75 of 232 questions · Page 3/4 · Architecture · Answers revealed
Which Cisco router platform is designed for the core/backbone of a service provider network, supporting high-density 100GE interfaces and massive scale for MPLS and Segment Routing?
CRS is designed for core/backbone roles.
Why this answer
The Cisco CRS (Carrier Routing System) is a core router platform with high-density interfaces and large scale for MPLS and Segment Routing.
In the context of IOS XR commit/rollback configuration model, which command is used to apply a set of configuration changes as a single atomic operation?
'commit' atomically applies configuration changes in IOS XR.
Why this answer
The 'commit' command applies changes atomically; if any part fails, the entire commit is rejected.
In IOS XR, each routing protocol runs as a separate process. What is the primary benefit of this architecture?
Each protocol runs independently, so a crash in one does not impact others.
Why this answer
Process separation prevents a failure in one protocol from affecting others, enhancing overall system stability.
Which TWO of the following are characteristics of the IOS XR operating system architecture? (Select two.)
Changes are staged and committed.
Why this answer
IOS XR features a distributed OS and a commit/rollback configuration model.
A large ISP is designing a multicast architecture to support IPTV, requiring high availability and minimal traffic convergence. Which RP placement design is most appropriate?
Provides load balancing and fast failover.
Why this answer
Anycast-RP with multiple RPs sharing the same IP address is the most appropriate design for a large ISP supporting IPTV because it provides high availability and load sharing without a single point of failure. In the event of an RP failure, traffic automatically converges to the nearest surviving RP using the same anycast address, minimizing disruption. This design also avoids the convergence delays inherent in dynamic RP discovery protocols like Auto-RP or BSR.
Exam trap
Cisco often tests the misconception that dynamic RP protocols (Auto-RP or BSR) inherently provide high availability, but the trap here is that they still rely on a single active RP unless combined with Anycast-RP, which is the only option that eliminates the single RP failure point.
How to eliminate wrong answers
Option A is wrong because a single static RP creates a single point of failure; if the core router fails, all multicast forwarding stops until manual intervention, which violates the high availability requirement. Option B is wrong because Auto-RP with one RP mapping agent introduces a single point of failure for RP discovery and relies on dense-mode flooding, which can cause unnecessary traffic overhead and slower convergence. Option D is wrong because BSR with one candidate RP still has a single RP that, if it fails, requires BSR election and re-advertisement, leading to longer convergence times compared to Anycast-RP's immediate failover.
A service provider is implementing EVPN with MPLS data plane. Which encapsulation type is used in MPLS EVPN to carry Ethernet frames across the MPLS network?
The control word is used to preserve the Ethernet frame integrity.
Why this answer
In MPLS EVPN, Ethernet frames are carried across the MPLS network using an MPLS label stack that includes a control word. The control word (4 bytes) is inserted between the MPLS label stack and the Ethernet frame to prevent misordering and to enable proper frame delineation. This encapsulation is defined in RFC 8214 (formerly RFC 7432) and is distinct from older EoMPLS or simple IP/MPLS tunneling.
Exam trap
Cisco often tests the distinction between the EVPN control plane (RFC 7432) and the MPLS data-plane encapsulation (RFC 8214), leading candidates to incorrectly select 'EVPN encapsulation defined by IETF RFC 7432' as the encapsulation type.
How to eliminate wrong answers
Option A is wrong because Ethernet over MPLS (EoMPLS) with VLAN encapsulation is a Layer 2 VPN technology that uses a single label and does not support the EVPN control plane or the multi-homing, MAC learning, and split-horizon features of EVPN. Option C is wrong because EVPN encapsulation is not defined by IETF RFC 7432; RFC 7432 defines the EVPN control plane and procedures, while the actual MPLS data-plane encapsulation (including the control word) is specified in RFC 8214. Option D is wrong because an IP/MPLS tunnel with an Ethernet frame inside describes a generic L2TPv3 or IP-based tunneling approach, not the specific MPLS label stack with control word required for EVPN over MPLS.
Which TWO are functions of the MPLS data plane?
Pushing a label is a data plane operation.
Why this answer
The MPLS data plane is responsible for the actual forwarding of packets based on labels. At the ingress LSR, the data plane performs a label push operation, which involves inserting a new MPLS label (or a stack of labels) onto the incoming IP packet before forwarding it into the MPLS domain. This action is a fundamental data-plane function, as it directly manipulates the packet header to enable label switching.
Exam trap
Cisco often tests the distinction between control plane and data plane functions, and the trap here is that candidates mistakenly associate label distribution (LDP) or routing protocol operations (BGP, OSPF) with the data plane, when in fact they are control plane processes that support but do not execute packet forwarding.
Which THREE are benefits of implementing MPLS-TE in a service provider core?
TE tunnels can be provisioned with bandwidth reservations.
Why this answer
MPLS-TE allows operators to reserve bandwidth along explicit paths using RSVP-TE signaling, ensuring that specific traffic flows receive guaranteed bandwidth. This is achieved through bandwidth reservation and admission control, which prevents oversubscription on TE tunnels.
Exam trap
Cisco often tests the misconception that MPLS-TE reduces routing table size or natively supports multicast, but these are not inherent benefits of the technology.
A service provider needs to offer L3VPN services to multiple customers, each with overlapping IP addresses. The provider plans to use MPLS VPNs with VRFs. Which statement is TRUE regarding the configuration of VRFs on the PE routers?
RTs determine which VRFs receive which routes, allowing overlapping addresses.
Why this answer
Route targets (RTs) are used on PE routers to control which VPNv4 routes are imported into a VRF and which routes from a VRF are exported to MP-BGP. This allows proper segregation and connectivity for MPLS L3VPNs. Option A is incorrect because VRF-to-CE routing can use any protocol, not just OSPF.
Option C is incorrect because MPLS labels are automatically assigned per VRF by the router, not manually per prefix. Option D is incorrect because the route distinguisher (RD) only needs to be unique per VRF on a single PE router; it can be the same across different PE routers if the RTs are configured correctly.
Match each MPLS VPN technology to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Uses BGP to distribute VPN routes between PE routers
Emulates Layer 2 services like Ethernet or ATM over MPLS
Multipoint Layer 2 VPN that simulates an Ethernet LAN
Point-to-point Layer 2 VPN providing pseudowire connectivity
Multicast VPN that supports IP multicast over MPLS
Why these pairings
MPLS provides multiple VPN services: Layer 3 VPNs use BGP for route exchange, Layer 2 VPNs emulate L2 circuits, TE controls traffic paths, and Inter-AS extends connectivity across providers. Common confusions involve swapping the L2 and L3 definitions.
Which access technology uses a passive optical splitter to deliver broadband services to multiple subscribers over a single fiber?
GPON is a passive optical network with optical splitters.
Why this answer
GPON (Gigabit Passive Optical Network) uses passive splitters to share fiber among multiple subscribers.
Which TWO of the following are advantages of segment routing over traditional LDP-based MPLS? (Choose two.)
SR uses IGP extensions instead of LDP.
Why this answer
Segment routing (SR-MPLS) eliminates the need for the LDP protocol by encoding MPLS labels directly in the IGP (e.g., OSPF or IS-IS) using extensions like RFC 8665 and RFC 8667. This simplifies the control plane by removing an entire protocol (LDP) and its associated state, reducing operational complexity and convergence time.
Exam trap
Cisco often tests the misconception that segment routing eliminates the IGP entirely, but in reality, SR relies on the IGP to distribute SIDs, so the IGP is still required.
