Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 826–900

The most common reason LDP fails to establish after global and interface configuration is that the interface is not enabled for MPLS forwarding. The command 'mpls ip' on the interface is required to activate LDP hello messages and label binding on that link. Without it, LDP remains disabled on the interface even if LDP is enabled globally and OSPF is working.

These are fundamental QoS tools used in service provider networks.

PIM-SM with BSR (Bootstrap Router) is the correct choice because it provides a dynamic, automated mechanism for electing an RP (Rendezvous Point) within a PIM-SM domain. BSR uses a distributed election process where candidate BSRs exchange bootstrap messages to elect a single BSR, which then collects candidate-RP advertisements and distributes the RP-set to all routers, enabling shared distribution trees without manual RP configuration.

In EVPN all-active multihoming, the aliasing capability allows a PE that has learned a MAC address via local attachment to the Ethernet Segment (ES) to advertise that MAC address on behalf of other PEs in the same ES. This enables remote PEs to load-balance traffic destined to that MAC across all multihomed PEs, even if only one PE actually learned the MAC locally. Without aliasing, traffic would be forced to the specific PE that learned the MAC, defeating the purpose of all-active redundancy.

A 400 Bad Request in RESTCONF indicates a client-side error, typically malformed syntax. The most common cause is an invalid JSON payload, such as incorrect data types (e.g., string instead of integer) or missing mandatory leafs defined in the YANG module. RESTCONF validates the payload against the YANG schema before applying the configuration, and any schema violation triggers a 400 error.

MPLS Traffic Engineering (MPLS-TE) explicitly supports bandwidth reservation, which allows an operator to guarantee a certain amount of bandwidth for a traffic-engineered LSP. This is a key differentiator from pure MPLS forwarding, where LSPs are created without any bandwidth awareness and simply forward packets based on the label-swapping mechanism.

When migrating from LDP to Segment Routing in an IS-IS network, the 'segment-routing mpls' command must be explicitly enabled under the IS-IS routing process. Without this command, IS-IS will not allocate MPLS labels for prefixes using the Segment Routing (SR) extension, causing the router to fall back to LDP for label distribution. This is the most common missing configuration when SR labels are not being assigned.

Option C is correct because configuring OSPF with the capability vrf-lite and enabling the down-bit on the PE-CE link prevents routing loops in a multi-homed CE scenario. The down-bit is set by the PE when redistributing routes into OSPF, ensuring that the CE does not re-advertise those routes back to another PE, which would cause a loop. The vrf-lite capability allows the CE to understand the down-bit without requiring full MPLS/VPN functionality, enabling load-balancing across both PEs safely.

B is correct because MPLS LDP distributes labels for routes found in the IP routing table, not for BGP routes. LDP peers exchange label bindings for each prefix in the IGP routing table, enabling label-switched paths (LSPs) for those destinations. This is fundamental to LDP's operation as defined in RFC 5036.

PRC recomputes only affected routes when a leaf changes, without full SPF, enabling faster convergence.

In EVPN-VPWS, the Ethernet Segment Identifier (ESI) uniquely identifies an Ethernet Segment across all multi-homed Provider Edge (PE) nodes. This 10-byte value is used in Designated Forwarder (DF) election and split-horizon filtering to prevent loops when a Customer Edge (CE) is multi-homed to multiple PEs. The ESI is carried in EVPN routes (Type 1 and Type 4) to signal multi-homing membership.

Option C is correct because hierarchical QoS (HQoS) allows the service provider to enforce a total bandwidth shape at the parent level while using a child policy to apply LLQ for voice (ensuring strict priority) and CBWFQ for video and data (ensuring video gets better treatment than data without starving voice). This meets the requirement that video should not degrade voice, as the parent shape prevents any single class from monopolizing the link, and the child policy’s LLQ guarantees voice priority over all other traffic.

Option C is correct because Flex-Algo allows the definition of a custom metric type, such as 'min-unidirectional-link-bandwidth', which enables Segment Routing TE to compute paths that avoid low-bandwidth links. This approach directly addresses the requirement to engineer traffic around links with low bandwidth by using bandwidth as the path selection metric.

In IS-IS, Level 2 routers route between areas and maintain a complete L2 database. Level 1 routers route within an area, and Level 1/2 routers act as both, but the question asks for the type that maintains a full L2 routing table of all areas. Level 2 routers specifically perform inter-area routing.

