Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 1–75

NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

TI-LFA (Topology Independent Loop-Free Alternate) precomputes a backup path using a segment list (label stack) that explicitly avoids the failed link. This is achieved by encoding a repair path as a sequence of adjacency and node segments, ensuring that traffic is steered around the failure without loops, regardless of the network topology. The backup path is installed in the forwarding table before the failure occurs, enabling sub-50ms convergence.

The NED (Network Element Driver) in Cisco NSO is the component that abstracts the native device configuration and translates YANG data models into device-specific CLI commands or protocols (e.g., SNMP, NETCONF). This allows NSO to manage heterogeneous devices using a unified YANG-based service model, making option A correct.

Cisco Jabber uses encrypted signaling and media (SRTP/TLS), which prevents NBAR from performing deep packet inspection to identify the application. Even with an up-to-date protocol pack, NBAR cannot match encrypted traffic unless decryption is performed elsewhere. Therefore, the class-map matching 'cisco-jabber' via NBAR protocol discovery will show zero matches.

The 'mpls ldp advertise-labels' command ensures that LDP advertises label bindings to its peers. If this is disabled (default is enabled, but can be overridden), LDP sessions may be up but no labels are distributed, resulting in missing labels in the LFIB. Re-enabling it forces LDP to send label mappings for all FECs, resolving the connectivity issue.

EoMPLS (Ethernet over MPLS) is correct because it establishes a point-to-point pseudowire (Martini draft, RFC 4448) between two PE routers, transporting Layer 2 Ethernet frames across an MPLS core without MAC learning or multipoint capabilities.

Segment Routing (SR-MPLS) eliminates the need for label distribution protocols like LDP or RSVP-TE. Instead, SR-MPLS encodes label information directly in the packet header as a segment list, and routers use the IGP (e.g., OSPF or IS-IS) to advertise segment identifiers (SIDs). This simplifies the control plane and removes protocol dependencies.

The Egress Tunnel Router (ETR) is the LISP device that registers its location (RLOC) to the mapping system (Map-Server) so that other devices can resolve the endpoint identifier (EID) to that RLOC. This registration process populates the mapping database, enabling remote Ingress Tunnel Routers (ITRs) to find and forward traffic to the ETR. Without ETR registration, the mapping system would have no location information for the EID.

The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Hierarchical QoS uses a parent policy for shaping and a child policy for classification and queuing. The parent policy applies shape, and the child policy is attached to a class within the parent.

BGP Graceful Shutdown (GSHUT) uses a well-known community (GRACEFUL_SHUTDOWN) to inform peers to lower the local preference, draining traffic before session termination.

In IS-IS, Segment Routing (SR-MPLS) requires explicit activation under the IS-IS routing process with the `segment-routing mpls` command. Without this, the router will not generate or advertise adjacency SIDs (ADJ-SIDs) even if SR is enabled globally. This command ties the SR-MPLS data plane to the IS-IS control plane, enabling IS-IS to allocate and distribute SIDs for adjacencies.

DSCP EF (46) is commonly mapped to MPLS EXP 5 to preserve priority across the MPLS core.

One-to-one backup tunnels in MPLS-TE FRR create a dedicated backup LSP for each protected primary LSP. This means every primary LSP gets its own unique set of labels for the backup path, leading to a significant increase in the number of labels in the forwarding table. In contrast, facility backup shares a single bypass tunnel among multiple protected LSPs, which conserves labels.

In RPKI, if no ROA exists for the prefix, the state is 'not-found'. If the origin AS matches a ROA, it's 'valid'; if it conflicts, it's 'invalid'.

EF is defined as DSCP 46 (binary 101110) for low-loss, low-latency traffic like voice.

Bidirectional Forwarding Detection (BFD) provides sub-second failure detection for BGP sessions, reducing the time to detect a link or neighbor failure from seconds (default BGP keepalive/hold timers) to milliseconds. BGP Prefix Independent Convergence (PIC) pre-installs backup paths in the forwarding table, allowing traffic to be rerouted immediately upon failure without waiting for BGP to reconverge. Together, these features drastically improve BGP convergence in an MPLS VPN environment.

