Knowledge + Practice

CCNA Architecture Questions

75 of 232 questions · Page 2/4 · Architecture · Answers revealed

Practice these questions Domain overview All questions

76

MCQmedium

In a carrier network using VRF-lite for customer isolation, which issue arises if route-target values are not correctly configured?

A.Customer routes are not installed in the global table.

B.BGP sessions between PEs flap.

C.The PE-CE routing protocol fails.

D.Customer routes leak into other VRFs.

AnswerD

Mismatched route-targets can cause unintended import/export, leading to route leakage between VRFs.

Why this answer

In VRF-lite, route-target (RT) values control the import and export of routes between VRFs. If RTs are misconfigured, a VRF may import routes intended for another VRF, causing customer routes to leak across VRFs. This violates isolation because the VRF table incorrectly accepts routes based on mismatched RT import statements.

Exam trap

Cisco often tests the misconception that route-target misconfiguration causes BGP session failures or routing protocol issues, when in fact it only affects route import/export logic, leading to route leakage.

How to eliminate wrong answers

Option A is wrong because VRF-lite does not use the global routing table for customer routes; routes are installed in the per-VRF table, and incorrect RTs do not affect the global table. Option B is wrong because BGP sessions between PEs are established independently of RT configuration; RTs only affect route processing within BGP, not session state. Option C is wrong because the PE-CE routing protocol (e.g., OSPF, EIGRP, static) operates on the VRF interface and is unaffected by RT misconfiguration; RTs only influence route redistribution between VRFs or between VRF and BGP.

Practice this question →

77

MCQeasy

Which MPLS label is used to identify the egress PE in a Layer 3 MPLS VPN?

A.Transport label

B.VPN label

C.LDP label

D.IGP label

AnswerB

The VPN label is used by the egress PE to identify the correct VRF.

Why this answer

In a Layer 3 MPLS VPN, the VPN label (also known as the service label) is assigned by the egress PE router and advertised via MP-BGP (RFC 4364). It uniquely identifies the VPN forwarding instance (VRF) on the egress PE, allowing the correct per-VPN forwarding decision to be made after the transport label has been removed. Without the VPN label, the egress PE would not know which VRF or customer-facing interface should receive the packet.

Exam trap

Cisco often tests the distinction between the transport label (used for core forwarding) and the VPN label (used for service identification), and candidates mistakenly think the LDP label or IGP label serves the egress PE identification role because they associate label distribution with routing protocols.

How to eliminate wrong answers

Option A is wrong because the transport label (typically an LDP or IGP-based label) is used for hop-by-hop forwarding across the MPLS core, not for identifying the egress PE's VPN context. Option C is wrong because LDP labels are used to build transport LSPs for label-switched paths, not to carry VPN-specific forwarding information. Option D is wrong because IGP labels do not exist as a distinct label type; IGPs (OSPF, IS-IS) may be used to distribute the underlying routing information but do not assign labels for VPN identification.

Practice this question →

78

MCQmedium

In a multicast environment, a PE router is not receiving multicast traffic from a source behind a CE. The PIM neighbors are established. The RP is reachable. What is the most likely issue?

A.The CE is not sending IGMP joins

B.The source address is not in the VRF

C.The PE does not have the multicast VRF enabled

D.The RP is not configured in the VRF

AnswerC

Without multicast VRF, the PE cannot forward multicast traffic in the VRF.

Why this answer

The most likely issue is that the PE router does not have the multicast VRF enabled. In a multicast VPN (MVPN) environment, even if PIM neighbors are established and the RP is reachable, the PE must have multicast routing explicitly enabled within the VRF using the 'ip multicast-routing vrf <name>' command. Without this, the PE will not process multicast traffic for that VRF, causing it to drop or ignore multicast packets from the source behind the CE.

Exam trap

Cisco often tests the subtle distinction between having PIM neighbors established (which only requires PIM configuration on the interface) versus having multicast routing enabled globally for the VRF, leading candidates to overlook the mandatory 'ip multicast-routing vrf' command.

How to eliminate wrong answers

Option A is wrong because IGMP joins are used by hosts to signal interest in a multicast group, but the CE is a router forwarding traffic, not a host; the issue is on the PE side, not the CE sending joins. Option B is wrong because the source address being in the VRF is a routing requirement, but the problem is about multicast forwarding, not unicast reachability; the source address is already behind the CE and thus in the VRF by default. Option D is wrong because the RP is reachable, and while the RP must be configured in the VRF for proper operation, the question states the RP is reachable, implying it is configured; the core issue is the missing multicast routing enablement on the PE.

Practice this question →

79

MCQeasy

A service provider wants to provide Layer 3 VPN services to customers using MPLS. Which technology is used to distribute VPNv4 routes between PE routers?

A.MP-BGP

B.IS-IS

C.OSPF

D.EIGRP

AnswerA

MP-BGP is the correct protocol for distributing VPNv4 routes.

Why this answer

MP-BGP is used to carry VPNv4 routes between PE routers. OSPF, EIGRP, and IS-IS are IGPs and do not carry VPNv4 routes.

Practice this question →

80

Multi-Selecthard

Which three are benefits of using MPLS Layer 3 VPNs over traditional VPNs? (Choose three.)

Select 3 answers

A.Scalability

B.Support for multiple services

C.Lower cost

D.Reduced security

E.Simplified routing

AnswersA, B, E

MPLS L3VPNs can scale to thousands of VPNs.

Why this answer

MPLS Layer 3 VPNs use a full-mesh of MP-BGP sessions between Provider Edge (PE) routers to exchange VPNv4 routes, which allows the network to scale to thousands of VPNs and customers without requiring a full mesh of tunnels. This is far more scalable than traditional VPNs that rely on point-to-point tunnels (e.g., IPsec or GRE) which create an O(n²) problem for connectivity.

Exam trap

Cisco often tests the misconception that MPLS VPNs are cheaper than traditional VPNs, but the trap here is that while MPLS reduces operational overhead for the provider, the hardware and licensing costs are typically higher, so 'lower cost' is not a guaranteed benefit.

Practice this question →

81

MCQeasy

Based on the exhibit, which label operation will occur when a packet destined to 10.2.2.1 enters PE1 with label 17?

A.Forward with no label (Untagged)

B.Pop the label and forward as IP

C.Push label 17 onto the packet

D.Swap label 17 to label 18

AnswerD

The forwarding table shows outgoing label 18 for this prefix.

Why this answer

The exhibit shows an MPLS VPN scenario where PE1 receives a labeled packet destined for 10.2.2.1. The incoming label 17 corresponds to the VPNv4 route for 10.2.2.1/32, and the LFIB on PE1 indicates a swap operation to label 18, which is the transport label used to forward the packet across the MPLS core toward the next-hop PE.

Exam trap

Cisco often tests the distinction between label operations (push, swap, pop) in MPLS VPN scenarios, and the trap here is that candidates mistakenly think the incoming label is a VPN label that must be popped or pushed, rather than recognizing that the LFIB dictates a swap when the packet is transiting the MPLS core.

How to eliminate wrong answers

Option A is wrong because the packet arrives with an MPLS label (17), and in an MPLS VPN, the ingress PE must forward the packet with a label stack, not as an untagged packet. Option B is wrong because popping the label and forwarding as IP would only occur at the penultimate hop (PHP) or if the packet were destined to the PE itself, but here the destination is a remote VPN prefix. Option C is wrong because pushing label 17 would imply the packet arrived unlabeled, but the question states the packet enters with label 17 already present; pushing a new label 17 would be incorrect as the operation is a swap, not a push.

Practice this question →

82

MCQeasy

Which Cisco router platform is designed for the aggregation layer and supports both mobile backhaul and business services with high density 10GE/100GE interfaces?

A.Cisco NCS

B.Cisco ASR 9000

C.Cisco CRS

D.Cisco ISR 4000

AnswerA

Correct. NCS is optimized for aggregation with high-density 10GE/100GE.

Why this answer

Cisco NCS (Network Convergence System) routers are designed for the aggregation layer, offering high port density and support for various services including mobile backhaul and business connectivity.

Practice this question →

83

MCQeasy

A service provider is deploying Segment Routing in the MPLS core using IS-IS. Which extension is required in IS-IS to advertise the prefix-SID?

A.TLV 22 (Extended IS Reachability)

B.TLV 242 (Router Capability)

C.Sub-TLV 3 (Prefix-SID)

D.TLV 135 (Extended IP Reachability)

AnswerC

Sub-TLV 3 is used within TLV 135 or 242 to carry prefix-SID.

Why this answer

In IS-IS, the Prefix-SID is advertised using Sub-TLV 3, which is carried within TLV 135 (Extended IP Reachability). This sub-TLV contains the SID value and flags, enabling Segment Routing in the MPLS core. Without Sub-TLV 3, the prefix-SID cannot be signaled, making it the required extension.

Exam trap

Cisco often tests the distinction between the TLV that carries the prefix (TLV 135) and the sub-TLV that carries the SID (Sub-TLV 3), leading candidates to incorrectly select TLV 135 as the answer.

How to eliminate wrong answers

Option A is wrong because TLV 22 (Extended IS Reachability) is used to advertise IS-IS neighbor information and link attributes, not prefix-SIDs. Option B is wrong because TLV 242 (Router Capability) is used to advertise router capabilities such as SRGB or node-SID, but it does not carry prefix-SIDs. Option D is wrong because TLV 135 (Extended IP Reachability) carries the prefix itself, but the prefix-SID is advertised via Sub-TLV 3 within TLV 135, not by TLV 135 alone.

Practice this question →

84

MCQhard

A large service provider operates a national MPLS backbone with over 200 P routers and 500 PE routers. They use IS-IS as the IGP with segment routing and have deployed TI-LFA for link and node protection. Recently, a core router (P1) suffered a complete failure, and during the failure, traffic for some prefixes was dropped for over 200ms. After the failure, the network recovered within seconds. The engineer suspects that TI-LFA did not provide the expected sub-50ms protection for some destinations. Further analysis reveals that the affected prefixes have their BGP next-hop on a router that is multiple hops away, and the P1 failure impacted both the primary path and the backup path computed by TI-LFA. The engineer reviews the TI-LFA configuration and finds that 'fast-reroute per-prefix ti-lfa' is enabled under router isis. The engineer also notes that P1 was not a protecting node for those prefixes. Which action should the engineer take to improve convergence time for these prefixes?

