971 questions total · 13pages · All types, answers revealed
Which IS-IS metric type supports values up to 2^24-1 and is used for traffic engineering?
Wide metrics use 24 bits and support larger values for TE.
Why this answer
IS-IS wide metrics use a 24-bit field, allowing values up to 16,777,215, and are required for TE.
A service provider is troubleshooting BGP route selection for prefixes received from two different peers. The first peer prepends its AS path twice, making it longer than the second peer's path. However, the router still prefers the route with the longer AS path. Which additional attribute could cause this behavior?
Local preference is the first criterion in BGP path selection; a higher value will be chosen regardless of AS path length.
Why this answer
BGP selects the best path based on a sequence of comparison steps. The first step after considering the next-hop reachability is to prefer the route with the highest weight (Cisco proprietary), then the highest local preference. Since the router prefers the longer AS path, a higher local preference (option D) on the first peer's route overrides the shorter AS path of the second peer, as local preference is evaluated before AS path length in the BGP best-path selection algorithm.
Exam trap
Cisco often tests the order of BGP path selection attributes, and the trap here is that candidates mistakenly think AS path length is always the deciding factor, forgetting that local preference (or weight) is evaluated first and can override a shorter AS path.
How to eliminate wrong answers
Option A is wrong because a lower MED (Multi-Exit Discriminator) is compared only if the paths are from the same neighboring AS, and it is evaluated after AS path length; a lower MED would not cause a longer AS path to be preferred. Option B is wrong because a higher weight is the first criterion in Cisco's BGP best-path selection and would cause the route to be preferred regardless of AS path length, but the question states the router prefers the route with the longer AS path, implying weight is not the overriding factor here (or weight is equal). Option C is wrong because a lower origin type (IGP < EGP < incomplete) is compared after AS path length; a lower origin could not override a shorter AS path.
Option E is wrong because a lower neighbor router ID is used only as a tiebreaker after all other steps, including AS path length, and would not cause a longer AS path to be preferred.
An engineer wants to secure NTP on IOS XR routers. Which configuration is required to prevent unauthorized time synchronization?
NTP authentication validates the source using a shared key.
Why this answer
NTP authentication using a key ensures that only trusted NTP servers can update the router's clock, preventing spoofing attacks.
Which SRv6 SID behavior is used to support EVPN-IRB (Integrated Routing and Bridging) for L2VPN with bridging?
Correct: End.DT2U decapsulates and bridges to an Ethernet segment.
Why this answer
End.DT2U is used for L2VPN bridging (EVPN VPWS) and EVPN-IRB uses End.DT2U for bridge domain.
A service provider is experiencing congestion on a core link connecting two P routers. The customer traffic is classified into three classes: voice (low latency), video (low loss), and data (best effort). The current configuration uses DSCP-based classification at the PE ingress, but many customers are remarking DSCP values to gain better service, bypassing the provider's QoS policy. The provider wants to enforce a strict trust boundary at the PE and re-mark all traffic according to a per-customer contract. Additionally, the provider must offer per-customer bandwidth guarantees, ensuring that one customer's traffic does not starve another customer's traffic on the congested core link. The solution must be scalable to hundreds of customers. What should the designer recommend?
Hierarchical QoS provides both per-customer and per-class enforcement, and setting trust boundary at ingress solves the remarking issue.
Why this answer
Hierarchical QoS allows per-customer shaping at the parent level to enforce per-customer bandwidth limits, and per-class policing at the child level to enforce per-class contracts. This provides the required trust boundary and per-customer guarantees. Option A is wrong because a flat policy on core interfaces does not allow per-customer differentiation and cannot enforce per-customer guarantees.
Option B is wrong because auto-qos does not provide per-customer granularity and relies on trust which is already broken. Option D is wrong because MPLS TE tunnels reserve bandwidth but do not solve the trust boundary issue; also resetting EXP is complex.
Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.
A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?
MPLS LSP must exist to the next-hop for label imposition.
Why this answer
For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.
How to eliminate wrong answers
Option B is wrong because the next-hop does not need to be a directly connected interface; it only needs to be reachable via the IGP with an MPLS label, even if multiple hops away. Option C is wrong because the PE does not need a VPN label for the next-hop; the VPN label is assigned by the remote PE for the specific VPN prefix, not for the next-hop itself. Option D is wrong because the IGP can be either IS-IS or OSPF, as both can carry MPLS label information via extensions like MPLS-TE or LDP; there is no requirement for IS-IS specifically.
A service provider wants to automate service provisioning using NSO. Which protocol is typically used by NSO to configure network devices?
Correct. NETCONF is used for configuration management with YANG models.
Why this answer
NSO uses NETCONF as the primary protocol for device configuration, leveraging YANG models for service modeling.
Which feature is used to validate that a BGP route origin is authorized by the prefix owner?
RPKI validates origin AS using ROAs.
Why this answer
RPKI BGP Origin Validation uses ROAs to validate the origin AS. Routes are marked as valid, invalid, or not-found based on ROA records.
Which TWO are benefits of using EVPN over traditional VPLS for L2VPN services? (Choose two.)
EVPN uses BGP to advertise MAC routes.
Why this answer
EVPN offers better control plane (BGP) and supports multi-homing with all-active load balancing.
In IS-IS, which type of router is responsible for exchanging routing information between different areas?
L2 routers exchange information between areas.
Why this answer
L2 routers handle inter-area routing in IS-IS, while L1 routers handle intra-area routing. L1/L2 routers act as both.
In SR-PCE architecture, which protocol is used for communication between the Path Computation Element (PCE) and the Path Computation Client (PCC) to request and report SR-TE paths?
PCEP is the standard protocol for PCE-PCC interactions.
Why this answer
B is correct because the Path Computation Element Protocol (PCEP), defined in RFC 5440 and extended for Segment Routing in RFC 8664, is the dedicated protocol used between a PCE and a PCC to request, report, and delegate SR-TE paths. PCEP carries explicit path computation requests (PCReq) and replies (PCRep), as well as state reporting (PCRpt) and delegation (PCUpd) messages, making it the standard control-plane protocol for SR-PCE architectures.
Exam trap
Cisco often tests the distinction between protocols that carry topology information (BGP-LS) versus protocols that carry path computation requests (PCEP), so candidates mistakenly choose BGP-LS because they associate it with Segment Routing, but it does not handle the PCE-PCC signaling.
How to eliminate wrong answers
Option A is wrong because RESTCONF is a RESTful protocol used for YANG-based data model access over HTTP, not for real-time path computation signaling between PCE and PCC. Option C is wrong because NETCONF is a network management protocol for configuration and state retrieval, not a path computation signaling protocol. Option D is wrong because BGP-LS is used to advertise link-state and topology information (e.g., IGP link-state data) to a controller or PCE, but it does not carry path computation requests or reports between PCE and PCC.
A service provider is deploying BGP PIC (Prefix Independent Convergence) for edge routers. What is the primary benefit of BGP PIC?
Correct; backup paths are precomputed and installed.
Why this answer
BGP PIC provides fast failover by precomputing backup paths in the forwarding table, enabling sub-second convergence upon failure, independent of the number of prefixes.
Which BGP attribute is used to influence inbound traffic to a multi-homed AS by indicating the preferred entry point?
MED influences inbound traffic.
Why this answer
MED (Multi-Exit Discriminator) is used to influence inbound traffic from neighboring ASes by suggesting the preferred path into the AS.
A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?
CoPP allows granular classification and rate-limiting of control plane traffic.
A service provider wants to protect its core routers from control plane attacks. Which two mechanisms are effective in mitigating such attacks on IOS XR? (Choose two.)
uRPF drops packets with spoofed source IPs, reducing attack traffic.
