971 questions total · 13pages · All types, answers revealed
A service provider is implementing Segment Routing in an IS-IS network. Which TLV is used to advertise the Segment Routing Global Block (SRGB)?
TLV 242 is the Router Capability TLV used for SRGB advertisement.
Why this answer
The IS-IS Router Capability TLV (242) carries sub-TLVs including the SR Capabilities sub-TLV that advertises the SRGB.
A network engineer is troubleshooting an OSPF issue in a service provider network. The network uses OSPFv2 with multiple areas. Routers in area 0 are able to ping each other, but routers in area 1 cannot reach routers in area 2. All routers are OSPF-enabled and have correct network type configurations. What is the most likely cause?
Inter-area routing must go through area 0; without proper ABRs, areas cannot exchange routes.
Why this answer
In OSPFv2, inter-area communication must traverse area 0 (the backbone). Routers in area 1 and area 2 can only reach each other if Area Border Routers (ABRs) exist between each non-backbone area and area 0, and those ABRs are correctly configured and have full adjacencies. Since area 0 routers can ping each other but area 1 and area 2 cannot, the most likely cause is a missing or misconfigured ABR on either side, preventing the exchange of Type 3 summary LSAs between the areas.
Exam trap
Cisco often tests the misconception that OSPF areas can communicate directly without the backbone, leading candidates to overlook the mandatory role of ABRs and area 0 in inter-area routing.
How to eliminate wrong answers
Option B is wrong because mismatched OSPF area IDs on routers within area 1 and area 2 would prevent them from forming adjacencies with each other, but the issue is about inter-area reachability, not intra-area connectivity; area IDs are locally significant per interface and do not need to match across different areas. Option C is wrong because BGP peering between ABRs is not required for OSPF inter-area routing; OSPF uses its own LSAs (Type 3) to propagate routes between areas, and BGP is a separate routing protocol typically used for external route exchange, not for OSPF inter-area connectivity. Option D is wrong because the question explicitly states that all routers have correct network type configurations, and a network type mismatch would prevent adjacency formation locally, not specifically cause a failure only between area 1 and area 2 while area 0 remains functional.
A service provider is implementing QoS on a PE router for customer traffic. Which tool should be used to classify traffic based on application layer information?
Correct. NBAR can classify traffic based on application signatures.
Why this answer
NBAR (Network-Based Application Recognition) is a deep packet inspection (DPI) engine within the Modular QoS CLI (MQC) that can identify applications by inspecting payloads up to Layer 7. This allows classification of traffic based on application-layer information such as HTTP, DNS, or proprietary protocols, which is exactly what the question requires.
Exam trap
Cisco often tests the distinction between classification tools (NBAR, ACLs) and QoS actions (shaping, policing), so the trap here is that candidates confuse a QoS action (like shaping or policing) with the classification mechanism itself.
How to eliminate wrong answers
Option A is wrong because an access-list (ACL) classifies traffic based on Layer 3/4 fields (IP addresses, ports, protocol numbers) and cannot inspect application-layer payloads. Option C is wrong because shaping is a QoS action that delays excess traffic to smooth output, not a classification tool. Option D is wrong because a policy-map with police is a QoS action (policing) that drops or marks traffic based on a pre-classified rate, not a method to classify traffic by application layer.
Refer to the exhibit. What is the significance of the entry with 'Pop Label'?
PHP removes the label before sending to the egress.
Why this answer
In MPLS, the 'Pop Label' entry in a forwarding table indicates the Penultimate Hop Popping (PHP) operation. PHP is a standard behavior (RFC 3031) where the penultimate router removes the MPLS label before forwarding the packet to the egress LSR, reducing the egress router's processing load. This is explicitly signaled via the 'implicit-null' label (label value 3) in LDP or RSVP-TE.
Exam trap
Cisco often tests the distinction between 'Pop Label' (PHP) and a generic label removal at the egress router, tricking candidates into thinking any label pop is the same as PHP, when in fact PHP specifically occurs at the penultimate hop.
How to eliminate wrong answers
Option A is wrong because a merge operation (e.g., in MPLS-TE or LSP merging) combines multiple incoming labels into a single outgoing label, not a pop operation. Option C is wrong because while the label is indeed removed at this router, the 'Pop Label' entry specifically denotes PHP, not a generic label removal at any hop (e.g., the egress router also removes labels but uses 'explicit-null' or no label). Option D is wrong because 'Pop Label' is a valid and intentional forwarding action, not an error condition.
Refer to the exhibit. A PE router in an MPLS L3VPN network shows the above output. The VRF CUSTOMER contains two routes. Which statement about forwarding for these routes is true?
'Pop' means implicit-null label (label 3), which is popped by the penultimate hop.
Why this answer
The output shows that for the VRF CUSTOMER, the route to 10.1.1.0/24 has a next hop of 192.168.1.2 and is associated with label 3 (implicit null). In MPLS L3VPN, label 3 instructs the upstream router to pop the MPLS label and forward the packet using IP routing to the directly connected next hop. Therefore, traffic to 10.1.1.0/24 will be label-switched with an implicit null label, meaning the label is removed before forwarding to the CE router.
Exam trap
Cisco often tests the distinction between implicit null (label 3) and explicit null (label 0), and the trap here is that candidates assume any route with a label in the VRF table is fully MPLS-switched end-to-end, not realizing that label 3 means the label is popped before the final hop.
How to eliminate wrong answers
Option A is wrong because not both routes are reachable via MPLS; the route to 10.1.1.0/24 uses implicit null (label 3), which means the MPLS label is popped before forwarding, so the packet is not MPLS-switched on the final hop. Option C is wrong because traffic to 10.2.2.0/24 will be forwarded using the BGP next hop label (label 16000), not an implicit null label; the output shows label 16000 for that route. Option D is wrong because traffic to 10.2.2.0/24 will be forwarded using MPLS label switching (label 16000), not IP routing, as indicated by the presence of a non-null label in the VRF table.
When configuring EVPN VPWS, which TWO parameters must match between the two endpoints of the pseudowire?
Correct. The EVI must match between endpoints as it defines the EVPN instance.
Why this answer
In EVPN VPWS, two parameters must match between endpoints: the EVI (Ethernet VPN Instance) must match because it defines the EVPN instance and the Route Distinguisher. The Route-target must also match because it ensures that routes are imported/exported correctly between the endpoints. The ESI (Ethernet Segment Identifier) is local to each PE and does not need to match; it identifies the local segment for split-horizon and DF election purposes.
Exam trap
A common misconception is that ESI must match, but ESI identifies the local segment and can differ. The key matching parameters are EVI and Route-target.
Refer to the exhibit. An operator configures an SR-TE policy on a headend router. Which statement is true about the traffic steered into this policy?
Explicit segment-lists define the ordered list of labels.
