971 questions total · 13pages · All types, answers revealed
In MPLS, which operation is performed when a packet arrives at a transit router and the top label matches the router's own label assigned for the FEC?
Correct.
Why this answer
When the top label is the router's own label (often an implicit null or explicit null), the router pops the label and forwards the packet based on the next label or IP header.
An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)
TACACS+ provides secure authentication and authorization.
You are a network engineer at a service provider that offers L3VPN services. A customer complains that their VPN traffic is intermittently dropping. The network uses OSPF as the IGP, LDP for label distribution, and MP-BGP for VPNv4 route exchange. The PE routers are connected to two core routers (P1 and P2) in a redundant design. Upon investigation, you find that the BGP next-hop for some VPN prefixes is set to the loopback interface of the remote PE, but the route to that loopback is sometimes unreachable due to a flapping link between P1 and P2. The IGP converges, but the BGP prefixes take longer to recover. What is the most likely cause of the intermittent drops?
NHT allows BGP to react quickly to IGP next-hop changes.
Why this answer
The intermittent drops occur because BGP next-hop tracking (NHT) is not enabled. Without NHT, BGP relies solely on IGP convergence to detect reachability changes for the BGP next-hop (the remote PE loopback). When the link between P1 and P2 flaps, OSPF converges quickly, but BGP does not immediately re-evaluate its next-hop reachability; it waits for the next BGP scan interval (default 60 seconds) or until a BGP update is received.
This delay causes the VPN prefixes to remain installed with an unreachable next-hop, leading to traffic drops until BGP eventually withdraws or re-advertises the routes.
Exam trap
Cisco often tests the misconception that BGP automatically reacts to IGP changes instantly, when in fact without NHT, BGP relies on periodic scanning, causing a delay that leads to traffic drops during transient IGP failures.
How to eliminate wrong answers
Option A is wrong because OSPF network type set to point-to-point would affect adjacency formation and LSA flooding, but it does not directly cause BGP to delay recovery after IGP convergence; the issue is about BGP next-hop reachability timing, not OSPF network type. Option B is wrong because setting BGP timers too low (e.g., keepalive/hold timers) would cause premature session resets, not intermittent drops tied to a flapping IGP link; the problem is BGP not reacting to IGP changes, not BGP session instability. Option D is wrong because the LDP session between PEs is not required for VPNv4 route exchange; LDP is used for label distribution within the MPLS core, and the PE-to-PE LDP session is not a standard design—LDP runs between directly connected LSRs, not between PEs across the core.
An engineer wants to configure SR-TE without using RSVP. Which mechanism does SR-TE use to specify the explicit path?
SR-TE uses segment lists in SR Policies.
Why this answer
SR-TE uses a segment list consisting of Node SIDs and/or Adjacency SIDs to define the explicit path, avoiding RSVP state.
A service provider is designing a new MPLS core network and needs to choose a routing protocol that supports traffic engineering and fast convergence. Which protocol should be used?
IS-IS supports MPLS TE and provides fast convergence, making it ideal for SP core.
Why this answer
IS-IS is the correct choice because it natively supports MPLS Traffic Engineering (TE) via IS-IS TE extensions (RFC 5305) and offers fast convergence through mechanisms like IS-IS Fast Flooding and LSP throttling. Unlike OSPF, IS-IS operates directly over Layer 2, making it more scalable and robust in large service provider core networks, and it avoids the need for a separate flooding domain for TE.
Exam trap
Cisco often tests the misconception that OSPF is the only link-state protocol suitable for MPLS TE, but the trap is that IS-IS is actually the more common choice in service provider cores due to its native TE support and superior scalability in hierarchical designs.
How to eliminate wrong answers
Option A is wrong because RIP is a distance-vector protocol with slow convergence and no support for traffic engineering or MPLS TE extensions. Option B is wrong because EIGRP is a Cisco-proprietary protocol that lacks native MPLS TE support and is not designed for the hierarchical, scalable core networks required by service providers. Option C is wrong because while OSPF supports MPLS TE via OSPF TE extensions (RFC 3630), it requires a separate opaque LSA type 10 flooding domain and has higher CPU overhead for TE link-state advertisements compared to IS-IS, making IS-IS the preferred choice in many service provider designs.
A service provider is implementing BGP PIC (Prefix Independent Convergence) for its core network. Which mechanism does BGP PIC primarily rely on to achieve fast convergence?
BGP PIC precomputes and installs backup paths in FIB.
Why this answer
BGP PIC uses precomputed backup paths (e.g., via BGP PIC edge or BGP add-path) to switch traffic upon failure without waiting for BGP convergence.
A network engineer is designing a Layer 2 VPN using EVPN with MPLS data plane. The customer requires all-hub multipoint connectivity with optimal multicast replication. Which EVPN route type is used to advertise multicast group membership?
Used to advertise multicast group membership for selective replication.
Why this answer
Route Type 6 (Selective Multicast Ethernet Tag) is used in EVPN to advertise multicast group membership for selective multicast replication. This allows the provider edge (PE) routers to build optimal multicast trees for specific groups, enabling efficient all-hub multipoint connectivity with EVPN-MPLS data plane.
Exam trap
Cisco often tests the distinction between inclusive (Route Type 3) and selective (Route Type 6) multicast, and the trap here is assuming that Route Type 3 is used for all multicast scenarios, when in fact Route Type 6 is required for optimal group-specific replication.
How to eliminate wrong answers
Option A is wrong because Route Type 3 (Inclusive Multicast Ethernet Tag) advertises an inclusive multicast service, meaning all traffic is flooded to all PEs in the broadcast domain, which does not support selective or optimal multicast replication. Option B is wrong because Route Type 2 (MAC/IP Advertisement) is used to advertise MAC and IP addresses for host reachability, not multicast group membership. Option C is wrong because Route Type 4 (Ethernet Segment) is used for multi-homing scenarios to advertise Ethernet segment identifiers and redundancy group information, not multicast group membership.
Which RSVP-TE message is used to reserve resources along the path and includes the Explicit Route Object (ERO)?
Correct. The PATH message carries the ERO to specify the explicit route for the LSP.
Why this answer
The PATH message is sent from the source to the destination to request resource reservation and includes the Explicit Route Object (ERO), which specifies the path to be taken. The RESV message, sent upstream in response, includes objects like LABEL, STYLE, and RECORD_ROUTE, but not the ERO.
Exam trap
Many candidates mistakenly think RESV carries the ERO because both relate to path setup, but the ERO is only in the PATH message.
Which component in MQC is used to classify traffic based on match criteria?
Class-map is used for classification.
Why this answer
In MQC, a class-map defines the match criteria to classify traffic.
A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?
Correct. Mismatched route-target prevents the new PEs from being discovered by the existing ones, so pseudowires are not established.
Why this answer
B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.