A.Configure TI-LFA on all interfaces using 'fast-reroute per-prefix ti-lfa interface'

B.Add the 'sr-protect' option under the fast-reroute configuration to enable node protection

C.Reduce the IGP timers and enable incremental SPF to accelerate convergence

D.Deploy LDP as a fallback label distribution protocol to provide additional backup paths

AnswerB

The 'sr-protect' option ensures that the node acts as a protecting node for transit traffic, providing node protection even if the node itself is the failure point.

Why this answer

For TI-LFA to provide node protection, the 'sr-protect' option should be configured, which forces the node to attempt to provide protection even for traffic that transits through the node. Option A is wrong because interface-level TI-LFA would not help; the issue is node-level. Option C is wrong because increasing IGP timers may cause slower convergence.

Option D is wrong because there is no need for an additional LDP backup.

Practice this question →

85

MCQeasy

In a service provider network, the access layer connects end customers. Which technology is commonly used for fibre-based access in GPON deployments?

A.DSL

B.MPLS

C.Metro Ethernet

D.GPON

AnswerD

GPON is the correct fibre access technology.

Why this answer

GPON (Gigabit Passive Optical Network) is a fibre-based access technology standardized by ITU-T.

Practice this question →

86

MCQmedium

A service provider is implementing MPLS TE to optimize bandwidth utilization. The engineer notices that tunnels are not using the explicitly configured path. What is the most likely reason?

A.The explicit path contains a link that is down

B.RSVP is not enabled on the headend

C.The tunnel destination is not reachable via IGP

D.The tunnel is configured with 'autoroute announce'

AnswerA

Causes path to be invalid, tunnel may use dynamic or stay down.

Why this answer

When an MPLS TE tunnel is configured with an explicit path, the headend router uses RSVP to signal the path and verify that all links in the path are operational. If any link in the explicit path is down, RSVP signaling fails for that path, and the tunnel may fall back to dynamic path computation or remain down, rather than using the explicitly configured path. This is the most common reason for a tunnel not using its explicit path.

Exam trap

Cisco often tests the misconception that 'autoroute announce' or IGP reachability issues cause path selection problems, when in fact the explicit path failure is due to a down link in the path itself, which is a fundamental RSVP signaling constraint.

How to eliminate wrong answers

Option B is wrong because if RSVP were not enabled on the headend, MPLS TE tunnels would not be able to signal at all, and the tunnel would not come up, not just fail to use an explicit path. Option C is wrong because the tunnel destination being unreachable via IGP would prevent the tunnel from establishing at all, but the question states tunnels are not using the explicit path, implying they may be using a dynamic path instead. Option D is wrong because 'autoroute announce' causes the headend to install the tunnel as a next-hop for IGP destinations, but it does not affect which path the tunnel itself uses; the tunnel path is determined by the explicit or dynamic path configuration.

Practice this question →

87

Multi-Selecteasy

Which TWO are characteristics of the access layer in a service provider network? (Choose two.)

Select 2 answers

A.Provides connectivity to end customers

B.Implements inter-AS MPLS

C.Uses MPLS label switching for core traffic

D.Performs BGP route reflection

E.Supports technologies like DSL, cable, and GPON

AnswersA, E

Access layer interfaces with customers.

Why this answer

Access layer provides connectivity to end users and aggregates traffic from various technologies.

Practice this question →

88

MCQeasy

A service provider is deploying MPLS in its core network. The core routers are all configured with LDP. Which label operation does an ingress PE perform on the first packet of a new flow?

A.Push a new label onto the packet

B.Remove the label stack entirely

C.Pop the label (PHP)

D.Swap the incoming label for an outgoing label

AnswerA

The ingress PE pushes the label corresponding to the FEC for the destination.

Why this answer

The ingress PE (Provider Edge) router is the first router in the MPLS domain to receive an unlabeled IP packet. For the first packet of a new flow, the ingress PE must perform a label push operation, which adds an MPLS label (or a stack of labels) to the packet. This label is used by subsequent LSRs to forward the packet based on the label rather than the IP header, enabling MPLS forwarding.

Exam trap

Cisco often tests the distinction between label operations at different MPLS roles (ingress, transit, egress), and the trap here is that candidates confuse the ingress push with the transit swap or egress pop operations.

How to eliminate wrong answers

Option B is wrong because removing the label stack entirely is the function of the egress PE (or the penultimate hop in PHP), not the ingress PE. Option C is wrong because pop (PHP) is performed by the penultimate hop router to remove the label before sending the packet to the egress PE, not by the ingress PE. Option D is wrong because swap is an operation performed by intermediate LSRs (transit routers) to replace the incoming label with an outgoing label; the ingress PE does not have an incoming label to swap.

Practice this question →

89

Multi-Selecteasy

In IS-IS, which TWO are types of Link State PDUs (LSPs)?

Select 2 answers

A.Partial Sequence Numbers PDU (PSNP)

B.Level 2 LSP

C.Hello LSP

D.Complete Sequence Numbers PDU (CSNP)

E.Level 1 LSP

AnswersB, E

Originated by Level 2 routers for inter-area reachability.

Why this answer

In IS-IS, Link State PDUs (LSPs) are the fundamental building blocks of the link-state database. They carry topology and prefix information and are generated by each router. There are two distinct types: Level 1 LSPs, which advertise information within the same area, and Level 2 LSPs, which advertise information between areas.

Options B and E correctly identify these two types.

Exam trap

Cisco often tests the distinction between PDU types (LSPs, CSNPs, PSNPs, and IIHs) and candidates mistakenly classify all IS-IS PDUs as LSPs, especially confusing CSNPs and PSNPs with actual Link State PDUs.

Practice this question →

90

MCQhard

In a carrier-supporting carrier (CSC) architecture, the customer carrier runs MPLS in its network. Which technology is used to exchange VPN routes between the provider carrier and the customer carrier?

A.OSPF

B.MP-BGP with VPNv4 address family

C.EIGRP

D.IPv4 BGP

AnswerB

MP-BGP carries VPNv4 routes with labels.

Why this answer

In a carrier-supporting-carrier (CSC) architecture, the customer carrier runs MPLS in its network and needs to exchange VPN routes (e.g., customer VPN prefixes) with the provider carrier. MP-BGP with the VPNv4 address family is the correct technology because it carries both the IPv4 prefix and the Route Distinguisher (RD), enabling the provider carrier to distinguish overlapping VPN routes from different customer VPNs. This is defined in RFC 4364 and is the standard inter-AS VPN option for CSC scenarios.

Exam trap

Cisco often tests the misconception that any IGP (like OSPF or EIGRP) or standard IPv4 BGP can exchange VPN routes between carriers, but only MP-BGP with the VPNv4 address family carries the necessary RD and RT attributes to support multi-tenant VPN separation in a CSC architecture.

How to eliminate wrong answers

Option A is wrong because OSPF is an IGP that can only carry IPv4 or IPv6 unicast routes, not VPNv4 routes with RDs and route targets; it lacks the multi-protocol extensions needed for VPN route exchange between carriers. Option C is wrong because EIGRP is a Cisco-proprietary IGP that does not support VPNv4 address families or the BGP-based VPN route distribution required in CSC architectures. Option D is wrong because IPv4 BGP (standard BGP with the IPv4 unicast address family) cannot carry the VPNv4 NLRI that includes the RD, which is essential for separating overlapping customer VPN routes in a multi-tenant carrier environment.

Practice this question →

91

MCQeasy

A service provider is designing its core network to carry both IPv4 and IPv6 traffic. Which BGP approach best minimizes routing table size on core routers while maintaining full reachability?

A.Use iBGP with route reflectors

B.Use eBGP between all core routers

C.Use static routing for all prefixes

D.Rely on OSPF for external routes

AnswerA

Reduces BGP sessions and maintains full reachability efficiently.

Why this answer

iBGP with route reflectors minimizes the number of BGP sessions required in the core network, reducing routing table size and control-plane overhead while still maintaining full IPv4 and IPv6 reachability. Route reflectors allow iBGP speakers to advertise routes learned from other iBGP peers without requiring a full mesh, which is essential for scalability in large service provider cores.

Exam trap

Cisco often tests the misconception that eBGP reduces routing table size compared to iBGP, but the trap here is that eBGP does not inherently reduce prefix count; it only changes the administrative distance and path selection behavior, while iBGP with route reflectors directly reduces the number of sessions and control-plane load.

How to eliminate wrong answers

Option B is wrong because using eBGP between all core routers would require a full mesh of eBGP sessions, increasing routing table size and administrative complexity, and it does not inherently reduce the number of prefixes. Option C is wrong because static routing is not scalable for a service provider core carrying both IPv4 and IPv6 traffic; it cannot dynamically adapt to topology changes and would require manual configuration for thousands of prefixes. Option D is wrong because OSPF is an IGP designed for internal routing within an AS and cannot carry external BGP routes; relying on OSPF for external routes would break reachability to prefixes learned via BGP from other autonomous systems.

Practice this question →

92

Multi-Selectmedium

Which THREE of the following are key components of an MPLS L3VPN architecture? (Choose three.)

Select 3 answers

A.RSVP-TE for traffic engineering

B.VRF on PE routers

C.LDP for label distribution in the core

D.P routers with full VPN routing tables

E.MP-BGP for VPNv4 route exchange

AnswersB, C, E

VRF provides per-VPN routing.

Why this answer

VRF (Virtual Routing and Forwarding) on PE routers is a key component because it isolates customer routing tables and forwarding planes within the provider edge, allowing multiple customers to share the same physical infrastructure while maintaining separate routing domains. Each VRF maintains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, which is fundamental to L3VPN separation.

Exam trap

Cisco often tests the misconception that P routers must hold VPN routing information, but in reality P routers only perform label switching and have no awareness of customer VPN prefixes.

Practice this question →

93

MCQmedium

In an MPLS core, which forwarding mechanism do P routers use to forward packets for L3VPN?

A.MPLS label imposition

B.MPLS label disposition

C.IP routing based on destination IP

D.MPLS label switching

AnswerD

Correct. P routers swap labels based on the LFIB.

Why this answer

P routers (core routers) perform label switching based on the MPLS label stack. They do not need to examine the IP header; they swap labels and forward accordingly.

