Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 151–225

An explicit path with strict hops requires each hop to be directly connected. If a hop is not directly connected, the path fails. Also, if there is no RSVP capability along the path, the tunnel cannot be signaled.

The gNMI ON_CHANGE subscription mode is designed to stream telemetry updates only when the value of a subscribed path changes. Since the NMS is missing BGP flap events, the subscription must be using SAMPLE mode, which periodically polls the state and can miss transient events between sampling intervals. Changing the subscription to ON_CHANGE ensures that every state transition (e.g., BGP session up/down) is immediately pushed to the collector, capturing all flaps.

SR-MPLS eliminates LDP and RSVP state, using IGP for label distribution (e.g., via IS-IS TLVs).

Distributed architecture with per-card allocation improves scalability and fault isolation. It does not directly reduce cost or simplify management; instead, it enhances performance and resilience.

The Ethernet Segment Identifier (ESI) is a 10-byte value that identifies a specific multihomed site.

NSO uses a Configuration Database (CDB) for storing device configurations, YANG models for service definitions, and NEDs (Network Element Drivers) for device abstraction.

Configuring backup tunnels with explicit paths that avoid high-latency links ensures that when MPLS TE Fast Reroute (FRR) activates, the backup path meets the latency requirements for real-time traffic like voice. By specifying explicit routes (e.g., via the 'path-option' command with explicit-path objects), the operator can exclude links known to have high propagation delay or congestion, thus preventing the poor voice quality experienced after the fiber cut.

The exhibit shows an MPLS LDP label binding table. Prefix 10.4.4.0/24 has no local label assigned (shown as 'no label' or missing), meaning LDP has not established a label binding for this FEC. Without a label, traffic destined for 10.4.4.0/24 cannot be label-switched and will be dropped or forwarded via IP lookup (if enabled), but in an MPLS core, this typically results in packet loss.

When a police action is configured, the router uses a token bucket model to meter traffic. If traffic exceeds the committed information rate (CIR) and burst size, it falls into the 'exceed' or 'violate' category depending on the configured conform and exceed burst parameters. The 'drop' action for exceed or violate conditions explicitly instructs the router to discard those packets, enforcing traffic shaping or policing at the hardware or software level.

SR-TE policies are stateful at the headend, use segment lists for path steering, and can be associated with a color for traffic engineering.

The exhibit shows that the best-effort class has an average queue depth of 580 packets, which is significantly higher than the voice class's average depth. This indicates that the best-effort class is experiencing the most congestion, as queue depth is a direct measure of buffered packets waiting for transmission. The voice class, despite having a taildrop threshold, has a much lower average depth, showing it is not as congested.

uRLLC (Ultra-Reliable Low-Latency Communications) is designed for latency-critical and reliable applications.

BGP FlowSpec (RFC 8955) allows encoding of flow specifications (e.g., source/dest IP, ports, protocol) and distributing them via BGP to routers, which then apply traffic filtering actions (e.g., drop, rate-limit) dynamically.

MED (Multi-Exit Discriminator) is used to influence inbound traffic by suggesting to a neighbor AS which path to use.

In RSVP-TE, the PATH message includes the ERO to specify the explicit route for the tunnel.

The order: weight, local pref, originate (locally originated), AS_PATH length, ORIGIN, MED. So weight, local pref, and AS_PATH length are before MED.

The VRF CUST1 configuration does not include a route-target import statement for RT 100:100. Without a matching import RT, the PE router will receive the route from the CE but will not import it into the VRF. The route is received (BGP update is accepted) but not installed in the VRF routing table, making option D correct.

GPON is a point-to-multipoint fiber access technology using passive optical splitters, providing downstream speeds up to 2.5 Gbps and upstream up to 1.25 Gbps.

Cisco NSO (Network Services Orchestrator) uses YANG models and NETCONF to manage service lifecycle.

BGP-LU (BGP Labeled Unicast) installs labels into the BGP table, but for those labels to be used for MPLS forwarding, the router must be configured to allocate labels on a per-prefix basis. By default, BGP may use per-VRF or per-next-hop label allocation, which does not populate the LFIB with per-prefix entries. Setting `label mode per-prefix` under the BGP neighbor or address-family forces BGP to allocate a unique label for each prefix, enabling the LFIB installation required for MPLS forwarding.