Why this answer
The SR-TE policy uses a segment-list with three labels (16000, 16001, 16002), which are MPLS labels assigned to prefix-SIDs for specific nodes. The headend imposes this label stack to steer traffic along the explicit path defined by the segment-list, ensuring strict source routing without relying on dynamic CSPF computation or LDP.
Exam trap
Cisco often tests the distinction between explicit segment-lists (which require manual label configuration) and dynamic path computation (CSPF), leading candidates to mistakenly assume CSPF is always used in SR-TE policies.
How to eliminate wrong answers
Option A is wrong because the segment-list consists of prefix-SIDs (labels 16000, 16001, 16002), not adjacency-SIDs; adjacency-SIDs are typically local and used for link-level forwarding, not for node-to-node path segments. Option B is wrong because the path is explicitly defined by the segment-list, not automatically computed using CSPF; SR-TE policies can use explicit paths or dynamic paths, but the exhibit shows an explicit segment-list. Option C is wrong because traffic is forwarded using MPLS labels from the segment-list (prefix-SIDs), not LDP labels; SR-TE uses segment routing labels, and LDP is not involved unless interworking is configured.
VRF maintains separate routing and forwarding tables per VPN.
An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?
The well-known community GRACEFUL_SHUTDOWN (65535:0) triggers graceful shutdown.
Why this answer
BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.
A large enterprise recently implemented centralized QoS policies using Cisco DNA Center. The policies are pushed via RESTCONF to the branch routers. After the deployment, the branch office reports that critical business applications (like ERP) are being delayed. The network team verifies that the QoS policy is applied correctly on the WAN interface (Serial0/0/0) with a shape of 10 Mbps. The policy-map has a class for 'critical-data' with bandwidth 5 Mbps and another class for 'transactional-data' with bandwidth 3 Mbps. The remaining traffic is in class-default with fair-queue. The branch router's CPU utilization is normal. The interface output shows that the queue for critical-data is rarely full, but packets are experiencing high latency. The engineer pings from the branch server to the central site and sees 200 ms RTT normally, but up to 500 ms during peak hours. What is the most likely cause of the high latency for critical-data?
If shaped to 10 Mbps but the actual link is faster, traffic buffers, increasing latency. Increasing shape rate reduces buffering.
Why this answer
The shape rate of 10 Mbps is the bottleneck. Even though the critical-data class has a bandwidth guarantee of 5 Mbps, the overall interface is shaped to 10 Mbps. During peak hours, when the sum of all traffic (critical, transactional, and default) exceeds 10 Mbps, packets are queued at the shaper.
This queueing introduces additional delay (up to 500 ms) for all classes, including critical-data, because the shaper enforces a single token bucket for the entire interface. Increasing the shape rate to match the actual access link speed (e.g., 20 Mbps) would reduce the queuing delay by allowing more traffic to be transmitted immediately.
Exam trap
Cisco often tests the distinction between shaping and policing, and the trap here is that candidates assume the bandwidth command inside a class provides low latency, when in fact a shaper at the interface level introduces queuing delay for all traffic, regardless of class-level guarantees.
How to eliminate wrong answers
Option B is wrong because the priority command is used for low-latency queuing (LLQ) to provide strict priority for voice or video, but the question states that the critical-data queue is rarely full and the issue is overall queuing delay caused by the shaper, not a lack of priority. Option C is wrong because reducing the queue-limit would cause tail drops, which would increase packet loss, not reduce latency; the problem is excessive buffering delay, not a full queue. Option D is wrong because increasing the bandwidth for critical-data would not solve the root cause—the shaper at 10 Mbps is the bottleneck; even with more bandwidth allocation, the shaper still queues all traffic when the aggregate exceeds 10 Mbps, so latency would remain high.
A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?
Loose hops allow the tunnel to traverse other interfaces.
Why this answer
Changing the explicit path from 'strict' to 'loose' for the down interface allows the MPLS TE tunnel to use an alternative next-hop that is reachable, even if the specified interface is down. A strict explicit path requires every hop to be directly connected, so a down interface prevents the tunnel from coming up. By making the hop loose, the router can route around the failed link using the IGP's best path to the next specified node.
Exam trap
Cisco often tests the distinction between strict and loose explicit paths, where candidates mistakenly think that adjusting path preference or adding constraints can override a strict hop that is down, rather than recognizing that only changing the hop type to loose allows the router to dynamically route around the failure.
How to eliminate wrong answers
Option A is wrong because increasing the path-option preference value only changes the order in which path options are tried; it does not bypass a down interface in a strict explicit path. Option B is wrong because disabling path protection removes the ability to use a backup tunnel or fast reroute, but does not resolve the issue of a strict explicit path requiring a down interface. Option D is wrong because configuring an affinity constraint to exclude the down interface would require the tunnel to avoid that interface, but the explicit path still mandates it as a strict hop, so the constraint cannot override the explicit path definition.
Match each Segment Routing component to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Segment Identifier, an instruction in the SR header
Segment Routing Global Block of label values
Segment Routing over MPLS data plane
Topology-Independent Loop-Free Alternate for fast reroute
Path Computation Element Protocol for SR path computation
Why these pairings
In Segment Routing, SID uniquely identifies a segment, SRGB reserves a label range for global SIDs, and Prefix-SID is a global SID for an IGP prefix. Common confusions include mixing SID with SRGB and Prefix-SID with Adjacency-SID.
Which two statements about MPLS label operations are true? (Choose two.)
Push adds an MPLS header.
Why this answer
The MPLS push operation adds a new label onto the top of the label stack, encapsulating the packet for forwarding through an LSP. Option E is correct because the pop operation removes the top label, and implicit-null (label value 3) triggers the penultimate hop to pop the label before forwarding the packet to the egress LSR, reducing the egress router's processing load.
Exam trap
Cisco often tests the misconception that push and pop operations are limited to one label at a time, but push can impose multiple labels (e.g., for label stacking), and pop with implicit-null is a specific mechanism to optimize egress processing.
A network architect is designing a Segment Routing (SR) network for a service provider with a requirement for fast convergence upon node failure. The network uses IS-IS as the IGP with segment routing extensions. Which design choice BEST ensures that the network can achieve sub-50ms convergence without relying on any signaling protocol beyond the IGP?
TI-LFA computes backup paths using only IGP information (IS-IS with segment routing extensions), ensuring sub-50ms convergence without any additional signaling protocol, making it the best choice.
Why this answer
TI-LFA (Topology Independent Loop-Free Alternate) provides sub-50ms convergence by precomputing backup paths using only the IGP (IS-IS with SR extensions), without requiring any additional signaling protocol. Option A is wrong because BFD with static routes offers fast detection but does not provide a backup path automatically; it must be combined with a protection mechanism like FRR. Option B is wrong because RSVP-TE Fast Reroute relies on RSVP signaling and TE tunnels, which are beyond the IGP-only requirement.
