Courseiva

CCNA Services Questions

66 questions · Services · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

A.Static default route from VRF to global
B.Route leaking between VRF and global
C.VRF-Aware Firewall
D.NAT with VRF awareness
AnswerD

NAT translates VRF source IP to global IP and route via global table.

Why this answer

Option A is correct because VRF-Aware NAT with outside interface in global routing enables NAT. Option B is wrong because VRF-Aware Firewall is not a standard feature. Option C is wrong because route leaking is what they want to avoid.

Option D is wrong because static routing does not provide Internet access without default route.

Practice this question →
2
Multi-Selecteasy

A service provider is planning to offer L2VPN services using MPLS. Which TWO statements are true regarding Ethernet over MPLS (EoMPLS) and Virtual Private LAN Service (VPLS)?

Select 2 answers
A.EoMPLS provides a point-to-point pseudowire between two PE routers.
B.VPLS requires all PE routers to be in the same VLAN.
C.VPLS uses a hub-and-spoke topology to interconnect multiple sites.
D.VPLS emulates a multipoint Ethernet service over MPLS.
E.EoMPLS supports MAC address learning between sites.
AnswersA, D

EoMPLS is a point-to-point service.

Why this answer

EoMPLS (Ethernet over MPLS) is correct because it establishes a point-to-point pseudowire (Martini draft, RFC 4448) between two PE routers, transporting Layer 2 Ethernet frames across an MPLS core without MAC learning or multipoint capabilities.

Exam trap

Cisco often tests the distinction between point-to-point (EoMPLS) and multipoint (VPLS) services, and the trap here is confusing MAC learning (VPLS) with simple transport (EoMPLS), or assuming VPLS uses a hub-and-spoke topology instead of a full mesh.

Practice this question →
3
Multi-Selectmedium

Which TWO of the following are characteristics of Segment Routing (SR-MPLS) compared to traditional LDP-based MPLS? (Select two.)

Select 2 answers
A.SR-MPLS requires a dedicated label range from 16 to 99.
B.SR-MPLS does not support traffic engineering.
C.SR-MPLS does not require LDP or RSVP-TE for label distribution.
D.SR-MPLS cannot provide fast reroute protection.
E.SR-MPLS uses a segment list to encode the path in the packet header.
AnswersC, E

Labels are distributed via IGP extensions.

Why this answer

Options A and E are correct. SR-MPLS uses a segment list (stack of labels) encoded in the packet header, and it does not require LDP or RSVP-TE for label distribution; labels are assigned by the IGP (OSPF or IS-IS). Option B is wrong: SR-MPLS can do traffic engineering via SR-TE policies.

Option C is wrong: SR-MPLS supports fast reroute (TI-LFA). Option D is wrong: SR-MPLS can support any label range (16-1,048,575).

Practice this question →
4
MCQhard

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

A.The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.
B.The priority level is set too low; voice should be priority level 4.
C.The 'bandwidth remaining ratio' command under class-default is starving the priority queue.
D.The policy is applied in the output direction; it should be input.
AnswerA

Policing drops traffic exceeding 10%.

Why this answer

The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Exam trap

Cisco often tests the distinction between priority queuing (which provides low latency) and policing (which enforces a rate limit), leading candidates to overlook that a police rate in a priority class can cause drops even when the priority queue is not congested.

How to eliminate wrong answers

Option B is wrong because priority levels in Cisco QoS (0-7) control the scheduling order within the priority queue, not the amount of bandwidth; voice traffic with DSCP EF is typically mapped to priority level 4 by default, and raising it would not prevent drops caused by policing. Option C is wrong because the 'bandwidth remaining ratio' command under class-default only affects the distribution of leftover bandwidth among non-priority classes; it does not starve the priority queue, which is serviced first regardless of remaining ratios. Option D is wrong because the policy is applied in the output direction, which is correct for shaping and policing egress traffic; applying it input would not control outbound drops on the PE-CE interface.

Practice this question →
5
Multi-Selectmedium

Which TWO features are used to improve BGP convergence in an MPLS VPN environment?

Select 2 answers
A.Route redistribution
B.Next-hop-self
C.Bidirectional Forwarding Detection (BFD)
D.BGP multipath
E.BGP Prefix Independent Convergence (PIC)
AnswersC, E

BFD quickly detects link failures.

Why this answer

Bidirectional Forwarding Detection (BFD) provides sub-second failure detection for BGP sessions, reducing the time to detect a link or neighbor failure from seconds (default BGP keepalive/hold timers) to milliseconds. BGP Prefix Independent Convergence (PIC) pre-installs backup paths in the forwarding table, allowing traffic to be rerouted immediately upon failure without waiting for BGP to reconverge. Together, these features drastically improve BGP convergence in an MPLS VPN environment.

Exam trap

Cisco often tests the distinction between features that improve convergence speed (BFD, PIC) versus features that affect routing behavior or path selection (next-hop-self, multipath, redistribution), leading candidates to mistakenly select options that are useful but do not directly address convergence time.

Practice this question →
6
MCQhard

Refer to the exhibit. A network engineer applies this policy on the PE-CE link. What is the expected behavior for VoIP traffic matching the access list?

A.VoIP traffic is given strict priority queuing with up to 30% bandwidth
B.VoIP traffic is dropped if congestion occurs
C.VoIP traffic is shaped to 30% of bandwidth
D.VoIP traffic is queued in the default class with fair-queue
AnswerA

Priority queue guarantees bandwidth up to 30% with strict priority.

Why this answer

Option B is correct because priority queue provides strict priority; traffic is not shaped. Option A is wrong because priority does not shape. Option C is wrong because fair-queue is for default class.

Option D is wrong because congestion is avoided but not specifically by WRED.

Practice this question →
7
MCQmedium

Refer to the exhibit. A network engineer is troubleshooting MPLS forwarding for prefix 10.10.10.0/24. The router shows two entries. What does the 'Pop tag' in the outgoing tag indicate?

A.The router will swap the label with the local label 16.
B.The router has received an error in label distribution.
C.The router will pop the MPLS label before forwarding the packet.
D.The router will forward the packet without an MPLS label.
AnswerC

PHP is performed by the penultimate router.

Why this answer

The 'Pop tag' in the outgoing tag indicates that the router is the penultimate hop in the MPLS LSP. According to Penultimate Hop Popping (PHP) behavior, the penultimate router removes (pops) the top label before forwarding the IP packet to the egress LSR, so the egress router receives a pure IP packet and does not need to perform a label lookup. This is standard MPLS behavior defined in RFC 3031.

Exam trap

Cisco often tests the distinction between 'Pop tag' (PHP/Implicit NULL) and 'Untagged' (no label at all), leading candidates to confuse the two; 'Pop tag' means the label is actively removed, while 'Untagged' means the packet was never labeled.

How to eliminate wrong answers

Option A is wrong because 'Pop tag' means the label is removed, not swapped; swapping would show a specific outgoing label value (e.g., 16) instead of 'Pop tag'. Option B is wrong because 'Pop tag' is a normal, intentional label operation in MPLS, not an error condition; label distribution errors typically result in missing or incorrect label bindings, not a 'Pop tag' indication. Option D is wrong because the router will forward the packet without an MPLS label only after popping it; the 'Pop tag' action itself removes the label, and the packet is then forwarded as a native IP packet, but the statement 'forward the packet without an MPLS label' is misleading because it implies the router never had a label, whereas PHP explicitly pops the existing label.

Practice this question →
8
MCQmedium

A customer requires MPLS Layer 2 VPN connectivity between two sites using Pseudowire. Which control protocol is used to signal the pseudowire label?

A.RSVP-TE
B.LDP
C.BGP
D.OSPF
AnswerB

LDP signaled pseudowire is used in AToM.

Why this answer

Option B is correct because LDP is used for pseudowire label signaling in AToM. Option A is wrong because BGP is used for auto-discovery. Option C is wrong because RSVP-TE is for traffic engineering.

Option D is wrong because OSPF is an IGP.

Practice this question →
9
MCQeasy

A service provider recently deployed MPLS L3VPN for a customer with four sites (Site1, Site2, Site3, Site4) connected to PE1, PE2, PE3, and PE4 respectively. All sites are in VRF CUST-A with route targets 100:1 import and 100:1 export on all PEs. The customer reports that Site4 cannot ping the loopback interface (10.1.1.1/32) of Site1, but Site2 and Site3 can reach it. The provider verifies that BGP sessions between all PEs and the route reflector are up and that VPNv4 routes are advertised. The VRF on PE4 shows the route 10.1.1.1/32 with next-hop 192.0.2.1 (PE1's loopback) but when Site4 initiates a ping, it fails. What should the provider check next?

A.Ensure that the IGP operating in the core has propagated the loopback interface address of PE1 to all P routers.
B.Verify that the BGP session between PE4 and the route reflector is using the correct update source.
C.Verify that the CE router at Site4 is configured with the correct VRF name and default gateway.
D.Check the VRF route target import on PE1 to ensure it includes the route target exported by PE4 for Site4's subnet.
AnswerD

Even if the remote prefix is in the VRF, return traffic requires the local prefix to be imported by the remote PE.

Why this answer

Option B is correct because the ping failure is likely due to return path routing; the VRF on PE4 has the route, but the ping echo reply must be routed back to Site4. The VRF on PE1 must have a route for Site4's subnet. Typically, the import and export RTs are symmetric, but if PE1 is not importing the RT that PE4 exports (e.g., Site4's prefix), the return traffic will be dropped.

Checking the RT import on PE1 for the route from Site4 is the most common cause. Option A is incorrect because BGP sessions are already up. Option C is incorrect because IGP propagation of loopbacks is not needed for VPNv4.

Option D is incorrect because CE configuration is likely fine since Site2 and Site3 work.

Practice this question →
10
MCQmedium

Refer to the exhibit. CE1 is not receiving the VPNv4 route for the 192.168.1.0/24 subnet. What is the most likely cause?

