350-501 Architecture Practice Test 7 — 15 Questions

Question 1

A service provider is implementing IPv6 transition in its core. Which transition mechanism is recommended for carrying IPv6 over an existing MPLS/IPv4 backbone without dual-stacking all routers?

Accepted Answer

6PE (IPv6 Provider Edge). 6PE (IPv6 Provider Edge) is the correct answer because it allows IPv6 traffic to be carried over an existing MPLS/IPv4 backbone without requiring dual-stack on all core routers. In 6PE, only the Provider Edge (PE) routers need to be dual-stack; they encapsulate IPv6 packets in MPLS labels and transport them across the IPv4 MPLS core, which remains IPv4-only. This meets the requirement of not dual-stacking all routers while leveraging the existing MPLS infrastructure.

Answer

ISATAP

Answer

NAT64

Answer

6to4 tunneling

Question 2

Which TWO are characteristics of Segment Routing?

Accepted Answer

Source routing capability. Segment Routing (SR) is a source-routing paradigm where the ingress node encodes a list of segments (instructions) into the packet header, guiding the packet through the network without intermediate routers needing to maintain per-flow state. Option B is correct because SR inherently provides source routing capability: the source node determines the path by stacking segment identifiers (SIDs), and transit nodes simply forward based on the top SID.

Answer

Uses only IPv6 data plane

Answer

Requires RSVP-like signaling for path setup

Answer

Requires a centralized SDN controller

Question 3

Which THREE are benefits of implementing MPLS-TE in a service provider core?

Accepted Answer

Ability to guarantee bandwidth for specific traffic flows. MPLS-TE allows operators to reserve bandwidth along explicit paths using RSVP-TE signaling, ensuring that specific traffic flows receive guaranteed bandwidth. This is achieved through bandwidth reservation and admission control, which prevents oversubscription on TE tunnels.

Answer

Reduction in BGP routing table size

Answer

Native support for multicast

Question 4

Which TWO are essential components for deploying EVPN in a service provider network?

Accepted Answer

Overlay tunnel encapsulation such as VXLAN or MPLS. A is correct because EVPN requires an overlay tunnel encapsulation to transport Layer 2 frames across the IP/MPLS underlay. VXLAN (RFC 7348) and MPLS (RFC 7432) are the two primary encapsulations used to carry Ethernet frames over the overlay, enabling MAC address learning and forwarding in the EVPN control plane.

Answer

OSPF as the underlay routing protocol

Answer

PIM-SM for multicast replication

Answer

RSVP-TE for path computation

Question 5

A service provider is implementing MPLS L3VPN for a customer. The customer requires that routes from two different VPNs be imported into a single VRF. Which feature should be used?

Accepted Answer

Route Target (RT) import/export. Route Target (RT) import/export is the correct feature because it controls which routes from which VPNs are imported into a given VRF. By configuring multiple RT import statements on a single VRF, the provider can selectively import routes from two different VPNs, enabling inter-VPN route sharing without merging the VPNs themselves.

Answer

Route Reflector

Answer

Route Distinguisher (RD)

Answer

BGP extended community

Question 6

An SP engineer notices that BGP routes from a CE are not being installed in the VRF routing table, although the BGP session is established. The VRF configuration includes route-target import 100:1. The CE is sending routes with RT 100:1. What is the most likely cause?

Accepted Answer

The route is not matching any import map. Even though the BGP session is up and the CE is sending routes with the correct route-target (RT 100:1), the VRF may have an import map applied. An import map filters which received VPN routes are actually installed into the VRF routing table. If the route does not match the conditions defined in that import map, it will be accepted by BGP but not installed, which explains the symptom.

Answer

The BGP route is suppressed due to route update delay

Answer

The VRF name does not match

Answer

The RD is not configured

Question 7

A large SP network uses Segment Routing (SR) with MPLS data plane. They want to enforce a strict path for certain traffic flows across the core while using shortest-path for others. Which technique should be used?

Accepted Answer

SR-TE with explicit path using segment list. SR-TE with an explicit path using a segment list allows the operator to define a strict, ordered list of MPLS labels (segments) that the traffic must follow, overriding the default IGP shortest-path behavior. This is the correct technique for enforcing a strict path across the core while leaving other traffic to use shortest-path forwarding.

Answer

Using TI-LFA

Answer

Configuring bandwidth reservation on all links

Answer

Using SR policies with color extended community based on BGP

Question 8

A service provider wants to prioritize voice traffic over data traffic on a PE-CE link. Which QoS mechanism should be applied at the PE ingress to classify packets?

Accepted Answer

Class-based marking based on NBAR. Class-based marking using NBAR (Network-Based Application Recognition) is the correct mechanism because it can inspect packets at the application layer to distinguish voice traffic (e.g., RTP, SIP) from data traffic. On a PE-CE link, marking at ingress allows the service provider to set the appropriate DSCP or IP precedence value, which downstream QoS policies can then trust and act upon. This classification step is essential before any policing, shaping, or queuing can be applied.