Segment Routing (SR) can perform traffic engineering using SR-TE policies (via a controller or PCEP) or SR Flexible Algorithm, without requiring RSVP-TE. This eliminates the complexity of RSVP-TE's soft-state signaling and per-LSP state maintenance, relying instead on source-routed segment lists encoded in the packet header.

End.DT4 is the SRv6 endpoint behavior for decapsulation and table lookup in the VPN IPv4 table.

'bandwidth remaining percent' allocates a percentage of the remaining bandwidth after the priority queue is serviced. This ensures other classes share leftover bandwidth.

In the VRF route output, the [200/0] notation represents the administrative distance (200) and the metric (0) for the route. The administrative distance is a trustworthiness value used by the router to select the best path when multiple routing protocols provide routes to the same destination; a lower value is preferred. The metric is a protocol-specific cost, and here it is 0, indicating a directly connected or very low-cost path within the VRF.

SVI configuration requires creating the VLAN, then the interface VLAN, assigning an IP, and enabling it.

The exhibit shows a QoS policy where the VOICE class is configured with the 'priority' command and a bandwidth statement of 10 percent. In Cisco IOS, the 'priority' command under a class map creates a strict priority queue (LLQ), and the bandwidth percentage defines the maximum amount of interface bandwidth that can be used by this queue, ensuring low-latency treatment for voice traffic. Therefore, option C is correct.

When two service policies are applied to the same subinterface in the same direction, the router only honors the first policy applied; the second policy is ignored. In this case, SHAKE-1M was applied first, so CHILD-QOS is not processed. Cisco IOS does not allow multiple service policies in the same direction on a single interface or subinterface, as each direction can have only one active policy-map.

EVPN IRB requires an IP-VRF to represent the tenant, a bridge domain (EVI) for Layer 2, and IRB interfaces (Layer 3 gateway) that connect the bridge domain to the VRF. BGP EVPN control plane is also needed.

TLV 236 (IPv6 Reachability) carries IPv6 prefixes and associated metrics.

A stub area does not allow AS-external LSAs (type 5), reducing routing table size. NSSA allows limited external routes via type 7 LSAs.

In the DiffServ Tunneling Model, the Short Pipe model specifically instructs the egress PE to ignore the MPLS EXP bits for queuing and instead use the original IP DSCP value. This preserves the end-to-end QoS marking across the MPLS core, making option D correct. The Pipe model, by contrast, uses the EXP bits at the egress PE, which is why option B is incorrect.

RPKI with Origin Validation uses ROAs to validate origin AS, which can be automated. IRR-based filtering with prefix-lists requires manual updates, while RPKI can be automated via RTR.

Pseudowire (A) is the correct technology because it provides a point-to-point Layer 2 circuit over an MPLS core, allowing Ethernet frames to be encapsulated and transported transparently. This is defined in RFC 4448 (Ethernet over MPLS) and enables service providers to offer E-Line services. Pseudowire uses MPLS labels to forward frames across the core without requiring the core routers to participate in the customer's Layer 2 control plane.

In an MPLS L3VPN multicast deployment, the core network between PE routers uses a label-based multicast mechanism rather than a traditional PIM protocol. mLDP (Multipoint LDP) is the correct choice because it establishes point-to-multipoint (P2MP) LSPs in the MPLS core, enabling efficient multicast transport without requiring PIM in the core. This approach is defined in RFC 6388 and is commonly used for MVPN (Multicast VPN) implementations.

Per-VRF label allocation assigns a single MPLS label per VRF, meaning all routes within a VRF share the same label. This minimizes the number of labels in the forwarding table compared to per-prefix allocation, while still maintaining per-VRF isolation for L3VPN services. It is the recommended mode when the goal is to reduce label consumption without sacrificing VPN separation.

MPLS LSP ping is the correct tool because it specifically tests connectivity along an MPLS Label Switched Path by sending MPLS echo request packets that follow the label stack, and it can detect label loops by checking the TTL field in the MPLS header. Unlike regular ICMP-based tools, MPLS LSP ping operates at the MPLS forwarding plane, verifying that the LSP is intact and that labels are correctly swapped at each hop.

CoPP (Control Plane Protection) on IOS XR uses class maps and policy maps to classify and rate-limit traffic destined to the control plane, protecting the router from CPU overload.