Practice this question →

94

MCQmedium

Refer to the exhibit. A network engineer configures a BGP route-map to set communities on routes advertised to a neighbor. After applying the configuration, the engineer checks the BGP table on the neighbor router and does not see the communities. What is the most likely reason?

A.The prefix-list does not match the exact prefix

B.The community values are not in the format 'AA:NN'

C.The neighbor is missing the 'send-community' command

D.The route-map needs to be applied inbound

AnswerC

Without 'send-community', communities are not advertised.

Why this answer

C is correct because BGP communities are not sent to a neighbor by default. Even if a route-map sets the community values correctly, the neighbor will not receive them unless the 'send-community' command is configured under the neighbor statement. This command enables the advertisement of the community attribute in BGP updates.

Exam trap

Cisco often tests the fact that BGP attributes like communities are not sent by default, and candidates mistakenly focus on route-map logic or prefix matching rather than the explicit neighbor command required to propagate the attribute.

How to eliminate wrong answers

Option A is wrong because the prefix-list is used to match routes for the route-map; if it does not match the exact prefix, the route-map would not apply, but the question states the route-map is configured and the engineer checks the BGP table on the neighbor—the issue is that communities are missing, not that the route is missing. Option B is wrong because while 'AA:NN' is the standard format for BGP communities, the route-map would still set the community value; if the format were incorrect, the router would typically reject the configuration or produce an error, not silently omit the community. Option D is wrong because the route-map is applied to outbound updates to set communities on routes advertised to the neighbor; applying it inbound would affect routes received from the neighbor, not the communities being sent.

Practice this question →

95

MCQmedium

A service provider offers L3VPN services to multiple enterprise customers. One customer reports that they cannot reach some remote sites intermittently. The network uses MPLS L3VPN with MP-BGP for VPN route exchange. The PE routers are configured with route-target import and export. The customer's CE router is dual-homed to two different PEs in the same point of presence. The engineer checks the BGP table on both PEs and sees the customer routes with the correct route-target. However, pings from the CE to a remote site fail about 50% of the time, and the flapping pattern suggests load balancing issues. The engineer discovers that the remote site's network prefix is being advertised from both PEs with the same route-target but with different next-hops. The CE has equal-cost paths via both PEs. What is the most likely cause of the intermittent connectivity?

A.The route-target import on the remote PE is missing the customer's route-target.

B.The CE is performing per-packet load balancing across the two PEs, causing asymmetric routing.

C.The BGP timers are misconfigured, causing the session to flap.

D.The MTU on the CE-PE links is mismatched.

AnswerB

Per-packet load balancing can lead to packets being sent to different PEs, potentially exiting via different remote PEs and causing return packets to arrive out of order or be dropped due to stateful inspection.

Why this answer

When a CE router receives two equal-cost paths from two PEs, it may perform per-packet load balancing. This can lead to asymmetric routing where packets from the same flow take different paths, causing out-of-order delivery and connectivity failures about 50% of the time, especially if stateful devices are in the path or if the transport layer is sensitive to ordering. Option A is incorrect because the route-target import on the remote PE is properly configured (as the routes are seen with correct route-target).

Option C is incorrect because BGP timer misconfiguration would cause session flapping and complete loss, not a 50% intermittent failure. Option D is incorrect because MTU mismatch would cause consistent packet drops, not intermittent failures.

Practice this question →

96

Multi-Selecthard

An SP is migrating its core network to Segment Routing (SR-MPLS). The network uses IS-IS as the IGP with SR extensions. Which three statements about SR-MPLS architecture are correct?

Select 3 answers

A.The OSPF protocol cannot be used for SR-MPLS because it does not support SR extensions.

B.Adjacency SIDs are local to a router and indicate a specific link.

C.A prefix SID is a global label that identifies a specific prefix in the network.

D.The SRGB must be identical across all routers in the domain to ensure global uniqueness.

E.Segment IDs (SIDs) are allocated from the SRGB (Segment Routing Global Block) and advertised via IS-IS.

AnswersB, C, E

Correct. Adjacency SIDs are locally significant and represent a specific interface or link.

Why this answer

An Adjacency SID is a local label assigned to a specific IS-IS adjacency, representing a particular link between two routers. It is locally significant and used to steer traffic over that specific next-hop, not globally unique.

Exam trap

Cisco often tests the misconception that the SRGB must be identical across all routers, when in reality only the mapping from prefix SID to label must be consistent, and the SRGB can vary as long as the label space is properly coordinated.

Practice this question →

97

MCQhard

A network operator is deploying segment routing in an MPLS network. They want to use a centralized controller to compute paths based on traffic demand and network constraints. Which architecture is being used?

A.LDP-based MPLS

B.Segment Routing Traffic Engineering (SR-TE)

C.Segment Routing Path Computation Element (SR-PCE)

D.Segment Routing Best Effort (SR-BE)

AnswerC

SR-PCE is a centralized controller for path computation.

Why this answer

The scenario describes a centralized controller computing paths based on traffic demand and network constraints, which is the definition of a Path Computation Element (PCE) architecture. In Segment Routing, the SR-PCE (Segment Routing Path Computation Element) is the centralized controller that calculates optimal paths using traffic engineering constraints and then communicates the path information (via PCEP) to the headend router. This is distinct from distributed control plane approaches like LDP or SR-BE, and from SR-TE which is the overall traffic engineering mechanism but not the specific centralized controller architecture.

Exam trap

Cisco often tests the distinction between the overall traffic engineering mechanism (SR-TE) and the specific centralized controller architecture (SR-PCE), leading candidates to pick SR-TE when the question explicitly mentions a 'centralized controller' for path computation.

How to eliminate wrong answers

Option A is wrong because LDP-based MPLS is a distributed label distribution protocol that does not use a centralized controller for path computation; it relies on IGP shortest-path routing. Option B is wrong because Segment Routing Traffic Engineering (SR-TE) is the overall framework for steering traffic over explicit paths, but it does not inherently require a centralized controller; paths can be configured manually or via a PCE. Option D is wrong because Segment Routing Best Effort (SR-BE) uses IGP-computed shortest paths without any centralized controller or traffic engineering constraints.

Practice this question →

98

MCQmedium

In Inter-AS MPLS Option B, which routers exchange labeled VPNv4 prefixes directly?

A.ASBR routers

B.PE routers

C.P routers

D.CE routers

E.Route reflectors

AnswerA

ASBRs exchange labeled VPNv4 prefixes via MP-eBGP in Option B.

Why this answer

In Inter-AS MPLS Option B, ASBR routers (Autonomous System Boundary Routers) exchange labeled VPNv4 prefixes directly across the AS boundary. This is achieved by having each ASBR perform two label operations: it pops the outer transport label from the VPNv4 prefix received from its own AS, then swaps the inner VPN label and forwards the labeled VPNv4 prefix to the neighboring ASBR in the adjacent AS. This direct exchange eliminates the need for end-to-end LSPs or MP-eBGP sessions between PE routers across different ASes.

Exam trap

Cisco often tests the misconception that PE routers directly exchange VPNv4 prefixes in Option B, but the correct answer is ASBR routers because the inter-AS VPNv4 exchange happens at the ASBR level using MP-eBGP, not between PEs.

How to eliminate wrong answers

Option B (PE routers) is wrong because PE routers in different ASes do not establish MP-eBGP sessions directly in Option B; the exchange occurs at the ASBR level, not between PEs. Option C (P routers) is wrong because P routers are core routers that only perform label switching based on the transport label and have no VPNv4 awareness or BGP sessions for VPNv4 prefixes. Option D (CE routers) is wrong because CE routers are customer edge devices that exchange standard IPv4 routes with PE routers and have no involvement in MPLS VPN label exchange.

Option E (Route reflectors) is wrong because route reflectors are used within an AS to scale iBGP sessions and do not participate in inter-AS VPNv4 prefix exchange; the direct exchange is between ASBRs across AS boundaries.

Practice this question →

99

MCQeasy

When deploying IS-IS in a large service provider core, what is the recommended network type on Ethernet interfaces to improve scalability?

A.loopback

B.point-to-point

C.point-to-multipoint

D.non-broadcast

E.broadcast

AnswerB

Point-to-point avoids DIS election and simplifies flooding, enhancing scalability.

Why this answer

In a large service provider core, configuring IS-IS interfaces as point-to-point (network type point-to-point) improves scalability by eliminating the need for Designated Router (DIS) election and the associated pseudonode LSPs. This reduces the number of LSPs in the link-state database, lowers CPU and memory overhead, and speeds up convergence, which is critical in dense core networks.

Exam trap

Cisco often tests the misconception that broadcast is the only valid network type for Ethernet interfaces in IS-IS, but the trap is that point-to-point is the recommended type for scalability because it eliminates DIS overhead, even though the physical medium is Ethernet.

How to eliminate wrong answers

Option A is wrong because loopback is not a network type for IS-IS; it is a logical interface type used for router IDs or management, not for adjacency formation. Option C is wrong because point-to-multipoint is not a valid IS-IS network type; IS-IS supports only broadcast and point-to-point network types on Ethernet interfaces. Option D is wrong because non-broadcast is a network type used in OSPF (e.g., NBMA), not in IS-IS; IS-IS does not have a non-broadcast network type.

Option E is wrong because broadcast is the default network type on Ethernet, but it requires DIS election and pseudonode LSPs, which increase LSP database size and processing overhead, reducing scalability in large core networks.

Practice this question →

100

MCQmedium

A service provider is implementing EVPN for its VPLS replacement. They have configured BGP EVPN on all PEs and have set up an EVPN instance for a customer requiring broadcast, unknown unicast, and multicast (BUM) traffic. The customer reports that broadcast traffic from one site is not being received at another site. The engineer checks the EVPN configuration and finds that the EVI is configured correctly, the route-target matches, and the BGP sessions are established. The engineer also checks the MAC address table on the receiving PE and sees that the source MAC of the broadcast frame is learned on the local interface, but not from the remote VTEP. The engineer suspects an issue with the IMET (Inclusive Multicast Ethernet Tag) route. Which action should the engineer take to verify the IMET route?

A.Use 'show evpn instance detail' to check the EVI configuration.

B.Check the BGP EVPN route table for IMET (route-type 3) routes using 'show bgp l2vpn evpn route-type 3'.

C.Use 'show bgp l2vpn evpn route-type 2' to verify MAC/IP routes.

