Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 76–150

Per-prefix label mode (option C) is correct because it assigns a single label for a specific prefix across all core routers, regardless of which router originated the route. This ensures label consistency, which is critical for proper MPLS forwarding and troubleshooting. In contrast, per-next-hop or per-interface modes would create different labels for the same prefix based on the next hop or interface, breaking the requirement for uniform label allocation.

BGP route selection starts with the highest weight (Cisco proprietary), then highest LOCAL_PREF, then locally originated routes.

B is correct because LDP (Label Distribution Protocol) is the standard control protocol used to signal pseudowire labels in MPLS Layer 2 VPNs. Specifically, the Targeted LDP (T-LDP) session between the two Provider Edge (PE) routers exchanges the Virtual Circuit (VC) label, which is the inner label used to identify the pseudowire. This is defined in RFC 4447 and is the default signaling mechanism for AToM (Any Transport over MPLS).

TACACS+ provides separate authentication, authorization, and accounting, and is commonly used with AAA for centralized management. Role-based access is achieved via task groups in IOS XR.

Ethernet Segment Identifier (ESI) and designated forwarder (DF) election in EVPN ensure that only one PE forwards traffic to the CE for a given Ethernet segment, preventing loops.

ECMP with a hash algorithm based on Layer 3 and Layer 4 headers is the correct choice because it provides per-flow load balancing by computing a hash over source/destination IP addresses and TCP/UDP port numbers, ensuring that all packets belonging to the same flow are forwarded over the same equal-cost path. This preserves packet order while distributing different flows across multiple paths in an MPLS network.

The BGP next-hop for VPNv4 routes is typically the loopback interface of the remote PE router. For BGP to consider the next-hop reachable, the local PE must have an IGP route to that loopback address. The 'neighbor x.x.x.x update-source loopback0' command ensures that BGP uses the loopback interface as the source IP for the TCP session, which aligns the BGP peering address with the IGP-advertised loopback, making the next-hop reachable via OSPF.

FlowSpec defines traffic matching criteria using components like destination port (type 3), source port (type 2), etc. Destination port is type 3.

For CE1 to receive the VPNv4 route for 192.168.1.0/24, PE1 must redistribute the route from the VRF into BGP. The neighbor statement under address-family ipv4 vrf CUSTOMER_A is required to establish an eBGP peering with CE1 and exchange IPv4 routes within that VRF. Without it, PE1 will not send any routes to CE1, even if the VRF and route targets are correctly configured.

SR-TE with an explicit path using a segment list allows the operator to define a strict, ordered list of MPLS labels (segments) that the traffic must follow, overriding the default IGP shortest-path behavior. This is the correct technique for enforcing a strict path across the core while leaving other traffic to use shortest-path forwarding.

By default, BGP does not drop invalid routes; they are considered but with a lower preference (typically not installed in the routing table if a valid route exists). To drop invalid routes, explicit policy is needed.

Route summarization (A) reduces the number of BGP prefixes advertised, which inherently limits the impact of flapping because a single summary prefix represents many more-specific prefixes. If a specific subprefix flaps, the aggregate remains stable, preventing the flapping from propagating to BGP peers. This is a proactive approach to minimize the control-plane churn caused by unstable routes.

The backup path in an MPLS Fast Reroute (FRR) configuration is precomputed and installed in the forwarding table to provide sub-50ms protection against link or node failures. When the primary outgoing interface fails, traffic is immediately switched to the backup path without waiting for IGP convergence, ensuring minimal packet loss.

Dial-out telemetry is the correct model because it allows the router to initiate a TCP connection to the collector, even when the collector is behind NAT and cannot be reached from the router. In dial-out mode, the router acts as the client and pushes telemetry data to the collector's configured IP address and port, bypassing the need for the collector to initiate the connection. This contrasts with dial-in models where the collector must reach the router, which is impossible when the collector is behind NAT.

LDP (Label Distribution Protocol) is a standardized protocol (RFC 5036) specifically designed for distributing MPLS labels between routers to establish Label Switched Paths (LSPs) without requiring an IGP to carry label information. BGP (Border Gateway Protocol) can also exchange MPLS labels, particularly in MPLS VPN and Inter-AS scenarios, where it carries VPNv4 routes with MPLS labels using the BGP label-mapping capability (RFC 3107).