Route Target (RT) import/export is the correct feature because it controls which routes from which VPNs are imported into a given VRF. By configuring multiple RT import statements on a single VRF, the provider can selectively import routes from two different VPNs, enabling inter-VPN route sharing without merging the VPNs themselves.

LDP (Label Distribution Protocol) is a standardized protocol (RFC 5036) specifically designed for label distribution in MPLS networks. It operates by discovering LDP peers and exchanging label mappings for each FEC (Forwarding Equivalence Class), enabling label-switched path (LSP) establishment without requiring a routing protocol to carry label information.

In MPLS, the swap operation replaces the incoming top label with a new outgoing label as per the LFIB entry.

End.DT4 is the SRv6 endpoint behavior for decapsulation and table lookup for IPv4 L3VPN. End.DT6 is for IPv6 L3VPN, End.DT2U is for L2VPN.

get-config with <source>running</source> retrieves the running configuration. The <get> RPC retrieves both configuration and state data.

BGP GSHUT uses a well-known community (0xFFFF0000) that lowers the local preference by 100 (to 0 by default) to make the routes less preferred, thus draining traffic gracefully.

A short CCM interval makes the system sensitive to minor delays, causing false failures and frequent protection switches. A longer interval would reduce sensitivity but increase detection time. Priority and OAM rate differences are not typical causes.

B is correct because TI-LFA (Topology-Independent Loop-Free Alternate) is a Segment Routing mechanism that precomputes a backup path using a segment list, enabling sub-50ms convergence upon link failure. It guarantees loop-free forwarding even in complex topologies where traditional LFA may fail, by leveraging SR's source routing capabilities.

In an MPLS L3VPN, customer IPv4 routes must be transported between Provider Edge (PE) routers across the MPLS backbone. The VPNv4 unicast address family (AF 1, SAFI 128) is required because it carries both the IPv4 prefix and an 8-byte Route Distinguisher (RD), making routes unique across different VPNs. This address family is enabled under the BGP configuration on PE routers (e.g., `address-family vpnv4 unicast`) to exchange labeled VPN routes using MP-BGP, as defined in RFC 4364.

Cisco CRS (Carrier Routing System) is a high-end core router designed for large service provider backbone networks, supporting MPLS, SR, and massive scale.

Segment Routing via IGP (Option A) is a valid label distribution method because it uses the IGP (OSPF or IS-IS) to advertise prefix-SIDs, which are MPLS labels. The IGP distributes these labels as part of its link-state database, eliminating the need for a separate label distribution protocol like LDP. This is defined in RFC 8660 and RFC 8665 for OSPF and IS-IS respectively.

LLQ is correct because it combines a strict priority queue with CBWFQ, ensuring voice traffic (which is delay-sensitive) is always serviced first, thereby minimizing latency and jitter. The priority queue is policed to prevent starvation of other traffic, making it ideal for real-time applications like VoIP in service provider networks.

Segment Routing (SR) eliminates the need for per-flow state on transit routers by encoding the path as a list of segment identifiers (SIDs) directly in the packet header. In contrast, RSVP-TE requires each transit router to maintain soft-state for every LSP, consuming memory and CPU. This state reduction simplifies network operation and scales better in large MPLS cores.

Enabling SSH only and using AAA with TACACS+ are key management plane hardening steps. SNMPv3 with encryption is also important but not listed as an option.

The tunnel fails to come up because the CSPF-computed path cannot reserve the requested 200 Mbps bandwidth. Even though the path has sufficient bandwidth on paper, the RSVP resource reservation process may fail due to a lack of available bandwidth at the exact time of reservation, or due to a mismatch in bandwidth pool configuration (e.g., global vs. subpool). Since the RSVP neighbor is established, the issue is specifically with the reservation step, not with reachability or LDP.

C is correct because a router always prefers the most specific prefix (longest prefix length) when forwarding packets, regardless of administrative distance or metric. This is a fundamental rule of IP routing: the route with the longest subnet mask match is chosen first, as it represents the most precise path to the destination.