D.Use 'show l2vpn vfi' to verify the VPLS forwarding instance.

AnswerB

IMET routes are route-type 3 in EVPN; checking their presence and reachability is essential for BUM traffic.

Why this answer

'show bgp l2vpn evpn route-type 3' displays the IMET (Inclusive Multicast Ethernet Tag) routes, which are necessary for forwarding BUM traffic between VTEPs. Option A is incorrect because 'show evpn instance detail' shows local EVI configuration but not remote IMET routes. Option C is incorrect because route-type 2 is for MAC/IP advertisement, not IMET.

Option D is incorrect because 'show l2vpn vfi' is used for VPLS, not EVPN.

Practice this question →

101

MCQmedium

A service provider is troubleshooting an MPLS L3VPN where customers behind CE-A cannot reach CE-B. The PE routers are Cisco ASR 9000 series. On PE-A, the show cef vrf CUSTOMER prefix 10.1.1.0/24 command displays 'punt' as the forwarding path. What is the most likely cause?

A.The IP prefix is not resolved via an MPLS label in the LFIB

B.The MPLS MTU on the interface is too small

C.The VRF is missing the route-target import statement

D.The CE is not running OSPF with the PE

AnswerA

The IP prefix is not resolved via an MPLS label in the LFIB – this causes the CEF to punt packets to the CPU because the hardware cannot forward them without a label.

Why this answer

When show cef vrf CUSTOMER prefix 10.1.1.0/24 displays 'punt', it means the prefix does not have a valid MPLS label in the LFIB (Label Forwarding Information Base). In MPLS L3VPN, the PE must push a label for the next-hop PE to forward traffic across the MPLS core. Without a label, the packet is punted to the CPU for further processing, often due to missing label binding or incomplete LDP/IGP synchronization.

Option A correctly identifies this issue. Option B is incorrect because MTU issues would cause drops, not punt. Option C is incorrect because missing route-target import would affect route installation in the VRF but not necessarily cause punt for a locally resolved prefix.

Option D is incorrect because CE-PE routing protocol (whether OSPF or BGP) is not directly related to MPLS label resolution on the PE.

Practice this question →

102

Multi-Selecthard

Which THREE are correct statements about IOS XR process separation? (Choose three.)

Select 3 answers

A.Processes can be restarted independently without affecting others

B.A failure in one process can crash the entire system

C.Each routing protocol runs as a separate process

D.All processes share a single memory space

E.Memory and CPU are allocated per line card

AnswersA, C, E

This is a key benefit.

Why this answer

IOS XR runs each protocol as a separate process, providing fault isolation and independent restart.

Practice this question →

103

MCQmedium

Which Cisco SP router platform uses IOS XR and is commonly deployed at the aggregation layer, supporting both L2 and L3 services?

A.Cisco ASR 9000

B.Cisco CRS

C.Cisco ASR 1000

D.Cisco NCS 540

AnswerA

ASR 9000 is a popular aggregation router with IOS XR.

Why this answer

Cisco ASR 9000 is an aggregation router running IOS XR, suitable for L2/L3 services.

Practice this question →

104

Matchingmedium

Match each MPLS protection mechanism to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Fast Reroute to bypass a failed link or node locally

End-to-end path protection for MPLS TE tunnels

Graceful restart for LDP to preserve forwarding during control plane restart

Prefix Independent Convergence for fast BGP failover

Fast Reroute for RSVP-TE tunnels using backup paths

Why these pairings

The correct matches are: A (MPLS FRR), B (MPLS TE FRR), C (MPLS PW Redundancy), D (MPLS LSP Protection). Distractors E and F swap definitions or use incorrect descriptions.

Practice this question →

105

MCQeasy

Refer to the exhibit. Which statement is true about this configuration?

A.LDP is manually configured

B.MPLS VPN is enabled

C.LDP is automatically enabled on the interface

D.MPLS forwarding is disabled

AnswerC

The autocfg command enables LDP automatically.

Why this answer

The `mpls ip` command under interface configuration enables LDP on that interface, allowing it to automatically discover LDP neighbors and exchange label bindings. This command implicitly enables LDP without requiring manual neighbor configuration, which is the default behavior for label distribution in many MPLS deployments.

Exam trap

Cisco often tests the distinction between `mpls ip` (which enables LDP and MPLS forwarding) and manual LDP configuration (which would require `mpls ldp neighbor`), leading candidates to incorrectly assume that LDP requires explicit neighbor statements.

How to eliminate wrong answers

Option A is wrong because LDP is not manually configured; the `mpls ip` command triggers automatic LDP neighbor discovery and session establishment via UDP and TCP port 646, without needing explicit neighbor statements. Option B is wrong because MPLS VPN requires additional configuration such as VRF definitions, BGP address-family VPNv4, and route-target import/export, none of which are shown in the exhibit. Option D is wrong because `mpls ip` explicitly enables MPLS forwarding on the interface, not disables it; disabling MPLS forwarding would require the `no mpls ip` command.

Practice this question →

106

MCQmedium

A network engineer is troubleshooting QoS in a service provider environment. Customer traffic is marked with DSCP AF31 (011010) at the CE. On the PE router, the policy maps trust DSCP and sets the CoS to 4. However, core routers remark the DSCP to 0. What is the most likely cause?

A.A policer on the core router is marking down out-of-contract traffic

B.The core routers use LDP labels and ignore DSCP

C.The ingress PE did not set MPLS EXP bits

D.The MPLS EXP bits are not copied from DSCP

AnswerA

Policers can re-mark DSCP to 0 for excess traffic.

Why this answer

The core router is likely applying a policer that marks down traffic exceeding the committed information rate (CIR). When traffic is out-of-contract, the policer can re-mark the DSCP to 0 (best effort), which overrides the trusted DSCP AF31 and the CoS 4 set at the PE. This behavior is common in service provider environments where core routers enforce traffic contracts and use policing to penalize excess traffic.

Exam trap

Cisco often tests the misconception that MPLS EXP bits are automatically preserved end-to-end, but the trap here is that a core router's policer can independently re-mark the DSCP to 0, overriding any earlier trust or EXP mapping, especially when the traffic exceeds the contracted rate.

How to eliminate wrong answers

Option B is wrong because LDP labels are used for MPLS label distribution and do not inherently ignore DSCP; core routers can still examine and act on DSCP values in the IP header. Option C is wrong because the ingress PE does set MPLS EXP bits when it trusts DSCP and sets CoS to 4, as the policy map maps DSCP to CoS/EXP. Option D is wrong because the MPLS EXP bits are explicitly set from DSCP by the PE's policy map (trust DSCP, set CoS 4), so the issue is not a failure to copy but rather a downstream remarking by the core router.

Practice this question →

107

MCQhard

A service provider wants to offer a point-to-point Layer 2 Ethernet service between two customer sites with strict SLAs. The solution must use MPLS pseudowires. Which MEF service type aligns with this requirement?

A.E-Line

B.E-Tree

C.E-Access

D.E-LAN

AnswerA

E-Line provides point-to-point Ethernet connectivity.

Why this answer

E-Line is a point-to-point Ethernet service defined by MEF. E-LAN is multipoint, E-Tree is rooted multipoint, E-Access is for access to a service provider network.

Practice this question →

108

Multi-Selectmedium

Which TWO are benefits of using Segment Routing over LDP in a service provider core?

Select 2 answers

A.Reduces the number of labels in the control plane.

B.Label allocation is per-prefix, not per-interface.

C.Eliminates the need for IGP convergence for label distribution.

D.Simplifies MPLS TE tunnel configuration.

E.Supports TI-LFA for fast reroute with full topology protection.

AnswersB, E

SR assigns a single label per prefix independent of the outgoing interface, simplifying label management.

Why this answer

Segment Routing (SR) uses a centralized control plane (via PCE or BGP-LS) to allocate labels per prefix, unlike LDP which allocates labels per interface on a hop-by-hop basis. This reduces the number of labels in the control plane and simplifies label management, as SR-MPLS uses a single label stack entry per segment rather than per-interface labels.

Exam trap

Cisco often tests the misconception that Segment Routing eliminates IGP convergence entirely, when in fact it still depends on IGP for topology discovery and SID advertisement, but removes the need for a separate label distribution protocol like LDP.

Practice this question →

109

MCQeasy

Which Cisco automation tool uses service models in YANG and communicates via NETCONF to orchestrate device configurations and lifecycle management?

A.Ansible

B.Chef

C.Cisco DNA Center

D.Cisco Network Services Orchestrator (NSO)

AnswerD

NSO is designed for service modeling and orchestration using YANG and NETCONF.

Why this answer

NSO (Network Services Orchestrator) uses YANG models and NETCONF for configuration management. Ansible, Cisco DNA Center, and Chef are other tools but NSO is specifically for service orchestration.

Practice this question →

110

MCQhard

An SP is designing a GPON access network. Which technology allows multiple ONUs to share the same fiber using different wavelengths for upstream and downstream?

A.Ethernet PON (EPON)

B.Time Division Multiple Access (TDMA)

C.Code Division Multiple Access (CDMA)

D.Wavelength Division Multiplexing (WDM)

AnswerD

Correct. WDM allows bidirectional communication over a single fiber using different wavelengths.

Why this answer

GPON uses Wavelength Division Multiplexing (WDM) with different wavelengths for downstream (1490nm) and upstream (1310nm) on the same fiber.

Practice this question →

111

MCQhard

Based on the exhibit, why is the route 10.10.10.0/24 from remote PE not installed in the VRF Customer-A on PE1?

A.The localpref is too low (100)

B.The VRF imports route-target 200:200, but the route has RT 100:100

C.The MPLS label allocation failed on the remote PE

D.The route distinguisher on the VRF (100:1) does not match the remote RD

AnswerB

Route-target import filter must match the route's RT for installation.

Why this answer

The route has RT 100:100, but VRF Customer-A imports RT 200:200. Thus, the route is not imported. Option A is wrong because the localpref is 100, which is default and not an issue.

Option C is wrong because the RD mismatch is between VRFs, but RD does not affect import; RT does. Option D is wrong because label allocation is working fine (vpn-label:24000).

Practice this question →

112

MCQmedium

An engineer is designing an MPLS L3VPN solution and must ensure that the provider edge (PE) routers can handle routing updates for multiple customers without interfering with each other. Which mechanism should be used on the PE routers?

