Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 826–900

Hierarchical QoS (HQoS) allows the service provider to enforce a total bandwidth shape at the parent level while using a child policy to apply LLQ for voice (ensuring strict priority) and CBWFQ for video and data (ensuring video gets better treatment than data without starving voice). This meets the requirement that video should not degrade voice, as the parent shape prevents any single class from monopolizing the link, and the child policy’s LLQ guarantees voice priority over all other traffic.

Flex-Algo allows the definition of a custom metric type, such as 'min-unidirectional-link-bandwidth', which enables Segment Routing TE to compute paths that avoid low-bandwidth links. This approach directly addresses the requirement to engineer traffic around links with low bandwidth by using bandwidth as the path selection metric.

In IS-IS, Level 2 routers route between areas and maintain a complete L2 database. Level 1 routers route within an area, and Level 1/2 routers act as both, but the question asks for the type that maintains a full L2 routing table of all areas. Level 2 routers specifically perform inter-area routing.

The SRGB defines a range of labels reserved for global segment routing SIDs (e.g., Node SIDs). It ensures that the same label value represents the same prefix across the domain, avoiding label conflicts.

leafref automatically validates that the leaf value matches a leaf in the referenced path.

A BGP-free core with LDP or Segment Routing allows the service provider to forward labeled packets for BGP prefixes without requiring an IGP label for every BGP prefix. In this design, edge routers (PEs) impose a label stack where the outer label (IGP label) is distributed by LDP or Segment Routing for the BGP next-hop, and the inner label is the BGP label. Core routers (P routers) only need to swap the outer label based on the IGP label, not the BGP prefix, thus eliminating the need for IGP labels per BGP prefix.

The 'preferred' algorithm is the correct choice because it instructs the router to automatically select the best algorithm for path computation based on IGP metrics. In Segment Routing, the 'preferred' algorithm uses the default SPF (Shortest Path First) algorithm, which computes paths based solely on IGP link metrics, ensuring optimal routing without additional constraints.

Segment Routing with MPLS data plane (SR-MPLS) uses IGP to distribute labels, eliminating the need for LDP. SR-MPLS is the direct replacement for LDP in MPLS networks.

The commit/rollback model applies changes atomically and allows reverting to previous configurations if needed.

The first step in troubleshooting an MPLS LSP that is not establishing is to verify LDP neighbor adjacency because LDP is the protocol responsible for distributing labels across the MPLS domain. Without a working LDP session between adjacent LSRs, label bindings cannot be exchanged, and the LSP cannot be built. This is the foundational layer for MPLS forwarding, so it must be checked before higher-layer issues like routing or reachability.

Peakflow uses NetFlow (or IPFIX) data exported from routers to analyze traffic patterns and detect anomalies.

Using a staging environment with identical configuration to test before production is the best practice because it allows validation of automation scripts and configuration changes in a controlled setting that mirrors the production network. This approach identifies potential errors, compatibility issues, or unintended side effects without risking service disruption, aligning with Cisco NSO's recommended deployment workflow that emphasizes pre-production testing to ensure change reliability.

The SEL byte is always 0x00 for routers, indicating that the address refers to the router itself rather than a specific service.

EVPN uses BGP control plane, supports multi-homing with ESI, and can provide both L2 and L3 services. It does not use LDP for signaling; it uses BGP. VPLS is older.

OSPF configuration requires entering global config mode, enabling the OSPF process, and then advertising networks under the OSPF process.

Q-in-Q (802.1ad) adds an outer VLAN tag to extend VLAN space. 802.1ah is for MAC-in-MAC, 802.1Q is the basic standard, and 802.1ak is not related.

In SR-MPLS, Prefix-SIDs are advertised in IS-IS using TLV 135 (Extended IP Reachability) to carry the prefix and its metric, and TLV 149 (IS-IS Router Capability) to carry the SID/Label Binding sub-TLV, which maps the prefix to a specific label (Prefix-SID). This allows IS-IS to distribute both the prefix reachability and its associated segment identifier in a single protocol update, enabling source routing without LDP or RSVP-TE.

Standard ACL configuration requires creating the ACL and applying it to an interface in the appropriate direction.

IS-IS supports both narrow (6-bit) and wide (24-bit) style metrics. TE metrics are separate TLVs that carry additional information for MPLS-TE and do not replace the standard metric used for SPF computation.

