971 questions total · 13pages · All types, answers revealed
A service provider is deploying L3VPN using BGP/MPLS. Which mechanism ensures customer isolation in the provider network?
VRF isolates routing and forwarding per customer.
Why this answer
VRF (Virtual Routing and Forwarding) creates separate routing tables per customer, ensuring isolation.
During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?
This is the standard RTBH mechanism: trigger routers to install a null route for the victim's IP.
Why this answer
Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.
When configuring an MPLS-TE tunnel with affinity/constraint-based routing, what is the effect of assigning a link attribute of 'red' and setting the tunnel's affinity to include 'red' with the 'include-all' keyword?
Correct: 'include-all' requires all links to have the attribute.
Why this answer
The 'include-all' affinity means the tunnel path must include all links that have the specified color attribute. If a link does not have 'red' attribute, it is excluded from the CSPF computation.
An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?
This provides encryption, centralized authentication, and authorization.
Which TWO conditions must be met for a BGP route to be considered valid and used for forwarding?
Correct. Only the best path is installed in the routing table.
Why this answer
BGP only installs the best path into the routing table for forwarding. BGP selects a single best path from all available paths for a given prefix based on its path selection algorithm (e.g., highest weight, local preference, shortest AS path). Only this best path is considered valid for forwarding, even if multiple paths exist in the BGP table.
Exam trap
Cisco often tests the distinction between a route being in the BGP table (valid) and being installed in the routing table (best path + reachable next hop), leading candidates to mistakenly think that any BGP table entry is automatically used for forwarding.
If the BGP next-hop for the redistributed routes is not reachable via the IPv6 routing table, BGP will not advertise them to iBGP peers.
Why this answer
In MP-BGP for IPv6, the next-hop address for iBGP peers must be reachable via an IPv6 route in the global routing table or the appropriate VRF. When OSPFv3 redistributes internal routes into BGP, the next-hop is often set to the OSPFv3 router's own IPv6 address; if that address is not reachable (e.g., because the interface is not in the IPv6 unicast routing table or the next-hop is link-local), iBGP peers will not install the routes. This is a common cause of routes being learned but not advertised to iBGP peers.
Exam trap
The trap here is that candidates often assume the issue is with the network command or the IPv4 unicast default, but the real problem is the IPv6 next-hop reachability, which is a subtle but critical requirement for MP-BGP IPv6 route propagation.
How to eliminate wrong answers
Option A is wrong because the network command is not used under the IPv6 address family in MP-BGP; instead, the network command is used under the IPv4 unicast address family, and for IPv6, you use the network command under the IPv6 unicast address family, but the issue here is about redistribution from OSPFv3, not about originating a network. Option B is wrong because disabling bgp default ipv4-unicast only affects IPv4 unicast sessions and does not impact IPv6 address family advertisements; it prevents automatic activation of IPv4 unicast for new peers but does not block IPv6 route propagation. Option D is wrong because the OSPFv3 routes are internal and are present in the IPv6 unicast table (OSPFv3 populates the IPv6 unicast RIB); the problem is that they are not being advertised to iBGP peers, not that they are missing from the table.
An engineer is troubleshooting MPLS forwarding. On a router, the 'show mpls forwarding-table' command displays that for a specific FEC, the outgoing label is 'Untagged'. What does this indicate?
Correct. 'Untagged' means the label is removed before forwarding.
Why this answer
When the 'show mpls forwarding-table' command shows 'Untagged' for a specific FEC, it indicates that the router is performing Penultimate Hop Popping (PHP). In PHP, the penultimate router (the router before the egress LSR) pops the MPLS label and forwards the packet as an IP packet (untagged) to the egress LSR. This is standard behavior to avoid the egress LSR having to perform a double lookup.
Exam trap
The trap here is that candidates often confuse 'Untagged' with the egress LSR behavior or with an implicit null label, but Cisco specifically uses 'Untagged' to denote the penultimate hop's PHP action, not the egress router's label disposition.
How to eliminate wrong answers
Option A is wrong because 'Untagged' is not the same as 'explicitly null'; an explicit null label (label value 0 or 2) is a valid MPLS label that is still tagged, whereas 'Untagged' means no label is present. Option C is wrong because the egress LSR would show 'Pop Label' or 'No Label' in its forwarding table, not 'Untagged', as it is the router that removes the label. Option D is wrong because 'Untagged' in this context is a normal PHP operation and does not indicate that the next-hop router lacks MPLS support; if the next hop did not support MPLS, the router would typically not have an MPLS forwarding entry for that FEC.
Which THREE are EVPN multi-homing functions? (Choose three.)
ESI is key for multi-homing.
Why this answer
EVPN multi-homing uses ESI for identification, DF election to avoid duplicate frames, and aliasing for load balancing.
An engineer is configuring MPLS LDP on a Cisco router. The router is using downstream unsolicited mode and liberal label retention. Which statement correctly describes the label advertisement behavior?
Correct for downstream unsolicited mode.
Why this answer
In downstream unsolicited mode, the router advertises labels for all known prefixes to all neighbors, even if the neighbor did not request them. Liberal label retention keeps all received labels, even if not currently used.
In IOS XR, which process is responsible for managing the configuration database and commit operations?
confd is the configuration daemon.
Why this answer
The configuration management process handles commit/rollback and stores configuration in a database.
Which MEF service type defines a point-to-point Ethernet connection, often used for business connectivity?
E-Line is the correct point-to-point service.
Why this answer
E-Line is the MEF service type for point-to-point Ethernet connections.
An ISP is implementing MAP-T to transition to IPv6. Which of the following best describes MAP-T?
MAP-T uses stateless NAT64-like translation.
Why this answer
MAP-T (Mapping of Address and Port using Translation) uses IPv4-IPv6 translation (stateless NAT64) to allow IPv4 devices to communicate over an IPv6 network. It is an IPv6 transition mechanism.
Which IOS XR feature allows an administrator to grant specific commands to a user based on their role, using task groups?
Task groups are the RBAC mechanism in IOS XR.
Why this answer
IOS XR uses task groups (e.g., cisco-support, cisco-config) to define sets of commands or operations. Users are assigned to task groups to control access to specific router functions.
Which RESTCONF HTTP method should be used to replace the entire configuration of a device interface?
Correct; PUT replaces the resource.
Why this answer
RESTCONF uses PUT to replace a resource entirely; PATCH is for partial updates.
An SP is migrating from an MPLS LDP-based network to Segment Routing. They want to ensure that existing LDP LSPs continue to work alongside SR LSPs during the migration. Which mechanism should be configured?