Exam trap
Cisco often tests the distinction between BGP session establishment (which only requires neighbor configuration and address-family activation) and successful VPLS pseudowire creation (which additionally requires matching route-target import/export policies), leading candidates to incorrectly suspect BGP activation issues when the real problem is RT mismatch.
How to eliminate wrong answers
Option A is wrong because the BGP neighbor is already activated under the L2VPN address-family (the question states BGP session is established and L2VPN routes are exchanged), so the issue is not activation. Option C is wrong because an MTU mismatch between PEs would cause pseudowire status to be 'down' due to LDP or MPLS MTU negotiation failure, but the question specifies BGP autodiscovery and signaling, and MTU mismatch typically manifests as operational errors or packet drops, not a pseudowire that fails to come up solely due to RT mismatch. Option D is wrong because the VFI name is a local label on each PE and does not need to be consistent across PEs; VPLS uses the VPLS ID (or VPLS instance ID) carried in BGP, not the VFI name, to match endpoints.
An SP implements Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. For legal compliance, what additional function must be enabled to log subscriber IP-port mappings?
Logging records subscriber IP, public IP, port, and timestamps.
Why this answer
CGNAT logging is required for lawful intercept and auditing. ALG support is for application layer protocols, not logging. Port allocation is part of NAT operation.
DPI classifies traffic.
A service provider is deploying a new MPLS core network and needs a router platform that supports high-scale MPLS forwarding and offers a modular operating system. Which Cisco platform is best suited for this role?
The CRS is a core router supporting high-scale MPLS and IOS XR.
Why this answer
The Cisco CRS is a carrier-grade router designed for the core/backbone with high MPLS scalability and IOS XR modularity. ASR 9000 is more for aggregation, NCS for edge/aggregation.
In IOS XR, what is the primary purpose of the commit/rollback configuration model?
This is the core of the commit/rollback model.
Why this answer
The commit/rollback model allows changes to be applied atomically and rolled back if errors occur, ensuring configuration consistency.
Based on the exhibit, which OSPF network type is configured on this interface?
Correct as displayed.
Why this answer
The OSPF network type is determined by the interface configuration. The 'ip ospf network point-to-point' command explicitly sets the interface to point-to-point mode, which eliminates the need for DR/BDR election and uses multicast hello packets (224.0.0.5) to neighbors. This is the correct answer because the exhibit shows this exact configuration.
Exam trap
Cisco often tests the distinction between default OSPF network types (e.g., Broadcast on Ethernet, Non-Broadcast on Frame Relay) and the explicit 'ip ospf network' command, tricking candidates into assuming the default type applies even when the configuration overrides it.
How to eliminate wrong answers
Option A is wrong because Non-Broadcast (NBMA) mode requires manual neighbor configuration and uses unicast hellos, but the exhibit shows no neighbor statements and the interface is configured as point-to-point. Option C is wrong because Broadcast mode requires DR/BDR election and uses multicast hellos (224.0.0.5 and 224.0.0.6), but the point-to-point command overrides this default behavior. Option D is wrong because Point-to-Multipoint mode treats all neighbors as endpoints without DR/BDR, but it requires the 'ip ospf network point-to-multipoint' command, which is not present in the exhibit.
What is the main benefit of using Q-in-Q (802.1ad) in metro Ethernet networks?
Q-in-Q expands VLAN space.
Why this answer
Q-in-Q allows multiple customer VLANs to be encapsulated within a service provider VLAN, increasing scalability.
An SP engineer is implementing LLQ on a PE router to prioritize voice. Which additional configuration is recommended to prevent voice traffic from starving other queues?
Policing within LLQ is recommended to protect other classes.
Why this answer
Policing within the LLQ class limits the amount of traffic that can use the priority queue, preventing starvation.
A service provider uses BGP to exchange routes with customers. To prevent the customer from announcing prefixes they do not own (BGP hijacking), which tool should the provider apply on the customer-facing BGP session?
This explicitly permits only customer-owned prefixes.
Why this answer
Prefix-lists and route-maps are used to filter incoming BGP advertisements based on prefix and attributes. RPKI validates origin but requires ROA; BGP GSHUT is for maintenance; communities are for tagging.
In OSPFv3, which of the following is true about the protocol's operation?
OSPFv3 adjacencies are formed over links, not IP subnets.
Why this answer
OSPFv3 runs per-link, not per-subnet; it uses link-local addresses for adjacencies and floods LSA types specific to IPv6.
A customer's MPLS L3VPN has two CE routers connected to two different PEs, but the PEs are not receiving the customer's routes from each other. The PE-CE routing protocol is OSPF. The PEs have the VRF configured with OSPF process, and the routes from CE are in the VRF routing table. The MP-BGP session between PEs is up and the VPNv4 address family is working. On the source PE, the routes show as not advertised to BGP. What is the likely issue?
Correct. The 'redistribute ospf process-id' command under the VRF address-family is missing, so OSPF routes are not injected into MP-BGP.
Why this answer
In an MPLS L3VPN with OSPF as the PE-CE protocol, the VRF OSPF process must be explicitly redistributed into the MP-BGP VPNv4 address family using the `redistribute ospf <process-id> match internal external` command under the VRF address-family IPv4. Without this redistribution, the OSPF routes learned from the CE remain in the VRF routing table but are never injected into BGP, so they are not advertised to the remote PE, even though the MP-BGP session is up and the VPNv4 address family is working.
How to eliminate wrong answers
Option A is wrong because if the route-target export on the source PE did not match the import on the remote PE, the routes would be advertised to BGP (they would show as advertised) but would not be installed on the remote PE; the question states the routes show as 'not advertised to BGP', so the issue is before BGP advertisement. Option B is wrong because the OSPF network type does not affect whether routes are redistributed into BGP; it only influences neighbor discovery and DR/BDR election, and the PE-CE adjacency is already established since routes are in the VRF table. Option D is wrong because `next-hop-self` is a BGP configuration (applied under the VRF address-family or BGP neighbor) that modifies the next-hop attribute in BGP updates, not an OSPF command; it does not control whether routes are advertised to BGP in the first place.
A service provider is implementing Segment Routing over IPv6 (SRv6) in their core. They want to provide path isolation for different services using SRv6 SIDs. Which SID structure is used to encode both the locator and the function?
SRv6 SID is structured as Locator:Function:Args.
Why this answer
In SRv6, the SID is encoded as a 128-bit IPv6 address that is explicitly divided into three parts: the Locator (identifies the node or prefix), the Function (identifies the specific behavior or instruction), and optionally Arguments (additional parameters). This structure allows path isolation by assigning unique locator/function combinations per service, enabling per-service steering without additional label stacks.
Exam trap
The trap here is that candidates confuse SRv6 with MPLS-based Segment Routing, assuming a separate label stack is needed for function encoding, when in fact SRv6 embeds everything into the IPv6 address itself.
