350-501 Automation and Quality of Service Practice Question
An enterprise uses IPsec VPN to connect branch offices. They apply QoS policies on the tunnel interface but notice that original DSCP markings are not preserved after encryption. Which feature should be enabled to maintain end-to-end QoS?
⚠ Common exam trap
Cisco often tests the misconception that QoS policies on the tunnel interface automatically see the inner packet's DSCP, but in reality encryption hides the original header, so 'qos pre-classify' is required to copy the marking to the outer header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
QoS pre-classify
When IPsec encrypts a packet, the original IP header (including DSCP markings) is hidden inside the tunnel payload. The tunnel interface then applies a new outer IP header, and QoS policies applied to the tunnel interface classify based on the outer header's DSCP, which defaults to 0. Enabling 'qos pre-classify' on the crypto map or tunnel interface copies the original DSCP value to the outer IP header before encryption, preserving end-to-end QoS markings across the IPsec tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AutoQoS
Why it's wrong here
AutoQoS automates QoS configuration but does not address IPsec marking.
- ✓
QoS pre-classify
Why this is correct
This feature copies the original DSCP to the tunnel header.
- ✗
MPLS TE
Why it's wrong here
MPLS TE is for traffic engineering, not marking preservation.
- ✗
NBAR
Why it's wrong here
NBAR is for application recognition, not marking preservation.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-501 question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.