A.Route distinguishers

B.Route reflectors

C.MPLS-TE

D.VRF-Lite

AnswerD

VRF-Lite creates separate routing tables for each customer.

Why this answer

VRF-Lite (Virtual Routing and Forwarding) is the correct mechanism because it allows a single PE router to maintain multiple separate routing tables (VRFs), each dedicated to a different customer. This ensures that routing updates for one customer are isolated from another, preventing interference. VRF-Lite achieves this without MPLS, using only IP forwarding and per-VRF routing instances.

Exam trap

Cisco often tests the distinction between VRF-Lite (which provides routing isolation without MPLS) and full MPLS L3VPN (which uses RDs and route targets for VPNv4 prefix uniqueness and distribution), leading candidates to mistakenly choose route distinguishers as the isolation mechanism.

How to eliminate wrong answers

Option A is wrong because route distinguishers (RDs) are used to make IPv4 prefixes unique across VRFs in an MPLS L3VPN, but they do not provide routing isolation; they are just a prefix-extension mechanism. Option B is wrong because route reflectors are used to scale BGP route distribution within an MPLS L3VPN core, not to isolate customer routing updates on the PE. Option C is wrong because MPLS-TE (Traffic Engineering) controls the path of MPLS LSPs for optimization, not the separation of customer routing tables.

Practice this question →

113

MCQhard

In a Cisco IOS XR router, which statement best describes process separation?

A.Processes share memory to improve performance

B.All routing protocols run in a single process to reduce memory usage

C.Each protocol runs as a separate process with its own memory space

D.Only BGP runs as a separate process; others are monolithic

AnswerC

This is the definition of process separation.

Why this answer

IOS XR runs each protocol as a separate process in protected memory, so a crash of one process does not affect others, improving stability.

Practice this question →

114

MCQmedium

In BGP/MPLS IP VPN (L3VPN), which component provides customer isolation by maintaining separate routing tables per customer?

A.Route distinguisher (RD)

B.MPLS label

C.VRF

D.MP-BGP

AnswerC

VRF provides per-customer routing table isolation.

Why this answer

VRF (Virtual Routing and Forwarding) creates separate routing tables for each customer, ensuring isolation.

Practice this question →

115

MCQhard

A service provider is deploying Segment Routing over IPv6 (SRv6) and needs to ensure that the forwarding plane can support SRv6 encapsulated packets. Which hardware capability is most critical for SRv6 at the line rate?

A.MPLS label swap capability

B.VXLAN tunnel termination

C.IPv6 extension header processing

D.NAT64 translation support

AnswerC

SRv6 uses the SRH, an IPv6 extension header, requiring line-rate processing.

Why this answer

SRv6 (Segment Routing over IPv6) encapsulates packets with an IPv6 header containing a Segment Routing Header (SRH), which is a type of IPv6 extension header. For line-rate forwarding, the hardware must natively process IPv6 extension headers in the forwarding plane without punting to the CPU, as software processing would cause performance degradation. Option C is correct because this capability is the most critical for SRv6 at line rate.

Exam trap

Cisco often tests the misconception that SRv6 is MPLS-based, leading candidates to incorrectly select MPLS label swap capability, but SRv6 is an IPv6-native technology that relies on IPv6 extension header processing.

How to eliminate wrong answers

Option A is wrong because MPLS label swap capability is irrelevant to SRv6, which uses IPv6 encapsulation and the SRH, not MPLS labels; SRv6 does not rely on MPLS forwarding. Option B is wrong because VXLAN tunnel termination is a separate overlay technology for network virtualization and does not directly support SRv6's IPv6-based segment routing. Option D is wrong because NAT64 translation support is used for IPv6-to-IPv4 translation and has no role in SRv6 packet forwarding or segment processing.

Practice this question →

116

MCQmedium

A service provider is implementing EVPN to support multi-homing for a customer site. Which EVPN attribute ensures that only one of the PEs forwards traffic for a given Ethernet segment?

A.Designated Forwarder (DF) election

B.Label block

C.Route Target

D.Ethernet Tag ID

AnswerA

DF election ensures only one PE forwards traffic for a given ESI in all-active multi-homing.

Why this answer

The ESI (Ethernet Segment Identifier) and designated forwarder election ensure single active forwarding per segment. DF election is used for multi-homing.

Practice this question →

117

MCQeasy

A service provider operates an MPLS-TE network using RSVP-TE with a full mesh of tunnels between core routers. The network uses OSPF as IGP with traffic engineering extensions. Recently, a new headend router PE-New was added and configured with several TE tunnels to remote destinations. However, some tunnels repeatedly go down after a few minutes and show in the 'down' state with the error 'Tunnel path option 0: no path to destination (TEDB lookup failed)'. The TE tunnels that remain up are those to destinations that are directly connected to the same OSPF area. The network has multiple OSPF areas (area 0, 1, 2) with inter-area routes redistributed. The operator suspects the issue is related to the TEDB (Traffic Engineering Database) not having complete information. Which action is MOST likely to resolve the issue?

A.Increase the tunnel hold-priority and setup-priority values

B.Add the remote loopbacks to OSPF using network statements in area 0

C.Change the IGP to IS-IS with wide metrics and enable MPLS-TE on all IS-IS levels

D.Configure static routes for the remote destinations on PE-New

AnswerC

IS-IS natively propagates TE information across all levels, ensuring TEDB completeness for inter-area tunnels.

Why this answer

The issue is that OSPF does not flood traffic engineering (TE) information across area boundaries by default. The TEDB on PE-New lacks topology data for inter-area destinations, so tunnel path computation fails. IS-IS, when configured with wide metrics and MPLS-TE enabled on all levels, floods TE link-state information throughout the entire routing domain (both Level-1 and Level-2), ensuring the TEDB is complete.

This resolves the problem. Option D (static routes) does not populate the TEDB. Option B does not help because adding loopbacks to OSPF does not provide TE information.

Option A (priorities) only affects tunnel setup and preemption, not TEDB completeness.

Practice this question →

118

Drag & Dropmedium

Drag and drop the steps to configure EIGRP on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

EIGRP configuration requires entering the EIGRP process, advertising networks, and optionally disabling auto-summary.

Practice this question →

119

MCQhard

An SP is deploying EVPN to provide both L2 and L3 VPN services. Which advantage does EVPN offer over traditional VPLS for multi-homing?

A.EVPN uses a single MAC address per PE to reduce forwarding table size.

B.EVPN supports only active/standby redundancy, similar to VPLS.

C.EVPN provides faster convergence and active-active multi-homing using Ethernet Segment Identifier (ESI) and Designated Forwarder (DF) election.

D.EVPN requires MPLS in the core, whereas VPLS can use IP-only.

AnswerC

EVPN's ESI and DF mechanism enable efficient multi-homing.

Why this answer

EVPN uses ESI-based multi-homing with BGP control plane, offering faster convergence and active-active load balancing compared to VPLS's active/standby model.

Practice this question →

120

MCQmedium

A service provider is designing a core network with IS-IS as the IGP. To support MPLS traffic engineering, which IS-IS extensions are required?

A.IS-IS multi-topology (MT)

B.IS-IS TE extensions (RFC 5305)

C.IS-IS wide metrics

D.IS-IS L1/L2 routing

AnswerB

TE extensions advertise link bandwidth, admin-group, etc.

Why this answer

IS-IS TE extensions (RFC 5305) are required to carry MPLS Traffic Engineering information, such as link bandwidth, administrative groups, and TE metric, in Type-Length-Value (TLV) fields within IS-IS Link State PDUs. These extensions enable the IGP to flood TE attributes that MPLS TE uses for constraint-based path computation, such as with RSVP-TE or Segment Routing.

Exam trap

Cisco often tests the distinction between wide metrics (which are a prerequisite for TE extensions) and the TE extensions themselves, leading candidates to mistakenly select wide metrics as the answer when the question specifically asks for the extensions that enable MPLS TE.

How to eliminate wrong answers

Option A is wrong because IS-IS multi-topology (MT) allows multiple independent topologies (e.g., IPv4 and IPv6) over a single IS-IS instance, but it does not provide the TE-specific TLVs needed for MPLS TE. Option C is wrong because IS-IS wide metrics (RFC 5305) extend the metric field to 24 bits to support larger link costs, but they are not sufficient alone; TE extensions require additional TLVs (e.g., sub-TLV 22) beyond just wide metrics. Option D is wrong because IS-IS L1/L2 routing is a fundamental hierarchical routing feature that separates areas, but it has no direct role in carrying MPLS TE attributes; TE extensions work within both L1 and L2.

Practice this question →

121

Multi-Selectmedium

Which TWO statements about EVPN Route Type 2 (MAC/IP advertisement) are correct?

Select 2 answers

A.It is used for MAC learning and ARP suppression

B.It advertises both MAC and IP addresses of hosts

C.It provides load balancing via aliasing

D.It includes the Ethernet Segment Identifier (ESI)

E.It is not used for host mobility

AnswersA, B

RT2 is used to populate MAC tables and suppress ARP.

Why this answer

EVPN Route Type 2 is used to advertise MAC and IP addresses of hosts, enabling MAC learning and ARP suppression in EVPN-VXLAN fabrics. By distributing host MAC and IP bindings via BGP, it allows VTEPs to learn remote MAC addresses without data-plane flooding and to suppress ARP requests by responding locally when the IP-to-MAC mapping is known.

Exam trap

Cisco often tests the distinction between EVPN Route Types, and the trap here is confusing the aliasing/load-balancing function of Route Type 1 with the MAC/IP advertisement function of Route Type 2, or assuming that the ESI is present in all EVPN routes.

Practice this question →

122

MCQhard

In the context of EVPN, which BGP address family is used to advertise MAC/VPN routes between PE routers?

A.EVPN (AFI 25, SAFI 70)

B.IPv4 Unicast (AFI 1, SAFI 1)

C.L2VPN (AFI 25, SAFI 70)

D.VPNv4 Unicast (AFI 1, SAFI 128)

AnswerA

EVPN uses AFI 25 SAFI 70.

Why this answer

EVPN uses BGP EVPN address family (AFI 25, SAFI 70) to exchange MAC/VPN routes for L2 and L3 services.