A.PE1 is missing the VRF configuration for CUSTOMER_A
B.PE1 is missing the neighbor statement under address-family ipv4 vrf CUSTOMER_A
C.CE1 is missing the network statement under router bgp 65001
D.The neighbor 10.0.0.2 is using an incorrect update-source
AnswerB

Why this answer

For CE1 to receive the VPNv4 route for 192.168.1.0/24, PE1 must redistribute the route from the VRF into BGP. The neighbor statement under address-family ipv4 vrf CUSTOMER_A is required to establish an eBGP peering with CE1 and exchange IPv4 routes within that VRF. Without it, PE1 will not send any routes to CE1, even if the VRF and route targets are correctly configured.

Exam trap

Cisco often tests the distinction between VRF configuration and BGP address-family activation, tricking candidates into thinking a missing VRF is the issue when the real problem is the missing neighbor statement under the VRF address-family.

How to eliminate wrong answers

Option A is wrong because PE1 missing the VRF configuration for CUSTOMER_A would prevent any VRF-based routing, but the question states CE1 is not receiving the VPNv4 route specifically, implying the VRF exists but the BGP peering is broken. Option C is wrong because CE1 missing the network statement under router bgp 65001 would prevent CE1 from advertising the 192.168.1.0/24 route to PE1, but the issue is CE1 not receiving the route, not advertising it. Option D is wrong because the neighbor 10.0.0.2 using an incorrect update-source would affect the BGP session between PE1 and CE1, but the exhibit shows the peering is established (otherwise CE1 would not be a BGP neighbor at all), and the problem is specifically that the route is not being sent to CE1.

Practice this question →
11
Multi-Selectmedium

Which TWO statements about BGP FlowSpec (RFC 8955) are correct?

Select 2 answers
A.FlowSpec can be deployed in BGP sessions between a route reflector and a client.
B.FlowSpec uses a separate BGP session from the regular IPv4 unicast session.
C.FlowSpec is designed to replace ACLs on provider edge routers.
D.FlowSpec requires MPLS forwarding to operate.
E.FlowSpec uses the IPv4 unicast or VPNv4 address family.
AnswersA, E

FlowSpec routes can be propagated via BGP within the service provider network.

Why this answer

Option A is correct because BGP FlowSpec (RFC 8955) can be deployed between a route reflector and its clients. The route reflector propagates FlowSpec NLRI (Network Layer Reachability Information) to its clients, allowing the clients to install traffic filtering rules without requiring a full BGP mesh. This is a common deployment model in service provider networks to distribute flow-spec routes efficiently.

Exam trap

Cisco often tests the misconception that FlowSpec requires a separate BGP session or MPLS, but the trap here is that candidates confuse the address family separation (which uses the same session) with a separate session, or assume MPLS is mandatory because FlowSpec is often discussed in MPLS VPN contexts.

Practice this question →
12
MCQmedium

A service provider is deploying LISP (Locator/ID Separation Protocol) to provide mobility and multihoming for customer endpoints. Which LISP component is responsible for maintaining the mapping between Endpoint Identifiers (EIDs) and Routing Locators (RLOCs) and for responding to Map-Request messages from ITRs?

A.Ingress Tunnel Router (ITR)
B.Map-Server (MS)
C.Map-Resolver (MR)
D.Egress Tunnel Router (ETR)
AnswerB

MS maintains the EID-to-RLOC mapping and responds to Map-Requests.

Why this answer

Option B is correct. The Map-Server maintains the EID-to-RLOC mapping database and responds to Map-Requests. Option A (ITR) encapsulates and sends packets to the ETR.

Option C (ETR) decapsulates and receives packets. Option D (MR) forwards Map-Requests to the MS, but the MS provides the mapping.

Practice this question →
13
Multi-Selectmedium

Which THREE factors must be considered when deploying MPLS Layer 3 VPN services to ensure optimal scalability and convergence?

Select 3 answers
A.Label distribution via LDP or TDP must be consistent across all P routers.
B.Route reflectors should be used to reduce the number of BGP sessions in the service provider core.
C.All PE routers must be directly connected via eBGP to exchange VPNv4 routes.
D.The number of VRFs per PE router is limited by available memory and route processing capacity.
E.The use of BGP next-hop-self is mandatory to prevent routing blackholes in multi-area IGP environments.
AnswersA, B, D

Inconsistent label distribution can cause label mismatch and forwarding failures.

Why this answer

Option A is correct because consistent label distribution across all P (Provider) routers is essential for MPLS L3VPN scalability and convergence. LDP (Label Distribution Protocol) or TDP (Tag Distribution Protocol, Cisco proprietary predecessor) must be uniformly configured to ensure a seamless label-switched path (LSP) from ingress to egress PE. Inconsistent label distribution can cause label binding mismatches, leading to forwarding failures or suboptimal convergence during topology changes.

Exam trap

Cisco often tests the misconception that eBGP is required between PEs for VPNv4 exchange, when in fact iBGP (often with route reflectors) is the standard, and eBGP is only used at the CE-PE edge.

Practice this question →
14
MCQmedium

A service provider is deploying MPLS Layer 3 VPNs and wants to ensure that customer traffic is not dropped when a PE-CE link fails. The CE router is using static routing. Which design should be implemented to provide fast convergence?

A.Configure OSPF on the PE-CE link and set hello timers to 1 second.
B.Use IP SLA tracking to monitor the CE and adjust the static route.
C.Increase the administrative distance of the static route to 255.
D.Enable BFD on the PE-CE interface and associate it with the static route.
AnswerD

BFD provides sub-second failure detection, triggering fast route withdrawal.

Why this answer

Option D is correct because BFD (Bidirectional Forwarding Detection) provides sub-second failure detection on the PE-CE link, and when associated with a static route, it allows the PE to quickly remove the failed route from the routing table. This triggers fast convergence without waiting for routing protocol timers, which is critical for MPLS Layer 3 VPNs using static routing on the CE side.

Exam trap

The trap here is that candidates often choose IP SLA (Option B) thinking it provides fast failure detection, but they overlook that IP SLA is poll-based and slower than BFD, which is the Cisco-recommended mechanism for sub-second convergence with static routes.

How to eliminate wrong answers

Option A is wrong because OSPF is a dynamic routing protocol, but the CE router is using static routing; configuring OSPF would require changing the CE configuration and does not leverage the static route design. Option B is wrong because IP SLA tracking can detect reachability but typically operates at a polling interval of several seconds (e.g., 5-60 seconds), which is too slow for fast convergence compared to BFD's sub-second detection. Option C is wrong because increasing the administrative distance of the static route to 255 makes it the least preferred route, effectively removing it from the routing table unless no other route exists, which would break connectivity rather than provide fast convergence.

Practice this question →
15
MCQeasy

A service provider deploys MPLS L3VPN to connect multiple customer sites. Which VPN address family must be enabled on the PE routers to exchange customer IPv4 routes between PEs?

A.VPNv4 unicast
B.IPv4 labeled-unicast
C.IPv4 unicast
D.VPNv6 unicast
AnswerA

VPNv4 address family carries VPN-IPv4 routes with route distinguisher.

Why this answer

Option C is correct because VPNv4 address family carries IPv4 VPN routes with RD and RT. Option A is wrong because IPv4 unicast is for global table. Option B is wrong because VPNv6 is for IPv6 VPNs.

Option D is wrong because labeled IPv4 is used for MPLS label distribution.

Practice this question →
16
MCQmedium

A service provider is implementing Multicast VPN (MVPN) in an MPLS backbone. They use Rosen GRE (draft-rosen) for multicast transport. What is the primary limitation of Rosen GRE compared to mLDP-based MVPN?

A.It requires full-mesh of GRE tunnels between all PEs.
B.It cannot use Source-Specific Multicast (SSM).
C.All multicast traffic is sent to every PE in the VPN, even if no receiver exists.
D.It does not support Protocol Independent Multicast (PIM).
AnswerC

Rosen GRE uses a default MDT that forwards traffic to all PEs, causing waste.

Why this answer

Option C is correct because Rosen GRE uses a default MDT group that carries all multicast traffic, leading to unnecessary traffic replication to PEs that do not have interested receivers. mLDP builds P2MP LSPs precisely where needed. Option A is wrong because both support PIM. Option B is wrong because both require full-mesh of tunnels (Rosen GRE uses GRE, mLDP uses MPLS LSP).

Option D is wrong because both can handle SSM.

Practice this question →
17
Multi-Selecteasy

A service provider is configuring BGP community propagation in an MPLS VPN network. Which two actions are necessary to ensure that communities are passed from CE to remote PE?

Select 2 answers
A.Configure no bgp default community-mode
B.Configure send-community on the CE-to-PE BGP session
C.Configure send-community extended on the VPNv4 neighbor
D.Configure vrf forwarding with route-target both
E.Configure route-map to filter communities
AnswersB, C

Correct. This allows communities from the CE to be received by the PE.

Why this answer

B is correct because the `send-community` command must be configured on the CE-to-PE BGP session to allow standard BGP communities (e.g., NO_EXPORT) to be propagated from the CE router into the MPLS VPN network. Without this, the PE router will strip communities from incoming BGP updates, preventing them from reaching the remote PE.

Exam trap

Cisco often tests the distinction between standard and extended communities, leading candidates to forget that `send-community` (for standard) is required on the CE-PE session, while `send-community extended` is only for VPNv4 peers.

Practice this question →
18
MCQhard

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

A.The BGP neighbor is not activated under the VPLS address-family
B.The route-target on the new PEs does not match the existing VPLS context
C.The MTU mismatch between PEs
D.The VFI name is not consistent across PEs
AnswerB

Correct. Mismatched route-target prevents the new PEs from being discovered by the existing ones, so pseudowires are not established.

Why this answer

B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Exam trap

Cisco often tests the distinction between BGP session establishment (which only requires neighbor configuration and address-family activation) and successful VPLS pseudowire creation (which additionally requires matching route-target import/export policies), leading candidates to incorrectly suspect BGP activation issues when the real problem is RT mismatch.

How to eliminate wrong answers

Option A is wrong because the BGP neighbor is already activated under the L2VPN address-family (the question states BGP session is established and L2VPN routes are exchanged), so the issue is not activation. Option C is wrong because an MTU mismatch between PEs would cause pseudowire status to be 'down' due to LDP or MPLS MTU negotiation failure, but the question specifies BGP autodiscovery and signaling, and MTU mismatch typically manifests as operational errors or packet drops, not a pseudowire that fails to come up solely due to RT mismatch. Option D is wrong because the VFI name is a local label on each PE and does not need to be consistent across PEs; VPLS uses the VPLS ID (or VPLS instance ID) carried in BGP, not the VFI name, to match endpoints.

