Knowledge + Practice

CCNA Sp Services Questions

64 questions · Sp Services topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQeasy

A service provider wants to provide Internet access to an MPLS L3VPN customer without leaking the Internet route into the VRF. Which feature allows the PE to forward traffic from the VRF to the global routing table?

A.Static default route from VRF to global

B.Route leaking between VRF and global

C.VRF-Aware Firewall

D.NAT with VRF awareness

AnswerD

NAT translates VRF source IP to global IP and route via global table.

Why this answer

NAT with VRF awareness (also known as VRF-aware NAT) allows the PE router to translate the private source IP address of traffic from the VRF to a public IP address in the global routing table, enabling Internet access without injecting Internet routes into the VRF. This feature performs NAT at the VRF-to-global boundary, forwarding traffic from the VRF to the global table while keeping the routing domains separate.

Exam trap

Cisco often tests the misconception that route leaking (Option B) is the only way to forward traffic between VRF and global tables, but the question explicitly prohibits leaking Internet routes, making VRF-aware NAT the correct answer because it provides forwarding without route injection.

How to eliminate wrong answers

Option A is wrong because a static default route from VRF to global does not exist as a native feature; a static route can point to a next-hop in the global table only if route leaking is configured, which would leak the default route into the VRF, violating the requirement to not leak Internet routes. Option B is wrong because route leaking between VRF and global explicitly injects routes from one table into the other, which directly contradicts the requirement to avoid leaking Internet routes into the VRF. Option C is wrong because a VRF-Aware Firewall inspects and filters traffic within a VRF but does not provide the forwarding path from the VRF to the global routing table; it operates on traffic that is already routed, not as a mechanism to bridge the two tables.

Practice this question →

2

Multi-Selecteasy

A service provider is planning to offer L2VPN services using MPLS. Which TWO statements are true regarding Ethernet over MPLS (EoMPLS) and Virtual Private LAN Service (VPLS)?

Select 2 answers

A.EoMPLS provides a point-to-point pseudowire between two PE routers.

B.VPLS requires all PE routers to be in the same VLAN.

C.VPLS uses a hub-and-spoke topology to interconnect multiple sites.

D.VPLS emulates a multipoint Ethernet service over MPLS.

E.EoMPLS supports MAC address learning between sites.

AnswersA, D

EoMPLS is a point-to-point service.

Why this answer

EoMPLS (Ethernet over MPLS) is correct because it establishes a point-to-point pseudowire (Martini draft, RFC 4448) between two PE routers, transporting Layer 2 Ethernet frames across an MPLS core without MAC learning or multipoint capabilities.

Exam trap

Cisco often tests the distinction between point-to-point (EoMPLS) and multipoint (VPLS) services, and the trap here is confusing MAC learning (VPLS) with simple transport (EoMPLS), or assuming VPLS uses a hub-and-spoke topology instead of a full mesh.

Practice this question →

3

Multi-Selectmedium

Which TWO of the following are characteristics of Segment Routing (SR-MPLS) compared to traditional LDP-based MPLS? (Select two.)

Select 2 answers

A.SR-MPLS requires a dedicated label range from 16 to 99.

B.SR-MPLS does not support traffic engineering.

C.SR-MPLS does not require LDP or RSVP-TE for label distribution.

D.SR-MPLS cannot provide fast reroute protection.

E.SR-MPLS uses a segment list to encode the path in the packet header.

AnswersC, E

Labels are distributed via IGP extensions.

Why this answer

Segment Routing (SR-MPLS) eliminates the need for label distribution protocols like LDP or RSVP-TE. Instead, SR-MPLS encodes label information directly in the packet header as a segment list, and routers use the IGP (e.g., OSPF or IS-IS) to advertise segment identifiers (SIDs). This simplifies the control plane and removes protocol dependencies.

Exam trap

Cisco often tests the misconception that SR-MPLS cannot do traffic engineering or fast reroute, when in fact it supports both through segment lists and TI-LFA, respectively.

Practice this question →

4

MCQhard

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

A.The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.

B.The priority level is set too low; voice should be priority level 4.

C.The 'bandwidth remaining ratio' command under class-default is starving the priority queue.

D.The policy is applied in the output direction; it should be input.

AnswerA

Policing drops traffic exceeding 10%.

Why this answer

The REALTIME class uses the 'police' command to enforce a rate of 10% of the interface bandwidth. When voice traffic marked DSCP EF exceeds this policed rate, packets are dropped, even though the class is configured with priority queuing. The police rate is the bottleneck, not the priority queue itself.

Exam trap

Cisco often tests the distinction between priority queuing (which provides low latency) and policing (which enforces a rate limit), leading candidates to overlook that a police rate in a priority class can cause drops even when the priority queue is not congested.

How to eliminate wrong answers

Option B is wrong because priority levels in Cisco QoS (0-7) control the scheduling order within the priority queue, not the amount of bandwidth; voice traffic with DSCP EF is typically mapped to priority level 4 by default, and raising it would not prevent drops caused by policing. Option C is wrong because the 'bandwidth remaining ratio' command under class-default only affects the distribution of leftover bandwidth among non-priority classes; it does not starve the priority queue, which is serviced first regardless of remaining ratios. Option D is wrong because the policy is applied in the output direction, which is correct for shaping and policing egress traffic; applying it input would not control outbound drops on the PE-CE interface.

Practice this question →

5

Multi-Selectmedium

Which TWO features are used to improve BGP convergence in an MPLS VPN environment?

Select 2 answers

A.Route redistribution

B.Next-hop-self

C.Bidirectional Forwarding Detection (BFD)

D.BGP multipath

E.BGP Prefix Independent Convergence (PIC)

AnswersC, E

BFD quickly detects link failures.

Why this answer

Bidirectional Forwarding Detection (BFD) provides sub-second failure detection for BGP sessions, reducing the time to detect a link or neighbor failure from seconds (default BGP keepalive/hold timers) to milliseconds. BGP Prefix Independent Convergence (PIC) pre-installs backup paths in the forwarding table, allowing traffic to be rerouted immediately upon failure without waiting for BGP to reconverge. Together, these features drastically improve BGP convergence in an MPLS VPN environment.

Exam trap

Cisco often tests the distinction between features that improve convergence speed (BFD, PIC) versus features that affect routing behavior or path selection (next-hop-self, multipath, redistribution), leading candidates to mistakenly select options that are useful but do not directly address convergence time.

Practice this question →

6

MCQhard

Refer to the exhibit. A network engineer applies this policy on the PE-CE link. What is the expected behavior for VoIP traffic matching the access list?

A.VoIP traffic is given strict priority queuing with up to 30% bandwidth

B.VoIP traffic is dropped if congestion occurs

C.VoIP traffic is shaped to 30% of bandwidth

D.VoIP traffic is queued in the default class with fair-queue

AnswerA

Priority queue guarantees bandwidth up to 30% with strict priority.

Why this answer

The policy-map applies the 'priority' command to the VoIP class, which enables strict priority queuing (LLQ). The 'police cir percent 30' command limits the priority queue's bandwidth to 30% during congestion, ensuring VoIP traffic is always served first but cannot exceed the configured percentage. This matches option A exactly.

Exam trap

Cisco often tests the distinction between policing and shaping in LLQ configurations, where candidates mistakenly think 'police' implies shaping or that priority queuing drops all traffic during congestion.

How to eliminate wrong answers

Option B is wrong because LLQ does not drop VoIP traffic during congestion; it polices the priority queue to 30% and drops only excess traffic beyond that limit. Option C is wrong because shaping is not configured; the 'police' command performs policing (rate-limiting with drop), not shaping (buffering). Option D is wrong because VoIP traffic is explicitly classified into a priority queue, not the default class, and fair-queue is not applied to the priority class.