This enables coexistence of LDP and SR LSPs.
Why this answer
LDP-SR interworking (RFC 8661) allows LDP and Segment Routing LSPs to coexist and interoperate during migration. It enables LDP-signaled LSPs to stitch with SR LSPs by mapping LDP labels to SR prefix-SIDs, ensuring end-to-end MPLS forwarding without service disruption. This mechanism is specifically designed for seamless coexistence without requiring a full network cutover.
Exam trap
Cisco often tests the misconception that SRGB or BGP-LU alone can enable coexistence, but only LDP-SR interworking provides the explicit label mapping and signaling integration required for LDP and SR LSPs to interoperate.
How to eliminate wrong answers
Option A is wrong because SRGB (Segment Routing Global Block) defines the label range for SR prefix-SIDs but does not provide any interworking or coexistence mechanism with LDP. Option B is wrong because BGP-LU (BGP Labeled Unicast) is a separate method for distributing MPLS labels via BGP, not a mechanism for interworking between LDP and SR LSPs. Option D is wrong because MPLS TE (Traffic Engineering) focuses on explicit path control and resource reservation, not on enabling LDP and SR LSPs to work together.
A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?
Loose mode only requires a route to the source, allowing asymmetric paths.
Why this answer
Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.
A service provider is experiencing suboptimal routing due to BGP route reflection. To improve path selection while maintaining IBGP scalability, which feature should be implemented?
ORR enables route reflectors to select the best path based on the client's IGP metric.
Why this answer
BGP optimal route reflection (ORR) improves path selection by allowing the route reflector to calculate the best path based on the IGP metric to the client's location, rather than using its own BGP table. This overcomes the suboptimal routing caused by standard route reflection, where the RR's best path may not be optimal for all clients, while still maintaining IBGP scalability by avoiding a full mesh.
Exam trap
Cisco often tests the distinction between features that improve path diversity (like add-path) versus features that improve path selection optimality (like ORR), leading candidates to confuse BGP add-path as a solution for suboptimal routing caused by route reflection.
How to eliminate wrong answers
Option A is wrong because BGP deterministic MED only ensures consistent MED comparison across paths from different ASs, but does not address the suboptimal routing caused by route reflection's path selection based on the RR's perspective. Option B is wrong because next-hop-self changes the next-hop attribute to the router's own IP, which is useful for reachability but does not improve path selection for clients in a route reflection topology. Option D is wrong because BGP add-path allows advertising multiple paths for the same prefix, but it does not directly optimize the best path selection per client; it increases path diversity but requires additional configuration and does not inherently fix suboptimal routing from route reflection.
An SP network engineer is hardening management plane access on IOS XR routers. They require authentication, authorization, and accounting (AAA) with per-command authorization and role-based access control. Which combination should be used?
SSH ensures encryption, TACACS+ provides per-command authorization, and task groups enable RBAC.
A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?
This defines the peer IP and VC ID for the pseudowire.
Why this answer
The `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.
Exam trap
Cisco often tests the distinction between BGP-based L2VPN (Option C) and MPLS L2VPN using targeted LDP (Option B), where candidates mistakenly apply BGP commands for a simple EoMPLS pseudowire that does not require BGP.
How to eliminate wrong answers
Option A is wrong because `l2vpn xconnect context` is not a valid Cisco IOS command; the correct command to enter xconnect configuration is `xconnect` under the interface, and the context is not used for pseudowire establishment. Option C is wrong because `neighbor 10.1.1.2 remote-as 100` is a BGP configuration command used for establishing BGP peering, not for setting up an MPLS pseudowire in EoMPLS. Option D is wrong because `pseudowire 10.1.1.2 100 encapsulation mpls` is not a valid Cisco command; the correct syntax uses `mpls l2transport route` to define the pseudowire endpoint and VC ID.
An engineer is configuring LDP in an MPLS network. Which THREE are valid label distribution modes for LDP?
This is a valid combination.
Why this answer
Downstream on Demand (DoD) with Independent Label Distribution Control allows a router to request a label mapping only when needed and to advertise bindings independently, as defined in RFC 5036. Option B is correct because Downstream Unsolicited (DU) with Conservative Label Retention means a router learns all label mappings but only stores those for routes it actively uses, which is a supported mode in MPLS LDP implementations. Option C is correct because Downstream Unsolicited with Liberal Label Retention is the default and most common mode, where a router stores all label mappings received from neighbors.
Options D and E are incorrect because Ordered Label Distribution Control is typically used with DoD, not DU, and Liberal Label Retention is rarely paired with DoD due to resource waste.
Exam trap
Cisco often tests the misconception that Ordered Label Distribution Control can be paired with Downstream Unsolicited mode, but Ordered control is only valid with Downstream on Demand in LDP specifications.
A service provider is implementing network automation using YANG data models. They need to ensure that the automation solution supports both configuration and operational state data retrieval. Which NETCONF operation should be used to retrieve operational state data?
Retrieves both configuration and operational state data.
Why this answer
The <get> NETCONF operation retrieves both configuration and operational state data from a device, making it the correct choice for this requirement. Unlike <get-config>, which only returns configuration data, <get> accesses the running datastore and includes state data such as interface statistics, routing tables, and system status. This aligns with RFC 6241, where <get> is defined as the operation to retrieve combined config and state information.
Exam trap
Cisco often tests the distinction between <get> and <get-config>, trapping candidates who assume <get-config> retrieves all data because it is the most commonly used operation for reading configurations.
How to eliminate wrong answers
Option A is wrong because <edit-config> is used to modify configuration data, not to retrieve any data. Option B is wrong because <get-config> retrieves only configuration data from a specified datastore (e.g., running, candidate), excluding operational state data like counters or status. Option D is wrong because <lock> is used to lock a datastore to prevent concurrent modifications, not to retrieve data.
In NSO, which statement best describes the function of the CDB (Configuration Database)?
CDB is the transactional database for device configurations.
Why this answer
CDB stores the intended configuration and operational state for managed devices, enabling NSO to compare and sync with actual device configurations.
Drag and drop the steps to configure a PPPoE client on a Cisco router into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
PPPoE client configuration involves creating a dialer interface, setting encapsulation, dialer pool, authentication, and IP address.
In SRv6, which endpoint behavior is used for decapsulating the outer IPv6 header and performing an IPv4 lookup (e.g., for L3VPN)?
Correct: End.DT4 decapsulates and does IPv4 lookup.