Practice this question →
19
MCQmedium

A customer's MPLS L3VPN has two CE routers connected to two different PEs, but the PEs are not receiving the customer's routes from each other. The PE-CE routing protocol is OSPF. The PEs have the VRF configured with OSPF process, and the routes from CE are in the VRF routing table. The MP-BGP session between PEs is up and the VPNv4 address family is working. On the source PE, the routes show as not advertised to BGP. What is the likely issue?

A.The route-target export on the source PE does not match the import on the remote PE
B.The OSPF network type is not set to broadcast
C.The OSPF process on the PE is not redistributed into BGP VPNv4 under the VRF
D.The next-hop-self is not configured under the VRF OSPF process
AnswerC

Correct. The 'redistribute ospf process-id' command under the VRF address-family is missing, so OSPF routes are not injected into MP-BGP.

Why this answer

The correct answer is C because in an MPLS L3VPN with OSPF as the PE-CE protocol, the VRF OSPF process must be explicitly redistributed into the MP-BGP VPNv4 address family using the `redistribute ospf <process-id> match internal external` command under the VRF address-family IPv4. Without this redistribution, the OSPF routes learned from the CE remain in the VRF routing table but are never injected into BGP, so they are not advertised to the remote PE, even though the MP-BGP session is up and the VPNv4 address family is working.

Exam trap

Cisco often tests the misconception that simply enabling OSPF under a VRF and having a working MP-BGP session is sufficient for route exchange, when in fact explicit redistribution from OSPF into BGP VPNv4 is required.

How to eliminate wrong answers

Option A is wrong because if the route-target export on the source PE did not match the import on the remote PE, the routes would be advertised to BGP (they would show as advertised) but would not be installed on the remote PE; the question states the routes show as 'not advertised to BGP', so the issue is before BGP advertisement. Option B is wrong because the OSPF network type does not affect whether routes are redistributed into BGP; it only influences neighbor discovery and DR/BDR election, and the PE-CE adjacency is already established since routes are in the VRF table. Option D is wrong because `next-hop-self` is a BGP configuration (applied under the VRF address-family or BGP neighbor) that modifies the next-hop attribute in BGP updates, not an OSPF command; it does not control whether routes are advertised to BGP in the first place.

Practice this question →
20
MCQhard

Refer to the exhibit. Which statement about this BGP configuration is true?

A.The no synchronization command is invalid under address-family ipv4 vrf.
B.The next-hop-self command ensures that the PE sets itself as the next-hop for routes advertised to the route reflector.
C.The send-community extended command is only needed for IPv4 unicast address family.
D.The redistribute ospf command will import OSPF routes into the VRF but not into BGP.
AnswerB

Next-hop-self is used to set the local router as next-hop.

Why this answer

Option B is correct because the `next-hop-self` command under the VRF address-family instructs the PE router to set its own IP address as the next-hop for routes advertised to the route reflector. This is necessary in MPLS L3VPN environments to ensure that the route reflector (and other PEs) can reach the customer prefix via the advertising PE, avoiding reachability issues when the original next-hop is not directly connected across the MPLS core.

Exam trap

Cisco often tests the misconception that `next-hop-self` is only needed for eBGP peers, but in MPLS L3VPN it is essential for iBGP sessions to route reflectors to ensure correct next-hop reachability across the core.

How to eliminate wrong answers

Option A is wrong because the `no synchronization` command is valid under `address-family ipv4 vrf`; BGP synchronization is disabled by default in modern IOS versions and is not required for VRF configurations. Option C is wrong because the `send-community extended` command is required for the VPNv4 address family (or under the VRF) to propagate extended communities (e.g., RTs) necessary for MPLS L3VPN operation, not just for IPv4 unicast. Option D is wrong because the `redistribute ospf` command under the VRF address-family imports OSPF routes into the BGP VRF table, making them available for redistribution into BGP VPNv4 routes; the routes are indeed imported into BGP, not excluded.

Practice this question →
21
MCQeasy

Refer to the exhibit. Which prerequisite for MPLS L3VPN is missing on PE1?

A.MPLS is not enabled on the interface
B.LDP is not enabled globally
C.VRF is not defined
D.OSPF is not redistributed into BGP
AnswerC

No `ip vrf` definition or VRF applied to any interface.

Why this answer

Option C is correct because the exhibit shows that PE1 has an interface configured with an IP address and MPLS enabled, but no VRF definition is present. For MPLS L3VPN, a VRF must be defined on the PE router to separate customer routing tables and to associate the customer-facing interface with that VRF. Without the VRF, the PE cannot import/export VPN routes or maintain per-VPN routing instances, which is a fundamental prerequisite for L3VPN operation.

Exam trap

Cisco often tests the misconception that MPLS or LDP configuration alone is sufficient for L3VPN, when in fact the VRF definition is the mandatory first step that candidates overlook.

How to eliminate wrong answers

Option A is wrong because the exhibit shows 'mpls ip' under the interface, indicating MPLS is already enabled on that interface. Option B is wrong because LDP is enabled globally as shown by 'mpls ldp router-id' and 'mpls ldp' in the global configuration, and LDP is not a prerequisite for L3VPN (though it is commonly used for label distribution). Option D is wrong because OSPF redistribution into BGP is a configuration step for propagating routes within the VPN, not a prerequisite; the VRF must exist first before any redistribution can be applied.

Practice this question →
22
MCQhard

A service provider is deploying EVPN-VPWS to replace legacy pseudowire connections for point-to-point Layer 2 services. They notice that MAC addresses learned from a CE device are not properly advertised to the remote PE. Which EVPN route type is responsible for advertising MAC address reachability information in a VPWS scenario?

A.Route Type 1 (Ethernet Auto-Discovery)
B.Route Type 2 (MAC/IP Advertisement)
C.Route Type 5 (IP Prefix)
D.Route Type 3 (Inclusive Multicast)
AnswerA

Ethernet AD routes include MAC address information for split-horizon.

Why this answer

Option A is correct because Route Type 1 (Ethernet Auto-Discovery) is used for VPWS per-EVI and per-ES AD routes, which include MAC mobility information. Route Type 2 is for MAC/IP advertisement, but in VPWS, MAC learning is not required typically; however, Route Type 1 carries the MAC address for split-horizon filtering. Option B (RT-2) is for MAC/IP but not the primary for VPWS.

Option C (RT-3) is for inclusive multicast. Option D (RT-5) is for IP prefix.

Practice this question →
23
MCQeasy

A service provider is implementing QoS on a PE router for customer traffic. Which tool should be used to classify traffic based on application layer information?

A.Access-list
B.MQC with NBAR
C.Shaping
D.Policy-map with police
AnswerB

Correct. NBAR can classify traffic based on application signatures.

Why this answer

NBAR (Network-Based Application Recognition) is a deep packet inspection (DPI) engine within the Modular QoS CLI (MQC) that can identify applications by inspecting payloads up to Layer 7. This allows classification of traffic based on application-layer information such as HTTP, DNS, or proprietary protocols, which is exactly what the question requires.

Exam trap

Cisco often tests the distinction between classification tools (NBAR, ACLs) and QoS actions (shaping, policing), so the trap here is that candidates confuse a QoS action (like shaping or policing) with the classification mechanism itself.

How to eliminate wrong answers

Option A is wrong because an access-list (ACL) classifies traffic based on Layer 3/4 fields (IP addresses, ports, protocol numbers) and cannot inspect application-layer payloads. Option C is wrong because shaping is a QoS action that delays excess traffic to smooth output, not a classification tool. Option D is wrong because a policy-map with police is a QoS action (policing) that drops or marks traffic based on a pre-classified rate, not a method to classify traffic by application layer.

Practice this question →
24
MCQeasy

A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?

A.Increase the path-option preference value.
B.Disable path protection on the tunnel.
C.Change the explicit path to 'loose' for the down interface.
D.Configure an affinity constraint to exclude the down interface.
AnswerC

Loose hops allow the tunnel to traverse other interfaces.

Why this answer

Option C is correct because changing the explicit path from 'strict' to 'loose' for the down interface allows the MPLS TE tunnel to use an alternative next-hop that is reachable, even if the specified interface is down. A strict explicit path requires every hop to be directly connected, so a down interface prevents the tunnel from coming up. By making the hop loose, the router can route around the failed link using the IGP's best path to the next specified node.

Exam trap

Cisco often tests the distinction between strict and loose explicit paths, where candidates mistakenly think that adjusting path preference or adding constraints can override a strict hop that is down, rather than recognizing that only changing the hop type to loose allows the router to dynamically route around the failure.

How to eliminate wrong answers

Option A is wrong because increasing the path-option preference value only changes the order in which path options are tried; it does not bypass a down interface in a strict explicit path. Option B is wrong because disabling path protection removes the ability to use a backup tunnel or fast reroute, but does not resolve the issue of a strict explicit path requiring a down interface. Option D is wrong because configuring an affinity constraint to exclude the down interface would require the tunnel to avoid that interface, but the explicit path still mandates it as a strict hop, so the constraint cannot override the explicit path definition.

Practice this question →
25
Matchingmedium

Match each Segment Routing component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Segment Identifier, an instruction in the SR header

Segment Routing Global Block of label values

Segment Routing over MPLS data plane

Topology-Independent Loop-Free Alternate for fast reroute

Path Computation Element Protocol for SR path computation

Why these pairings

These are key elements of Segment Routing in service provider networks.

Practice this question →
26
MCQhard

A service provider is using LISP to provide host mobility. Which LISP component is responsible for storing the mapping of EID to RLOC?

A.Map-Server
B.Altitude
C.Tunnel Router
D.Map-Resolver
AnswerA

Correct. The Map-Server maintains the mapping database for the LISP site.

Why this answer

In LISP (RFC 6830), the Map-Server (MS) is the central repository that stores the mapping of Endpoint Identifiers (EIDs) to Routing Locators (RLOCs). When an Ingress Tunnel Router (ITR) needs to forward traffic to a destination EID, it queries the Map-Resolver, which in turn contacts the Map-Server to retrieve the authoritative mapping. The Map-Server also accepts registration from Egress Tunnel Routers (ETRs) on behalf of their EID prefixes, making it the definitive source for EID-to-RLOC bindings.