Practice this question →

7

MCQmedium

Refer to the exhibit. A network engineer is troubleshooting MPLS forwarding for prefix 10.10.10.0/24. The router shows two entries. What does the 'Pop tag' in the outgoing tag indicate?

A.The router will swap the label with the local label 16.

B.The router has received an error in label distribution.

C.The router will pop the MPLS label before forwarding the packet.

D.The router will forward the packet without an MPLS label.

AnswerC

PHP is performed by the penultimate router.

Why this answer

The 'Pop tag' in the outgoing tag indicates that the router is the penultimate hop in the MPLS LSP. According to Penultimate Hop Popping (PHP) behavior, the penultimate router removes (pops) the top label before forwarding the IP packet to the egress LSR, so the egress router receives a pure IP packet and does not need to perform a label lookup. This is standard MPLS behavior defined in RFC 3031.

Exam trap

Cisco often tests the distinction between 'Pop tag' (PHP/Implicit NULL) and 'Untagged' (no label at all), leading candidates to confuse the two; 'Pop tag' means the label is actively removed, while 'Untagged' means the packet was never labeled.

How to eliminate wrong answers

Option A is wrong because 'Pop tag' means the label is removed, not swapped; swapping would show a specific outgoing label value (e.g., 16) instead of 'Pop tag'. Option B is wrong because 'Pop tag' is a normal, intentional label operation in MPLS, not an error condition; label distribution errors typically result in missing or incorrect label bindings, not a 'Pop tag' indication. Option D is wrong because the router will forward the packet without an MPLS label only after popping it; the 'Pop tag' action itself removes the label, and the packet is then forwarded as a native IP packet, but the statement 'forward the packet without an MPLS label' is misleading because it implies the router never had a label, whereas PHP explicitly pops the existing label.

Practice this question →

8

MCQmedium

A customer requires MPLS Layer 2 VPN connectivity between two sites using Pseudowire. Which control protocol is used to signal the pseudowire label?

A.RSVP-TE

B.LDP

AnswerB

LDP signaled pseudowire is used in AToM.

Why this answer

B is correct because LDP (Label Distribution Protocol) is the standard control protocol used to signal pseudowire labels in MPLS Layer 2 VPNs. Specifically, the Targeted LDP (T-LDP) session between the two Provider Edge (PE) routers exchanges the Virtual Circuit (VC) label, which is the inner label used to identify the pseudowire. This is defined in RFC 4447 and is the default signaling mechanism for AToM (Any Transport over MPLS).

Exam trap

The trap here is that candidates often confuse BGP's role in MPLS Layer 3 VPNs (where it distributes VPNv4 routes and labels) with pseudowire signaling, leading them to incorrectly select BGP for Layer 2 VPN pseudowire setup.

How to eliminate wrong answers

Option A is wrong because RSVP-TE is used for traffic engineering and MPLS-TE label signaling, not for pseudowire label distribution. Option C is wrong because BGP can be used for MPLS Layer 3 VPN label distribution (VPNv4 routes) or for signaling pseudowire labels in certain implementations like L2VPN BGP-signaled VPLS, but it is not the standard control protocol for point-to-point pseudowires in AToM. Option D is wrong because OSPF is an IGP used for IP routing within an autonomous system and does not distribute MPLS labels; it has no role in pseudowire signaling.

Practice this question →

9

MCQeasy

A service provider recently deployed MPLS L3VPN for a customer with four sites (Site1, Site2, Site3, Site4) connected to PE1, PE2, PE3, and PE4 respectively. All sites are in VRF CUST-A with route targets 100:1 import and 100:1 export on all PEs. The customer reports that Site4 cannot ping the loopback interface (10.1.1.1/32) of Site1, but Site2 and Site3 can reach it. The provider verifies that BGP sessions between all PEs and the route reflector are up and that VPNv4 routes are advertised. The VRF on PE4 shows the route 10.1.1.1/32 with next-hop 192.0.2.1 (PE1's loopback) but when Site4 initiates a ping, it fails. What should the provider check next?

A.Ensure that the IGP operating in the core has propagated the loopback interface address of PE1 to all P routers.

B.Verify that the BGP session between PE4 and the route reflector is using the correct update source.

C.Verify that the CE router at Site4 is configured with the correct VRF name and default gateway.

D.Check the VRF route target import on PE1 to ensure it includes the route target exported by PE4 for Site4's subnet.

AnswerD

Correct. The ping fails because return traffic from Site1 to Site4 is dropped. PE1 must import the route target exported by PE4 for Site4's subnet. If the import RT on PE1 does not include the RT from PE4, the return path is broken.

Why this answer

The issue is that return traffic from Site1 to Site4 is being dropped. Although PE4 has the route to Site1's loopback, PE1 needs to have a route back to Site4's subnet in its VRF CUST-A. This is achieved by ensuring that PE1 imports the correct route target (exported by PE4 for Site4's prefix).

If the import RT on PE1 does not include the RT that PE4 exports for Site4, the return path is broken. Option A is incorrect because the IGP propagation of loopback interfaces is not directly related to VPNv4 route reachability; BGP sessions are already up. Option B is incorrect because the BGP session between PE4 and the route reflector is already up, and update source issues would affect route advertisement, not return path.

Option C is incorrect because CE configuration is likely fine since Site2 and Site3 work.

Practice this question →

10

MCQmedium

Refer to the exhibit. CE1 is not receiving the VPNv4 route for the 192.168.1.0/24 subnet. What is the most likely cause?

A.PE1 is missing the VRF configuration for CUSTOMER_A

B.PE1 is missing the neighbor statement under address-family ipv4 vrf CUSTOMER_A

C.CE1 is missing the network statement under router bgp 65001

D.The neighbor 10.0.0.2 is using an incorrect update-source

AnswerB

Why this answer

For CE1 to receive the VPNv4 route for 192.168.1.0/24, PE1 must redistribute the route from the VRF into BGP. The neighbor statement under address-family ipv4 vrf CUSTOMER_A is required to establish an eBGP peering with CE1 and exchange IPv4 routes within that VRF. Without it, PE1 will not send any routes to CE1, even if the VRF and route targets are correctly configured.

Exam trap

Cisco often tests the distinction between VRF configuration and BGP address-family activation, tricking candidates into thinking a missing VRF is the issue when the real problem is the missing neighbor statement under the VRF address-family.

How to eliminate wrong answers

Option A is wrong because PE1 missing the VRF configuration for CUSTOMER_A would prevent any VRF-based routing, but the question states CE1 is not receiving the VPNv4 route specifically, implying the VRF exists but the BGP peering is broken. Option C is wrong because CE1 missing the network statement under router bgp 65001 would prevent CE1 from advertising the 192.168.1.0/24 route to PE1, but the issue is CE1 not receiving the route, not advertising it. Option D is wrong because the neighbor 10.0.0.2 using an incorrect update-source would affect the BGP session between PE1 and CE1, but the exhibit shows the peering is established (otherwise CE1 would not be a BGP neighbor at all), and the problem is specifically that the route is not being sent to CE1.

Practice this question →

11

Multi-Selectmedium

Which TWO statements about BGP FlowSpec (RFC 8955) are correct?

Select 2 answers

A.FlowSpec can be deployed in BGP sessions between a route reflector and a client.

B.FlowSpec uses a separate BGP session from the regular IPv4 unicast session.

