971 questions total · 13pages · All types, answers revealed
Which RESTCONF HTTP method is used to create a new data resource?
POST creates a new resource.
Why this answer
RESTCONF uses POST to create a new data resource. PUT is used to replace or create, but POST is the standard for creation.
An SP engineer is designing a BGP-based MPLS L3VPN service. The PE routers are fully meshed via iBGP for VPNv4 routes, and an RR is deployed to reduce sessions. The engineer notices that all PE routers are receiving duplicate routes from different PEs, causing suboptimal path selection. Which BGP feature should be enabled to ensure proper load balancing across multiple equal-cost paths?
Enabling BGP multipath on the PE routers allows them to install up to a configured number of equal-cost paths in the routing table. This enables load balancing across the multiple paths, which is the required outcome.
Why this answer
BGP multipath on PE routers enables the router to install multiple equal-cost paths into the routing table, allowing load balancing across them. In an MPLS L3VPN iBGP full mesh with an RR, duplicate routes are received from different PEs; BGP multipath selects and uses up to the configured number of equal-cost paths. Option A (BGP additional paths) allows advertising multiple paths but does not directly install them.
Option B (second RR) reduces sessions but does not affect duplicate routes. Option C (ignoring interior cost) modifies best-path selection but does not enable multipath.
In IS-IS, which TWO are types of Link State PDUs (LSPs)?
Originated by Level 2 routers for inter-area reachability.
Why this answer
In IS-IS, Link State PDUs (LSPs) are the fundamental building blocks of the link-state database. They carry topology and prefix information and are generated by each router. There are two distinct types: Level 1 LSPs, which advertise information within the same area, and Level 2 LSPs, which advertise information between areas.
Options B and E correctly identify these two types.
Exam trap
Cisco often tests the distinction between PDU types (LSPs, CSNPs, PSNPs, and IIHs) and candidates mistakenly classify all IS-IS PDUs as LSPs, especially confusing CSNPs and PSNPs with actual Link State PDUs.
In a carrier-supporting carrier (CSC) architecture, the customer carrier runs MPLS in its network. Which technology is used to exchange VPN routes between the provider carrier and the customer carrier?
MP-BGP carries VPNv4 routes with labels.
Why this answer
In a carrier-supporting-carrier (CSC) architecture, the customer carrier runs MPLS in its network and needs to exchange VPN routes (e.g., customer VPN prefixes) with the provider carrier. MP-BGP with the VPNv4 address family is the correct technology because it carries both the IPv4 prefix and the Route Distinguisher (RD), enabling the provider carrier to distinguish overlapping VPN routes from different customer VPNs. This is defined in RFC 4364 and is the standard inter-AS VPN option for CSC scenarios.
How to eliminate wrong answers
Option A is wrong because OSPF is an IGP that can only carry IPv4 or IPv6 unicast routes, not VPNv4 routes with RDs and route targets; it lacks the multi-protocol extensions needed for VPN route exchange between carriers. Option C is wrong because EIGRP is a Cisco-proprietary IGP that does not support VPNv4 address families or the BGP-based VPN route distribution required in CSC architectures. Option D is wrong because IPv4 BGP (standard BGP with the IPv4 unicast address family) cannot carry the VPNv4 NLRI that includes the RD, which is essential for separating overlapping customer VPN routes in a multi-tenant carrier environment.
A service provider is designing its core network to carry both IPv4 and IPv6 traffic. Which BGP approach best minimizes routing table size on core routers while maintaining full reachability?
Reduces BGP sessions and maintains full reachability efficiently.
Why this answer
iBGP with route reflectors minimizes the number of BGP sessions required in the core network, reducing routing table size and control-plane overhead while still maintaining full IPv4 and IPv6 reachability. Route reflectors allow iBGP speakers to advertise routes learned from other iBGP peers without requiring a full mesh, which is essential for scalability in large service provider cores.
Exam trap
Cisco often tests the misconception that eBGP reduces routing table size compared to iBGP, but the trap here is that eBGP does not inherently reduce prefix count; it only changes the administrative distance and path selection behavior, while iBGP with route reflectors directly reduces the number of sessions and control-plane load.
How to eliminate wrong answers
Option B is wrong because using eBGP between all core routers would require a full mesh of eBGP sessions, increasing routing table size and administrative complexity, and it does not inherently reduce the number of prefixes. Option C is wrong because static routing is not scalable for a service provider core carrying both IPv4 and IPv6 traffic; it cannot dynamically adapt to topology changes and would require manual configuration for thousands of prefixes. Option D is wrong because OSPF is an IGP designed for internal routing within an AS and cannot carry external BGP routes; relying on OSPF for external routes would break reachability to prefixes learned via BGP from other autonomous systems.
An engineer is troubleshooting an MPLS network where some routers are not exchanging labels via LDP. Which two steps are most appropriate for diagnosing the issue? (Choose two.)
Correct: This confirms session state.
An SP is designing MQC policies. Which THREE statements about MQC are true? (Choose three.)
Correct; that is the MQC process.
Why this answer
MQC uses class-map, policy-map, and service-policy; class-map can match multiple criteria; policy-map defines actions.
Refer to the exhibit. What is the role of this router for prefix 10.0.1.0/24?
Correct. The 'Pop tag' indicates this router is the penultimate hop, which removes the label before forwarding to the egress LSR.
Why this answer
The router is the penultimate hop for prefix 10.0.1.0/24 because it performs a 'Pop tag' operation (implicit null label). In MPLS, the penultimate hop pops the label before forwarding the unlabeled IP packet to the egress LSR. Therefore, this router is not the egress; it is the penultimate Label Switching Router (LSR).
Exam trap
A common trap is assuming that any router performing a label pop is the egress LSR. In MPLS with implicit null, the penultimate hop performs the pop, and the egress LSR receives an unlabeled IP packet.
How to eliminate wrong answers
Option A is wrong because a transit LSR swaps labels and forwards MPLS packets without removing the top label, but this router pops the label (implicit null), indicating it is not a transit node. Option C is wrong because the penultimate hop is the router immediately upstream that pops the label before forwarding to the egress; here, the router itself performs the pop, so it is the egress, not the penultimate hop. Option D is wrong because an ingress LSR imposes labels on incoming IP packets, but this router is receiving labeled packets and removing the label, not imposing one.
Which THREE components are required to deploy MPLS Layer 3 VPN?
VRFs provide per-customer routing separation.
Why this answer
VRFs (Virtual Routing and Forwarding) are required on PE routers to maintain separate, isolated routing tables for each customer VPN. This allows overlapping IP addresses between different customers and ensures that traffic from one VPN does not leak into another. Without VRFs, the PE router cannot distinguish between customer routes, making Layer 3 VPN operation impossible.
Exam trap
Cisco often tests the misconception that an IGP like OSPF is mandatory for MPLS Layer 3 VPN, when in fact the required components are VRFs, LDP (or another label distribution protocol), and MP-BGP with VPNv4 address family—the IGP is only needed to support LDP, not as a direct component of the VPN service.
Which THREE of the following are key components of an MPLS L3VPN architecture? (Choose three.)
VRF provides per-VPN routing.
Why this answer
VRF (Virtual Routing and Forwarding) on PE routers is a key component because it isolates customer routing tables and forwarding planes within the provider edge, allowing multiple customers to share the same physical infrastructure while maintaining separate routing domains. Each VRF maintains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, which is fundamental to L3VPN separation.
