350-501 Architecture Practice Test 9 — 15 Questions

Question 1

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the 'sr-protect' option under the fast-reroute configuration to enable node protection. For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence. Option D is wrong because there is no need for an additional LDP backup.

Answer

Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

Answer

Reduce the IGP timers and enable incremental SPF to accelerate convergence

Answer

Deploy LDP as a fallback label distribution protocol to provide additional backup paths

Question 2

A service provider offers L3VPN services to multiple enterprise customers. One customer reports that they cannot reach some remote sites intermittently. The network uses MPLS L3VPN with MP-BGP for VPN route exchange. The PE routers are configured with route-target import and export. The customer's CE router is dual-homed to two different PEs in the same point of presence. The engineer checks the BGP table on both PEs and sees the customer routes with the correct route-target. However, pings from the CE to a remote site fail about 50% of the time, and the flapping pattern suggests load balancing issues. The engineer discovers that the remote site's network prefix is being advertised from both PEs with the same route-target but with different next-hops. The CE has equal-cost paths via both PEs. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The CE is performing per-packet load balancing across the two PEs, causing asymmetric routing.. When a CE router receives two equal-cost paths from two PEs, it may perform per-packet load balancing. This can lead to asymmetric routing where packets from the same flow take different paths, causing out-of-order delivery and connectivity failures about 50% of the time, especially if stateful devices are in the path or if the transport layer is sensitive to ordering. Option A is incorrect because the route-target import on the remote PE is properly configured (as the routes are seen with correct route-target). Option C is incorrect because BGP timer misconfiguration would cause session flapping and complete loss, not a 50% intermittent failure. Option D is incorrect because MTU mismatch would cause consistent packet drops, not intermittent failures.

Answer

The route-target import on the remote PE is missing the customer's route-target.

Answer

The BGP timers are misconfigured, causing the session to flap.

Answer

The MTU on the CE-PE links is mismatched.

Question 3

A small service provider is deploying MPLS in its core network for the first time. They have a simple topology: three P routers in the core and two PE routers connecting customers. They have configured LDP on all interfaces and OSPF as the IGP. They also configured a basic L3VPN for a customer with a single CE attached to each PE. The customer reports that they can ping between CEs for a few minutes, but then the connectivity drops. After a few seconds, it returns. This pattern repeats every few minutes. The engineer checks the LDP neighbors and sees that all LDP sessions are up. The OSPF adjacencies are stable. The engineer also notices that the pings time out exactly when the LDP graceful restart timer is expiring on one of the P routers. What is the most likely cause?

Accepted Answer

The BGP session between the PEs is flapping due to a hold timer mismatch or connectivity issue.. The symptom of periodic connectivity drops that recover after a few seconds, coinciding with the LDP graceful restart timer, indicates that the BGP session between the PEs is flapping. When the BGP session goes down, the VPN routes are withdrawn, causing the CE-to-CE connectivity to drop. Once the BGP session re-establishes, routes are re-advertised and connectivity returns. LDP graceful restart timer expiration is not the cause (LDP sessions are up), but may coincide with BGP hold timer failures. Options B, C, and D are incorrect because LDP graceful restart does not cause the described pattern, OSPF network type does not cause periodic drops, and interface flapping would cause more permanent outages.

Answer

The LDP graceful restart timer is causing periodic re-establishment of LDP sessions.

Answer

The OSPF network type on the core links is set to point-to-point, causing SPF recalculation every 5 minutes.

Answer

One of the core interfaces is flapping due to a hardware issue, triggering IGP and LDP convergence.

Question 4

A service provider is implementing EVPN for its VPLS replacement. They have configured BGP EVPN on all PEs and have set up an EVPN instance for a customer requiring broadcast, unknown unicast, and multicast (BUM) traffic. The customer reports that broadcast traffic from one site is not being received at another site. The engineer checks the EVPN configuration and finds that the EVI is configured correctly, the route-target matches, and the BGP sessions are established. The engineer also checks the MAC address table on the receiving PE and sees that the source MAC of the broadcast frame is learned on the local interface, but not from the remote VTEP. The engineer suspects an issue with the IMET (Inclusive Multicast Ethernet Tag) route. Which action should the engineer take to verify the IMET route?