C.FlowSpec is designed to replace ACLs on provider edge routers.

D.FlowSpec requires MPLS forwarding to operate.

E.FlowSpec uses the IPv4 unicast or VPNv4 address family.

AnswersA, E

FlowSpec routes can be propagated via BGP within the service provider network.

Why this answer

BGP FlowSpec (RFC 8955) can be deployed between a route reflector and its clients. The route reflector propagates FlowSpec NLRI (Network Layer Reachability Information) to its clients, allowing the clients to install traffic filtering rules without requiring a full BGP mesh. This is a common deployment model in service provider networks to distribute flow-spec routes efficiently.

Exam trap

Cisco often tests the misconception that FlowSpec requires a separate BGP session or MPLS, but the trap here is that candidates confuse the address family separation (which uses the same session) with a separate session, or assume MPLS is mandatory because FlowSpec is often discussed in MPLS VPN contexts.

Practice this question →

12

MCQmedium

A service provider is deploying LISP (Locator/ID Separation Protocol) to provide mobility and multihoming for customer endpoints. Which LISP component is responsible for maintaining the mapping between Endpoint Identifiers (EIDs) and Routing Locators (RLOCs) and for responding to Map-Request messages from ITRs?

A.Ingress Tunnel Router (ITR)

B.Map-Server (MS)

C.Map-Resolver (MR)

D.Egress Tunnel Router (ETR)

AnswerB

MS maintains the EID-to-RLOC mapping and responds to Map-Requests.

Why this answer

The Map-Server (MS) is the central control-plane component in LISP that maintains the authoritative mapping database of EID-to-RLOC entries. When an Ingress Tunnel Router (ITR) sends a Map-Request for an unknown EID, the Map-Server receives it, looks up the mapping, and either responds directly or forwards the request to the appropriate Egress Tunnel Router (ETR) for a reply. This makes the MS the correct answer for maintaining mappings and responding to Map-Requests.

Exam trap

Cisco often tests the distinction between the Map-Server and Map-Resolver, where candidates confuse the Map-Resolver's role of forwarding requests with the Map-Server's role of maintaining the authoritative mapping database and responding to Map-Requests.

How to eliminate wrong answers

Option A is wrong because the Ingress Tunnel Router (ITR) is the device that encapsulates packets and initiates Map-Requests, but it does not maintain the authoritative mapping database or respond to Map-Requests; it is a consumer of mapping information. Option C is wrong because the Map-Resolver (MR) receives Map-Requests from ITRs and forwards them to the Map-Server, but it does not maintain the mapping database or directly respond to Map-Requests; it acts as a proxy. Option D is wrong because the Egress Tunnel Router (ETR) decapsulates packets and can respond to Map-Requests if it is the authoritative ETR for the requested EID, but it does not maintain the central mapping database; the Map-Server is the authoritative repository.

Practice this question →

13

Multi-Selectmedium

Which THREE factors must be considered when deploying MPLS Layer 3 VPN services to ensure optimal scalability and convergence?

Select 3 answers

A.Label distribution via LDP or TDP must be consistent across all P routers.

B.Route reflectors should be used to reduce the number of BGP sessions in the service provider core.

C.All PE routers must be directly connected via eBGP to exchange VPNv4 routes.

D.The number of VRFs per PE router is limited by available memory and route processing capacity.

E.The use of BGP next-hop-self is mandatory to prevent routing blackholes in multi-area IGP environments.

AnswersA, B, D

Inconsistent label distribution can cause label mismatch and forwarding failures.

Why this answer

Consistent label distribution across all P (Provider) routers is essential for MPLS L3VPN scalability and convergence. LDP (Label Distribution Protocol) or TDP (Tag Distribution Protocol, Cisco proprietary predecessor) must be uniformly configured to ensure a seamless label-switched path (LSP) from ingress to egress PE. Inconsistent label distribution can cause label binding mismatches, leading to forwarding failures or suboptimal convergence during topology changes.

Exam trap

Cisco often tests the misconception that eBGP is required between PEs for VPNv4 exchange, when in fact iBGP (often with route reflectors) is the standard, and eBGP is only used at the CE-PE edge.

Practice this question →

14

MCQmedium

A service provider is deploying MPLS Layer 3 VPNs and wants to ensure that customer traffic is not dropped when a PE-CE link fails. The CE router is using static routing. Which design should be implemented to provide fast convergence?

A.Configure OSPF on the PE-CE link and set hello timers to 1 second.

B.Use IP SLA tracking to monitor the CE and adjust the static route.

C.Increase the administrative distance of the static route to 255.

D.Enable BFD on the PE-CE interface and associate it with the static route.

AnswerD

BFD provides sub-second failure detection, triggering fast route withdrawal.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection on the PE-CE link, and when associated with a static route, it allows the PE to quickly remove the failed route from the routing table. This triggers fast convergence without waiting for routing protocol timers, which is critical for MPLS Layer 3 VPNs using static routing on the CE side.

Exam trap

The trap here is that candidates often choose IP SLA (Option B) thinking it provides fast failure detection, but they overlook that IP SLA is poll-based and slower than BFD, which is the Cisco-recommended mechanism for sub-second convergence with static routes.

How to eliminate wrong answers

Option A is wrong because OSPF is a dynamic routing protocol, but the CE router is using static routing; configuring OSPF would require changing the CE configuration and does not leverage the static route design. Option B is wrong because IP SLA tracking can detect reachability but typically operates at a polling interval of several seconds (e.g., 5-60 seconds), which is too slow for fast convergence compared to BFD's sub-second detection. Option C is wrong because increasing the administrative distance of the static route to 255 makes it the least preferred route, effectively removing it from the routing table unless no other route exists, which would break connectivity rather than provide fast convergence.

Practice this question →

15

MCQeasy

A service provider deploys MPLS L3VPN to connect multiple customer sites. Which VPN address family must be enabled on the PE routers to exchange customer IPv4 routes between PEs?

A.VPNv4 unicast

B.IPv4 labeled-unicast

C.IPv4 unicast

D.VPNv6 unicast

AnswerA

VPNv4 address family carries VPN-IPv4 routes with route distinguisher.

Why this answer

In an MPLS L3VPN, customer IPv4 routes must be transported between Provider Edge (PE) routers across the MPLS backbone. The VPNv4 unicast address family (AF 1, SAFI 128) is required because it carries both the IPv4 prefix and an 8-byte Route Distinguisher (RD), making routes unique across different VPNs. This address family is enabled under the BGP configuration on PE routers (e.g., `address-family vpnv4 unicast`) to exchange labeled VPN routes using MP-BGP, as defined in RFC 4364.

Exam trap

Cisco often tests the distinction between IPv4 unicast and VPNv4 unicast, trapping candidates who confuse standard BGP route exchange (which lacks VPN separation) with the MP-BGP VPNv4 address family required for MPLS L3VPN.

How to eliminate wrong answers

Option B is wrong because IPv4 labeled-unicast (AF 1, SAFI 4) is used for MPLS-based inter-AS or carrier-supporting-carrier scenarios, not for exchanging customer VPN routes between PEs. Option C is wrong because standard IPv4 unicast (AF 1, SAFI 1) lacks the Route Distinguisher and VPN label information required to separate and forward customer routes across the MPLS L3VPN backbone. Option D is wrong because VPNv6 unicast (AF 2, SAFI 128) is used for IPv6 VPN routes, not for IPv4 customer routes.

Practice this question →

16

MCQmedium

A service provider is implementing Multicast VPN (MVPN) in an MPLS backbone. They use Rosen GRE (draft-rosen) for multicast transport. What is the primary limitation of Rosen GRE compared to mLDP-based MVPN?