Option D is wrong because LDP is a separate signaling protocol that requires LDP FRR and path protection, again adding signaling overhead beyond the IGP.
In RSVP-TE, which filter spec style allows multiple senders to share the same reserved resources on a link, as long as their flows do not exceed the reservation?
SE provides sharing with explicit sender list.
Why this answer
Shared Explicit (SE) style allows multiple senders to share a single reservation, with explicit sender list.
An SP is deploying NAT64 to allow IPv6-only clients to access IPv4 servers. Which address translation mechanism is used by NAT64 to map IPv6 addresses to IPv4 addresses?
Correct. NAT64 uses a prefix (64:ff9b::/96) to embed IPv4 addresses.
Why this answer
NAT64 uses a well-known prefix (64:ff9b::/96) to embed IPv4 addresses into IPv6 addresses. The IPv4 address is appended to the prefix, creating an IPv6 address that represents the IPv4 destination.
A service provider is using LISP to provide host mobility. Which LISP component is responsible for storing the mapping of EID to RLOC?
Correct. The Map-Server maintains the mapping database for the LISP site.
Why this answer
In LISP (RFC 6830), the Map-Server (MS) is the central repository that stores the mapping of Endpoint Identifiers (EIDs) to Routing Locators (RLOCs). When an Ingress Tunnel Router (ITR) needs to forward traffic to a destination EID, it queries the Map-Resolver, which in turn contacts the Map-Server to retrieve the authoritative mapping. The Map-Server also accepts registration from Egress Tunnel Routers (ETRs) on behalf of their EID prefixes, making it the definitive source for EID-to-RLOC bindings.
Exam trap
Cisco often tests the distinction between the Map-Server (which stores the mapping) and the Map-Resolver (which only proxies requests), so the trap here is confusing the resolver's forwarding role with the server's storage role, leading candidates to incorrectly select Map-Resolver.
How to eliminate wrong answers
Option B (Altitude) is wrong because Altitude is not a LISP component; it is a proprietary Cisco technology for traffic engineering and path selection, unrelated to EID-to-RLOC mapping storage. Option C (Tunnel Router) is wrong because Tunnel Routers (ITR/ETR) perform encapsulation/decapsulation and may cache mappings, but they do not store the authoritative mapping database—that is the Map-Server's role. Option D (Map-Resolver) is wrong because the Map-Resolver handles incoming map-requests from ITRs and forwards them to the Map-Server; it does not store mappings itself, acting only as a proxy.
Which THREE of the following are benefits of using EVPN over traditional VPLS for L2VPN services? (Select three.)
EVPN can provide L2 and L3 services.
Why this answer
EVPN offers BGP control plane, multi-homing with ESI, and integrated L2/L3 services.
A service provider wants to offer a point-to-point Ethernet service between two customer sites with a defined bandwidth and performance guarantee, according to MEF standards. Which Carrier Ethernet service type is appropriate?
E-Line provides point-to-point Ethernet connectivity.
Why this answer
E-Line (Ethernet Line) is a point-to-point service defined by MEF for Carrier Ethernet.
Which congestion avoidance mechanism is used to prevent tail drop by selectively dropping packets from lower-priority flows before the queue becomes full?
WRED proactively drops packets to manage congestion.
Why this answer
WRED (Weighted Random Early Detection) drops packets probabilistically based on queue depth and IP precedence/DSCP, avoiding synchronization and providing congestion avoidance.
In an IS-IS segment routing network, after the global 'segment-routing mpls' configuration, which IS-IS configuration is mandatory for label allocation?
This command is required to enable segment routing label allocation within the IS-IS process.
Why this answer
The global 'segment-routing mpls' command enables MPLS Segment Routing on the device, but it does not automatically enable label allocation under IS-IS. The mandatory IS-IS configuration to trigger label allocation is 'segment-routing mpls' under the 'router isis' process. Without this sub-mode command, IS-IS will not allocate MPLS labels for prefixes, even if prefix-SIDs are configured on interfaces.
Exam trap
Cisco often tests that candidates confuse the global 'segment-routing mpls' command with the IS-IS sub-mode 'segment-routing mpls' command, leading them to think the global command alone is sufficient for label allocation.
How to eliminate wrong answers
Option A is wrong because 'mpls label protocol sr' is used to specify the label distribution protocol as Segment Routing on an interface, but it is not required for IS-IS label allocation; IS-IS uses its own signaling for SR-MPLS. Option C is wrong because 'prefix-sid' under the loopback interface assigns a Segment ID to a prefix, but it is not mandatory for label allocation; labels can be allocated dynamically without explicit prefix-SIDs, and the mandatory step is enabling SR-MPLS under IS-IS. Option D is wrong because 'is-type level-1-2' defines the IS-IS level, which is unrelated to label allocation; SR-MPLS works with any IS-IS level configuration.
Which two statements about MPLS Layer 3 VPN route target (RT) communities are correct?
Incorrect: RTs can be auto-generated using the Auto-RT feature.
Why this answer
Route targets (RTs) are BGP extended community attributes used to control the import and export of VPN routes between VRFs on PE routers. Option D is correct. While auto-RT can automatically generate RTs, many deployments require manual configuration on each PE for each VRF, especially when custom RTs are needed; therefore, option A is also correct.
Option B is incorrect because loop prevention in MPLS VPNs uses mechanisms like AS-override and allowas-in, not RTs. Option C is incorrect because the next-hop IP address for VPN prefixes is determined by the BGP next-hop attribute, not RTs. Option E is incorrect because RTs are carried within BGP VPNv4 updates as extended communities, not in the IP header.
When deploying EVPN with SR-MPLS or SRv6, which THREE statements about EVPN multi-homing and related concepts are correct? (Choose three.)
Correct. IRB provides L2 and L3 with anycast gateway.
Why this answer
The three correct statements about EVPN multi-homing are A, B, and E. EVPN IRB does use an anycast gateway for Layer 3 forwarding. Aliasing allows forwarding based on ESI knowledge even without learning the specific MAC address.
Designated Forwarder (DF) election is performed per (ESI, VLAN) to avoid duplicate traffic. Option C is incorrect because the Ethernet Segment Identifier (ESI) is used for identifying multi-homed sites and DF election, but split-horizon filtering is achieved through the ESI label, not the ESI itself. Option D is incorrect because EVPN VPWS is a point-to-point service only.
An engineer is designing an EVPN IRB (Integrated Routing and Bridging) solution. Which two statements about EVPN IRB are correct? (Choose two.)
Correct: common anycast gateway.
Why this answer
EVPN IRB provides bridging at Layer 2 and routing at Layer 3 with an anycast default gateway. It uses asymmetric IRB (bridging locally, routing via VRF) and symmetric IRB (both directions route). The anycast gateway MAC is shared across all PEs.