Exam trap
Cisco often tests the misconception that P routers must hold VPN routing information, but in reality P routers only perform label switching and have no awareness of customer VPN prefixes.
An engineer is troubleshooting MPLS LSP connectivity. The ingress PE router has the label binding for the FEC 10.1.1.0/24, but no LSP is established. Which command should be checked on the P routers to verify the LSP path?
Displays MPLS forwarding entries, revealing label path issues.
Why this answer
The correct command is 'show mpls forwarding-table' because it displays the LFIB (Label Forwarding Information Base) on each P router. Since the ingress PE has a label binding for FEC 10.1.1.0/24 but no LSP is established, the issue likely lies in label propagation or forwarding along the path. Checking the LFIB on P routers reveals whether they have installed the correct outgoing label and interface for that FEC, which is essential for LSP connectivity.
Exam trap
Cisco often tests the distinction between control plane (LDP neighbors, IP routes) and data plane (LFIB) verification, trapping candidates who assume LDP adjacency or IP reachability guarantees a working LSP.
How to eliminate wrong answers
Option A is wrong because 'show mpls interface' only verifies which interfaces are enabled for MPLS processing, not the label bindings or forwarding state for a specific FEC. Option B is wrong because 'show mpls ldp neighbor' checks LDP adjacency status, but if LDP neighbors are up, the problem could still be in label distribution or forwarding, so this command does not directly confirm LSP establishment. Option D is wrong because 'show ip route 10.1.1.0' shows the IP routing table entry, which may be present even if MPLS labels are not correctly propagated or the LSP is broken; MPLS LSPs depend on label switching, not just IP reachability.
In an MPLS core, which forwarding mechanism do P routers use to forward packets for L3VPN?
Correct. P routers swap labels based on the LFIB.
Why this answer
P routers (core routers) perform label switching based on the MPLS label stack. They do not need to examine the IP header; they swap labels and forward accordingly.
An SP network is using IS-IS and wants to achieve fast convergence using BFD. Which two statements about BFD in IS-IS are correct?
BFD provides fast detection, typically less than 1 second.
Why this answer
BFD provides fast failure detection (sub-second) and is configured under the interface. IS-IS does not require BFD for normal operation; it's an enhancement.
Which MPLS security best practice helps prevent label spoofing attacks where an attacker injects MPLS packets with a forged label stack to bypass ACLs?
Disabling TTL propagation is a security measure for hiding network topology, but it does not prevent label spoofing directly.
Why this answer
None of the provided options are the direct best practice to prevent label spoofing. The primary Cisco-recommended method is to disable MPLS on PE-CE interfaces or apply inbound label filtering to reject labeled packets from untrusted sources.
An engineer is configuring VPLS on a Cisco ASR 9000. After verifying the pseudowire status, they notice that the 'pw status' shows 'down' for one of the PWs. Which two conditions could cause this? (Choose two.)
Encapsulation must match between peers.
Why this answer
A mismatched encapsulation type (e.g., Ethernet vs. VLAN) on the pseudowire causes the PW to fail to come up. In VPLS, the encapsulation must match between the local and remote PE for the pseudowire to be operational; otherwise, the PW status will show 'down' due to a negotiation failure.
Exam trap
Cisco often tests the distinction between conditions that cause a pseudowire to be 'down' versus conditions that affect VPLS forwarding but leave the PW 'up', leading candidates to incorrectly select VPLS ID mismatch (Option B) as a cause of PW failure.
An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?
No ROA found for the prefix results in 'not-found'.
Why this answer
If no ROA exists for the prefix, the state is 'not-found'. 'Invalid' means the AS does not match an existing ROA. 'Valid' means the AS matches.
Refer to the exhibit. A network engineer configures a BGP route-map to set communities on routes advertised to a neighbor. After applying the configuration, the engineer checks the BGP table on the neighbor router and does not see the communities. What is the most likely reason?
Without 'send-community', communities are not advertised.
Why this answer
C is correct because BGP communities are not sent to a neighbor by default. Even if a route-map sets the community values correctly, the neighbor will not receive them unless the 'send-community' command is configured under the neighbor statement. This command enables the advertisement of the community attribute in BGP updates.
Exam trap
Cisco often tests the fact that BGP attributes like communities are not sent by default, and candidates mistakenly focus on route-map logic or prefix matching rather than the explicit neighbor command required to propagate the attribute.
How to eliminate wrong answers
Option A is wrong because the prefix-list is used to match routes for the route-map; if it does not match the exact prefix, the route-map would not apply, but the question states the route-map is configured and the engineer checks the BGP table on the neighbor—the issue is that communities are missing, not that the route is missing. Option B is wrong because while 'AA:NN' is the standard format for BGP communities, the route-map would still set the community value; if the format were incorrect, the router would typically reject the configuration or produce an error, not silently omit the community. Option D is wrong because the route-map is applied to outbound updates to set communities on routes advertised to the neighbor; applying it inbound would affect routes received from the neighbor, not the communities being sent.
Which BGP attribute is used to influence inbound traffic to an AS by indicating the preferred path into the AS?
Correct. MED is used to influence inbound traffic.
Why this answer
The MED (Multi-Exit Discriminator) is used to influence inbound traffic from neighboring ASes. It is advertised to eBGP peers and is compared when multiple paths to the same prefix exist from the same neighboring AS.
Refer to the exhibit. A network engineer is configuring a segment routing traffic engineering policy. The output shows two candidate paths. Why is path1 selected as the active path even though path2 has a bandwidth constraint?
path2 has preference 100, lower than path1's 200; the higher preference wins.
Why this answer
Path1 is selected as the active path because it has a higher preference value (200) compared to path2 (100). In segment routing traffic engineering, the preference value is the primary tie-breaker for candidate paths; the path with the highest preference is chosen regardless of bandwidth constraints. Bandwidth constraints are only evaluated after preference, and a path with a lower preference is not considered for activation even if it has a bandwidth constraint configured.
Exam trap
Cisco often tests the misconception that bandwidth constraints or path type (explicit vs. dynamic) determine path activation, when in reality the preference value is the decisive factor in SR-TE candidate path selection.
How to eliminate wrong answers
Option A is wrong because the segment list length is not a primary selection criterion; preference value takes precedence over path length. Option B is wrong because path2 is not down due to insufficient bandwidth; the output shows path2 is valid but not selected because its preference is lower. Option C is wrong because explicit paths are not inherently preferred over dynamic paths; the preference value determines which path is active, not the path type.
A service provider offers L3VPN services to multiple enterprise customers. One customer reports that they cannot reach some remote sites intermittently. The network uses MPLS L3VPN with MP-BGP for VPN route exchange. The PE routers are configured with route-target import and export. The customer's CE router is dual-homed to two different PEs in the same point of presence. The engineer checks the BGP table on both PEs and sees the customer routes with the correct route-target. However, pings from the CE to a remote site fail about 50% of the time, and the flapping pattern suggests load balancing issues. The engineer discovers that the remote site's network prefix is being advertised from both PEs with the same route-target but with different next-hops. The CE has equal-cost paths via both PEs. What is the most likely cause of the intermittent connectivity?