Exam trap

Cisco often tests the distinction between the Map-Server (which stores the mapping) and the Map-Resolver (which only proxies requests), so the trap here is confusing the resolver's forwarding role with the server's storage role, leading candidates to incorrectly select Map-Resolver.

How to eliminate wrong answers

Option B (Altitude) is wrong because Altitude is not a LISP component; it is a proprietary Cisco technology for traffic engineering and path selection, unrelated to EID-to-RLOC mapping storage. Option C (Tunnel Router) is wrong because Tunnel Routers (ITR/ETR) perform encapsulation/decapsulation and may cache mappings, but they do not store the authoritative mapping database—that is the Map-Server's role. Option D (Map-Resolver) is wrong because the Map-Resolver handles incoming map-requests from ITRs and forwards them to the Map-Server; it does not store mappings itself, acting only as a proxy.

Practice this question →
27
Multi-Selecteasy

Which two statements about MPLS Layer 3 VPN route target (RT) communities are correct?

Select 1 answer
A.RTs must be manually configured on every PE router for each VRF.
B.RTs are used to prevent routing loops within the MPLS VPN network.
C.RTs are used to determine the next-hop IP address for VPN prefixes.
D.RTs control the import and export of routes between VRFs on PE routers.
E.RTs are carried in the IP header to enable per-VPN forwarding.
AnswersD

Correct: RTs determine which routes are imported into or exported from a VRF.

Why this answer

Route targets are used to import and export VPN routes between VRFs, and they are encoded as extended community attributes in BGP updates. Option B is incorrect because RTs do not directly determine the next hop; that is done by the BGP next-hop attribute. Option C is incorrect because RTs are not used for loop prevention (that is the role of the route distinguisher and AS-override).

Option D is incorrect because RTs are not required to be manually configured if auto-RT is used. Option E is incorrect because RTs are not carried in IP headers; they are part of BGP VPNv4 updates.

Practice this question →
28
MCQhard

Refer to the exhibit. CE1 is unable to ping the loopback of a remote CE. Which configuration change is required on PE1 to enable communication?

A.Add `send-community extended` to the VRF BGP neighbor
B.Apply the VRF to the interface facing CE and ensure BGP VRF neighbor is activated
C.Change the VPNv4 neighbor to point to 192.168.1.2
D.Set the CE neighbor remote-as to 65000
AnswerB

Missing `ip vrf forwarding CUSTOMER` on interface and `neighbor 192.168.1.2 activate` under address-family ipv4 vrf CUSTOMER.

Why this answer

Option D is correct because the VRF CUSTOMER is defined but the VRF is not applied to any interface; also the BGP VRF configuration lacks the `neighbor ... activate` under address-family ipv4 vrf. Option A is wrong because send-community already enabled. Option B is wrong because the VPNv4 neighbor is correct.

Option C is wrong because the CE neighbor remote-as is correct.

Practice this question →
29
MCQmedium

A service provider is implementing QoS policies on an access aggregation router. They want to shape traffic to a downstream DSLAM to 10 Mbps, but they do not want to exceed the shaping rate even if the line rate is higher. Which QoS tool should be used on the interface facing the DSLAM?

A.Queuing
B.Marking
C.Policing
D.Shaping
AnswerD

Shaping buffers traffic to stay below a configured rate.

Why this answer

Option C is correct. Shaping buffers traffic to a configured rate, smoothing bursts and ensuring the rate is not exceeded. Option A (Policing) drops or marks traffic that exceeds a rate, but does not buffer.

Option B (Marking) sets DSCP/IP precedence but does not enforce rate. Option D (Queuing) manages congestion but not rate enforcement.

Practice this question →
30
Multi-Selecthard

Which THREE components are required to deploy MPLS Layer 3 VPN?

Select 3 answers
A.VRFs on PE routers
B.GRE tunneling
C.OSPF
D.LDP
E.MP-BGP with VPNv4 address family
AnswersA, D, E

VRFs provide per-customer routing separation.

Why this answer

VRFs (Virtual Routing and Forwarding) are required on PE routers to maintain separate, isolated routing tables for each customer VPN. This allows overlapping IP addresses between different customers and ensures that traffic from one VPN does not leak into another. Without VRFs, the PE router cannot distinguish between customer routes, making Layer 3 VPN operation impossible.

Exam trap

Cisco often tests the misconception that an IGP like OSPF is mandatory for MPLS Layer 3 VPN, when in fact the required components are VRFs, LDP (or another label distribution protocol), and MP-BGP with VPNv4 address family—the IGP is only needed to support LDP, not as a direct component of the VPN service.

Practice this question →
31
MCQhard

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

A.MCAST-VPN address family
B.MVPN does not use BGP; it uses PIM.
C.VPNv4 address family
D.IPv4 multicast address family
AnswerA

The MCAST-VPN address family is used for MVPN signaling.

Why this answer

In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Exam trap

Cisco often tests the distinction between the MCAST-VPN address family (used for MVPN signaling) and the VPNv4 address family (used for unicast VPN routes), leading candidates to mistakenly select VPNv4 when multicast is involved.

How to eliminate wrong answers

Option B is wrong because MVPN with BGP signaling (draft-rosen) explicitly uses BGP to carry multicast routing information; PIM is used for control plane signaling within the VRF but not for inter-PE multicast route exchange. Option C is wrong because the VPNv4 address family carries unicast VPN-IPv4 prefixes, not multicast routing information; multicast VPN requires the MCAST-VPN address family. Option D is wrong because the IPv4 multicast address family (AFI 1, SAFI 2) is used for native IPv4 multicast routing (e.g., PIM BSR or Auto-RP) and does not support VRF-scoped multicast VPN signaling.

Practice this question →
32
Multi-Selecthard

Which THREE of the following are correct statements about EVPN-VXLAN in a data center fabric? (Select three.)

Select 3 answers
A.EVPN route type 3 is used for BUM traffic forwarding.
B.VXLAN encapsulation adds a 50-byte outer header (14 Ethernet + 20 IP + 8 UDP + 8 VXLAN).
C.EVPN route type 2 is used to advertise MAC and IP addresses.
D.VXLAN is a Layer 3 overlay that requires an IGP in the overlay.
E.VXLAN always requires IP multicast in the underlay for BUM traffic.
AnswersA, B, C

Route type 3 is the inclusive multicast route.

Why this answer

Options A, B, and D are correct. EVPN-VXLAN uses BGP EVPN route type 2 for MAC/IP advertisement, route type 3 for inclusive multicast, and VXLAN encapsulation uses a UDP header. Option C is wrong: VXLAN uses multicast or BGP EVPN but not necessarily ingress replication for BUM traffic; it can use multicast or ARP suppression.

Option E is wrong: VXLAN is a Layer 2 overlay over a Layer 3 underlay.

Practice this question →
33
MCQmedium

Given the output, which configuration mismatch would prevent a remote PE in the same VPN from installing this route into its VRF?

A.The remote PE has an import RT that does not include RT:65000:200.
B.The remote PE uses a different route distinguisher for its VRF.
C.The remote PE filters routes based on BGP AS-path containing AS 65000.
D.The next-hop 10.1.1.2 is not reachable in the remote PE's global routing table.
AnswerA

Correct: The route's RT must match an import RT on the remote VRF for the route to be installed.

Why this answer

The route carries RT:65000:200. A remote PE must have a VRF with an import RT that matches this RT to install the route. If the remote PE's VRF imports RT:65000:100 instead, the route will not be installed.

Option A is incorrect because different RDs do not prevent route installation as long as the RT matches. Option B is incorrect because the next-hop is reachable (10.1.1.2) via the global table. Option D is incorrect because MPLS VPN does not use AS-path filtering by default.

Practice this question →
34
MCQeasy

Which technology allows a service provider to offer different classes of service over a single MPLS network?

A.QoS
B.BGP
C.LDP
D.MPLS VPN (VRF)
AnswerA

QoS provides classification and prioritization for service classes.

Why this answer

Option B is correct because QoS enables traffic differentiation. Option A is wrong because VRF is for separation, not service classes. Option C is wrong because BGP is routing.

Option D is wrong because LDP is label distribution.

Practice this question →
35
MCQeasy

A service provider is deploying IGMPv3 snooping on an MVPN network to optimize multicast forwarding. After configuration, multicast traffic is not reaching receivers. The source is sending to group 239.1.1.1. The PE router has received the IGMP report from the receiver, and the MDT is established. What is the most likely reason?

A.The RP for the group is not configured
B.The IGMP snooping is filtering the multicast traffic because of wrong VLAN configuration
C.The source-specific multicast (SSM) range is applied but the receiver sent a (*,G) report
D.The multicast routing is not enabled globally
AnswerC

Correct. IGMPv3 allows source-specific reports. If the group falls in SSM range, the receiver must specify the source; otherwise, traffic is not forwarded.

Why this answer

Option C is correct because IGMPv3 snooping on the PE router processes the receiver's IGMPv3 report. If the SSM range (232.0.0.0/8) is applied to group 239.1.1.1, the receiver must send an IGMPv3 (S,G) report to join a specific source. However, if the receiver sends a (*,G) report (which is allowed only in ASM mode), the IGMP snooping will not install the forwarding entry, causing multicast traffic to be dropped even though the MDT is established.

Exam trap

The trap here is that candidates assume IGMPv3 snooping always works with any group, forgetting that the SSM range enforces (S,G) reports and that a (*,G) report in that range is silently dropped, not processed.

How to eliminate wrong answers

Option A is wrong because the RP is not required for SSM operation; in SSM, receivers learn the source via out-of-band mechanisms, and the PE uses the (S,G) state directly without an RP. Option B is wrong because the question states the MDT is established and the IGMP report is received, indicating VLAN configuration is correct; IGMP snooping filtering due to wrong VLAN would prevent the report from reaching the PE. Option D is wrong because multicast routing must be enabled globally for any multicast forwarding to work, but the question confirms the MDT is established, which implies multicast routing is already enabled.