A customer reports intermittent packet loss on a MPLS L3VPN connection. The PE router shows 'show mpls forwarding' entries for the CE prefix, but ping from the PE to the CE fails intermittently. Which action should be taken to isolate the issue?
This verifies that the VRF has the correct routes and that BGP VPNv4 routes are properly imported.
Why this answer
The intermittent packet loss suggests a control-plane issue rather than a data-plane problem. By checking 'show ip route vrf CUSTOMER' and 'show bgp vpnv4 unicast vrf CUSTOMER', you can verify that the VRF route for the CE prefix is present in the routing table and that BGP is advertising the correct VPNv4 route with the proper next-hop and label. This isolates whether the failure is due to missing or incorrect route propagation, which is a common cause of intermittent reachability in MPLS L3VPN.
Exam trap
Cisco often tests the distinction between control-plane verification (routing table, BGP) and data-plane verification (MPLS forwarding, LSP) in MPLS L3VPN troubleshooting, leading candidates to mistakenly focus on label operations or LSPs when the root cause is a missing or unstable route.
How to eliminate wrong answers
Option B is wrong because 'show mpls lsp' verifies the label-switched path (LSP) between PEs, but the issue is between the PE and the CE, which is a Layer 3 adjacency (often a direct link or static route) and does not involve an LSP. Option C is wrong because 'show mpls forwarding vrf CUSTOMER' shows label operations for packets entering the VRF, but since the ping from PE to CE fails intermittently, the problem is likely in the VRF route presence or BGP advertisement, not in the MPLS forwarding table. Option D is wrong because 'show bgp vpnv4 unicast all' displays all VPNv4 routes from all VRFs, which is too broad and may obscure the specific VRF route; the VRF-specific command is more targeted and efficient for isolating the CE prefix issue.
In SRv6, what is the function of the 'End.DT4' behavior?
Correct: End.DT4 is for L3VPNv4.
Why this answer
End.DT4 is a SRv6 endpoint behavior that decapsulates an IPv6 packet with an SRH and performs a lookup in the IPv4 VRF table for L3VPN.
In an IS-IS network, a service provider wants to achieve fast convergence using Partial Route Computation (PRC). Which of the following events triggers a PRC instead of a full SPF?
Correct. A prefix change without topology change triggers PRC.
Why this answer
PRC is triggered when an IP prefix changes (addition, removal, or metric change) without a change in the IS-IS topology (i.e., no change in adjacency or reachable IS-IS neighbors). PRC only recalculates the affected prefixes, avoiding full SPF.
Which THREE are MEF-defined Ethernet service types? (Choose three.)
Multipoint-to-multipoint Ethernet service.
Why this answer
MEF defines E-Line, E-LAN, and E-Tree. E-Access is also defined but is not part of the three main types. E-WAN is not a standard MEF service.
Which RSVP message is used to tear down an MPLS-TE LSP by being sent from the ingress toward the egress?
Correct.
Why this answer
RSVP-TE uses PATH messages to establish state and RESV to reserve. To tear down, a PathTear message is sent from the ingress to the egress, or a ResvTear from egress to ingress.
A service provider wants to prevent IP spoofing attacks from customer edge devices connected to a PE router. The customer prefixes are known and asymmetric routing is not present. Which uRPF mode should be configured on the PE-CE interface?
Strict mode verifies the source IP is reachable via the incoming interface, ideal for PE-CE links with symmetric routing.
Why this answer
Strict mode uRPF checks that the source IP address is reachable via the same interface the packet arrived on, and that the route points back to that interface. This is suitable when symmetric routing is guaranteed, as on PE-CE links in L3VPN.
An engineer configures an SRv6 SID with the behavior End.DT6. What is the primary function of this SID?
Correct.
Why this answer
End.DT6 (Endpoint with Decapsulation and IPv6 table lookup) is used for L3VPN over SRv6. It decapsulates the outer IPv6 header and forwards based on the inner IPv6 destination using a specific VRF table.
A network engineer is troubleshooting OSPFv3 on a service provider's IPv6 network. The router shows that OSPFv3 adjacency never reaches FULL, says 'Init'. The neighbor is directly connected over a point-to-point link. What is the most likely cause?
OSPFv3 requires explicit interface configuration to activate adjacency.
Why this answer
The 'Init' state in OSPFv3 indicates that the router has received a Hello packet from the neighbor but the neighbor has not received a Hello packet back. On a point-to-point link, the most common cause is that the 'ipv6 ospf <process-id> area <area-id>' interface command is missing on one side, which prevents OSPFv3 from sending Hellos on that interface. Without this command, the interface is not enabled for OSPFv3, so the neighbor never sees a Hello and the adjacency cannot progress to FULL.
Exam trap
Cisco often tests the distinction between OSPFv2 and OSPFv3 interface activation methods, trapping candidates who assume that OSPFv3 uses a similar 'network' command or that a global OSPF process automatically enables all interfaces.
How to eliminate wrong answers
Option A is wrong because LSA throttling controls the rate of LSA generation and flooding, not the formation of adjacencies; it would not cause the adjacency to stall in Init. Option B is wrong because mismatched OSPF router-IDs do not prevent adjacency formation in OSPFv3; the router-ID is used for router identification but is not checked during the Hello exchange for adjacency compatibility. Option C is wrong because mismatched area IDs would cause the adjacency to stall in the ExStart or Exchange state, not in Init; the Init state indicates that the Hello packet was received but not reciprocated, which is unrelated to area ID mismatch.
A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?
SR-TE policies enable traffic engineering with Segment Routing.
Why this answer
C is correct because Segment Routing Traffic Engineering (SR-TE) allows the service provider to perform traffic engineering without RSVP-TE by using segment lists (label stacks) to steer traffic along explicit paths. SR-TE leverages the IGP (OSPF or IS-IS) to distribute segment IDs (SIDs) and uses a centralized controller or headend node to compute and enforce TE policies, eliminating the need for RSVP-TE's per-flow signaling and state maintenance.
Exam trap
Cisco often tests the misconception that BGP-LU can replace RSVP-TE for traffic engineering, but BGP-LU only provides label distribution for inter-domain reachability, not explicit path control within a single domain.
How to eliminate wrong answers
Option A is wrong because LDP is a label distribution protocol that only distributes labels for IGP shortest-path forwarding, not for traffic engineering; it lacks explicit path control and cannot replace RSVP-TE. Option B is wrong because MPLS-TE (RSVP-TE) is the technology being migrated away from, and the question explicitly asks for a solution that does not require RSVP-TE. Option D is wrong because BGP-LU (BGP Labeled Unicast) is used for inter-domain label distribution and MPLS VPN services, not for intra-domain traffic engineering with explicit path steering.
Which TWO commands are most effective to verify that an SR-TE policy is active and forwarding traffic? (Choose two.)
Shows the SR-TE policies, their state (active/inactive), and candidate paths.
Why this answer
The 'show segment-routing traffic-eng policy' command displays the operational state of SR-TE policies, including whether the policy is 'up' and actively forwarding traffic. It shows the candidate path, binding SID, and forwarding status, making it the primary verification command for SR-TE policy activity.
Exam trap
Cisco often tests the distinction between configuration verification (e.g., segment-lists) and operational/forwarding verification, leading candidates to choose 'show segment-routing traffic-eng segment-list' (which only shows configured lists) instead of the policy state or forwarding table commands.
Which MQC component is used to match traffic based on criteria such as DSCP or IP precedence?
Class-map uses match statements to identify traffic.