Which MPLS-based service provides point-to-point Ethernet connectivity over a service provider network, emulating a wire?
Correct. VPWS provides point-to-point pseudowire.
Why this answer
VPWS (Virtual Private Wire Service) is a pseudowire that provides point-to-point L2VPN connectivity, emulating a physical wire.
A customer is experiencing intermittent packet loss in an MPLS L3VPN network. The PE routers show no errors on interfaces. Which tool can help isolate the issue by showing the complete path a packet takes through the MPLS network?
MPLS traceroute displays the label stack at each hop along the LSP.
Why this answer
MPLS traceroute (often implemented via LSP ping with the 'traceroute' option or the 'mpls traceroute' command) is the correct tool because it uses MPLS echo request/reply messages (RFC 8029) to traverse the label-switched path (LSP) hop by hop, revealing the exact label stack and transit LSRs. This allows identification of a failing or misbehaving node in the MPLS core that standard IP traceroute would not see, since IP traceroute relies on TTL expiry in the IP header, which may not occur in an MPLS network where labels are swapped and IP TTL is often copied from the label TTL.
Exam trap
Cisco often tests the distinction between MPLS ping (end-to-end LSP validation) and MPLS traceroute (hop-by-hop path discovery), and the trap here is that candidates confuse 'ping' with 'traceroute' and assume MPLS ping provides per-hop details, when it only confirms connectivity without revealing the intermediate path.
How to eliminate wrong answers
Option A is wrong because standard IP traceroute uses ICMP TTL-exceeded messages, which may not be generated by MPLS transit LSRs if they propagate the IP TTL from the MPLS label TTL, or if the LSRs are configured to not send ICMP for MPLS traffic, thus failing to reveal the MPLS path. Option B is wrong because ping (ICMP echo) only tests end-to-end reachability and cannot isolate which specific hop in the MPLS LSP is causing packet loss; it provides no per-hop visibility. Option D is wrong because MPLS ping (LSP ping) only verifies the end-to-end LSP connectivity and does not provide hop-by-hop path information; it will either succeed or fail, but cannot pinpoint the exact intermediate node where loss occurs.
A service provider is deploying Segment Routing Traffic Engineering (SR-TE) with a Path Computation Element (PCE). The PCE fails to compute a path for an SR-TE policy configured with constraint 'avoid nodes in affinity red'. The core network has red affinity assigned to several nodes. Which is the most likely cause?
PCE needs current IGP database to honor constraints; if not updated, it cannot compute paths with avoid conditions.
Why this answer
The PCE computes paths based on the link-state database (LSDB) it receives from the IGP (e.g., OSPF or IS-IS). If the LSDB does not include the affinity (color) attributes for the nodes, the PCE cannot evaluate the 'avoid nodes in affinity red' constraint. This results in a path computation failure, even though the affinities are correctly configured on the network devices.
Exam trap
Cisco often tests the misconception that a path computation failure is due to misconfigured affinities on the network devices, when in fact the root cause is the PCE lacking the updated link-state database with those affinity attributes.
How to eliminate wrong answers
Option B is wrong because the headend router's SR-TE policy configuration is irrelevant if the PCE cannot compute the path; the policy is the trigger for the PCE request, not the cause of the computation failure. Option C is wrong because if the PCE were unreachable, the headend would receive a connectivity error or timeout, not a path computation failure specific to the affinity constraint. Option D is wrong because a strict explicit path would be defined by the operator and would not involve the PCE computing a path with constraints; the PCE would simply validate the explicit path, not fail due to constraint evaluation.
Option E is wrong because the question states that the core network has red affinity assigned to several nodes, so the affinity is properly configured; the issue is that the PCE lacks the updated LSDB containing those affinity attributes.
An SP has configured MPLS TE tunnels for traffic engineering. To verify the status of the TE tunnels, which command provides the most relevant information?
This command summarizes TE tunnel states and is the primary verification tool.
Why this answer
The 'show mpls traffic-eng tunnels brief' command directly displays the status, state (up/down), and key parameters (e.g., bandwidth, path) of all configured MPLS TE tunnels, making it the most relevant command for verifying TE tunnel status. It provides a concise view of tunnel endpoints, admin/operational states, and signaled bandwidth, which is essential for traffic engineering verification.
Exam trap
Cisco often tests the distinction between LDP and RSVP-TE; candidates mistakenly think LDP is involved in TE tunnel signaling, but LDP is for label distribution in non-TE MPLS, while TE tunnels exclusively use RSVP-TE for path setup and bandwidth reservation.
How to eliminate wrong answers
Option A is wrong because 'show mpls forwarding-table' displays the LFIB (Label Forwarding Information Base) entries for all MPLS labels, not the status or configuration of TE tunnels; it shows how packets are forwarded based on labels, not tunnel state. Option B is wrong because 'show mpls ldp tunnels' is not a valid Cisco command; LDP (Label Distribution Protocol) does not manage TE tunnels—TE uses RSVP-TE for signaling, not LDP. Option D is wrong because 'show ip rsvp reservation' shows RSVP reservation state (e.g., bandwidth reservations) but does not provide the operational status or brief summary of MPLS TE tunnels; it is a lower-level RSVP command, not a TE tunnel verification tool.
Which TWO are key features of IOS XR architecture? (Choose two.)
Each process runs independently.
Why this answer
IOS XR is a distributed OS with process separation and a commit/rollback model. Monolithic kernel and shared memory are not features.
In Segment Routing over IPv6 (SRv6), what is the function of the SRH (Segment Routing Header)?
SRH contains a list of SIDs that define the forwarding path.
Why this answer
The Segment Routing Header (SRH) is a new IPv6 extension header defined in RFC 8754 that carries an ordered list of Segment Identifiers (SIDs). When a packet is forwarded along a segment-routed path, the SRH encodes the explicit path by listing each segment (node or adjacency SID) in sequence, and the active segment is updated as the packet traverses each hop. This allows the source node to steer packets through a specific path without intermediate nodes needing to maintain per-flow state.
Exam trap
Cisco often tests the distinction between the SRH's core function (carrying the segment list) and ancillary features like OAM or flow label usage, so candidates may incorrectly associate the SRH with monitoring or encoding mechanisms that are separate from its primary role.
How to eliminate wrong answers
Option A is wrong because the SRH does not replace the IPv6 header; it is an extension header that follows the fixed IPv6 header, and the IPv6 header remains intact with its source and destination addresses. Option C is wrong because while SRv6 can support OAM functions (e.g., via mechanisms like ping or traceroute using SIDs), the primary and defining function of the SRH is to carry the segment list, not to provide OAM capabilities. Option D is wrong because the IPv6 flow label is a separate 20-bit field in the IPv6 header used for flow classification and load balancing, not for encoding the path; the path is encoded in the SRH segment list.
Which Cisco platform is designed for the core/backbone of large service provider networks and offers high scalability with IOS XR?
CRS is the core router.
Why this answer
The Cisco CRS (Carrier Routing System) is a high-end core router designed for the backbone of large SP networks.
In IOS XR architecture, what is the purpose of Secure Domain Router (SDR)?
SDR provides fault isolation between virtual routers.
Why this answer
SDR logically partitions a physical router into multiple independent routers, each with its own control plane and resources.
Which MEF service type provides a multipoint-to-multipoint Ethernet virtual connection?
Correct. E-LAN is multipoint-to-multipoint.