Practice this question →
36
MCQeasy

A customer is connected to a service provider MPLS L3VPN network using BGP. The CE advertises a prefix 10.1.1.0/24 to the PE. On the PE, the customer's VRF route table shows the route with the next-hop set to the CE. When the PE receives a packet destined to 10.1.1.1, what label stack will the PE apply before forwarding the packet across the MPLS core?

A.Only the transport label (LDP or RSVP) for the egress PE
B.Only the MPLS VPN label assigned to the route by the egress PE
C.No label, because the CE is directly connected
D.Both the transport label and the VPN label
AnswerB

The ingress PE pushes the VPN label (inner) and a transport label (outer), but the VPN label is specific to the VRF.

Why this answer

Option A is correct. For a packet going from the PE to a CE in the same VRF, the PE will push an MPLS label (LSP label) towards the egress PE, not a VPN label for the CE. Actually, when forwarding from local CE to remote CE, the ingress PE pushes both transport label (for the egress PE) and the VPN label.

But the question says 'before forwarding across the MPLS core', so the packet goes to the remote PE. The PE will push an outer transport label (LDP or RSVP-TE label) and an inner VPN label identifying the VRF or prefix. Option A says only MPLS VPN label, which is correct as the inner label; the outer label is also needed.

However, the phrasing 'the PE will apply which label?' might be interpreted as the label stack. Typically, the PE pushes two labels: transport label + VPN label. Among options, only A mentions VPN label, but it says 'only the MPLS VPN label assigned to that route by the egress PE' - that is the inner label.

The outer label is also needed. But since it's multiple choice, best answer is the inner VPN label because the transport label is core-dependent. Actually, the standard is that the ingress PE imposes two labels.

Option A correctly identifies the VPN label, though it omits transport. But option D says no label, which is wrong. Option B says transport label only, wrong.

Option C says both, but does not specify. The most accurate is that the PE will apply a VPN label (assigned by the remote PE) and a transport label, but since it's asking for 'which label', likely the VPN label is the one specific to the service. Given typical exam questions, they expect the VPN label.

I'll go with A.

Practice this question →
37
Multi-Selecthard

Which THREE characteristics apply to the BGP-LS (BGP Link State) protocol?

Select 3 answers
A.It supports only IS-IS, not OSPF.
B.It uses a separate address family from VPNv4.
C.It distributes link-state information from IGPs like OSPF and IS-IS.
D.It uses BGP as the transport protocol.
E.It carries traffic-engineering parameters in the NLRI.
AnswersB, C, D

BGP-LS uses AFI 16388, SAFI 71.

Why this answer

BGP-LS uses a separate address family (AFI 16388 / SAFI 71) from VPNv4 (AFI 1 / SAFI 128) to carry link-state information. This separation allows BGP-LS to operate independently from VPNv4 routes, enabling the collection and distribution of IGP topology data without interfering with MPLS VPN signaling.

Exam trap

Cisco often tests the misconception that BGP-LS only supports IS-IS (Option A) or that TE parameters are carried in the NLRI (Option E), when in fact BGP-LS supports both OSPF and IS-IS, and TE attributes are carried as sub-TLVs within the BGP-LS path attribute, not directly in the NLRI.

Practice this question →
38
MCQhard

A large service provider is migrating its L2VPN services (VPWS and VPLS) to EVPN-based solutions to improve scalability and support multi-homing. During the rollout for a customer using VLAN-based EVPN for a data center interconnect, the operations team notices frequent MAC address flapping and broadcast storms on one of the attachment circuits connected to a PE router. The PE is configured for EVPN-MPLS with ESI multihoming using all-active mode. The customer has two PEs (PE1 and PE2) connected to the same CE via two separate Ethernet links. The MAC table on PE1 shows the same MAC address alternating between the local AC interface and the remote EVPN peers. What is the most likely cause and the correct action to resolve this issue?

A.Implement ESI multihoming with per-flow load balancing to ensure consistent designated forwarder election.
B.Disable split-horizon on the local AC interface to allow MAC learning from the CE directly.
C.Enable selective multicast on the EVPN instance to reduce broadcast traffic.
D.Use MPLS encapsulation instead of VXLAN to avoid MAC address issues.
AnswerA

Proper ESI configuration and DF election prevent duplicate MACs and loops; per-flow load balancing can help but the key is correct ESI.

Why this answer

Option C is correct because in all-active multihoming, split-horizon is required to prevent loops, but if the ESI is misconfigured (e.g., different ESI on each PE), the designated forwarder (DF) election may fail, causing both PEs to forward traffic and create loops, leading to MAC flapping. Implementing ESI multihoming with per-flow load balancing (option C) is not a direct fix; the correct action is to ensure ESI values match and that split-horizon is enabled. However, the options are designed such that option C is the only one that addresses the root cause (incorrect ESI configuration).

Option A (disable split-horizon) would worsen the problem. Option B (enable selective multicast) is for multicast, not MAC flapping. Option D (use MPLS encapsulation instead of VXLAN) does not affect MAC learning loops.

Therefore, the correct answer is C.

Practice this question →
39
MCQmedium

A network engineer is troubleshooting slow BGP convergence after a link failure in an MPLS core. Which feature can be enabled on the PE routers to fast-failover traffic upon BGP next-hop unreachability?

A.Route Reflector clustering
B.Bidirectional Forwarding Detection (BFD)
C.Local Preference manipulation
D.BGP Prefix Independent Convergence (PIC)
AnswerD

BGP PIC pre-installs backup paths for fast failover.

Why this answer

Option B is correct because BGP PIC (Prefix Independent Convergence) provides fast failover using backup paths. Option A is wrong because BFD is for fast detection, not convergence. Option C is wrong because Local Pref influences path selection, not convergence.

Option D is wrong because Route Reflectors reduce iBGP sessions, not failover speed.

Practice this question →
40
MCQmedium

A service provider is deploying MPLS L3VPN and wants to ensure that routes from a specific customer VRF are only advertised to a specific remote PE. Which mechanism should be used?

A.Applying a route-map to the VRF export statement
B.Configuring a separate VPNv4 address-family for that PE
C.Using a unique route-distinguisher per VRF
D.Setting the next-hop-self on the PE
AnswerA

Correct. A route-map on export can filter routes before they are advertised to other PEs via VPNv4.

Why this answer

Option B is correct because a route-map on the VRF export can filter which routes are advertised into VPNv4. Option A is incorrect as RD does not filter advertisements. Option C is incorrect because VPNv4 address-family is shared among PEs.

Option D is incorrect as next-hop-self does not control route advertisement.

Practice this question →
41
MCQeasy

A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?

A.l2vpn xconnect context
B.mpls l2transport route 10.1.1.2 100
C.neighbor 10.1.1.2 remote-as 100
D.pseudowire 10.1.1.2 100 encapsulation mpls
AnswerB

This defines the peer IP and VC ID for the pseudowire.

Why this answer

Option B is correct because the `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.

Exam trap

Cisco often tests the distinction between BGP-based L2VPN (Option C) and MPLS L2VPN using targeted LDP (Option B), where candidates mistakenly apply BGP commands for a simple EoMPLS pseudowire that does not require BGP.

How to eliminate wrong answers

Option A is wrong because `l2vpn xconnect context` is not a valid Cisco IOS command; the correct command to enter xconnect configuration is `xconnect` under the interface, and the context is not used for pseudowire establishment. Option C is wrong because `neighbor 10.1.1.2 remote-as 100` is a BGP configuration command used for establishing BGP peering, not for setting up an MPLS pseudowire in EoMPLS. Option D is wrong because `pseudowire 10.1.1.2 100 encapsulation mpls` is not a valid Cisco command; the correct syntax uses `mpls l2transport route` to define the pseudowire endpoint and VC ID.

Practice this question →
42
MCQhard

Refer to the exhibit. Which statement is true regarding the forwarding entry for 10.2.2.0/24?

A.This entry uses explicit label request (not PHP).
B.The outgoing interface uses penultimate hop popping.
C.The outgoing label is Untagged.
D.The local label is 20.
AnswerA

Outgoing label 20 means next hop expects that label, not pop.

Why this answer

Option A is correct because the forwarding entry for 10.2.2.0/24 shows an outgoing label of 20, which means the egress LSR is not performing penultimate hop popping (PHP). In MPLS, when the outgoing label is not the implicit-null label (3) or explicit-null label (0), the penultimate hop must push that label, and the egress LSR will perform a full label lookup. This is an explicit label request, not PHP.

Exam trap

Cisco often tests the distinction between the incoming label (local label) and the outgoing label in the forwarding table, and the trap here is that candidates confuse the local label (which is the label this router assigns for the FEC) with the incoming label shown in the forwarding entry, leading them to incorrectly select option D.

How to eliminate wrong answers

Option B is wrong because penultimate hop popping (PHP) would require the outgoing label to be implicit-null (label 3) or the forwarding entry to indicate 'Pop Label', but here the outgoing label is 20, so PHP is not used. Option C is wrong because 'Untagged' means the packet is forwarded without an MPLS label, but the entry shows an outgoing label of 20, so the packet is label-switched. Option D is wrong because the local label is the label assigned by this LSR for the FEC, which is not shown in the exhibit; the exhibit only shows the incoming label (20) and outgoing label (20) for the forwarding entry, not the local label assigned by this router.

Practice this question →
43
MCQmedium

Refer to the exhibit. A PE router has this BGP configuration. The CE router is advertising a default route via eBGP. However, the PE is not installing the route in the VRF table. What is the most likely cause?

A.The redistribute connected command under the VRF is overwriting the default route
B.The neighbor 10.1.1.1 is not configured under the address-family ipv4 vrf CUSTOMER
C.The next-hop-self under the VRF address-family is not set
D.The default-information originate command is missing
AnswerB

Correct. Without activating the neighbor under the VRF address-family, eBGP routes from CE are not imported into the VRF.

Why this answer

Option B is correct because the BGP configuration shows that the neighbor 10.1.1.1 is configured under the BGP IPv4 unicast address-family, but not under the address-family ipv4 vrf CUSTOMER. For a VRF to install a route learned via eBGP from a CE router, the neighbor must be explicitly activated under the VRF address-family. Without this, the PE will receive the default route but will not place it into the VRF routing table.