A.It requires full-mesh of GRE tunnels between all PEs.

B.It cannot use Source-Specific Multicast (SSM).

C.All multicast traffic is sent to every PE in the VPN, even if no receiver exists.

D.It does not support Protocol Independent Multicast (PIM).

AnswerC

Rosen GRE uses a default MDT that forwards traffic to all PEs, causing waste.

Why this answer

In Rosen GRE (draft-rosen) MVPN, a default MDT (Multicast Distribution Tree) is built using a shared PIM-SM group across all PEs in the VPN. All multicast traffic from any source in the VPN is encapsulated in GRE and sent to this default MDT group, meaning every PE receives the traffic regardless of whether it has any local receivers. This is the primary limitation because it wastes bandwidth and processing on PEs that do not need the traffic, unlike mLDP-based MVPN which builds trees only to PEs with receivers.

Exam trap

Cisco often tests the misconception that Rosen GRE requires a full-mesh of tunnels (Option A) because candidates confuse the concept of a shared MDT with the need for individual tunnels, but the real limitation is the flooding of traffic to all PEs regardless of receivers.

How to eliminate wrong answers

Option A is wrong because Rosen GRE does not require a full-mesh of GRE tunnels; it uses a single default MDT group (a PIM-SM group) shared across all PEs, and traffic is sent via this group, not via individual point-to-point GRE tunnels between each pair of PEs. Option B is wrong because Rosen GRE can use Source-Specific Multicast (SSM) for the default MDT if the provider configures it, though it is more commonly associated with PIM-SM; the limitation is not about SSM support. Option D is wrong because Rosen GRE explicitly relies on PIM (typically PIM-SM) to build the default MDT between PEs; it does not lack PIM support.

Practice this question →

17

Multi-Selecteasy

A service provider is configuring BGP community propagation in an MPLS VPN network. Which two actions are necessary to ensure that communities are passed from CE to remote PE?

Select 2 answers

A.Configure no bgp default community-mode

B.Configure send-community on the CE-to-PE BGP session

C.Configure send-community extended on the VPNv4 neighbor

D.Configure vrf forwarding with route-target both

E.Configure route-map to filter communities

AnswersB, C

Correct. This allows communities from the CE to be received by the PE.

Why this answer

B is correct because the `send-community` command must be configured on the CE-to-PE BGP session to allow standard BGP communities (e.g., NO_EXPORT) to be propagated from the CE router into the MPLS VPN network. Without this, the PE router will strip communities from incoming BGP updates, preventing them from reaching the remote PE.

Exam trap

Cisco often tests the distinction between standard and extended communities, leading candidates to forget that `send-community` (for standard) is required on the CE-PE session, while `send-community extended` is only for VPNv4 peers.

Practice this question →

18

MCQhard

A service provider operates a Layer 2 MPLS VPN using VPLS. Recently, two new CE routers were added to the VPLS domain, but they cannot ping each other. The existing CEs can communicate. The network uses BGP autodiscovery and signaling. The new CEs are connected to different PEs. The 'show vfi status' command on the new PEs indicates the VFI is up but the pseudowire to the remote PE is down. The BGP session between the PEs is established and the L2VPN address family routes are exchanged. What is the most probable cause?

A.The BGP neighbor is not activated under the VPLS address-family

B.The route-target on the new PEs does not match the existing VPLS context

C.The MTU mismatch between PEs

D.The VFI name is not consistent across PEs

AnswerB

Correct. Mismatched route-target prevents the new PEs from being discovered by the existing ones, so pseudowires are not established.

Why this answer

B is correct because BGP autodiscovery for VPLS relies on route-target (RT) matching to import remote VPLS endpoints into the local VFI. If the RT configured on the new PEs does not match the RT used by the existing VPLS context, the remote pseudowire will not be created even though BGP sessions are up and L2VPN routes are exchanged. The 'show vfi status' showing VFI up but pseudowire down is a classic symptom of RT mismatch, as the local PE cannot associate the received BGP routes with the correct VPLS instance.

Exam trap

Cisco often tests the distinction between BGP session establishment (which only requires neighbor configuration and address-family activation) and successful VPLS pseudowire creation (which additionally requires matching route-target import/export policies), leading candidates to incorrectly suspect BGP activation issues when the real problem is RT mismatch.

How to eliminate wrong answers

Option A is wrong because the BGP neighbor is already activated under the L2VPN address-family (the question states BGP session is established and L2VPN routes are exchanged), so the issue is not activation. Option C is wrong because an MTU mismatch between PEs would cause pseudowire status to be 'down' due to LDP or MPLS MTU negotiation failure, but the question specifies BGP autodiscovery and signaling, and MTU mismatch typically manifests as operational errors or packet drops, not a pseudowire that fails to come up solely due to RT mismatch. Option D is wrong because the VFI name is a local label on each PE and does not need to be consistent across PEs; VPLS uses the VPLS ID (or VPLS instance ID) carried in BGP, not the VFI name, to match endpoints.

Practice this question →

19

MCQmedium

A customer's MPLS L3VPN has two CE routers connected to two different PEs, but the PEs are not receiving the customer's routes from each other. The PE-CE routing protocol is OSPF. The PEs have the VRF configured with OSPF process, and the routes from CE are in the VRF routing table. The MP-BGP session between PEs is up and the VPNv4 address family is working. On the source PE, the routes show as not advertised to BGP. What is the likely issue?

A.The route-target export on the source PE does not match the import on the remote PE

B.The OSPF network type is not set to broadcast

C.The OSPF process on the PE is not redistributed into BGP VPNv4 under the VRF

D.The next-hop-self is not configured under the VRF OSPF process

AnswerC

Correct. The 'redistribute ospf process-id' command under the VRF address-family is missing, so OSPF routes are not injected into MP-BGP.

Why this answer

In an MPLS L3VPN with OSPF as the PE-CE protocol, the VRF OSPF process must be explicitly redistributed into the MP-BGP VPNv4 address family using the `redistribute ospf <process-id> match internal external` command under the VRF address-family IPv4. Without this redistribution, the OSPF routes learned from the CE remain in the VRF routing table but are never injected into BGP, so they are not advertised to the remote PE, even though the MP-BGP session is up and the VPNv4 address family is working.

Exam trap

Cisco often tests the misconception that simply enabling OSPF under a VRF and having a working MP-BGP session is sufficient for route exchange, when in fact explicit redistribution from OSPF into BGP VPNv4 is required.

How to eliminate wrong answers

Option A is wrong because if the route-target export on the source PE did not match the import on the remote PE, the routes would be advertised to BGP (they would show as advertised) but would not be installed on the remote PE; the question states the routes show as 'not advertised to BGP', so the issue is before BGP advertisement. Option B is wrong because the OSPF network type does not affect whether routes are redistributed into BGP; it only influences neighbor discovery and DR/BDR election, and the PE-CE adjacency is already established since routes are in the VRF table. Option D is wrong because `next-hop-self` is a BGP configuration (applied under the VRF address-family or BGP neighbor) that modifies the next-hop attribute in BGP updates, not an OSPF command; it does not control whether routes are advertised to BGP in the first place.

Practice this question →

20

MCQhard

Refer to the exhibit. Which statement about this BGP configuration is true?

A.The no synchronization command is invalid under address-family ipv4 vrf.

B.The next-hop-self command ensures that the PE sets itself as the next-hop for routes advertised to the route reflector.

C.The send-community extended command is only needed for IPv4 unicast address family.