Refer to the exhibit. CE1 is unable to ping the loopback of a remote CE. Which configuration change is required on PE1 to enable communication?
Missing `ip vrf forwarding CUSTOMER` on interface and `neighbor 192.168.1.2 activate` under address-family ipv4 vrf CUSTOMER.
Why this answer
The configuration is missing the VRF forwarding statement on the interface facing CE1 and the BGP VRF neighbor activation under the VRF address-family. Without applying the VRF to the interface, PE1 cannot associate the CE-facing interface with the correct VRF, and without activating the BGP neighbor under the VRF address-family, PE1 will not establish a BGP session with CE1 or exchange routes for that VRF. This prevents CE1 from learning the remote CE's loopback route.
Exam trap
Cisco often tests the distinction between configuring a BGP neighbor under the global BGP process versus under a VRF address-family, and the requirement to bind the VRF to the interface, which candidates frequently overlook when focusing only on BGP configuration.
How to eliminate wrong answers
Option A is wrong because `send-community extended` is used to propagate extended BGP communities (e.g., RT, SOO) between PE routers in the MPLS VPN core, not between PE and CE; the issue here is VRF-to-interface binding and BGP VRF neighbor activation, not community propagation. Option C is wrong because the VPNv4 neighbor already points to 192.168.1.2 (the remote PE's loopback), which is correct for the MP-BGP session; changing it would break the VPNv4 peering. Option D is wrong because the CE neighbor remote-as is already set to 65001 (the CE's AS), and changing it to 65000 (the PE's AS) would misconfigure the eBGP session, preventing the CE from establishing a BGP adjacency.
In the DiffServ model, which per-hop behavior (PHB) is associated with the AF31 DSCP value?
AF31 is DSCP 26.
Why this answer
DSCP 26 (binary 011010) corresponds to AF31, which is part of the Assured Forwarding class with low drop probability and medium priority.
Refer to the exhibit. The show command output displays the LDP neighbor state. What does the 'Downstream' label mode indicate about label distribution?
Downstream mode means unsolicited label advertisement.
Why this answer
In the context of LDP, 'Downstream' label mode means that a router advertises label bindings for all prefixes in its routing table to its LDP neighbors without waiting for an explicit request. This is the default label distribution mode for LDP, where labels are proactively sent to all peers. Option D correctly identifies this behavior.
Exam trap
Cisco often tests the distinction between 'Downstream Unsolicited' and 'Downstream on Demand' modes, where candidates confuse the default DU behavior with the request-driven DoD behavior described in options B and C.
How to eliminate wrong answers
Option A is wrong because 'Downstream Unsolicited' mode does not require the peer to advertise the prefix first; labels are sent regardless. Option B is wrong because it describes 'Downstream on Demand' mode, where labels are only distributed when explicitly requested via a Label Request message. Option C is wrong because it also describes 'Downstream on Demand' mode, where a Label Request message is required; in 'Downstream Unsolicited' mode, no such request is needed.
Type 10 carries TE information within an area.
Why this answer
OSPF uses opaque LSAs to carry TE information. Type 10 (area-local) and Type 11 (AS-scoped) opaque LSAs are used for TE. Type 9 is link-local.
An engineer is configuring IS-IS in a service provider network. The network uses wide metrics for traffic engineering. Which TLV is mandatory for IS-IS to carry traffic engineering (TE) information in accordance with RFC 5305?
TLV 22 carries TE information including link attributes.
Why this answer
TLV 22 (Extended IS Reachability) is the mandatory TLV for IS-IS TE, defined in RFC 5305.
In EVPN, what is the purpose of Ethernet Segment Identifier (ESI)?
ESI is key for multi-homing in EVPN.
Why this answer
ESI is used to identify a multi-homed site or Ethernet segment for all-active or single-active redundancy and to prevent loops.
A service provider wants to enforce a hard rate limit of 10 Mbps on a subscriber's traffic, dropping any excess packets. Which QoS mechanism should be used?
Policing drops or re-marks packets exceeding the rate, enforcing a hard limit.
Why this answer
Policing drops or re-marks traffic exceeding the configured rate, enforcing a hard limit. Shaping buffers excess traffic, which does not enforce a hard drop.
In IS-IS, which type of LSP is used to advertise prefix information for IPv4 and IPv6 in a modern SP network that supports traffic engineering?
TLV 135 carries IPv4 prefixes with wide metrics.
Why this answer
TLV 135 for IPv4 (extended IP reachability) and TLV 236 for IPv6 (IPv6 reachability) are used in IS-IS for prefix advertisement.
Which TWO statements about model-driven telemetry compared to SNMP are correct? (Choose two.)
Correct: Telemetry supports high-frequency streaming.
Why this answer
Model-driven telemetry (MDT) uses a push model where the network device streams structured data (e.g., YANG-modeled) to a collector, enabling sub-second intervals for real-time monitoring. This contrasts with SNMP's pull model, where the manager polls the device at intervals limited by CPU and network overhead, making sub-second polling impractical.
What is the purpose of the 'mpls ldp autoconfig' command on an interface?
This command enables LDP automatically on the interface.
Why this answer
The 'mpls ldp autoconfig' command is used on an interface to automatically enable LDP on that interface for all IPv4 address families configured under the OSPF process. This eliminates the need to manually configure 'mpls ldp' on each interface, simplifying deployment in large-scale networks where LDP should be enabled on all OSPF-enabled interfaces.
Exam trap
Cisco often tests the distinction between 'mpls ldp autoconfig' (which enables LDP on OSPF interfaces automatically) and 'mpls ip' (which enables MPLS forwarding on an interface), leading candidates to confuse the purpose of the command.
How to eliminate wrong answers
Option A is wrong because 'mpls ldp autoconfig' does not directly enable MPLS forwarding; MPLS forwarding is enabled globally with 'mpls ip' or per interface with 'mpls ip', while this command specifically triggers LDP neighbor discovery and label exchange. Option B is wrong because the command does not enable LDP on all interfaces; it only enables LDP on interfaces that are part of the OSPF process under which the command is configured, not on all interfaces in the router. Option C is wrong because the command enables LDP on the interface, not disables it; to disable LDP on an interface, the command 'no mpls ldp autoconfig' or 'mpls ldp igp autoconfig disable' would be used.
An engineer configures an SR-TE policy with a segment list containing adjacency SIDs. The required path includes a strict loose hop through a specific router. Which segment type should be used for the strict hop?
Correct.
Why this answer
Adjacency SIDs force the packet to traverse a specific link. For a strict hop, the adjacency SID ensures the packet goes through that exact link. A Node SID would allow any path to the node.
In IS-IS, a router is configured as L1 only. Which statement is true regarding its routing table?
Correct. The L1/L2 router advertises a default route into L1 area.
