Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 601–675

A Prefix-SID is a Segment Routing identifier that is globally unique within the SR domain and is bound to an IGP prefix (e.g., a loopback interface). It instructs routers to forward packets along the shortest path to that prefix, as computed by the IGP (OSPF or IS-IS). Option D correctly states this role, while Option C is identical but marked as incorrect in the answer set, making D the correct choice.

The 'path computation failed' error indicates that the head-end router cannot find a valid path for the MPLS TE tunnel. IGP TE extensions (OSPF TE or IS-IS TE) must be enabled on the head-end router to flood link attributes (bandwidth, TE metrics) and build the TED (Traffic Engineering Database). Without the TED, CSPF (Constrained Shortest Path First) cannot compute a path, leaving the tunnel down.

Option B is correct because route-maps allow you to tag redistributed EIGRP routes with a specific tag value (e.g., 'tag 100') and then filter those tagged routes on OSPF routers using a distribute-list in or prefix-list combined with the route-map. This prevents the redistributed routes from being re-injected back into EIGRP, breaking the redistribution loop. Without such tagging and filtering, mutual redistribution between EIGRP and OSPF can cause routing loops due to the two-way redistribution of routes.

In an MPLS L3VPN, VPNv4 routes carry both the IPv4 prefix and the Route Distinguisher (RD) to ensure uniqueness across overlapping customer address spaces. The VPNv4 unicast address family (address-family ipv4 vpn) is the mandatory BGP address family used between PE routers to exchange these VPNv4 routes, enabling MPLS-based VPN reachability.

Wide metrics use a 24-bit or 32-bit field, allowing values up to 16,777,215 or more, and are backward compatible with narrow metrics via apportioning.

Weight (Cisco proprietary) and LOCAL_PREF are the first two criteria in BGP path selection. They influence outbound traffic by choosing the preferred path for routes learned from multiple sources.

Strict mode requires the source address to be reachable via the incoming interface, which fails with asymmetric routing. Loose mode only checks that the source address exists in the routing table, making it suitable for asymmetric paths.

Network slices are isolated virtual networks, but they share the same physical infrastructure; they do not have dedicated physical links.

LLQ is strict priority, so voice gets priority up to its police rate; if voice exceeds, it may be dropped. Video and data get their allocated bandwidths, but if voice exceeds its allowed priority, it may be policed, preventing starvation.

B is correct because LDP must be enabled on the core interfaces between PE1 and PE2 to establish LDP sessions, which are required to exchange MPLS labels for the transport LSP. Without LDP, the MPLS forwarding path between the PEs is broken, preventing CE-to-CE ping even if BGP VPNv4 routes are correctly advertised.

EBGP with BFD provides the fastest convergence for PE-CE link failures because BFD can detect link failures in sub-second intervals (as low as 50 ms) and trigger BGP to withdraw routes immediately, without waiting for routing protocol timers. This is critical for Layer 3 MPLS VPNs where fast failover is required, and EBGP is commonly used as the PE-CE routing protocol in service provider environments.

Option A is correct because the ingress router (LER) in an MPLS network performs a push operation, adding a label stack (typically one or more labels) onto the incoming IP packet. This label stack is used to direct the packet along a Label Switched Path (LSP) through the core, enabling MPLS forwarding based on labels rather than IP routing.

Cisco CRS (Carrier Routing System) is a high-end core router supporting high-density 100GE and running IOS XR.

VRF (Virtual Routing and Forwarding) creates separate routing tables per customer, ensuring isolation.

Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.

The 'include-all' affinity means the tunnel path must include all links that have the specified color attribute. If a link does not have 'red' attribute, it is excluded from the CSPF computation.

SSH provides encrypted access, TACACS+ centralizes AAA with encryption, and IOS XR task groups allow fine-grained RBAC. Telnet and SNMPv2c are insecure; SNMPv3 is required for security.