Exam trap

Cisco often tests the distinction between configuring a BGP neighbor globally versus under a VRF address-family, tricking candidates into thinking that a neighbor statement under router bgp is sufficient for VRF route installation.

How to eliminate wrong answers

Option A is wrong because the 'redistribute connected' command under the VRF does not overwrite the default route; it only injects directly connected routes into the VRF, and BGP routes have a higher administrative distance (20 for eBGP) compared to connected routes (0), so there is no overwriting. Option C is wrong because 'next-hop-self' is used to change the next-hop attribute of routes advertised to a neighbor, but it does not affect the installation of a received route into the VRF table; the route is not being installed because the neighbor is not activated under the VRF address-family. Option D is wrong because 'default-information originate' is used to originate a default route into BGP from the PE to the CE, not to accept a default route from a CE; the PE is receiving the default route but failing to install it due to the missing VRF address-family configuration.

Practice this question →
44
MCQhard

An ISP operates an MPLS Layer 3 VPN backbone. A customer, Corporation X, has four sites (A, B, C, D) each connected to a different PE router (PE-A, PE-B, PE-C, PE-D). They use OSPF as the CE-PE routing protocol. Sites A, B, and C can exchange routes without issue. However, Site D suddenly loses connectivity to Site B, though it can still reach Sites A and C. Show commands on PE-D reveal that the VRF for Corporation X imports RT:100:200, and the route for Site B (prefix 10.10.20.0/24) is present in the BGP VPNv4 table with RT:100:200 and next-hop 10.0.2.2. The OSPF neighbor between PE-D and the CE at Site D is up, and no route filters are configured. ‘ping 10.10.20.0’ from PE-D fails. What is the most likely cause of the issue?

A.OSPF route redistribution from PE-B into BGP is set to external type 2, while PE-D expects type 1.
B.The route target for Site B is misconfigured on PE-D, not matching the export RT from PE-B.
C.PE-D is not assigning an MPLS label for the route to Site B, causing packets to be dropped.
D.The BGP next-hop (10.0.2.2) for Site B's route is not reachable in PE-D's global routing table.
AnswerD

Correct: If the next-hop is unreachable, the VPNv4 route cannot be installed in the VRF, causing loss of connectivity to that specific site.

Why this answer

The route is in the VPNv4 table with the correct RT, so import is working. The next-hop is 10.0.2.2. If that next-hop is not reachable in the global routing table of PE-D, the VPNv4 route will not be installed in the VRF.

Checking ‘show ip route 10.0.2.2’ on PE-D would confirm. Option A is plausible but incorrect because an RT mismatch would prevent the route from even appearing in the VPNv4 table. Option C is incorrect because OSPF is redistributed, and the route type does not affect reachability.

Option D is incorrect because label allocation is not the issue; the prefix is present with labels.

Practice this question →
45
Multi-Selecteasy

Which TWO of the following are services that can be offered using MPLS Layer 3 VPN (L3VPN) technology? (Select two.)

Select 2 answers
A.IP transit services
B.Layer 2 bridging between sites
C.Transport of Ethernet frames over MPLS
D.Native multicast support without tunnels
E.Internet access for customers
AnswersA, E

L3VPN provides IP routing between sites.

Why this answer

Options A and C are correct. MPLS L3VPN provides Layer 3 connectivity between customer sites; Internet service can be provided via separate VRF or global table; IP transit is a typical Layer 3 service. Option B (Layer 2 bridging) is for L2VPN/VPLS.

Option D (Transport of Ethernet frames) is L2VPN. Option E (Multicast support) is possible but is a feature, not a service itself.

Practice this question →
46
MCQhard

A service provider has a network with multiple PE routers providing MPLS L3VPN services. Customers are complaining that some remote sites are unreachable after a recent software upgrade on PE1. Upon investigation, you notice that PE1 is receiving BGP VPNv4 routes from the route reflector, but some routes are not being installed in the VRF routing table. PE1 is configured with BGP additional-path capability and has a route policy that selects only the best path. The VRF on PE1 has import and export route targets configured correctly. The missing routes have a higher local preference but are not selected due to a tie-break in BGP path selection. Which action should be taken to ensure that all valid routes are installed in the VRF?

A.Reset the BGP session between PE1 and the route reflector.
B.Configure BGP additional-paths for the VRF and adjust the route policy to allow multiple paths.
C.Disable route target filtering on PE1 to import all routes.
D.Increase the local preference on the route reflector for the missing routes.
AnswerB

Additional-paths allows multiple BGP paths to be installed in the VRF.

Why this answer

B is correct because the issue is that PE1 is configured with BGP additional-path capability but has a route policy that selects only the best path. When BGP path selection ties on local preference and other attributes, additional-path send/receive capability allows multiple paths to be considered, but the route policy must be adjusted to permit multiple paths into the VRF. Without this, only the single best path is installed, even if valid alternative paths exist.

Exam trap

Cisco often tests the distinction between enabling BGP additional-path capability globally and actually configuring the VRF to accept multiple paths; candidates mistakenly think that enabling additional-path alone is sufficient, but the route policy must be adjusted to allow multiple paths into the VRF routing table.

How to eliminate wrong answers

Option A is wrong because resetting the BGP session would not change the route selection logic; the same tie-break would occur again, and the missing routes would still not be installed. Option C is wrong because disabling route target filtering would import all routes regardless of RT, which violates VRF isolation and could introduce incorrect routing, but the problem is not about RT filtering—it is about BGP path selection limiting the number of paths installed. Option D is wrong because increasing local preference on the route reflector would only affect the tie-break if the missing routes had a lower local preference, but the scenario states they have a higher local preference and are still not selected due to a different tie-break; changing local preference would not resolve the fundamental issue of multiple paths not being accepted.

Practice this question →
47
MCQeasy

A service provider is deploying a point-to-point Layer 2 VPN across an MPLS network using Ethernet over MPLS (EoMPLS) with Martini encapsulation. The customer requires transparent transport of VLAN tags (Q-in-Q) between two sites. The provider configures the attachment circuits on the PE routers as VLAN subinterfaces with dot1q encapsulation. After configuration, the customer reports that only untagged frames pass through the pseudowire; double-tagged frames are dropped at the egress PE. Which action resolves the issue?

A.Replace the attachment circuit with a port-mode Layer 2 interface and disable VLAN tagging on the PE
B.Configure the pseudowire to use the 'tag-imposition' keyword to allow double tagging
C.Configure the PE routers to use VLAN translation to map both tags to a single tag before encapsulation
D.Change the encapsulation on the PE subinterfaces to dot1q second-dot1q and enable the preservation of the outer VLAN tag at the ingress PE
AnswerD

Why this answer

Option D is correct because EoMPLS with Martini encapsulation (RFC 4448) supports Q-in-Q transparent transport only when the ingress PE is configured to preserve the outer VLAN tag. Using 'dot1q second-dot1q' encapsulation on the subinterface tells the PE to treat the outer tag as part of the payload and not strip it, allowing both tags to be carried across the pseudowire. Without this, the default dot1q encapsulation strips the outer tag, causing double-tagged frames to be dropped at the egress PE.

Exam trap

Cisco often tests the distinction between 'dot1q' and 'dot1q second-dot1q' encapsulation on subinterfaces, where candidates mistakenly think that standard dot1q encapsulation will preserve double tags, but it actually strips the outer tag before encapsulation into the pseudowire.

How to eliminate wrong answers

Option A is wrong because replacing the attachment circuit with a port-mode Layer 2 interface and disabling VLAN tagging would strip all VLAN tags, preventing Q-in-Q transport entirely. Option B is wrong because 'tag-imposition' is not a valid keyword for EoMPLS pseudowires; it is a concept used in MPLS VPN label imposition, not for preserving double tags in Layer 2 VPNs. Option C is wrong because VLAN translation would map both tags to a single tag, which defeats the purpose of transparent Q-in-Q transport and does not preserve the original double-tagged frame structure.

Practice this question →
48
MCQhard

An SP is designing a MPLS L3VPN service with BGP as the PE-CE routing protocol. They want to ensure that the CE router does not become a transit router between two sites. Which BGP feature should be configured on the PE to prevent the CE from advertising routes received from one site to another?

A.Site of Origin (SoO)
B.allowas-in
C.disable-connected-check
D.as-override
AnswerA

SoO marks routes so that a CE will ignore routes with its own SoO, preventing transit.

Why this answer

Option D is correct because disabling route propagation (e.g., using 'neighbor x.x.x.x next-hop-self' or 'no bgp default route-advertise' but the key is to prevent the CE from learning other CE routes; typically on the PE, you set 'neighbor CE next-hop-self' and also ensure that the CE only receives routes from its own site. However, the exact feature is to use 'neighbor CE soft-reconfiguration inbound' plus filters, but specifically, 'disable-optimal-route-splitting' is not standard. Actually, the standard is to use 'neighbor CE prefix-list' to filter outgoing routes, but among options, 'disable-route-propagation' is a Cisco feature that prevents routes from being sent back to the same BGP AS.

Alternatively, 'allowas-in' would allow duplicates. The correct answer is to not allow routes from other sites to be sent to the CE; typically you use 'neighbor CE route-map' to filter. Option D is correct because 'neighbor x.x.x.x disable-connected-check' is unrelated.

Wait, checking options: A: allowas-in, B: as-override, C: soo, D: disable-connected-check. Actually, SoO (Site of Origin) is used to prevent loops in multi-homed BGP, but the question asks to prevent the CE from becoming a transit. With SoO, the PE marks routes with a SoO extended community, and the CE can be prevented from advertising routes back if it sees its own SoO.

But SoO is not the primary method; best practice is to set next-hop-self on the PE and not advertise other site routes. However, among given options, SoO is the correct one. Let's rethink: Option C (SoO) is used to prevent routing loops by adding a unique SoO value per site; when the CE receives a route with its own SoO, it drops it.

Thus it prevents a CE from learning routes from other sites. So Option C is correct. Explanation: SoO prevents the CE from accepting routes that originated from its own site, thus it cannot become a transit.

Practice this question →
49
Drag & Dropmedium

Drag and drop the steps to configure a GRE tunnel on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

GRE tunnel configuration involves creating the tunnel interface, setting source and destination, and assigning an IP address.