Why this answer
End.DT4 is the SRv6 endpoint behavior that decapsulates the outer IPv6 header and then performs a lookup in the IPv4 VPN table. End.DT6 is for IPv6, and End.DT2U is for L2VPN.
In SR-MPLS, which THREE statements correctly describe the properties of Adjacency SIDs? (Choose three.)
Correct.
Why this answer
Adjacency SIDs are local to a router and represent a specific link. They are not global and are used for strict path control. They are allocated from a local label range (not SRGB).
A service provider is deploying L3VPN. Which mechanism ensures that customer routes are isolated and not leaked between different customers?
Correct. VRF provides isolated routing tables per customer.
Why this answer
VRF (Virtual Routing and Forwarding) instances provide separate routing tables per customer, ensuring isolation in L3VPN.
Which THREE statements are true regarding NSO's NED? (Choose three.)
NEDs support multiple protocols.
Why this answer
NSO's NED (Network Equipment Driver) is the component that abstracts the southbound communication between NSO and network devices. NEDs can use NETCONF, SNMP, or CLI as the southbound protocol to translate NSO's device-independent configuration into device-specific commands, enabling multi-vendor management.
Exam trap
Cisco often tests the misconception that NEDs generate YANG models or perform path computation, when in fact NEDs are purely abstraction layers for southbound communication and device configuration.
Which Cisco router platform is designed for the core/backbone of a service provider network, supporting high-density 100GE interfaces and massive scale for MPLS and Segment Routing?
CRS is designed for core/backbone roles.
Why this answer
The Cisco CRS (Carrier Routing System) is a core router platform with high-density interfaces and large scale for MPLS and Segment Routing.
Match each network automation tool to its primary use.
Drag a concept onto its matching description — or click a concept then click the description.
Network configuration protocol using XML-based data encoding
Data modeling language for network device configuration and state
HTTP-based API for NETCONF data stores
Automation tool for configuration management and orchestration
High-performance RPC framework for telemetry and streaming
Why these pairings
These are key automation and programmability tools for service provider networks.
A service provider wants to provide IPv6 connectivity over an MPLS IPv4 core using 6PE. Which BGP extension is required on the provider edge routers?
This allows IPv4 next-hop in IPv6 AF.
Why this answer
6PE uses MP-BGP with the IPv6 address family and an IPv4 next-hop (the PE's IPv4 address), encoded via the IPv4-mapped IPv6 address format.
PE routers can mark DSCP for customer traffic before entering the MPLS backbone.
Why this answer
On a PE router, DSCP values can be set or remarked to classify incoming customer traffic into distinct service classes. This classification is performed at the ingress edge of the MPLS VPN network, allowing the provider to apply appropriate per-hop behaviors (PHBs) before the traffic is label-switched.
Refer to the exhibit. Which statement is true regarding the forwarding entry for 10.2.2.0/24?
Outgoing label 20 means next hop expects that label, not pop.
Why this answer
The forwarding entry for 10.2.2.0/24 shows an outgoing label of 20, which means the egress LSR is not performing penultimate hop popping (PHP). In MPLS, when the outgoing label is not the implicit-null label (3) or explicit-null label (0), the penultimate hop must push that label, and the egress LSR will perform a full label lookup. This is an explicit label request, not PHP.
Exam trap
Cisco often tests the distinction between the incoming label (local label) and the outgoing label in the forwarding table, and the trap here is that candidates confuse the local label (which is the label this router assigns for the FEC) with the incoming label shown in the forwarding entry, leading them to incorrectly select option D.
How to eliminate wrong answers
Option B is wrong because penultimate hop popping (PHP) would require the outgoing label to be implicit-null (label 3) or the forwarding entry to indicate 'Pop Label', but here the outgoing label is 20, so PHP is not used. Option C is wrong because 'Untagged' means the packet is forwarded without an MPLS label, but the entry shows an outgoing label of 20, so the packet is label-switched. Option D is wrong because the local label is the label assigned by this LSR for the FEC, which is not shown in the exhibit; the exhibit only shows the incoming label (20) and outgoing label (20) for the forwarding entry, not the local label assigned by this router.
Refer to the exhibit. Which of the following is true about the BGP table?
Correct. There are two entries, one is best.
Why this answer
The exhibit shows two paths for prefix 192.168.3.0/24: one via 10.4.4.4 with AS path 300 400 and one via 10.5.5.5 with AS path 300 500. BGP selects the best path based on a sequence of attributes (e.g., weight, local preference, AS path length, origin code, MED, etc.). Option B is correct because the prefix has two paths and BGP will choose one as best based on these attributes.
Exam trap
Cisco often tests the misconception that a shorter AS path always determines the best path, but here both paths have equal AS path length, so candidates must look at other attributes like origin code or IGP metric to determine why one path is preferred.
How to eliminate wrong answers
Option A is wrong because the origin code for the route to 192.168.3.0/24 with path 300 400 is shown as '?' (incomplete), not 'i' (IGP). Option C is wrong because the prefix 192.168.2.0/24 is not shown in the exhibit at all, so no comparison of local preference can be made. Option D is wrong because the route via 10.4.4.4 has an AS path length of 2 (300 400) while the route via 10.5.5.5 also has an AS path length of 2 (300 500); they are equal in AS path length, so a shorter AS path cannot be the reason for best path selection.
What is the purpose of the SEL (NSAP Selector) field in an IS-IS NET address?
Correct. SEL is 0x00 for the network layer entity.
Why this answer
In IS-IS, the NET (Network Entity Title) address includes an SEL byte. The SEL is always set to 0x00 for the device itself, as it identifies the network layer entity, not a specific service.
In the context of IOS XR commit/rollback configuration model, which command is used to apply a set of configuration changes as a single atomic operation?
'commit' atomically applies configuration changes in IOS XR.
Why this answer
The 'commit' command applies changes atomically; if any part fails, the entire commit is rejected.
In IS-IS, which TLV is used to carry traffic engineering information for MPLS-TE?
TLV 22 (Extended IS Reachability) carries TE information for MPLS-TE, including link attributes like bandwidth and admin group.
Why this answer
In IS-IS, TLV 22 (Extended IS Reachability) is used to carry traffic engineering information, such as link attributes (bandwidth, admin group, TE metric), for MPLS-TE. TLV 135 (Extended IP Reachability) carries IP prefix information, not TE link attributes.
A service provider is designing an OSPF network with multiple areas. Which two area types prevent Type 5 LSAs from being flooded? (Choose two.)
Stub areas block Type 5 LSAs.