Per-packet load balancing can lead to packets being sent to different PEs, potentially exiting via different remote PEs and causing return packets to arrive out of order or be dropped due to stateful inspection.
Why this answer
When a CE router receives two equal-cost paths from two PEs, it may perform per-packet load balancing. This can lead to asymmetric routing where packets from the same flow take different paths, causing out-of-order delivery and connectivity failures about 50% of the time, especially if stateful devices are in the path or if the transport layer is sensitive to ordering. Option A is incorrect because the route-target import on the remote PE is properly configured (as the routes are seen with correct route-target).
Option C is incorrect because BGP timer misconfiguration would cause session flapping and complete loss, not a 50% intermittent failure. Option D is incorrect because MTU mismatch would cause consistent packet drops, not intermittent failures.
A network automation engineer needs to retrieve QoS policy statistics from a Cisco IOS XE device using RESTCONF. Which YANG module should be targeted?
This is the native Cisco YANG module for QoS.
Why this answer
The Cisco-IOS-XE-QoS YANG module is the native Cisco module that provides the data model for QoS policy configuration and operational statistics on IOS XE devices. Since the engineer is using RESTCONF to retrieve QoS statistics from a Cisco IOS XE device, this module is the correct target because it is specifically designed for and supported on IOS XE platforms.
Exam trap
Cisco often tests the distinction between native Cisco YANG modules (like Cisco-IOS-XE-QoS) and open-standard models (like ietf-qos or openconfig-qos), expecting candidates to know that native modules are required for platform-specific features and statistics on IOS XE devices.
How to eliminate wrong answers
Option B is wrong because ietf-qos is an IETF standard YANG model that is not natively supported on Cisco IOS XE for retrieving QoS statistics via RESTCONF; it is more commonly used in multi-vendor environments. Option C is wrong because Cisco-NX-OS-device is a YANG module for NX-OS devices, not IOS XE, and would not be applicable for a Cisco IOS XE device. Option D is wrong because openconfig-qos is an open standard YANG model that may be supported on some platforms but is not the native Cisco module for IOS XE; it is typically used in openconfig-based automation frameworks and may not expose the same detailed statistics as the Cisco native module.
Which THREE of the following are standard per-hop behaviors (PHBs) in the DiffServ model? (Select three.)
Default PHB for best-effort traffic.
Why this answer
The DiffServ model defines EF (Expedited Forwarding), AF (Assured Forwarding), and Default (BE) PHBs. CS is Class Selector, but not a separate PHB; it is part of AF? Actually CS is a backward-compatible PHB. Standard ones are EF, AF, and Default.
In IS-IS, what is the result of configuring wide metrics on all interfaces?
Wide metrics support higher values, essential for TE.
Why this answer
Wide metrics (24-bit or 32-bit) allow values up to 16,777,215 or higher, enabling TE and faster convergence with precise metric adjustments.
Which THREE functions are provided by EVPN multi-homing? (Choose three.)
Correct. Aliasing enables load balancing.
Why this answer
EVPN multi-homing uses ESI, DF election for BUM traffic, and aliasing for load balancing.
An SP is migrating its core network to Segment Routing (SR-MPLS). The network uses IS-IS as the IGP with SR extensions. Which three statements about SR-MPLS architecture are correct?
Correct. Adjacency SIDs are locally significant and represent a specific interface or link.
Why this answer
An Adjacency SID is a local label assigned to a specific IS-IS adjacency, representing a particular link between two routers. It is locally significant and used to steer traffic over that specific next-hop, not globally unique.
Exam trap
Cisco often tests the misconception that the SRGB must be identical across all routers, when in reality only the mapping from prefix SID to label must be consistent, and the SRGB can vary as long as the label space is properly coordinated.
A network operator is deploying segment routing in an MPLS network. They want to use a centralized controller to compute paths based on traffic demand and network constraints. Which architecture is being used?
SR-PCE is a centralized controller for path computation.
Why this answer
The scenario describes a centralized controller computing paths based on traffic demand and network constraints, which is the definition of a Path Computation Element (PCE) architecture. In Segment Routing, the SR-PCE (Segment Routing Path Computation Element) is the centralized controller that calculates optimal paths using traffic engineering constraints and then communicates the path information (via PCEP) to the headend router. This is distinct from distributed control plane approaches like LDP or SR-BE, and from SR-TE which is the overall traffic engineering mechanism but not the specific centralized controller architecture.
Exam trap
Cisco often tests the distinction between the overall traffic engineering mechanism (SR-TE) and the specific centralized controller architecture (SR-PCE), leading candidates to pick SR-TE when the question explicitly mentions a 'centralized controller' for path computation.
How to eliminate wrong answers
Option A is wrong because LDP-based MPLS is a distributed label distribution protocol that does not use a centralized controller for path computation; it relies on IGP shortest-path routing. Option B is wrong because Segment Routing Traffic Engineering (SR-TE) is the overall framework for steering traffic over explicit paths, but it does not inherently require a centralized controller; paths can be configured manually or via a PCE. Option D is wrong because Segment Routing Best Effort (SR-BE) uses IGP-computed shortest paths without any centralized controller or traffic engineering constraints.
The ingress PE maps DSCP to EXP bits.
Why this answer
In MPLS QoS, the EXP bits are set at the ingress PE router because this is where the IP packet first encounters the MPLS domain. The ingress PE maps the incoming IP packet's DSCP value to the MPLS EXP bits using a configured trust boundary or marking policy (e.g., 'policy-map' with 'set mpls experimental imposition'). This ensures that the QoS treatment is applied consistently across the MPLS core, as P routers typically forward based on the EXP bits without inspecting the original IP header.
Exam trap
Cisco often tests the misconception that EXP marking happens at the egress PE or that P routers can modify EXP bits based on routing, but the key is that EXP bits are set only at the ingress PE when the label is imposed, and P routers treat the EXP field as read-only unless explicit EXP manipulation is configured (e.g., via 'mpls experimental' in a policy-map on the P router, which is rare).
How to eliminate wrong answers
Option A is wrong because P routers in the core do not set EXP bits based on routing protocols; they forward MPLS packets based on the label and EXP bits already set at the ingress, and routing protocols like OSPF or IS-IS do not influence QoS marking. Option C is wrong because the egress PE router removes the MPLS label and may perform QoS actions (e.g., queuing or remarking) based on EXP-to-DSCP mapping, but the initial EXP marking occurs at the ingress, not the egress. Option D is wrong because the CE router is outside the MPLS domain and does not set MPLS EXP bits; it only sends IP packets with DSCP values, and the PE router may or may not trust those markings based on the configured trust boundary.
A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?
The MCAST-VPN address family is used for MVPN signaling.
Why this answer
In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.
Exam trap
Cisco often tests the distinction between the MCAST-VPN address family (used for MVPN signaling) and the VPNv4 address family (used for unicast VPN routes), leading candidates to mistakenly select VPNv4 when multicast is involved.
How to eliminate wrong answers
Option B is wrong because MVPN with BGP signaling (draft-rosen) explicitly uses BGP to carry multicast routing information; PIM is used for control plane signaling within the VRF but not for inter-PE multicast route exchange. Option C is wrong because the VPNv4 address family carries unicast VPN-IPv4 prefixes, not multicast routing information; multicast VPN requires the MCAST-VPN address family. Option D is wrong because the IPv4 multicast address family (AFI 1, SAFI 2) is used for native IPv4 multicast routing (e.g., PIM BSR or Auto-RP) and does not support VRF-scoped multicast VPN signaling.