Practice this question →

123

MCQhard

Refer to the exhibit. The router is configured as a route reflector for VPNv4. What is the requirement for the route reflector to propagate VPNv4 routes received from a client to other clients?

A.The route reflector must filter routes based on route-target communities

B.The route reflector must use the same cluster ID for all clients

C.The route reflector must include the originator ID attribute to prevent loops

D.The route reflector must set the next-hop to itself for all reflected routes

AnswerC

The originator ID identifies the original advertiser; the route reflector must not modify it.

Why this answer

The route reflector must include the originator ID attribute to prevent routing loops when reflecting VPNv4 routes between clients. The originator ID is set to the router ID of the originating IBGP speaker, and the route reflector ignores any route with an originator ID equal to its own router ID, thereby preventing loops in a client-to-client reflection scenario.

Exam trap

Cisco often tests the misconception that route reflectors must modify the next-hop or filter based on route-targets, but the key loop-prevention mechanism for client-to-client reflection is the originator ID attribute, not cluster ID or next-hop manipulation.

How to eliminate wrong answers

Option A is wrong because route reflectors do not filter VPNv4 routes based on route-target communities; route-target filtering is performed by the receiving PE router based on its VRF configuration, not by the route reflector itself. Option B is wrong because the same cluster ID is used for all clients to identify the route reflector cluster and prevent loops between multiple route reflectors, but it is not a requirement for propagating routes from one client to another. Option D is wrong because the route reflector does not change the next-hop attribute to itself; the next-hop is typically unchanged (unless configured with 'next-hop-self' on the PE), and changing it would break BGP path selection and VPN reachability.

Practice this question →

124

MCQmedium

Which protocol is used to exchange label binding information in a classic MPLS network without Segment Routing?

A.LDP

B.OSPF

C.BGP

D.IS-IS

AnswerA

LDP is used for label distribution in classic MPLS.

Why this answer

In a classic MPLS network without Segment Routing, LDP (Label Distribution Protocol) is the standard protocol used to exchange label binding information. LDP assigns and distributes labels for each FEC (Forwarding Equivalence Class) based on the underlying IGP routing table, enabling label-switched paths (LSPs) without requiring RSVP or Segment Routing extensions.

Exam trap

Cisco often tests the distinction between control plane protocols (LDP for label exchange) and routing protocols (OSPF, IS-IS, BGP) to see if candidates confuse the role of IGPs in MPLS; the trap is assuming that because OSPF or IS-IS are used for routing, they also distribute MPLS labels.

How to eliminate wrong answers

Option B (OSPF) is wrong because OSPF is an IGP used for IP routing, not for MPLS label distribution; it does not carry label bindings. Option C (BGP) is wrong because BGP is used for inter-domain routing and can carry MPLS labels only in VPN contexts (e.g., MP-BGP for L3VPN), but it is not the protocol for exchanging label bindings in a classic, non-SR MPLS core. Option D (IS-IS) is wrong because IS-IS is also an IGP and does not distribute MPLS labels; it can be extended for Segment Routing (SR-IS-IS) but not for classic LDP-based label exchange.

Practice this question →

125

MCQmedium

In IOS XR, each routing protocol runs as a separate process. What is the primary benefit of this architecture?

A.It simplifies configuration by combining all protocols into a single file.

B.It allows each protocol to be upgraded independently without a system reboot.

C.It reduces memory consumption by sharing code between processes.

D.It improves forwarding performance by dedicating CPU cores to each protocol.

AnswerB

Individual processes can be restarted or upgraded without affecting other processes.

Why this answer

Process separation provides fault isolation; a crash in one protocol process does not affect others, improving overall system stability.

Practice this question →

126

Multi-Selectmedium

A service provider is designing a BGP-based network. Which TWO are characteristics of BGP within a service provider core?

Select 2 answers

A.IBGP sessions require a full mesh or route reflectors to avoid routing loops

B.BGP MED attribute is mandatory for all routes

C.BGP uses the AS path for loop prevention in iBGP

D.BGP route reflectors always modify the AS path

E.BGP relies on an IGP for next-hop reachability within the AS

AnswersA, E

iBGP does not advertise routes learned from another iBGP peer to prevent loops; thus full mesh or RR is needed.

Why this answer

IBGP requires either a full mesh of sessions or route reflectors to prevent routing loops. The BGP split-horizon rule states that routes learned from an iBGP peer are not advertised to another iBGP peer, so without a full mesh or route reflectors, reachability information cannot propagate within the AS. Route reflectors break this rule by allowing selected iBGP speakers to re-advertise routes, but they must be deployed with proper cluster and originator ID attributes to avoid loops.

Exam trap

Cisco often tests the misconception that iBGP uses the AS path for loop prevention, but in reality, iBGP relies on the split-horizon rule and attributes like originator ID and cluster list, while the AS path is only used for eBGP loop prevention.

Practice this question →

127

MCQeasy

Which encapsulation technology is commonly used in service provider networks to separate subscriber traffic in an Ethernet aggregation network?

A.Q-in-Q (802.1ad)

B.VXLAN

C.802.1Q

D.MPLS

AnswerA

Double tagging separates subscriber from service VLAN.

Why this answer

Q-in-Q (802.1ad) is the correct encapsulation technology because it allows service providers to stack an outer service VLAN tag (S-Tag) on top of a customer's inner VLAN tag (C-Tag), effectively separating subscriber traffic in an Ethernet aggregation network. This double-tagging mechanism preserves the customer's VLAN space while enabling the provider to aggregate multiple subscribers over a single physical port, which is essential for Metro Ethernet and DSLAM aggregation scenarios.

Exam trap

Cisco often tests the distinction between 802.1Q (single tagging) and 802.1ad (Q-in-Q) in aggregation networks, where candidates mistakenly choose 802.1Q because they overlook the need to preserve customer VLANs while scaling beyond 4096 VLANs.

How to eliminate wrong answers

Option B (VXLAN) is wrong because it is an overlay encapsulation that uses UDP and a 24-bit VNI to tunnel Layer 2 over Layer 3 networks, typically in data center fabrics, not for simple subscriber separation in an Ethernet aggregation network. Option C (802.1Q) is wrong because it provides only a single VLAN tag (12-bit VID), which cannot separate overlapping customer VLANs in an aggregation environment without exhausting the 4096 VLAN limit. Option D (MPLS) is wrong because it is a label-switching technology used for traffic engineering and VPNs in the core, not a direct encapsulation for separating subscriber traffic at the Ethernet aggregation layer.

Practice this question →

128

MCQmedium

Which architecture feature of IOS XR ensures that a failure in one routing protocol process does not affect other processes on the same router?

A.Admin plane vs default SDR

B.Commit/rollback configuration model

C.Process separation with each protocol as a separate process

D.CPU and memory allocation per card

AnswerC

Process separation isolates failures.

Why this answer

IOS XR uses a distributed OS with process separation; each protocol runs as a separate process in its own memory space, providing fault isolation.

Practice this question →

129

Multi-Selecthard

Which THREE of the following are key characteristics of Cisco IOS XR operating system?

Select 3 answers

A.Each routing protocol runs as a separate process.

B.Atomic commit and rollback configuration model.

C.Supports non-stop forwarding (NSF) with graceful restart.

D.Monolithic kernel where all processes run in a single memory space.

E.Distributed OS architecture with separate control and data planes.

AnswersA, B, C

Each routing protocol runs as a separate process, which is a key characteristic of IOS XR's microkernel architecture.

Why this answer

Cisco IOS XR uses a microkernel operating system where each routing protocol runs as a separate process (A). It features a two-phase commit configuration model with atomic commit and rollback (B). It also supports non-stop forwarding (NSF) with graceful restart for high availability (C).

Option D is incorrect because IOS XR does not have a monolithic kernel; it uses a microkernel. Option E is incorrect because while IOS XR separates control and data planes, it is not a distributed OS architecture; it is a microkernel-based OS designed for a single router.

Practice this question →

130

MCQhard

In Cisco IOS XR architecture, using Secure Domain Routers (SDRs) allows partitioning a physical router into multiple logical routers. Which statement about admin plane and SDRs is correct?

A.The admin plane runs only on route processor cards, while default SDR runs on line cards.

B.The admin plane and default SDR are the same logical entity and share all configuration.

C.The admin plane is a separate SDR that manages hardware resources and system-level functions, while the default SDR handles routing and forwarding.

D.SDRs are only supported on Cisco CRS, not on ASR 9000.

AnswerC

Admin plane is dedicated to system management; default SDR is for data plane and control plane services.

Why this answer

The admin plane is a special SDR used for managing the system (e.g., hardware inventory, shared resources). Default SDR is the primary forwarding SDR, but admin SDR is separate.

Practice this question →

131

Multi-Selectmedium

Which two are requirements for deploying Segment Routing in a service provider network? (Choose two.)

Select 2 answers

A.TE tunnels must be configured

B.IGP supporting segment routing (OSPF or IS-IS)

C.LDP must be enabled

D.All routers must run BGP

E.MPLS forwarding

AnswersB, E

The IGP must support SR extensions.

Why this answer

Segment Routing (SR) relies on an IGP (OSPF or IS-IS) that has been extended to advertise prefix-SIDs and adjacency-SIDs. The IGP extensions (RFC 8665 for IS-IS, RFC 8666 for OSPF) enable routers to compute source-routed paths without a separate signaling protocol. This is a fundamental requirement because SR-MPLS encodes the path as a stack of labels derived directly from the IGP SIDs.

Exam trap

The trap here is that candidates often assume LDP is still required for MPLS forwarding, but SR-MPLS replaces LDP entirely by using IGP-distributed SIDs, so the correct answer requires recognizing that LDP must be disabled, not enabled.

Practice this question →

132

MCQeasy

Which Cisco router platform is designed for the aggregation layer and runs IOS XR, supporting both L2 and L3 services at high density?

A.Cisco NCS 5500

B.Cisco CRS

C.Cisco ASR 9000

D.Cisco ISR 4000

AnswerC

ASR 9000 is optimized for the aggregation layer with IOS XR.

Why this answer

The ASR 9000 is a widely used aggregation router with IOS XR and supports L2/L3 services. CRS is core, NCS 5500 is edge/aggregation but more focused on 100GE, and ISR is enterprise.

Practice this question →

133

MCQmedium

An SP is deploying Inter-AS MPLS VPN option B. Which design characteristic is unique to Option B compared to Option A?