Answer

Policer

Answer

WRED

Answer

Shaper

Question 9

In a multicast environment, a PE router is not receiving multicast traffic from a source behind a CE. The PIM neighbors are established. The RP is reachable. What is the most likely issue?

Accepted Answer

The PE does not have the multicast VRF enabled. The most likely issue is that the PE router does not have the multicast VRF enabled. In a multicast VPN (MVPN) environment, even if PIM neighbors are established and the RP is reachable, the PE must have multicast routing explicitly enabled within the VRF using the 'ip multicast-routing vrf <name>' command. Without this, the PE will not process multicast traffic for that VRF, causing it to drop or ignore multicast packets from the source behind the CE.

Answer

The CE is not sending IGMP joins

Answer

The source address is not in the VRF

Answer

The RP is not configured in the VRF

Question 10

An SP is deploying EVPN with VXLAN encapsulation in a data center interconnect. The design requires that the control plane for MAC/VTEP learning is based on BGP. Which BGP address family must be configured?

Accepted Answer

l2vpn evpn. EVPN with VXLAN encapsulation requires the BGP L2VPN address family (l2vpn evpn) to exchange MAC/VTEP reachability information. This address family carries EVPN routes (type-2 for MAC/IP, type-3 for IMET) that populate the control plane for VXLAN tunnel endpoints, enabling MAC learning without flooding.

Answer

l2vpn vpls-vpws

Answer

vpnv4

Answer

ipv4 unicast

Question 11

An SP network uses NTP for synchronization. To secure NTP, which authentication mode should be used?

Accepted Answer

NTPv4 autokey. NTPv4 autokey (Option A) is the correct answer because it provides a secure, automated key distribution mechanism using public-key cryptography (RFC 5906). This eliminates the need for manual key exchange, making it the recommended authentication mode for securing NTP in service provider networks.

Answer

NTPv3 symmetric key

Answer

NTPv4 with SHA-1

Answer

NTPv4 with MD5

Question 12

A service provider is experiencing suboptimal routing due to BGP route reflection. To improve path selection while maintaining IBGP scalability, which feature should be implemented?

Accepted Answer

BGP optimal route reflection (ORR). BGP optimal route reflection (ORR) improves path selection by allowing the route reflector to calculate the best path based on the IGP metric to the client's location, rather than using its own BGP table. This overcomes the suboptimal routing caused by standard route reflection, where the RR's best path may not be optimal for all clients, while still maintaining IBGP scalability by avoiding a full mesh.

Answer

BGP deterministic med

Answer

BGP next-hop-self

Answer

BGP add-path

Question 13

An SP is using NETCONF with YANG to automate VRF provisioning. The engineer notices that the NETCONF session is established but configuration changes are not applied. Which issue is most likely?

Accepted Answer

The NETCONF capability :candidate is not advertised. NETCONF uses datastores to manage configuration. The `:candidate` capability allows changes to be made to a candidate configuration before committing them. If this capability is not advertised, the device defaults to the `:writable-running` capability, which requires changes to be applied directly to the running datastore. Since the engineer is likely using a candidate-based workflow (e.g., `edit-config` with target `candidate`), the session establishes but changes are silently ignored or rejected because the device does not support a separate candidate datastore.

Answer

The YANG model does not support the target configuration datastore

Answer

The device does not support :url capability

Answer

The user does not have write access to the candidate datastore

Question 14

A service provider is troubleshooting an L2VPN where a CE is unable to ping the remote CE. The PE-CE interfaces are up, and the pseudowire status shows 'up'. Which two actions should be taken to further isolate the issue? (Choose two.)

Accepted Answer

Verify the VC ID match on both PEs. The VC ID (Virtual Circuit ID) must match on both PEs for the pseudowire to be established correctly. If the VC IDs are mismatched, the pseudowire status may show as 'up' due to local signaling, but traffic will not be forwarded between the CEs because the pseudowire endpoints are not logically connected. Verifying the VC ID ensures that the L2VPN circuit is properly configured end-to-end.

Answer

Check the MAC address table on the CE

Answer

Check the LDP session between PEs

Answer

Verify the VFI configuration on the PE

Question 15

A network engineer is designing a new MPLS core. Which three of the following are recommended best practices for MPLS LDP configuration? (Choose three.)

Accepted Answer

Enable LDP authentication using MD5. C is correct because enabling LDP authentication using MD5 protects the LDP session from spoofing and tampering by verifying the integrity of TCP segments exchanged between LDP peers. This is a recommended security best practice in MPLS networks to prevent unauthorized label distribution and route hijacking.

Answer

Use explicit null label for BGP prefixes

Answer

Set the LDP session holdtime to 180 seconds