EF is defined by DSCP 46 (binary 101110) to provide low-loss, low-latency service for voice.

For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

MPLS LSP ping (option C) is an OAM tool specifically designed to verify the data plane of an MPLS label switched path (LSP) by sending an MPLS echo request packet with a target FEC stack, which is forwarded along the LSP and validated by the egress LSR. This tests the actual label forwarding path, not just the control plane, making it a correct choice for troubleshooting LSPs.

Segment Routing (SR) with IS-IS only assigns prefix-SIDs to prefixes that are part of the IS-IS domain and explicitly configured with a SID. External routes, such as those redistributed from another protocol (e.g., BGP or OSPF), are not covered by prefix-SIDs and require a separate label distribution mechanism like LDP or a manually configured explicit-null label to be forwarded with MPLS encapsulation. The engineer's observation that some labels are missing for external routes directly points to this limitation.

These are essential multicast protocols for service provider IPTV and content delivery.

BGP selection order: highest weight first. Route 1 has weight 100, Route 2 has weight 50, so Route 1 is preferred regardless of other attributes.

In Segment Routing Traffic Engineering (SR-TE), the 'color' attribute is a 32-bit numerical value that, combined with the destination prefix, uniquely identifies an SR-TE policy. This allows traffic to be steered into a specific policy based on color, enabling advanced traffic engineering use cases such as multi-topology routing or service-level agreement (SLA) differentiation.

Cisco NSO provides a built-in transaction management system that automatically rolls back a service deployment to its previous state if any part of the deployment fails. This ensures service lifecycle integrity by preventing partial or inconsistent configurations across devices.

BNG supports PPPoE and IPoE (DHCP) for subscriber access. PPPoA is asynchronous transfer mode, not typically used in modern BNG.

NETCONF hello message exchange includes the list of supported YANG modules in the capabilities. This is the standard way to discover device capabilities. Other options are either not standard or would not provide the required information.

The well-known community NO_EXPORT (0xFFFFFF01) prevents a route from being advertised to any eBGP peers. The route can still be advertised within the AS.

S/RTBH works by advertising a /32 prefix (the victim's IP) with a special BGP community (e.g., NO_EXPORT) and a next-hop of the discard interface (e.g., Null0). Edge routers install the route pointing to Null0, dropping traffic to that IP.

Segment Routing (SR) defines two primary types of Segment Identifiers (SIDs): the Prefix-SID and the Adjacency-SID. A Prefix-SID is a global or local label associated with an IGP prefix (e.g., a loopback), enabling shortest-path forwarding toward that prefix. An Adjacency-SID is a local label associated with a specific adjacency (link) between two routers, forcing traffic out that exact interface regardless of the IGP shortest path.

B is correct because the VRF CUSTOMER is configured with route-target import 100:1, but the route in question carries a different route-target value (e.g., 100:2). For a route to be installed into a VRF table, the route-target extended community attached to the route must match at least one of the import route-targets configured on the VRF. A mismatch prevents the route from being imported, even if other conditions are satisfied.

In Segment Routing Traffic Engineering (SR-TE), traffic is steered into an SR-TE policy using a color extended community attached to BGP routes. The color community acts as a service-level identifier that maps BGP-learned prefixes to a specific SR-TE policy on the headend router, enabling automated traffic engineering without per-flow state or tunnel interfaces.

In OSPF, the Extended Prefix TLV (type 1) carries the Prefix SID sub-TLV for segment routing. The Adjacency SID is carried in the Extended Link TLV.

NTP authentication ensures that time synchronization messages are from a trusted source, preventing spoofed NTP packets that could cause time changes affecting logs, protocols, and security.

CBWFQ with WRED is the best choice because CBWFQ provides per-class queuing with guaranteed bandwidth, while WRED proactively drops less important traffic (based on IP precedence or DSCP) before the queue becomes full, preventing tail drop and ensuring that higher-priority traffic is preserved during congestion. This combination allows the service provider to selectively discard lower-priority packets under congestion, meeting the requirement to drop less important traffic before more important traffic.