The SRGB defines a range of labels reserved for global segment routing SIDs (e.g., Node SIDs). It ensures that the same label value represents the same prefix across the domain, avoiding label conflicts.

leafref automatically validates that the leaf value matches a leaf in the referenced path.

A BGP-free core with LDP or Segment Routing allows the service provider to forward labeled packets for BGP prefixes without requiring an IGP label for every BGP prefix. In this design, edge routers (PEs) impose a label stack where the outer label (IGP label) is distributed by LDP or Segment Routing for the BGP next-hop, and the inner label is the BGP label. Core routers (P routers) only need to swap the outer label based on the IGP label, not the BGP prefix, thus eliminating the need for IGP labels per BGP prefix.

The 'preferred' algorithm is the correct choice because it instructs the router to automatically select the best algorithm for path computation based on IGP metrics. In Segment Routing, the 'preferred' algorithm uses the default SPF (Shortest Path First) algorithm, which computes paths based solely on IGP link metrics, ensuring optimal routing without additional constraints.

Segment Routing with MPLS data plane (SR-MPLS) uses IGP to distribute labels, eliminating the need for LDP. SR-MPLS is the direct replacement for LDP in MPLS networks.

The commit/rollback model applies changes atomically and allows reverting to previous configurations if needed.

The first step in troubleshooting an MPLS LSP that is not establishing is to verify LDP neighbor adjacency because LDP is the protocol responsible for distributing labels across the MPLS domain. Without a working LDP session between adjacent LSRs, label bindings cannot be exchanged, and the LSP cannot be built. This is the foundational layer for MPLS forwarding, so it must be checked before higher-layer issues like routing or reachability.

Peakflow uses NetFlow (or IPFIX) data exported from routers to analyze traffic patterns and detect anomalies.

Using a staging environment with identical configuration to test before production is the best practice because it allows validation of automation scripts and configuration changes in a controlled setting that mirrors the production network. This approach identifies potential errors, compatibility issues, or unintended side effects without risking service disruption, aligning with Cisco NSO's recommended deployment workflow that emphasizes pre-production testing to ensure change reliability.

The SEL byte is always 0x00 for routers, indicating that the address refers to the router itself rather than a specific service.

EVPN uses BGP control plane, supports multi-homing with ESI, and can provide both L2 and L3 services. It does not use LDP for signaling; it uses BGP. VPLS is older.

Q-in-Q (802.1ad) adds an outer VLAN tag to extend VLAN space. 802.1ah is for MAC-in-MAC, 802.1Q is the basic standard, and 802.1ak is not related.

In SR-MPLS, Prefix-SIDs are advertised in IS-IS using TLV 135 (Extended IP Reachability) to carry the prefix and its metric, and TLV 149 (IS-IS Router Capability) to carry the SID/Label Binding sub-TLV, which maps the prefix to a specific label (Prefix-SID). This allows IS-IS to distribute both the prefix reachability and its associated segment identifier in a single protocol update, enabling source routing without LDP or RSVP-TE.

IS-IS supports both narrow (6-bit) and wide (24-bit) style metrics. TE metrics are separate TLVs that carry additional information for MPLS-TE and do not replace the standard metric used for SPF computation.

EF is defined by DSCP 46 (binary 101110) to provide low-loss, low-latency service for voice.

For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

MPLS LSP ping (option C) is an OAM tool specifically designed to verify the data plane of an MPLS label switched path (LSP) by sending an MPLS echo request packet with a target FEC stack, which is forwarded along the LSP and validated by the egress LSR. This tests the actual label forwarding path, not just the control plane, making it a correct choice for troubleshooting LSPs.

Option D is correct because Segment Routing (SR) with IS-IS only assigns prefix-SIDs to prefixes that are part of the IS-IS domain and explicitly configured with a SID. External routes, such as those redistributed from another protocol (e.g., BGP or OSPF), are not covered by prefix-SIDs and require a separate label distribution mechanism like LDP or a manually configured explicit-null label to be forwarded with MPLS encapsulation. The engineer's observation that some labels are missing for external routes directly points to this limitation.

These are essential multicast protocols for service provider IPTV and content delivery.

BGP selection order: highest weight first. Route 1 has weight 100, Route 2 has weight 50, so Route 1 is preferred regardless of other attributes.