Why this answer
Stub and NSSA areas both block Type 5 LSAs; totally stubby also blocks Type 3/4.
In IOS XR, each routing protocol runs as a separate process. What is the primary benefit of this architecture?
Each protocol runs independently, so a crash in one does not impact others.
Why this answer
Process separation prevents a failure in one protocol from affecting others, enhancing overall system stability.
In an MPLS L3VPN network, a route reflector (RR) is used to distribute VPNv4 routes between PE routers. After a new PE router (PE4) is added, some VPN routes are not being received by other PEs. Which TWO actions should be investigated to resolve the issue? (Choose two.)
Mismatched RTs prevent routes from being imported into the VRF.
Why this answer
The new PE must have matching VRF route-target import/export values to receive and advertise VPN routes. Option C is correct because a BGP VPNv4 neighbor relationship between the new PE and the RR is necessary for VPNv4 route exchange. Option B is incorrect: OSPF as an additional IGP is not required for VPN route distribution.
Option D is incorrect: while physical connectivity and IGP adjacency are prerequisites, the specific issue with missing VPN routes points to BGP session or RT misconfiguration. Option E is incorrect: a route refresh does not fix missing route-target or BGP session problems.
Refer to the exhibit. A PE router has this BGP configuration. The CE router is advertising a default route via eBGP. However, the PE is not installing the route in the VRF table. What is the most likely cause?
Correct. Without activating the neighbor under the VRF address-family, eBGP routes from CE are not imported into the VRF.
Why this answer
The BGP configuration shows that the neighbor 10.1.1.1 is configured under the BGP IPv4 unicast address-family, but not under the address-family ipv4 vrf CUSTOMER. For a VRF to install a route learned via eBGP from a CE router, the neighbor must be explicitly activated under the VRF address-family. Without this, the PE will receive the default route but will not place it into the VRF routing table.
Exam trap
Cisco often tests the distinction between configuring a BGP neighbor globally versus under a VRF address-family, tricking candidates into thinking that a neighbor statement under router bgp is sufficient for VRF route installation.
How to eliminate wrong answers
Option A is wrong because the 'redistribute connected' command under the VRF does not overwrite the default route; it only injects directly connected routes into the VRF, and BGP routes have a higher administrative distance (20 for eBGP) compared to connected routes (0), so there is no overwriting. Option C is wrong because 'next-hop-self' is used to change the next-hop attribute of routes advertised to a neighbor, but it does not affect the installation of a received route into the VRF table; the route is not being installed because the neighbor is not activated under the VRF address-family. Option D is wrong because 'default-information originate' is used to originate a default route into BGP from the PE to the CE, not to accept a default route from a CE; the PE is receiving the default route but failing to install it due to the missing VRF address-family configuration.
Which TWO of the following are characteristics of the IOS XR operating system architecture? (Select two.)
Changes are staged and committed.
Why this answer
IOS XR features a distributed OS and a commit/rollback configuration model.
Which TWO are valid benefits of automating QoS policy management in a large SP network? (Choose two.)
Correct: Automation minimizes manual mistakes.
Why this answer
Automating QoS policy management eliminates manual configuration steps, reducing the risk of syntax errors, misapplied policies, or inconsistent deployments across thousands of devices. Automation tools like Ansible or NSO enforce standardized templates and pre-validated configurations, directly lowering human error rates in large SP networks.
Exam trap
Cisco often tests the misconception that automation completely removes the need for human oversight (like monitoring or validation), when in fact automation augments but does not replace these critical operational steps.
Which technology allows an IPv6-only customer edge router to connect to an MPLS provider edge router using IPv4 transport, encapsulating IPv6 packets in MPLS with a labeled IPv4 next-hop?
6PE provides IPv6 over MPLS with IPv4 next-hop.
Why this answer
6PE (IPv6 Provider Edge) uses MP-BGP to exchange IPv6 prefixes with IPv4 next-hop addresses over MPLS. It does not require IPv6 in the core.
A large ISP is designing a multicast architecture to support IPTV, requiring high availability and minimal traffic convergence. Which RP placement design is most appropriate?
Provides load balancing and fast failover.
Why this answer
Anycast-RP with multiple RPs sharing the same IP address is the most appropriate design for a large ISP supporting IPTV because it provides high availability and load sharing without a single point of failure. In the event of an RP failure, traffic automatically converges to the nearest surviving RP using the same anycast address, minimizing disruption. This design also avoids the convergence delays inherent in dynamic RP discovery protocols like Auto-RP or BSR.
Exam trap
Cisco often tests the misconception that dynamic RP protocols (Auto-RP or BSR) inherently provide high availability, but the trap here is that they still rely on a single active RP unless combined with Anycast-RP, which is the only option that eliminates the single RP failure point.
How to eliminate wrong answers
Option A is wrong because a single static RP creates a single point of failure; if the core router fails, all multicast forwarding stops until manual intervention, which violates the high availability requirement. Option B is wrong because Auto-RP with one RP mapping agent introduces a single point of failure for RP discovery and relies on dense-mode flooding, which can cause unnecessary traffic overhead and slower convergence. Option D is wrong because BSR with one candidate RP still has a single RP that, if it fails, requires BSR election and re-advertisement, leading to longer convergence times compared to Anycast-RP's immediate failover.
A service provider is transitioning from LDP-based MPLS to Segment Routing (SR-MPLS). Which TWO statements correctly describe differences or interoperability considerations? (Choose two.)
Correct. SRGB is a global label range for Prefix-SIDs.
Why this answer
In SR-MPLS, the Segment Routing Global Block (SRGB) is a reserved label range used to allocate Prefix-SIDs, ensuring end-to-end label consistency across the SR domain. An Adjacency-SID is a local label that represents a specific link and is used for traffic steering over that link. LDP and SR-MPLS can coexist with proper mapping, making option B incorrect.
Node-SIDs are allocated from the SRGB and are unique domain-wide, not just within an area. In SR-MPLS, the ingress router pushes a label stack, and intermediate nodes perform penultimate hop popping (PHP) or continue to forward, but they do not swap labels as in LDP. Therefore, options C and D are correct.
Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
VLAN configuration involves creating the VLAN, optionally naming it, and then assigning ports to it.
An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?
NAT logging records translations for compliance purposes.
Why this answer
CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.
A service provider is implementing EVPN with MPLS data plane. Which encapsulation type is used in MPLS EVPN to carry Ethernet frames across the MPLS network?
The control word is used to preserve the Ethernet frame integrity.
