350-501 MPLS and Segment Routing Practice Test 3 — 15 Questions

Question 1

What does the output indicate about the TI-LFA protection on R1?

Accepted Answer

Only 1 prefix has a backup path.. The output shows that for the protected prefix 10.1.1.1/32, the backup path is listed as 'N/A', meaning no backup path was computed. However, for the other prefix (likely a different /32), a backup path is present. This indicates that only one prefix has a backup path, making option B correct. TI-LFA computes a backup path only when a viable post-convergence path exists without microloops; if the topology doesn't allow it, the backup is marked as not available.

Answer

All prefixes have backup paths.

Answer

0 prefixes have backup paths.

Answer

2 prefixes have backup paths.

Question 2

A network engineer is configuring Segment Routing on an IOS-XR router. They want to use the preferred algorithm for automatically computing paths based on IGP metrics. Which algorithm should be configured under the SR segment list?

Accepted Answer

preferred. The 'preferred' algorithm is the correct choice because it instructs the router to automatically select the best algorithm for path computation based on IGP metrics. In Segment Routing, the 'preferred' algorithm uses the default SPF (Shortest Path First) algorithm, which computes paths based solely on IGP link metrics, ensuring optimal routing without additional constraints.

Answer

strict-spf

Answer

delay

Answer

te

Question 3

During MPLS LDP operation, a router receives a label mapping for a prefix from its neighbor. What is the correct behavior when the receiving router has a route to that prefix?

Accepted Answer

It installs the label as the outgoing label for the prefix.. When a router receives a label mapping from an LDP neighbor for a prefix, it installs the received label as the outgoing label for that prefix in its Label Forwarding Information Base (LFIB). This label is used when forwarding packets toward the neighbor. The router must have a route to the prefix in its routing table to accept the mapping.

Answer

It discards the label mapping unless it has a corresponding route.

Answer

It uses UDP to send a notification back.

Answer

It installs the label as the incoming label for the prefix.

Question 4

An engineer is troubleshooting MPLS label switching in a service provider core. They notice that packets are being forwarded correctly between provider edge routers, but when they check the MPLS forwarding table on a P router, they see only implicit-null labels for some destinations. What is the most likely reason for this?

Accepted Answer

The router has a directly connected neighbor that is the egress LER.. When a P router sees only implicit-null labels (label 3) for some destinations in its MPLS forwarding table, it indicates that the router is performing penultimate hop popping (PHP). This occurs when the P router is the penultimate hop before the egress Label Edge Router (LER). The egress LER advertises an implicit-null label to its directly connected neighbor, causing the P router to pop the label and forward the packet using only the IP header. Option B is correct because the P router has a directly connected neighbor that is the egress LER, which triggers PHP.

Answer

The router is using explicit-null label due to security policies.

Answer

The router is misconfigured to use implicit-null for all labels.

Answer

The router is performing penultimate hop popping (PHP) incorrectly.

Question 5

A service provider is using Segment Routing with TI-LFA for fast convergence. During a link failure, the router performing the local repair must compute a backup path that avoids the failed link. Which type of Adjacency Segment Identifier (Adj-SID) is required for the backup path to be loop-free?

Accepted Answer

Protected Adj-SID. In Segment Routing with TI-LFA, the router performing local repair must compute a backup path that is guaranteed loop-free. A Protected Adj-SID (Adj-SID with the B-flag set) is required because it indicates that the adjacency segment is protected by a fast-reroute mechanism, allowing the router to use a precomputed backup path that avoids the failed link while ensuring no forwarding loops occur.

Answer

Anycast Adj-SID

Answer

Unprotected Adj-SID

Answer

Backup Adj-SID

Question 6

An MPLS network is experiencing micro-loops during convergence after a link failure. The network uses LDP and IS-IS as IGP. Which of the following solutions can prevent micro-loops during IGP convergence without requiring additional protocols?

Accepted Answer

Configure LFA (Loop-Free Alternate) on the IGP.. LFA (Loop-Free Alternate) is a feature built directly into IGPs like IS-IS and OSPF that precomputes a backup next-hop that does not loop back to the failed link. This prevents micro-loops during IGP convergence without requiring any additional protocols such as RSVP-TE or BGP, making it a lightweight, protocol-integrated solution.

Answer

Implement MPLS-TE FRR using bypass tunnels.

Answer

Enable BGP PIC (Prefix Independent Convergence).

Answer

Deploy RSVP-TE with fast-reroute.

Question 7

Which two are characteristics of the Anycast SID in Segment Routing? (Choose two.)