Why this answer
In the Modular QoS CLI (MQC), the class-map component is used to define traffic classes by matching packets based on criteria such as DSCP (Differentiated Services Code Point) or IP precedence values. The class-map uses match statements (e.g., match ip dscp, match ip precedence) to classify traffic, which is then applied within a policy-map for QoS actions. This makes class-map the correct MQC component for traffic matching.
Exam trap
Cisco often tests the distinction between class-map (classification) and policy-map (action), so candidates mistakenly select policy-map because they associate it with QoS policies, forgetting that classification is done separately in the class-map.
How to eliminate wrong answers
Option B is wrong because a service-policy is used to attach a policy-map to an interface (inbound or outbound), not to match traffic based on DSCP or IP precedence. Option C is wrong because a policy-map defines QoS actions (e.g., shaping, policing, queuing) and references class-maps, but does not itself perform traffic matching. Option D is wrong because an access-list (ACL) can match traffic based on IP addresses or ports, but it is not an MQC component; MQC uses class-maps with match statements for DSCP or IP precedence classification.
An SP network uses NTP for synchronization. To secure NTP, which authentication mode should be used?
NTPv4 autokey provides strong cryptographic authentication.
Why this answer
NTPv4 autokey (Option A) is the correct answer because it provides a secure, automated key distribution mechanism using public-key cryptography (RFC 5906). This eliminates the need for manual key exchange, making it the recommended authentication mode for securing NTP in service provider networks.
Exam trap
Cisco often tests the distinction between NTPv3 symmetric key (manual) and NTPv4 autokey (automated), leading candidates to incorrectly choose symmetric key because they overlook the 'secure' requirement in the question.
How to eliminate wrong answers
Option B is wrong because NTPv3 symmetric key uses pre-shared keys that must be manually distributed and updated, which is operationally burdensome and less secure in large SP environments. Option C is wrong because NTPv4 with SHA-1 is not a defined authentication mode; NTPv4 supports SHA-1 only as a hash algorithm within the autokey framework, not as a standalone mode. Option D is wrong because NTPv4 with MD5 is deprecated due to known vulnerabilities in the MD5 algorithm, and Cisco recommends against using MD5 for NTP authentication.
A service provider has implemented model-driven telemetry to monitor the health of its core network. The telemetry collector is a single server running a custom application that receives and processes gRPC streams from 200 routers. The collector is experiencing high CPU usage and is falling behind in processing data, causing some telemetry data to be dropped. The engineer decides to offload processing to multiple collectors. The routers support dial-out mode and can be configured with a list of collector IPs. The engineer wants to distribute the load evenly across collectors without manual configuration per router. Which should the engineer implement?
A load balancer provides dynamic distribution and requires no changes to router configuration beyond the VIP.
Why this answer
A load balancer distributes incoming gRPC streams from all 200 routers across multiple collectors based on a configured algorithm (e.g., round-robin or least connections), achieving even load distribution without per-router configuration. The routers simply send telemetry to a single virtual IP (VIP), and the load balancer forwards each stream to an available collector, preventing any single collector from being overwhelmed. This matches the requirement to offload processing and avoid manual configuration per router.
Exam trap
Cisco often tests the misconception that DNS round-robin or multicast can solve load distribution in telemetry, but the trap here is that dial-out gRPC requires TCP unicast connections and DNS round-robin lacks real-time load awareness, making a load balancer the only viable option for even distribution without manual configuration.
How to eliminate wrong answers
Option B is wrong because multicast addresses are not supported for dial-out gRPC telemetry; dial-out mode uses TCP-based unicast connections to specific collector IPs, and multicast would cause all collectors to receive duplicate data, increasing CPU load rather than reducing it. Option C is wrong because round-robin DNS does not provide real-time load balancing; DNS caching by routers and intermediate resolvers can cause uneven distribution, and DNS changes are not immediate, leading to potential overload of some collectors. Option D is wrong because it requires manual configuration per router to assign groups to specific collector IPs, which violates the requirement to distribute load evenly without manual configuration per router.
Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?
The route-map permits matching routes with additive community, denies others without affecting acceptance.
Why this answer
The configuration uses a route-map applied to the neighbor with a match clause referencing a prefix-list that permits 10.1.0.0/16 le 32. This matches the exact prefix and any more specific prefix (up to /32). The set community 65000:100 action adds the community without using the additive keyword, but because the route-map does not contain a deny clause for non-matching routes, all routes are still accepted; only matching routes have the community added.
Thus, only routes matching 10.1.0.0/16 or more specific will have community 65000:100 added, and other routes remain unchanged.
Exam trap
Cisco often tests the misconception that a route-map with a match clause and no explicit deny will reject non-matching routes, when in fact unmatched routes are still permitted and unchanged unless a deny sequence is present.
How to eliminate wrong answers
Option B is wrong because the prefix-list permits 10.1.0.0/16 le 32, which allows masks longer than /24 (e.g., /25, /28) — there is no reject condition for masks longer than /24. Option C is wrong because the set community command does not include the additive keyword, so it replaces any existing communities on matching routes, but it does not affect non-matching routes at all; the route-map only applies the set action to matched prefixes, not to all routes. Option D is wrong because the route-map has no explicit deny statement; routes that do not match the prefix-list simply fall through without a set action and are still accepted and installed normally.
Sets DSCP EF for voice packets on ingress.
Why this answer
The question specifies that the PE router must mark voice packets with the correct DSCP value before they enter the MPLS core. The 'set dscp ef' action in a policy-map applied to the ingress interface explicitly sets the DSCP field to EF (46) for voice traffic matched by a class-map, ensuring proper classification and treatment across the MPLS network. This is the standard method for marking IP packets at the edge before MPLS encapsulation.
Exam trap
Cisco often tests the distinction between IP-layer marking (DSCP) and MPLS-layer marking (EXP), so the trap here is that candidates may choose 'set mpls experimental 5' thinking it achieves the same result, but the question explicitly requires DSCP marking before MPLS encapsulation.
How to eliminate wrong answers
Option B is wrong because 'mls qos trust dscp' preserves the existing DSCP marking from the customer, but the question requires the service provider to actively mark voice packets, not just trust markings that may be absent or incorrect. Option C is wrong because 'set mpls experimental 5' sets the MPLS EXP bits on the MPLS label, not the DSCP value in the IP header; the question explicitly asks for DSCP marking before entering the MPLS core, which is an IP-layer action. Option D is wrong because a police action that drops excess traffic does not mark packets with a DSCP value; it only enforces bandwidth limits, failing to address the requirement to set the DSCP value for voice traffic.
In an MPLS VPN environment, which address family is used to exchange VPNv4 routes between PE routers?
VPNv4 carries both IPv4 prefixes and route distinguishers.
Why this answer
In an MPLS VPN environment, VPNv4 routes (which include both the IPv4 prefix and the Route Distinguisher) are exchanged between Provider Edge (PE) routers using the VPNv4 unicast address family under the BGP configuration. This address family allows PE routers to carry customer routes with unique RD values, enabling address overlap across different VPNs.
Exam trap
Cisco often tests the distinction between the address family used for route exchange (VPNv4 unicast) and the community attribute (Route Target) that controls route distribution, leading candidates to mistakenly select Route-target as the answer.
How to eliminate wrong answers
Option A is wrong because Route-target (RT) is a BGP extended community attribute used to control the import/export of VPN routes into VRFs, not an address family for exchanging routes. Option B is wrong because IPv4 unicast is the standard address family for exchanging global IPv4 routes, but it lacks the Route Distinguisher (RD) necessary to differentiate overlapping customer prefixes in an MPLS VPN. Option C is wrong because VPNv6 unicast is used for exchanging IPv6 VPN routes (VPNv6) between PE routers, not for VPNv4 routes.