In hierarchical QoS (HQoS) on a Cisco ASR 9000, the parent policy shapes traffic to a specified rate, but if the child policy includes a police command, that policer can independently drop or mark down traffic before it reaches the parent shaper. This causes the observed traffic rate to be lower than the parent shape rate, as the child policer is the actual bottleneck. The correct answer is A because the police command in the child policy is limiting traffic below the 10 Mbps parent shaper, resulting in only 8 Mbps observed.

Designated Forwarder (DF) election ensures only one PE forwards traffic to the CE for broadcast/multicast/unknown unicast, and split-horizon prevents a PE from forwarding packets back to the ES from which they were received.

OSPF TE extensions use Opaque LSAs. Specifically, Type 10 Opaque LSAs (area-scoped) carry TE information as defined in RFC 3630.

VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.

The 'show ip mroute' command displays the multicast routing table, including the outgoing interface list (OIL) for each multicast group. Since the PIM neighbor table confirms the upstream interface is correct, the issue likely lies in the OIL, which 'show ip mroute' directly verifies. This command shows which interfaces are forwarding multicast traffic and whether they are pruned or in a forwarding state.

Stub and NSSA allow Type 3 LSAs but block Type 5 LSAs. Totally stubby blocks both Type 3 and Type 5.

With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Loose uRPF only checks that a route to the source exists, suitable for asymmetric routing. Strict uRPF requires the incoming interface to match the best return route, which can drop legitimate traffic with asymmetric routing. Default routes do not affect loose mode.

The NETCONF response shows a 'police' configuration under the QoS policy 'POLICE-CUSTOMER' with a committed information rate (CIR) of 256000 bps (256 kbps) and a conform-action of 'transmit' with an exceed-action of 'drop'. This is a standard policing action that meters traffic to the specified rate and drops any packets that exceed it, as defined in RFC 2697 (Single Rate Three Color Marker). Option A correctly identifies this behavior.

VRF (D) provides per-customer routing isolation, and MP-BGP with VPN-IPv4 address family (E) is used to exchange VPN routes between PEs. MPLS labels are used for data plane forwarding but are not considered control plane components for VPN operation.

TI-LFA (Topology Independent Loop-Free Alternate) is activated under the IGP process using the 'fast-reroute per-prefix ti-lfa' command. This enables segment routing to compute a backup path that provides link protection without relying on the topology of the failure, ensuring 50-msec convergence.

In a Layer 3 MPLS VPN, VRF RED routes are learned via MP-BGP between PEs. The 'show ip bgp vpnv4 vrf RED' command confirms the routes are present in the BGP table, but they are not installed in the routing table because the receiving PE lacks the correct route-target import configuration. The route-target import statement on the VRF determines which VPNv4 routes are accepted and installed into the VRF's RIB; without it, the routes remain in BGP but are not added to the routing table.

ORIGINATOR_ID is a non-transitive optional attribute that identifies the router that originated the route into the iBGP domain, used to prevent loops.

The Adjacency SID is local to the router and represents a specific link; it is typically allocated from the dynamic label range, not the SRGB.

NSO uses NETCONF as the primary protocol to push configuration changes, leveraging YANG data models.

In an MPLS VPN, the egress PE (Provider Edge) router receives a packet with a label stack typically consisting of a transport label (IGP label) and a VPN label. Before forwarding the IP packet to the CE (Customer Edge), the egress PE must remove the entire MPLS label stack because the CE is an IP-only device that does not understand MPLS labels. This operation is called 'pop the label stack' (also known as penultimate hop popping, though at the egress PE it is explicit label removal).

E-LAN provides multipoint-to-multipoint connectivity, emulating a LAN across multiple locations.

The voice traffic is only 5% of link capacity, but the priority percent 10 command allows up to 10% of the link to be treated as priority. During peak hours, if other traffic (e.g., video or data) bursts and exceeds the remaining bandwidth, the priority queue can still be policed implicitly by the scheduler, but jitter arises because the priority queue is not rate-limited. Adding a police command under the VOICE class to limit voice to 5% and shaping the priority queue ensures that voice traffic does not exceed its actual rate, preventing microbursts that cause jitter in the priority queue.