How to eliminate wrong answers
Option B is wrong because SRv6 does not use a separate label stack; the function is encoded directly within the IPv6 address, not in a separate MPLS label stack. Option C is wrong because an SRv6 SID is not a plain IPv6 address without encoding; it has a structured format with locator, function, and optional arguments as defined in RFC 8986. Option D is wrong because the SID is not just a prefix; it includes the function and optional arguments to specify the forwarding behavior, not merely a network prefix.
Edge devices classify and mark packets with DSCP.
Why this answer
Which network architecture model separates the control plane and data plane in a way that allows for centralized control and distributed forwarding?
SDN centralizes control while keeping forwarding distributed.
Why this answer
Software-Defined Networking (SDN) architecture explicitly separates the control plane from the data plane, centralizing network intelligence in a controller while leaving packet forwarding to distributed switches and routers. This decoupling enables programmatic, centralized control of the network, with the controller (e.g., OpenDaylight, Cisco APIC) making forwarding decisions and pushing flow entries to devices via protocols like OpenFlow or OpFlex. The result is a logically centralized brain with physically distributed forwarding, which is the defining characteristic of SDN.
How to eliminate wrong answers
Option B is wrong because MPLS architecture does not separate the control and data planes for centralized control; instead, it uses a distributed control plane (e.g., LDP, RSVP-TE) where each router independently builds its label forwarding table, and forwarding is still distributed. Option C is wrong because VPN architecture (e.g., MPLS Layer 3 VPN) relies on a distributed control plane using MP-BGP to exchange VPN routes, with each PE router making independent forwarding decisions; it does not centralize control. Option D is wrong because QoS architecture is a set of mechanisms (e.g., classification, policing, shaping) that operate within the data plane and control plane of existing devices, but it does not fundamentally separate the two planes for centralized control.
In an MPLS-based service provider core network, the aggregation layer typically connects to the core backbone. Which technology is primarily used at the aggregation layer to scale Ethernet services for many customers while preserving VLAN separation?
Q-in-Q double-tags Ethernet frames to scale VLANs per customer.
Why this answer
Q-in-Q (802.1ad) allows service providers to stack a customer VLAN tag on top of a service VLAN tag, enabling scalable customer separation in metro Ethernet networks.
Which OSPF area type can import external routes as Type 7 LSAs?
NSSA allows external routes as Type 7 LSAs.
Why this answer
NSSA (Not-So-Stubby Area) allows the import of external routes as Type 7 LSAs, which are translated to Type 5 at the ABR.
Which THREE of the following are required components for implementing MPLS Layer 3 VPN (L3VPN) in a service provider network? (Choose three.)
MP-BGP between PE routers is mandatory for MPLS L3VPN because it carries VPNv4 routes that include both the IPv4 prefix and the Route Distinguisher, enabling unique global identification of overlapping customer address spaces. This satisfies the requirement for a control-plane protocol that can separate and distribute per-VPN routing information across the provider backbone.
Why this answer
MP-BGP (Multiprotocol BGP) is essential for carrying VPNv4 routes between PE routers. It uses address family VPNv4 to transport customer IPv4 prefixes along with their Route Distinguisher (RD) and Route Target (RT) attributes, enabling the separation and distribution of multiple customer VPNs across the MPLS core.
Exam trap
Cisco often tests the misconception that P routers require VRF configuration or that IBGP is used for label distribution between PE and P routers, when in fact P routers only need MPLS forwarding and LDP for label exchange.
A service provider wants to mitigate DDoS attacks by blackholing traffic destined to a victim IP address. They plan to use Remotely Triggered Black Hole (RTBH) filtering. What BGP community is commonly used to trigger the blackhole route?
Community 666 is a commonly used standard for RTBH to trigger null routing.
Why this answer
RTBH works by advertising a /32 route with a specific community (often 666 or a locally defined one) that causes the router to forward traffic to a null interface. The well-known community for RTBH is often 666 or custom.
Which LDP mode uses downstream unsolicited label distribution and liberal label retention?
This is the default LDP mode.
Why this answer
Downstream unsolicited (DU) label distribution is the default mode in LDP, where each LSR advertises labels for all its directly connected prefixes to its neighbors without waiting for a request. Liberal label retention means the LSR stores all received label bindings, even if they are not currently used for forwarding, which enables rapid convergence upon topology changes.
Exam trap
Cisco often tests the distinction between label distribution modes (DU vs. DoD) and label retention modes (liberal vs. conservative), and candidates may confuse 'downstream unsolicited' with 'upstream unsolicited' or incorrectly associate liberal retention with DoD mode.
How to eliminate wrong answers
Option A is wrong because downstream on demand (DoD) mode requires an explicit label request from an upstream neighbor before a label is advertised, which is the opposite of unsolicited distribution. Option C is wrong because LDP does not use an 'upstream unsolicited' mode; label distribution is always from the downstream LSR to the upstream LSR. Option D is wrong because conservative label retention discards label bindings that are not currently used for forwarding, which contradicts the liberal retention specified in the question.
Which TWO are correct about network slicing? (Choose two.)
Correct. Slices provide resource isolation.
Why this answer
Network slicing divides a physical network into multiple virtual networks, each with dedicated resources. Slices can be tailored for specific services like eMBB, uRLLC, mMTC. They are not limited to 5G core but also include transport.
Which TWO statements about IOS XR architecture are correct? (Choose two.)
Correct. Process separation enhances stability.
Why this answer
IOS XR uses distributed OS with process separation, and a commit/rollback model for configuration. It does not have a monolithic kernel; each protocol is a separate process. The admin plane is separate from SDRs.
Refer to the exhibit. Which statement about this BGP configuration is true?
Next-hop-self is used to set the local router as next-hop.
Why this answer
The `next-hop-self` command under the VRF address-family instructs the PE router to set its own IP address as the next-hop for routes advertised to the route reflector. This is necessary in MPLS L3VPN environments to ensure that the route reflector (and other PEs) can reach the customer prefix via the advertising PE, avoiding reachability issues when the original next-hop is not directly connected across the MPLS core.
Exam trap
Cisco often tests the misconception that `next-hop-self` is only needed for eBGP peers, but in MPLS L3VPN it is essential for iBGP sessions to route reflectors to ensure correct next-hop reachability across the core.
How to eliminate wrong answers
Option A is wrong because the `no synchronization` command is valid under `address-family ipv4 vrf`; BGP synchronization is disabled by default in modern IOS versions and is not required for VRF configurations. Option C is wrong because the `send-community extended` command is required for the VPNv4 address family (or under the VRF) to propagate extended communities (e.g., RTs) necessary for MPLS L3VPN operation, not just for IPv4 unicast. Option D is wrong because the `redistribute ospf` command under the VRF address-family imports OSPF routes into the BGP VRF table, making them available for redistribution into BGP VPNv4 routes; the routes are indeed imported into BGP, not excluded.