Why this answer
E-LAN (Ethernet LAN) service provides multipoint-to-multipoint connectivity, as per MEF standards.
What is the primary function of the aggregation layer in a service provider network?
Aggregation layer consolidates access traffic.
Why this answer
The aggregation layer collects traffic from access nodes and forwards it to the core, often performing QoS, filtering, and subscriber management.
An SP is managing a large MPLS network and needs to verify the MPLS forwarding entries for a specific VRF. Which command provides the most complete information for the VRF?
Shows the complete LFIB for the VRF with inbound and outbound labels.
Why this answer
The 'show mpls forwarding-table vrf <name>' command displays the complete MPLS forwarding entries for a specific VRF, including the incoming label, outgoing label, next-hop, and outgoing interface. This command is specifically designed to verify MPLS label-switched paths (LSPs) for a VRF, which is essential for troubleshooting MPLS VPN forwarding. It provides the most complete information for MPLS forwarding, as it shows both the label operations (swap, pop, push) and the VRF-specific forwarding details.
Exam trap
Cisco often tests the distinction between control plane (BGP, CEF) and data plane (MPLS forwarding) commands, and the trap here is that candidates confuse 'show ip cef vrf' (which shows IP forwarding) with 'show mpls forwarding-table vrf' (which shows MPLS label forwarding), leading them to choose option A instead of the correct B.
How to eliminate wrong answers
Option A is wrong because 'show ip cef vrf <name>' displays the CEF (Cisco Express Forwarding) table for the VRF, which shows IP prefix and next-hop information but does not include MPLS label details such as incoming or outgoing labels. Option C is wrong because 'show mpls vrf <name>' is not a valid Cisco IOS command; the correct command for VRF-specific MPLS information is 'show mpls forwarding-table vrf <name>'. Option D is wrong because 'show bgp vpnv4 unicast all labels' displays BGP VPNv4 label information for all VRFs, but it shows only the labels advertised via BGP, not the complete MPLS forwarding entries (e.g., incoming labels, outgoing interfaces) for a specific VRF.
Which component of the IOS XR architecture is responsible for managing the system configuration and providing a separation of control plane for multiple tenants?
Default SDR (Secure Domain Router) handles configuration and control plane separation.
Why this answer
The Default Secure Domain Router (SDR) in IOS XR manages the system configuration and provides logical separation of the control plane for multiple tenants. Other options: XR Config Manager is a tool for configuration management but not for tenant separation; Admin Plane handles administrative functions like system monitoring; LRO (Label Rewrite Engine) is used for label switching operations, unrelated to configuration or tenant separation.
Which TWO are essential components for deploying EVPN in a service provider network?
EVPN requires an overlay for traffic forwarding.
Why this answer
A is correct because EVPN requires an overlay tunnel encapsulation to transport Layer 2 frames across the IP/MPLS underlay. VXLAN (RFC 7348) and MPLS (RFC 7432) are the two primary encapsulations used to carry Ethernet frames over the overlay, enabling MAC address learning and forwarding in the EVPN control plane.
Exam trap
Cisco often tests the misconception that a specific underlay protocol (like OSPF) is mandatory for EVPN, when in fact only the overlay encapsulation and BGP control plane are essential, while the underlay can be any IP-routed network.
Which MPLS-based service provides point-to-point Ethernet connectivity over a service provider network, also known as a pseudowire?
VPWS is the correct point-to-point service.
Why this answer
VPWS (Virtual Private Wire Service) is a point-to-point L2VPN service that emulates a wire, also called a pseudowire.
An SP is using NETCONF with YANG to automate VRF provisioning. The engineer notices that the NETCONF session is established but configuration changes are not applied. Which issue is most likely?
If :candidate is not advertised, the device does not support candidate datastore, and edit-config with candidate fails.
Why this answer
NETCONF uses datastores to manage configuration. The `:candidate` capability allows changes to be made to a candidate configuration before committing them. If this capability is not advertised, the device defaults to the `:writable-running` capability, which requires changes to be applied directly to the running datastore.
Since the engineer is likely using a candidate-based workflow (e.g., `edit-config` with target `candidate`), the session establishes but changes are silently ignored or rejected because the device does not support a separate candidate datastore.
Exam trap
Cisco often tests the distinction between NETCONF capabilities (like `:candidate`) and YANG model compatibility, leading candidates to incorrectly blame the YANG model or user permissions when the real issue is a missing capability advertisement.
How to eliminate wrong answers
Option A is wrong because YANG models define data structures, not datastore support; the target datastore (e.g., candidate) is a NETCONF capability issue, not a YANG model limitation. Option C is wrong because the `:url` capability is used for referencing remote files (e.g., via FTP or HTTP) in operations like `copy-config`, and its absence would not prevent configuration changes via standard `edit-config`. Option D is wrong because the user's write access is irrelevant if the device does not advertise the `:candidate` capability; without the capability, the candidate datastore does not exist as a writable target.
A service provider wants to provide a point-to-point Ethernet service between two customer sites with strict Service Level Agreements (SLAs). Which MEF service type should be used?
E-Line provides point-to-point Ethernet connectivity.
Why this answer
E-Line is a MEF standard for point-to-point Ethernet services, providing dedicated bandwidth and SLA guarantees.
Which TWO of the following are characteristics of MPLS L3VPN architecture? (Choose two.)
VRF is essential for L3VPN isolation.
Why this answer
In MPLS L3VPN, each customer is assigned a separate Virtual Routing and Forwarding (VRF) instance on the Provider Edge (PE) router. This VRF maintains a unique routing table and forwarding table per customer, ensuring complete isolation between different VPN customers on the same PE.
Exam trap
Cisco often tests the misconception that LDP is mandatory for MPLS L3VPN, but in reality, any label distribution protocol (LDP, RSVP-TE, or SR-MPLS) can be used in the core.
An engineer is configuring QoS on a service provider edge router to prioritize real-time traffic. Which queuing mechanism provides the lowest latency and jitter for voice traffic?
LLQ combines strict priority queue with CBWFQ for real-time traffic.
Why this answer
LLQ (Low Latency Queuing) is the correct choice because it combines a strict priority queue with CBWFQ, ensuring that voice traffic is always served before any other queue. This strict priority scheduling minimizes both latency and jitter for real-time traffic, which is critical for voice quality.
Exam trap
Cisco often tests the distinction between queuing mechanisms and congestion avoidance, so candidates may mistakenly choose WRED (a drop mechanism) or CBWFQ (which lacks strict priority) instead of LLQ for real-time traffic.
How to eliminate wrong answers
Option A is wrong because FIFO (First In, First Out) provides no traffic differentiation or priority, so voice packets can be delayed by large data packets, increasing latency and jitter. Option B is wrong because CBWFQ (Class-Based Weighted Fair Queuing) assigns bandwidth weights to classes but does not include a strict priority queue, so voice traffic may still experience queuing delays. Option C is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that drops packets to prevent tail drops, not a queuing mechanism, and it does not provide low latency or jitter for voice traffic.
A service provider is troubleshooting BGP route selection for prefixes received from two different peers. The first peer prepends its AS path twice, making it longer than the second peer's path. However, the router still prefers the route with the longer AS path. Which additional attribute could cause this behavior?
Local preference is the first criterion in BGP path selection; a higher value will be chosen regardless of AS path length.
Why this answer
BGP selects the best path based on a sequence of comparison steps. The first step after considering the next-hop reachability is to prefer the route with the highest weight (Cisco proprietary), then the highest local preference. Since the router prefers the longer AS path, a higher local preference (option D) on the first peer's route overrides the shorter AS path of the second peer, as local preference is evaluated before AS path length in the BGP best-path selection algorithm.