Why this answer
In MPLS EVPN, Ethernet frames are carried across the MPLS network using an MPLS label stack that includes a control word. The control word (4 bytes) is inserted between the MPLS label stack and the Ethernet frame to prevent misordering and to enable proper frame delineation. This encapsulation is defined in RFC 8214 (formerly RFC 7432) and is distinct from older EoMPLS or simple IP/MPLS tunneling.
Exam trap
Cisco often tests the distinction between the EVPN control plane (RFC 7432) and the MPLS data-plane encapsulation (RFC 8214), leading candidates to incorrectly select 'EVPN encapsulation defined by IETF RFC 7432' as the encapsulation type.
How to eliminate wrong answers
Option A is wrong because Ethernet over MPLS (EoMPLS) with VLAN encapsulation is a Layer 2 VPN technology that uses a single label and does not support the EVPN control plane or the multi-homing, MAC learning, and split-horizon features of EVPN. Option C is wrong because EVPN encapsulation is not defined by IETF RFC 7432; RFC 7432 defines the EVPN control plane and procedures, while the actual MPLS data-plane encapsulation (including the control word) is specified in RFC 8214. Option D is wrong because an IP/MPLS tunnel with an Ethernet frame inside describes a generic L2TPv3 or IP-based tunneling approach, not the specific MPLS label stack with control word required for EVPN over MPLS.
An SP is deploying IPv6 using 6VPE. Which THREE components are required? (Choose three.)
CE routers must support IPv6.
Why this answer
6VPE requires MPLS core, MP-BGP with VPNv6 address family, and CE routers running IPv6. LDP is used for label distribution in the core.
An OSPF network is configured with RSVP-TE. Which OSPF extension is used to advertise TE link attributes such as bandwidth and administrative group?
Type 10 Opaque LSA carries TE information.
Why this answer
OSPF TE extensions use Opaque LSAs (Type 9, 10, 11) to carry TE information. Type 10 (area-local) is commonly used for TE.
Which NETCONF operation is used to retrieve the entire running configuration from a network device?
Correct; 'get-config' retrieves configuration.
Why this answer
The NETCONF `get-config` operation is specifically designed to retrieve a configuration datastore, such as the running configuration. Unlike the `get` operation, which retrieves both configuration and state data, `get-config` targets only the configuration data, making it the precise operation for fetching the entire running configuration from a network device.
Exam trap
The trap here is that candidates often confuse `get` with `get-config`, assuming `get` retrieves only configuration, but `get` actually returns both configuration and operational state data, which can cause unexpected output or performance issues in automation scripts.
How to eliminate wrong answers
Option A is wrong because the `get` operation retrieves both configuration and operational state data, not just the running configuration, and it may filter results based on subtrees. Option B is wrong because `commit` is used to confirm and apply a candidate configuration to the running datastore, not to retrieve data. Option D is wrong because `edit-config` is used to modify or replace configuration data in a target datastore, not to retrieve it.
A service provider is designing a new MPLS core network using Segment Routing with MPLS data plane. They require traffic engineering capabilities to optimize bandwidth utilization. Which technology should be used to compute optimal paths based on IGP link attributes and bandwidth constraints?
SR-TE computes paths using segment lists and can enforce bandwidth constraints.
Why this answer
SR-TE (Segment Routing Traffic Engineering) is the correct choice because it uses a centralized or distributed controller to compute optimal paths based on IGP link attributes (such as metric, TE metric, affinity) and bandwidth constraints, encoding the path as a segment list in the packet header. Unlike RSVP-TE, SR-TE does not require per-flow state in the core routers, making it more scalable for bandwidth optimization in an MPLS Segment Routing network.
Exam trap
Cisco often tests the misconception that OSPF with MPLS-TE extensions alone provides traffic engineering, but in reality, it only advertises link attributes and requires a separate path computation mechanism like SR-TE or RSVP-TE to enforce TE paths.
How to eliminate wrong answers
Option A is wrong because RSVP-TE with FRR is a traditional MPLS TE solution that requires per-tunnel state maintenance and signaling, which contradicts the stateless nature of Segment Routing and does not leverage IGP link attributes for path computation in the same way as SR-TE. Option B is wrong because LDP over SR is a label distribution mechanism that provides basic MPLS forwarding but lacks traffic engineering capabilities to compute optimal paths based on bandwidth constraints or link attributes. Option D is wrong because OSPF with MPLS-TE extensions only floods TE link attributes (via opaque LSAs) but does not compute or enforce traffic-engineered paths; it requires an external component like RSVP-TE or SR-TE to perform the actual path computation.
Which TWO of the following are characteristics of MPLS-TE (Traffic Engineering)?
MPLS-TE can specify explicit paths for traffic engineering.
Why this answer
MPLS-TE uses explicit paths (either strict or loose) to direct traffic away from the shortest path determined by the IGP (e.g., OSPF or IS-IS). This allows network operators to engineer traffic flows based on administrative policies, such as load balancing or avoiding congested links, rather than relying solely on the IGP's metric-based shortest path.
Exam trap
Cisco often tests the distinction between LDP and RSVP-TE, so the trap here is that candidates mistakenly associate MPLS-TE with LDP because both are label distribution protocols, but TE explicitly requires RSVP-TE for constraint-based path setup.
An SP is deploying DDoS mitigation using BGP FlowSpec. Which THREE types of actions can be encoded in a FlowSpec rule? (Choose three.)
FlowSpec can drop packets.
An SP engineer is configuring a policy-map to implement hierarchical QoS. Which two statements are correct when using MQC for hierarchical QoS? (Choose two.)
Correct. The child policy-map must include queueing commands like bandwidth and priority.
Why this answer
In hierarchical QoS using MQC, the child policy-map must include bandwidth/priority commands to define queuing behavior (B). The parent policy-map contains the shape command and references a child policy-map (C). The service-policy command is applied directly to the interface, referencing the parent policy (D).
Therefore, options B, C, and D are correct. Note: The question stem asks for two, but all three are accurate statements.
Which TWO statements correctly describe Segment Routing characteristics? (Select two.)
SR uses a label stack to specify the path.
Why this answer
Segment Routing (SR) encodes the forwarding path as an ordered list of segment identifiers (SIDs) pushed onto a label stack at the source router. This source-routing paradigm allows the ingress node to specify the exact path through the network without requiring intermediate routers to maintain per-flow state.
Exam trap
Cisco often tests the misconception that SR eliminates all per-prefix state from core routers, but in reality, core routers still maintain IGP per-prefix state and may hold SR-MPLS labels for those prefixes.