A service provider is running OSPF in their core network. After a link failure, routing convergence is taking longer than expected. The engineer suspects the issue is related to the SPF calculation. Which OSPF feature can reduce the SPF calculation time?
Reduces SPF computation by recalculating only changed parts.
Why this answer
Incremental SPF (iSPF) reduces SPF calculation time by recalculating only the affected portion of the Shortest Path Tree (SPT) after a topology change, rather than recomputing the entire tree. This is especially beneficial in large OSPF networks where full SPF runs are CPU-intensive and slow convergence.
Exam trap
Cisco often tests the distinction between fast failure detection (BFD) and fast SPF calculation (iSPF), leading candidates to mistakenly choose BFD when the question specifically asks about reducing SPF calculation time.
How to eliminate wrong answers
Option A is wrong because OSPF database overload protection is a mechanism to limit the number of LSAs in the database to prevent memory exhaustion, not to speed up SPF calculation. Option B is wrong because Bidirectional Forwarding Detection (BFD) provides fast link failure detection but does not reduce the SPF calculation time itself; it only triggers the SPF process sooner. Option D is wrong because LSA pacing timers control the rate at which LSAs are generated and flooded, which can reduce network churn but do not directly reduce the time required for SPF computation.
A service provider wants to enable fast convergence for OSPF networks. Which feature should be enabled to detect link failures in sub-second time?
BFD provides sub-second failure detection.
Why this answer
BFD (Bidirectional Forwarding Detection) provides fast failure detection for routing protocols like OSPF. OSPF can be configured to use BFD for sub-second convergence.
Refer to the exhibit. Which prerequisite for MPLS L3VPN is missing on PE1?
No `ip vrf` definition or VRF applied to any interface.
Why this answer
The exhibit shows that PE1 has an interface configured with an IP address and MPLS enabled, but no VRF definition is present. For MPLS L3VPN, a VRF must be defined on the PE router to separate customer routing tables and to associate the customer-facing interface with that VRF. Without the VRF, the PE cannot import/export VPN routes or maintain per-VPN routing instances, which is a fundamental prerequisite for L3VPN operation.
Exam trap
Cisco often tests the misconception that MPLS or LDP configuration alone is sufficient for L3VPN, when in fact the VRF definition is the mandatory first step that candidates overlook.
How to eliminate wrong answers
Option A is wrong because the exhibit shows 'mpls ip' under the interface, indicating MPLS is already enabled on that interface. Option B is wrong because LDP is enabled globally as shown by 'mpls ldp router-id' and 'mpls ldp' in the global configuration, and LDP is not a prerequisite for L3VPN (though it is commonly used for label distribution). Option D is wrong because OSPF redistribution into BGP is a configuration step for propagating routes within the VPN, not a prerequisite; the VRF must exist first before any redistribution can be applied.
Which SRv6 endpoint behavior is used for L3VPN decapsulation and IP forwarding to the destination in a VRF?
Correct. End.DT4 decapsulates and does IPv4 VRF lookup.
Why this answer
End.DT4 is the correct SRv6 endpoint behavior for L3VPN decapsulation and IP forwarding to the destination in a VRF. It removes the outer IPv6 header and SRH, then performs a lookup in the specified VRF IPv4 routing table to forward the inner IPv4 packet. This behavior is defined in RFC 8986 and is the direct SRv6 equivalent of the MPLS-based per-VRF label allocation for L3VPN.
Exam trap
Cisco often tests the distinction between endpoint behaviors by using similar acronyms (e.g., End.DT2U vs End.DT4) to confuse candidates who may not recall that '2U' refers to Layer 2 unicast and '4' refers to IPv4 VRF forwarding.
How to eliminate wrong answers
Option A is wrong because End.DT2U is used for L2VPN decapsulation and unicast MAC forwarding to a bridge domain, not for L3VPN IP forwarding in a VRF. Option B is wrong because End (without any flavor) performs simple decapsulation and IPv6 forwarding based on the destination address in the inner IPv6 header, not VRF-based IPv4 forwarding. Option C is wrong because End.X is used for decapsulation and forwarding to a specific neighbor via a Layer 3 interface, often with a next-hop address, but it does not involve VRF lookup for L3VPN.
A service provider is designing a Layer 2 MPLS VPN to connect multiple customer sites. Which technology should be used to provide end-to-end Ethernet service with MAC address transparency and support for multiple customer VLANs?
VPLS provides multipoint Ethernet services with MAC address transparency and supports multiple VLANs via QinQ or VLAN mapping.
Why this answer
VPLS (Virtual Private LAN Service) is the correct choice because it emulates an Ethernet bridge across an MPLS core, providing MAC address transparency and supporting multiple customer VLANs through a multipoint-to-multipoint topology. Unlike point-to-point services, VPLS learns MAC addresses and forwards frames based on them, enabling end-to-end Ethernet service across distributed sites.
Exam trap
Cisco often tests the distinction between point-to-point (VPWS) and multipoint (VPLS) services, and candidates mistakenly choose VPWS when the question explicitly requires connecting multiple sites with MAC transparency.
How to eliminate wrong answers
Option A is wrong because MPLS Traffic Engineering (MPLS TE) is a mechanism for optimizing traffic paths based on bandwidth and constraints, not for providing Layer 2 Ethernet services with MAC transparency. Option C is wrong because VPWS (Virtual Private Wire Service) offers only point-to-point Ethernet connections, lacking the multipoint capability and MAC learning required for connecting multiple sites with VLAN transparency. Option D is wrong because RSVP-TE is a signaling protocol used for MPLS label distribution and traffic engineering, not a Layer 2 VPN service technology.
A service provider is deploying segment routing in its MPLS core. Which label allocation method is used by segment routing to distribute prefix SIDs?
Segment routing encodes prefix SIDs in IGP updates.
Why this answer
Segment routing uses the IGP (IS-IS or OSPF) to distribute prefix SIDs. The IGP extensions for segment routing (RFC 8665 for OSPF, RFC 8667 for IS-IS) carry the prefix SID sub-TLV within the prefix reachability information, allowing each router to allocate and advertise the SID associated with a prefix. This is the native label allocation method for segment routing, as it leverages the existing IGP database without requiring a separate label distribution protocol.
Exam trap
Cisco often tests the misconception that segment routing requires a separate label distribution protocol like LDP or RSVP-TE, but the trap here is that segment routing uses the IGP itself to distribute prefix SIDs, making it a control-plane-less label distribution method.
How to eliminate wrong answers
Option A is wrong because LDP (Label Distribution Protocol) is a separate label distribution protocol used in traditional MPLS, but segment routing eliminates the need for LDP by encoding labels directly in the IGP. Option B is wrong because BGP is used for distributing VPN labels or inter-domain prefix SIDs (e.g., BGP-LU), but not for allocating prefix SIDs within a single IGP domain. Option C is wrong because RSVP-TE is a signaling protocol for traffic engineering that establishes explicit LSPs with resource reservations, whereas segment routing uses source-routed paths without signaling.