Accepted Answer

Check the BGP EVPN route table for IMET (route-type 3) routes using 'show bgp l2vpn evpn route-type 3'.. 'show bgp l2vpn evpn route-type 3' displays the IMET (Inclusive Multicast Ethernet Tag) routes, which are necessary for forwarding BUM traffic between VTEPs. Option A is incorrect because 'show evpn instance detail' shows local EVI configuration but not remote IMET routes. Option C is incorrect because route-type 2 is for MAC/IP advertisement, not IMET. Option D is incorrect because 'show l2vpn vfi' is used for VPLS, not EVPN.

Answer

Use 'show evpn instance detail' to check the EVI configuration.

Answer

Use 'show bgp l2vpn evpn route-type 2' to verify MAC/IP routes.

Answer

Use 'show l2vpn vfi' to verify the VPLS forwarding instance.

Question 5

A service provider is designing an MPLS L3VPN network to provide Layer 3 VPN services to multiple customers. Which two statements correctly describe the roles of the Provider Edge (PE) and Customer Edge (CE) routers in this architecture?

Accepted Answer

PE routers advertise customer routes via MP-BGP with route distinguishers and route targets.. In an MPLS L3VPN, PE routers use MP-BGP (Multiprotocol BGP) to exchange customer VPN routes. Each VPN route is uniquely identified by a Route Distinguisher (RD) to maintain global uniqueness, and Route Targets (RTs) control the import/export of routes between VRFs. This allows the PE to separate customer routing domains while still using a shared MPLS backbone.

Answer

P routers store all customer VPN routes in their global routing table.

Answer

CE routers perform MPLS label switching between PE routers.

Answer

CE routers participate in the service provider's IGP to exchange loopback addresses.

Question 6

An SP is migrating its core network to Segment Routing (SR-MPLS). The network uses IS-IS as the IGP with SR extensions. Which three statements about SR-MPLS architecture are correct?

Accepted Answer

Adjacency SIDs are local to a router and indicate a specific link.. An Adjacency SID is a local label assigned to a specific IS-IS adjacency, representing a particular link between two routers. It is locally significant and used to steer traffic over that specific next-hop, not globally unique.

Answer

The OSPF protocol cannot be used for SR-MPLS because it does not support SR extensions.

Answer

The SRGB must be identical across all routers in the domain to ensure global uniqueness.

Question 7

A large service provider operates an MPLS L3VPN network with multiple Route Reflectors (RRs) in the core. The network uses BGP as the control plane for both IPv4 unicast and VPNv4 routes. Recently, one of the RRs started flapping, causing route withdrawals to many clients. The network architect wants to improve stability. The RRs are fully meshed with each other and clients are configured as route-reflector clients. The RRs have both IPv4 and VPNv4 address families enabled. Which action should be taken to minimize the impact of an RR failure?

Accepted Answer

Configure client-to-client reflection on the RRs and ensure that each PE is a client of at least two RRs.. Configuring client-to-client reflection on the RRs and ensuring each PE is a client of at least two RRs provides redundancy; if one RR fails, routes are still available via the other RR. BGP PIC helps fast failover but does not prevent route withdrawal impact; add-paths increases paths but not redundancy; same cluster ID reduces redundancy.

Answer

Configure BGP prefix-independent convergence (PIC) on all PE routers.

Answer

Implement BGP add-paths capability on RRs to advertise multiple paths to clients.

Answer

Deploy redundant RRs with the same cluster ID and use the 'bgp cluster-id' command to ensure clients only accept routes from one RR at a time.

Question 8

An SP is deploying a Quality of Service (QoS) architecture in its core network to support multiple services: voice, video, and data. The core routers use MPLS and implement QoS based on the MPLS EXP bits. The architecture must ensure that voice packets are never dropped, even during congestion, while allowing video to have higher priority than data. The current design marks voice with EXP 4, video with EXP 3, and data with EXP 0. During a traffic burst, voice traffic is being dropped, which should not happen. The core routers have the following queue configuration: (1) a priority queue (PQ) for EXP 4+5, (2) a bandwidth queue for EXP 2-3, (3) a default queue for EXP 0-1. What is most likely the cause of voice drops?