Match each BGP attribute to its category or purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Well-known mandatory attribute for loop prevention
Well-known mandatory attribute indicating next-hop IP
Well-known discretionary attribute for best path selection
Optional non-transitive attribute to influence inbound traffic
Optional transitive attribute for route tagging and policy
Why these pairings
Correct matches associate BGP attributes with their standard categories and purposes. Local Preference and Next Hop are well-known discretionary and mandatory respectively, while MED is optional nontransitive. Common confusions include misclassifying attribute categories or purposes.
An SP engineer is configuring NTP authentication on IOS XR routers in the management plane. Which TWO statements about NTP authentication are correct? (Choose two.)
A key is configured and used to authenticate NTP packets.
Why this answer
NTP authentication uses a symmetric key (MD5 or SHA) to authenticate NTP packets. The key must be trusted on the client. NTP authentication does not encrypt packets; it only provides integrity.
Multiple keys can be configured.
An engineer is configuring QoS for voice traffic on a Cisco router. Which marking should be applied to voice packets to ensure proper end-to-end prioritization?
DSCP EF is the correct marking for voice payload.
Why this answer
Voice traffic requires low latency, jitter, and packet loss. DSCP EF (Expedited Forwarding, per-hop behavior value 46) is the standard marking for real-time voice payloads, ensuring strict priority queuing (PQ) across the network. RFC 3246 defines EF for this purpose, and Cisco routers use it to map voice to the priority queue.
Exam trap
Cisco often tests the distinction between voice bearer (RTP) and voice signaling (SIP/H.323) markings, so the trap here is that candidates confuse DSCP CS3 (for signaling) with DSCP EF (for actual voice payload), or assume IP Precedence 3 is sufficient despite its lack of strict priority behavior.
How to eliminate wrong answers
Option A is wrong because DSCP AF41 (Assured Forwarding class 4, low drop probability) is designed for data traffic that needs bandwidth guarantees but can tolerate some loss, not for real-time voice. Option B is wrong because DSCP CS3 (Class Selector 3, value 24) is a legacy marking often used for voice signaling (e.g., SIP, H.323), not for voice bearer (RTP) packets. Option D is wrong because IP Precedence 3 (value 3) is an older, less granular marking that does not provide the strict priority queuing behavior required for voice; it maps to DSCP 24 (CS3) by default, which is for signaling, not bearer traffic.
A misconfigured match statement would cause video traffic to fall into the default class, resulting in DSCP 0.
Why this answer
The most common reason for video traffic being marked as DSCP 0 (default) while voice traffic is correctly marked is that the class map for video traffic fails to match the intended packets. This could be due to an incorrect match statement (e.g., using the wrong ACL, protocol, or DSCP value) or a misconfigured match criterion that does not capture the video flows. Since voice traffic is marked correctly, the policy itself is applied and functional, isolating the issue to the video class map's matching logic.
Exam trap
Cisco often tests the misconception that a marking policy failure is due to interface direction or trust boundaries, when the real issue is a misconfigured class map that does not match the intended traffic, especially when one traffic type works and another does not.
How to eliminate wrong answers
Option B is wrong because policing drops or re-marks traffic based on a configured rate, but the symptom here is that video traffic is marked as DSCP 0, not dropped; policing would either drop packets or re-mark them to a lower DSCP value, but DSCP 0 is the default marking for unclassified traffic, not a typical policed re-mark value. Option C is wrong because if the trust boundary is set to 'trust dscp', the router would preserve any existing DSCP markings on incoming traffic; if video traffic arrived unmarked (DSCP 0), it would remain DSCP 0, but the policy should still be able to mark it via the class map—this option implies the policy cannot override trust, which is incorrect because a marking policy applied in the correct direction will overwrite the DSCP value regardless of trust settings. Option D is wrong because if the policy were not applied to the correct interface direction, voice traffic would also fail to be marked correctly; since voice is marked as DSCP EF, the policy is clearly applied in the correct direction (likely input) and is functioning for at least one traffic class.
When automating service provisioning with NSO, which three components are part of the NSO architecture? (Choose three.)
Service models in YANG define the service logic.
Why this answer
The YANG service model is a core component of NSO architecture. It defines the service logic and data model that translates high-level service requests into device-specific configurations. NSO uses YANG to model both services and devices, enabling automation of service provisioning.
Exam trap
Cisco often tests the distinction between NSO's core architectural components (YANG service models, CDB, NEDs) and external interfaces or protocols (like Java API or SNMP), which are not part of the internal architecture but rather integration points.
Which TWO are functions of the MPLS data plane?
Pushing a label is a data plane operation.
Why this answer
The MPLS data plane is responsible for the actual forwarding of packets based on labels. At the ingress LSR, the data plane performs a label push operation, which involves inserting a new MPLS label (or a stack of labels) onto the incoming IP packet before forwarding it into the MPLS domain. This action is a fundamental data-plane function, as it directly manipulates the packet header to enable label switching.
Exam trap
Cisco often tests the distinction between control plane and data plane functions, and the trap here is that candidates mistakenly associate label distribution (LDP) or routing protocol operations (BGP, OSPF) with the data plane, when in fact they are control plane processes that support but do not execute packet forwarding.
A service provider is deploying a new MPLS core network. The network has four routers: P1, P2, PE1, and PE2. OSPF is used as the IGP. The engineer configures MPLS LDP on all interfaces. After enabling LDP, the engineer notices that the LDP session between P1 and P2 is established, but no labels are exchanged for the loopback0 interfaces of PE1 and PE2. The loopback0 addresses are advertised in OSPF. The engineer verifies that the OSPF routes are present in the routing table of all routers. What is the most likely reason for the missing labels?
Label advertisement can be filtered; this is a common issue.
Why this answer
The most likely reason is that an access-list is applied under 'mpls ldp advertise-labels' that denies the loopback prefixes. LDP by default advertises labels for all prefixes in the routing table, but the 'advertise-labels' command can filter which prefixes receive labels. If the loopback0 prefixes of PE1 and PE2 are denied by such an access-list, no labels will be advertised for them, even though OSPF routes are present.
Exam trap
Cisco often tests the misconception that 'mpls ip' must be enabled on the loopback interface itself for its prefix to receive a label, when in fact LDP advertises labels for any prefix in the routing table as long as the outgoing interface has 'mpls ip' enabled.
