations. However, some tunnels repeatedly go down after a few minutes and show in the 'down' state with the error 'Tunnel path option 0: no path to destination (TEDB lookup failed)'. The TE tunnels that remain up are those to destinations that are directly connected to the same OSPF area. The network has multiple OSPF areas (area 0, 1, 2) with inter-area routes redistributed. The operator suspects the issue is related to the TEDB (Traffic Engineering Database) not having complete information. Which action is MOST likely to resolve the issue?

Accepted Answer

Change the IGP to IS-IS with wide metrics and enable MPLS-TE on all IS-IS levels. The error 'TEDB lookup failed' indicates that the Traffic Engineering Database lacks reachability information for the tunnel destination. OSPF with TE extensions (OSPF-TE) only floods TE link-state advertisements (LSAs) within the same OSPF area; inter-area TE information is not propagated by default. Since the network uses multiple OSPF areas and the failing tunnels cross area boundaries, the TEDB on PE-New cannot see the remote destinations. IS-IS with wide metrics and TE enabled on all levels floods TE information across the entire IS-IS domain (L1 and L2), providing complete TEDB visibility. Therefore, changing the IGP to IS-IS resolves the issue.

Answer

Increase the tunnel hold-priority and setup-priority values

Answer

Add the remote loopbacks to OSPF using network statements in area 0

Answer

Configure static routes for the remote destinations on PE-New

Question 12

Which Cisco router platform is designed for high-density 100GE and uses IOS XR, making it suitable for the core/backbone of a service provider network?

Accepted Answer

Cisco CRS. The Cisco CRS (Carrier Routing System) is a high-end core routing platform designed for service provider backbone networks, supporting high-density 100GE interfaces and running IOS XR. It is purpose-built for massive scale, high throughput, and carrier-grade reliability, making it the correct choice for core/backbone deployments.

Answer

Cisco NCS 5500

Answer

Cisco ASR 9000

Answer

Cisco ISR 4400

Question 13

Which THREE are correct statements about IOS XR process separation? (Choose three.)

Accepted Answer

Processes can be restarted independently without affecting others. Option A is correct because IOS XR's microkernel architecture runs each process in its own protected memory space, so an individual process can be restarted (or fail) without bringing down other processes or the whole router. Option C is correct because IOS XR isolates routing protocols into separate processes — for example, OSPF, BGP, and ISIS each run as distinct processes — so a crash or restart of one protocol does not affect the others. Option E is correct because IOS XR distributes processing across the control plane and line cards, with memory and CPU resources allocated per line card, allowing each card to run its own processes independently. Option B is incorrect because process isolation is specifically designed to prevent a single process failure from crashing the entire system. Option D is incorrect because IOS XR processes do not share a single memory space; each process has its own protected address space, which is the foundation of the fault-isolation benefit.

Answer

A failure in one process can crash the entire system

Answer

All processes share a single memory space

Question 14

Which Cisco router platform is designed for the core/backbone of a service provider network, supporting high-density 100GE interfaces and massive scale for MPLS and Segment Routing?

Accepted Answer

Cisco CRS. The Cisco CRS (Carrier Routing System) is purpose-built for service provider core and backbone networks, designed to deliver massive scale with multi-chassis architecture and high-density 100GE line cards. It supports the throughput, MPLS, and Segment Routing requirements needed at the core of large SP networks. The CRS family is specifically positioned for core routing roles where terabit-scale capacity is required.

Answer

Cisco ASR 9000

Answer

Cisco ISR 4000

Answer

Cisco NCS 5500

Question 15

In an MPLS-based service provider core network, the aggregation layer typically connects to the core backbone. Which technology is primarily used at the aggregation layer to scale Ethernet services for many customers while preserving VLAN separation?

Accepted Answer

Q-in-Q (IEEE 802.1ad). Q-in-Q (IEEE 802.1ad) is primarily used at the aggregation layer in MPLS service provider networks to scale Ethernet services for many customers while preserving VLAN separation, because it encapsulates customer VLAN tags (C-TAGs) within a service provider VLAN tag (S-TAG). This allows the provider to use a single outer VLAN to identify a customer while preserving the customer's internal VLAN IDs, enabling thousands of customers to be multiplexed over the same infrastructure.

Answer

IEEE 802.1ah (MAC-in-MAC)

Answer

IEEE 802.3ad (Link Aggregation)

Answer

IEEE 802.1x (Port-based Network Access Control)