In Segment Routing Traffic Engineering (SR-TE) with a Path Computation Element (PCE), the PCE communicates with the Path Computation Client (PCC) using the Path Computation Element Protocol (PCEP), as defined in RFC 5440 and extended for SR by RFC 8664. PCEP is specifically designed for path computation requests and responses, and for initiating and setting up LSPs via the PCE-initiated LSP stateful model (RFC 8281). The PCC sends path computation requests to the PCE, and the PCE responds with computed paths, which the PCC then uses to instantiate SR-TE LSPs.

RSVP-TE must be explicitly enabled on every interface that will participate in MPLS-TE label-switched path (LSP) signaling. Even if the link-state database shows sufficient reservable bandwidth, without RSVP-TE enabled on transit interfaces, the PATH messages cannot be processed, and the tunnel will fail to establish. This is a common misconfiguration when deploying MPLS-TE.

Model-driven telemetry uses structured data models defined in YANG, which provides a standardized, hierarchical representation of device state and configuration. This contrasts with SNMP polling, which relies on flat MIB variables and often requires complex parsing of unstructured data. YANG models enable consistent data retrieval across multivendor environments and simplify automation workflows.

ON_CHANGE mode in gNMI ensures that the target device sends a telemetry update immediately whenever a state change occurs, guaranteeing that no updates are missed. This is in contrast to SAMPLE mode, which only sends periodic snapshots and can miss transient changes between intervals. Therefore, to capture all state changes, ON_CHANGE is the correct subscription mode.

BGP path selection applies within the VRF. The route with higher local preference or shorter IGP metric to the next-hop determines the best path. Route targets are used for import/export only.

SR-TE reduces state by not requiring per-LSP state on intermediate nodes, supports distributed intelligence via IGP, and does not require a separate protocol like RSVP. However, SR-TE still requires CSPF for path computation, and RSVP-TE also supports fast reroute.

After local preference, the BGP best path selection process evaluates the AS path length. A shorter AS path is preferred because it indicates a less complex path to the destination network. This attribute is directly compared next, making option C correct.

YANG data models (C) are required because they define the structure and semantics of the telemetry data being streamed. gRPC uses YANG as its schema language to encode data in Protocol Buffers (protobuf) or JSON format, ensuring the receiver can parse and interpret the telemetry information correctly.

Massive IoT corresponds to mMTC (massive Machine Type Communications) slice, designed for many devices with low data rates.

RSVP-TE Fast Reroute uses bypass tunnels to protect links, providing local repair upon failure.

Prefix-lists and route-maps are commonly used together to match and filter BGP prefixes. Prefix-lists define the prefixes, and route-maps apply them in BGP neighbor statements.

6PE (IPv6 Provider Edge) is the correct answer because it allows IPv6 traffic to be carried over an existing MPLS/IPv4 backbone without requiring dual-stack on all core routers. In 6PE, only the Provider Edge (PE) routers need to be dual-stack; they encapsulate IPv6 packets in MPLS labels and transport them across the IPv4 MPLS core, which remains IPv4-only. This meets the requirement of not dual-stacking all routers while leveraging the existing MPLS infrastructure.

Many application protocols embed IP addresses in payload. ALGs (Application Level Gateways) inspect and modify these payloads to ensure proper translation. Without ALGs, these protocols may break.

In a PPPoE environment, the BNG acts as the access concentrator. Authentication is performed using PAP or CHAP, and IP address assignment is done via IPCP (IP Control Protocol). The BNG also uses RADIUS for centralized authentication but between BNG and CPE, PPPoE uses PPP for authentication and IPCP for IP address.

The exhibit shows that the local router (192.168.1.2) has allocated label 161 for prefix 10.1.1.0/24, as indicated in the output of the 'show mpls forwarding-table' command. This label is assigned by the local router as the ingress LSR to forward traffic toward the egress LSR (192.168.1.1). The correct statement is that the local router allocated label 161 for this prefix.

DPI inspects packet payloads to identify application-layer protocols (e.g., HTTP, BitTorrent), enabling traffic shaping, QoS, or security policies.

Expedited Forwarding (EF) per-hop behavior is defined in RFC 3246 and is designed for low-loss, low-latency, and low-jitter services such as voice traffic. The recommended DSCP value for EF is 46 (binary 101110), which corresponds to the PHB that ensures a dedicated forwarding treatment with a minimal queueing delay. This value is widely adopted in Cisco QoS deployments for voice payloads to guarantee strict priority queuing.