D.The redistribute ospf command will import OSPF routes into the VRF but not into BGP.

AnswerB

Next-hop-self is used to set the local router as next-hop.

Why this answer

The `next-hop-self` command under the VRF address-family instructs the PE router to set its own IP address as the next-hop for routes advertised to the route reflector. This is necessary in MPLS L3VPN environments to ensure that the route reflector (and other PEs) can reach the customer prefix via the advertising PE, avoiding reachability issues when the original next-hop is not directly connected across the MPLS core.

Exam trap

Cisco often tests the misconception that `next-hop-self` is only needed for eBGP peers, but in MPLS L3VPN it is essential for iBGP sessions to route reflectors to ensure correct next-hop reachability across the core.

How to eliminate wrong answers

Option A is wrong because the `no synchronization` command is valid under `address-family ipv4 vrf`; BGP synchronization is disabled by default in modern IOS versions and is not required for VRF configurations. Option C is wrong because the `send-community extended` command is required for the VPNv4 address family (or under the VRF) to propagate extended communities (e.g., RTs) necessary for MPLS L3VPN operation, not just for IPv4 unicast. Option D is wrong because the `redistribute ospf` command under the VRF address-family imports OSPF routes into the BGP VRF table, making them available for redistribution into BGP VPNv4 routes; the routes are indeed imported into BGP, not excluded.

Practice this question →

21

MCQeasy

Refer to the exhibit. Which prerequisite for MPLS L3VPN is missing on PE1?

A.MPLS is not enabled on the interface

B.LDP is not enabled globally

C.VRF is not defined

D.OSPF is not redistributed into BGP

AnswerC

No `ip vrf` definition or VRF applied to any interface.

Why this answer

The exhibit shows that PE1 has an interface configured with an IP address and MPLS enabled, but no VRF definition is present. For MPLS L3VPN, a VRF must be defined on the PE router to separate customer routing tables and to associate the customer-facing interface with that VRF. Without the VRF, the PE cannot import/export VPN routes or maintain per-VPN routing instances, which is a fundamental prerequisite for L3VPN operation.

Exam trap

Cisco often tests the misconception that MPLS or LDP configuration alone is sufficient for L3VPN, when in fact the VRF definition is the mandatory first step that candidates overlook.

How to eliminate wrong answers

Option A is wrong because the exhibit shows 'mpls ip' under the interface, indicating MPLS is already enabled on that interface. Option B is wrong because LDP is enabled globally as shown by 'mpls ldp router-id' and 'mpls ldp' in the global configuration, and LDP is not a prerequisite for L3VPN (though it is commonly used for label distribution). Option D is wrong because OSPF redistribution into BGP is a configuration step for propagating routes within the VPN, not a prerequisite; the VRF must exist first before any redistribution can be applied.

Practice this question →

22

MCQeasy

A service provider is implementing QoS on a PE router for customer traffic. Which tool should be used to classify traffic based on application layer information?

B.MQC with NBAR

C.Shaping

D.Policy-map with police

AnswerB

Correct. NBAR can classify traffic based on application signatures.

Why this answer

NBAR (Network-Based Application Recognition) is a deep packet inspection (DPI) engine within the Modular QoS CLI (MQC) that can identify applications by inspecting payloads up to Layer 7. This allows classification of traffic based on application-layer information such as HTTP, DNS, or proprietary protocols, which is exactly what the question requires.

Exam trap

Cisco often tests the distinction between classification tools (NBAR, ACLs) and QoS actions (shaping, policing), so the trap here is that candidates confuse a QoS action (like shaping or policing) with the classification mechanism itself.

How to eliminate wrong answers

Option A is wrong because an access-list (ACL) classifies traffic based on Layer 3/4 fields (IP addresses, ports, protocol numbers) and cannot inspect application-layer payloads. Option C is wrong because shaping is a QoS action that delays excess traffic to smooth output, not a classification tool. Option D is wrong because a policy-map with police is a QoS action (policing) that drops or marks traffic based on a pre-classified rate, not a method to classify traffic by application layer.

Practice this question →

23

MCQeasy

A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?

A.Increase the path-option preference value.

B.Disable path protection on the tunnel.

C.Change the explicit path to 'loose' for the down interface.

D.Configure an affinity constraint to exclude the down interface.

AnswerC

Loose hops allow the tunnel to traverse other interfaces.

Why this answer

Changing the explicit path from 'strict' to 'loose' for the down interface allows the MPLS TE tunnel to use an alternative next-hop that is reachable, even if the specified interface is down. A strict explicit path requires every hop to be directly connected, so a down interface prevents the tunnel from coming up. By making the hop loose, the router can route around the failed link using the IGP's best path to the next specified node.

Exam trap

Cisco often tests the distinction between strict and loose explicit paths, where candidates mistakenly think that adjusting path preference or adding constraints can override a strict hop that is down, rather than recognizing that only changing the hop type to loose allows the router to dynamically route around the failure.

How to eliminate wrong answers

Option A is wrong because increasing the path-option preference value only changes the order in which path options are tried; it does not bypass a down interface in a strict explicit path. Option B is wrong because disabling path protection removes the ability to use a backup tunnel or fast reroute, but does not resolve the issue of a strict explicit path requiring a down interface. Option D is wrong because configuring an affinity constraint to exclude the down interface would require the tunnel to avoid that interface, but the explicit path still mandates it as a strict hop, so the constraint cannot override the explicit path definition.

Practice this question →

24

Matchingmedium

Match each Segment Routing component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Segment Identifier, an instruction in the SR header

Segment Routing Global Block of label values

Segment Routing over MPLS data plane

Topology-Independent Loop-Free Alternate for fast reroute

Path Computation Element Protocol for SR path computation

Why these pairings

In Segment Routing, SID uniquely identifies a segment, SRGB reserves a label range for global SIDs, and Prefix-SID is a global SID for an IGP prefix. Common confusions include mixing SID with SRGB and Prefix-SID with Adjacency-SID.

Practice this question →

25

MCQhard

A service provider is using LISP to provide host mobility. Which LISP component is responsible for storing the mapping of EID to RLOC?

A.Map-Server

B.Altitude

C.Tunnel Router

D.Map-Resolver

AnswerA

Correct. The Map-Server maintains the mapping database for the LISP site.

Why this answer

In LISP (RFC 6830), the Map-Server (MS) is the central repository that stores the mapping of Endpoint Identifiers (EIDs) to Routing Locators (RLOCs). When an Ingress Tunnel Router (ITR) needs to forward traffic to a destination EID, it queries the Map-Resolver, which in turn contacts the Map-Server to retrieve the authoritative mapping. The Map-Server also accepts registration from Egress Tunnel Routers (ETRs) on behalf of their EID prefixes, making it the definitive source for EID-to-RLOC bindings.

Exam trap

Cisco often tests the distinction between the Map-Server (which stores the mapping) and the Map-Resolver (which only proxies requests), so the trap here is confusing the resolver's forwarding role with the server's storage role, leading candidates to incorrectly select Map-Resolver.

How to eliminate wrong answers

Option B (Altitude) is wrong because Altitude is not a LISP component; it is a proprietary Cisco technology for traffic engineering and path selection, unrelated to EID-to-RLOC mapping storage. Option C (Tunnel Router) is wrong because Tunnel Routers (ITR/ETR) perform encapsulation/decapsulation and may cache mappings, but they do not store the authoritative mapping database—that is the Map-Server's role. Option D (Map-Resolver) is wrong because the Map-Resolver handles incoming map-requests from ITRs and forwards them to the Map-Server; it does not store mappings itself, acting only as a proxy.