Accepted Answer

It provides redundancy and fast convergence by allowing traffic to be rerouted to another router.. Option E is correct because an Anycast SID is a single Segment Identifier that is configured identically on multiple routers belonging to the same anycast group, so all those nodes advertise the same SID value. Option D is correct because, since the same Anycast SID is present on several routers, the IGP installs multiple equal-cost paths to that SID, and if one router fails, traffic is automatically rerouted to another router in the group, providing redundancy and fast convergence without waiting for a new prefix advertisement. Option A is incorrect because an adjacency between two routers is identified by an Adjacency SID (Adj-SID), which is locally significant and not shared. Option B is incorrect because Adj-SIDs are used for adjacency-based forwarding and load balancing, not Anycast SIDs, which are prefix/node SIDs shared across nodes. Option C is incorrect because a SID that is unique per node and identifies a specific router is a Prefix SID or Node SID, whereas an Anycast SID is deliberately shared by multiple routers.

Answer

It identifies an adjacency between two routers.

Answer

It is typically used as an Adj-SID for load balancing.

Answer

It is unique per node and identifies a specific router.

Question 8

Refer to the exhibit. The show command output displays the LDP neighbor state. What does the 'Downstream' label mode indicate about label distribution?

Accepted Answer

Labels are advertised to all neighbors without a request.. In the context of LDP, 'Downstream' label mode means that a router advertises label bindings for all prefixes in its routing table to its LDP neighbors without waiting for an explicit request. This is the default label distribution mode for LDP, where labels are proactively sent to all peers. Option D correctly identifies this behavior.

Answer

Labels are sent only to the peer that advertises the prefix.

Answer

Labels are only distributed when explicitly requested.

Answer

The neighbor must request labels via a Label Request message.

Question 9

Refer to the exhibit. A network engineer is configuring a segment routing traffic engineering policy. The output shows two candidate paths. Why is path1 selected as the active path even though path2 has a bandwidth constraint?

Accepted Answer

path2 has a lower preference value.. Path1 is selected as the active path because it has a higher preference value (200) compared to path2 (100). In segment routing traffic engineering, the preference value is the primary tie-breaker for candidate paths; the path with the highest preference is chosen regardless of bandwidth constraints. Bandwidth constraints are only evaluated after preference, and a path with a lower preference is not considered for activation even if it has a bandwidth constraint configured.

Answer

path1 has a shorter segment list.

Answer

path2 is down due to insufficient bandwidth.

Answer

path1 is explicit and always preferred over dynamic paths.

Question 10

A network engineer is troubleshooting MPLS L3VPN issues on a PE router. The CE router is receiving routes from the PE, but the CE cannot ping the remote CE. The PE shows the remote prefix in its routing table and in the VRF. What is the most likely cause?

Accepted Answer

The LSP between the PEs is not operational. The CE can receive routes from the PE (indicating that the VRF and route-target import/export are functioning correctly), but the CE cannot ping the remote CE. This points to a failure in the data plane between the PEs. If the LSP (Label Switched Path) between the PEs is not operational, MPLS labels cannot be swapped or forwarded correctly, causing packets to be dropped even though the control plane (routing table and VRF) shows the remote prefix.

Answer

The VRF route-target import/export is misconfigured

Answer

The MTU on the core links is too small

Answer

The RD is different on the two PEs

Question 11

A service provider is deploying MPLS L2VPN using Virtual Private Wire Service (VPWS). After configuration, the two CEs cannot ping each other. The PE routers show the xconnect interface is up, but no MAC addresses are learned. What is the most likely cause?

Accepted Answer

The VC ID mismatch between the two PEs. In MPLS L2VPN VPWS, the VC ID (Virtual Circuit ID) must match on both PE routers to establish the pseudowire between them. A mismatch prevents the pseudowire from coming up, so even though the local xconnect interface shows as up (because the attachment circuit is operational), no MAC learning can occur because the pseudowire control plane (e.g., LDP or BGP signaled) fails to bind the two endpoints. This directly explains why the CEs cannot ping and no MAC addresses are learned.

Answer

The MTU on the core links is less than 1500

Answer

The control word is enabled on one PE but not the other

Answer

The encapsulation type on the AC is different on the two PEs

Question 12

A network engineer notices that BGP-LU prefixes learned from an eBGP neighbor are not being installed in the MPLS forwarding table (LFIB). The BGP table shows the prefixes with the correct label. The IGP route to the neighbor is reachable. What additional configuration is needed?

