Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 751–825

The collection protocol (gRPC, gNMI, or native TCP) is critical because it determines the transport mechanism, security model, and compatibility with the telemetry collector. gRPC offers high-performance streaming with TLS, gNMI provides a standardized interface for both telemetry and configuration, and native TCP is simpler but less flexible. Choosing the wrong protocol can lead to interoperability issues or performance bottlenecks in a large SP network.

After LOCAL_PREF, the next step in BGP best path selection is whether the route was originated locally (via network or aggregate command). Then AS_PATH length is considered.

Option D is correct because NETCONF uses TCP port 830 as its default transport port (per RFC 6242). If a firewall blocks this port, the TCP three-way handshake cannot complete, preventing the NETCONF session from establishing. This is a common network-layer cause of session failure.

Downstream unsolicited means the router sends label bindings without being asked; liberal label retention means it keeps all bindings even if not from the next hop.

Option D is correct because the command `ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE` creates a static inter-VRF route on the PE router, allowing traffic from VRF RED to be forwarded to VRF BLUE without requiring MPLS or BGP. This is the standard method for VRF-lite inter-VRF communication on the same PE, using a static route that points to the next-hop VRF instead of an IP address.

In OSPF, Prefix-SIDs for loopbacks are advertised by configuring 'segment-routing mpls' globally and then assigning a SID index under the OSPF router process using the 'prefix-sid index' command for the specific loopback network. This ties the SID to the OSPF prefix advertisement, enabling SR-MPLS forwarding without LDP.

E-Line is a MEF standard for point-to-point Ethernet services, providing dedicated bandwidth and SLA guarantees.

Option B is correct because in MPLS L3VPN, each customer is assigned a separate Virtual Routing and Forwarding (VRF) instance on the Provider Edge (PE) router. This VRF maintains a unique routing table and forwarding table per customer, ensuring complete isolation between different VPN customers on the same PE.

LLQ (Low Latency Queuing) is the correct choice because it combines a strict priority queue with CBWFQ, ensuring that voice traffic is always served before any other queue. This strict priority scheduling minimizes both latency and jitter for real-time traffic, which is critical for voice quality.

The LER (or ingress LSR) imposes a label stack (push operation) on the packet, then forwards it based on the label. It does not swap labels (that's done by LSRs), nor does it pop the label (egress LER does).

IS-IS wide metrics use a 24-bit field, allowing values up to 16,777,215, and are required for TE.

BGP selects the best path based on a sequence of comparison steps. The first step after considering the next-hop reachability is to prefer the route with the highest weight (Cisco proprietary), then the highest local preference. Since the router prefers the longer AS path, a higher local preference (option D) on the first peer's route overrides the shorter AS path of the second peer, as local preference is evaluated before AS path length in the BGP best-path selection algorithm.

NTP authentication using a key ensures that only trusted NTP servers can update the router's clock, preventing spoofing attacks.

End.DT2U is used for L2VPN bridging (EVPN VPWS) and EVPN-IRB uses End.DT2U for bridge domain.

For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.

NSO uses NETCONF as the primary protocol for device configuration, leveraging YANG models for service modeling.

PRC is used when only leaf (IP prefix) information changes, not the IS-IS topology. It avoids full SPF recalculation, improving convergence.

RPKI BGP Origin Validation uses ROAs to validate the origin AS. Routes are marked as valid, invalid, or not-found based on ROA records.

EVPN offers better control plane (BGP) and supports multi-homing with all-active load balancing.

L2 routers handle inter-area routing in IS-IS, while L1 routers handle intra-area routing. L1/L2 routers act as both.

B is correct because the Path Computation Element Protocol (PCEP), defined in RFC 5440 and extended for Segment Routing in RFC 8664, is the dedicated protocol used between a PCE and a PCC to request, report, and delegate SR-TE paths. PCEP carries explicit path computation requests (PCReq) and replies (PCRep), as well as state reporting (PCRpt) and delegation (PCUpd) messages, making it the standard control-plane protocol for SR-PCE architectures.