Totally stubby area blocks Type 4 (ASBR Summary) and Type 5 (External) LSAs, and also Type 3 (Summary) LSAs except for the default route.

AF41 is Assured Forwarding class 4, low drop probability, with DSCP decimal value 34 (binary 100010).

QoS policies on PE routers with shaping and policing allow the service provider to enforce traffic contracts per customer, ensuring that one customer's traffic does not consume bandwidth allocated to another. This is achieved by applying ingress policing to limit customer traffic to the Committed Information Rate (CIR) and egress shaping to smooth bursts, preventing congestion in the MPLS core from affecting other customers.

In RSVP-TE, the PATH message includes the ERO to define the explicit route the traffic should take. The RESV message is sent back to confirm the reservation.

The BGP table shows the prefix as valid but not advertised, which indicates that BGP has the route but is not sending it to the upstream neighbor. A common cause is that the next-hop for the customer prefix is not reachable from the PE router via the interface used to reach the upstream provider. BGP will not advertise a route if the next-hop is not reachable in the routing table (unless 'neighbor x.x.x.x next-hop-self' is configured), because the upstream router would be unable to forward traffic to that next-hop.

B is correct because SR-MPLS uses the MPLS data plane but replaces the control plane protocols LDP and RSVP-TE with IGP extensions (IS-IS or OSPF) to distribute segment information. This eliminates the need for these traditional label distribution protocols, simplifying network operations and reducing protocol overhead.

BGP route reflectors use the cluster ID to detect and prevent routing loops. When a route reflector receives an update containing its own cluster ID in the cluster-list attribute, it discards the route, breaking the loop. This mechanism is defined in RFC 4456 and is essential for loop-free route propagation in non-full-mesh iBGP topologies.

CSPF computes a path that meets constraints (bandwidth, affinity, etc.) and avoids links/ nodes not meeting them.

EF (Expedited Forwarding) is assigned DSCP 46 for low-latency voice traffic.

6VPE uses the VPNv6 address family (or IPv6 labeled unicast with VPN extensions) to carry IPv6 prefixes with VPN-IPv6 addresses.

Segment Routing (SR-MPLS) eliminates the need for a separate label distribution protocol like LDP or RSVP-TE. The MPLS labels are derived directly from the IGP (IS-IS or OSPF) extensions, reducing control-plane complexity while still enabling traffic engineering via SR-TE policies and flexible path computation.

BGP FlowSpec (RFC 8955) can be deployed between a route reflector and its clients. The route reflector propagates FlowSpec NLRI (Network Layer Reachability Information) to its clients, allowing the clients to install traffic filtering rules without requiring a full BGP mesh. This is a common deployment model in service provider networks to distribute flow-spec routes efficiently.

BNG uses RADIUS for AAA (authentication, authorization, and accounting) of subscribers. RADIUS exchanges messages with a backend server to validate credentials and assign policies.

On a point-to-point OSPF link, the EXSTART state indicates that the routers have formed a bidirectional communication (2WAY) and are now negotiating the master/slave relationship for database description (DBD) packet exchange. A mismatched MTU between the two interfaces causes the DBD packets to be dropped or rejected, preventing the adjacency from progressing beyond EXSTART. This is a common issue on serial links where one side may have a different MTU configured.

In IS-IS, an area is identified by a common area address, LSPs carry link state data, and Level-1 routers operate intra-area. Common confusions involve swapping area definitions (system ID vs. area address) and mixing Level-1/Level-2 roles.

The BNG acts as a RADIUS client and uses RADIUS protocol to send authentication requests (Access-Request) for PPPoE or IPoE sessions.

Cisco NSO (Network Services Orchestrator) is a key technology for automated service provisioning because it provides a multi-vendor, service-oriented orchestration layer that uses YANG models and NETCONF to manage device configurations and service lifecycles. It enables operators to define services as templates, then push consistent configurations across the network, drastically reducing manual CLI-based provisioning.