A VPNv4 route is installed into a VRF table only if its Route Target (RT) matches an import statement in the VRF's route-target import list or import map. If the RT does not match, the PE router will not import the route into the VRF, even though the route is valid in the BGP VPNv4 table. This is the most common cause for a VPNv4 route being present in BGP but missing from the VRF.

The most likely cause is a mismatched MTU because OSPF uses the interface MTU to determine whether to form an adjacency. If the MTU on one side is smaller than the size of the Database Description (DBD) packet, the neighbor will reject the packet and remain in the EXSTART state, preventing full adjacency. This is a common issue when connecting interfaces with different MTU values, such as a default 1500 bytes on one side and a lower value on the other.

LLQ provides a strict priority queue for real-time traffic (voice) and uses CBWFQ for other data classes with bandwidth guarantees.

The Init state is the first step in OSPF neighbor formation after the Down state. A router enters Init when it receives a Hello packet from a neighbor but does not yet see its own Router ID in the neighbor's Hello packet, indicating that bidirectional communication is not yet confirmed.

NETCONF uses <edit-config> to modify the config; <get-config> retrieves; <lock> prevents concurrent edits.

FlowSpec actions include 'traffic-rate' (rate-limit), 'traffic-action' (drop), 'redirect', etc. The correct actions among the options are rate-limiting and dropping.

In Segment Routing (SR-MPLS), the IGP (IS-IS or OSPF) is extended to advertise prefix Segment Identifiers (SIDs), which are used to build MPLS labels directly from the IGP database. This eliminates the need for a separate label distribution protocol like LDP, as the IGP itself carries the label information within its link-state advertisements.

The 'show mpls forwarding-table vrf VPN-A 10.1.1.0' command displays the MPLS label stack that will be imposed on packets destined for the VPN prefix, including the inner VPN label and the outer transport label (LDP or SR-MPLS). This directly verifies the end-to-end MPLS forwarding path for VPN traffic, which is necessary when VRF routes are present but connectivity fails due to label issues.

CSPF considers bandwidth, affinity (color), and explicit constraints, but not administrative distance, which is a routing protocol metric.

In model-driven telemetry on Cisco XR, a subscription must explicitly associate a sensor-group (which defines the data to collect) with a destination-group (which defines where to send it). If these are not correctly associated and committed, the router will not stream any telemetry data to the collector, even if the collector is reachable. The verification of reachability confirms the network path is fine, so the next logical step is to check the subscription configuration.

RESTCONF is a southbound interface that NSO uses to communicate with network devices. It is a RESTful protocol that uses HTTP methods (GET, POST, PUT, DELETE) to access YANG-defined data models, making it suitable for modern programmable devices. NSO leverages RESTCONF to configure and manage devices that support this protocol, providing a standardized, stateless interface for automation.

ORIGINATOR_ID is set by the route reflector to identify the originator of the route. It is used to prevent loops in iBGP.

The BGP best-path selection algorithm considers attributes in a specific order before using the metric (MED). The sequence is: highest Weight, highest Local Preference, prefer locally originated routes, shortest AS_PATH, lowest Origin type, and then lowest metric. Therefore, all five options A, B, C, D, and E are evaluated before the metric step.

To prevent label spoofing, MPLS should be disabled on PE-CE links so that customers cannot send labeled packets. Additionally, disabling TTL propagation prevents label stack visibility.

The Locator portion of an SRv6 SID identifies the node and is routable in the IGP.

The MPLS forwarding table on PE1 shows the label for PE2's loopback as 'Untagged', which indicates that LDP has not assigned a label for that prefix on the incoming interface. Since LDP is responsible for distributing labels for IGP routes (like loopbacks) in an MPLS LDP-enabled network, the missing label means LDP is not operational on the link between PE1 and P1. Without a label, PE1 cannot push an MPLS label for the BGP next-hop, causing the VPNv4 traffic to be dropped or forwarded as IP, which fails because the core routers (P1, P2) do not have the VPN route.

XGS-PON provides symmetric 10 Gbps, while GPON is asymmetric (2.5G/1.25G). Both use passive optical splitters and WDM.

E-Line is the MEF service for point-to-point Ethernet connectivity.

EVPN-VPWS provides multi-homing with fast convergence and simplifies provisioning using BGP.

