Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 676–750

Intermittent connectivity during peak hours strongly suggests a bandwidth or queuing issue at the edge of the MPLS network. Interface errors (e.g., CRC, runts) and discards on the CE router indicate congestion or Layer 1/2 problems, which are the most common cause of such time-dependent symptoms. Checking this first aligns with the standard troubleshooting methodology of verifying the physical and data-link layers before moving to higher-layer protocols.

Hierarchical QoS uses a parent policy for shaping and a child policy for classification and priority queuing. The child is applied to the parent's class-default.

RPKI requires: 1) ROA (Route Origin Authorization) created by the prefix holder; 2) Relying Party (cache server) that fetches and validates ROAs; 3) RTR protocol to download the VRP (Validated ROA Payload) to routers. BGPsec is a separate standard for path validation. IS-IS is not involved.

The UDP Jitter operation (option E) is correct because it measures both one-way jitter and packet loss by sending UDP packets with precise timestamps, which is essential for diagnosing voice quality issues. Unlike other IP SLA operations, UDP Jitter specifically tracks inter-packet delay variation (jitter) and loss patterns that directly impact VoIP and real-time traffic.

MPLS provides multiple VPN services: Layer 3 VPNs use BGP for route exchange, Layer 2 VPNs emulate L2 circuits, TE controls traffic paths, and Inter-AS extends connectivity across providers. Common confusions involve swapping the L2 and L3 definitions.

The 'show mpls traffic-eng tunnels' command displays detailed information about MPLS TE tunnels, including path calculation status, RSVP signaling errors, and tunnel state. This command is specifically designed to verify TE tunnel operations and troubleshoot issues such as path computation failures or RSVP resource reservation problems.

B is correct because Topology-Independent LFA (TI-LFA) provides fast convergence in Segment Routing networks by computing a backup path that is guaranteed to be loop-free regardless of the network topology. It leverages the Segment Routing data plane to pre-install a repair path using a segment list, enabling sub-50ms failover without relying on IGP convergence.

D is correct because MPLS Layer 3 VPN (BGP/MPLS IP VPN) uses per-VPN routing tables (VRFs) to maintain separate forwarding instances for each customer. This allows overlapping IP addresses across different customers while keeping each VPN's routes isolated. The provider edge routers exchange VPNv4 routes using MP-BGP with route distinguishers (RDs) to make overlapping prefixes unique, and route targets (RTs) control which VRFs import/export those routes.

The most likely cause is that the SSH host key of the router is not in the controller's known_hosts file. NETCONF over SSH (RFC 6242) requires SSH transport, and the controller must authenticate the router's SSH host key during session establishment. If the host key is missing or mismatched, the SSH handshake fails, preventing the NETCONF session from starting, even though the router is reachable and NETCONF is enabled.

Since the interface between the PE and P routers is up/up and IGP reachability to the PE's loopback is fine, the issue is that MPLS LDP is not enabled on that interface. Without LDP, the PE cannot advertise a label for its loopback to the P router, so the P router cannot push the correct label for packets destined to the remote PE. This makes the BGP VPNv4 next-hop unreachable even though the route itself is present in the table.

In inter-AS Option B, ASBRs peer using eBGP and exchange labeled VPN-IPv4 prefixes (AFI 1, SAFI 128). This allows the VPNv4 routes to be carried across AS boundaries without requiring a full mesh of MP-IBGP between PEs, as the ASBRs re-advertise the routes with a new next-hop and perform label allocation for the VPN labels.

MPLS Layer 3 VPN (L3VPN) uses a peer-to-peer model where the provider edge (PE) router participates in the customer's routing via MP-BGP (RFC 4364). This allows the provider to offer IP transit services by carrying customer IP routes across the MPLS backbone, and Internet access by connecting the customer VRF to an Internet-facing VRF or global routing table. Both services rely on the L3VPN architecture's ability to separate and forward IP traffic based on VRFs and route targets.

Hierarchical QoS (HQoS) is required when you need to shape traffic to a contracted rate (e.g., 10 Mbps) while also applying per-class actions like priority and bandwidth guarantees. Option A correctly uses a child policy to define class-based QoS (priority for voice, bandwidth for critical data) and a parent policy that applies the shape average command to the entire child policy aggregate, enforcing the 10 Mbps contract. This two-level MQC structure ensures that shaping occurs at the parent level before the child policy’s per-class queuing and scheduling are applied.