Option C is correct because BGP only installs the best path into the routing table for forwarding. BGP selects a single best path from all available paths for a given prefix based on its path selection algorithm (e.g., highest weight, local preference, shortest AS path). Only this best path is considered valid for forwarding, even if multiple paths exist in the BGP table.

In MP-BGP for IPv6, the next-hop address for iBGP peers must be reachable via an IPv6 route in the global routing table or the appropriate VRF. When OSPFv3 redistributes internal routes into BGP, the next-hop is often set to the OSPFv3 router's own IPv6 address; if that address is not reachable (e.g., because the interface is not in the IPv6 unicast routing table or the next-hop is link-local), iBGP peers will not install the routes. This is a common cause of routes being learned but not advertised to iBGP peers.

When the 'show mpls forwarding-table' command shows 'Untagged' for a specific FEC, it indicates that the router is performing Penultimate Hop Popping (PHP). In PHP, the penultimate router (the router before the egress LSR) pops the MPLS label and forwards the packet as an IP packet (untagged) to the egress LSR. This is standard behavior to avoid the egress LSR having to perform a double lookup.

EVPN multi-homing uses ESI for identification, DF election to avoid duplicate frames, and aliasing for load balancing.

In downstream unsolicited mode, the router advertises labels for all known prefixes to all neighbors, even if the neighbor did not request them. Liberal label retention keeps all received labels, even if not currently used.

For BGP-SR (Segment Routing for BGP) to advertise labels for prefixes learned from a CE, the neighbor must be configured with 'send-community extended' under the address-family. This is because BGP-SR uses the BGP Prefix-SID attribute, which is carried as an extended community. Without this command, the PE will not send the label information to the CE, even if the route-policy is correctly applied.

The configuration management process handles commit/rollback and stores configuration in a database.

E-Line is the MEF service type for point-to-point Ethernet connections.

MAP-T (Mapping of Address and Port using Translation) uses IPv4-IPv6 translation (stateless NAT64) to allow IPv4 devices to communicate over an IPv6 network. It is an IPv6 transition mechanism.

IOS XR uses task groups (e.g., cisco-support, cisco-config) to define sets of commands or operations. Users are assigned to task groups to control access to specific router functions.

RESTCONF uses PUT to replace a resource entirely; PATCH is for partial updates.

Option C is correct because LDP-SR interworking (RFC 8661) allows LDP and Segment Routing LSPs to coexist and interoperate during migration. It enables LDP-signaled LSPs to stitch with SR LSPs by mapping LDP labels to SR prefix-SIDs, ensuring end-to-end MPLS forwarding without service disruption. This mechanism is specifically designed for seamless coexistence without requiring a full network cutover.

Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.

BGP optimal route reflection (ORR) improves path selection by allowing the route reflector to calculate the best path based on the IGP metric to the client's location, rather than using its own BGP table. This overcomes the suboptimal routing caused by standard route reflection, where the RR's best path may not be optimal for all clients, while still maintaining IBGP scalability by avoiding a full mesh.

For per-command authorization and role-based access, TACACS+ is preferred over RADIUS. IOS XR uses task groups to define roles. SSH provides encrypted management access.

Option B is correct because the `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.

Option A is correct because LDP supports Downstream on Demand (DoD) mode, where a router requests a label mapping from its downstream neighbor only when needed, combined with Independent Label Distribution Control, which allows each router to advertise label bindings independently without waiting for its downstream neighbor. This is a valid label distribution mode defined in RFC 5036.

The <get> NETCONF operation retrieves both configuration and operational state data from a device, making it the correct choice for this requirement. Unlike <get-config>, which only returns configuration data, <get> accesses the running datastore and includes state data such as interface statistics, routing tables, and system status. This aligns with RFC 6241, where <get> is defined as the operation to retrieve combined config and state information.

CDB stores the intended configuration and operational state for managed devices, enabling NSO to compare and sync with actual device configurations.