Exam trap
Cisco often tests the order of BGP path selection attributes, and the trap here is that candidates mistakenly think AS path length is always the deciding factor, forgetting that local preference (or weight) is evaluated first and can override a shorter AS path.
How to eliminate wrong answers
Option A is wrong because a lower MED (Multi-Exit Discriminator) is compared only if the paths are from the same neighboring AS, and it is evaluated after AS path length; a lower MED would not cause a longer AS path to be preferred. Option B is wrong because a higher weight is the first criterion in Cisco's BGP best-path selection and would cause the route to be preferred regardless of AS path length, but the question states the router prefers the route with the longer AS path, implying weight is not the overriding factor here (or weight is equal). Option C is wrong because a lower origin type (IGP < EGP < incomplete) is compared after AS path length; a lower origin could not override a shorter AS path.
Option E is wrong because a lower neighbor router ID is used only as a tiebreaker after all other steps, including AS path length, and would not cause a longer AS path to be preferred.
A service provider wants to automate service provisioning using NSO. Which protocol is typically used by NSO to configure network devices?
Correct. NETCONF is used for configuration management with YANG models.
Why this answer
NSO uses NETCONF as the primary protocol for device configuration, leveraging YANG models for service modeling.
Which TWO are benefits of using EVPN over traditional VPLS for L2VPN services? (Choose two.)
EVPN uses BGP to advertise MAC routes.
Why this answer
EVPN offers better control plane (BGP) and supports multi-homing with all-active load balancing.
Which THREE are MEF-defined Ethernet service types? (Choose three.)
Multipoint-to-multipoint Ethernet service.
Why this answer
MEF defines E-Line, E-LAN, and E-Tree. E-Access is also defined but is not part of the three main types. E-WAN is not a standard MEF service.
An SP network uses NTP for synchronization. To secure NTP, which authentication mode should be used?
NTPv4 autokey provides strong cryptographic authentication.
Why this answer
NTPv4 autokey (Option A) is the correct answer because it provides a secure, automated key distribution mechanism using public-key cryptography (RFC 5906). This eliminates the need for manual key exchange, making it the recommended authentication mode for securing NTP in service provider networks.
Exam trap
Cisco often tests the distinction between NTPv3 symmetric key (manual) and NTPv4 autokey (automated), leading candidates to incorrectly choose symmetric key because they overlook the 'secure' requirement in the question.
How to eliminate wrong answers
Option B is wrong because NTPv3 symmetric key uses pre-shared keys that must be manually distributed and updated, which is operationally burdensome and less secure in large SP environments. Option C is wrong because NTPv4 with SHA-1 is not a defined authentication mode; NTPv4 supports SHA-1 only as a hash algorithm within the autokey framework, not as a standalone mode. Option D is wrong because NTPv4 with MD5 is deprecated due to known vulnerabilities in the MD5 algorithm, and Cisco recommends against using MD5 for NTP authentication.
In an MPLS VPN environment, which address family is used to exchange VPNv4 routes between PE routers?
VPNv4 carries both IPv4 prefixes and route distinguishers.
Why this answer
In an MPLS VPN environment, VPNv4 routes (which include both the IPv4 prefix and the Route Distinguisher) are exchanged between Provider Edge (PE) routers using the VPNv4 unicast address family under the BGP configuration. This address family allows PE routers to carry customer routes with unique RD values, enabling address overlap across different VPNs.
Exam trap
Cisco often tests the distinction between the address family used for route exchange (VPNv4 unicast) and the community attribute (Route Target) that controls route distribution, leading candidates to mistakenly select Route-target as the answer.
How to eliminate wrong answers
Option A is wrong because Route-target (RT) is a BGP extended community attribute used to control the import/export of VPN routes into VRFs, not an address family for exchanging routes. Option B is wrong because IPv4 unicast is the standard address family for exchanging global IPv4 routes, but it lacks the Route Distinguisher (RD) necessary to differentiate overlapping customer prefixes in an MPLS VPN. Option C is wrong because VPNv6 unicast is used for exchanging IPv6 VPN routes (VPNv6) between PE routers, not for VPNv4 routes.
What is the function of the admin plane in IOS XR architecture?
Correct. The admin plane manages SDR creation and system-level configuration.
Why this answer
The admin plane is a separate management context for administrative tasks such as configuring SDRs, managing hardware, and system-level settings. It provides isolation from the default SDR.
A service provider is designing a network to support mobile backhaul for eMBB, uRLLC, and mMTC services. Which technology allows the physical network to be divided into virtual networks with dedicated resources for each service type?
Network slicing is the correct technology.
Why this answer
Network slicing enables multiple virtual networks on a shared physical infrastructure, each with tailored performance characteristics.
Which THREE are benefits of using EVPN over traditional VPLS? (Choose three.)
EVPN advertises MACs via BGP, allowing mobility.
Why this answer
EVPN offers BGP-based control plane, multi-homing support, and MAC mobility. VPLS traditionally uses LDP and does not natively support multi-homing or MAC mobility as effectively.
A service provider is building a new network slicing architecture to offer differentiated services to enterprise customers. The architecture uses SRv6 with network slices identified by slice IDs embedded in the SRv6 SID. The underlay is an IP network with ISIS. Each slice will have dedicated resources in the core, including guaranteed bandwidth and low latency. The plan is to use the SRv6 network programming concept to steer traffic into different slices. The provider wants to ensure that slice isolation is maintained end-to-end, including at the egress PE where traffic is handed off to the customer. However, during testing, they observe that traffic from one slice is incorrectly entering another slice's queue on an intermediate node, causing performance interference. The intermediate node is a transit router that does not terminate SRv6 but performs 'SID-based forwarding'. Which mechanism is most likely missing to ensure slice isolation on transit nodes?
Correct. Transit nodes need to recognize the slice ID and apply appropriate queuing; otherwise, slices compete for resources.
Why this answer
Transit nodes must have per-slice QoS policies that map the slice ID (carried in the SID) to dedicated queue resources. Without such policies, all traffic may be mapped to a default queue, breaking isolation. The SID can indeed carry the slice ID; egress PE stripping or ingress PE misconfiguration would affect other nodes, not specifically transit.
A network engineer is configuring MPLS LDP on a new router. After enabling LDP globally and on the interface, the LDP session does not establish. The IGP (OSPF) is fully operational. What should the engineer verify first?
This is the most basic verification; if MPLS is not enabled on the interface, LDP will not form.
Why this answer
The most common reason LDP fails to establish after global and interface configuration is that the interface is not enabled for MPLS forwarding. The command 'mpls ip' on the interface is required to activate LDP hello messages and label binding on that link. Without it, LDP remains disabled on the interface even if LDP is enabled globally and OSPF is working.
Exam trap
Cisco often tests the distinction between enabling LDP globally versus enabling it on the interface, trapping candidates who assume global configuration alone is sufficient for LDP to operate on all interfaces.
How to eliminate wrong answers
Option A is wrong because LDP password authentication is optional and not required for session establishment; it is only used if configured on both peers. Option B is wrong because while a loopback router-id is recommended for stability, LDP can use any IP address as its router-id, including a physical interface IP, and the session can still establish. Option C is wrong because the IGP metric does not affect LDP session establishment; LDP relies on IGP for reachability but not on the metric value itself.