Practice this question →

26

Multi-Selecteasy

Which two statements about MPLS Layer 3 VPN route target (RT) communities are correct?

Select 2 answers

A.RTs must be manually configured on every PE router for each VRF.

B.RTs are used to prevent routing loops within the MPLS VPN network.

C.RTs are used to determine the next-hop IP address for VPN prefixes.

D.RTs control the import and export of routes between VRFs on PE routers.

E.RTs are carried in the IP header to enable per-VPN forwarding.

AnswersA, D

Incorrect: RTs can be auto-generated using the Auto-RT feature.

Why this answer

Route targets (RTs) are BGP extended community attributes used to control the import and export of VPN routes between VRFs on PE routers. Option D is correct. While auto-RT can automatically generate RTs, many deployments require manual configuration on each PE for each VRF, especially when custom RTs are needed; therefore, option A is also correct.

Option B is incorrect because loop prevention in MPLS VPNs uses mechanisms like AS-override and allowas-in, not RTs. Option C is incorrect because the next-hop IP address for VPN prefixes is determined by the BGP next-hop attribute, not RTs. Option E is incorrect because RTs are carried within BGP VPNv4 updates as extended communities, not in the IP header.

Practice this question →

27

MCQhard

Refer to the exhibit. CE1 is unable to ping the loopback of a remote CE. Which configuration change is required on PE1 to enable communication?

A.Add `send-community extended` to the VRF BGP neighbor

B.Apply the VRF to the interface facing CE and ensure BGP VRF neighbor is activated

C.Change the VPNv4 neighbor to point to 192.168.1.2

D.Set the CE neighbor remote-as to 65000

AnswerB

Missing `ip vrf forwarding CUSTOMER` on interface and `neighbor 192.168.1.2 activate` under address-family ipv4 vrf CUSTOMER.

Why this answer

The configuration is missing the VRF forwarding statement on the interface facing CE1 and the BGP VRF neighbor activation under the VRF address-family. Without applying the VRF to the interface, PE1 cannot associate the CE-facing interface with the correct VRF, and without activating the BGP neighbor under the VRF address-family, PE1 will not establish a BGP session with CE1 or exchange routes for that VRF. This prevents CE1 from learning the remote CE's loopback route.

Exam trap

Cisco often tests the distinction between configuring a BGP neighbor under the global BGP process versus under a VRF address-family, and the requirement to bind the VRF to the interface, which candidates frequently overlook when focusing only on BGP configuration.

How to eliminate wrong answers

Option A is wrong because `send-community extended` is used to propagate extended BGP communities (e.g., RT, SOO) between PE routers in the MPLS VPN core, not between PE and CE; the issue here is VRF-to-interface binding and BGP VRF neighbor activation, not community propagation. Option C is wrong because the VPNv4 neighbor already points to 192.168.1.2 (the remote PE's loopback), which is correct for the MP-BGP session; changing it would break the VPNv4 peering. Option D is wrong because the CE neighbor remote-as is already set to 65001 (the CE's AS), and changing it to 65000 (the PE's AS) would misconfigure the eBGP session, preventing the CE from establishing a BGP adjacency.

Practice this question →

28

MCQmedium

A service provider is implementing QoS policies on an access aggregation router. They want to shape traffic to a downstream DSLAM to 10 Mbps, but they do not want to exceed the shaping rate even if the line rate is higher. Which QoS tool should be used on the interface facing the DSLAM?

A.Queuing

B.Marking

C.Policing

D.Shaping

AnswerD

Shaping buffers traffic to stay below a configured rate.

Why this answer

Shaping is the correct tool because it buffers excess traffic and smooths the output rate to a configured target (10 Mbps) without exceeding it, even if the physical line rate is higher. Unlike policing, shaping does not drop or re-mark packets when the rate is exceeded, ensuring the downstream DSLAM receives traffic at or below the shaped rate.

Exam trap

Cisco often tests the distinction that shaping buffers and delays traffic to meet a rate, while policing drops or re-marks, leading candidates to mistakenly choose policing when the requirement is to never exceed the rate without dropping.

How to eliminate wrong answers

Option A is wrong because queuing manages the order and prioritization of packets within a queue but does not enforce a specific output rate limit. Option B is wrong because marking sets or modifies DSCP/CoS values for classification and treatment downstream, but it does not control the rate of traffic leaving the interface. Option C is wrong because policing drops or re-marks packets that exceed a configured rate, which can cause TCP retransmissions and does not buffer traffic to maintain a steady rate below the line speed.

Practice this question →

29

Multi-Selecthard

Which THREE components are required to deploy MPLS Layer 3 VPN?

Select 3 answers

A.VRFs on PE routers

B.GRE tunneling

D.LDP

E.MP-BGP with VPNv4 address family

AnswersA, D, E

VRFs provide per-customer routing separation.

Why this answer

VRFs (Virtual Routing and Forwarding) are required on PE routers to maintain separate, isolated routing tables for each customer VPN. This allows overlapping IP addresses between different customers and ensures that traffic from one VPN does not leak into another. Without VRFs, the PE router cannot distinguish between customer routes, making Layer 3 VPN operation impossible.

Exam trap

Cisco often tests the misconception that an IGP like OSPF is mandatory for MPLS Layer 3 VPN, when in fact the required components are VRFs, LDP (or another label distribution protocol), and MP-BGP with VPNv4 address family—the IGP is only needed to support LDP, not as a direct component of the VPN service.

Practice this question →

30

MCQhard

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

A.MCAST-VPN address family

B.MVPN does not use BGP; it uses PIM.

C.VPNv4 address family

D.IPv4 multicast address family

AnswerA

The MCAST-VPN address family is used for MVPN signaling.

Why this answer

In a draft-rosen MVPN (Multicast VPN) implementation, BGP is used to signal multicast routing information between PE routers. The MCAST-VPN address family (AFI 25, SAFI 5) is specifically defined to carry multicast VPN routes, including Intra-AS I-PMSI A-D routes and S-PMSI A-D routes, enabling the exchange of multicast state and tunnel information across the MPLS/VPN backbone.

Exam trap

Cisco often tests the distinction between the MCAST-VPN address family (used for MVPN signaling) and the VPNv4 address family (used for unicast VPN routes), leading candidates to mistakenly select VPNv4 when multicast is involved.

How to eliminate wrong answers

Option B is wrong because MVPN with BGP signaling (draft-rosen) explicitly uses BGP to carry multicast routing information; PIM is used for control plane signaling within the VRF but not for inter-PE multicast route exchange. Option C is wrong because the VPNv4 address family carries unicast VPN-IPv4 prefixes, not multicast routing information; multicast VPN requires the MCAST-VPN address family. Option D is wrong because the IPv4 multicast address family (AFI 1, SAFI 2) is used for native IPv4 multicast routing (e.g., PIM BSR or Auto-RP) and does not support VRF-scoped multicast VPN signaling.

Practice this question →

31

Multi-Selecthard

Which THREE of the following are correct statements about EVPN-VXLAN in a data center fabric? (Select three.)

Select 3 answers

A.EVPN route type 3 is used for BUM traffic forwarding.

B.VXLAN encapsulation adds a 50-byte outer header (14 Ethernet + 20 IP + 8 UDP + 8 VXLAN).

C.EVPN route type 2 is used to advertise MAC and IP addresses.

D.VXLAN is a Layer 3 overlay that requires an IGP in the overlay.

E.VXLAN always requires IP multicast in the underlay for BUM traffic.

AnswersA, B, C

Route type 3 is the inclusive multicast route.