In Segment Routing Traffic Engineering (SR-TE), the 'color' attribute is a 32-bit numerical value that, combined with the destination prefix, uniquely identifies an SR-TE policy. This allows traffic to be steered into a specific policy based on color, enabling advanced traffic engineering use cases such as multi-topology routing or service-level agreement (SLA) differentiation.

Option A is correct because Cisco NSO provides a built-in transaction management system that automatically rolls back a service deployment to its previous state if any part of the deployment fails. This ensures service lifecycle integrity by preventing partial or inconsistent configurations across devices.

Weight, LOCAL_PREF, and AS_PATH length are considered before IGP metric. MED comes after AS_PATH.

BNG supports PPPoE and IPoE (DHCP) for subscriber access. PPPoA is asynchronous transfer mode, not typically used in modern BNG.

NETCONF hello message exchange includes the list of supported YANG modules in the capabilities. This is the standard way to discover device capabilities. Other options are either not standard or would not provide the required information.

The well-known community NO_EXPORT (0xFFFFFF01) prevents a route from being advertised to any eBGP peers. The route can still be advertised within the AS.

S/RTBH works by advertising a /32 prefix (the victim's IP) with a special BGP community (e.g., NO_EXPORT) and a next-hop of the discard interface (e.g., Null0). Edge routers install the route pointing to Null0, dropping traffic to that IP.

Segment Routing (SR) defines two primary types of Segment Identifiers (SIDs): the Prefix-SID and the Adjacency-SID. A Prefix-SID is a global or local label associated with an IGP prefix (e.g., a loopback), enabling shortest-path forwarding toward that prefix. An Adjacency-SID is a local label associated with a specific adjacency (link) between two routers, forcing traffic out that exact interface regardless of the IGP shortest path.

B is correct because the VRF CUSTOMER is configured with route-target import 100:1, but the route in question carries a different route-target value (e.g., 100:2). For a route to be installed into a VRF table, the route-target extended community attached to the route must match at least one of the import route-targets configured on the VRF. A mismatch prevents the route from being imported, even if other conditions are satisfied.

In Segment Routing Traffic Engineering (SR-TE), traffic is steered into an SR-TE policy using a color extended community attached to BGP routes. The color community acts as a service-level identifier that maps BGP-learned prefixes to a specific SR-TE policy on the headend router, enabling automated traffic engineering without per-flow state or tunnel interfaces.

In OSPF, the Extended Prefix TLV (type 1) carries the Prefix SID sub-TLV for segment routing. The Adjacency SID is carried in the Extended Link TLV.

NTP authentication ensures that time synchronization messages are from a trusted source, preventing spoofed NTP packets that could cause time changes affecting logs, protocols, and security.

CBWFQ with WRED is the best choice because CBWFQ provides per-class queuing with guaranteed bandwidth, while WRED proactively drops less important traffic (based on IP precedence or DSCP) before the queue becomes full, preventing tail drop and ensuring that higher-priority traffic is preserved during congestion. This combination allows the service provider to selectively discard lower-priority packets under congestion, meeting the requirement to drop less important traffic before more important traffic.

In hierarchical QoS (HQoS) on a Cisco ASR 9000, the parent policy shapes traffic to a specified rate, but if the child policy includes a police command, that policer can independently drop or mark down traffic before it reaches the parent shaper. This causes the observed traffic rate to be lower than the parent shape rate, as the child policer is the actual bottleneck. The correct answer is A because the police command in the child policy is limiting traffic below the 10 Mbps parent shaper, resulting in only 8 Mbps observed.

Network slices require resource isolation (A), dedicated control plane functions (B), and end-to-end orchestration (E). Slices share physical resources (C is false) and do not necessarily require separate BGP AS (D).

Designated Forwarder (DF) election ensures only one PE forwards traffic to the CE for broadcast/multicast/unknown unicast, and split-horizon prevents a PE from forwarding packets back to the ES from which they were received.

OSPF TE extensions use Opaque LSAs. Specifically, Type 10 Opaque LSAs (area-scoped) carry TE information as defined in RFC 3630.

VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.

The 'show ip mroute' command displays the multicast routing table, including the outgoing interface list (OIL) for each multicast group. Since the PIM neighbor table confirms the upstream interface is correct, the issue likely lies in the OIL, which 'show ip mroute' directly verifies. This command shows which interfaces are forwarding multicast traffic and whether they are pruned or in a forwarding state.