An SP network engineer configures IS-IS with wide metrics. Which statement is true about IS-IS wide metrics compared to narrow metrics?
Wide metrics use TLV 135 and 236 for TE.
Why this answer
Wide metrics use a 24-bit field, allowing values up to 16,777,215, and support TE extensions and segment routing.
An engineer is troubleshooting a BGP peering issue between two routers. The peering is established, but routes are not being exchanged. On router R1, 'show bgp neighbors 192.0.2.2' shows the neighbor state as 'Established' but the 'Prefixes received' counter is zero. What is most likely the cause?
An outbound route-map on R2 would filter routes sent to R1, causing zero prefixes received on R1.
Why this answer
The neighbor state is 'Established', confirming that the TCP session and BGP open messages have been successfully exchanged. However, zero prefixes received indicates that R1 is not receiving any routes from the neighbor. An outbound route-map applied on the neighbor (the router sending routes to R1) can filter all prefixes before they are advertised, resulting in zero received prefixes while the session remains up.
Exam trap
Cisco often tests the distinction between session state and route exchange; the trap here is that candidates assume an Established session guarantees route exchange, overlooking outbound filtering on the neighbor side.
How to eliminate wrong answers
Option B is wrong because if the 'maximum-prefix' limit were exceeded, the BGP session would reset or go into an Idle state, not remain Established with zero prefixes received. Option C is wrong because a misconfigured update-source would prevent the BGP session from reaching the Established state entirely; the session would be stuck in Idle or Active. Option D is wrong because the 'next-hop-self' command affects the next-hop attribute of advertised routes, not the reception of prefixes; missing it would not cause zero prefixes received.
An OSPF network uses point-to-point links. The engineer notices that LSAs are being flooded every 30 minutes even when no topology changes occur. What is the most likely reason?
Correct. OSPF refreshes LSAs every 30 minutes.
Why this answer
In OSPF, LSAs have a default refresh interval of 30 minutes (1800 seconds). When this timer expires, the router that originated the LSA re-floods it to maintain database synchronization, even if no topology changes have occurred. This is normal OSPF behavior defined in RFC 2328, and it explains why LSAs are flooded every 30 minutes.
Exam trap
Cisco often tests the distinction between event-driven LSA flooding (due to topology changes) and periodic LSA refresh (due to the 30-minute timer), leading candidates to incorrectly attribute the behavior to a network issue like flapping interfaces or misconfigured timers.
How to eliminate wrong answers
Option A is wrong because LSU (Link State Update) packets are the correct mechanism for flooding LSAs; using them every 30 minutes for refresh is proper behavior, not incorrect usage. Option B is wrong because a flapping interface would cause frequent, irregular LSA updates (every few seconds or minutes), not a predictable 30-minute cycle. Option C is wrong because the dead timer (default 40 seconds on broadcast links) controls how long a neighbor is considered dead without receiving Hello packets; it does not trigger LSA flooding.
In Inter-AS MPLS Option B, which routers exchange labeled VPNv4 prefixes directly?
ASBRs exchange labeled VPNv4 prefixes via MP-eBGP in Option B.
Why this answer
In Inter-AS MPLS Option B, ASBR routers (Autonomous System Boundary Routers) exchange labeled VPNv4 prefixes directly across the AS boundary. This is achieved by having each ASBR perform two label operations: it pops the outer transport label from the VPNv4 prefix received from its own AS, then swaps the inner VPN label and forwards the labeled VPNv4 prefix to the neighboring ASBR in the adjacent AS. This direct exchange eliminates the need for end-to-end LSPs or MP-eBGP sessions between PE routers across different ASes.
Exam trap
Cisco often tests the misconception that PE routers directly exchange VPNv4 prefixes in Option B, but the correct answer is ASBR routers because the inter-AS VPNv4 exchange happens at the ASBR level using MP-eBGP, not between PEs.
How to eliminate wrong answers
Option B (PE routers) is wrong because PE routers in different ASes do not establish MP-eBGP sessions directly in Option B; the exchange occurs at the ASBR level, not between PEs. Option C (P routers) is wrong because P routers are core routers that only perform label switching based on the transport label and have no VPNv4 awareness or BGP sessions for VPNv4 prefixes. Option D (CE routers) is wrong because CE routers are customer edge devices that exchange standard IPv4 routes with PE routers and have no involvement in MPLS VPN label exchange.
Option E (Route reflectors) is wrong because route reflectors are used within an AS to scale iBGP sessions and do not participate in inter-AS VPNv4 prefix exchange; the direct exchange is between ASBRs across AS boundaries.
An operator is deploying EVPN-VPWS over an MPLS network. Which component uniquely identifies a multihomed Ethernet segment in EVPN?
Correct: ESI uniquely identifies the segment.
Why this answer
The Ethernet Segment Identifier (ESI) is a unique identifier for a multihomed segment. It is used for DF election, aliasing, and split-horizon.
An SP is deploying SR-TE policies using PCEP. What is the role of the SR-PCE in this architecture?
Correct; SR-PCE computes and provisions paths.
Why this answer
SR-PCE acts as a central controller that computes paths for SR-TE policies and communicates them via PCEP.
MP-BGP carries VPNv4 routes with MPLS labels.
Why this answer
In MPLS VPN architectures, VPN labels (also known as service labels) are distributed using Multiprotocol BGP (MP-BGP). MP-BGP carries VPN-IPv4 routes that include both the route distinguisher (RD) and the VPN label in the Network Layer Reachability Information (NLRI). This allows PE routers to exchange per-VRF label bindings, enabling label-switched VPN traffic across the MPLS core.
Without MP-BGP, the PE routers cannot signal the VPN-specific labels required for end-to-end label switching.
How to eliminate wrong answers
Option A is wrong because Segment Routing (SR) is a source-routing paradigm that can be used for transport label distribution (e.g., SR-MPLS), but it does not distribute VPN service labels; VPN labels still require MP-BGP. Option C is wrong because RSVP-TE is a signaling protocol for traffic-engineered LSPs and is used for transport label distribution, not for VPN service labels. Option D is wrong because LDP distributes transport labels (IGP next-hop labels) for the MPLS core, but it cannot carry VPN-IPv4 routes or VPN labels; VPN label distribution is exclusively handled by MP-BGP.
Refer to the exhibit. An engineer configured a telemetry subscription to push interface state data to a collector. The subscription shows 'State: Invalid'. What is the most likely cause?
The last error directly states 'Connection refused', meaning the receiver is not accepting connections. The engineer should check the collector's status.
Why this answer
The 'State: Invalid' with an associated error such as 'Connection refused' indicates that the subscription cannot reach the collector. This is typically due to the collector not being reachable or the service not listening on the specified port. Therefore, option B is correct.
Option A is incorrect because 'encode-kvgpb' is a valid encoding for gRPC telemetry. Option C is incorrect because the xpath '/interfaces/interface/state' is correctly formatted. Option D is incorrect because a periodic update interval of 500 ms is acceptable and not the cause of the invalid state.
When deploying IS-IS in a large service provider core, what is the recommended network type on Ethernet interfaces to improve scalability?