A.ASBRs exchange VPNv4 routes directly via MP-EBGP

B.Requires a full mesh of MP-IBGP sessions between all PEs

C.ASBRs maintain separate VRF for each VPN

D.Traffic is forwarded using IP, not MPLS

AnswerA

Uses MP-EBGP between ASBRs to exchange VPNv4 routes.

Why this answer

In Option B, ASBRs exchange VPNv4 routes directly via MP-EBGP without requiring a full mesh of MP-IBGP sessions between PEs. This eliminates the need for per-VPN VRF configuration on ASBRs, as they only carry labeled VPNv4 routes and perform label allocation per next-hop, not per VPN.

Exam trap

Cisco often tests the misconception that Option B requires a full mesh of MP-IBGP sessions (like Option A), when in fact it uses MP-EBGP between ASBRs to eliminate that requirement.

How to eliminate wrong answers

Option B is wrong because a full mesh of MP-IBGP sessions between all PEs is a requirement for Option A (Inter-AS MPLS VPN Option A), not Option B; Option B uses MP-EBGP between ASBRs to avoid this full mesh. Option C is wrong because ASBRs in Option B do not maintain separate VRFs for each VPN; they use a single global routing table with VPNv4 prefixes and label forwarding, whereas Option A requires per-VPN VRFs on ASBRs. Option D is wrong because traffic in Option B is forwarded using MPLS labels (not IP) between ASBRs, leveraging label stacking for end-to-end transport; IP forwarding would be used in Option A or in non-MPLS scenarios.

Practice this question →

134

Multi-Selecteasy

A network engineer is designing a new MPLS core. Which three of the following are recommended best practices for MPLS LDP configuration? (Choose three.)

Select 3 answers

A.Use explicit null label for BGP prefixes

B.Set the LDP session holdtime to 180 seconds

C.Enable LDP authentication using MD5

D.Enable LDP on all core interfaces

E.Configure label filtering to limit label distribution

AnswersC, D, E

LDP authentication protects against spoofing and is a security best practice.

Why this answer

C is correct because enabling LDP authentication using MD5 protects the LDP session from spoofing and tampering by verifying the integrity of TCP segments exchanged between LDP peers. This is a recommended security best practice in MPLS networks to prevent unauthorized label distribution and route hijacking.

Exam trap

Cisco often tests the distinction between explicit null (label 0) and implicit null (label 3) for BGP prefixes, leading candidates to mistakenly choose explicit null as a best practice when it is actually used only for specific purposes like QoS marking.

Practice this question →

135

MCQhard

In a Carrier Supporting Carrier (CSC) architecture, which condition is necessary for the customer carrier's BGP routes to be carried over the provider carrier's MPLS backbone?

A.The BGP next-hop on the customer carrier's routes must be reachable via IGP in the provider carrier.

B.The provider carrier's VRF must have the route-target matching the customer carrier's.

C.The provider carrier must be in the same AS as the customer carrier.

D.The customer carrier must use LDP for label distribution.

AnswerA

For the provider carrier to switch MPLS packets, the BGP next-hop must be reachable via the IGP and have a label binding.

Why this answer

In a Carrier Supporting Carrier (CSC) architecture, the provider carrier's MPLS backbone must be able to forward packets toward the BGP next-hop of the customer carrier's routes. For this to happen, the BGP next-hop (typically a loopback interface on the customer carrier's PE router) must be reachable via an IGP (e.g., OSPF or IS-IS) running within the provider carrier's core. Without IGP reachability to that next-hop, the provider carrier's P routers cannot perform MPLS label switching to deliver traffic to the customer carrier's egress router, breaking end-to-end connectivity.

Exam trap

Cisco often tests the misconception that route-target matching (Option B) is required for CSC, when in fact the critical requirement is IGP reachability to the BGP next-hop, not VRF route-target alignment.

How to eliminate wrong answers

Option B is wrong because route-target matching is used in MPLS Layer 3 VPNs to control route import/export between VRFs, but in CSC the customer carrier's BGP routes are carried as VPNv4 routes across the provider carrier's backbone; the provider carrier does not need its VRF to match the customer carrier's route-target — instead, the provider carrier uses its own VRF to import/export routes based on configured policies. Option C is wrong because the provider carrier and customer carrier can be in different autonomous systems; CSC explicitly supports inter-AS scenarios where the customer carrier operates its own AS and runs eBGP with the provider carrier. Option D is wrong because LDP is used for label distribution within the provider carrier's MPLS core, but the customer carrier can use any label distribution protocol (e.g., LDP, RSVP-TE, or even BGP-labeled unicast) — LDP is not a mandatory condition for the customer carrier's BGP routes to be carried over the provider carrier's backbone.

Practice this question →

136

MCQmedium

A service provider is deploying EVPN-MPLS for L2VPN services. The customer requires that MAC addresses learned from one PE are not advertised to other PEs unless they are active. Which EVPN route type is used for MAC address withdrawal?

A.Route Type 5: IP Prefix

B.Route Type 1: Ethernet Auto-Discovery (A-D)

C.Route Type 2: MAC/IP Advertisement

D.Route Type 3: Inclusive Multicast Ethernet Tag

AnswerC

MAC addresses are advertised in Type 2 routes; withdrawal is done by withdrawing the route.

Why this answer

EVPN Route Type 2 (MAC/IP Advertisement) carries both MAC addresses and their associated IP addresses, and it supports a 'sticky' or 'withdraw' mechanism via the BGP Withdraw message. When a MAC address becomes inactive on a PE, the PE sends a BGP Withdraw for the specific Route Type 2 route, effectively removing that MAC from the control plane of other PEs. This ensures that only active MAC addresses are advertised, meeting the customer requirement.

Exam trap

Cisco often tests the distinction between Route Type 2 for individual MAC withdrawal and Route Type 1 for mass Ethernet segment withdrawal, leading candidates to confuse the two when the question specifies 'MAC addresses learned from one PE' rather than a segment-level failure.

How to eliminate wrong answers

Option A is wrong because Route Type 5 (IP Prefix) is used for inter-subnet forwarding (EVPN-VPN) to advertise IP prefixes, not for MAC address withdrawal. Option B is wrong because Route Type 1 (Ethernet Auto-Discovery) is used for mass withdrawal of all MAC addresses associated with an Ethernet segment (e.g., during link failure) or for aliasing/backup paths, not for individual MAC address withdrawal. Option D is wrong because Route Type 3 (Inclusive Multicast Ethernet Tag) is used to advertise multicast tunnel endpoints for BUM traffic, not for MAC address withdrawal.

Practice this question →

137

Multi-Selectmedium

A service provider is troubleshooting an L2VPN where a CE is unable to ping the remote CE. The PE-CE interfaces are up, and the pseudowire status shows 'up'. Which two actions should be taken to further isolate the issue? (Choose two.)

Select 2 answers

A.Check the MAC address table on the CE

B.Check the LDP session between PEs

C.Verify the VFI configuration on the PE

D.Verify the VC ID match on both PEs

E.Verify the MTU consistency on the pseudowire

AnswersD, E

Mismatched VC IDs can cause traffic to be dropped despite pseudowire being up.

Why this answer

The VC ID (Virtual Circuit ID) must match on both PEs for the pseudowire to be established correctly. If the VC IDs are mismatched, the pseudowire status may show as 'up' due to local signaling, but traffic will not be forwarded between the CEs because the pseudowire endpoints are not logically connected. Verifying the VC ID ensures that the L2VPN circuit is properly configured end-to-end.

Exam trap

Cisco often tests the misconception that a pseudowire status of 'up' guarantees end-to-end connectivity, when in fact control-plane up does not ensure data-plane forwarding if parameters like VC ID or MTU are mismatched.

Practice this question →

138

MCQmedium

In Segment Routing, what is the role of the 'Prefix-SID'?

A.It identifies a specific adjacency

B.It is used for service chaining

C.It identifies a specific node

D.It identifies a prefix in the IGP

AnswerD

Correct. A Prefix-SID identifies an IGP prefix and is used to route traffic to that prefix via the shortest path.

Why this answer

A Prefix-SID is a Segment Routing identifier bound to an IGP prefix. It allows forwarding along the shortest path computed by the IGP to that prefix. Therefore, it identifies a prefix in the IGP, not a specific adjacency or node.

Exam trap

The common misconception is confusing Prefix-SID with Adjacency-SID. A Prefix-SID is bound to a prefix (e.g., a loopback) and leads to forwarding along the shortest path to that prefix, while an Adjacency-SID is bound to a specific adjacency and forces traffic over that link. Remember that Prefix-SID identifies a prefix in the IGP, not an adjacency or a service chain.

How to eliminate wrong answers

Option A is wrong because a Prefix-SID identifies a prefix, not a specific adjacency; adjacency SIDs (Adj-SIDs) are used to identify a particular link or neighbor. Option B is wrong because service chaining in SR is typically achieved using Segment Lists composed of multiple SIDs (including service SIDs), not by a single Prefix-SID. Option C is wrong because it is a duplicate of the correct answer D, and in this question format, only D is marked as correct; the distinction is that D is the intended correct choice.

Practice this question →

139

MCQhard

A service provider is implementing network slicing for 5G services. Which of the following is NOT a typical characteristic of a network slice?

A.Each slice can have its own dedicated virtualized functions and resources.

B.Slices can be customized for specific service types like eMBB, uRLLC, or mMTC.

C.Slices require dedicated physical infrastructure per slice.

D.Slices are isolated from each other in terms of performance and security.

AnswerC

Slices share physical infrastructure; they are logical partitions.

Why this answer

Network slices are isolated virtual networks, but they share the same physical infrastructure; they do not have dedicated physical links.

Practice this question →

140

MCQmedium

A customer reports that CE routers attached to PE1 and PE2 in the same VRF cannot ping each other. Based on the exhibit, what is the most likely cause?

A.Missing address-family ipv4 for BGP neighbor

B.LDP is not enabled on the core interfaces between PE1 and PE2

C.Mismatched route distinguisher (RD) values on PE1 and PE2

D.Route target (RT) import/export mismatch

AnswerB

LDP is required to distribute labels for BGP next-hop reachability; without it, MPLS forwarding fails.