A network engineer needs to design a multicast solution for IPTV distribution across a service provider network. Which protocol is best suited for building a shared distribution tree where the RP is dynamically elected?
BSR provides dynamic RP election in a standards-based way.
Why this answer
PIM-SM with BSR (Bootstrap Router) is the correct choice because it provides a dynamic, automated mechanism for electing an RP (Rendezvous Point) within a PIM-SM domain. BSR uses a distributed election process where candidate BSRs exchange bootstrap messages to elect a single BSR, which then collects candidate-RP advertisements and distributes the RP-set to all routers, enabling shared distribution trees without manual RP configuration.
Exam trap
Cisco often tests the distinction between Auto-RP and BSR, where candidates mistakenly think Auto-RP dynamically elects the RP, but Auto-RP only advertises RP information from a statically configured RP or mapping agent, whereas BSR provides true dynamic RP election through a distributed bootstrap process.
How to eliminate wrong answers
Option A is wrong because PIM-DM (Dense Mode) uses a flood-and-prune approach to build source-based trees, not shared trees, and does not involve an RP or dynamic RP election. Option B is wrong because PIM-SM with Auto-RP uses a separate, statically configured RP (or a mapping agent) to advertise RP information, but it does not dynamically elect the RP itself; Auto-RP relies on a designated RP or a mapping agent, which is not a fully dynamic election mechanism like BSR. Option C is wrong because MSDP (Multicast Source Discovery Protocol) is used to interconnect multiple PIM-SM domains by sharing active source information between RPs, not for building a shared distribution tree or dynamically electing an RP within a single domain.
A service provider is migrating from LDP to Segment Routing (SR) in the core. They need to support MPLS forwarding without maintaining LDP sessions. Which SR data plane is appropriate?
Correct. SR-MPLS uses IGP to advertise labels, no LDP needed.
Why this answer
Segment Routing with MPLS data plane (SR-MPLS) uses IGP to distribute labels, eliminating the need for LDP. SR-MPLS is the direct replacement for LDP in MPLS networks.
In IOS XR, what is the commit/rollback configuration model?
This is the correct description.
Why this answer
The commit/rollback model applies changes atomically and allows reverting to previous configurations if needed.
An engineer notices that an MPLS LSP in the core is not establishing. Which troubleshooting step should be performed first?
LDP adjacency is essential for label exchange and LSP building.
Why this answer
The first step in troubleshooting an MPLS LSP that is not establishing is to verify LDP neighbor adjacency because LDP is the protocol responsible for distributing labels across the MPLS domain. Without a working LDP session between adjacent LSRs, label bindings cannot be exchanged, and the LSP cannot be built. This is the foundational layer for MPLS forwarding, so it must be checked before higher-layer issues like routing or reachability.
Exam trap
Cisco often tests the misconception that checking IGP adjacency (OSPF) is the first step, but LDP depends on IGP for reachability, not adjacency; the trap is that candidates confuse routing protocol adjacency with label distribution protocol adjacency.
How to eliminate wrong answers
Option B is wrong because pinging the far-end loopback interface tests IP reachability, not the MPLS label-switched path; a successful ping can occur even if LDP is broken if the router uses IP forwarding. Option C is wrong because BGP IPv4 unicast neighbors are used for exchanging routing information, not for MPLS label distribution; LDP or RSVP-TE handles label binding. Option D is wrong because while OSPF adjacency is necessary for IGP routing, it does not directly affect LDP session establishment; LDP can fail even if OSPF is fully converged.
Which THREE are characteristics of EVPN? (Choose three.)
Correct. EVPN supports all-active and single-active.
Why this answer
EVPN uses BGP control plane, supports multi-homing with ESI, and can provide both L2 and L3 services. It does not use LDP for signaling; it uses BGP. VPLS is older.
Drag and drop the steps to configure OSPF on a Cisco IOS router into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
OSPF configuration requires entering global config mode, enabling the OSPF process, and then advertising networks under the OSPF process.
A metro Ethernet provider needs to scale customer VLANs beyond the 4,096 limit by encapsulating customer VLAN tags with an outer service provider tag. Which IEEE standard is used?
802.1ad allows double tagging with an outer service provider tag.
Why this answer
Q-in-Q (802.1ad) adds an outer VLAN tag to extend VLAN space. 802.1ah is for MAC-in-MAC, 802.1Q is the basic standard, and 802.1ak is not related.
Which QoS mechanism is most effective for preventing congestion on a service provider edge link when traffic exceeds the link capacity?
Shapes traffic to avoid line-rate bursts and drops.
Why this answer
Traffic shaping is the most effective QoS mechanism for preventing congestion on a service provider edge link when traffic exceeds link capacity because it buffers excess packets and smooths the transmission rate to match the configured committed information rate (CIR). Unlike policing, which drops or re-marks packets, shaping avoids tail drops and packet loss by queuing bursts, making it ideal for edge links where preserving traffic integrity is critical. Cisco IOS uses the Generic Traffic Shaping (GTS) or Class-Based Shaping (CB-Shaping) to enforce a rate limit while maintaining TCP fairness and reducing retransmissions.
Exam trap
Cisco often tests the distinction between congestion management (queuing/scheduling) and congestion avoidance (WRED) versus rate limiting (policing/shaping), and the trap here is that candidates confuse policing (which drops) with shaping (which buffers), or assume WRED prevents congestion rather than just avoiding tail drops.
How to eliminate wrong answers
Option A is wrong because priority queuing (PQ) provides strict priority scheduling, not congestion prevention; it can cause starvation of lower-priority queues when traffic exceeds capacity, leading to packet loss for non-priority traffic. Option B is wrong because traffic policing drops or re-marks packets that exceed the configured rate, which can cause TCP global synchronization and excessive retransmissions, making it unsuitable for preventing congestion on an edge link where preserving traffic is preferred. Option D is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that proactively drops packets before queues fill, but it does not limit the overall traffic rate to prevent congestion; it only manages queue depth and cannot stop traffic from exceeding link capacity.
Refer to the exhibit. This JSON policy is used for Segment Routing Traffic Engineering. What is the purpose of the 'color' attribute?
Color is used to match traffic via color-based forwarding.
Why this answer
In Segment Routing Traffic Engineering (SR-TE), the 'color' attribute is a 32-bit numerical value that, combined with the destination prefix, uniquely identifies an SR-TE policy. This allows traffic to be steered into a specific policy based on color, enabling advanced traffic engineering use cases such as multi-topology routing or service-level agreement (SLA) differentiation.
Exam trap
The trap here is that candidates confuse the 'color' attribute with the 'preference' value, as both are numerical values used in SR-TE policy selection, but 'color' identifies the policy itself while 'preference' selects among candidate paths within that policy.
How to eliminate wrong answers
Option A is wrong because the metric type for path calculation is set via the 'metric' sub-object within the candidate path, not by the 'color' attribute. Option B is wrong because the preference value for a candidate path is defined by the 'preference' field inside the candidate path list, not by 'color'. Option D is wrong because link affinity constraints are specified using the 'affinity' object under constraints, not by the 'color' attribute.
A service provider is deploying Segment Routing Traffic Engineering (SR-TE) to optimize traffic flows. Which mechanism is used to steer traffic into an SR-TE policy?
The color community is the standard way to steer traffic into an SR-TE policy.
Why this answer
In Segment Routing Traffic Engineering (SR-TE), traffic is steered into an SR-TE policy using a color extended community attached to BGP routes. The color community acts as a service-level identifier that maps BGP-learned prefixes to a specific SR-TE policy on the headend router, enabling automated traffic engineering without per-flow state or tunnel interfaces.