How to eliminate wrong answers
Option B is wrong because LDP uses TCP (port 646) for session establishment and label exchange, not UDP; UDP is used only for LDP discovery (hello messages). Option C is wrong because OSPF cost does not affect LDP label advertisement; LDP advertises labels for all reachable prefixes regardless of metric, as long as they are in the routing table. Option D is wrong because 'mpls ip' must be enabled on interfaces for LDP to form adjacencies and exchange labels, but the loopback interfaces themselves do not need 'mpls ip' for their prefixes to be advertised with labels; the issue is about label advertisement for the loopback prefixes, not LDP session establishment.
An engineer is configuring RSVP-TE fast reroute for link protection. Which protection method uses a pre-configured bypass tunnel that protects multiple LSPs on the same link?
Bypass tunnel protects multiple LSPs.
Why this answer
In RSVP-TE FRR, facility backup uses a bypass tunnel that can protect multiple LSPs on the same link. In contrast, 1:1 detour creates a separate detour LSP for each protected LSP.
Which THREE are benefits of implementing MPLS-TE in a service provider core?
TE tunnels can be provisioned with bandwidth reservations.
Why this answer
MPLS-TE allows operators to reserve bandwidth along explicit paths using RSVP-TE signaling, ensuring that specific traffic flows receive guaranteed bandwidth. This is achieved through bandwidth reservation and admission control, which prevents oversubscription on TE tunnels.
Exam trap
Cisco often tests the misconception that MPLS-TE reduces routing table size or natively supports multicast, but these are not inherent benefits of the technology.
A service provider needs to offer L3VPN services to multiple customers, each with overlapping IP addresses. The provider plans to use MPLS VPNs with VRFs. Which statement is TRUE regarding the configuration of VRFs on the PE routers?
RTs determine which VRFs receive which routes, allowing overlapping addresses.
Why this answer
Route targets (RTs) are used on PE routers to control which VPNv4 routes are imported into a VRF and which routes from a VRF are exported to MP-BGP. This allows proper segregation and connectivity for MPLS L3VPNs. Option A is incorrect because VRF-to-CE routing can use any protocol, not just OSPF.
Option C is incorrect because MPLS labels are automatically assigned per VRF by the router, not manually per prefix. Option D is incorrect because the route distinguisher (RD) only needs to be unique per VRF on a single PE router; it can be the same across different PE routers if the RTs are configured correctly.
A service provider is troubleshooting an MPLS L3VPN issue where a CE router is receiving the VPN route from the PE but cannot ping the remote CE's loopback. The PE shows that the VPN label is assigned but cannot route the packets. Which command would help determine if the remote PE is correctly resolving the BGP next-hop via IGP?
Shows the BGP route and its next-hop reachability (via IGP).
Why this answer
'show ip route bgp', is correct because the issue is that the remote PE cannot route packets to the BGP next-hop of the VPN route. The CE receives the route, but the PE cannot forward packets, indicating a missing or incorrect IGP route to the next-hop address. This command displays BGP routes in the global routing table, allowing you to verify if the next-hop is reachable via IGP (e.g., OSPF or IS-IS) and if the recursive routing is successful.
Exam trap
Cisco often tests the distinction between VRF-specific commands and global routing table commands; the trap here is that candidates assume 'show ip route vrf CUST' will show the next-hop reachability, but it only shows the VPN route itself, not the underlying IGP route required for recursive forwarding.
How to eliminate wrong answers
Option B is wrong because 'show mpls ldp neighbor' checks LDP session status and label exchange between directly connected LSRs, but it does not verify IGP reachability to the BGP next-hop, which is the root cause here. Option C is wrong because 'show ip route vrf CUST' shows routes within the VRF, including the VPN route received from the remote PE, but it does not show the global IGP route to the BGP next-hop; the issue is in the global routing table, not the VRF. Option D is wrong because 'show mpls forwarding-table vrf CUST' displays the MPLS forwarding entries for the VRF, including the VPN label and outgoing interface, but it does not reveal whether the BGP next-hop is reachable via IGP; the forwarding table assumes the next-hop is reachable, which is the problem here.
A service provider is deploying MPLS-TE with RSVP-TE in their core network. They notice that some LSPs are not being established due to resource contention. Which action would best address this issue without redesigning the entire traffic engineering deployment?
Preemption allows higher-priority LSPs to take resources from lower-priority ones, resolving contention dynamically.
Why this answer
Enabling preemption on RSVP-TE LSPs with appropriate setup and hold priorities allows higher-priority LSPs to tear down lower-priority LSPs to free up bandwidth, resolving resource contention without redesigning the entire TE deployment. This is the standard mechanism defined in RFC 3209 for managing bandwidth contention in MPLS-TE networks.
Exam trap
Cisco often tests the misconception that explicit path configuration or bandwidth upgrades are the primary solutions for resource contention, when in fact preemption priorities are the designed mechanism for dynamic contention resolution in RSVP-TE.
How to eliminate wrong answers
Option B is wrong because increasing the bandwidth of all core links is a costly, non-scalable approach that may not be feasible and does not address the root cause of contention; it also requires a network redesign. Option C is wrong because configuring LSP path-option explicit paths with strict hops forces a specific path but does not resolve bandwidth contention on those links; it may even worsen contention by not allowing dynamic rerouting. Option D is wrong because disabling RSVP-TE and using LDP for label distribution removes traffic engineering capabilities entirely, as LDP does not support bandwidth reservation or explicit path control, which would not solve the resource contention issue.
An engineer is deploying Segment Routing in an MPLS network. To ensure that routers can forward packets based on SR-MPLS labels without requiring LDP, which requirement must be met?
Correct. The IGP distributes prefix-SIDs for SR-MPLS label forwarding.
Why this answer
Segment Routing (SR) can operate without LDP by encoding the forwarding path as a list of MPLS labels derived from the IGP. For routers to allocate and advertise these SR-MPLS labels, the IGP (IS-IS or OSPF) must have the Segment Routing extension enabled. This allows the IGP to distribute prefix-SIDs (labels) that routers use to forward packets, eliminating the need for LDP.
Exam trap
Cisco often tests the misconception that LDP is always required for MPLS forwarding, but SR-MPLS bypasses LDP by using the IGP to distribute labels, so candidates must recognize that the IGP SR extension is the enabling requirement.
How to eliminate wrong answers
Option B is wrong because MPLS LDP is specifically not required when SR-MPLS is used; SR replaces LDP by using IGP-distributed labels. Option C is wrong because BGP-LU (BGP Labeled Unicast) is used for inter-domain label distribution, not for the basic intra-domain label allocation needed for SR-MPLS forwarding. Option D is wrong because the IGP overload bit is a mechanism to prevent transit traffic through a router during convergence or maintenance, and it has no role in enabling SR-MPLS label-based forwarding.