Disabling MPLS on the PE-CE link ensures the CE does not receive labeled packets. TTL propagation is for traceroute, not for preventing label exposure. LDP authentication secures label distribution but does not prevent CE from receiving labels if MPLS is enabled.

IS-IS is the correct choice because it is a link-state IGP that inherently supports fast convergence through mechanisms like incremental SPF (iSPF) and prefix-independent convergence (PIC). It is widely deployed in MPLS core networks due to its scalability, extensibility via TLVs, and native support for MPLS Traffic Engineering (MPLS-TE) without requiring additional protocol extensions like OSPF's opaque LSA.

RSVP-TE FRR offers two protection methods: facility backup (bypass tunnel) and 1:1 protection (detour LSP). Global Repair is not a standard term; Local Protection is used in segment routing.

GPON (Gigabit Passive Optical Network) uses passive splitters to share fiber among multiple subscribers.

The 'set-overload-bit' command causes the IS-IS router to set the overload bit in its Link State PDUs (LSPs). This signals to other routers that the advertising router should not be used for transit traffic, but it still participates in SPF calculations and can be reached as a leaf or end node. Therefore, the router retains its routes and adjacency, but other routers will not forward traffic through it.

Segment routing (SR-MPLS) eliminates the need for the LDP protocol by encoding MPLS labels directly in the IGP (e.g., OSPF or IS-IS) using extensions like RFC 8665 and RFC 8667. This simplifies the control plane by removing an entire protocol (LDP) and its associated state, reducing operational complexity and convergence time.

A transit Label Switch Router (LSR) in an MPLS network receives a labeled packet and must forward it toward the egress LSR. The core operation on the top label is a swap: the incoming label is replaced with an outgoing label learned from the downstream LSR via Label Distribution Protocol (LDP) or other label distribution protocols. This maintains the label-switched path (LSP) and ensures the packet continues along the correct path.

VPWS (Virtual Private Wire Service) is a pseudowire that provides point-to-point L2VPN connectivity, emulating a physical wire.

Strict mode checks that the source IP is in the FIB and that the best return route is through the same interface. Loose mode only checks that the source IP is in the FIB. Strict mode is used at customer edges where traffic should come from a specific interface.

MPLS traceroute (often implemented via LSP ping with the 'traceroute' option or the 'mpls traceroute' command) is the correct tool because it uses MPLS echo request/reply messages (RFC 8029) to traverse the label-switched path (LSP) hop by hop, revealing the exact label stack and transit LSRs. This allows identification of a failing or misbehaving node in the MPLS core that standard IP traceroute would not see, since IP traceroute relies on TTL expiry in the IP header, which may not occur in an MPLS network where labels are swapped and IP TTL is often copied from the label TTL.

BGP community values are exchanged as part of the BGP routing update and are stored in the BGP table, but they are not carried in the IP packet header. QoS classification in Cisco IOS operates on fields within the Layer 2 or Layer 3 packet header (e.g., DSCP, IP precedence, CoS) and cannot inspect BGP attributes like community values. Therefore, a class-map using a match statement for BGP communities will never match traffic at the QoS classification stage, making this the most likely cause of the policy not working.

NEDs (Network Element Drivers) are plugins that translate NSO's service models to device-specific configurations.

The PCE computes paths based on the link-state database (LSDB) it receives from the IGP (e.g., OSPF or IS-IS). If the LSDB does not include the affinity (color) attributes for the nodes, the PCE cannot evaluate the 'avoid nodes in affinity red' constraint. This results in a path computation failure, even though the affinities are correctly configured on the network devices.

B is correct because the issue is that PE1 is configured with BGP additional-path capability but has a route policy that selects only the best path. When BGP path selection ties on local preference and other attributes, additional-path send/receive capability allows multiple paths to be considered, but the route policy must be adjusted to permit multiple paths into the VRF. Without this, only the single best path is installed, even if valid alternative paths exist.

In OSPFv3, Inter-Area Prefix LSAs (Type 0x2003) are used to advertise prefixes from other areas.

The 'show mpls traffic-eng tunnels brief' command directly displays the status, state (up/down), and key parameters (e.g., bandwidth, path) of all configured MPLS TE tunnels, making it the most relevant command for verifying TE tunnel status. It provides a concise view of tunnel endpoints, admin/operational states, and signaled bandwidth, which is essential for traffic engineering verification.

RADIUS is the standard protocol for authentication, authorization, and accounting (AAA) in BNG environments. DHCP assigns IP addresses, but authentication is via RADIUS. TACACS+ is for device administration; IPoE uses DHCP but not typically for authentication.