Point-to-point avoids DIS election and simplifies flooding, enhancing scalability.
Why this answer
In a large service provider core, configuring IS-IS interfaces as point-to-point (network type point-to-point) improves scalability by eliminating the need for Designated Router (DIS) election and the associated pseudonode LSPs. This reduces the number of LSPs in the link-state database, lowers CPU and memory overhead, and speeds up convergence, which is critical in dense core networks.
Exam trap
Cisco often tests the misconception that broadcast is the only valid network type for Ethernet interfaces in IS-IS, but the trap is that point-to-point is the recommended type for scalability because it eliminates DIS overhead, even though the physical medium is Ethernet.
How to eliminate wrong answers
Option A is wrong because loopback is not a network type for IS-IS; it is a logical interface type used for router IDs or management, not for adjacency formation. Option C is wrong because point-to-multipoint is not a valid IS-IS network type; IS-IS supports only broadcast and point-to-point network types on Ethernet interfaces. Option D is wrong because non-broadcast is a network type used in OSPF (e.g., NBMA), not in IS-IS; IS-IS does not have a non-broadcast network type.
Option E is wrong because broadcast is the default network type on Ethernet, but it requires DIS election and pseudonode LSPs, which increase LSP database size and processing overhead, reducing scalability in large core networks.
A service provider is implementing EVPN for its VPLS replacement. They have configured BGP EVPN on all PEs and have set up an EVPN instance for a customer requiring broadcast, unknown unicast, and multicast (BUM) traffic. The customer reports that broadcast traffic from one site is not being received at another site. The engineer checks the EVPN configuration and finds that the EVI is configured correctly, the route-target matches, and the BGP sessions are established. The engineer also checks the MAC address table on the receiving PE and sees that the source MAC of the broadcast frame is learned on the local interface, but not from the remote VTEP. The engineer suspects an issue with the IMET (Inclusive Multicast Ethernet Tag) route. Which action should the engineer take to verify the IMET route?
IMET routes are route-type 3 in EVPN; checking their presence and reachability is essential for BUM traffic.
Why this answer
'show bgp l2vpn evpn route-type 3' displays the IMET (Inclusive Multicast Ethernet Tag) routes, which are necessary for forwarding BUM traffic between VTEPs. Option A is incorrect because 'show evpn instance detail' shows local EVI configuration but not remote IMET routes. Option C is incorrect because route-type 2 is for MAC/IP advertisement, not IMET.
Option D is incorrect because 'show l2vpn vfi' is used for VPLS, not EVPN.
Which THREE of the following are correct statements about EVPN-VXLAN in a data center fabric? (Select three.)
Route type 3 is the inclusive multicast route.
Why this answer
EVPN route type 3 (Inclusive Multicast Ethernet Tag Route) is used to advertise the VTEP addresses that participate in a given broadcast domain (EVI). This enables the underlay to forward BUM (Broadcast, Unknown unicast, Multicast) traffic by building a head-end replication list or by signaling multicast group membership, ensuring that BUM frames are delivered to all remote VTEPs in the same VXLAN segment.
Exam trap
Cisco often tests the misconception that VXLAN is a Layer 3 overlay or that it always requires multicast in the underlay, when in fact VXLAN is a Layer 2 overlay and can use head-end replication as an alternative to multicast.
In EVPN with SRv6, which SID behavior is used for integrated routing and bridging (IRB) to forward packets between the IP fabric and the Ethernet segment?
Correct. End.DT4 decapsulates and does IPv4 table lookup, enabling routing between IP and bridged domain.
Why this answer
End.DT2U is for L2VPN; for IRB, the router uses End.DT4/DT6 for IP forwarding and then bridges to the segment; however, the question asks for the SID behavior that enables IRB. Usually, IRB is achieved by combining a Layer 2 VPN SID and a Layer 3 VPN SID, but for the specific behavior that forwards between IP and MAC, it's often End.DT4 or End.DT6 plus a MAC lookup. But standard SRv6 IRB uses a dedicated SID like End.DT2U? Actually, IRB requires both routing and bridging; the common approach is to use a Layer 3 VPN SID for the routed part and an EVPN Ethernet segment for bridging.
In SRv6, the endpoint behavior for IRB is typically End.DT4 or End.DT6 for the routing side, and for bridging, it's End.DT2U. But the question expects a single behavior? Perhaps End.DT2U is for L2VPN only. Let's think: Cisco documentation often describes 'End.DT2U' for L2VPN, and 'End.DT4' for L3VPN.
For IRB, the service is provided by a combination. However, a specific SID behavior called 'End.DT2U' can be used for EVPN VPWS. To align with common SIDs, the answer is End.DT2U for L2VPN IRB? Actually, IRB typically uses a Layer 3 gateway SID.
I'll choose End.DT4 as it routes IP, and then the router bridges locally. But the question says 'forward packets between the IP fabric and the Ethernet segment' - that is routing. So End.DT4 is correct.
What is the primary difference between traffic shaping and policing in a QoS implementation?
This correctly describes the difference.
Why this answer
Shaping buffers excess traffic to smooth bursts, while policing drops or re-marks excess traffic to enforce a hard rate limit.
In SR-MPLS, what is the purpose of the SRGB (Segment Routing Global Block)?
Correct: SRGB is for prefix SIDs.
Why this answer
SRGB is a reserved label range used for globally significant prefix SIDs. All routers in the domain use the same SRGB to ensure consistent label mapping.
A service provider is troubleshooting an MPLS L3VPN where customers behind CE-A cannot reach CE-B. The PE routers are Cisco ASR 9000 series. On PE-A, the show cef vrf CUSTOMER prefix 10.1.1.0/24 command displays 'punt' as the forwarding path. What is the most likely cause?
The IP prefix is not resolved via an MPLS label in the LFIB – this causes the CEF to punt packets to the CPU because the hardware cannot forward them without a label.
Why this answer
When show cef vrf CUSTOMER prefix 10.1.1.0/24 displays 'punt', it means the prefix does not have a valid MPLS label in the LFIB (Label Forwarding Information Base). In MPLS L3VPN, the PE must push a label for the next-hop PE to forward traffic across the MPLS core. Without a label, the packet is punted to the CPU for further processing, often due to missing label binding or incomplete LDP/IGP synchronization.
Option A correctly identifies this issue. Option B is incorrect because MTU issues would cause drops, not punt. Option C is incorrect because missing route-target import would affect route installation in the VRF but not necessarily cause punt for a locally resolved prefix.
Option D is incorrect because CE-PE routing protocol (whether OSPF or BGP) is not directly related to MPLS label resolution on the PE.
A service provider is deploying segment routing in their MPLS core. They want to use an IGP as the control plane for label distribution without running LDP or RSVP-TE. Which IGP is best suited for this purpose?
IS-IS supports segment routing extensions and is widely used in SP cores.
Why this answer
IS-IS is the best-suited IGP for segment routing in an MPLS core because it natively supports the Segment Routing (SR) extensions defined in RFC 8667. These extensions allow IS-IS to advertise Prefix-SIDs and Adjacency-SIDs directly within the link-state database, enabling label distribution without requiring LDP or RSVP-TE. This makes IS-IS a natural fit for service providers deploying SR-MPLS.