Exam trap
The trap here is that candidates often confuse the color extended community with BGP communities used for routing policy (e.g., route maps) or assume that SR-TE requires explicit tunnel interfaces like RSVP-TE, when in fact the color community is the key steering mechanism in SR-TE.
How to eliminate wrong answers
Option A is wrong because RSVP-TE tunnel interfaces are a legacy MPLS-TE mechanism that requires per-tunnel signaling and state, whereas SR-TE uses segment lists and does not rely on RSVP-TE. Option C is wrong because BGP prefix-independent convergence (PIC) is a fast-convergence technique for BGP route failures, not a mechanism for steering traffic into an SR-TE policy. Option D is wrong because manual static routes pointing to a policy are not a standard or scalable method; SR-TE policies are dynamically selected via BGP color communities or explicit policy configuration, not static routes.
Option E is wrong because LDP label distribution is used for label-switched path setup in traditional MPLS, not for steering traffic into SR-TE policies, which use segment routing labels (MPLS or SRv6).
A service provider is designing a new MPLS L3VPN service. The customer requires that their VPN traffic be isolated from other customers and that the provider edge routers maintain separate routing tables for each VPN. Which architectural component is essential for this separation?
VRF creates separate routing tables per VPN instance, enabling isolation.
Why this answer
VRF (Virtual Routing and Forwarding) is the essential architectural component that enables a provider edge router to maintain separate, isolated routing tables for each VPN customer. Each VRF instance contains its own routing table, CEF (Cisco Express Forwarding) table, and associated interfaces, ensuring that traffic from one customer is never forwarded using another customer's routing information. This per-VPN isolation is fundamental to MPLS L3VPN services as defined in RFC 4364.
Exam trap
Cisco often tests the distinction between data-plane isolation (VLANs, MPLS labels) and control-plane isolation (VRF), and the trap here is that candidates confuse VLAN tagging (Layer 2) with the Layer 3 routing table separation provided by VRFs, assuming VLANs alone can achieve the required routing isolation.
How to eliminate wrong answers
Option A is wrong because MPLS label stacking is a forwarding mechanism used to separate transport labels from service labels in an MPLS network, but it does not create or maintain separate routing tables per VPN; it operates at the data plane, not the control plane. Option C is wrong because VLAN tagging on customer-facing interfaces provides Layer 2 segmentation (802.1Q) but does not create separate Layer 3 routing tables; a single VLAN can still be mapped to a single VRF, but VLANs alone cannot isolate routing information. Option D is wrong because BGP route reflectors are used to scale BGP route distribution within an MPLS VPN by reducing the number of iBGP sessions, but they do not provide per-VPN routing table isolation; they propagate VPNv4 routes that already carry the Route Distinguisher (RD) and Route Target (RT) attributes.
An SP is planning to offer L3VPN services. Which TWO components are essential for BGP/MPLS IP VPN operation?
VRF isolates routing per customer.
Why this answer
VRF (D) provides per-customer routing isolation, and MP-BGP with VPN-IPv4 address family (E) is used to exchange VPN routes between PEs. MPLS labels are used for data plane forwarding but are not considered control plane components for VPN operation.
In an SR network, which configuration is required to activate TI-LFA for link protection?
This command enables TI-LFA for all prefixes in the IGP domain.
Why this answer
TI-LFA (Topology Independent Loop-Free Alternate) is activated under the IGP process using the 'fast-reroute per-prefix ti-lfa' command. This enables segment routing to compute a backup path that provides link protection without relying on the topology of the failure, ensuring 50-msec convergence.
Exam trap
Cisco often tests the distinction between per-interface and per-process configuration; the trap here is that candidates might think TI-LFA is configured under the interface (like traditional MPLS-TE FRR) rather than under the IGP process.
How to eliminate wrong answers
Option A is wrong because 'metric delay interface configuration' is used for IGP metric propagation delays (e.g., 'metric delay' under OSPF or IS-IS), not for activating TI-LFA. Option B is wrong because 'label-preferred under the interface' is not a valid Cisco command; TI-LFA is configured at the IGP process level, not per interface. Option D is wrong because 'mpls traffic-eng auto-tunnel primary' is used for MPLS-TE auto-tunnel creation, not for TI-LFA link protection in an SR network.
An SP uses Cisco NSO for automation. Which protocol does NSO typically use to push configuration changes to network devices?
NETCONF is the standard protocol for NSO.
Why this answer
NSO uses NETCONF as the primary protocol to push configuration changes, leveraging YANG data models.
In an MPLS VPN, what label operation does the egress PE perform on the VPN packet before forwarding it to the CE?
The egress PE removes all labels and forwards the IP packet.
Why this answer
In an MPLS VPN, the egress PE (Provider Edge) router receives a packet with a label stack typically consisting of a transport label (IGP label) and a VPN label. Before forwarding the IP packet to the CE (Customer Edge), the egress PE must remove the entire MPLS label stack because the CE is an IP-only device that does not understand MPLS labels. This operation is called 'pop the label stack' (also known as penultimate hop popping, though at the egress PE it is explicit label removal).
Exam trap
Cisco often tests the distinction between label operations at different MPLS nodes; the trap here is confusing the egress PE's role with that of the ingress PE (which imposes labels) or a transit P router (which swaps labels), leading candidates to select 'Swap the top label' or 'Push a new label'.
How to eliminate wrong answers
Option A is wrong because swapping the top label is an operation performed by transit P routers (label switch routers) in the MPLS core, not by the egress PE when forwarding to the CE. Option B is wrong because imposing a VPN label is done by the ingress PE when encapsulating the original IP packet, not by the egress PE. Option D is wrong because pushing a new label would add another MPLS header, which is unnecessary and would confuse the CE router that expects a plain IP packet.
Option E is wrong because replacing the transport label is a function of intermediate P routers performing label swap, not the egress PE's final disposition.
Which MEF service type is used for multipoint-to-multipoint Ethernet connectivity, such as a corporate LAN extension across multiple sites?
E-LAN supports any-to-any communication.
Why this answer
E-LAN provides multipoint-to-multipoint connectivity, emulating a LAN across multiple locations.
An operator notices that a new MPLS-TE tunnel is not being established. The tunnel configuration includes a dynamic path option and a bandwidth of 100 Mbps. The network uses RSVP-TE with CSPF. The link-state database shows sufficient reservable bandwidth on all links along the calculated path. What is the most likely cause of the tunnel establishment failure?
RSVP-TE must be enabled on each interface along the path for signaling.
Why this answer
RSVP-TE must be explicitly enabled on every interface that will participate in MPLS-TE label-switched path (LSP) signaling. Even if the link-state database shows sufficient reservable bandwidth, without RSVP-TE enabled on transit interfaces, the PATH messages cannot be processed, and the tunnel will fail to establish. This is a common misconfiguration when deploying MPLS-TE.
Exam trap
Cisco often tests the distinction between having sufficient bandwidth in the link-state database (IGP) versus having RSVP-TE actually enabled on the interfaces, leading candidates to overlook the required interface-level RSVP configuration.
How to eliminate wrong answers
Option B is wrong because a dynamic path option does not use a strict explicit path; a strict explicit path would be configured under a different path option type, and the question states a dynamic path option is used. Option C is wrong because MPLS LDP is not required for MPLS-TE tunnels; RSVP-TE signals its own labels, and LDP is used for different label distribution purposes. Option D is wrong because if the tunnel source interface lacked an IP address, the tunnel would not even come up operationally, and the operator would likely notice that issue before attempting to establish the tunnel; the question focuses on RSVP-TE signaling failure.