Which TWO statements about MPLS label operations are correct? (Choose two.)
Transit LSRs swap the incoming label with an outgoing label.
Why this answer
Penultimate Hop Popping (PHP) removes the label before the final hop, and the ingress LSR pushes the initial label.
A network engineer at a service provider is using Cisco NSO to automate the provisioning of VLANs on thousands of access devices. The engineer creates a service using a custom YANG model and deploys it to a set of devices. However, the deployment fails with a 'failed to reach devices' error for some devices, while others succeed. The engineer checks device connectivity and confirms all devices are reachable via SSH and NETCONF. The engineer also verifies that the NSO device list is accurate and includes all target devices. What is the most likely cause of the failure?
Out-of-sync devices prevent NSO from deploying services on them, and the error may manifest as 'failed to reach' because NSO cannot reconcile the configuration.
Why this answer
When NSO deploys a service, it first checks whether the target devices are in sync with the NSO CDB (configuration database). If a device is out of sync (e.g., its running configuration differs from what NSO expects), NSO will refuse to push the new service configuration and will report a 'failed to reach devices' error, even though the device is reachable via SSH/NETCONF. This is a safety mechanism to prevent configuration conflicts or overwriting unmanaged changes.
Exam trap
Cisco often tests the misconception that 'failed to reach devices' always indicates a network connectivity problem, when in fact it can be caused by NSO's synchronization check failing on a reachable device.
How to eliminate wrong answers
Option A is wrong because an unsupported feature would typically cause a validation or commit error, not a 'failed to reach devices' error; NSO would still attempt to connect and then reject the configuration. Option C is wrong because insufficient memory would manifest as a commit failure or device crash, not a connectivity error, and NSO would still establish a session. Option D is wrong because NSO packages are loaded on the NSO server, not on the managed devices; devices only need to support NETCONF or CLI for NSO to manage them.
An MPLS core network uses LDP to distribute labels. An engineer wants to verify that the LDP session between two routers is up and exchanging labels. Which command should be used?
Displays LDP neighbors and session state.
Why this answer
The command 'show mpls ldp neighbor' displays the status of LDP sessions, including the neighbor's IP address, session state (e.g., Operational), and label exchange activity. Since LDP is the protocol used to distribute labels in this MPLS core network, this command directly verifies that the session is up and exchanging labels between the two routers.
Exam trap
Cisco often tests the distinction between verifying the LDP session itself (show mpls ldp neighbor) versus verifying the results of label exchange (show mpls forwarding-table), leading candidates to confuse the output of label distribution with the state of the label distribution protocol.
How to eliminate wrong answers
Option A is wrong because 'show mpls interfaces' displays which interfaces are enabled for MPLS and their LDP or TDP status, but it does not show LDP session state or label exchange with a specific neighbor. Option B is wrong because 'show mpls l2transport binding' is used for Layer 2 VPN (L2VPN) pseudowire label bindings, not for verifying LDP session status. Option D is wrong because 'show mpls forwarding-table' displays the LFIB (Label Forwarding Information Base) entries, which are the result of label exchange, but it does not show the LDP session state or neighbor adjacency.
A service provider uses BGP route reflectors to scale iBGP. A route reflected from a route reflector arrives at a client with the originator-id set. What is the purpose of the originator-id attribute?
Correct; if a router receives a route with its own router-id as originator-id, it discards the route.
Why this answer
The originator-id is set by the route reflector to the router-id of the originating router in the AS. It prevents routing loops by allowing a route to be ignored if the originator-id matches the receiving router's ID.
An SP engineer is configuring hierarchical QoS on a PE router. The parent policy shapes the traffic to 10 Mbps, and the child policy applies LLQ for voice and CBWFQ for data. What is the primary purpose of using policing within the LLQ child policy?
Correct; policing limits voice traffic in LLQ.
Why this answer
In hierarchical QoS (HQoS), the parent policy shapes the aggregate traffic to 10 Mbps, while the child policy applies LLQ for voice and CBWFQ for data. The primary purpose of policing within the LLQ child policy is to enforce a strict rate limit on voice traffic, dropping excess packets to prevent voice from consuming bandwidth beyond its allocated share. This prevents voice traffic from starving other queues (e.g., data) within the shaped parent rate, ensuring fairness and protecting other classes from congestion.
Exam trap
Cisco often tests the misconception that policing in a child policy is used to enforce the parent shape rate, but in reality, the parent shape rate is enforced by the shape command in the parent policy, while child policing controls per-class fairness within that shaped rate.
How to eliminate wrong answers
Option A is wrong because re-marking voice traffic to a lower DSCP is not the primary purpose of policing within LLQ; policing can mark down but its main role here is to drop excess traffic to protect other queues, not just re-mark. Option C is wrong because the parent shape rate is enforced by the parent policy's shape command, not by policing within the child LLQ policy; policing in the child operates on the child's traffic, not the parent's aggregate rate. Option D is wrong because policing does not buffer traffic; it either drops or re-marks packets, while buffering is a function of queuing mechanisms like WFQ or tail-drop, not policing.
A service provider is implementing QoS on an MPLS network to support voice, video, and data traffic. Which queuing mechanism provides the lowest latency for real-time traffic?
LLQ provides a strict priority queue that ensures low latency and jitter for real-time traffic.
Why this answer
LLQ (Low Latency Queuing) is the correct choice because it provides a strict priority queue specifically designed for real-time traffic like voice and video. By placing delay-sensitive packets into a dedicated priority queue that is serviced before all other queues, LLQ ensures minimal and predictable latency, which is essential for maintaining voice quality in an MPLS network.
Exam trap
Cisco often tests the misconception that CBWFQ alone can handle real-time traffic, but the trap is that CBWFQ lacks a strict priority queue, so only LLQ provides the necessary low-latency guarantee for voice and video.
How to eliminate wrong answers
Option A is wrong because FIFO (First In, First Out) offers no traffic differentiation or priority handling, so real-time packets can be delayed behind large data packets, causing jitter and unacceptable latency. Option B is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that drops packets proactively to prevent tail drops, but it does not provide any queuing or priority scheduling, so it cannot guarantee low latency for real-time traffic. Option D is wrong because CBWFQ (Class-Based Weighted Fair Queuing) provides bandwidth guarantees per class but does not include a strict priority queue; real-time traffic can still experience delay if competing with other classes for service.
Practice 350-501 by domain
Target a specific domain to shore up weak areas.