Exam trap
The trap here is that candidates may think OSPF is also a valid choice, but the question specifically asks for the IGP best suited for segment routing without LDP or RSVP-TE, and while OSPF does support SR (RFC 8665), IS-IS is historically more common in service provider cores due to its native support for CLNS and easier migration from LDP to SR.
How to eliminate wrong answers
Option A is wrong because BGP is not an IGP; it is an EGP used for inter-domain routing and, while it can carry SR policies via BGP-LS or BGP SR-TE, it does not function as the IGP control plane for label distribution within a single IGP domain. Option B is wrong because EIGRP is a Cisco-proprietary distance-vector protocol that does not support segment routing extensions; it relies on its own RIB-based label distribution and is not standardized for SR-MPLS. Option D is wrong because RIP is a legacy distance-vector protocol that lacks any support for MPLS or segment routing, and it cannot distribute labels or SIDs.
Which THREE are correct statements about IOS XR process separation? (Choose three.)
This is a key benefit.
Why this answer
IOS XR runs each protocol as a separate process, providing fault isolation and independent restart.
Which two statements about LDP liberal label retention are true? (Choose two.)
Correct: Labels are already available.
Why this answer
Liberal label retention is the default mode in Cisco IOS and does not require explicit configuration; it retains all labels even if not used (D) and speeds convergence because labels are already available after a topology change (B). Option C describes conservative retention, and option E is false because liberal retention is default and does not require manual filtering.
An SP engineer is configuring model-driven telemetry (MDT) to monitor interface utilization on Cisco routers. The telemetry receiver uses gRPC and is experiencing high CPU load due to excessive subscription data. Which MDT subscription parameter should be adjusted to reduce the data rate without losing critical threshold events?
On-change reporting sends updates only when the value changes, and suppression limits the update frequency, reducing load while still reporting events.
Why this answer
On-change reporting with suppression reduces data rate by sending updates only when values change, and suppression prevents too-frequent updates. Increasing sample interval risks missing threshold events. Other options do not effectively reduce data rate while preserving event detection.
Given the output, which configuration mismatch would prevent a remote PE in the same VPN from installing this route into its VRF?
Correct: The route's RT must match an import RT on the remote VRF for the route to be installed.
Why this answer
The route carries RT:65000:200. For a remote PE to install this route into its VRF, the VRF must have an import RT that includes RT:65000:200. If the remote PE's VRF imports a different RT (e.g., RT:65000:100), the route will not be installed.
Option B is incorrect because different route distinguishers (RDs) do not prevent route installation as long as the Route Target matches. Option C is incorrect because MPLS VPN does not filter routes based on BGP AS-path by default; moreover, the AS-path containing AS 65000 is not a typical filter in this context. Option D is incorrect because the next-hop 10.1.1.2 is reachable in the remote PE's global routing table, as indicated by the output (or assumed reachable).
Which TWO tasks are required when implementing segment routing in an MPLS network?
IGP must be configured to support segment routing and advertise labels (prefix-SIDs).
Why this answer
Options C and D are correct. Configuring the IGP (OSPF or IS-IS) with segment routing extensions is essential to advertise prefix-SIDs and adjacency-SIDs, enabling segment routing control plane. Enabling MPLS on all interfaces that participate in segment routing forwarding is required to enable MPLS forwarding for the SIDs.
Option A (RSVP-TE) is not required because segment routing uses source-routed paths instead of RSVP-TE LSPs. Option B (CEF) is generally enabled by default on Cisco routers and is a prerequisite for MPLS forwarding, but it is not a task specific to implementing segment routing. Option E (LDP) is not required because segment routing replaces LDP with SID-based label distribution.
An engineer is configuring MPLS LDP on a Cisco router. The router uses downstream unsolicited mode with liberal label retention. Which behavior describes the label distribution and retention on this router?
Correct description.
Why this answer
Downstream unsolicited means the downstream router sends label bindings to all neighbors without being asked. Liberal label retention means the router keeps all received label bindings, even if the next hop is not reachable.
An SP engineer configures IS-IS fast convergence mechanisms. Which three techniques help achieve sub-second convergence in IS-IS?
iSPF reduces SPF recomputation.
Why this answer
BFD provides fast failure detection, PRC recalculates only affected routes, and SPF incremental (iSPF) reduces SPF computation. LFA provides fast reroute.
Which Cisco SP router platform uses IOS XR and is commonly deployed at the aggregation layer, supporting both L2 and L3 services?
ASR 9000 is a popular aggregation router with IOS XR.
Why this answer
Cisco ASR 9000 is an aggregation router running IOS XR, suitable for L2/L3 services.
Which technology allows a service provider to offer different classes of service over a single MPLS network?
QoS provides classification and prioritization for service classes.
Why this answer
QoS (Quality of Service) enables a service provider to differentiate traffic by marking packets with specific DSCP or IP precedence values and applying policies such as policing, shaping, and queuing. This allows multiple classes of service (e.g., voice, video, best-effort) to be carried over a single MPLS network while guaranteeing bandwidth, latency, and jitter requirements for each class.
Exam trap
Cisco often tests the misconception that MPLS VPNs or VRFs alone provide class-of-service differentiation, when in fact VRFs only isolate routing and forwarding, and QoS policies must be separately configured to prioritize traffic within or across VPNs.
How to eliminate wrong answers
Option B (BGP) is wrong because BGP is a routing protocol used to exchange reachability information between autonomous systems, not a mechanism for classifying or prioritizing traffic into different service classes. Option C (LDP) is wrong because LDP is a label distribution protocol that builds MPLS label-switched paths (LSPs) but does not provide any traffic differentiation or class-of-service capabilities. Option D (MPLS VPN with VRF) is wrong because VRFs provide logical separation of routing tables and forwarding planes for different customers or VPNs, but they do not inherently offer per-class traffic prioritization; QoS policies must be explicitly applied to achieve class-of-service differentiation.
Which TWO statements correctly describe differences between PIM dense mode and PIM sparse mode? (Choose two.)
Dense mode floods to all interfaces and then prunes where not wanted.
Why this answer
PIM-DM operates on the assumption that every downstream router wants to receive multicast traffic for a given group. It initially floods multicast traffic out all PIM-enabled interfaces, then prunes back branches that do not have interested receivers. This flood-and-prune behavior is fundamental to PIM-DM's design for dense multicast environments.
Exam trap
Cisco often tests the reversal of PIM-DM and PIM-SM behaviors, specifically confusing which mode uses explicit joins versus flood-and-prune, and which mode requires an RP.
A service provider is implementing BGP route reflectors to scale iBGP. Which THREE mechanisms are used to prevent routing loops in a route reflector topology? (Choose three.)
Correct. CLUSTER_LIST tracks clusters to prevent loops.
A customer has a 100 Mbps access link and wants to limit traffic to 95 Mbps with burst allowance up to 100 Mbps. Which QoS action should be applied on the egress interface?
Policing limits the rate and can drop or remark exceeding traffic, allowing bursts.
Why this answer
Police is the correct QoS action because it allows you to enforce a maximum traffic rate (95 Mbps) while permitting bursts up to 100 Mbps, dropping or remarking excess traffic. Unlike shaping, policing does not buffer traffic, so it can enforce a hard limit on egress without introducing delay, which matches the requirement to limit traffic with a burst allowance.