A service provider is deploying MPLS in their core network and wants to ensure that all routers in the MPLS domain can dynamically exchange label bindings. Which protocol should be enabled on all routers to meet this requirement?
LDP dynamically distributes labels for all prefixes in the IGP.
Why this answer
LDP (Label Distribution Protocol) is the correct choice because it is the standard protocol used in MPLS networks to dynamically distribute label bindings for all routes in the routing table. It operates by establishing LDP sessions between directly connected LSRs and exchanging label mappings for each prefix, ensuring every router in the MPLS domain has the necessary labels to forward labeled packets.
Exam trap
Cisco often tests the distinction between protocols that distribute labels for all routes (LDP) versus protocols that only distribute labels for specific routes (e.g., iBGP for BGP routes) or are used for traffic engineering (RSVP-TE), leading candidates to mistakenly choose iBGP or RSVP-TE when the question asks for dynamic label exchange across the entire MPLS domain.
How to eliminate wrong answers
Option B (OSPF) is wrong because OSPF is an interior gateway protocol (IGP) used for IP routing, not for distributing MPLS label bindings; it does not carry label information. Option C (iBGP) is wrong because iBGP is used to exchange BGP routes and their associated labels (via the 'label' or 'vpnv4' address family) but only for BGP-learned prefixes, not for all routes in the MPLS domain, and it requires LDP or another label distribution protocol for IGP routes. Option D (RSVP-TE) is wrong because RSVP-TE is a signaling protocol for traffic engineering and MPLS-TE tunnels, not for general dynamic label exchange for all prefixes; it is used for explicit path setup and resource reservation, not for distributing label bindings for all IGP routes.
Which BGP attribute is used to indicate the preference of a route within an AS and is propagated to iBGP peers but not to eBGP peers by default?
Correct. LOCAL_PREF is used for route preference within an AS.
Why this answer
LOCAL_PREF is a well-known discretionary attribute that indicates the degree of preference for a route within an AS. It is sent to iBGP peers but not to eBGP peers by default.
Which three BGP attributes are considered during the route selection process before comparing AS_PATH length? (Choose three.)
LOCAL_PREF is compared second.
Why this answer
Weight, LOCAL_PREF, and locally originated routes are compared before AS_PATH length in the BGP best path selection algorithm.
Segment Routing with TI-LFA (Topology Independent Loop-Free Alternate) provides fast convergence. Which statement accurately describes TI-LFA?
TI-LFA uses post-convergence path and ensures loop avoidance.
Why this answer
TI-LFA (Topology Independent Loop-Free Alternate) computes a backup path that is guaranteed to be loop-free regardless of the network topology, using segment lists (label stacks) to steer traffic around a failure. It does not rely on the presence of a natural loop-free alternate in the IGP topology, making it topology independent. This ensures fast convergence (typically sub-50ms) without requiring signaling protocols like RSVP-TE.
Exam trap
Cisco often tests the distinction between TI-LFA and traditional LFA or RSVP-TE; the trap here is assuming TI-LFA requires a signaling protocol (like RSVP-TE) or that it only protects link failures, when in fact it is topology independent and protects both link and node failures using segment routing.
How to eliminate wrong answers
Option A is wrong because TI-LFA protects against both link and node failures, as it can compute a backup path that avoids a specific failed node by using adjacency segments or prefix segments. Option B is wrong because TI-LFA does not use RSVP-TE; it is a segment routing mechanism that uses pre-computed MPLS label stacks (segment lists) derived from the IGP (IS-IS or OSPF) without any signaling. Option D is wrong because TI-LFA does not require BFD for failure detection; it relies on IGP fast convergence mechanisms such as link-state advertisements (LSA) or hello timers, though BFD can be optionally used to accelerate detection.
An SP uses NSO to orchestrate MPLS L3VPN services. The service model is written in YANG, and the NED communicates with the PE routers. Which protocol does NSO use to push configuration to the network devices?
NSO uses NETCONF for device configuration and management.
Why this answer
NSO can use NETCONF or RESTCONF southbound to communicate with network devices. NETCONF is the standard for configuration management.
When implementing MPLS TE tunnels in a service provider core, what is the purpose of the 'affinity' attribute?
Affinity allows tunnels to restrict links based on administrative group membership.
Why this answer
The 'affinity' attribute in MPLS TE is used to define administrative groups (also known as link colors) that allow you to include or exclude specific links from a TE tunnel path based on user-defined properties. This enables traffic engineering policies such as forcing traffic to avoid certain links or preferring links with specific characteristics, without modifying the underlying IGP metric.
Exam trap
Cisco often tests the confusion between 'affinity' (administrative groups for link inclusion/exclusion) and 'color' (a separate attribute used in Segment Routing or for visual identification), leading candidates to mistakenly choose Option A.
How to eliminate wrong answers
Option A is wrong because 'affinity' does not set the color of the tunnel; it uses color-like bitmask values to represent administrative groups on links, not to assign a visual or logical color to the tunnel itself. Option B is wrong because adjusting the cost of TE tunnels is done via the 'metric' or 'cost' command under the tunnel interface, not through the affinity attribute. Option D is wrong because binding tunnels to specific interfaces is achieved using the 'mpls traffic-eng tunnels' command on the interface or explicit path definitions, not via affinity.
A network engineer notices that voice traffic is being dropped during congestion. The traffic is marked with DSCP EF. After reviewing the QoS policy, it is discovered that the voice traffic is not being placed into a priority queue. Which configuration change would ensure voice traffic receives priority treatment?
The 'priority' command places traffic into a low-latency queue, which is essential for real-time traffic like voice.
Why this answer
DSCP EF (Expedited Forwarding, per RFC 3246) requires strict priority queuing to guarantee low latency and jitter for voice traffic. The 'priority' command under the voice class in a policy map places the traffic into a strict priority queue (LLQ), ensuring it is serviced before any other queue during congestion. Without this command, the voice traffic is treated as a regular class, subject to bandwidth constraints and potential drops.
Exam trap
Cisco often tests the misconception that bandwidth guarantees or queue tuning alone can provide priority treatment, when in fact only the 'priority' command creates the strict priority queue required for real-time traffic like voice.
How to eliminate wrong answers
Option A is wrong because increasing the queue limit only allows more packets to be buffered, but does not provide priority treatment; during congestion, the queue can still experience tail drops and delay. Option B is wrong because increasing the bandwidth percentage for the voice class only guarantees a minimum bandwidth share, but does not create a priority queue; voice traffic can still be delayed by other queues. Option C is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that drops packets before the queue is full, which is inappropriate for real-time voice traffic that requires low jitter and minimal drops; WRED would introduce additional delay and potential packet loss.
What is the function of the admin plane in IOS XR architecture?
Correct. The admin plane manages SDR creation and system-level configuration.
Why this answer
The admin plane is a separate management context for administrative tasks such as configuring SDRs, managing hardware, and system-level settings. It provides isolation from the default SDR.
A service provider is implementing MAP-T (Mapping of Address and Port using Translation) to transition customers from IPv4 to IPv6. Which two characteristics of MAP-T are true? (Choose two.)
Correct. The BR performs IPv4-IPv6 translation.
Why this answer
MAP-T uses stateful or stateless translation between IPv4 and IPv6, and it uses a Border Router (BR) that performs translation. MAP-T does not use encapsulation; it uses translation (NAT). MAP-T also uses a Domain Name System (DNS) but that is not unique.