Accepted Answer

The priority queue is rate-limited by a policer that shapes traffic to a certain bandwidth.. Voice drops occur because the priority queue is often rate-limited by a policer to prevent starvation of other queues. If the policer rate is set too low, voice packets are dropped during bursts. Strict priority without policing does not drop, but policing is common in SP core to protect other queues. The bandwidth queue and default queue are not the issue.

Answer

Voice traffic is being marked with EXP 4 but the priority queue also includes EXP 5, which may cause policing.

Answer

The bandwidth queue for video is configured to borrow from the priority queue.

Answer

The priority queue is not strictly priority; it shares bandwidth with other queues.

Question 9

A service provider is deploying EVPN-VXLAN in its data center to provide Layer 2 and Layer 3 overlay services. The underlay uses an eBGP-based CLOS fabric with spine and leaf switches. The leaf switches act as VTEPs and run EVPN for MAC/VXLAN advertisement. One of the tenants, a financial customer, requires that their traffic between two leaf-connected servers is always forwarded through a firewall for inspection, even when the servers are on the same leaf. The firewall is connected to a service leaf. The architect proposes using EVPN integrated routing and bridging (IRB) with asymmetric IRB. However, traffic between two VMs on the same leaf is bypassing the firewall. Which architectural change ensures that all inter-VM traffic within the same leaf goes through the firewall?

Accepted Answer

Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.. Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.

Answer

Configure a gateway on the firewall and use static routes on the leaf to forward traffic to the firewall.

Answer

Use EVPN symmetric IRB and ensure the firewall is attached as a Layer 2 extension.

Answer

Enable 'split-horizon' on the leaf switches to prevent direct forwarding.

Question 10

A service provider offers Carrier Ethernet services using MPLS-TP in the access and aggregation layers. The network uses MPLS-TP tunnels with static LSPs and protection via 1:1 linear protection with APS. One customer reports intermittent connectivity issues on their E-LINE service. The operations team observes that the protection switchover is occurring frequently due to apparent signal failures on the working path. However, the physical layer shows no errors. The protection switching is configured with revertive mode. The working LSP has an RDI (Remote Defect Indication) configured. Upon further investigation, the team finds that the working LSP's OAM continuity check messages (CCMs) are being lost occasionally, triggering a protection switch. What is the most likely misconfiguration?

Accepted Answer

The CCM interval is too short, causing frequent false failures due to transient congestion.. A short CCM interval makes the system sensitive to minor delays, causing false failures and frequent protection switches. A longer interval would reduce sensitivity but increase detection time. Priority and OAM rate differences are not typical causes.

Answer

The CCM interval is too long, causing delayed detection.

Answer

The working path uses a higher MPLS-TP OAM rate than the protection path.

Answer

The protection path has a lower priority than the working path.

Question 11

A service provider is building a new network slicing architecture to offer differentiated services to enterprise customers. The architecture uses SRv6 with network slices identified by slice IDs embedded in the SRv6 SID. The underlay is an IP network with ISIS. Each slice will have dedicated resources in the core, including guaranteed bandwidth and low latency. The plan is to use the SRv6 network programming concept to steer traffic into different slices. The provider wants to ensure that slice isolation is maintained end-to-end, including at the egress PE where traffic is handed off to the customer. However, during testing, they observe that traffic from one slice is incorrectly entering another slice's queue on an intermediate node, causing performance interference. The intermediate node is a transit router that does not terminate SRv6 but performs 'SID-based forwarding'. Which mechanism is most likely missing to ensure slice isolation on transit nodes?

Accepted Answer

The transit nodes are not configured to enforce per-slice QoS policies based on the slice ID in the SID.. Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.

Answer

The SRv6 SID does not carry the slice ID; it only carries the locator.

Answer

The egress PE is misconfigured to strip the slice ID before forwarding.

Answer

The ingress PE is not setting the slice ID correctly.

Question 12

A service provider offers IPTV services using multicast. The network uses Multicast VPN (MVPN) with Rosen GRE encapsulation (Profile 1) in an MPLS L3VPN environment. The Provider Edge (PE) routers participate in both the default MDT and data MDT for high-bandwidth streams. Recently, a new channel was added, and it uses a data MDT. The content server is attached to a PE that is acting as a multicast source. Other PEs are receivers. Upon adding the channel, some receivers report missing packets. The network engineer checks the PEs and notices that the data MDT group address is being advertised via BGP as an MDT SAFI route, but some PEs are not joining the data MDT. The source PE's multicast routing table shows that it believes data MDT is active. Which architecture issue is most likely preventing some PEs from joining the data MDT?