EoMPLS with Martini encapsulation (RFC 4448) supports Q-in-Q transparent transport only when the ingress PE is configured to preserve the outer VLAN tag. Using 'dot1q second-dot1q' encapsulation on the subinterface tells the PE to treat the outer tag as part of the payload and not strip it, allowing both tags to be carried across the pseudowire. Without this, the default dot1q encapsulation strips the outer tag, causing double-tagged frames to be dropped at the egress PE.

In FlowSpec, a controller (or a router acting as controller) originates the FlowSpec NLRI and distributes it to edge routers via BGP. Edge routers apply the actions (e.g., drop, rate-limit). The trigger router is for RTBH; detection system may trigger but does not distribute FlowSpec.

BGP Graceful Shutdown (GSHUT) uses a well-known community or attribute to inform peers that the session is going down, allowing them to reroute traffic. BFD detects failures fast but does not signal; TTL propagation is for MPLS; route refresh is for soft reconfiguration.

Marking is the QoS mechanism that sets the Differentiated Services Code Point (DSCP) or IP Precedence bits in the packet header at the ingress edge of the network. This classification allows downstream devices to apply per-hop behaviors (PHBs) based on the marked value, as defined in RFC 2474 and RFC 2597. Unlike queuing, shaping, or policing, marking does not delay or drop packets; it only modifies the packet header to indicate the desired service class.

IS-IS TLV 22 (Extended IS reachability) carries TE metrics and other attributes for traffic engineering. TLVs 128 and 130 are IP reachability TLVs; TLV 135 is for extended IP reachability.

IOS XR is a distributed OS with process separation and a commit/rollback model. Monolithic kernel and shared memory are not features.

The Segment Routing Header (SRH) is a new IPv6 extension header defined in RFC 8754 that carries an ordered list of Segment Identifiers (SIDs). When a packet is forwarded along a segment-routed path, the SRH encodes the explicit path by listing each segment (node or adjacency SID) in sequence, and the active segment is updated as the packet traverses each hop. This allows the source node to steer packets through a specific path without intermediate nodes needing to maintain per-flow state.

The Cisco CRS (Carrier Routing System) is a high-end core router designed for the backbone of large SP networks.

SDR logically partitions a physical router into multiple independent routers, each with its own control plane and resources.

The exhibit shows two remote label bindings for prefix 10.0.0.0/24, one with an incoming label of 18 from LSR 192.168.1.2 and another with an incoming label of 19 from LSR 192.168.1.3. This indicates that two different LSRs have advertised label bindings for the same prefix, which is typical in an MPLS network with multiple paths. Therefore, option A is correct.

MPLS VPN traffic relies on LDP to distribute labels for the BGP next-hop loopback addresses used in the VPNv4 route exchange. If LDP is not enabled on the core-facing interfaces, the local PE cannot obtain a label binding for the remote PE's loopback, causing the traffic to be forwarded via IP (without a label) or taking a suboptimal path. Enabling LDP on all core-facing interfaces resolves the missing label binding and restores optimal label-switched forwarding.

E-LAN (Ethernet LAN) service provides multipoint-to-multipoint connectivity, as per MEF standards.

The aggregation layer collects traffic from access nodes and forwards it to the core, often performing QoS, filtering, and subscriber management.

The Site of Origin (SoO) BGP community is the correct feature because it prevents routing loops in MPLS L3VPN environments where the same CE router connects to multiple sites. When configured on the PE, SoO tags routes received from a CE with a unique identifier for that site; if the PE receives a route with the same SoO value from another site, it discards the route, ensuring the CE does not become a transit router between sites.

The Network Element Driver (NED) provides the abstraction layer between NSO and network devices, translating YANG models to device-specific configurations (e.g., CLI, SNMP).

The 'show mpls forwarding-table vrf <name>' command displays the complete MPLS forwarding entries for a specific VRF, including the incoming label, outgoing label, next-hop, and outgoing interface. This command is specifically designed to verify MPLS label-switched paths (LSPs) for a VRF, which is essential for troubleshooting MPLS VPN forwarding. It provides the most complete information for MPLS forwarding, as it shows both the label operations (swap, pop, push) and the VRF-specific forwarding details.

An Adjacency SID represents a specific link; when a router receives a packet with that label, it pops the label and forwards the packet out of the associated interface, because the Adjacency SID is a 'penultimate hop popping' type of SID.