The key characteristics: it uses a BR for translation and can be stateless.
An engineer is configuring BGP route reflectors to scale iBGP. Which TWO attributes are used to prevent routing loops in a route reflector cluster? (Choose two.)
ORIGINATOR_ID prevents loops within a cluster.
Why this answer
CLUSTER_LIST and ORIGINATOR_ID are used to prevent loops. CLUSTER_LIST is a sequence of cluster IDs; ORIGINATOR_ID identifies the originator.
DSCP is the standard marking field in DiffServ.
Why this answer
The DiffServ model uses the 6-bit DSCP field in the IP header to classify packets.
An SP network uses OSPF with RSVP-TE for traffic engineering. Which OSPF extension is required to advertise TE link parameters such as maximum reservable bandwidth?
Correct. Type 10 Opaque LSAs carry TE information.
A network engineer is troubleshooting an LDP session failure between two directly connected routers. The routers are configured with the 'mpls ldp' command under the interface. The 'show mpls ldp neighbor' command shows no neighbors. Which two additional pieces of information should the engineer verify? (Choose two.)
LDP hello messages are sent to the all-routers multicast address; mismatched subnets prevent discovery.
Why this answer
LDP sessions are established only between directly connected LSRs when using the default 'mpls ldp' interface configuration. The LDP Hello messages are sent as UDP packets to the multicast address 224.0.0.2, and if the interface IP addresses are not in the same subnet, the Hello messages will not be received, preventing neighbor discovery.
An engineer is troubleshooting a BGP route reflector setup. Clients are not receiving all routes. The 'show bgp neighbors' output shows a state of 'Active'. What is the most likely cause?
Active state indicates TCP session failure, often due to misconfiguration.
Why this answer
The 'Active' state in BGP indicates that the router is trying to establish a TCP connection with the neighbor but has not yet succeeded. This is most commonly caused by a misconfiguration in the BGP neighbor statement, such as an incorrect IP address, wrong AS number, or a missing neighbor statement on one side. Since the route reflector is not forming a BGP session, clients cannot receive any routes, which explains the symptom.
How to eliminate wrong answers
Option A is wrong because a full mesh is not required with a route reflector; the route reflector design intentionally avoids a full mesh by having clients connect only to the reflector. Option B is wrong because an AS_PATH loop would cause routes to be withdrawn or not advertised, but the BGP session itself would still reach an 'Established' state, not 'Active'. Option C is wrong because next-hop reachability issues affect route installation in the RIB, not the BGP session state; the session would still be 'Established' even if next hops are unreachable.
A service provider is using Segment Routing with TI-LFA for fast convergence. During a link failure, the router performing the local repair must compute a backup path that avoids the failed link. Which type of Adjacency Segment Identifier (Adj-SID) is required for the backup path to be loop-free?
Protected Adj-SID enables fast reroute protection in SR networks.
Why this answer
In Segment Routing with TI-LFA, the router performing local repair must compute a backup path that is guaranteed loop-free. A Protected Adj-SID (Adj-SID with the B-flag set) is required because it indicates that the adjacency segment is protected by a fast-reroute mechanism, allowing the router to use a precomputed backup path that avoids the failed link while ensuring no forwarding loops occur.
Exam trap
Cisco often tests the misconception that any Adj-SID can be used for TI-LFA backup, but only the Protected Adj-SID (B-flag set) guarantees loop-free behavior, while Unprotected Adj-SID leads to potential loops or blackholing.
How to eliminate wrong answers
Option A is wrong because an Anycast Adj-SID identifies a set of routers sharing the same anycast prefix, not a specific adjacency, and it does not provide per-link protection or loop-free backup path computation. Option B is wrong because an Unprotected Adj-SID (B-flag not set) explicitly indicates no fast-reroute protection is available, so it cannot be used for a TI-LFA backup path. Option D is wrong because there is no standard 'Backup Adj-SID' in Segment Routing; the correct term is Protected Adj-SID, and the backup path is derived from the protected adjacency SID.
In the Modular QoS CLI (MQC), which component is used to define traffic classes based on match criteria?
Class-map defines traffic classes with match criteria.
Why this answer
In the Modular QoS CLI (MQC), the class-map is the component used to define traffic classes by specifying match criteria such as IP precedence, DSCP values, or access-group references. The class-map groups packets that match one or more conditions, allowing the policy-map to apply QoS actions (e.g., policing, shaping) to that specific class. Without a class-map, the policy-map cannot differentiate between traffic types.
Exam trap
Cisco often tests the distinction between the component that defines traffic (class-map) versus the component that applies actions (policy-map), leading candidates to mistakenly select policy-map when asked about defining traffic classes.
How to eliminate wrong answers
Option A is wrong because a policy-map is used to associate QoS actions (like bandwidth, police, shape) with a class-map, not to define the traffic classes themselves. Option B is wrong because an access-list is a packet filtering tool that can be referenced within a class-map as a match criterion, but it is not the component that defines the traffic class in MQC. Option D is wrong because a service-policy is the command that applies a policy-map to an interface or direction (input/output), not a component for defining traffic classes.
A service provider is troubleshooting BGP route selection between two eBGP peers. The router receives a prefix from Peer A with local preference 150 and AS path length 3. From Peer B, the same prefix has local preference 100 and AS path length 2. Which route will be preferred?
Local preference is the first tiebreaker after weight; higher value wins.
Why this answer
B is correct because BGP's route selection process evaluates local preference before AS path length. The route from Peer A has a local preference of 150, which is higher than Peer B's 100, so it is preferred regardless of the shorter AS path from Peer B. Local preference is the second BGP attribute in the decision process (after weight) and is used to influence outbound traffic from an AS.
Exam trap
Cisco often tests the order of BGP path selection attributes, and the trap here is that candidates mistakenly prioritize AS path length over local preference because they remember 'shortest AS path' but forget it comes after local preference in the decision process.
How to eliminate wrong answers
Option A is wrong because weight is a Cisco-proprietary attribute that is not mentioned in the question; local preference is the relevant attribute here, and weight would only be considered first if it were set. Option C is wrong because the routes have different local preference values (150 vs. 100), so they are not equally preferred; BGP does not load-balance between routes with different local preferences. Option D is wrong because although AS path length is considered in BGP path selection, it is evaluated after local preference; since local preference differs, the AS path length is not compared.
A service provider is designing a network to support mobile backhaul for eMBB, uRLLC, and mMTC services. Which technology allows the physical network to be divided into virtual networks with dedicated resources for each service type?
Network slicing is the correct technology.
Why this answer
Network slicing enables multiple virtual networks on a shared physical infrastructure, each with tailored performance characteristics.
A service provider uses OSPFv3 for IPv6 routing in the core. Which statement correctly describes OSPFv3 adjacency formation on a broadcast multiaccess network?
DR/BDR reduce O(n^2) to O(n).
Why this answer
OSPFv3 operates similarly to OSPFv2 on broadcast networks, electing a DR and BDR using Hello protocol, and forming adjacencies with the DR.
A service provider is implementing MPLS L3VPN and needs to ensure that BGP route advertisement uses a specific next-hop. Which technique ensures BGP advertises the PE-CE next-hop instead of the PE-PE loopback?
Sets the next-hop to the router's own address for iBGP advertisements.
Why this answer
In MPLS L3VPN, the PE-CE next-hop (the PE interface facing the CE) must be advertised to the remote PE so that the remote PE knows to forward traffic directly to the local PE's CE-facing interface. The `next-hop-self` command on the PE forces BGP to set the next-hop to the PE's own IP address (typically the loopback or the interface used for BGP peering), which overrides the default behavior of preserving the original next-hop. This ensures that the remote PE uses the correct next-hop for VPN traffic.