End.DT4 is the SRv6 endpoint behavior that decapsulates the outer IPv6 header and then performs a lookup in the IPv4 VPN table. End.DT6 is for IPv6, and End.DT2U is for L2VPN.

Adjacency SIDs are local to a router and represent a specific link. They are not global and are used for strict path control. They are allocated from a local label range (not SRGB).

VRF (Virtual Routing and Forwarding) instances provide separate routing tables per customer, ensuring isolation in L3VPN.

Option C is correct because NSO's NED (Network Equipment Driver) is the component that abstracts the southbound communication between NSO and network devices. NEDs can use NETCONF, SNMP, or CLI as the southbound protocol to translate NSO's device-independent configuration into device-specific commands, enabling multi-vendor management.

The Cisco CRS (Carrier Routing System) is a core router platform with high-density interfaces and large scale for MPLS and Segment Routing.

6PE uses MP-BGP with the IPv6 address family and an IPv4 next-hop (the PE's IPv4 address), encoded via the IPv4-mapped IPv6 address format.

Option A is correct because on a PE router, DSCP values can be set or remarked to classify incoming customer traffic into distinct service classes. This classification is performed at the ingress edge of the MPLS VPN network, allowing the provider to apply appropriate per-hop behaviors (PHBs) before the traffic is label-switched.

Option A is correct because the forwarding entry for 10.2.2.0/24 shows an outgoing label of 20, which means the egress LSR is not performing penultimate hop popping (PHP). In MPLS, when the outgoing label is not the implicit-null label (3) or explicit-null label (0), the penultimate hop must push that label, and the egress LSR will perform a full label lookup. This is an explicit label request, not PHP.

The exhibit shows two paths for prefix 192.168.3.0/24: one via 10.4.4.4 with AS path 300 400 and one via 10.5.5.5 with AS path 300 500. BGP selects the best path based on a sequence of attributes (e.g., weight, local preference, AS path length, origin code, MED, etc.). Option B is correct because the prefix has two paths and BGP will choose one as best based on these attributes.

In IS-IS, the NET (Network Entity Title) address includes an SEL byte. The SEL is always set to 0x00 for the device itself, as it identifies the network layer entity, not a specific service.

The 'commit' command applies changes atomically; if any part fails, the entire commit is rejected.

The IS-IS TE Extended IP Reachability TLV (135) carries TE metrics such as bandwidth, admin group, etc., for MPLS-TE.

Stub and NSSA areas both block Type 5 LSAs; totally stubby also blocks Type 3/4.

Process separation prevents a failure in one protocol from affecting others, enhancing overall system stability.

Option B is correct because the BGP configuration shows that the neighbor 10.1.1.1 is configured under the BGP IPv4 unicast address-family, but not under the address-family ipv4 vrf CUSTOMER. For a VRF to install a route learned via eBGP from a CE router, the neighbor must be explicitly activated under the VRF address-family. Without this, the PE will receive the default route but will not place it into the VRF routing table.

IOS XR features a distributed OS and a commit/rollback configuration model.

Option D is correct because automating QoS policy management eliminates manual configuration steps, reducing the risk of syntax errors, misapplied policies, or inconsistent deployments across thousands of devices. Automation tools like Ansible or NSO enforce standardized templates and pre-validated configurations, directly lowering human error rates in large SP networks.

6PE (IPv6 Provider Edge) uses MP-BGP to exchange IPv6 prefixes with IPv4 next-hop addresses over MPLS. It does not require IPv6 in the core.

Anycast-RP with multiple RPs sharing the same IP address is the most appropriate design for a large ISP supporting IPTV because it provides high availability and load sharing without a single point of failure. In the event of an RP failure, traffic automatically converges to the nearest surviving RP using the same anycast address, minimizing disruption. This design also avoids the convergence delays inherent in dynamic RP discovery protocols like Auto-RP or BSR.

CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.