Why this answer
An L1 router only knows routes within its own area. It uses the closest L1/L2 router as a default route to reach other areas. The L1/L2 router leaks a default route into the L1 area.
Which THREE of the following are required for successful operation of OSPFv3 in an IPv6 service provider network?
Each interface must be explicitly activated for OSPFv3.
Why this answer
OSPFv3 requires interface-level activation using the 'ipv6 ospf <process> area <area>' command to enable the OSPFv3 process on a specific interface and associate it with an area. Without this, the interface will not participate in OSPFv3 neighbor discovery or routing updates, even if the process is configured globally.
Exam trap
Cisco often tests the misconception that OSPFv3 authentication is mandatory, but it is optional and uses IPsec AH/ESP headers, not the simple authentication mechanisms of OSPFv2.
A service provider uses RESTCONF to automate interface configuration. They need to add a new IPv4 address to an existing interface. Which HTTP method and URI should be used?
PATCH merges the new address into the list.
Why this answer
PATCH is the appropriate HTTP method for a partial update to an existing resource, and the URI targets the IPv4 address list under the specific interface. This allows adding a new IPv4 address without replacing the entire interface configuration, which aligns with RESTCONF's support for partial resource modification as defined in RFC 8040.
Exam trap
Cisco often tests the difference between PATCH (partial update) and PUT (full replacement), where candidates mistakenly choose PUT thinking it 'updates' the resource, but it actually replaces the entire list.
How to eliminate wrong answers
Option A is wrong because DELETE removes the entire interface resource, not adds an address. Option C is wrong because POST is used to create a new data resource (e.g., a new interface), not to add an address to an existing list; the URI also points to the ipv4 container, not the address list. Option D is wrong because PUT replaces the entire address list resource with the payload, which would overwrite any existing addresses instead of adding a new one.
An SP is implementing traffic shaping on an MPLS PE-CE link. Which TWO statements are true about shaping compared to policing? (Select two.)
Policing can re-mark, shaping only buffers.
Why this answer
Shaping buffers excess traffic to smooth bursts, while policing drops or re-marks excess packets. Shaping introduces delay due to buffering; policing can cause TCP retransmissions.
Which TWO of the following are valid BGP extended community attributes? (Choose two.)
Correct. Site of Origin (SoO) is a BGP extended community used to prevent routing loops.
Why this answer
Site of Origin (SoO) and Route Target (RT) are well-known BGP extended communities. Route Origin (RO) is a standard community, not an extended community. Standard and Large communities are also not extended communities.
Thus, only SoO and RT are correct among the options, but the question asks for three; note that Color or Bandwidth are other valid extended communities not listed here.
Exam trap
Candidates often confuse Route Origin (standard community) with Route Target (extended community).
Which TWO statements about SR-MPLS compared to LDP are correct? (Choose two.)
Correct. SRGB is configured consistently.
Why this answer
SR-MPLS uses a Segment Routing Global Block (SRGB), which is a reserved label range (e.g., 16000–23999 per RFC 8660) that is configured consistently across all routers in the SR domain. This global consistency allows any router to interpret a label from the SRGB as the same topological or service instruction, eliminating the need for per-hop label negotiation.
Exam trap
Cisco often tests the misconception that SR-MPLS is dependent on LDP or RSVP-TE, when in fact SR-MPLS is designed to replace these protocols by leveraging IGP for label distribution and SR-TE policies for traffic engineering.
In an MPLS L3VPN network with route reflectors, what is the default behavior regarding the BGP next-hop attribute for reflected VPNv4 routes?
Route reflectors preserve the next-hop attribute.
Why this answer
In an MPLS L3VPN network with route reflectors, the default behavior for VPNv4 routes is that the route reflector does not modify the BGP next-hop attribute. This is because the next-hop should remain the address of the originating PE router to ensure proper MPLS label switching and reachability. Changing the next-hop would break the MPLS forwarding path, as the P routers rely on the IGP to reach the PE's loopback, not the route reflector's.
Exam trap
Cisco often tests the misconception that route reflectors behave like route servers or that they must update the next-hop to themselves to ensure reachability, but in MPLS L3VPN, the next-hop must remain unchanged to preserve the MPLS forwarding path.
How to eliminate wrong answers
Option A is wrong because setting the next-hop to 0.0.0.0 would invalidate the route, as it is not a reachable address and would cause traffic to be dropped; this is not a default behavior for route reflectors. Option B is wrong because removing the next-hop attribute would make the route unusable for forwarding, as BGP requires a valid next-hop for recursive route resolution. Option C is wrong because setting the next-hop to the route reflector's loopback would break MPLS L3VPN functionality, as the P routers would attempt to reach the route reflector instead of the originating PE, disrupting label-switched path (LSP) establishment; route reflectors are not required to be in the MPLS forwarding path.
What is the role of Network Services Orchestrator (NSO) in service provider automation?
NSO orchestrates services end-to-end.
Why this answer
NSO provides service lifecycle management by modeling services with YANG and configuring devices via NETCONF.
In a carrier network using VRF-lite for customer isolation, which issue arises if route-target values are not correctly configured?
Mismatched route-targets can cause unintended import/export, leading to route leakage between VRFs.
Why this answer
In VRF-lite, route-target (RT) values control the import and export of routes between VRFs. If RTs are misconfigured, a VRF may import routes intended for another VRF, causing customer routes to leak across VRFs. This violates isolation because the VRF table incorrectly accepts routes based on mismatched RT import statements.
Exam trap
Cisco often tests the misconception that route-target misconfiguration causes BGP session failures or routing protocol issues, when in fact it only affects route import/export logic, leading to route leakage.
How to eliminate wrong answers
Option A is wrong because VRF-lite does not use the global routing table for customer routes; routes are installed in the per-VRF table, and incorrect RTs do not affect the global table. Option B is wrong because BGP sessions between PEs are established independently of RT configuration; RTs only affect route processing within BGP, not session state. Option C is wrong because the PE-CE routing protocol (e.g., OSPF, EIGRP, static) operates on the VRF interface and is unaffected by RT misconfiguration; RTs only influence route redistribution between VRFs or between VRF and BGP.
Which TWO statements correctly describe the DiffServ model? (Choose two.)
Correct; DSCP is 6 bits.
Why this answer
The DiffServ model uses the 6-bit Differentiated Services Code Point (DSCP) field in the IP header to mark packets, providing 2^6 = 64 possible values (0-63). This allows for up to 64 distinct per-hop behaviors (PHBs), enabling scalable QoS classification beyond the limited 8 classes of the older IP Precedence model.
Exam trap
Cisco often tests the distinction between DSCP (6-bit) and IP Precedence (3-bit), and the specific DSCP value for EF (46) versus Best Effort (0), to catch candidates who confuse the bit length or default markings.