Exam trap
Cisco often tests the distinction between `next-hop-self` (used to force the PE's own address as the next-hop) and `next-hop-unchanged` (used to preserve the original next-hop in inter-AS scenarios), and candidates confuse these two commands.
How to eliminate wrong answers
Option A is wrong because a route-map with `set next-hop` can manually override the next-hop, but it is not the standard or most efficient technique for this specific requirement; it requires additional configuration and may not be as reliable as `next-hop-self` in all scenarios. Option B is wrong because `next-hop-unchanged` is used in MPLS VPN inter-AS scenarios (option B) to preserve the original next-hop across AS boundaries, which is the opposite of what is needed here. Option D is wrong because disabling next-hop-check (`no bgp next-hop-check`) is used in BGP confederation or route reflector scenarios to allow routes with unreachable next-hops to be accepted, not to change the next-hop value.
Refer to the exhibit. A telemetry subscription is configured on an IOS-XR router. The collector at 10.1.1.100 is not receiving data. Which configuration error is present?
The destination-group must include 'protocol grpc' or 'protocol tcp'; otherwise, no data is transmitted.
Why this answer
In IOS-XR telemetry, a destination-group must include the 'protocol' keyword (e.g., 'protocol grpc' or 'protocol tcp') to specify the transport protocol for the collector. Without this specification, the router does not know how to send the telemetry data, and the collector at 10.1.1.100 will not receive any data.
Exam trap
Cisco often tests the requirement for the 'protocol' keyword in the destination-group, as candidates may assume that specifying the IP and port alone is sufficient, overlooking this mandatory parameter.
How to eliminate wrong answers
Option A is wrong because the destination IP address 10.1.1.100 is explicitly shown in the exhibit, and there is no indication that it is incorrect; the issue is a missing protocol specification, not a wrong IP. Option C is wrong because the sample-interval being too short would cause high CPU or data loss, but it would not prevent the collector from receiving data entirely; the collector would still receive some data. Option D is wrong because the subscription is shown in the running configuration, implying it is committed; IOS-XR requires an explicit 'commit' for configuration to take effect, and if it were missing, the subscription would not appear in the running config.
Option E is wrong because the sensor-group path is present in the exhibit (e.g., 'Cisco-IOS-XR-infra-statsd-oper:statistics'), and there is no evidence it is invalid; an invalid path would cause a configuration rejection or no data, but the primary error here is the missing protocol.
Which THREE are benefits of using EVPN over traditional VPLS? (Choose three.)
EVPN advertises MACs via BGP, allowing mobility.
Why this answer
EVPN offers BGP-based control plane, multi-homing support, and MAC mobility. VPLS traditionally uses LDP and does not natively support multi-homing or MAC mobility as effectively.
A junior automation engineer is writing a Python script to configure OSPF on a Cisco IOS-XE router using RESTCONF. The script sends a PUT request to update the OSPF configuration but receives a 401 Unauthorized response. The engineer has configured a local user with privilege 15 on the router and enabled restconf. The engineer verified that the router's RESTCONF API is running on port 443. What is the most likely missing element in the script?
RESTCONF uses HTTP basic authentication by default; without it, the server returns 401.
Why this answer
A 401 Unauthorized response indicates the request lacks proper authentication. The engineer likely forgot to include HTTP basic authentication headers with the correct username and password. Other options relate to content types or TLS, which would cause different errors (e.g., 415 Unsupported Media Type).
An SP engineer implements LLQ for VoIP traffic on a DS3 link. The policy-map calls for a priority queue of 500 kbps. The actual VoIP traffic averages 400 kbps with bursts to 600 kbps. What is the expected behavior during bursts?
LLQ polices the priority queue to its configured rate; excess is dropped.
Why this answer
C is correct because the priority queue in a Low Latency Queueing (LLQ) policy is policed at the configured rate (500 kbps). When VoIP traffic bursts exceed this rate, the excess packets are dropped immediately by the policer, not queued or reclassified. This ensures that the priority queue does not starve other queues and maintains low latency for conforming traffic.
Exam trap
Cisco often tests the misconception that the priority queue can buffer excess traffic or reclassify it, when in fact LLQ uses a policer to drop traffic exceeding the configured bandwidth to protect other queues.
How to eliminate wrong answers
Option A is wrong because LLQ does not reclassify excess priority traffic to best-effort; instead, it drops the excess packets via policing. Option B is wrong because the priority queue does not use tail-drop; it uses a policer that drops packets exceeding the configured bandwidth, regardless of queue depth. Option D is wrong because the priority queue cannot queue excess traffic above the configured rate; LLQ strictly polices the priority queue to prevent it from monopolizing bandwidth.
An SP engineer is designing a QoS policy for a business customer with three traffic classes: Voice (critical latency), Transactional Data (low delay), and Bulk Data (no strict requirements). The link is 100 Mbps. Which TWO actions should be part of the policy? (Select two.)
LLQ ensures low latency; policing prevents voice from starving other classes.
Why this answer
LLQ provides strict priority for voice. CBWFQ with bandwidth guarantees for transactional data ensures it gets capacity. Bulk data can use remaining bandwidth.
In IS-IS, which metric type supports traffic engineering (TE) and is required for segment routing?
Wide metrics use 24-bit fields and support TE.
Why this answer
IS-IS wide metrics (TLV 135/236/22) support TE and segment routing; narrow metrics (TLV 128/130) are limited to 6-bit metrics.
A service provider wants to use BGP Prefix Independent Convergence (PIC) for faster failover. Which BGP feature must be enabled to support PIC?
Additional paths allow backup path installation.
Why this answer
BGP PIC requires BGP additional paths (add-path) or BGP PIC edge, which installs backup paths in the FIB independent of the prefix count.
A service provider is building a new network slicing architecture to offer differentiated services to enterprise customers. The architecture uses SRv6 with network slices identified by slice IDs embedded in the SRv6 SID. The underlay is an IP network with ISIS. Each slice will have dedicated resources in the core, including guaranteed bandwidth and low latency. The plan is to use the SRv6 network programming concept to steer traffic into different slices. The provider wants to ensure that slice isolation is maintained end-to-end, including at the egress PE where traffic is handed off to the customer. However, during testing, they observe that traffic from one slice is incorrectly entering another slice's queue on an intermediate node, causing performance interference. The intermediate node is a transit router that does not terminate SRv6 but performs 'SID-based forwarding'. Which mechanism is most likely missing to ensure slice isolation on transit nodes?
Correct. Transit nodes need to recognize the slice ID and apply appropriate queuing; otherwise, slices compete for resources.
Why this answer
Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.
In RSVP-TE, which message is sent by the headend router along the explicit route to reserve resources and establish an LSP?
Correct. PATH carries the ERO and requests resources.
Why this answer
In RSVP-TE, the headend router sends a PATH message along the explicit route to signal the desired LSP. This message carries the label request, traffic parameters, and the explicit route object (ERO) to each downstream router, which then forwards it hop-by-hop toward the destination. Only after the PATH message reaches the tailend does the tailend respond with a RESV message to actually reserve resources and establish the LSP.
Exam trap
Cisco often tests the distinction between the direction of PATH (headend to tailend) and RESV (tailend to headend), trapping candidates who confuse which message initiates the reservation versus which message actually reserves resources.
How to eliminate wrong answers
Option A is wrong because the RESV message is sent by the tailend router back toward the headend to reserve resources and confirm the LSP, not by the headend. Option C is wrong because the RSVP Hello message is used for neighbor liveness detection and graceful restart, not for LSP establishment. Option D is wrong because the RSVP Tear message is used to tear down an existing LSP, not to establish one.