Why this answer

EVPN route type 3 (Inclusive Multicast Ethernet Tag Route) is used to advertise the VTEP addresses that participate in a given broadcast domain (EVI). This enables the underlay to forward BUM (Broadcast, Unknown unicast, Multicast) traffic by building a head-end replication list or by signaling multicast group membership, ensuring that BUM frames are delivered to all remote VTEPs in the same VXLAN segment.

Exam trap

Cisco often tests the misconception that VXLAN is a Layer 3 overlay or that it always requires multicast in the underlay, when in fact VXLAN is a Layer 2 overlay and can use head-end replication as an alternative to multicast.

Practice this question →

32

MCQmedium

Given the output, which configuration mismatch would prevent a remote PE in the same VPN from installing this route into its VRF?

A.The remote PE has an import RT that does not include RT:65000:200.

B.The remote PE uses a different route distinguisher for its VRF.

C.The remote PE filters routes based on BGP AS-path containing AS 65000.

D.The next-hop 10.1.1.2 is not reachable in the remote PE's global routing table.

AnswerA

Correct: The route's RT must match an import RT on the remote VRF for the route to be installed.

Why this answer

The route carries RT:65000:200. For a remote PE to install this route into its VRF, the VRF must have an import RT that includes RT:65000:200. If the remote PE's VRF imports a different RT (e.g., RT:65000:100), the route will not be installed.

Option B is incorrect because different route distinguishers (RDs) do not prevent route installation as long as the Route Target matches. Option C is incorrect because MPLS VPN does not filter routes based on BGP AS-path by default; moreover, the AS-path containing AS 65000 is not a typical filter in this context. Option D is incorrect because the next-hop 10.1.1.2 is reachable in the remote PE's global routing table, as indicated by the output (or assumed reachable).

Practice this question →

33

MCQeasy

Which technology allows a service provider to offer different classes of service over a single MPLS network?

C.LDP

D.MPLS VPN (VRF)

AnswerA

QoS provides classification and prioritization for service classes.

Why this answer

QoS (Quality of Service) enables a service provider to differentiate traffic by marking packets with specific DSCP or IP precedence values and applying policies such as policing, shaping, and queuing. This allows multiple classes of service (e.g., voice, video, best-effort) to be carried over a single MPLS network while guaranteeing bandwidth, latency, and jitter requirements for each class.

Exam trap

Cisco often tests the misconception that MPLS VPNs or VRFs alone provide class-of-service differentiation, when in fact VRFs only isolate routing and forwarding, and QoS policies must be separately configured to prioritize traffic within or across VPNs.

How to eliminate wrong answers

Option B (BGP) is wrong because BGP is a routing protocol used to exchange reachability information between autonomous systems, not a mechanism for classifying or prioritizing traffic into different service classes. Option C (LDP) is wrong because LDP is a label distribution protocol that builds MPLS label-switched paths (LSPs) but does not provide any traffic differentiation or class-of-service capabilities. Option D (MPLS VPN with VRF) is wrong because VRFs provide logical separation of routing tables and forwarding planes for different customers or VPNs, but they do not inherently offer per-class traffic prioritization; QoS policies must be explicitly applied to achieve class-of-service differentiation.

Practice this question →

34

MCQeasy

A service provider is deploying IGMPv3 snooping on an MVPN network to optimize multicast forwarding. After configuration, multicast traffic is not reaching receivers. The source is sending to group 239.1.1.1. The PE router has received the IGMP report from the receiver, and the MDT is established. What is the most likely reason?

A.The RP for the group is not configured

B.The IGMP snooping is filtering the multicast traffic because of wrong VLAN configuration

C.The source-specific multicast (SSM) range is applied but the receiver sent a (*,G) report

D.The multicast routing is not enabled globally

AnswerC

Correct. IGMPv3 allows source-specific reports. If the group falls in SSM range, the receiver must specify the source; otherwise, traffic is not forwarded.

Why this answer

IGMPv3 snooping on the PE router processes the receiver's IGMPv3 report. If the SSM range (232.0.0.0/8) is applied to group 239.1.1.1, the receiver must send an IGMPv3 (S,G) report to join a specific source. However, if the receiver sends a (*,G) report (which is allowed only in ASM mode), the IGMP snooping will not install the forwarding entry, causing multicast traffic to be dropped even though the MDT is established.

Exam trap

The trap here is that candidates assume IGMPv3 snooping always works with any group, forgetting that the SSM range enforces (S,G) reports and that a (*,G) report in that range is silently dropped, not processed.

How to eliminate wrong answers

Option A is wrong because the RP is not required for SSM operation; in SSM, receivers learn the source via out-of-band mechanisms, and the PE uses the (S,G) state directly without an RP. Option B is wrong because the question states the MDT is established and the IGMP report is received, indicating VLAN configuration is correct; IGMP snooping filtering due to wrong VLAN would prevent the report from reaching the PE. Option D is wrong because multicast routing must be enabled globally for any multicast forwarding to work, but the question confirms the MDT is established, which implies multicast routing is already enabled.

Practice this question →

35

Multi-Selecthard

Which THREE characteristics apply to the BGP-LS (BGP Link State) protocol?

Select 3 answers

A.It supports only IS-IS, not OSPF.

B.It uses a separate address family from VPNv4.

C.It distributes link-state information from IGPs like OSPF and IS-IS.

D.It uses BGP as the transport protocol.

E.It carries traffic-engineering parameters in the NLRI.

AnswersB, C, D

BGP-LS uses AFI 16388, SAFI 71.

Why this answer

BGP-LS uses a separate address family (AFI 16388 / SAFI 71) from VPNv4 (AFI 1 / SAFI 128) to carry link-state information. This separation allows BGP-LS to operate independently from VPNv4 routes, enabling the collection and distribution of IGP topology data without interfering with MPLS VPN signaling.

Exam trap

Cisco often tests the misconception that BGP-LS only supports IS-IS (Option A) or that TE parameters are carried in the NLRI (Option E), when in fact BGP-LS supports both OSPF and IS-IS, and TE attributes are carried as sub-TLVs within the BGP-LS path attribute, not directly in the NLRI.

Practice this question →

36

MCQhard

A large service provider is migrating its L2VPN services (VPWS and VPLS) to EVPN-based solutions to improve scalability and support multi-homing. During the rollout for a customer using VLAN-based EVPN for a data center interconnect, the operations team notices frequent MAC address flapping and broadcast storms on one of the attachment circuits connected to a PE router. The PE is configured for EVPN-MPLS with ESI multihoming using all-active mode. The customer has two PEs (PE1 and PE2) connected to the same CE via two separate Ethernet links. The MAC table on PE1 shows the same MAC address alternating between the local AC interface and the remote EVPN peers. What is the most likely cause and the correct action to resolve this issue?

A.Implement ESI multihoming with per-flow load balancing to ensure consistent designated forwarder election.

B.Disable split-horizon on the local AC interface to allow MAC learning from the CE directly.

C.Enable selective multicast on the EVPN instance to reduce broadcast traffic.

D.Use MPLS encapsulation instead of VXLAN to avoid MAC address issues.

AnswerA

Proper ESI configuration and DF election prevent duplicate MACs and loops; per-flow load balancing can help but the key is correct ESI.

Why this answer

In all-active multihoming, both PEs forward traffic for the same VLAN, but split-horizon prevents loops. However, if the designated forwarder (DF) election is inconsistent—for example, due to misconfiguration of ESI or DF algorithm—both PEs may forward broadcast/multicast traffic, causing MAC flapping and broadcast storms. Per-flow load balancing ensures consistent DF election by hashing based on flow characteristics, reducing the chance of both PEs forwarding the same MAC addresses.