A service provider is deploying IPv6 transition mechanisms. Which three technologies use encapsulation over an IPv4 network? (Choose three.)
6VPE encapsulates IPv6 VPN traffic over MPLS.
Why this answer
6PE, 6VPE, and 6rd encapsulate IPv6 packets over IPv4; MAP-T uses translation, not encapsulation.
An SP network operator needs to ensure that voice traffic always gets priority access to the output link. Which queuing mechanism is designed to provide a strict priority queue while preventing starvation of other queues?
LLQ combines a strict priority queue with policing to protect other classes.
Why this answer
LLQ provides a strict priority queue for EF traffic and includes a policer to limit the priority traffic rate, preventing starvation of other queues.
A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?
RADIUS enables the BNG to authenticate subscribers against a central AAA server and dynamically assign IP addresses via DHCP or PPPoE session attributes. This satisfies the stem’s requirement for a protocol that both verifies subscriber credentials and delivers IP configuration, whereas alternatives like DHCP alone lack authentication, and TACACS+ does not handle IP address assignment.
A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?
A matching ROA results in 'valid' state.
Why this answer
If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.
Which TWO statements about Cisco NSO (Network Services Orchestrator) are true? (Choose two.)
NSO exposes NETCONF and RESTCONF northbound.
Why this answer
NSO provides northbound APIs using NETCONF and RESTCONF, enabling integration with higher-level orchestration and management systems. These standard protocols allow external systems to interact with NSO for service lifecycle management, configuration, and operational data retrieval, making B correct.
Exam trap
Cisco often tests the misconception that NSO only supports CLI-based management or that it eliminates SNMP entirely, when in fact NSO is protocol-agnostic and can leverage multiple southbound protocols including NETCONF, CLI, and SNMP for different device types.
Which MPLS label is used to identify the egress PE in a Layer 3 MPLS VPN?
The VPN label is used by the egress PE to identify the correct VRF.
Why this answer
In a Layer 3 MPLS VPN, the VPN label (also known as the service label) is assigned by the egress PE router and advertised via MP-BGP (RFC 4364). It uniquely identifies the VPN forwarding instance (VRF) on the egress PE, allowing the correct per-VPN forwarding decision to be made after the transport label has been removed. Without the VPN label, the egress PE would not know which VRF or customer-facing interface should receive the packet.
Exam trap
Cisco often tests the distinction between the transport label (used for core forwarding) and the VPN label (used for service identification), and candidates mistakenly think the LDP label or IGP label serves the egress PE identification role because they associate label distribution with routing protocols.
How to eliminate wrong answers
Option A is wrong because the transport label (typically an LDP or IGP-based label) is used for hop-by-hop forwarding across the MPLS core, not for identifying the egress PE's VPN context. Option C is wrong because LDP labels are used to build transport LSPs for label-switched paths, not to carry VPN-specific forwarding information. Option D is wrong because IGP labels do not exist as a distinct label type; IGPs (OSPF, IS-IS) may be used to distribute the underlying routing information but do not assign labels for VPN identification.
In a multicast environment, a PE router is not receiving multicast traffic from a source behind a CE. The PIM neighbors are established. The RP is reachable. What is the most likely issue?
Without multicast VRF, the PE cannot forward multicast traffic in the VRF.
Why this answer
The most likely issue is that the PE router does not have the multicast VRF enabled. In a multicast VPN (MVPN) environment, even if PIM neighbors are established and the RP is reachable, the PE must have multicast routing explicitly enabled within the VRF using the 'ip multicast-routing vrf <name>' command. Without this, the PE will not process multicast traffic for that VRF, causing it to drop or ignore multicast packets from the source behind the CE.
Exam trap
Cisco often tests the subtle distinction between having PIM neighbors established (which only requires PIM configuration on the interface) versus having multicast routing enabled globally for the VRF, leading candidates to overlook the mandatory 'ip multicast-routing vrf' command.
How to eliminate wrong answers
Option A is wrong because IGMP joins are used by hosts to signal interest in a multicast group, but the CE is a router forwarding traffic, not a host; the issue is on the PE side, not the CE sending joins. Option B is wrong because the source address being in the VRF is a routing requirement, but the problem is about multicast forwarding, not unicast reachability; the source address is already behind the CE and thus in the VRF by default. Option D is wrong because the RP is reachable, and while the RP must be configured in the VRF for proper operation, the question states the RP is reachable, implying it is configured; the core issue is the missing multicast routing enablement on the PE.
Which IS-IS level is used for routing within an area?
L1 is used for routing within a single area.
Why this answer
IS-IS uses Level 1 (L1) for intra-area routing and Level 2 (L2) for inter-area routing.
A service provider wants to provide Layer 3 VPN services to customers using MPLS. Which technology is used to distribute VPNv4 routes between PE routers?
MP-BGP is the correct protocol for distributing VPNv4 routes.
Which four statements correctly describe the SRv6 micro-SID (uSID) concept? (Choose four.)
Correct. Micro-SID is an SRv6 concept and is incompatible with SR-MPLS since it uses IPv6 forwarding.
Why this answer
SRv6 micro-SID uses a compressed SID format where multiple SIDs are encoded in a single 128-bit IPv6 address. It reduces overhead by combining SIDs into a carrier SID. The uSID instruction is usually 16 bits, and the locator block is shared.
Micro-SID is incompatible with SR-MPLS because it operates in the IPv6 data plane, whereas SR-MPLS uses MPLS labels.
An SP network is running OSPFv3 for IPv6 and needs to support traffic engineering extensions for RSVP-TE. Which three statements about OSPFv3 TE extensions are true?
TLV 1 is the Router Address TLV used in OSPF TE.
Why this answer
OSPFv3 uses Opaque LSA types 9, 10, and 11 for TE, with Type 10 carrying TE information link-state. OSPFv3 TE requires the OSPFv3 process to be configured for TE.
Type 10 is area-scoped opaque, used for TE.
Which three are benefits of using MPLS Layer 3 VPNs over traditional VPNs? (Choose three.)
MPLS L3VPNs can scale to thousands of VPNs.
Why this answer
MPLS Layer 3 VPNs use a full-mesh of MP-BGP sessions between Provider Edge (PE) routers to exchange VPNv4 routes, which allows the network to scale to thousands of VPNs and customers without requiring a full mesh of tunnels. This is far more scalable than traditional VPNs that rely on point-to-point tunnels (e.g., IPsec or GRE) which create an O(n²) problem for connectivity.
Exam trap
Cisco often tests the misconception that MPLS VPNs are cheaper than traditional VPNs, but the trap here is that while MPLS reduces operational overhead for the provider, the hardware and licensing costs are typically higher, so 'lower cost' is not a guaranteed benefit.
In MPLS, what is the term for the operation where the top label is removed and replaced with a new label?
Correct. Swap replaces the top label with a new label.