An ISP is implementing 6PE for IPv6 transport over MPLS. Which two conditions are required for 6PE to work? (Choose two.)
BGP must carry IPv6 address family.
Why this answer
6PE requires BGP to carry IPv6 prefixes with an IPv4 next-hop (MPLS label), and the core MPLS network must support IPv4 LSPs.
Even with policy-map compiled, without attaching it to the interface, no action occurs.
Why this answer
On IOS XR routers, QoS policies require explicit feature enablement via the 'qos' command under the interface configuration, and the policy-map must be attached in the correct direction. Without the 'qos' feature enabled, the router will compile the policy but silently ignore it, resulting in no re-marking of DSCP from AF11 to AF22.
Exam trap
Cisco often tests the IOS XR-specific requirement to explicitly enable the 'qos' feature on an interface, which catches candidates accustomed to classic IOS where policy-map attachment alone enables QoS.
How to eliminate wrong answers
Option A is wrong because ACLs on IOS XR can match on DSCP values using the 'ip dscp' keyword within the access-list entries, so this is not a limitation. Option B is wrong because while applying the ACL to the wrong interface could cause traffic to not match, the question states the policy compiles successfully and traffic is not re-marked, implying the ACL is correctly placed but the QoS feature itself is not operational. Option D is wrong because marking can be performed on both ingress and egress directions in IOS XR; the statement that marking can only be done on ingress is incorrect, as egress marking is supported and commonly used.
A network administrator is designing an MPLS TE tunnel for a service provider backbone. The goal is to provide bandwidth protection for voice traffic. Which MPLS TE feature should be configured?
FRR provides backup LSPs to protect against link or node failures.
Why this answer
MPLS TE Fast Reroute (FRR) provides sub-50 ms protection against link or node failures by pre-computing and pre-signaling a backup tunnel that bypasses the protected element. This meets the requirement for bandwidth protection of voice traffic, which is sensitive to packet loss and delay during network convergence.
Exam trap
Cisco often tests the distinction between features that provide path selection (Path-option) or traffic steering (Autoroute announce) versus features that provide actual failure protection (FRR), leading candidates to confuse 'bandwidth protection' as a separate feature rather than a benefit of FRR.
How to eliminate wrong answers
Option A is wrong because Autoroute announce is used to automatically inject the TE tunnel's destination into the IGP routing table, enabling traffic to be routed into the tunnel without explicit static routes; it does not provide any failure protection. Option B is wrong because Path-option defines the explicit or dynamic path for the primary TE tunnel but does not create a backup path or offer fast failover. Option D is wrong because 'Bandwidth protection' is not a standalone MPLS TE feature; it is a capability provided by FRR (specifically link or node protection) and is not a configurable command or feature name in Cisco IOS XR or classic IOS.
In an MPLS network using LDP, which LDP mode allocates a label for every prefix in the routing table and advertises it to all LDP neighbors, regardless of whether the neighbor requests it?
This is the default mode in Cisco IOS.
Why this answer
Downstream unsolicited (DU) mode means a router advertises labels for all its prefixes to all neighbors without waiting for a request.
An engineer is configuring an MPLS Traffic Engineering tunnel using RSVP-TE. The tunnel is intended to carry voice traffic with strict delay requirements. Which RSVP-TE object should be used to enforce a maximum delay path?
This allows CSPF to use delay as the metric for path computation.
Why this answer
The 'path-option with metric delay' command instructs RSVP-TE to compute a path that minimizes cumulative delay rather than IGP cost or hop count. This directly enforces a maximum delay constraint for voice traffic by selecting the path with the lowest measured or configured delay metric across the MPLS network.
Exam trap
Cisco often tests the distinction between path selection tools (like metric types) and path recording or protection mechanisms, leading candidates to confuse 'record-route' or 'fast-reroute' with delay enforcement.
How to eliminate wrong answers
Option A is wrong because 'record-route' merely logs the actual path taken by the tunnel for troubleshooting or loop detection; it does not influence path selection or enforce delay constraints. Option B is wrong because 'fast-reroute' provides local protection against link or node failures by pre-signaling backup tunnels, but it does not impose a delay requirement on the primary path. Option C is wrong because manually specifying an explicit-path (ERO) forces a fixed sequence of hops, which may not be the lowest-delay path and requires static engineering; it does not dynamically enforce a delay metric.
A service provider is implementing RPKI to validate BGP routes. Which THREE components are necessary for a complete RPKI deployment on routers? (Choose three)
Correct. The RPKI cache server (Relying Party) aggregates ROAs and serves validated prefix-to-AS mappings (VRP) to routers.
Why this answer
RPKI requires three components: Route Origin Authorization (ROA) records created by RIRs to authorize AS origins, an RPKI cache server (Relying Party) that collects ROAs and validates them, and the BGP Origin Validation feature on routers that uses the Relying Party's VRP data to filter invalid routes. The cache server communicates with routers via RTR protocol. Components like prefix-lists or local preference manipulation are not part of RPKI itself.
In Segment Routing over IPv6 (SRv6), what is the function of the 'Locator' part of an SRv6 SID?
Correct: The locator is routable and identifies the node.
Why this answer
The Locator is the portion of the SRv6 SID that identifies the node (or the segment endpoint) and is used for routing to that node.
Which TWO statements correctly describe RSVP-TE reservation styles? (Choose two.)
SE style uses explicit filters but allows sharing.
Why this answer
Shared Explicit (SE) allows sharing among senders with different selectors, and Fixed Filter (FF) creates distinct reservations per sender.
A service provider operates a large MPLS network with hundreds of PE routers. They have deployed QoS policies to ensure real-time traffic (voice and video) receives priority. The policy uses LLQ with a strict priority queue for voice (DSCP EF) and another for video (DSCP AF41). Each priority queue has a policer to prevent starvation of other classes. Recently, a customer reports that their video calls are experiencing jitter and packet loss. The engineer examines the PE router connected to this customer. The interface is GigabitEthernet0/0/1 with the policy applied in the output direction. Show commands indicate that the video priority queue is frequently dropping packets, while the voice queue has no drops. The police for the video queue is set to 10 Mbps. The customer's contract guarantees 20 Mbps for video traffic. However, the actual video traffic is averaging 15 Mbps with bursts to 18 Mbps. The engineer notes that the video class also has a bandwidth command of 10 Mbps under the priority statement. What is the most likely cause of the video packet loss?
The policer drops traffic exceeding 10 Mbps, causing loss for 15-18 Mbps traffic.
Why this answer
The video priority queue is dropping packets because the police rate (10 Mbps) is lower than the actual traffic rate (15 Mbps average, bursts to 18 Mbps). In LLQ, the priority queue uses a policer to enforce a maximum rate; traffic exceeding the police rate is dropped. The bandwidth command under priority only reserves bandwidth for the queue in the absence of congestion or for shaping purposes, but the policer is the active enforcement mechanism that causes drops.