Practice this question →
50
MCQeasy

A service provider is configuring VRF-lite between two CE routers connected to the same PE. The CE routers are in different VRFs. Which command allows the PE router to forward traffic between the VRFs?

A.vrf forward RED
B.route-target export RED:100 import BLUE:100
C.ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.1 global
D.ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE
AnswerD

Correct. This command uses the 'vrf' keyword to route between VRFs.

Why this answer

Option D is correct because the command `ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE` creates a static inter-VRF route on the PE router, allowing traffic from VRF RED to be forwarded to VRF BLUE without requiring MPLS or BGP. This is the standard method for VRF-lite inter-VRF communication on the same PE, using a static route that points to the next-hop VRF instead of an IP address.

Exam trap

Cisco often tests the distinction between VRF-lite static inter-VRF routes and MPLS L3VPN route-target commands, trapping candidates who confuse the simple static route approach with the BGP-based route-target import/export mechanism.

How to eliminate wrong answers

Option A is wrong because `vrf forward RED` is not a valid Cisco IOS command; it does not exist and would not configure inter-VRF forwarding. Option B is wrong because `route-target export RED:100 import BLUE:100` is used in MPLS L3VPN environments to control route distribution between VRFs via MP-BGP, not for direct VRF-lite forwarding on a single PE. Option C is wrong because `ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.1 global` installs a default route in VRF RED pointing to a next-hop in the global routing table, which does not forward traffic into another VRF; it only sends traffic to the global table, not to VRF BLUE.

Practice this question →
51
MCQmedium

A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?

A.The next-hop must be reachable via the IGP with an MPLS label.
B.The next-hop must be a directly connected interface.
C.The PE must have a VPN label for the next-hop.
D.The IGP must be IS-IS, not OSPF.
AnswerA

MPLS LSP must exist to the next-hop for label imposition.

Why this answer

For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.

Exam trap

Cisco often tests the misconception that a directly connected next-hop or a VPN label for the next-hop is required, when in fact the critical condition is IGP reachability with an MPLS label for the BGP next-hop.

How to eliminate wrong answers

Option B is wrong because the next-hop does not need to be a directly connected interface; it only needs to be reachable via the IGP with an MPLS label, even if multiple hops away. Option C is wrong because the PE does not need a VPN label for the next-hop; the VPN label is assigned by the remote PE for the specific VPN prefix, not for the next-hop itself. Option D is wrong because the IGP can be either IS-IS or OSPF, as both can carry MPLS label information via extensions like MPLS-TE or LDP; there is no requirement for IS-IS specifically.

Practice this question →
52
MCQmedium

A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?

A.LDP
B.MPLS-TE (RSVP-TE)
C.SR-TE
D.BGP-LU
AnswerC

SR-TE policies enable traffic engineering with Segment Routing.

Why this answer

Option C is correct because Segment Routing offers traffic engineering capabilities via a centralized controller (e.g., PCE) or distributed policies using SR-TE policies, eliminating the need for RSVP-TE. Option A is wrong because LDP does not support traffic engineering. Option B is wrong because BGP-LU only provides LSP labels, not TE.

Option D is wrong because MPLS-TE is synonymous with RSVP-TE.

Practice this question →
53
MCQhard

Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?

A.Only routes matching 10.1.0.0/16 or more specific will have the community added; other routes remain unchanged.
B.Routes with a mask longer than /24 will be rejected by the prefix-list.
C.All routes from the customer will have their communities replaced with 65000:100.
D.Routes not matching the prefix-list will be denied and not installed.
AnswerA

The route-map permits matching routes with additive community, denies others without affecting acceptance.

Why this answer

The configuration uses a route-map applied to the neighbor with a match clause referencing a prefix-list that permits 10.1.0.0/16 le 32. This matches the exact prefix and any more specific prefix (up to /32). The set community 65000:100 action adds the community without using the additive keyword, but because the route-map does not contain a deny clause for non-matching routes, all routes are still accepted; only matching routes have the community added.

Thus, only routes matching 10.1.0.0/16 or more specific will have community 65000:100 added, and other routes remain unchanged.

Exam trap

Cisco often tests the misconception that a route-map with a match clause and no explicit deny will reject non-matching routes, when in fact unmatched routes are still permitted and unchanged unless a deny sequence is present.

How to eliminate wrong answers

Option B is wrong because the prefix-list permits 10.1.0.0/16 le 32, which allows masks longer than /24 (e.g., /25, /28) — there is no reject condition for masks longer than /24. Option C is wrong because the set community command does not include the additive keyword, so it replaces any existing communities on matching routes, but it does not affect non-matching routes at all; the route-map only applies the set action to matched prefixes, not to all routes. Option D is wrong because the route-map has no explicit deny statement; routes that do not match the prefix-list simply fall through without a set action and are still accepted and installed normally.

Practice this question →
54
MCQeasy

A network engineer is configuring QoS on a Cisco ASR 9000 router to support multiple traffic classes. The policy must ensure that real-time traffic (EF) is not starved by high-volume bulk data (AF11). Which queuing strategy should be applied to the EF class to provide low latency and strict priority?

A.Weighted Round Robin (WRR)
B.Class-Based Weighted Fair Queuing (CBWFQ)
C.Priority Queuing (LLQ)
D.First-In-First-Out (FIFO)
AnswerC

LLQ provides a strict priority queue for EF traffic.

Why this answer

Option B is correct because Priority queuing provides a strict priority queue that services the EF class before other queues, ensuring low latency. LLQ is the implementation of priority queuing with CBWFQ. Option A (CBWFQ) provides fair bandwidth allocation but no strict priority.

Option C (WRR) is byte-based and not strict. Option D (FIFO) does not differentiate.

Practice this question →
55
MCQhard

In EVPN multihoming with all-active mode, what is the purpose of the aliasing capability?

A.It permits the use of a single ESI label across all PEs in the ES.
B.It reduces the number of BGP updates by aggregating MAC routes.
C.It allows load balancing of traffic across all PEs.
D.It enables one PE to advertise MAC addresses for another PE in the same ES.
AnswerD

Correct. Aliasing allows a PE to advertise MACs for other PEs in the same ES, making all active paths known.

Why this answer

In EVPN all-active multihoming, the aliasing capability allows a PE that has learned a MAC address via local attachment to the Ethernet Segment (ES) to advertise that MAC address on behalf of other PEs in the same ES. This enables remote PEs to load-balance traffic destined to that MAC across all multihomed PEs, even if only one PE actually learned the MAC locally. Without aliasing, traffic would be forced to the specific PE that learned the MAC, defeating the purpose of all-active redundancy.

Exam trap

Cisco often tests the distinction between aliasing (advertising MACs for other PEs) and load balancing (the forwarding behavior that aliasing enables), causing candidates to mistakenly select 'load balancing' as the purpose of aliasing itself.

How to eliminate wrong answers

Option A is wrong because the aliasing capability does not involve a single ESI label; each PE in the ES advertises its own MPLS label (e.g., the ESI label or MAC/IP advertisement label), and the aliasing function is about MAC address advertisement, not label consolidation. Option B is wrong because aliasing does not reduce BGP updates or aggregate MAC routes; in fact, it may increase the number of MAC/IP advertisement routes as each PE advertises the same MAC addresses, and aggregation is not a feature of EVPN aliasing. Option C is wrong because aliasing itself does not perform load balancing; it enables load balancing by allowing remote PEs to see multiple next hops for the same MAC, but the actual load balancing is a forwarding decision made by the remote PE based on the received aliased routes.

Practice this question →
56
Multi-Selectmedium

Which two of the following are characteristics of MPLS Traffic Engineering that differentiate it from pure MPLS forwarding?

Select 2 answers
A.Requires LDP for LSP creation
B.Allows bandwidth reservation
C.Supports explicit path selection
D.Provides optimal load balancing based on topology
E.Uses RSVP for label distribution
AnswersB, C

Correct. MPLS TE can reserve bandwidth along a path to guarantee QoS.

Why this answer

MPLS Traffic Engineering (MPLS-TE) explicitly supports bandwidth reservation, which allows an operator to guarantee a certain amount of bandwidth for a traffic-engineered LSP. This is a key differentiator from pure MPLS forwarding, where LSPs are created without any bandwidth awareness and simply forward packets based on the label-swapping mechanism.

Exam trap

Cisco often tests the misconception that MPLS-TE requires LDP for LSP creation, but in reality, MPLS-TE uses RSVP-TE for signaling and does not depend on LDP for the TE LSPs themselves.

Practice this question →
57
MCQhard

A service provider is troubleshooting BGP route advertisement for a VPNv4 prefix. The PE router receives the prefix from the route reflector but does not install it in the VRF routing table. The BGP table shows the prefix as valid but not best. What is the most likely cause?

A.The VRF does not have the correct route-target import.
B.The next-hop is not reachable via the IGP with an MPLS label.
C.The BGP table is full and cannot accept more prefixes.
D.The MPLS label is missing in the BGP update.
AnswerB

Next-hop unreachability causes the route to be not best.

Why this answer

For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

Exam trap

Cisco often tests the distinction between a route being valid (accepted into BGP table) versus best (eligible for installation into the VRF), and the trap here is that candidates assume a valid route should automatically be installed, overlooking the next-hop reachability with label requirement for MPLS VPNs.

How to eliminate wrong answers

Option A is wrong because the VRF route-target import configuration determines whether the prefix is accepted into the VRF at all; if the import RT matches, the prefix enters the BGP table, but the issue here is that it is already in the BGP table as valid, so RT import is not the problem. Option C is wrong because a full BGP table would prevent new prefixes from being accepted, but the prefix is already present in the BGP table as valid, so table capacity is not the limiting factor. Option D is wrong because if the MPLS label were missing in the BGP update, the prefix would likely be marked as invalid or not installed at all, but the question states the prefix is valid, indicating the label is present in the update; the problem is that the next-hop itself is not reachable via the IGP with a label.

Practice this question →
58
MCQmedium

A customer is experiencing packet loss during congestion on a link. The service provider wants to implement a QoS policy that drops less important traffic before more important traffic. Which queuing mechanism is best suited?