Why this answer
Swap is the operation where the incoming label is replaced with a new outgoing label, as determined by the LFIB.
Based on the exhibit, which label operation will occur when a packet destined to 10.2.2.1 enters PE1 with label 17?
The forwarding table shows outgoing label 18 for this prefix.
Why this answer
The exhibit shows an MPLS VPN scenario where PE1 receives a labeled packet destined for 10.2.2.1. The incoming label 17 corresponds to the VPNv4 route for 10.2.2.1/32, and the LFIB on PE1 indicates a swap operation to label 18, which is the transport label used to forward the packet across the MPLS core toward the next-hop PE.
Exam trap
Cisco often tests the distinction between label operations (push, swap, pop) in MPLS VPN scenarios, and the trap here is that candidates mistakenly think the incoming label is a VPN label that must be popped or pushed, rather than recognizing that the LFIB dictates a swap when the packet is transiting the MPLS core.
How to eliminate wrong answers
Option A is wrong because the packet arrives with an MPLS label (17), and in an MPLS VPN, the ingress PE must forward the packet with a label stack, not as an untagged packet. Option B is wrong because popping the label and forwarding as IP would only occur at the penultimate hop (PHP) or if the packet were destined to the PE itself, but here the destination is a remote VPN prefix. Option C is wrong because pushing label 17 would imply the packet arrived unlabeled, but the question states the packet enters with label 17 already present; pushing a new label 17 would be incorrect as the operation is a swap, not a push.
An SP router is configured with a hierarchical QoS policy (parent policy shaper, child policy with CBWFQ). When applying this policy to an interface, the router reports 'Policy map not found' error. What is the most likely cause?
The child policy must exist before applying the parent.
Why this answer
The 'Policy map not found' error occurs when the parent policy-map references a child policy-map via the 'service-policy' command, but that child policy-map does not exist in the router's configuration. Hierarchical QoS requires both the parent and child policy-maps to be created and correctly named; a missing child policy-map prevents the router from applying the nested policy.
Exam trap
Cisco often tests the distinction between configuration errors (e.g., missing policy-map) and operational errors (e.g., unsupported values), leading candidates to overthink interface or shaping parameters when the actual issue is a simple missing object.
How to eliminate wrong answers
Option A is wrong because the interface speed does not need to be explicitly configured for a hierarchical QoS policy to be applied; the router can auto-negotiate or use default speed settings, and a missing speed configuration would not cause a 'Policy map not found' error. Option B is wrong because bridge domains are relevant to Layer 2 VPN or EVPN configurations, not to the existence of a policy-map; the error is purely about a missing policy-map object, not about the interface's Layer 2 membership. Option D is wrong because an unsupported shape average value would cause a configuration rejection or a different error (e.g., 'Invalid shape rate'), not a 'Policy map not found' error; the error message explicitly indicates the child policy-map is missing.
In OSPF, which type of area does not allow external routes and only accepts a default route?
Stub areas block Type 5 LSAs and use a default route.
Why this answer
A stub area blocks Type 5 LSAs and injects a default route; it does not accept external routes from other areas.
An SP network is implementing BGP PIC (Prefix Independent Convergence) for fast failover. What is the primary mechanism used by BGP PIC to achieve sub-second convergence?
Correct. BGP PIC installs a backup path so that upon failure, traffic is immediately switched to the backup.
Why this answer
BGP PIC uses a backup path (often a pre-computed alternate path) that is installed in the FIB along with the primary path. Upon failure of the primary path, traffic is switched to the backup path without waiting for BGP convergence.
Which Cisco router platform is designed for the aggregation layer and supports both mobile backhaul and business services with high density 10GE/100GE interfaces?
Correct. NCS is optimized for aggregation with high-density 10GE/100GE.
Why this answer
Cisco NCS (Network Convergence System) routers are designed for the aggregation layer, offering high port density and support for various services including mobile backhaul and business connectivity.
A service provider is deploying Segment Routing in the MPLS core using IS-IS. Which extension is required in IS-IS to advertise the prefix-SID?
Sub-TLV 3 is used within TLV 135 or 242 to carry prefix-SID.
Why this answer
In IS-IS, the Prefix-SID is advertised using Sub-TLV 3, which is carried within TLV 135 (Extended IP Reachability). This sub-TLV contains the SID value and flags, enabling Segment Routing in the MPLS core. Without Sub-TLV 3, the prefix-SID cannot be signaled, making it the required extension.
Exam trap
Cisco often tests the distinction between the TLV that carries the prefix (TLV 135) and the sub-TLV that carries the SID (Sub-TLV 3), leading candidates to incorrectly select TLV 135 as the answer.
How to eliminate wrong answers
Option A is wrong because TLV 22 (Extended IS Reachability) is used to advertise IS-IS neighbor information and link attributes, not prefix-SIDs. Option B is wrong because TLV 242 (Router Capability) is used to advertise router capabilities such as SRGB or node-SID, but it does not carry prefix-SIDs. Option D is wrong because TLV 135 (Extended IP Reachability) carries the prefix itself, but the prefix-SID is advertised via Sub-TLV 3 within TLV 135, not by TLV 135 alone.
A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?
The 'sr-protect' option ensures that the node acts as a protecting node for transit traffic, providing node protection even if the node itself is the failure point.
Why this answer
For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence.
Option D is wrong because there is no need for an additional LDP backup.
In a service provider network, the access layer connects end customers. Which technology is commonly used for fibre-based access in GPON deployments?
GPON is the correct fibre access technology.
Why this answer
GPON (Gigabit Passive Optical Network) is a fibre-based access technology standardized by ITU-T.
An automation engineer is writing a Python script using Cisco's pyATS library to validate QoS configurations across a fleet of routers. The script runs without errors but reports that all routers are compliant even though some are not. What is the most likely issue?
A generic 'show run' parser may not extract nested configurations like interface service-policies, leading to false compliance.
Why this answer
The pyATS parser for 'show running-config' without filtering may not recursively parse QoS policy-map configurations applied under interfaces. When the script uses a single unfiltered 'show running-config', the parser might fail to extract QoS policies nested under interface sub-configurations, leading to false compliance reports. This is a common issue where the parser's data model does not map deeply nested CLI structures like 'service-policy input/output' under interfaces.
Exam trap
Cisco often tests the misconception that a generic 'show running-config' parser will capture all configuration details, when in reality, nested or interface-specific constructs require targeted parsing or explicit iteration.
How to eliminate wrong answers
Option A is wrong because pyATS supports QoS features across many Cisco platforms via its Genie parsers, and the script runs without errors, indicating the library is compatible. Option B is wrong because incorrect testbed credentials would cause authentication failures or connection errors, not a silent 'compliant' result. Option D is wrong because parsing startup-config instead of running-config would likely show different or no QoS policies, but the script would still detect non-compliance if the parser correctly located QoS policies; the issue is parser depth, not config source.