A network engineer is configuring QoS on a Cisco ASR 9000 router to support multiple traffic classes. The policy must ensure that real-time traffic (EF) is not starved by high-volume bulk data (AF11). Which queuing strategy should be applied to the EF class to provide low latency and strict priority?
LLQ provides a strict priority queue for EF traffic.
Why this answer
Low Latency Queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that EF (real-time) traffic is always served before other queues. This prevents starvation of delay-sensitive traffic by bulk data (AF11) while still allowing fair treatment of other classes. LLQ is the standard Cisco mechanism for supporting real-time traffic like VoIP with guaranteed low latency.
Exam trap
Cisco often tests the misconception that CBWFQ alone can provide low latency for real-time traffic, but the trap is that CBWFQ lacks a strict priority queue, so candidates must recognize that LLQ is required for EF traffic to avoid delay and jitter.
How to eliminate wrong answers
Option A is wrong because Weighted Round Robin (WRR) does not provide strict priority; it services queues in a round-robin fashion based on weights, which can cause delay for real-time traffic if the bulk data queue is heavy. Option B is wrong because Class-Based Weighted Fair Queuing (CBWFQ) assigns bandwidth guarantees but lacks a strict priority mechanism, so EF traffic could still be delayed by AF11 traffic during congestion. Option D is wrong because First-In-First-Out (FIFO) treats all traffic equally with no differentiation, making it impossible to protect real-time traffic from being starved by bulk data.
An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)
Drop is a standard action to discard traffic.
A network engineer is configuring MPLS LDP on a new router. After enabling LDP globally and on the interface, the LDP session does not establish. The IGP (OSPF) is fully operational. What should the engineer verify first?
This is the most basic verification; if MPLS is not enabled on the interface, LDP will not form.
Why this answer
The most common reason LDP fails to establish after global and interface configuration is that the interface is not enabled for MPLS forwarding. The command 'mpls ip' on the interface is required to activate LDP hello messages and label binding on that link. Without it, LDP remains disabled on the interface even if LDP is enabled globally and OSPF is working.
Exam trap
Cisco often tests the distinction between enabling LDP globally versus enabling it on the interface, trapping candidates who assume global configuration alone is sufficient for LDP to operate on all interfaces.
How to eliminate wrong answers
Option A is wrong because LDP password authentication is optional and not required for session establishment; it is only used if configured on both peers. Option B is wrong because while a loopback router-id is recommended for stability, LDP can use any IP address as its router-id, including a physical interface IP, and the session can still establish. Option C is wrong because the IGP metric does not affect LDP session establishment; LDP relies on IGP for reachability but not on the metric value itself.
A service provider has deployed segment routing with OSPF as the IGP in its core network. The network consists of 100 routers in a single area. The operations team reports that after a link failure between Router X and Router Y, traffic from Router A to Router B is taking a suboptimal path even though IGP convergence is complete and all routers have updated their LSDB. Router A and Router B are both segment routing capable. The team verifies that no SR-TE policies are configured and that all routers are using the default SPF algorithm. The expected shortest path from A to B should go through the newly restored link, but instead it still traverses an alternate path. Which action should resolve the issue?
Correct. 'clear ip ospf process' forces a fresh LSA flood and SPF computation, updating the routing table to use the restored link.
Why this answer
The suboptimal path persists despite LSDB convergence due to OSPF not performing a full SPF recalculation after the link restoration. 'clear ip ospf process' forces a complete SPF computation and reflooding of LSAs, which corrects the routing table. Option A is incorrect because adjacency SIDs are dynamically allocated and removing/re-adding them does not address the root cause. Option C is incorrect because SR-TE policies are not required for shortest-path forwarding and may unnecessarily override the IGP.
Option D is incorrect because clearing MPLS forwarding labels does not affect the IGP routing decision; the issue is at Layer 3, not label allocation.
Match each QoS mechanism to its primary function.
Drag a concept onto its matching description — or click a concept then click the description.
Identifying packets based on specified criteria
Setting QoS bits (e.g., DSCP, CoS) in packet headers
Enforcing traffic rate limits by dropping or remarking excess packets
Buffering excess traffic to smooth output rate
Congestion avoidance by selectively dropping packets based on queue depth
Why these pairings
In QoS, Classification identifies traffic, Marking sets priority, Policing drops/excess, Shaping buffers, and WRED drops probabilistically. Queuing handles packet scheduling, not rate enforcement.
A network engineer needs to design a multicast solution for IPTV distribution across a service provider network. Which protocol is best suited for building a shared distribution tree where the RP is dynamically elected?
BSR provides dynamic RP election in a standards-based way.
Why this answer
PIM-SM with BSR (Bootstrap Router) is the correct choice because it provides a dynamic, automated mechanism for electing an RP (Rendezvous Point) within a PIM-SM domain. BSR uses a distributed election process where candidate BSRs exchange bootstrap messages to elect a single BSR, which then collects candidate-RP advertisements and distributes the RP-set to all routers, enabling shared distribution trees without manual RP configuration.
Exam trap
Cisco often tests the distinction between Auto-RP and BSR, where candidates mistakenly think Auto-RP dynamically elects the RP, but Auto-RP only advertises RP information from a statically configured RP or mapping agent, whereas BSR provides true dynamic RP election through a distributed bootstrap process.
How to eliminate wrong answers
Option A is wrong because PIM-DM (Dense Mode) uses a flood-and-prune approach to build source-based trees, not shared trees, and does not involve an RP or dynamic RP election. Option B is wrong because PIM-SM with Auto-RP uses a separate, statically configured RP (or a mapping agent) to advertise RP information, but it does not dynamically elect the RP itself; Auto-RP relies on a designated RP or a mapping agent, which is not a fully dynamic election mechanism like BSR. Option C is wrong because MSDP (Multicast Source Discovery Protocol) is used to interconnect multiple PIM-SM domains by sharing active source information between RPs, not for building a shared distribution tree or dynamically electing an RP within a single domain.
In EVPN multihoming with all-active mode, what is the purpose of the aliasing capability?
Correct. Aliasing allows a PE to advertise MACs for other PEs in the same ES, making all active paths known.
Why this answer
In EVPN all-active multihoming, the aliasing capability allows a PE that has learned a MAC address via local attachment to the Ethernet Segment (ES) to advertise that MAC address on behalf of other PEs in the same ES. This enables remote PEs to load-balance traffic destined to that MAC across all multihomed PEs, even if only one PE actually learned the MAC locally. Without aliasing, traffic would be forced to the specific PE that learned the MAC, defeating the purpose of all-active redundancy.
Exam trap
Cisco often tests the distinction between aliasing (advertising MACs for other PEs) and load balancing (the forwarding behavior that aliasing enables), causing candidates to mistakenly select 'load balancing' as the purpose of aliasing itself.
How to eliminate wrong answers
Option A is wrong because the aliasing capability does not involve a single ESI label; each PE in the ES advertises its own MPLS label (e.g., the ESI label or MAC/IP advertisement label), and the aliasing function is about MAC address advertisement, not label consolidation. Option B is wrong because aliasing does not reduce BGP updates or aggregate MAC routes; in fact, it may increase the number of MAC/IP advertisement routes as each PE advertises the same MAC addresses, and aggregation is not a feature of EVPN aliasing. Option C is wrong because aliasing itself does not perform load balancing; it enables load balancing by allowing remote PEs to see multiple next hops for the same MAC, but the actual load balancing is a forwarding decision made by the remote PE based on the received aliased routes.