BGP PIC provides fast failover by precomputing backup paths in the forwarding table, enabling sub-second convergence upon failure, independent of the number of prefixes.

MED (Multi-Exit Discriminator) is used to influence inbound traffic from neighboring ASes by suggesting the preferred path into the AS.

CoPP (Control Plane Policing) on IOS XR uses class maps and policy maps to classify and rate-limit control plane traffic, including ICMP. ACL-based policing is less granular, and MPLS TE or BGP prefix filtering do not apply.

Option A is correct because the intermittent packet loss suggests a control-plane issue rather than a data-plane problem. By checking 'show ip route vrf CUSTOMER' and 'show bgp vpnv4 unicast vrf CUSTOMER', you can verify that the VRF route for the CE prefix is present in the routing table and that BGP is advertising the correct VPNv4 route with the proper next-hop and label. This isolates whether the failure is due to missing or incorrect route propagation, which is a common cause of intermittent reachability in MPLS L3VPN.

End.DT4 is a SRv6 endpoint behavior that decapsulates an IPv6 packet with an SRH and performs a lookup in the IPv4 VRF table for L3VPN.

PRC is triggered when an IP prefix changes (addition, removal, or metric change) without a change in the IS-IS topology (i.e., no change in adjacency or reachable IS-IS neighbors). PRC only recalculates the affected prefixes, avoiding full SPF.

MEF defines E-Line, E-LAN, and E-Tree. E-Access is also defined but is not part of the three main types. E-WAN is not a standard MEF service.

RSVP-TE uses PATH messages to establish state and RESV to reserve. To tear down, a PathTear message is sent from the ingress to the egress, or a ResvTear from egress to ingress.

Strict mode uRPF checks that the source IP address is reachable via the same interface the packet arrived on, and that the route points back to that interface. This is suitable when symmetric routing is guaranteed, as on PE-CE links in L3VPN.

End.DT6 (Endpoint with Decapsulation and IPv6 table lookup) is used for L3VPN over SRv6. It decapsulates the outer IPv6 header and forwards based on the inner IPv6 destination using a specific VRF table.

The 'Init' state in OSPFv3 indicates that the router has received a Hello packet from the neighbor but the neighbor has not received a Hello packet back. On a point-to-point link, the most common cause is that the 'ipv6 ospf <process-id> area <area-id>' interface command is missing on one side, which prevents OSPFv3 from sending Hellos on that interface. Without this command, the interface is not enabled for OSPFv3, so the neighbor never sees a Hello and the adjacency cannot progress to FULL.

C is correct because Segment Routing Traffic Engineering (SR-TE) allows the service provider to perform traffic engineering without RSVP-TE by using segment lists (label stacks) to steer traffic along explicit paths. SR-TE leverages the IGP (OSPF or IS-IS) to distribute segment IDs (SIDs) and uses a centralized controller or headend node to compute and enforce TE policies, eliminating the need for RSVP-TE's per-flow signaling and state maintenance.

The 'show segment-routing traffic-eng policy' command displays the operational state of SR-TE policies, including whether the policy is 'up' and actively forwarding traffic. It shows the candidate path, binding SID, and forwarding status, making it the primary verification command for SR-TE policy activity.

In the Modular QoS CLI (MQC), the class-map component is used to define traffic classes by matching packets based on criteria such as DSCP (Differentiated Services Code Point) or IP precedence values. The class-map uses match statements (e.g., match ip dscp, match ip precedence) to classify traffic, which is then applied within a policy-map for QoS actions. This makes class-map the correct MQC component for traffic matching.

NTPv4 autokey (Option A) is the correct answer because it provides a secure, automated key distribution mechanism using public-key cryptography (RFC 5906). This eliminates the need for manual key exchange, making it the recommended authentication mode for securing NTP in service provider networks.