Increasing the police rate to at least 20 Mbps aligns with the customer's guaranteed rate and prevents drops.
Exam trap
Cisco often tests the distinction between the bandwidth command (which reserves bandwidth for CBWFQ) and the policer rate (which enforces a hard limit on priority traffic), leading candidates to mistakenly think increasing bandwidth will solve the drops.
How to eliminate wrong answers
Option A is wrong because the bandwidth command under priority in LLQ does not directly limit the queue's throughput; it is used for CBWFQ bandwidth allocation and does not affect the policer's drop behavior. Option B is wrong because queue limit (tail-drop threshold) is not the cause; the drops are due to the policer exceeding its configured rate, not due to buffer exhaustion. Option C is wrong because the question states the video traffic is classified as DSCP AF41 and is being placed into the correct priority queue (drops are occurring in that queue), so classification is working correctly.
An SP is using Cisco ASR 9000 routers with IOS XR. They need to apply a configuration change and ensure that if the change causes issues, it can be easily reverted. Which IOS XR feature supports this?
Correct. The commit/rollback model allows safe configuration changes.
Why this answer
IOS XR uses a commit/rollback configuration model. Changes are staged in a candidate configuration and committed; if issues arise, rollback to a previous commit is possible.
A service provider is designing a new MPLS core network and wants to simplify traffic engineering without deploying a centralized controller. Which technology should be used to enable source-routed paths with explicit path control?
SR-MPLS enables source routing with segment lists, supporting traffic engineering without a controller.
Why this answer
Segment Routing (SR-MPLS) enables source-routed paths with explicit path control by encoding the path as a list of segment identifiers (SIDs) in the packet header, allowing the ingress router to steer traffic along a specific path without a centralized controller. This simplifies traffic engineering in an MPLS core network by eliminating the need for per-flow signaling and state maintenance on intermediate nodes, which is exactly what the question requires.
Exam trap
Cisco often tests the misconception that RSVP-TE is the only way to achieve explicit path control, but the trap here is that RSVP-TE requires per-flow state and signaling, while Segment Routing provides source-routed paths without a centralized controller or per-node state.
How to eliminate wrong answers
Option A (BGP-LU) is wrong because BGP-LU is used for distributing MPLS labels for IPv4/IPv6 prefixes across BGP peers, not for source-routed path control or explicit traffic engineering; it lacks the ability to encode a path as a segment list. Option B (LDP) is wrong because LDP is a label distribution protocol that creates hop-by-hop label-switched paths based on IGP routing, without any explicit path control or source-routing capability; it cannot enforce a specific path beyond what the IGP provides. Option C (RSVP-TE) is wrong because while RSVP-TE does provide explicit path control through signaling, it requires a centralized controller or per-path configuration on each router, and it maintains per-flow state on every intermediate node, which contradicts the goal of simplifying traffic engineering without a centralized controller.
Match each Ethernet OAM protocol to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Connectivity Fault Management for end-to-end Ethernet OAM
Performance monitoring including delay and loss measurement
Ethernet in the First Mile OAM for link-level monitoring
Link Aggregation Control Protocol for bundling links
Link Layer Discovery Protocol for neighbor discovery
Why these pairings
These are Ethernet OAM and management protocols used in service provider access.
Which Cisco platform is best suited for the core/backbone role of a large service provider network, offering high scalability and MPLS forwarding capacity?
CRS is a high-end core router.
Why this answer
Cisco CRS (Carrier Routing System) is designed for the core with high capacity and MPLS capabilities.
Which component of SRv6 SID format is used to identify the specific function (e.g., End, End.X) on the node?
Correct: Function identifies the behavior.
Why this answer
The SRv6 SID is structured as Locator:Function:Argument. The Function part identifies the specific behavior to be executed on the node, such as End or End.X.
An SR-TE policy is configured with a candidate path containing multiple segment lists. Which selection criteria is used to choose the active segment list among the candidate paths?
The candidate path with highest preference is selected.
Why this answer
The preference value (or priority) is used to select the best candidate path; higher preference wins.
A Cisco XR router is configured to stream telemetry via gRPC with TLS. The collector can connect but receives empty data. The telemetry configuration is as follows: sensor-group with 'openconfig-interfaces' paths. What is the likely cause?
An unsupported YANG path results in an empty subscription; the device may not implement openconfig-interfaces.
Why this answer
The collector can establish a gRPC-TLS connection but receives empty data because the sensor-group path 'openconfig-interfaces' is not supported on the Cisco XR router. Cisco IOS XR supports OpenConfig paths only if the corresponding YANG models are loaded and the device implements those models; if the path is unsupported, the router will accept the subscription but send no telemetry data for that path. This is a common misconfiguration when using gRPC telemetry with OpenConfig models on platforms that may not fully support all OpenConfig paths.
How to eliminate wrong answers
Option A is wrong because CPU overload would cause delayed or dropped telemetry messages, not consistently empty data with a successful connection. Option C is wrong because the collector connects successfully via gRPC with TLS, proving TLS support is present. Option D is wrong because a short telemetry interval would produce frequent data updates, not empty data; empty data indicates no data is generated for the subscribed path.
Option E is wrong because the 'encoding' configuration (e.g., JSON or GPB) is optional in gRPC telemetry; the default encoding is used if omitted, and missing it does not cause empty data—it would still send data in the default format.
An SP engineer is configuring IS-IS on a router and specifies a NET address of 49.0001.1921.6800.1001.00. What does the '00' at the end represent?
SEL identifies the network service user; 00 is for the routing protocol.
Why this answer
The last two octets of an IS-IS NET address represent the SEL (NSAP Selector), which is always 00 for a router.
Which Cisco SP router platform runs IOS XR and is designed for the aggregation layer with high-density 10GE/100GE interfaces?
ASR 9000 is the correct aggregation platform.
Why this answer
The Cisco ASR 9000 series is optimized for the aggregation layer with dense 10GE/100GE ports and runs IOS XR.
Which protocol is typically used to distribute MPLS labels between directly connected LSRs?
LDP is specifically designed to distribute labels for MPLS forwarding.
Why this answer
LDP (Label Distribution Protocol) is the standard protocol used to distribute MPLS labels between directly connected LSRs (Label Switch Routers) in a non-traffic-engineered MPLS network. It operates by establishing LDP sessions over TCP (port 646) and exchanging label mappings for each FEC (Forwarding Equivalence Class) based on the underlying IGP routing table, enabling hop-by-hop label switching without requiring explicit path setup.