The policy-map applies the 'priority' command to the VoIP class, which enables strict priority queuing (LLQ). The 'police cir percent 30' command limits the priority queue's bandwidth to 30% during congestion, ensuring VoIP traffic is always served first but cannot exceed the configured percentage. This matches option A exactly.

IS-IS TE extensions use sub-TLVs within the extended IS reachability TLV (type 22). Specifically, TLV 135 (extended IP reachability) carries wide metrics, but TE information is carried in the extended IS reachability TLV (type 22) with sub-TLVs. The question asks for the TLV that carries TE info; the correct answer is the extended IS reachability TLV (type 22).

VPLS (Virtual Private LAN Service) emulates a multipoint Ethernet LAN over MPLS. VPWS is point-to-point, EVPN is modern but not always broadcast, and L3VPN is layer 3.

BFD (Bidirectional Forwarding Detection) provides fast failure detection at the link layer, triggering routing protocol convergence.

The issue is that MPLS L3VPN traffic is not being load-balanced despite equal-cost IGP paths. This typically occurs when the MPLS forwarding table on the P router has only one label entry for the BGP next-hop, indicating that per-flow load balancing is not enabled. Enabling 'load-balance per-flow' on all routers ensures that the CEF (Cisco Express Forwarding) uses per-flow hashing to distribute traffic across multiple equal-cost LSPs (Label Switched Paths), rather than per-packet or default behavior that may favor a single path.

The 'Pop tag' in the outgoing tag indicates that the router is the penultimate hop in the MPLS LSP. According to Penultimate Hop Popping (PHP) behavior, the penultimate router removes (pops) the top label before forwarding the IP packet to the egress LSR, so the egress router receives a pure IP packet and does not need to perform a label lookup. This is standard MPLS behavior defined in RFC 3031.

MP-BGP (Multiprotocol BGP) carries VPNv4 routes between PE routers, including the VPN label, enabling customer isolation and reachability across the MPLS core.

A transit Label Switch Router (LSR) in an MPLS network performs label swapping: it receives a labeled packet, replaces the incoming label with an outgoing label from its LFIB (Label Forwarding Information Base), and forwards the packet toward the egress LSR. This is the fundamental operation of an LSR in the core of an MPLS domain, as defined in RFC 3031.

BGP PIC uses backup paths that are pre-installed in the RIB/FIB. When the primary path fails, traffic is immediately switched to the backup path without waiting for BGP re-convergence.

BGP confederations divide an AS into sub-ASes. eBGP-like behavior is used between sub-ASes, but the AS_PATH length calculation treats the confederation as a single AS. The sub-AS number is appended to the AS_PATH with a special type code, but the AS_PATH length for best path selection ignores confederation segments.

B is correct because pyang is a YANG data modeling language validator and converter that can validate YANG modules against device capabilities (e.g., via RFC 7895 YANG Library) and generate Python bindings (e.g., using the `--plugindir` or `pyang --format pybind` options) for use in automation scripts. It directly supports the task of validating YANG models and producing Python code, unlike the other options which are protocols or automation frameworks.

NETCONF uses RPCs like get-config and edit-config; it runs over SSH (RFC 6242) and uses XML encoding.

Cisco's SR/LDP interworking allows coexistence. Routers can run both LDP and SR, and a mapping server advertises SR labels for LDP-learned prefixes. This enables seamless migration.

LDP uses downstream unsolicited mode by default, where each LSR advertises labels for all FECs to all neighbors without being asked, and liberal label retention stores all received labels even if not currently used.

Application Layer Gateway (ALG) is required to inspect and modify payloads for protocols like SIP and FTP that carry IP addresses in the data stream.

EVPN uses Ethernet Segment Identifier (ESI) for multi-homing. All-active mode allows load balancing across multiple PE nodes, and BGP control plane provides fast convergence via route withdrawal.

6PE uses BGP multiprotocol extensions (MP-BGP) with the IPv6 Address Family Identifier (AFI) and subsequent AFI (SAFI) to carry IPv6 prefixes. The next-hop is encoded as an IPv4 address using the 'next-hop' attribute with an IPv4 address. This is done via MP_REACH_NLRI for IPv6 with an IPv4 next-hop.