Accepted Answer

Set `label mode per-prefix` under the BGP neighbor or address-family. BGP-LU (BGP Labeled Unicast) installs labels into the BGP table, but for those labels to be used for MPLS forwarding, the router must be configured to allocate labels on a per-prefix basis. By default, BGP may use per-VRF or per-next-hop label allocation, which does not populate the LFIB with per-prefix entries. Setting `label mode per-prefix` under the BGP neighbor or address-family forces BGP to allocate a unique label for each prefix, enabling the LFIB installation required for MPLS forwarding.

Answer

Enable `no bgp default ipv4-unicast`

Answer

Configure `mpls ldp autoconfig` on the interface

Answer

Add `allowas-in` to accept routes with AS-path containing own AS

Question 13

A company is connecting two sites using MPLS L3VPN. The PE routers are running both LDP and Segment Routing (SR-MPLS) in the core. The CE router at Site A cannot reach the CE at Site B. On the PEs, the VRF routes are present. Which command would you use to verify the MPLS forwarding path for the VPN traffic?

Accepted Answer

show mpls forwarding-table vrf VPN-A 10.1.1.0. The 'show mpls forwarding-table vrf VPN-A 10.1.1.0' command displays the MPLS label stack that will be imposed on packets destined for the VPN prefix, including the inner VPN label and the outer transport label (LDP or SR-MPLS). This directly verifies the end-to-end MPLS forwarding path for VPN traffic, which is necessary when VRF routes are present but connectivity fails due to label issues.

Answer

show mpls ldp bindings

Answer

show ip route vrf VPN-A 10.1.1.0

Answer

show bgp vpnv4 unicast labels

Question 14

A large service provider runs a dual-stack MPLS core with Segment Routing (SR-MPLS) and IS-IS as the IGP. The network has been operating stably for months. Recently, a new PE router (PE-5) was added and configured with IS-IS and SR. After the addition, some remote prefixes in the VRF on other PEs become unreachable. Troubleshooting reveals that the BGP next hop for those prefixes is the loopback of another PE (PE-3), but the MPLS forwarding table on PE-3 shows no label for the prefix. The IS-IS database on PE-3 shows the prefix-SID for PE-5's loopback, but the forwarding table does not have a label for that prefix. Commands like 'show mpls forwarding-table' show no entry for PE-5's loopback. What is the most likely cause and correct action?

Accepted Answer

Check and adjust the SRGB configuration on PE-5 to match the range used by other routers. The correct answer is C: check and adjust the SRGB (Segment Routing Global Block) configuration on PE-5 to match the range used by other routers. In SR-MPLS, each router maps a prefix-SID from IS-IS into a local MPLS label by adding the SID index to its own SRGB base; if PE-5's SRGB differs from the rest of the domain, PE-3 receives the prefix-SID but cannot install a valid label for PE-5's loopback in its forwarding table, so 'show mpls forwarding-table' shows no entry and BGP next-hop resolution fails. Aligning PE-5's SRGB with the domain-wide range restores consistent label allocation. Option A (clearing the IS-IS adjacency) is wrong because the IS-IS database already shows the prefix-SID, indicating the adjacency and flooding are working. Option B (enabling MPLS on the PE-5 link) is wrong because the problem is label/SRGB mapping, not MPLS enablement on the interface. Option D (redistributing IS-IS into BGP) is wrong because BGP already has the next hop; the failure is in MPLS label resolution, not BGP route propagation.

Answer

Clear the IS-IS adjacency between PE-3 and PE-5

Answer

Enable MPLS on the interface connecting to PE-5

Answer

Configure BGP to redistribute IS-IS routes into BGP

Question 15

A service provider is troubleshooting an MPLS L3VPN scenario where a customer in VRF Blue cannot reach a server in VRF Blue at a remote site. The PEs are running MPLS with LDP. The VRF on both PEs shows the remote prefix. The PE at the local site shows the label from the remote PE for the prefix in the BGP table. However, when pinging from the CE, the packets are dropped. A packet capture on the core shows MPLS packets with the correct VPN label, but the transport label is missing. Further investigation shows that the LDP session between the two PEs is up, but the LDP label binding for the remote PE's loopback is not present. What is the most likely cause and correct action?

Accepted Answer

Check MPLS LDP interface configuration and enable LDP on all core interfaces. The missing transport label indicates that LDP is not establishing label bindings for the remote PE's loopback, which is used as the LDP transport address. The most likely cause is that LDP is not enabled on all core interfaces along the path, so the label binding for the remote loopback never propagates. Enabling LDP on all core interfaces restores the transport label and allows the VPN label to be forwarded correctly.

Answer

Increase the TTL on the MPLS packets

Answer

Change the transport address in LDP to the loopback IP

Answer

Configure the remote PE's loopback to be advertised via BGP