An SP engineer is configuring QoS on a router and needs to drop traffic that exceeds a certain rate while allowing bursts up to a specified amount. Which QoS feature should be used?
Policing uses a token bucket to enforce a maximum data rate; excess packets are either dropped or re-marked.
Why this answer
Policing is the correct QoS feature because it drops traffic that exceeds a configured rate while allowing bursts up to a specified amount. Unlike shaping, which buffers excess traffic, policing enforces a rate limit by immediately dropping or re-marking packets that exceed the configured committed information rate (CIR) and burst size (Bc/Be). This matches the requirement to drop traffic that exceeds a certain rate while permitting bursts.
Exam trap
Cisco often tests the distinction between policing (drops excess traffic) and shaping (buffers excess traffic), so the trap here is that candidates may confuse 'allowing bursts' with shaping's buffering behavior, but policing explicitly permits bursts up to a configured size before dropping.
How to eliminate wrong answers
Option A is wrong because shaping buffers excess traffic in a queue to smooth the output rate, rather than dropping traffic that exceeds a rate; it delays packets instead of discarding them. Option B is wrong because Weighted Random Early Detection (WRED) is a congestion avoidance mechanism that probabilistically drops packets before a queue becomes full based on average queue depth and precedence/DSCP values, not a rate-based policer that enforces a specific traffic rate with burst allowance. Option D is wrong because queueing (e.g., CBWFQ, LLQ) manages the order and priority of packet transmission during congestion but does not enforce a rate limit or drop traffic that exceeds a specific rate.
A service provider is implementing MPLS TE to optimize bandwidth utilization. The engineer notices that tunnels are not using the explicitly configured path. What is the most likely reason?
Causes path to be invalid, tunnel may use dynamic or stay down.
Why this answer
When an MPLS TE tunnel is configured with an explicit path, the headend router uses RSVP to signal the path and verify that all links in the path are operational. If any link in the explicit path is down, RSVP signaling fails for that path, and the tunnel may fall back to dynamic path computation or remain down, rather than using the explicitly configured path. This is the most common reason for a tunnel not using its explicit path.
Exam trap
Cisco often tests the misconception that 'autoroute announce' or IGP reachability issues cause path selection problems, when in fact the explicit path failure is due to a down link in the path itself, which is a fundamental RSVP signaling constraint.
How to eliminate wrong answers
Option B is wrong because if RSVP were not enabled on the headend, MPLS TE tunnels would not be able to signal at all, and the tunnel would not come up, not just fail to use an explicit path. Option C is wrong because the tunnel destination being unreachable via IGP would prevent the tunnel from establishing at all, but the question states tunnels are not using the explicit path, implying they may be using a dynamic path instead. Option D is wrong because 'autoroute announce' causes the headend to install the tunnel as a next-hop for IGP destinations, but it does not affect which path the tunnel itself uses; the tunnel path is determined by the explicit or dynamic path configuration.
This feature copies the original DSCP to the tunnel header.
Why this answer
When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.
How to eliminate wrong answers
Option A is wrong because AutoQoS is an automated QoS configuration tool that simplifies deployment but does not address the issue of DSCP preservation after IPsec encryption; it still relies on the outer header markings. Option C is wrong because MPLS TE (Traffic Engineering) is a mechanism for optimizing traffic paths in MPLS networks, not a feature for preserving DSCP markings across IPsec tunnels. Option D is wrong because NBAR (Network-Based Application Recognition) is a deep packet inspection tool for classifying traffic based on application signatures, but it cannot preserve original DSCP markings after encryption since the inner header is not visible to the classifier.
A service provider is implementing QoS policies on an access aggregation router. They want to shape traffic to a downstream DSLAM to 10 Mbps, but they do not want to exceed the shaping rate even if the line rate is higher. Which QoS tool should be used on the interface facing the DSLAM?
Shaping buffers traffic to stay below a configured rate.
Why this answer
Shaping is the correct tool because it buffers excess traffic and smooths the output rate to a configured target (10 Mbps) without exceeding it, even if the physical line rate is higher. Unlike policing, shaping does not drop or re-mark packets when the rate is exceeded, ensuring the downstream DSLAM receives traffic at or below the shaped rate.
Exam trap
Cisco often tests the distinction that shaping buffers and delays traffic to meet a rate, while policing drops or re-marks, leading candidates to mistakenly choose policing when the requirement is to never exceed the rate without dropping.
How to eliminate wrong answers
Option A is wrong because queuing manages the order and prioritization of packets within a queue but does not enforce a specific output rate limit. Option B is wrong because marking sets or modifies DSCP/CoS values for classification and treatment downstream, but it does not control the rate of traffic leaving the interface. Option C is wrong because policing drops or re-marks packets that exceed a configured rate, which can cause TCP retransmissions and does not buffer traffic to maintain a steady rate below the line speed.
Which TWO are characteristics of the access layer in a service provider network? (Choose two.)
Access layer interfaces with customers.
Why this answer
Access layer provides connectivity to end users and aggregates traffic from various technologies.
A service provider is deploying MPLS in its core network. The core routers are all configured with LDP. Which label operation does an ingress PE perform on the first packet of a new flow?
The ingress PE pushes the label corresponding to the FEC for the destination.
Why this answer
The ingress PE (Provider Edge) router is the first router in the MPLS domain to receive an unlabeled IP packet. For the first packet of a new flow, the ingress PE must perform a label push operation, which adds an MPLS label (or a stack of labels) to the packet. This label is used by subsequent LSRs to forward the packet based on the label rather than the IP header, enabling MPLS forwarding.
Exam trap
Cisco often tests the distinction between label operations at different MPLS roles (ingress, transit, egress), and the trap here is that candidates confuse the ingress push with the transit swap or egress pop operations.
How to eliminate wrong answers
Option B is wrong because removing the label stack entirely is the function of the egress PE (or the penultimate hop in PHP), not the ingress PE. Option C is wrong because pop (PHP) is performed by the penultimate hop router to remove the label before sending the packet to the egress PE, not by the ingress PE. Option D is wrong because swap is an operation performed by intermediate LSRs (transit routers) to replace the incoming label with an outgoing label; the ingress PE does not have an incoming label to swap.
An engineer configures an RSVP-TE tunnel with a bandwidth of 100 Mbps and an explicit path that excludes a specific interface. The tunnel fails to come up. Which term describes the path computation method used by RSVP-TE to find a feasible path given these constraints?
Correct: CSPF considers constraints.
Why this answer
CSPF (Constrained Shortest Path First) is the algorithm used by RSVP-TE to compute a path that satisfies constraints such as bandwidth, explicit path, and link affinities.
Practice 350-501 by domain
Target a specific domain to shore up weak areas.