Exam trap
Cisco often tests the distinction between policing and shaping, where the trap is that candidates assume shaping is always the answer for rate-limiting on egress, but policing is required when the goal is to enforce a hard burst limit without buffering.
How to eliminate wrong answers
Option A is wrong because shape buffers excess traffic to smooth output to a configured rate (e.g., 95 Mbps), but it cannot enforce a hard burst limit of 100 Mbps; shaping allows bursts to exceed the rate temporarily as long as the average is met, which contradicts the requirement to limit bursts to exactly 100 Mbps. Option B is wrong because priority is used to assign strict priority queuing to traffic classes, not to rate-limit or police traffic; it does not enforce a bandwidth cap or burst allowance. Option C is wrong because bandwidth allocates a minimum guaranteed bandwidth to a class (e.g., 95 Mbps) but does not limit traffic to that rate; traffic can exceed the allocated bandwidth if the link is idle, and it does not provide burst control.
What does the output indicate about the TI-LFA protection on R1?
The line 'Number of prefixes with backup paths: 1' confirms this.
Why this answer
The output shows that for the protected prefix 10.1.1.1/32, the backup path is listed as 'N/A', meaning no backup path was computed. However, for the other prefix (likely a different /32), a backup path is present. This indicates that only one prefix has a backup path, making option B correct.
TI-LFA computes a backup path only when a viable post-convergence path exists without microloops; if the topology doesn't allow it, the backup is marked as not available.
Exam trap
Cisco often tests the misconception that TI-LFA always provides a backup path for every prefix, but in reality, the backup is only installed when a loop-free post-convergence path exists; candidates may incorrectly assume all prefixes are protected.
How to eliminate wrong answers
Option A is wrong because the output explicitly shows that not all prefixes have backup paths (one shows 'N/A'). Option C is wrong because at least one prefix does have a backup path (the other prefix shows a valid backup next hop). Option D is wrong because only one prefix has a backup path, not two.
Which MPLS label operation is performed by the penultimate hop router in PHP (Penultimate Hop Popping)?
PHP pops the label.
Why this answer
In PHP, the penultimate hop router pops the label before forwarding the packet to the egress router, reducing the egress's workload.
You are a network automation engineer for a large service provider. Your team is tasked with automating the provisioning of new MPLS L3VPN services across a multi-vendor environment (Cisco and Juniper). The automation framework uses Ansible with Jinja2 templates and NETCONF as the transport protocol. During a pilot deployment, the automation successfully configures the Cisco devices but fails on Juniper devices with a 'syntax error' when applying the generated XML configuration. The Jinja2 templates are designed to generate Cisco-style configuration. You need to modify the automation to support both vendors. Which approach is most effective?
Vendor-neutral models with separate templates ensure compatibility.
Why this answer
Using IETF YANG models (e.g., RFC 8299 for L3VPN) provides a vendor-neutral data model that both Cisco and Juniper support via NETCONF. Creating separate Jinja2 templates for each vendor ensures the generated XML conforms to each device's native YANG models, avoiding syntax errors. This approach maintains automation consistency while respecting vendor-specific implementations.
Exam trap
Cisco often tests the misconception that a single template or translation script can handle multi-vendor environments, but the correct approach is to use IETF YANG models with vendor-specific templates to ensure schema compliance.
How to eliminate wrong answers
Option B is wrong because translating Cisco XML to Juniper XML post-generation is fragile, error-prone, and does not leverage standardized YANG models; it introduces an unnecessary translation layer that can break with firmware updates. Option C is wrong because switching to CLI-based automation with SSH abandons the structured, programmatic benefits of NETCONF and YANG, leading to brittle scripts that are harder to maintain and validate. Option D is wrong because a single Jinja2 template with conditionals for different XML structures becomes complex and unmanageable, especially as the number of vendors or service variations grows; it also does not address the root cause of using vendor-native YANG models.
Match each MPLS protection mechanism to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Fast Reroute to bypass a failed link or node locally
End-to-end path protection for MPLS TE tunnels
Graceful restart for LDP to preserve forwarding during control plane restart
Prefix Independent Convergence for fast BGP failover
Fast Reroute for RSVP-TE tunnels using backup paths
Why these pairings
The correct matches are: A (MPLS FRR), B (MPLS TE FRR), C (MPLS PW Redundancy), D (MPLS LSP Protection). Distractors E and F swap definitions or use incorrect descriptions.
An SP router is configured with CBWFQ. For a data class requiring 30% bandwidth guarantee, which command is correct in the policy-map?
Correct way to specify percentage.
Why this answer
The 'bandwidth percent' command allocates a percentage of the interface bandwidth to the class.
Which three components are part of NSO (Network Services Orchestrator) architecture? (Choose three.)
YANG models define service structures in NSO.
Why this answer
YANG models are the foundation for service definitions in NSO because they define the data structures and constraints for network services using a standardized modeling language (RFC 6020/7950). NSO uses YANG to model both the service layer (customer-facing services) and the device layer (native device configurations), enabling service abstraction and multi-vendor orchestration.
Exam trap
Cisco often tests the distinction between protocols that NSO can orchestrate (like PCEP for path computation) versus components that are part of NSO's internal architecture (like NEDs, CDB, and YANG models), leading candidates to mistakenly select external protocols as architectural components.
Which three are required components for deploying Segment Routing in an MPLS network? (Choose three.)
Routers must support MPLS forwarding to process labels.
Why this answer
B is correct because Segment Routing relies on the existing MPLS forwarding plane; routers must be capable of pushing, swapping, and popping MPLS labels based on the Segment Routing label stack. Without MPLS forwarding hardware or software support, the SR-MPLS data plane cannot function, even if the control plane is configured.
Exam trap
Cisco often tests the misconception that Segment Routing requires RSVP-TE or LDP, but the correct answer is that SR uses IGP extensions and the existing MPLS forwarding plane, eliminating the need for these legacy signaling protocols.
Refer to the exhibit. Which statement is true about this configuration?
The autocfg command enables LDP automatically.
Why this answer
The `mpls ip` command under interface configuration enables LDP on that interface, allowing it to automatically discover LDP neighbors and exchange label bindings. This command implicitly enables LDP without requiring manual neighbor configuration, which is the default behavior for label distribution in many MPLS deployments.
Exam trap
Cisco often tests the distinction between `mpls ip` (which enables LDP and MPLS forwarding) and manual LDP configuration (which would require `mpls ldp neighbor`), leading candidates to incorrectly assume that LDP requires explicit neighbor statements.
How to eliminate wrong answers
Option A is wrong because LDP is not manually configured; the `mpls ip` command triggers automatic LDP neighbor discovery and session establishment via UDP and TCP port 646, without needing explicit neighbor statements. Option B is wrong because MPLS VPN requires additional configuration such as VRF definitions, BGP address-family VPNv4, and route-target import/export, none of which are shown in the exhibit. Option D is wrong because `mpls ip` explicitly enables MPLS forwarding on the interface, not disables it; disabling MPLS forwarding would require the `no mpls ip` command.
An SP engineer is hardening management plane access on IOS XR routers. They want to enforce role-based access control using task groups. Which AAA protocol is required to support attribute-based authorization on IOS XR?
TACACS+ provides granular command authorization and is used with IOS XR task groups.
An SP uses traffic policing and shaping to manage bandwidth. Which statement best describes the difference between the two mechanisms?