Option A is correct because a load balancer distributes incoming gRPC streams from all 200 routers across multiple collectors based on a configured algorithm (e.g., round-robin or least connections), achieving even load distribution without per-router configuration. The routers simply send telemetry to a single virtual IP (VIP), and the load balancer forwards each stream to an available collector, preventing any single collector from being overwhelmed. This matches the requirement to offload processing and avoid manual configuration per router.

Option A is correct because the question specifies that the PE router must mark voice packets with the correct DSCP value before they enter the MPLS core. The 'set dscp ef' action in a policy-map applied to the ingress interface explicitly sets the DSCP field to EF (46) for voice traffic matched by a class-map, ensuring proper classification and treatment across the MPLS network. This is the standard method for marking IP packets at the edge before MPLS encapsulation.

Option D is correct because in an MPLS VPN environment, VPNv4 routes (which include both the IPv4 prefix and the Route Distinguisher) are exchanged between Provider Edge (PE) routers using the VPNv4 unicast address family under the BGP configuration. This address family allows PE routers to carry customer routes with unique RD values, enabling address overlap across different VPNs.

LDP (Label Distribution Protocol) is the correct choice because it is the standard protocol used in MPLS networks to dynamically distribute label bindings for all routes in the routing table. It operates by establishing LDP sessions between directly connected LSRs and exchanging label mappings for each prefix, ensuring every router in the MPLS domain has the necessary labels to forward labeled packets.

LOCAL_PREF is a well-known discretionary attribute that indicates the degree of preference for a route within an AS. It is sent to iBGP peers but not to eBGP peers by default.

Weight, LOCAL_PREF, and locally originated routes are compared before AS_PATH length in the BGP best path selection algorithm.

Option C is correct because TI-LFA (Topology Independent Loop-Free Alternate) computes a backup path that is guaranteed to be loop-free regardless of the network topology, using segment lists (label stacks) to steer traffic around a failure. It does not rely on the presence of a natural loop-free alternate in the IGP topology, making it topology independent. This ensures fast convergence (typically sub-50ms) without requiring signaling protocols like RSVP-TE.

NSO can use NETCONF or RESTCONF southbound to communicate with network devices. NETCONF is the standard for configuration management.

The 'affinity' attribute in MPLS TE is used to define administrative groups (also known as link colors) that allow you to include or exclude specific links from a TE tunnel path based on user-defined properties. This enables traffic engineering policies such as forcing traffic to avoid certain links or preferring links with specific characteristics, without modifying the underlying IGP metric.

DSCP EF (Expedited Forwarding, per RFC 3246) requires strict priority queuing to guarantee low latency and jitter for voice traffic. The 'priority' command under the voice class in a policy map places the traffic into a strict priority queue (LLQ), ensuring it is serviced before any other queue during congestion. Without this command, the voice traffic is treated as a regular class, subject to bandwidth constraints and potential drops.

The admin plane is a separate management context for administrative tasks such as configuring SDRs, managing hardware, and system-level settings. It provides isolation from the default SDR.

CLUSTER_LIST and ORIGINATOR_ID are used to prevent loops. CLUSTER_LIST is a sequence of cluster IDs; ORIGINATOR_ID identifies the originator.

The DiffServ model uses the 6-bit DSCP field in the IP header to classify packets.

OSPF TE extensions are defined in RFC 3630, which introduces the Opaque LSA (Type 9, 10, 11). Specifically, Type 10 Opaque LSAs carry TE information. The TE LSA is carried in an Opaque LSA of area scope (Type 10).

Option A is correct because LDP sessions are established only between directly connected LSRs when using the default 'mpls ldp' interface configuration. The LDP Hello messages are sent as UDP packets to the multicast address 224.0.0.2, and if the interface IP addresses are not in the same subnet, the Hello messages will not be received, preventing neighbor discovery.

The 'Active' state in BGP indicates that the router is trying to establish a TCP connection with the neighbor but has not yet succeeded. This is most commonly caused by a misconfiguration in the BGP neighbor statement, such as an incorrect IP address, wrong AS number, or a missing neighbor statement on one side. Since the route reflector is not forming a BGP session, clients cannot receive any routes, which explains the symptom.