How to eliminate wrong answers
Option B (RSVP) is wrong because RSVP is used for traffic engineering (RSVP-TE) to reserve bandwidth and establish explicit paths, not for basic label distribution between directly connected LSRs; it requires signaling of path and reservation messages and is more complex than LDP. Option C (BGP) is wrong because BGP distributes labels for VPN or inter-AS MPLS services (e.g., labeled unicast or VPNv4 routes) but does not handle label distribution for directly connected LSRs in the core; it relies on LDP or RSVP-TE for the underlying LSP. Option D (OSPF) is wrong because OSPF is an IGP that distributes routing information, not labels; while OSPF can carry opaque LSAs for traffic engineering (OSPF-TE), it does not perform label distribution itself.
Which TWO actions are required to implement QoS trust boundaries correctly in a service provider network?
Classification marks packets at the edge, defining the trust boundary.
Why this answer
Classification must be performed at the network edge to establish the trust boundary and enforce QoS policies. Option D is correct because setting trust to CoS on access ports allows the switch to accept the priority markings from trusted devices like IP phones or routers, which is essential for maintaining the trust boundary. Option B is incorrect because Auto QoS is not a mandatory requirement for trust boundaries; it is an optional feature that automates QoS configuration.
Option C is incorrect because shaping is applied at customer premises and is not directly related to trust boundary implementation. Option E is incorrect because MPLS EXP bits are used for core marking, not for configuring trust boundaries at the access layer.
In a CBWFQ policy with LLQ, which statement is true regarding the bandwidth command for non-priority classes?
Total bandwidth allocated must not exceed 100% of the interface bandwidth (after LLQ).
Why this answer
The bandwidth command can specify a percentage or absolute bandwidth, but the sum must not exceed the available bandwidth (interface bandwidth minus LLQ).
Which THREE QoS mechanisms can be used for traffic policing?
This is another common policing implementation.
Why this answer
Traffic policing uses token bucket mechanisms to measure and enforce traffic rates. Dual-rate three-color (RFC 2698) uses two token buckets (CIR/PIR) to mark packets as green, yellow, or red, allowing separate policing of committed and peak rates. Single-rate two-color (RFC 2697) uses one token bucket to mark packets as either conforming (green) or exceeding (red).
Both are standard policing implementations.
Exam trap
Cisco often tests the distinction between policing and shaping, where candidates mistakenly select shaping as a policing mechanism because both control traffic rates, but shaping buffers while policing drops/re-marks.
An engineer is configuring MPLS-TE FRR for link protection. Which of the following options describes a 1:1 protection scheme where a dedicated detour LSP is created for each protected LSP?
Correct. 1:1 detour is per-LSP.
Why this answer
In MPLS-TE Fast Reroute (FRR), a 1:1 protection scheme means a dedicated detour LSP is created for each protected LSP. This provides per-LSP backup, ensuring that if a link fails, traffic is immediately switched to the detour tunnel. Option C correctly describes this exact mechanism, where each protected LSP has its own pre-established detour path.
Exam trap
Cisco often tests the distinction between 1:1 (detour LSP) and 1:N (bypass tunnel) protection schemes, and the trap here is that candidates confuse 'bypass tunnel protecting multiple LSPs' (facility backup) with a dedicated detour, or assume 'node protection' is the same as link protection.
How to eliminate wrong answers
Option A is wrong because shared mesh protection is a recovery mechanism where multiple LSPs share a pool of backup resources, not a 1:1 dedicated detour per LSP. Option B is wrong because a bypass tunnel protecting multiple LSPs is a facility backup (1:N) scheme, where a single bypass tunnel protects many LSPs over a common link or node, not a dedicated detour per LSP. Option D is wrong because node protection bypass tunnel protects against a node failure, not a link failure, and it is a facility backup (1:N) scheme, not a 1:1 detour per LSP.
In the context of YANG modeling for network automation, which statement about 'must' expressions is true?
'must' specifies an XPath expression that must evaluate to true.
Why this answer
'must' is an XPath expression that enforces a constraint on the data; if the condition is false, validation fails.
Which component of an MPLS-TE FRR (Fast Reroute) configuration provides protection for the next-hop node by bypassing it?
Node protection protects the next-hop node.
Why this answer
Node protection uses a bypass tunnel that bypasses the protected node, while link protection only bypasses the link.
Which IS-IS metric type is required for traffic engineering and segment routing?
Wide metrics support larger values and are used for TE and segment routing.
Why this answer
IS-IS wide metrics (TLV 22 and 135) use 24-bit or 32-bit values, allowing higher link costs needed for TE. Narrow metrics are limited to 6 bits.
Which TWO access technologies are considered fiber-based solutions for service provider access networks? (Select two.)
XGS-PON is a symmetric 10G PON.
Why this answer
GPON and XGS-PON are fiber-based PON technologies.
A multicast service provider is designing an IPv4 PIM Sparse Mode (PIM-SM) network with multiple RPs. The network must support Anycast RP using MSDP. Which THREE statements are correct regarding this design?
The same IP is configured as RP on multiple routers; MSDP ensures consistency.
Why this answer
Options A, C, and E are correct. Option A: Anycast RP uses the same IP address on multiple RPs, providing redundancy and load balancing. Option C: MSDP peering is required between the anycast RPs to exchange active source information.
Option E: IGMPv3 is needed on last-hop routers to support Source-Specific Multicast (SSM) if used together with Anycast RP. Option B is incorrect: Auto-RP is not required; Anycast RP can work with static RP assignments. Option D is incorrect: MSDP is used for Anycast RP, not specifically for SSM; SSM does not require MSDP.
What is the primary difference between traffic policing and traffic shaping?
Correct description.
Why this answer
Policing drops or re-marks excess traffic; shaping buffers excess and smooths output.
Which LDP label retention mode stores all received label bindings even if they are not currently used for forwarding?
Correct: Liberal retains all bindings.
Why this answer
Liberal label retention stores all label bindings, allowing quick convergence when a path changes, while conservative retention stores only bindings from the next-hop.
What is the primary benefit of using model-driven telemetry over traditional SNMP polling for network assurance?
Push-based telemetry eliminates polling.
Why this answer
Model-driven telemetry uses a push model where network devices continuously stream structured data (e.g., YANG-encoded) to a collector, eliminating the need for periodic SNMP polling. This provides real-time visibility with minimal CPU overhead on the device, as the device itself initiates the data export based on configured subscriptions, rather than responding to repeated GET requests.
Exam trap
Cisco often tests the misconception that model-driven telemetry is primarily about security or simplicity, when the core differentiator is the shift from pull-based (SNMP) to push-based (telemetry) data collection for real-time, low-overhead streaming.
How to eliminate wrong answers
Option B is wrong because model-driven telemetry actually relies on YANG models to define the data being streamed, so it increases, not reduces, the need for YANG models. Option C is wrong because while telemetry can use secure transports like gRPC over TLS or SSH (NETCONF), the primary benefit is not security; traditional SNMPv3 also provides encryption and authentication. Option D is wrong because model-driven telemetry does not simplify device configuration; it requires additional configuration for subscriptions, destinations, and encoding (e.g., GPB, JSON), which can be more complex than enabling SNMP.