The DF election is performed using a deterministic algorithm based on the ESI and the list of PEs, with the lowest IP address becoming DF.

GRE tunnel configuration involves creating the tunnel interface, setting source and destination, and assigning an IP address.

The Default Secure Domain Router (SDR) in IOS XR manages the system configuration and provides logical separation of the control plane for multiple tenants. Other options: XR Config Manager is a tool for configuration management but not for tenant separation; Admin Plane handles administrative functions like system monitoring; LRO (Label Rewrite Engine) is used for label switching operations, unrelated to configuration or tenant separation.

(10.5.5.5/32) is correct because the exhibit shows that the LDP label bindings are only present for prefixes 10.1.1.1/32, 10.2.2.2/32, and 10.3.3.3/32. The prefix 10.5.5.5/32 is not in the LDP label information base (LIB), meaning no MPLS label has been assigned to it, so it cannot be forwarded via MPLS and must be forwarded using standard IP routing instead.

BGP GSHUT adjusts the local preference of routes to make them less preferred, gracefully draining traffic before the session is shut down. This avoids packet loss.

OSPFv3 uses a 32-bit Router ID independent of IPv6 addresses. Adjacencies are formed with Router IDs, not link-local addresses. OSPFv3 runs per-link rather than per-subnet.

A is correct because EVPN requires an overlay tunnel encapsulation to transport Layer 2 frames across the IP/MPLS underlay. VXLAN (RFC 7348) and MPLS (RFC 7432) are the two primary encapsulations used to carry Ethernet frames over the overlay, enabling MAC address learning and forwarding in the EVPN control plane.

Prefix filtering (with prefix-lists and route-maps) ensures only expected prefixes are accepted from peers. RPKI validation provides cryptographic verification of origin AS. Both prevent hijacking.

EF PHB is used for low-loss, low-latency traffic such as voice. The recommended DSCP value for EF is 46 (binary 101110).

S/RTBH uses BGP to advertise a /32 route with a specific community to trigger routers to install a null route. This drops traffic to the victim IP at the edge. FlowSpec is more flexible but not specifically for RTBH; Peakflow detects anomalies; IDMS scrubs traffic.

VPWS (Virtual Private Wire Service) is a point-to-point L2VPN service that emulates a wire, also called a pseudowire.

The collection protocol (gRPC, gNMI, or native TCP) is critical because it determines the transport mechanism, security model, and compatibility with the telemetry collector. gRPC offers high-performance streaming with TLS, gNMI provides a standardized interface for both telemetry and configuration, and native TCP is simpler but less flexible. Choosing the wrong protocol can lead to interoperability issues or performance bottlenecks in a large SP network.

After LOCAL_PREF, the next step in BGP best path selection is whether the route was originated locally (via network or aggregate command). Then AS_PATH length is considered.

NETCONF uses TCP port 830 as its default transport port (per RFC 6242). If a firewall blocks this port, the TCP three-way handshake cannot complete, preventing the NETCONF session from establishing. This is a common network-layer cause of session failure.

Downstream unsolicited means the router sends label bindings without being asked; liberal label retention means it keeps all bindings even if not from the next hop.

The command `ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE` creates a static inter-VRF route on the PE router, allowing traffic from VRF RED to be forwarded to VRF BLUE without requiring MPLS or BGP. This is the standard method for VRF-lite inter-VRF communication on the same PE, using a static route that points to the next-hop VRF instead of an IP address.

In OSPF, Prefix-SIDs for loopbacks are advertised by configuring 'segment-routing mpls' globally and then assigning a SID index under the OSPF router process using the 'prefix-sid index' command for the specific loopback network. This ties the SID to the OSPF prefix advertisement, enabling SR-MPLS forwarding without LDP.

E-Line is a MEF standard for point-to-point Ethernet services, providing dedicated bandwidth and SLA guarantees.

In MPLS L3VPN, each customer is assigned a separate Virtual Routing and Forwarding (VRF) instance on the Provider Edge (PE) router. This VRF maintains a unique routing table and forwarding table per customer, ensuring complete isolation between different VPN customers on the same PE.

LLQ (Low Latency Queuing) is the correct choice because it combines a strict priority queue with CBWFQ, ensuring that voice traffic is always served before any other queue. This strict priority scheduling minimizes both latency and jitter for real-time traffic, which is critical for voice quality.

The LER (or ingress LSR) imposes a label stack (push operation) on the packet, then forwards it based on the label. It does not swap labels (that's done by LSRs), nor does it pop the label (egress LER does).