The IP SLA UDP jitter operation completed successfully, meaning the destination is reachable and the operation is running. However, if the threshold is set too high, the IP SLA will not trigger a reaction (e.g., an SNMP trap or route change) even when jitter exceeds acceptable levels for voice quality. The customer reports voice quality issues, so the engineer must check if the jitter threshold is configured too high, masking the problem.

IOS XR uses a two-phase commit: the user commits, and if successful, the configuration is applied; otherwise, it rolls back. There is no need for explicit rollback commands.

The last byte '00' is the SEL (NSAP Selector), which is always '00' for IS-IS routing.

In EVPN-VXLAN deployments for data center interconnect, MAC address learning occurs via the control plane using BGP with the MP-BGP EVPN address family (AFI 25 / SAFI 70). This eliminates the need for traditional data-plane flooding and learning, providing better scalability and control. The correct statement is that MAC addresses are learned via BGP MP-BGP EVPN address family.

DF election determines which PE forwards traffic for a given VLAN to avoid duplication.

BGP FlowSpec allows the inclusion of a 'rate-limit' action within the FlowSpec rule's 'action' clause to enforce policing. This action directly applies a traffic rate limit (in bits per second) to the matched flow, enabling DDoS mitigation without requiring external QoS policies or MPLS TE reservations.

The Map-Server (MS) is the central control-plane component in LISP that maintains the authoritative mapping database of EID-to-RLOC entries. When an Ingress Tunnel Router (ITR) sends a Map-Request for an unknown EID, the Map-Server receives it, looks up the mapping, and either responds directly or forwards the request to the appropriate Egress Tunnel Router (ETR) for a reply. This makes the MS the correct answer for maintaining mappings and responding to Map-Requests.

Segment Routing (SR-MPLS) eliminates the need for LDP by encoding MPLS labels directly in the IGP (OSPF or IS-IS) using extensions, which reduces control-plane overhead and speeds up convergence. This directly addresses the large OSPF LSDB and slow LDP session establishment because SR-MPLS does not require a separate label distribution protocol and can leverage a single IGP for both routing and label information, improving scalability without hardware replacement.

The NET (Network Entity Title) consists of AFI, Area ID, System ID, and SEL. The System ID uniquely identifies a router within an area.

A stub area blocks Type 5 LSAs, and a default route is injected for external destinations.

The `ios_config` module with `check_mode` (enabled via the `--check` flag or `check_mode: yes`) allows Ansible to first verify device reachability and then compare the intended configuration against the running configuration without making changes. Only when a difference is detected and `check_mode` is disabled will the module apply the configuration changes. This directly meets the requirement of applying configurations only when the device is reachable and the current configuration differs from the intended.

The OSPF network statement uses a wildcard mask of 0.0.0.0, which matches only the exact IP address 10.1.1.1, but the interface has a /30 prefix (255.255.255.252), so the correct wildcard mask should be 0.0.0.3 to include the entire subnet. This misconfiguration prevents OSPF from advertising the correct network, breaking MPLS VPN CE-to-PE routing.

Leafref references an existing leaf in the YANG data tree, ensuring consistency.

In an MPLS L3VPN, PE routers use MP-BGP (Multiprotocol BGP) to exchange customer VPN routes. Each VPN route is uniquely identified by a Route Distinguisher (RD) to maintain global uniqueness, and Route Targets (RTs) control the import/export of routes between VRFs. This allows the PE to separate customer routing domains while still using a shared MPLS backbone.

Each SID in the list is a node SID (Prefix-SID) of intermediate routers, forming a strict hop-by-hop path.

SRGB defines a range of labels reserved for global segments (e.g., Node SIDs). It ensures that a given Node SID maps to the same label across all routers in the SR domain, simplifying operations.

MAP-T (Mapping of Address and Port using Translation) uses IPv4-IPv6 translation (stateless NAT64-like) at the customer edge, not encapsulation.