Weight (D) is a Cisco-proprietary attribute that is checked first in the BGP best-path selection process, before AS-path length. Local Preference (E) is the second attribute evaluated, also preceding AS-path length. Both are considered before the AS-path length comparison in the default BGP decision process.

In SR-MPLS, the SID values in the segment list are relative to the SRGB. If the SRGB starts at 10000, a SID value of 100 corresponds to label 10100 (10000 + 100). So the first segment label is 10100.

IS-IS uses the IS-IS Router CAPABILITY TLV (135) with sub-TLV 19 to carry the SR-capable information and prefix-SID. Specifically, the Prefix-SID is advertised in the IS-IS Extended IP Reachability TLV (135) with sub-TLV 3.

NSO uses NETCONF as the primary protocol for device configuration, leveraging YANG models.

NETCONF retrieves data based on YANG models. If the filter does not specify the correct YANG path for QoS queueing statistics, the server will not include that data in the response. The YANG data model for QoS (e.g., Cisco‑IOS‑XE‑qos‑oper.yang) defines specific paths for queueing counters; omitting or mis‑specifying the filter path results in an incomplete reply.

An SR-TE policy uses a color extended community to identify the policy's color and its associated endpoint. BGP distributes these color extended communities, enabling headend routers to match traffic to the correct SR-TE policy for steering. Without BGP carrying the color extended community, the policy cannot be dynamically selected for traffic engineering.

The BGP best path selection order is: weight, local pref, originated locally, AS_PATH length, ORIGIN, MED, etc. MED is considered after ORIGIN.

The police rate for voice is too low for the offered traffic. Voice traffic requires a guaranteed bandwidth to maintain low jitter and packet loss; if the policer rate is set below the actual voice flow rate, packets are dropped or marked down, causing poor voice quality. In the exhibit, the voice class has a police rate that is insufficient for the offered load, leading to excessive drops.

Low Latency Queuing (LLQ) allows you to place voice traffic into a strict priority queue, ensuring guaranteed bandwidth and low latency during congestion, while the default class uses CBWFQ to allocate remaining bandwidth to data traffic. This matches the requirement of prioritizing voice without starving data entirely, as the priority queue is policed to prevent voice from consuming all bandwidth.

AF41 uses DSCP 34 (010001) and AF31 uses DSCP 26 (011010).

DPI inspects packet payloads using signatures, pattern matching, or behavioral analysis to identify applications, even if they use non-standard ports.

Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.

The correct matches are: PE connects to customer edge, P is MPLS core, ASBR connects to other ASes. Common confusions: mistaking P for CE or confusing Route Reflector with ASBR.

An SDR provides a logical partitioning of router resources, allowing multiple independent virtual routers within a single physical chassis.

Segment Routing (SR) eliminates the need for the Label Distribution Protocol (LDP) and Resource Reservation Protocol with Traffic Engineering (RSVP-TE) by encoding MPLS labels directly into the Interior Gateway Protocol (IGP), such as OSPF or IS-IS. This simplifies the control plane by removing these protocols entirely, reducing operational complexity and resource overhead.

The premium business class queue is experiencing excessive packet drops because a police action configured with a 'drop' exceed-action is discarding traffic that exceeds the committed information rate (CIR). Unlike congestion management (queuing), policing is a congestion avoidance mechanism that drops packets immediately when the traffic rate surpasses the configured CIR, regardless of the queue depth or available bandwidth. This explains why drops occur only in the premium class queue, as the policer is explicitly dropping excess packets before they even enter the CBWFQ scheduler.

MED (Multi-Exit Discriminator) is the correct BGP attribute for influencing inbound traffic from a multihomed customer. When the customer advertises the same prefix to two PE routers in the same AS, setting a lower MED value on one PE will cause the customer's upstream AS to prefer that path for returning traffic. This allows the service provider to control which PE receives the ingress traffic without altering any outbound routing policies.

Weight, local preference, and AS_PATH length are considered before MED. ORIGIN is also before MED but AS_PATH is longer.