Correct definition.
Why this answer
Shaping buffers excess packets to smooth traffic and reduce bursts, while policing drops or re-marks excess packets to enforce a strict rate limit.
An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?
The key must be shared and trusted.
Why this answer
NTP authentication uses a shared key (MD5 or SHA) configured on both client and server. The key must match for the client to accept time updates.
A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)
SNMPv3 provides secure network management.
A service provider is deploying segment routing (SR) with MPLS data plane. The network uses OSPF as the IGP. Which configuration is required to enable SR-MPLS and ensure that routers advertise prefix-SIDs for their loopback interfaces?
This enables SR-MPLS and advertises a prefix-SID for the loopback.
Why this answer
To enable SR-MPLS with OSPF, you must globally enable segment routing with the 'segment-routing mpls' command, and then assign a prefix-SID to the loopback interface under the OSPF process using the 'prefix-sid' command. This ensures that routers advertise the prefix-SID for their loopback via OSPF extensions, which is the fundamental requirement for SR-MPLS operation without LDP.
Exam trap
Cisco often tests the distinction between enabling segment routing globally versus configuring the SRGB; candidates mistakenly think that setting the SRGB alone enables SR-MPLS, but the 'segment-routing mpls' command is the actual enabler.
How to eliminate wrong answers
Option A is wrong because it enables MPLS LDP via auto-config, which is not required for SR-MPLS and actually introduces a different label distribution protocol (LDP) that conflicts with the segment routing paradigm. Option B is wrong because 'label mode per-prefix' is a command used for MPLS LDP label allocation, not for SR-MPLS prefix-SID assignment; SR-MPLS uses the 'prefix-sid' command under OSPF, not label mode configuration. Option C is wrong because while configuring the segment-routing global block (SRGB) is important for SR-MPLS, it does not enable segment routing itself; the 'segment-routing mpls' global command is mandatory, and 'mpls ip' on interfaces is not required for SR-MPLS as it relies on IGP extensions, not LDP.
Policers can re-mark DSCP to 0 for excess traffic.
Why this answer
The core router is likely applying a policer that marks down traffic exceeding the committed information rate (CIR). When traffic is out-of-contract, the policer can re-mark the DSCP to 0 (best effort), which overrides the trusted DSCP AF31 and the CoS 4 set at the PE. This behavior is common in service provider environments where core routers enforce traffic contracts and use policing to penalize excess traffic.
Exam trap
Cisco often tests the misconception that MPLS EXP bits are automatically preserved end-to-end, but the trap here is that a core router's policer can independently re-mark the DSCP to 0, overriding any earlier trust or EXP mapping, especially when the traffic exceeds the contracted rate.
How to eliminate wrong answers
Option B is wrong because LDP labels are used for MPLS label distribution and do not inherently ignore DSCP; core routers can still examine and act on DSCP values in the IP header. Option C is wrong because the ingress PE does set MPLS EXP bits when it trusts DSCP and sets CoS to 4, as the policy map maps DSCP to CoS/EXP. Option D is wrong because the MPLS EXP bits are explicitly set from DSCP by the PE's policy map (trust DSCP, set CoS 4), so the issue is not a failure to copy but rather a downstream remarking by the core router.
A service provider wants to offer a point-to-point Layer 2 Ethernet service between two customer sites with strict SLAs. The solution must use MPLS pseudowires. Which MEF service type aligns with this requirement?
E-Line provides point-to-point Ethernet connectivity.
Why this answer
E-Line is a point-to-point Ethernet service defined by MEF. E-LAN is multipoint, E-Tree is rooted multipoint, E-Access is for access to a service provider network.
Which TWO methods can RESTCONF use to create a new data resource? (Choose two.)
POST creates a new resource.
Why this answer
RESTCONF uses POST to create a new resource, and PUT can also create if the resource does not exist.
Refer to the exhibit. An engineer notices that R1 has an LDP neighbor but 'show mpls forwarding-table' on R1 shows no label bindings for prefixes learned from R2. What is the most likely cause?
Downstream on-demand means labels are not sent until requested; if no request, no labels.
Why this answer
R1 shows an LDP neighbor (session is up) but no label bindings for prefixes from R2. This occurs when R1 is configured for 'label distribution on-demand' (RFC 5036), meaning it only requests label bindings for prefixes in its routing table, not all prefixes from the peer. Since R1 has not yet needed those specific prefixes, it has not requested labels, so the forwarding table remains empty.
Exam trap
Cisco often tests the distinction between LDP session state (neighbor adjacency) and label binding exchange, tricking candidates into thinking a working session guarantees label bindings, when in fact 'label distribution on-demand' can suppress label advertisements.
How to eliminate wrong answers
Option A is wrong because the LDP discovery source being incorrect would prevent neighbor discovery entirely, but the exhibit shows an LDP neighbor is present, so discovery is working. Option B is wrong because if the peer LDP identifier were not reachable, the LDP session would not establish; the exhibit confirms a session exists, so reachability is fine. Option C is wrong because the LDP session is established (neighbor is shown), so the session is not the issue; the problem is specifically with label binding exchange, not session state.
Which TWO statements about YANG data models are true? (Choose two.)
YANG is the data modeling language for NETCONF/RESTCONF.
Why this answer
YANG (RFC 6020/7950) is a data modeling language specifically designed to model configuration and state data for network management protocols like NETCONF and RESTCONF. YANG defines the structure, constraints, and semantics of data that can be exchanged via these protocols, making it the standard for model-driven network automation.
Exam trap
Cisco often tests the misconception that YANG is only for configuration data, but candidates must remember that YANG explicitly supports both config and state data via the 'config false' statement.
A service provider is deploying a new MPLS core with Segment Routing and requires fast convergence upon link failure. They plan to use TI-LFA (Topology Independent Loop-Free Alternate). What is a prerequisite for TI-LFA to provide protection against any single link failure?
TI-LFA uses the link-state database to compute backup paths.
Why this answer
TI-LFA relies on the IGP having a complete view of the network topology to compute a post-convergence path that avoids the failed link. OSPF and IS-IS are link-state protocols that flood link-state advertisements (LSAs) or link-state packets (LSPs) to provide this full topology database, which is essential for TI-LFA to calculate a loop-free backup path for any single link failure.
Exam trap
Cisco often tests the misconception that TI-LFA requires LDP or RSVP-TE, but the key prerequisite is a link-state IGP (OSPF or IS-IS) with complete topology information, as TI-LFA is a Segment Routing feature that uses IGP-based SIDs for path computation.
How to eliminate wrong answers
Option B is wrong because BGP-LU (BGP Labeled Unicast) is used for inter-domain label distribution and does not provide the link-state topology information required by TI-LFA; TI-LFA operates within a single IGP domain. Option C is wrong because LDP is not a prerequisite for TI-LFA; in fact, Segment Routing can operate without LDP by using IGP-distributed labels (Prefix-SIDs), and TI-LFA is designed for SR-based networks. Option D is wrong because RSVP-TE with FRR is a separate MPLS fast-reroute mechanism that requires explicit tunnel signaling and resource reservation, whereas TI-LFA is a topology-based, signaling-free protection mechanism that works with Segment Routing and a link-state IGP.
Practice 350-501 by domain
Target a specific domain to shore up weak areas.