OSPF uses different LSA types (e.g., Type 1 Router LSA, Type 2 Network LSA, Type 3 Summary LSA, Type 5 AS-External LSA) to advertise different categories of routing information, such as router links, network links, inter-area routes, and external routes. This LSA-type differentiation is fundamental to OSPF's link-state architecture, enabling efficient flooding and route computation within and across areas.

Disabling MPLS on the PE-CE link ensures that the customer cannot send labeled packets into the MPLS core, preventing label spoofing. Additionally, disabling TTL propagation can hide the core topology but does not prevent spoofing.

Consistent label distribution across all P (Provider) routers is essential for MPLS L3VPN scalability and convergence. LDP (Label Distribution Protocol) or TDP (Tag Distribution Protocol, Cisco proprietary predecessor) must be uniformly configured to ensure a seamless label-switched path (LSP) from ingress to egress PE. Inconsistent label distribution can cause label binding mismatches, leading to forwarding failures or suboptimal convergence during topology changes.

Best Effort (DF, Default Forwarding) is DSCP 0.

GPON (Gigabit-PON) is defined by ITU-T G.984 with downstream up to 2.488 Gbps.

AF4 has three drop probabilities: low (AF41 = DSCP 34), medium (AF42 = DSCP 36), high (AF43 = DSCP 38).

Route reflectors use cluster-id to detect loops and originator-id to prevent advertisement back to the originator. The non-client mesh requirement is eliminated with route reflectors.

ESI identifies the segment, DF election avoids duplicates, and aliasing allows traffic to be forwarded to any PE in the multi-homing group.

Standard BGP communities include NO_EXPORT (0xFFFFFF01), NO_ADVERTISE (0xFFFFFF02), and LOCAL_AS (0xFFFFFF03). NO_EXPORT prevents advertisement to any eBGP peer; NO_ADVERTISE prevents advertisement to any peer; LOCAL_AS prevents advertisement outside the local AS.

LOCAL_PREF is used to influence the path selection for outbound traffic within the AS, with higher preference preferred.

The shape command can interfere with police by smoothing traffic, which may prevent the policer from seeing bursts that exceed the committed rate. If the shape rate is set higher than the police rate, the policer may not drop traffic because the shaper is already limiting the output to a lower rate. Additionally, the order of operations in a service policy matters: if shape is applied before police, the policer sees shaped traffic, which may not exceed the rate.

Traffic shaping buffers excess traffic that exceeds the configured rate, smoothing bursts and delaying packets to conform to the desired rate. Traffic policing, on the other hand, immediately drops or re-marks packets that exceed the rate limit, without buffering. This fundamental difference in handling excess traffic—buffering versus dropping/re-marking—is the key distinction between the two QoS mechanisms.

In Cisco IOS XR, the 'prefix-sid index' command must be configured under the OSPF process for the specific prefix (e.g., 'prefix-sid index 100' under 'router ospf 1' for the loopback0 prefix). Configuring it under the interface does not associate the SID with the prefix in OSPF's link-state database, so the router will not advertise the Prefix-SID. The exhibit shows the command under the loopback interface, which is incorrect for OSPF Segment Routing.

On Cisco routers, you can use 'set mpls experimental imposition' to set EXP on the imposed label, or use a QoS policy with 'set mpls experimental' in a policy-map.

A 404 Not Found response to a RESTCONF PATCH request targeting a specific interface indicates that the resource (the interface) does not exist at the given URI. RESTCONF uses the URI path to identify the exact YANG data node; if the interface name in the URI does not match any configured interface on the Cisco ASR 9000, the server returns 404. This is consistent with RFC 8040, where 404 is used when the target resource cannot be found.

MPLS TE with RSVP-TE requires that links advertise reservable bandwidth so that the Constrained Shortest Path First (CSPF) algorithm can compute paths that satisfy bandwidth constraints. Without reservable bandwidth advertised via IGP extensions (e.g., OSPF TE or IS-IS TE), RSVP-TE cannot reserve resources along the path.

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection on the PE-CE link, and when associated with a static route, it allows the PE to quickly remove the failed route from the routing table. This triggers fast convergence without waiting for routing protocol timers, which is critical for MPLS Layer 3 VPNs using static routing on the CE side.