A.Class-Based Weighted Fair Queuing (CBWFQ) with WRED
B.FIFO queuing
C.Low Latency Queuing (LLQ)
D.Traffic shaping
AnswerA

CBWFQ allocates bandwidth per class, WRED drops low priority before high priority.

Why this answer

CBWFQ with WRED is the best choice because CBWFQ provides per-class queuing with guaranteed bandwidth, while WRED proactively drops less important traffic (based on IP precedence or DSCP) before the queue becomes full, preventing tail drop and ensuring that higher-priority traffic is preserved during congestion. This combination allows the service provider to selectively discard lower-priority packets under congestion, meeting the requirement to drop less important traffic before more important traffic.

Exam trap

Cisco often tests the misconception that LLQ alone can prioritize traffic during congestion, but the trap here is that LLQ provides strict priority queuing without proactive dropping, so it does not selectively drop less important traffic; WRED is required for that function.

How to eliminate wrong answers

Option B (FIFO queuing) is wrong because it treats all traffic equally, dropping packets from the tail of the queue regardless of importance, which does not differentiate between traffic classes. Option C (LLQ) is wrong because it is designed to provide strict priority queuing for delay-sensitive traffic (e.g., voice), but it does not inherently drop less important traffic before more important traffic; it can starve other queues if not policed, and it lacks the proactive dropping mechanism of WRED. Option D (Traffic shaping) is wrong because it buffers excess traffic to smooth out bursts and does not drop packets; it delays them, which does not address the requirement to drop less important traffic during congestion.

Practice this question →
59
MCQmedium

During a multicast deployment, some receivers are not receiving the stream. The PIM neighbor table shows the upstream interface is correct. Which command would verify whether the multicast routing table has the correct outgoing interface list?

A.show ip igmp groups
B.show ip pim neighbor
C.show ip mroute
D.show ip route
AnswerC

Shows multicast routing table, including incoming and outgoing interfaces.

Why this answer

Option C is correct because show ip mroute displays the multicast routing table with OIL. Option A is wrong because show ip pim neighbor only shows neighbors. Option B is wrong because show ip igmp groups shows receiver groups.

Option D is wrong because show ip route is unicast.

Practice this question →
60
MCQhard

In a Segment Routing network with TI-LFA enabled, which mechanism prevents micro-loops during a link failure?

A.Constraint Shortest Path First computation
B.Explicit path with segment list and delay timer
C.Loop-Free Alternate precomputed backup paths
D.Prefix Independent Convergence with fast reroute
AnswerB

Correct. TI-LFA encodes a post-convergence path as an explicit segment list and introduces a delay to allow other routers to converge, preventing micro-loops.

Why this answer

In Segment Routing with TI-LFA, micro-loops are prevented by using an explicit path with a segment list and a delay timer. When a link fails, the protecting router installs a backup path with a segment list that steers traffic around the failure, and a delay timer ensures that the backup path is not activated until the network has converged, preventing transient loops.

Exam trap

Cisco often tests the distinction between TI-LFA and traditional LFA, where candidates mistakenly think LFA alone prevents micro-loops, but TI-LFA specifically adds segment lists and delay timers to address this issue.

How to eliminate wrong answers

Option A is wrong because Constraint Shortest Path First (CSPF) computation is used in MPLS-TE for path calculation under constraints, not for micro-loop prevention in TI-LFA. Option C is wrong because Loop-Free Alternate (LFA) precomputed backup paths provide fast reroute but do not inherently prevent micro-loops during convergence; TI-LFA extends LFA with segment lists and delay timers to address this. Option D is wrong because Prefix Independent Convergence (PIC) with fast reroute is a mechanism for fast convergence in MPLS networks, but it does not specifically prevent micro-loops; TI-LFA uses explicit segment lists and timers for that purpose.

Practice this question →
61
MCQeasy

Which multicast RP model is recommended for large-scale networks to provide redundancy and load sharing?

A.Auto-RP
B.BSR
C.Anycast-RP
D.Static RP
AnswerC

Correct. Anycast-RP uses the same IP address for multiple RPs, enabling load sharing and redundancy.

Why this answer

Anycast-RP is recommended for large-scale networks because it allows multiple RPs to share the same IP address, providing redundancy and load sharing without requiring dynamic RP discovery protocols. This model uses MSDP (Multicast Source Discovery Protocol) or PIM (Protocol Independent Multicast) to synchronize multicast state between RPs, ensuring that sources and receivers can register with the nearest RP for optimal path selection.

Exam trap

Cisco often tests the misconception that BSR or Auto-RP provide load sharing, but the trap here is that only Anycast-RP explicitly supports both redundancy and load sharing by allowing multiple RPs to actively serve different groups or sources simultaneously.

How to eliminate wrong answers

Option A is wrong because Auto-RP uses a flood-and-prune mechanism with a designated RP announcement group (224.0.1.39/40), which can cause scalability issues and lacks built-in load sharing across multiple RPs. Option B is wrong because BSR (Bootstrap Router) uses a single elected BSR to distribute RP information, creating a single point of failure and not inherently supporting load sharing across multiple RPs. Option D is wrong because Static RP requires manual configuration on every router, offers no redundancy if the single RP fails, and cannot provide load sharing without additional complex configurations like Anycast-RP.

Practice this question →
62
Multi-Selectmedium

Which TWO statements about QoS policy propagation via BGP (QPPB) are correct?

Select 2 answers
A.QPPB can be applied on inbound direction only.
B.QPPB is an IETF standard.
C.It uses BGP communities to mark QoS on traffic received from customer.
D.It uses MPLS EXP bits to propagate QoS.
E.It dynamically adjusts BGP attributes based on QoS policy.
AnswersA, C

It applies to traffic coming from customers.

Why this answer

Option A is correct because QPPB can be applied on inbound direction only. QPPB uses BGP policy to classify traffic based on IP precedence or QoS group, and the classification is performed on incoming traffic before any routing decision. The outbound direction is not supported for QPPB classification.

Exam trap

Cisco often tests the misconception that QPPB is an IETF standard or that it can be applied bidirectionally, when in fact it is a Cisco proprietary feature limited to inbound direction only.

Practice this question →
63
MCQmedium

A service provider is migrating from LDP to Segment Routing. What is the correct order of operations to ensure uninterrupted MPLS forwarding?

A.Enable SR on each router one by one while LDP remains active, then remove LDP after SR is stable.
B.Enable SR on all routers simultaneously.
C.Configure IS-IS SR extensions on all routers, then disable LDP.
D.Disable LDP first to free labels, then enable SR.
AnswerA

Correct. This gradual migration ensures continuous forwarding via LDP while SR is established.

Why this answer

Option A is correct because it follows the recommended migration strategy of running LDP and Segment Routing (SR) in parallel. By enabling SR on each router one by one while LDP remains active, MPLS forwarding continues uninterrupted via LDP until SR is fully deployed and stable. Once SR is verified on all routers, LDP can be safely removed without causing any forwarding black holes.

Exam trap

Cisco often tests the misconception that you must disable the old protocol before enabling the new one, but the correct approach is to run both protocols in parallel to maintain forwarding continuity during migration.

How to eliminate wrong answers

Option B is wrong because enabling SR on all routers simultaneously is operationally risky; any misconfiguration or instability in SR could cause widespread forwarding disruption without a fallback. Option C is wrong because configuring IS-IS SR extensions alone does not automatically enable SR MPLS forwarding; you must also enable SR globally and on interfaces, and disabling LDP before SR is stable would break MPLS forwarding. Option D is wrong because disabling LDP first removes the existing label bindings, causing immediate MPLS forwarding failures before SR can provide replacement labels.

Practice this question →
64
Multi-Selecthard

Which three of the following are valid methods for protecting a pseudowire in an MPLS network?

Select 3 answers
A.Multi-segment PW with backup
B.Ethernet OAM CFM
C.RSVP FRR for link protection
D.PW redundancy with active/standby
E.LSP ping for fault detection
AnswersA, C, D

Correct. Multi-segment pseudowires can be configured with a backup path for redundancy.

Why this answer

Multi-segment PW (MS-PW) with backup is a valid protection method because it allows a pseudowire to be established across multiple MPLS segments, with a backup PW path that can take over if the primary MS-PW fails. This provides end-to-end pseudowire redundancy by using a secondary switched path, ensuring service continuity in multi-domain or multi-area MPLS networks.

Exam trap

Cisco often tests the distinction between fault detection tools (like LSP ping or Ethernet OAM) and actual protection mechanisms (like FRR or PW redundancy), leading candidates to mistakenly select detection methods as valid protection answers.

Practice this question →
65
MCQhard

An SP is troubleshooting an MPLS L2VPN VPLS network where MAC flapping is occurring between two PEs. Which mechanism in VPLS prevents loops and ensures that a broadcast frame from one PE is not reflected back to the originating PE?

A.Split horizon
B.Spanning Tree Protocol (STP)
C.Rapid Spanning Tree Protocol (RSTP)
D.MAC address aging
AnswerA

Split horizon prevents forwarding out of incoming pseudowire.

Why this answer

Option D is correct. Split horizon in VPLS means a PE will not forward a frame received from one pseudowire out another pseudowire within the same VFI, preventing loops. Option A (STP) is used at the CE side but not inside the VPLS core.

Option B (RSTP) same. Option C (MAC aging) is for learning, not loop prevention.

Practice this question →
66
Multi-Selecthard

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Select 3 answers
A.VPLS
B.6VPE
C.MPLS L3VPN
D.Carrier Supporting Carrier (CSC) VPN
E.MDT VPN
AnswersB, C, D

Why this answer

6VPE (IPv6 VPN Provider Edge) requires a dedicated control plane per VPN instance because it uses separate per-VPN routing tables and a distinct BGP session (typically MP-BGP with the IPv6 address family) to exchange IPv6 VPN routes. This ensures that each customer's IPv6 routing information is isolated and processed independently, which is a core requirement for L3VPN services that maintain per-VPN forwarding and control plane separation.

Exam trap

Cisco often tests the misconception that all MPLS-based VPN services (including VPLS and MDT VPN) require per-VPN control planes, but only L3VPN services that maintain per-VPN routing tables and separate routing protocol instances (like MPLS L3VPN, 6VPE, and CSC VPN) actually need dedicated control planes per VPN instance.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Services questions.

Start 20-question session