In MPLS EVPN, Ethernet frames are carried across the MPLS network using an MPLS label stack that includes a control word. The control word (4 bytes) is inserted between the MPLS label stack and the Ethernet frame to prevent misordering and to enable proper frame delineation. This encapsulation is defined in RFC 8214 (formerly RFC 7432) and is distinct from older EoMPLS or simple IP/MPLS tunneling.

6VPE requires MPLS core, MP-BGP with VPNv6 address family, and CE routers running IPv6. LDP is used for label distribution in the core.

OSPF TE extensions use Opaque LSAs (Type 9, 10, 11) to carry TE information. Type 10 (area-local) is commonly used for TE.

The correct answer is C because the NETCONF `get-config` operation is specifically designed to retrieve a configuration datastore, such as the running configuration. Unlike the `get` operation, which retrieves both configuration and state data, `get-config` targets only the configuration data, making it the precise operation for fetching the entire running configuration from a network device.

SR-TE (Segment Routing Traffic Engineering) is the correct choice because it uses a centralized or distributed controller to compute optimal paths based on IGP link attributes (such as metric, TE metric, affinity) and bandwidth constraints, encoding the path as a segment list in the packet header. Unlike RSVP-TE, SR-TE does not require per-flow state in the core routers, making it more scalable for bandwidth optimization in an MPLS Segment Routing network.

MPLS-TE uses explicit paths (either strict or loose) to direct traffic away from the shortest path determined by the IGP (e.g., OSPF or IS-IS). This allows network operators to engineer traffic flows based on administrative policies, such as load balancing or avoiding congested links, rather than relying solely on the IGP's metric-based shortest path.

FlowSpec rules can include traffic rate-limiting, redirecting to a VRF (e.g., for scrubbing), and dropping traffic. Setting a BGP community is not a FlowSpec action; community is for routing policy. IPsec encryption is not a FlowSpec action.

In hierarchical QoS, the parent policy applies shaping; the child policy applies queuing actions like bandwidth and priority. The child policy is attached to a class in the parent.

Option B is correct because Segment Routing (SR) encodes the forwarding path as an ordered list of segment identifiers (SIDs) pushed onto a label stack at the source router. This source-routing paradigm allows the ingress node to specify the exact path through the network without requiring intermediate routers to maintain per-flow state.

These are critical BGP attributes for service provider routing policies.

Voice traffic requires low latency, jitter, and packet loss. DSCP EF (Expedited Forwarding, per-hop behavior value 46) is the standard marking for real-time voice payloads, ensuring strict priority queuing (PQ) across the network. RFC 3246 defines EF for this purpose, and Cisco routers use it to map voice to the priority queue.

Option A is correct because the most common reason for video traffic being marked as DSCP 0 (default) while voice traffic is correctly marked is that the class map for video traffic fails to match the intended packets. This could be due to an incorrect match statement (e.g., using the wrong ACL, protocol, or DSCP value) or a misconfigured match criterion that does not capture the video flows. Since voice traffic is marked correctly, the policy itself is applied and functional, isolating the issue to the video class map's matching logic.

Option B is correct because the YANG service model is a core component of NSO architecture. It defines the service logic and data model that translates high-level service requests into device-specific configurations. NSO uses YANG to model both services and devices, enabling automation of service provisioning.

Option A is correct because the MPLS data plane is responsible for the actual forwarding of packets based on labels. At the ingress LSR, the data plane performs a label push operation, which involves inserting a new MPLS label (or a stack of labels) onto the incoming IP packet before forwarding it into the MPLS domain. This action is a fundamental data-plane function, as it directly manipulates the packet header to enable label switching.

The most likely reason is that an access-list is applied under 'mpls ldp advertise-labels' that denies the loopback prefixes. LDP by default advertises labels for all prefixes in the routing table, but the 'advertise-labels' command can filter which prefixes receive labels. If the loopback0 prefixes of PE1 and PE2 are denied by such an access-list, no labels will be advertised for them, even though OSPF routes are present.