Accepted Answer

The data MDT group is not within the configured data MDT group range on the receiving PEs.. The data MDT group must be within the configured data-MDT group range on each PE; if not, the PE will ignore the BGP MDT SAFI route and not join the data MDT. Source PE IGMP joins are not relevant; default MDT issues are separate; PIM RP reachability might affect default MDT but not data MDT join if using SSM.

Answer

The source PE is not sending IGMP joins for the data MDT group.

Answer

The default MDT group is flapping.

Answer

The PIM sparse mode RP is not reachable.

Question 13

A service provider is troubleshooting an MPLS L3VPN where customers behind CE-A cannot reach CE-B. The PE routers are Cisco ASR 9000 series. On PE-A, the show cef vrf CUSTOMER prefix 10.1.1.0/24 command displays 'punt' as the forwarding path. What is the most likely cause?

Accepted Answer

The IP prefix is not resolved via an MPLS label in the LFIB. When show cef vrf CUSTOMER prefix 10.1.1.0/24 displays 'punt', it means the prefix does not have a valid MPLS label in the LFIB (Label Forwarding Information Base). In MPLS L3VPN, the PE must push a label for the next-hop PE to forward traffic across the MPLS core. Without a label, the packet is punted to the CPU for further processing, often due to missing label binding or incomplete LDP/IGP synchronization. Option A correctly identifies this issue. Option B is incorrect because MTU issues would cause drops, not punt. Option C is incorrect because missing route-target import would affect route installation in the VRF but not necessarily cause punt for a locally resolved prefix. Option D is incorrect because CE-PE routing protocol (whether OSPF or BGP) is not directly related to MPLS label resolution on the PE.

Answer

The MPLS MTU on the interface is too small

Answer

The VRF is missing the route-target import statement

Answer

The CE is not running OSPF with the PE

Question 14

A network architect is designing a Segment Routing (SR) network for a service provider with a requirement for fast convergence upon node failure. The network uses IS-IS as the IGP with segment routing extensions. Which design choice BEST ensures that the network can achieve sub-50ms convergence without relying on any signaling protocol beyond the IGP?

Accepted Answer

Enable TI-LFA (Topology Independent Loop-Free Alternate) on all ISIS interfaces. TI-LFA (Topology Independent Loop-Free Alternate) provides sub-50ms convergence by precomputing backup paths using only the IGP (IS-IS with SR extensions), without requiring any additional signaling protocol. Option A is wrong because BFD with static routes offers fast detection but does not provide a backup path automatically; it must be combined with a protection mechanism like FRR. Option B is wrong because RSVP-TE Fast Reroute relies on RSVP signaling and TE tunnels, which are beyond the IGP-only requirement. Option D is wrong because LDP is a separate signaling protocol that requires LDP FRR and path protection, again adding signaling overhead beyond the IGP.

Answer

Deploy BFD with static routes for fast detection

Answer

Configure RSVP-TE with Fast Reroute on all label-switched paths

Answer

Use LDP with LDP FRR and path protection

Question 15

A service provider needs to offer L3VPN services to multiple customers, each with overlapping IP addresses. The provider plans to use MPLS VPNs with VRFs. Which statement is TRUE regarding the configuration of VRFs on the PE routers?

Accepted Answer

Route targets (RTs) are used to control the import and export of VPNv4 routes between VRFs. Route targets (RTs) are used on PE routers to control which VPNv4 routes are imported into a VRF and which routes from a VRF are exported to MP-BGP. This allows proper segregation and connectivity for MPLS L3VPNs. Option A is incorrect because VRF-to-CE routing can use any protocol, not just OSPF. Option C is incorrect because MPLS labels are automatically assigned per VRF by the router, not manually per prefix. Option D is incorrect because the route distinguisher (RD) only needs to be unique per VRF on a single PE router; it can be the same across different PE routers if the RTs are configured correctly.

Answer

The VRF must run OSPF to exchange routes with the CE router

Answer

MPLS labels are assigned per prefix inside a VRF by manual configuration

Answer

Each VRF must have a unique route distinguisher across the entire provider network