A network administrator is configuring a Cisco ASR 9000 router for MPLS L3VPN. The PE receives customer routes via eBGP from the CE. Which command is required to redistribute these routes into the VPNv4 BGP table on the PE?
The VRF address-family ipv4 unicast imports routes into the VRF, and the VPNv4 address-family enables VPNv4 BGP to carry these routes.
Why this answer
In MPLS L3VPN, customer routes learned via eBGP from the CE must be placed into the VRF's IPv4 unicast table first, and then the 'address-family vpnv4 unicast' under BGP is required to redistribute those VRF routes into the VPNv4 BGP table, which carries the route with its route distinguisher (RD) and extended community. This two-step process ensures the PE can advertise the route as a VPNv4 prefix to other PEs via MP-BGP.
Exam trap
Cisco often tests the distinction between configuring BGP within a VRF (for CE-PE eBGP) and enabling the VPNv4 address family to propagate those routes across the MPLS core, leading candidates to mistakenly think that simply configuring 'address-family ipv4 vrf CUSTOMER' is sufficient for VPNv4 redistribution.
How to eliminate wrong answers
Option B is wrong because 'address-family ipv4 vrf CUSTOMER' under BGP is used to configure BGP peering within the VRF (e.g., for eBGP with the CE), but it does not automatically redistribute those routes into the VPNv4 address family; the VPNv4 address family must be explicitly configured and the VRF routes must be injected via network statements or redistribution. Option C is wrong because entering 'vrf CUSTOMER' in the BGP process and then 'address-family ipv4 unicast' under the VRF is not a valid BGP configuration; the VRF is defined globally, and BGP uses 'address-family ipv4 vrf CUSTOMER' to handle VRF-specific BGP sessions, not a nested 'address-family ipv4 unicast' under the VRF. Option D is wrong because 'redistribute bgp 100' under the VRF's OSPF or static route configuration would redistribute BGP routes into an IGP or static routes, not into the VPNv4 BGP table; the VPNv4 table is populated by MP-BGP, not by redistribution from an IGP.
An SP network is migrating from IS-IS narrow metrics to wide metrics. What is a key advantage of using wide metrics?
Wide metrics allow larger values and TE extensions.
Why this answer
Wide metrics support values up to 2^24-1 (16,777,215) and allow Traffic Engineering (TE) metrics, unlike narrow metrics which are limited to 6 bits (max 63).
During multicast troubleshooting, the command 'show ip mroute' shows that the RPF neighbor for a particular (S,G) entry is incorrect. What is the most likely cause?
RPF check uses unicast route towards source; missing or incorrect route leads to wrong RPF neighbor.
Why this answer
The RPF (Reverse Path Forwarding) neighbor for an (S,G) entry is determined by the unicast routing table: the router expects to reach the source S via the interface and next-hop that the unicast route provides. If the unicast routing table does not have a route back to the source, the router cannot determine the correct RPF interface and neighbor, leading to an incorrect RPF neighbor in the 'show ip mroute' output. This is the most common cause of RPF failures in multicast troubleshooting.
Exam trap
Cisco often tests the misconception that multicast issues are caused by multicast-specific misconfigurations (like PIM or IGMP), when in fact the root cause is a unicast routing problem, specifically the absence of a route back to the source in the unicast routing table.
How to eliminate wrong answers
Option B is wrong because if the multicast routing protocol (e.g., PIM) were not enabled globally, the router would not have any (S,G) entries at all, not an incorrect RPF neighbor. Option C is wrong because a TTL threshold set too high on the incoming interface would cause multicast packets to be dropped due to TTL expiry, not an incorrect RPF neighbor in the mroute table. Option D is wrong because IGMP snooping is a Layer 2 switch feature that controls multicast group membership at the access layer; it does not affect the RPF neighbor calculation on a Layer 3 router.
Which TWO statements accurately describe the behavior of the QoS policy shown in the exhibit?
Bandwidth remaining percent allocates a percentage of the available bandwidth after priority queues are serviced.
Why this answer
The policy uses the 'bandwidth remaining percent' command under the video class, which allocates 30% of the remaining bandwidth after the voice class (which is in a strict priority queue) has been served. This is the standard behavior for class-based weighted fair queuing (CBWFQ) when a priority queue is present: the priority traffic is serviced first, and then the remaining bandwidth is distributed according to the 'bandwidth remaining percent' values assigned to the non-priority classes.
Exam trap
Cisco often tests the distinction between 'bandwidth' (which allocates a guaranteed minimum during congestion) and 'bandwidth remaining percent' (which allocates a percentage of leftover bandwidth after priority queues), and candidates frequently confuse 'police' with 'shape' or misinterpret a fixed police rate as a percentage of interface bandwidth.
An MPLS TE tunnel is configured with an explicit path. Which RSVP message is used by the headend to signal the path and carry the Explicit Route Object (ERO) listing the hops?
PATH carries the ERO and label request.
Why this answer
The PATH message is sent downstream from the headend and contains the ERO that specifies the explicit route.
Which SR-MPLS SID is advertised by an IS-IS router to identify a specific link and is distributed only to adjacent neighbors?
Adjacency SID is link-specific and local.
Why this answer
An Adjacency SID is a local label for a specific adjacency, distributed only to neighbors.
A service provider wants to provide point-to-point Ethernet services with strict SLAs. Which technology should they use?
VPWS/pseudowire is point-to-point.
Why this answer
VPWS (Virtual Private Wire Service) or pseudowire provides a point-to-point Ethernet connection over MPLS.
Refer to the exhibit. An engineer is troubleshooting an MPLS LDP session between two routers. The output shows that the LDP session is operational. However, MPLS labels are not being exchanged. What is the most likely cause?
In this mode, labels are only sent on request; if the peer expects unsolicited, labels may not be exchanged.
Why this answer
The exhibit shows that the LDP session is operational (state = Operational), but no labels are being exchanged. In 'downstream on demand' mode, a router does not advertise labels unless explicitly requested by an upstream neighbor via a Label Request message. Since the session is up but no labels are exchanged, this mismatch in label advertisement mode is the most likely cause.
Exam trap
The trap here is that candidates see the LDP session is 'Operational' and assume label exchange must be working, but Cisco tests the subtle distinction that session state and label advertisement are independent processes.
How to eliminate wrong answers
Option A is wrong because the LDP Ident is used to identify the label space and is bound to the router ID; the peer's addresses not being bound would prevent session establishment, not just label exchange. Option B is wrong because LDP uses TCP port 646 by default; if the TCP connection were not using port 646, the session would not be established at all. Option D is wrong because the output explicitly states the LDP session is operational, meaning it is established.
Practice 350-501 by domain
Target a specific domain to shore up weak areas.