Stub and NSSA allow Type 3 LSAs but block Type 5 LSAs. Totally stubby blocks both Type 3 and Type 5.

With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Loose uRPF only checks that a route to the source exists, suitable for asymmetric routing. Strict uRPF requires the incoming interface to match the best return route, which can drop legitimate traffic with asymmetric routing. Default routes do not affect loose mode.

The NETCONF response shows a 'police' configuration under the QoS policy 'POLICE-CUSTOMER' with a committed information rate (CIR) of 256000 bps (256 kbps) and a conform-action of 'transmit' with an exceed-action of 'drop'. This is a standard policing action that meters traffic to the specified rate and drops any packets that exceed it, as defined in RFC 2697 (Single Rate Three Color Marker). Option A correctly identifies this behavior.

VRF (A) provides per-customer routing, and MP-BGP (B) advertises VPN routes between PEs. MPLS labels are used but not essential as control plane component.

Option C is correct because TI-LFA (Topology Independent Loop-Free Alternate) is activated under the IGP process using the 'fast-reroute per-prefix ti-lfa' command. This enables segment routing to compute a backup path that provides link protection without relying on the topology of the failure, ensuring 50-msec convergence.

In a Layer 3 MPLS VPN, VRF RED routes are learned via MP-BGP between PEs. The 'show ip bgp vpnv4 vrf RED' command confirms the routes are present in the BGP table, but they are not installed in the routing table because the receiving PE lacks the correct route-target import configuration. The route-target import statement on the VRF determines which VPNv4 routes are accepted and installed into the VRF's RIB; without it, the routes remain in BGP but are not added to the routing table.

ORIGINATOR_ID is a non-transitive optional attribute that identifies the router that originated the route into the iBGP domain, used to prevent loops.

The Adjacency SID is local to the router and represents a specific link; it is typically allocated from the dynamic label range, not the SRGB.

NSO uses NETCONF as the primary protocol to push configuration changes, leveraging YANG data models.

In an MPLS VPN, the egress PE (Provider Edge) router receives a packet with a label stack typically consisting of a transport label (IGP label) and a VPN label. Before forwarding the IP packet to the CE (Customer Edge), the egress PE must remove the entire MPLS label stack because the CE is an IP-only device that does not understand MPLS labels. This operation is called 'pop the label stack' (also known as penultimate hop popping, though at the egress PE it is explicit label removal).

E-LAN provides multipoint-to-multipoint connectivity, emulating a LAN across multiple locations.

The voice traffic is only 5% of link capacity, but the priority percent 10 command allows up to 10% of the link to be treated as priority. During peak hours, if other traffic (e.g., video or data) bursts and exceeds the remaining bandwidth, the priority queue can still be policed implicitly by the scheduler, but jitter arises because the priority queue is not rate-limited. Adding a police command under the VOICE class to limit voice to 5% and shaping the priority queue ensures that voice traffic does not exceed its actual rate, preventing microbursts that cause jitter in the priority queue.

In Segment Routing Traffic Engineering (SR-TE) with a Path Computation Element (PCE), the PCE communicates with the Path Computation Client (PCC) using the Path Computation Element Protocol (PCEP), as defined in RFC 5440 and extended for SR by RFC 8664. PCEP is specifically designed for path computation requests and responses, and for initiating and setting up LSPs via the PCE-initiated LSP stateful model (RFC 8281). The PCC sends path computation requests to the PCE, and the PCE responds with computed paths, which the PCC then uses to instantiate SR-TE LSPs.

OSPFv3 runs on a per-link basis, uses link-local addresses for adjacencies, and supports multiple instances per link. OSPFv3 does not require IPv4; it is for IPv6. It uses the same LSA types but with modified formats.

RSVP-TE must be explicitly enabled on every interface that will participate in MPLS-TE label-switched path (LSP) signaling. Even if the link-state database shows sufficient reservable bandwidth, without RSVP-TE enabled on transit interfaces, the PATH messages cannot be processed, and the tunnel will fail to establish. This is a common misconfiguration when deploying MPLS-TE.

Option A is correct because model-driven telemetry uses structured data models defined in YANG, which provides a standardized, hierarchical representation of device state and configuration. This contrasts with SNMP polling, which relies on flat MIB variables and often requires complex parsing of unstructured data. YANG models enable consistent data retrieval across multivendor environments and simplify automation workflows.