An engineer is using RESTCONF to configure an interface on a Cisco IOS-XE device. The request returns a 400 Bad Request error. What is the most likely cause?
400 Bad Request indicates a client-side error; invalid payload is a common cause.
Why this answer
A 400 Bad Request in RESTCONF indicates a client-side error, typically malformed syntax. The most common cause is an invalid JSON payload, such as incorrect data types (e.g., string instead of integer) or missing mandatory leafs defined in the YANG module. RESTCONF validates the payload against the YANG schema before applying the configuration, and any schema violation triggers a 400 error.
Exam trap
Cisco often tests the distinction between HTTP status codes in RESTCONF, where candidates confuse a 400 (client payload error) with a 404 (resource not found) or 401/403 (authentication/authorization), especially when the URI seems correct but the payload is invalid.
How to eliminate wrong answers
Option A is wrong because if the device did not support RESTCONF, the response would be a 404 Not Found or a 501 Not Implemented, not a 400 Bad Request. Option B is wrong because insufficient privileges would result in a 401 Unauthorized or 403 Forbidden error, not a 400. Option C is wrong because an incorrect URI would typically return a 404 Not Found (if the resource doesn't exist) or a 405 Method Not Allowed (if the path is valid but the method is wrong), not a 400.
Option D is wrong because a missing YANG module would cause a 500 Internal Server Error or a 404 if the module's namespace is not recognized, not a 400.
Which two of the following are characteristics of MPLS Traffic Engineering that differentiate it from pure MPLS forwarding?
Correct. MPLS TE can reserve bandwidth along a path to guarantee QoS.
Why this answer
MPLS Traffic Engineering (MPLS-TE) explicitly supports bandwidth reservation, which allows an operator to guarantee a certain amount of bandwidth for a traffic-engineered LSP. This is a key differentiator from pure MPLS forwarding, where LSPs are created without any bandwidth awareness and simply forward packets based on the label-swapping mechanism.
Exam trap
Cisco often tests the misconception that MPLS-TE requires LDP for LSP creation, but in reality, MPLS-TE uses RSVP-TE for signaling and does not depend on LDP for the TE LSPs themselves.
A service provider is migrating from LDP to Segment Routing in an IS-IS network. After enabling IS-IS with segment-routing on all routers, they observe that some prefixes still receive labels from LDP instead of from SR. Which configuration is most likely missing on these routers?
This command enables SR label allocation in IS-IS.
Why this answer
When migrating from LDP to Segment Routing in an IS-IS network, the 'segment-routing mpls' command must be explicitly enabled under the IS-IS routing process. Without this command, IS-IS will not allocate MPLS labels for prefixes using the Segment Routing (SR) extension, causing the router to fall back to LDP for label distribution. This is the most common missing configuration when SR labels are not being assigned.
Exam trap
Cisco often tests the distinction between enabling segment-routing globally versus enabling it under the IGP process; the trap here is that candidates assume 'segment-routing mpls' is automatically applied when SR is enabled globally, but it must be explicitly configured under IS-IS or OSPF.
How to eliminate wrong answers
Option B is wrong because OSPF segment-routing configuration is irrelevant in an IS-IS network; the question explicitly states IS-IS is used, so OSPF settings have no effect on IS-IS SR behavior. Option C is wrong because TI-LFA (Topology Independent Loop-Free Alternate) is a fast-reroute mechanism that relies on SR, but its absence does not prevent SR from assigning labels; it only affects protection. Option D is wrong because an SRGB range conflict with the MPLS label range would cause label allocation failures or errors, not a fallback to LDP; LDP would still be used only if SR is not properly enabled.
A service provider is deploying MPLS L3VPN over an OSPF backbone. The PE routers are configured with OSPF as the IGP. The CE router of customer A is connected to two PEs for redundancy. Which configuration is required on the PE routers to ensure that the CE router can load-balance traffic across both PEs without loops?
The down-bit prevents the CE from re-advertising routes learned from one PE to the other PE, avoiding loops.
Why this answer
Configuring OSPF with the capability vrf-lite and enabling the down-bit on the PE-CE link prevents routing loops in a multi-homed CE scenario. The down-bit is set by the PE when redistributing routes into OSPF, ensuring that the CE does not re-advertise those routes back to another PE, which would cause a loop. The vrf-lite capability allows the CE to understand the down-bit without requiring full MPLS/VPN functionality, enabling load-balancing across both PEs safely.
Exam trap
Cisco often tests the distinction between the down-bit (DN-bit) used in OSPF PE-CE scenarios and the sham-link concept used for OSPF area 0 extension, leading candidates to mistakenly choose sham-links for loop prevention in multi-homed CE designs.
How to eliminate wrong answers
Option A is wrong because OSPF sham-links are used to connect two PE routers in different OSPF areas within an MPLS L3VPN to maintain OSPF adjacency across the backbone, not to prevent loops or enable load-balancing for a multi-homed CE. Option B is wrong because the BGP cost community influences path selection on the PE side for inter-AS or multi-homing scenarios, but it does not affect the CE's OSPF routing decisions or prevent loops in the PE-CE OSPF domain. Option D is wrong because disabling the DN-bit (down-bit) on the PE-CE OSPF interface would allow the CE to re-advertise routes learned from one PE back to the other PE, creating a routing loop; the DN-bit must be enabled to prevent this.
Which TWO of the following are characteristics of MPLS LDP?
By default, LDP distributes labels for all IGP routes.
Why this answer
B is correct because MPLS LDP distributes labels for routes found in the IP routing table, not for BGP routes. LDP peers exchange label bindings for each prefix in the IGP routing table, enabling label-switched paths (LSPs) for those destinations. This is fundamental to LDP's operation as defined in RFC 5036.
Exam trap
Cisco often tests the misconception that LDP requires an IGP for session reachability, but the trap is that LDP uses its own UDP discovery mechanism and can form sessions over any IP reachable path, though an IGP is commonly used for loopback reachability in practice.
In IS-IS, what is the purpose of the Partial Route Computation (PRC)?
PRC is triggered by IP prefix changes.
Why this answer
PRC recomputes only affected routes when a leaf changes, without full SPF, enabling faster convergence.
In an EVPN-VPWS (Virtual Private Wire Service) deployment, which identifier is used to uniquely identify an Ethernet Segment for multi-homing?
Correct identifier.
Why this answer
In EVPN-VPWS, the Ethernet Segment Identifier (ESI) uniquely identifies an Ethernet Segment across all multi-homed Provider Edge (PE) nodes. This 10-byte value is used in Designated Forwarder (DF) election and split-horizon filtering to prevent loops when a Customer Edge (CE) is multi-homed to multiple PEs. The ESI is carried in EVPN routes (Type 1 and Type 4) to signal multi-homing membership.
Exam trap
Cisco often tests the distinction between the Ethernet Tag ID (used for service identification) and the ESI (used for multi-homing segment identification), causing candidates to confuse the two identifiers in EVPN-VPWS contexts.
How to eliminate wrong answers
Option A is wrong because the Ethernet Tag ID identifies a specific service instance (e.g., VLAN or VPWS service) within an EVPN instance, not the multi-homed segment. Option B is wrong because the MAC address of the CE is not used for segment identification; EVPN-VPWS relies on the ESI for multi-homing, and MAC addresses are irrelevant in point-to-point VPWS. Option D is wrong because the Route Distinguisher (RD) is used to make EVPN routes unique across different VRFs or EVPN instances, not to identify an Ethernet Segment for multi-homing.
Practice 350-501 by domain
Target a specific domain to shore up weak areas.