Setting the BGP 'no-export' community on routes from the undesired entry point prevents those routes from being advertised to the customer AS. Since the customer only learns routes from the desired entry point, they will prefer that entry point for inbound traffic. This is a standard technique for influencing inbound traffic without requiring customer-side configuration.

The ESI identifies a multi-homed device or network, enabling all-active redundancy and fast convergence.

Confederation uses private AS numbers (from 64512 to 65535) for sub-ASs, and these are prepended to the AS_PATH but not shown to external peers.

OSPFv3 runs over IPv6, supports multiple instances per link, and uses link-local addresses. OSPFv2 does not have these.

1:1 detour creates a one-to-one backup LSP for each protected LSP. The detour LSP is pre-signaled and protects against link failure by re-routing traffic around the failed link.

Route reflectors allow iBGP speakers to advertise routes learned from other iBGP peers, reducing full mesh requirements, and use cluster-id and originator-id to prevent loops.

Network slicing using dedicated resources via Flex-Algo or resource reservation can guarantee performance. Flex-Algo allows IGP to compute paths based on constraints like latency, providing dedicated paths for uRLLC.

The CE can receive routes from the PE (indicating that the VRF and route-target import/export are functioning correctly), but the CE cannot ping the remote CE. This points to a failure in the data plane between the PEs. If the LSP (Label Switched Path) between the PEs is not operational, MPLS labels cannot be swapped or forwarded correctly, causing packets to be dropped even though the control plane (routing table and VRF) shows the remote prefix.

The NO_EXPORT community (well-known community 0xFFFFFF01) tells the router not to advertise the prefix to any external BGP peer (eBGP), but allows it to be advertised within the same AS (iBGP). This matches the requirement to prevent the prefix from being advertised to any external AS, as NO_EXPORT is specifically designed to keep routes confined to the local autonomous system.

OSPFv3 runs per-link instead of per-subnet, uses link-local addresses for neighbor discovery, and separates the protocol from addressing by using LSAs with IPv6 prefix information.

Checking telemetry subscription statistics on each router (e.g., using show telemetry statistics) provides per-router counters for drops, errors, and sequence gaps. This directly identifies which routers are experiencing loss. Other options are either too manual, network-wide, or do not isolate individual routers.

L1/L2 routers perform both intra-area and inter-area routing, maintaining both L1 and L2 LSDBs.

VRF (Virtual Routing and Forwarding) instances provide separate routing tables per customer, ensuring isolation in L3VPN.

E-Tree (Ethernet Tree) is a rooted-multipoint service where the root can communicate with leaves, but leaves cannot communicate with each other.

In Rosen GRE (draft-rosen) MVPN, a default MDT (Multicast Distribution Tree) is built using a shared PIM-SM group across all PEs in the VPN. All multicast traffic from any source in the VPN is encapsulated in GRE and sent to this default MDT group, meaning every PE receives the traffic regardless of whether it has any local receivers. This is the primary limitation because it wastes bandwidth and processing on PEs that do not need the traffic, unlike mLDP-based MVPN which builds trees only to PEs with receivers.

B is correct because the `send-community` command must be configured on the CE-to-PE BGP session to allow standard BGP communities (e.g., NO_EXPORT) to be propagated from the CE router into the MPLS VPN network. Without this, the PE router will strip communities from incoming BGP updates, preventing them from reaching the remote PE.

The error 'invalid policy-map structure' occurs because the policy-map references a class name that has not been defined in a class-map beforehand. In Cisco IOS, a class-map must exist before it can be used inside a policy-map; otherwise, the device rejects the configuration as structurally invalid.

WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that monitors the average queue depth and, when it exceeds a configured threshold, begins dropping packets probabilistically before the queue becomes completely full. This proactive dropping signals TCP senders to reduce their transmission rates, thereby preventing tail drop and global synchronization.

Increasing the administrative distance of IS-IS to be higher than OSPF (e.g., from 115 to 120) makes OSPF routes preferred over IS-IS routes in the routing table. Since BGP uses the IGP route to resolve its next-hop, this ensures BGP always selects the OSPF path, preventing traffic drops when the next-hop is only reachable via OSPF. This is a simple, protocol-agnostic way to control IGP preference during a migration without altering route redistribution or tunneling.