In the context of network slicing for 5G, which type of slice is optimized for massive IoT with low data rates and high connection density?
mMTC supports massive IoT with high connection density.
Why this answer
Massive IoT corresponds to mMTC (massive Machine Type Communications) slice, designed for many devices with low data rates.
A service provider is implementing IPv6 transition in its core. Which transition mechanism is recommended for carrying IPv6 over an existing MPLS/IPv4 backbone without dual-stacking all routers?
6PE uses MPLS labels; only PEs need dual-stack.
Why this answer
6PE (IPv6 Provider Edge) is the correct answer because it allows IPv6 traffic to be carried over an existing MPLS/IPv4 backbone without requiring dual-stack on all core routers. In 6PE, only the Provider Edge (PE) routers need to be dual-stack; they encapsulate IPv6 packets in MPLS labels and transport them across the IPv4 MPLS core, which remains IPv4-only. This meets the requirement of not dual-stacking all routers while leveraging the existing MPLS infrastructure.
Exam trap
Cisco often tests the distinction between mechanisms that require dual-stack on all routers (like 6to4 or ISATAP) versus those that only require dual-stack on edge routers (like 6PE), so the trap here is assuming that any tunneling mechanism works without considering the MPLS core requirement.
How to eliminate wrong answers
Option A (ISATAP) is wrong because it is a site-to-site tunneling mechanism that requires dual-stack hosts and routers, and it does not integrate with MPLS or provide scalable carrier-grade transport over an existing MPLS/IPv4 backbone. Option B (NAT64) is wrong because it is a translation mechanism for IPv6-only clients to access IPv4 servers, not a method for carrying IPv6 traffic over an MPLS backbone, and it introduces stateful translation overhead. Option C (6to4 tunneling) is wrong because it uses automatic IPv6-in-IPv4 tunneling with a public 6to4 relay, which relies on IPv4 connectivity and does not leverage MPLS label switching; it also suffers from reliability issues and is not recommended for service provider core networks.
Which protocol is used to discover MPLS peers for LDP session establishment?
LDP hello messages are sent via UDP on port 646.
Why this answer
LDP uses UDP multicast (224.0.0.2) on port 646 to discover directly connected MPLS peers, as specified in RFC 5036. This allows LDP to dynamically find neighbors without manual configuration, using UDP for the initial discovery phase before establishing a TCP session for label exchange.
Exam trap
Cisco often tests the misconception that LDP uses TCP for discovery because TCP is used for the subsequent label exchange, but the initial peer discovery is explicitly UDP-based.
How to eliminate wrong answers
Option A is wrong because TCP is used for the reliable exchange of label bindings and session maintenance after discovery, not for the initial peer discovery. Option C is wrong because ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network, not for discovering MPLS peers. Option D is wrong because ICMP is used for error reporting and diagnostic functions (e.g., ping), not for LDP neighbor discovery.
An SP is designing a core network using Cisco CRS routers running IOS XR. They require process separation to ensure that a failure in the BGP process does not affect OSPF operations. Which IOS XR architectural feature provides this capability?
Correct. Each protocol runs as an independent process, ensuring fault isolation.
Why this answer
IOS XR uses a distributed OS where each protocol runs as a separate process (process separation). This prevents a crash in one protocol process from impacting others, enhancing stability.
Which access technology uses orthogonal frequency-division multiplexing (OFDM) and is commonly deployed for high-speed internet over copper telephone lines?
DSL uses copper telephone lines with OFDM.
Why this answer
VDSL2 and G.fast use OFDM, but DSL generally refers to xDSL technologies. However, the most common high-speed copper access is VDSL2, but the question is broad. The correct answer is DSL as a family.
An MPLS Traffic Engineering LSP fails to establish. The RSVP signaling shows 'PathErr: Admission Control Failure'. The link has sufficient bandwidth but the headend reports a lack of resources. What is the most likely cause?
Without 'ip rsvp bandwidth' command on the interface, RSVP cannot allocate resources.
Why this answer
The 'PathErr: Admission Control Failure' with 'lack of resources' despite sufficient link bandwidth indicates that RSVP has no reservable bandwidth on the interface. This occurs when the 'ip rsvp bandwidth' command is missing or set to 0, preventing RSVP from admitting any LSP even if the physical link has capacity. The headend correctly reports the failure because the interface-level RSVP resource pool is exhausted or unconfigured.
Exam trap
Cisco often tests the distinction between physical link bandwidth and RSVP reservable bandwidth, trapping candidates who assume 'sufficient bandwidth' on the link automatically means RSVP can admit the LSP.
How to eliminate wrong answers
Option A is wrong because the tunnel requesting more bandwidth than available would cause a different PathErr (e.g., 'Admission Control Failure' due to insufficient bandwidth on a specific link), but the question states the link has sufficient bandwidth and the headend reports lack of resources, pointing to a local RSVP configuration issue. Option B is wrong because a corrupted MPLS forwarding table would cause forwarding failures or label errors, not RSVP signaling failures like PathErr. Option C is wrong because an incorrect destination address would result in a 'PathErr: Bad Initial Subobject' or routing failure, not an admission control failure.
Option E is wrong because a strict explicit path that is impossible would generate a 'PathErr: Routing Problem' or 'PathErr: Bad Strict Node' during path computation, not an admission control failure at the headend.
A service provider offers IPTV services using multicast. The network uses Multicast VPN (MVPN) with Rosen GRE encapsulation (Profile 1) in an MPLS L3VPN environment. The Provider Edge (PE) routers participate in both the default MDT and data MDT for high-bandwidth streams. Recently, a new channel was added, and it uses a data MDT. The content server is attached to a PE that is acting as a multicast source. Other PEs are receivers. Upon adding the channel, some receivers report missing packets. The network engineer checks the PEs and notices that the data MDT group address is being advertised via BGP as an MDT SAFI route, but some PEs are not joining the data MDT. The source PE's multicast routing table shows that it believes data MDT is active. Which architecture issue is most likely preventing some PEs from joining the data MDT?
Correct. If the group is outside the configured range, the PE will not participate in that data MDT.
Why this answer
The data MDT group must be within the configured data-MDT group range on each PE; if not, the PE will ignore the BGP MDT SAFI route and not join the data MDT. Source PE IGMP joins are not relevant; default MDT issues are separate; PIM RP reachability might affect default MDT but not data MDT join if using SSM.
A service provider wants to offer a service where a customer site can communicate with multiple other sites in a full mesh over MPLS. Which L2VPN technology is most appropriate?
VPLS provides multipoint connectivity.
Why this answer
VPLS (Virtual Private LAN Service) provides multipoint-to-multipoint Ethernet connectivity over MPLS, emulating a LAN.
An ISP wants to create separate virtual networks over a shared physical infrastructure to serve mobile broadband (eMBB), IoT (mMTC), and mission-critical services (uRLLC). Which technology enables this segmentation with per-slice resource guarantees?
Network slicing provisions isolated virtual networks with dedicated resources.
Why this answer
Network slicing divides the physical network into multiple virtual networks, each with dedicated resources for different service types. L3VPN, MPLS-TE, and VPLS do not provide per-slice resource guarantees natively.
Refer to the exhibit. The router has an outgoing label of 'Pop' for prefix ***********. What does this imply?