In Segment Routing with TI-LFA, the router performing local repair must compute a backup path that is guaranteed loop-free. A Protected Adj-SID (Adj-SID with the B-flag set) is required because it indicates that the adjacency segment is protected by a fast-reroute mechanism, allowing the router to use a precomputed backup path that avoids the failed link while ensuring no forwarding loops occur.

In the Modular QoS CLI (MQC), the class-map is the component used to define traffic classes by specifying match criteria such as IP precedence, DSCP values, or access-group references. The class-map groups packets that match one or more conditions, allowing the policy-map to apply QoS actions (e.g., policing, shaping) to that specific class. Without a class-map, the policy-map cannot differentiate between traffic types.

B is correct because BGP's route selection process evaluates local preference before AS path length. The route from Peer A has a local preference of 150, which is higher than Peer B's 100, so it is preferred regardless of the shorter AS path from Peer B. Local preference is the second BGP attribute in the decision process (after weight) and is used to influence outbound traffic from an AS.

Network slicing enables multiple virtual networks on a shared physical infrastructure, each with tailored performance characteristics.

OSPFv3 operates similarly to OSPFv2 on broadcast networks, electing a DR and BDR using Hello protocol, and forming adjacencies with the DR.

In MPLS L3VPN, the PE-CE next-hop (the PE interface facing the CE) must be advertised to the remote PE so that the remote PE knows to forward traffic directly to the local PE's CE-facing interface. The `next-hop-self` command on the PE forces BGP to set the next-hop to the PE's own IP address (typically the loopback or the interface used for BGP peering), which overrides the default behavior of preserving the original next-hop. This ensures that the remote PE uses the correct next-hop for VPN traffic.

Option B is correct because in IOS-XR telemetry, a destination-group must include the 'protocol' keyword (e.g., 'protocol grpc' or 'protocol tcp') to specify the transport protocol for the collector. Without this specification, the router does not know how to send the telemetry data, and the collector at 10.1.1.100 will not receive any data.

EVPN offers BGP-based control plane, multi-homing support, and MAC mobility. VPLS traditionally uses LDP and does not natively support multi-homing or MAC mobility as effectively.

A 401 Unauthorized response indicates the request lacks proper authentication. The engineer likely forgot to include HTTP basic authentication headers with the correct username and password. Other options relate to content types or TLS, which would cause different errors (e.g., 415 Unsupported Media Type).

C is correct because the priority queue in a Low Latency Queueing (LLQ) policy is policed at the configured rate (500 kbps). When VoIP traffic bursts exceed this rate, the excess packets are dropped immediately by the policer, not queued or reclassified. This ensures that the priority queue does not starve other queues and maintains low latency for conforming traffic.

LLQ provides strict priority for voice. CBWFQ with bandwidth guarantees for transactional data ensures it gets capacity. Bulk data can use remaining bandwidth.

IS-IS wide metrics (TLV 135/236/22) support TE and segment routing; narrow metrics (TLV 128/130) are limited to 6-bit metrics.

BGP PIC requires BGP additional paths (add-path) or BGP PIC edge, which installs backup paths in the FIB independent of the prefix count.

Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.

In RSVP-TE, the headend router sends a PATH message along the explicit route to signal the desired LSP. This message carries the label request, traffic parameters, and the explicit route object (ERO) to each downstream router, which then forwards it hop-by-hop toward the destination. Only after the PATH message reaches the tailend does the tailend respond with a RESV message to actually reserve resources and establish the LSP.

Low Latency Queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that EF (real-time) traffic is always served before other queues. This prevents starvation of delay-sensitive traffic by bulk data (AF11) while still allowing fair treatment of other classes. LLQ is the standard Cisco mechanism for supporting real-time traffic like VoIP with guaranteed low latency.

BGP FlowSpec can specify actions like traffic-rate (rate-limiting), redirect (to a next-hop or VRF), and drop (discard). Marking DSCP is not typical; sample is used for traffic analysis but not a standard action in FlowSpec.