Why this answer

B is correct because LDP must be enabled on the core interfaces between PE1 and PE2 to establish LDP sessions, which are required to exchange MPLS labels for the transport LSP. Without LDP, the MPLS forwarding path between the PEs is broken, preventing CE-to-CE ping even if BGP VPNv4 routes are correctly advertised.

Exam trap

Cisco often tests the distinction between control-plane issues (BGP VPNv4, RT, RD) and data-plane issues (LDP, MPLS forwarding), leading candidates to focus on route advertisement problems when the actual fault is at the MPLS transport layer.

How to eliminate wrong answers

Option A is wrong because the address-family ipv4 for BGP neighbor is not required for MPLS VPN; the VPNv4 address-family is used for PE-to-PE BGP sessions to exchange VPN routes. Option C is wrong because route distinguisher (RD) values can be different on PE1 and PE2; RD only needs to be unique per VRF within a single PE to maintain route uniqueness, not matched between PEs. Option D is wrong because an RT import/export mismatch would cause routes not to be imported into the VRF, but the question states the CE routers are in the same VRF and cannot ping each other, implying the VRF configuration is correct; the issue is at the MPLS transport layer.

Practice this question →

141

MCQeasy

A service provider is designing a Layer 3 MPLS VPN for a customer with two sites. The customer requires fast convergence in case of a PE-CE link failure. Which routing protocol should be used between PE and CE to achieve the fastest convergence?

A.Static routing with object tracking

B.IS-IS with SPF tuning

C.EIGRP

D.EBGP with BFD

E.OSPF with fast hello timers

AnswerD

BFD provides sub-second failure detection independent of routing protocol, enabling fast convergence.

Why this answer

EBGP with BFD provides the fastest convergence for PE-CE link failures because BFD can detect link failures in sub-second intervals (as low as 50 ms) and trigger BGP to withdraw routes immediately, without waiting for routing protocol timers. This is critical for Layer 3 MPLS VPNs where fast failover is required, and EBGP is commonly used as the PE-CE routing protocol in service provider environments.

Exam trap

Cisco often tests the misconception that OSPF with fast hello timers or EIGRP provides the fastest convergence, but the trap here is that BFD is the only mechanism that offers hardware-assisted, sub-second detection independent of routing protocol timers, making it the fastest option for PE-CE link failure convergence in MPLS VPNs.

How to eliminate wrong answers

Option A is wrong because static routing with object tracking relies on tracking objects (e.g., SLA probes) to detect failures, which introduces additional delay and complexity, and does not achieve sub-second convergence like BFD. Option B is wrong because IS-IS with SPF tuning can improve convergence but still depends on hello timers and SPF calculations, which are slower than BFD-based detection; IS-IS is also rarely used as a PE-CE protocol in MPLS VPN designs. Option C is wrong because EIGRP is a Cisco proprietary protocol and is not typically used in service provider MPLS VPN PE-CE links; it also relies on hello timers and DUAL computations, which are slower than BFD-triggered convergence.

Option E is wrong because OSPF with fast hello timers can reduce detection time but still requires OSPF neighbor state transitions and LSA flooding, which are slower than BFD's hardware-based failure detection.

Practice this question →

142

Multi-Selecthard

Which TWO statements about MPLS label operations in a service provider core are correct? (Choose two.)

Select 2 answers

A.The ingress router pushes a label stack onto the IP packet

B.The egress router receives an MPLS packet with two labels by default

C.The penultimate hop performs label swap for the top label

D.The penultimate hop pops the top label before forwarding to the egress router

E.The penultimate hop is disabled by default in MPLS networks

AnswersA, D

Ingress pushes the label stack to encapsulate the packet.

Why this answer

The ingress router (LER) in an MPLS network performs a push operation, adding a label stack (typically one or more labels) onto the incoming IP packet. This label stack is used to direct the packet along a Label Switched Path (LSP) through the core, enabling MPLS forwarding based on labels rather than IP routing.

Exam trap

Cisco often tests the misconception that the penultimate hop performs a label swap, when in fact it performs a pop (PHP) by default, and that the egress router always receives two labels, which is only true in specific scenarios like MPLS VPNs with a transport label and a VPN label.

Practice this question →

143

MCQmedium

Which Cisco router platform is designed for high-density 100GE and uses IOS XR, making it suitable for the core/backbone of a service provider network?

A.Cisco NCS 5500

B.Cisco CRS

C.Cisco ASR 9000

D.Cisco ISR 4400

AnswerB

CRS is designed for core backbone with massive scale.

Why this answer

Cisco CRS (Carrier Routing System) is a high-end core router supporting high-density 100GE and running IOS XR.

Practice this question →

144

MCQmedium

A service provider is deploying L3VPN using BGP/MPLS. Which mechanism ensures customer isolation in the provider network?

A.Virtual Routing and Forwarding (VRF)

B.Pseudowire

C.MP-BGP

D.MPLS labels

AnswerA

VRF isolates routing and forwarding per customer.

Why this answer

VRF (Virtual Routing and Forwarding) creates separate routing tables per customer, ensuring isolation.

Practice this question →

145

MCQmedium

In IOS XR, which process is responsible for managing the configuration database and commit operations?

A.fman

B.confd

C.sysmgr

D.rib

AnswerB

confd is the configuration daemon.

Why this answer

The configuration management process handles commit/rollback and stores configuration in a database.

Practice this question →

146

MCQmedium

Which MEF service type defines a point-to-point Ethernet connection, often used for business connectivity?

A.E-Tree

B.E-Access

C.E-LAN

D.E-Line

AnswerD

E-Line is the correct point-to-point service.

Why this answer

E-Line is the MEF service type for point-to-point Ethernet connections.

Practice this question →

147

MCQhard

An SP is migrating from an MPLS LDP-based network to Segment Routing. They want to ensure that existing LDP LSPs continue to work alongside SR LSPs during the migration. Which mechanism should be configured?

A.SRGB

B.BGP-LU

C.LDP-SR interworking

D.MPLS TE

AnswerC

This enables coexistence of LDP and SR LSPs.

Why this answer

LDP-SR interworking (RFC 8661) allows LDP and Segment Routing LSPs to coexist and interoperate during migration. It enables LDP-signaled LSPs to stitch with SR LSPs by mapping LDP labels to SR prefix-SIDs, ensuring end-to-end MPLS forwarding without service disruption. This mechanism is specifically designed for seamless coexistence without requiring a full network cutover.

Exam trap

Cisco often tests the misconception that SRGB or BGP-LU alone can enable coexistence, but only LDP-SR interworking provides the explicit label mapping and signaling integration required for LDP and SR LSPs to interoperate.

How to eliminate wrong answers

Option A is wrong because SRGB (Segment Routing Global Block) defines the label range for SR prefix-SIDs but does not provide any interworking or coexistence mechanism with LDP. Option B is wrong because BGP-LU (BGP Labeled Unicast) is a separate method for distributing MPLS labels via BGP, not a mechanism for interworking between LDP and SR LSPs. Option D is wrong because MPLS TE (Traffic Engineering) focuses on explicit path control and resource reservation, not on enabling LDP and SR LSPs to work together.

Practice this question →

148

MCQmedium

A service provider is experiencing suboptimal routing due to BGP route reflection. To improve path selection while maintaining IBGP scalability, which feature should be implemented?

A.BGP deterministic med

B.BGP next-hop-self

C.BGP optimal route reflection (ORR)

D.BGP add-path

AnswerC

ORR enables route reflectors to select the best path based on the client's IGP metric.

Why this answer

BGP optimal route reflection (ORR) improves path selection by allowing the route reflector to calculate the best path based on the IGP metric to the client's location, rather than using its own BGP table. This overcomes the suboptimal routing caused by standard route reflection, where the RR's best path may not be optimal for all clients, while still maintaining IBGP scalability by avoiding a full mesh.

Exam trap

Cisco often tests the distinction between features that improve path diversity (like add-path) versus features that improve path selection optimality (like ORR), leading candidates to confuse BGP add-path as a solution for suboptimal routing caused by route reflection.

How to eliminate wrong answers

Option A is wrong because BGP deterministic MED only ensures consistent MED comparison across paths from different ASs, but does not address the suboptimal routing caused by route reflection's path selection based on the RR's perspective. Option B is wrong because next-hop-self changes the next-hop attribute to the router's own IP, which is useful for reachability but does not improve path selection for clients in a route reflection topology. Option D is wrong because BGP add-path allows advertising multiple paths for the same prefix, but it does not directly optimize the best path selection per client; it increases path diversity but requires additional configuration and does not inherently fix suboptimal routing from route reflection.

Practice this question →

149

Multi-Selecthard

An engineer is configuring LDP in an MPLS network. Which THREE are valid label distribution modes for LDP?

Select 3 answers

A.Downstream on Demand with Independent Label Distribution Control

B.Downstream Unsolicited with Conservative Label Retention

C.Downstream Unsolicited with Liberal Label Retention

D.Downstream Unsolicited with Ordered Label Distribution Control

E.Downstream on Demand with Liberal Label Retention

AnswersA, B, C

This is a valid combination.

Why this answer

Downstream on Demand (DoD) with Independent Label Distribution Control allows a router to request a label mapping only when needed and to advertise bindings independently, as defined in RFC 5036. Option B is correct because Downstream Unsolicited (DU) with Conservative Label Retention means a router learns all label mappings but only stores those for routes it actively uses, which is a supported mode in MPLS LDP implementations. Option C is correct because Downstream Unsolicited with Liberal Label Retention is the default and most common mode, where a router stores all label mappings received from neighbors.

Options D and E are incorrect because Ordered Label Distribution Control is typically used with DoD, not DU, and Liberal Label Retention is rarely paired with DoD due to resource waste.

Exam trap

Cisco often tests the misconception that Ordered Label Distribution Control can be paired with Downstream Unsolicited mode, but Ordered control is only valid with Downstream on Demand in LDP specifications.

Practice this question →

150

MCQmedium

A service provider is deploying L3VPN. Which mechanism ensures that customer routes are isolated and not leaked between different customers?

A.Route target (RT)

B.Route distinguisher (RD)

C.VRF

D.MPLS labels

AnswerC

Correct. VRF provides isolated routing tables per customer.

Why this answer

VRF (Virtual Routing and Forwarding) instances provide separate routing tables per customer, ensuring isolation in L3VPN.

Practice this question →

← PreviousPage 2 of 4 · 232 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Architecture questions.

Start 20-question session