Penultimate hop popping (PHP) removes the outermost label.
Why this answer
When a router has an outgoing label of 'Pop' for a prefix in MPLS, it indicates that the router is the penultimate hop (PHP) in the LSP. PHP means the router will remove (pop) the top label before forwarding the packet to the next hop, reducing the burden on the egress LSR. This is standard MPLS behavior as per RFC 3031, where the egress router signals an implicit null label (label 3) to its upstream neighbor.
Exam trap
Cisco often tests the distinction between 'Pop' (PHP) and 'Untagged' (no label assigned), so candidates mistakenly think 'Pop' means the router is dropping the label or not forwarding traffic, when in fact it is a deliberate MPLS optimization.
How to eliminate wrong answers
Option A is wrong because 'Pop' is an explicit label operation, not an indication of a missing label; if no label were learned, the entry would show 'no label' or 'untagged'. Option B is wrong because the router will still forward traffic for that prefix, but it will pop the label before doing so; the prefix is reachable and traffic is not dropped. Option D is wrong because 'Pop' means the router removes the label, not pushes a new one; pushing a new label would be indicated by an 'impose' or 'push' operation.
A service provider wants to prioritize voice traffic over data traffic on a PE-CE link. Which QoS mechanism should be applied at the PE ingress to classify packets?
NBAR performs deep packet inspection to classify traffic by application.
Why this answer
Class-based marking using NBAR (Network-Based Application Recognition) is the correct mechanism because it can inspect packets at the application layer to distinguish voice traffic (e.g., RTP, SIP) from data traffic. On a PE-CE link, marking at ingress allows the service provider to set the appropriate DSCP or IP precedence value, which downstream QoS policies can then trust and act upon. This classification step is essential before any policing, shaping, or queuing can be applied.
Exam trap
Cisco often tests the misconception that policing or shaping can classify traffic, when in reality they are actions applied after classification, not mechanisms for identifying packet types.
How to eliminate wrong answers
Option A is wrong because a policer measures and limits traffic rate but does not classify or mark packets; it only drops or re-marks based on a pre-existing classification. Option C is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism that drops packets based on queue depth and precedence, not a classification tool. Option D is wrong because a shaper delays excess traffic to smooth bursts but does not inspect or classify packets; it operates on traffic that has already been classified.
A small service provider is deploying MPLS in its core network for the first time. They have a simple topology: three P routers in the core and two PE routers connecting customers. They have configured LDP on all interfaces and OSPF as the IGP. They also configured a basic L3VPN for a customer with a single CE attached to each PE. The customer reports that they can ping between CEs for a few minutes, but then the connectivity drops. After a few seconds, it returns. This pattern repeats every few minutes. The engineer checks the LDP neighbors and sees that all LDP sessions are up. The OSPF adjacencies are stable. The engineer also notices that the pings time out exactly when the LDP graceful restart timer is expiring on one of the P routers. What is the most likely cause?
If the BGP session between PEs goes down, VPN routes are withdrawn, causing connectivity loss. When the session comes back, routes are re-advertised, restoring connectivity. The pattern matches.
Why this answer
The symptom of periodic connectivity drops that recover after a few seconds, coinciding with the LDP graceful restart timer, indicates that the BGP session between the PEs is flapping. When the BGP session goes down, the VPN routes are withdrawn, causing the CE-to-CE connectivity to drop. Once the BGP session re-establishes, routes are re-advertised and connectivity returns.
LDP graceful restart timer expiration is not the cause (LDP sessions are up), but may coincide with BGP hold timer failures. Options B, C, and D are incorrect because LDP graceful restart does not cause the described pattern, OSPF network type does not cause periodic drops, and interface flapping would cause more permanent outages.
Which access technology uses wavelength division multiplexing to provide symmetric gigabit speeds in fiber-optic networks?
XGS-PON uses WDM to deliver symmetric 10 Gbps.
Why this answer
XGS-PON uses wavelength division multiplexing to support symmetric 10 Gbps speeds, while GPON is asymmetric and DSL/cable are copper-based.
An engineer is troubleshooting a BGP route propagation issue. The customer is receiving a default route from upstream provider, but the route is not being installed in the routing table. The BGP table shows the route is valid but not best. What is the most likely cause?
Static route AD 1 < BGP AD 20, so BGP route is not best.
Why this answer
A static default route with a lower administrative distance (e.g., 1) will be preferred over a BGP default route (AD 20 for eBGP). Even though the BGP route is valid in the BGP table, it is not installed in the routing table because the static route is more trustworthy. This is a common scenario where the routing table already has a better path, preventing the BGP route from becoming 'best' and being installed.
Exam trap
Cisco often tests the distinction between a route being 'valid' in the BGP table versus being 'best' and installed in the routing table, trapping candidates who assume a valid BGP route is automatically used for forwarding.
How to eliminate wrong answers
Option A is wrong because if the next-hop were unreachable, the BGP route would be marked as invalid in the BGP table, not 'valid but not best'. Option B is wrong because an inbound route-map filtering the route would prevent it from appearing in the BGP table at all, whereas the question states the route is present and valid. Option C is wrong because if the BGP session were not established, no routes would be received from the upstream provider, contradicting the fact that the route is in the BGP table.
An SP is designing a metro Ethernet network using Q-in-Q. A customer uses VLAN ID 100 on their network, and the SP assigns service VLAN 200. Which frame format is used on the SP network?
Outer tag is service VLAN, inner is customer VLAN.
Why this answer
Q-in-Q adds an outer (service) VLAN tag (200) while preserving the inner (customer) VLAN tag (100).
An SP is deploying EVPN with VXLAN encapsulation in a data center interconnect. The design requires that the control plane for MAC/VTEP learning is based on BGP. Which BGP address family must be configured?
The l2vpn evpn address family is used for EVPN control plane with BGP.
Why this answer
EVPN with VXLAN encapsulation requires the BGP L2VPN address family (l2vpn evpn) to exchange MAC/VTEP reachability information. This address family carries EVPN routes (type-2 for MAC/IP, type-3 for IMET) that populate the control plane for VXLAN tunnel endpoints, enabling MAC learning without flooding.
Exam trap
Cisco often tests the misconception that VPLS (l2vpn vpls-vpws) is the correct address family for EVPN with VXLAN, but VPLS uses MPLS encapsulation and a different control plane, while EVPN with VXLAN specifically requires the l2vpn evpn address family.
How to eliminate wrong answers
Option B (l2vpn vpls-vpws) is wrong because it is used for MPLS-based VPLS or VPWS services, not for VXLAN encapsulation or EVPN control plane. Option C (vpnv4) is wrong because it carries IPv4 VPN routes (MP-BGP for MPLS L3VPN), not MAC/VTEP information for Layer 2 EVPN. Option D (ipv4 unicast) is wrong because it carries standard IPv4 unicast routes and has no role in EVPN MAC/VTEP learning or VXLAN control plane.
A service provider is deploying a new metro Ethernet network and needs to support multiple customer VLANs over a single physical link without overlapping VLAN IDs. Which technology should be used at the access layer to achieve this?
Correct. Q-in-Q adds an outer tag to segregate customer traffic, allowing overlapping inner VLANs.
Why this answer
Q-in-Q (802.1ad) allows service providers to add an outer VLAN tag to customer frames, enabling customer VLAN separation even when their VLAN IDs conflict. This is commonly used in metro Ethernet networks for scalability.
Ready to test yourself?
Try a timed practice session using only Architecture questions.