Option B (disabling split-horizon) would worsen loops. Option C (selective multicast) is for optimizing multicast, not for MAC flapping. Option D (MPLS vs VXLAN) does not affect MAC learning loops.

Exam trap

Candidates often think that split-horizon is causing the issue, but in all-active mode, split-horizon is enabled by default. The real issue is often DF election inconsistency, which can be addressed by per-flow load balancing.

Practice this question →

37

MCQmedium

A network engineer is troubleshooting slow BGP convergence after a link failure in an MPLS core. Which feature can be enabled on the PE routers to fast-failover traffic upon BGP next-hop unreachability?

A.Route Reflector clustering

B.Bidirectional Forwarding Detection (BFD)

C.Local Preference manipulation

D.BGP Prefix Independent Convergence (PIC)

AnswerD

BGP PIC pre-installs backup paths for fast failover.

Why this answer

BGP Prefix Independent Convergence (PIC) enables fast failover by pre-installing backup paths into the forwarding table, so when a BGP next-hop becomes unreachable, traffic is immediately switched to the backup path without waiting for BGP reconvergence. This is critical in MPLS cores where slow BGP convergence after a link failure can cause prolonged traffic loss.

Exam trap

Cisco often tests the distinction between fast detection (BFD) and fast failover (PIC), so candidates mistakenly choose BFD thinking it alone solves slow convergence, but BFD only detects failure faster—it does not pre-install backup paths.

How to eliminate wrong answers

Option A is wrong because Route Reflector clustering reduces the number of iBGP sessions and improves scalability, but does not provide fast failover upon next-hop unreachability. Option B is wrong because BFD provides fast link failure detection, but it does not pre-install backup forwarding paths; it only speeds up the detection of failure, after which BGP still needs to reconverge. Option C is wrong because Local Preference manipulation influences BGP path selection but does not enable fast failover; it is a policy tool, not a convergence acceleration mechanism.

Practice this question →

38

MCQmedium

A service provider is deploying MPLS L3VPN and wants to ensure that routes from a specific customer VRF are only advertised to a specific remote PE. Which mechanism should be used?

A.Applying a route-map to the VRF export statement

B.Configuring a separate VPNv4 address-family for that PE

C.Using a unique route-distinguisher per VRF

D.Setting the next-hop-self on the PE

AnswerA

Correct. A route-map on export can filter routes before they are advertised to other PEs via VPNv4.

Why this answer

A route-map applied to the VRF export statement allows granular control over which routes are advertised to specific BGP VPNv4 neighbors. By matching on route targets or other attributes, the route-map can filter outbound routes per neighbor, ensuring that routes from a specific customer VRF are only sent to a designated remote PE.

Exam trap

Cisco often tests the misconception that route-distinguishers or next-hop-self control route advertisement scope, when in fact they serve entirely different purposes (prefix uniqueness and next-hop resolution, respectively).

How to eliminate wrong answers

Option B is wrong because configuring a separate VPNv4 address-family for that PE does not inherently restrict which VRF routes are advertised; it merely creates a separate BGP session, but without additional filtering, all VPNv4 routes would still be exchanged. Option C is wrong because a unique route-distinguisher per VRF is used to make IPv4 prefixes unique across VRFs, not to control advertisement scope; it does not filter which routes are sent to specific PEs. Option D is wrong because setting next-hop-self on the PE changes the next-hop IP address in BGP updates but does not limit which routes are advertised to a particular remote PE.

Practice this question →

39

MCQeasy

A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?

A.l2vpn xconnect context

B.mpls l2transport route 10.1.1.2 100

C.neighbor 10.1.1.2 remote-as 100

D.pseudowire 10.1.1.2 100 encapsulation mpls

AnswerB

This defines the peer IP and VC ID for the pseudowire.

Why this answer

The `mpls l2transport route` command is used under the xconnect configuration on a PE router to specify the remote PE's IP address and the VC ID for the pseudowire. This command establishes the MPLS L2VPN circuit by creating a targeted LDP session for label exchange, which is required for EoMPLS pseudowire setup.

Exam trap

Cisco often tests the distinction between BGP-based L2VPN (Option C) and MPLS L2VPN using targeted LDP (Option B), where candidates mistakenly apply BGP commands for a simple EoMPLS pseudowire that does not require BGP.

How to eliminate wrong answers

Option A is wrong because `l2vpn xconnect context` is not a valid Cisco IOS command; the correct command to enter xconnect configuration is `xconnect` under the interface, and the context is not used for pseudowire establishment. Option C is wrong because `neighbor 10.1.1.2 remote-as 100` is a BGP configuration command used for establishing BGP peering, not for setting up an MPLS pseudowire in EoMPLS. Option D is wrong because `pseudowire 10.1.1.2 100 encapsulation mpls` is not a valid Cisco command; the correct syntax uses `mpls l2transport route` to define the pseudowire endpoint and VC ID.

Practice this question →

40

MCQhard

Refer to the exhibit. Which statement is true regarding the forwarding entry for 10.2.2.0/24?

A.This entry uses explicit label request (not PHP).

B.The outgoing interface uses penultimate hop popping.

C.The outgoing label is Untagged.

D.The local label is 20.

AnswerA

Outgoing label 20 means next hop expects that label, not pop.

Why this answer

The forwarding entry for 10.2.2.0/24 shows an outgoing label of 20, which means the egress LSR is not performing penultimate hop popping (PHP). In MPLS, when the outgoing label is not the implicit-null label (3) or explicit-null label (0), the penultimate hop must push that label, and the egress LSR will perform a full label lookup. This is an explicit label request, not PHP.

Exam trap

Cisco often tests the distinction between the incoming label (local label) and the outgoing label in the forwarding table, and the trap here is that candidates confuse the local label (which is the label this router assigns for the FEC) with the incoming label shown in the forwarding entry, leading them to incorrectly select option D.

How to eliminate wrong answers

Option B is wrong because penultimate hop popping (PHP) would require the outgoing label to be implicit-null (label 3) or the forwarding entry to indicate 'Pop Label', but here the outgoing label is 20, so PHP is not used. Option C is wrong because 'Untagged' means the packet is forwarded without an MPLS label, but the entry shows an outgoing label of 20, so the packet is label-switched. Option D is wrong because the local label is the label assigned by this LSR for the FEC, which is not shown in the exhibit; the exhibit only shows the incoming label (20) and outgoing label (20) for the forwarding entry, not the local label assigned by this router.

Practice this question →

41

MCQmedium

Refer to the exhibit. A PE router has this BGP configuration. The CE router is advertising a default route via eBGP. However, the PE is not installing the route in the VRF table. What is the most likely cause?

A.The redistribute connected command under the VRF is overwriting the default route

B.The neighbor 10.1.1.1 is not configured under the address-family ipv4 vrf CUSTOMER

C.The next-hop-self under the VRF address-family is not set

D.The default-information originate command is missing

AnswerB

Correct. Without activating the neighbor under the VRF address-family, eBGP routes from CE are not imported into the VRF.

Why this answer

The BGP configuration shows that the neighbor 10.1.1.1 is configured under the BGP IPv4 unicast address-family, but not under the address-family ipv4 vrf CUSTOMER. For a VRF to install a route learned via eBGP from a CE router, the neighbor must be explicitly activated under the VRF address-family. Without this, the PE will receive the default route but will not place it into the VRF routing table.

Exam trap

Cisco often tests the distinction between configuring a BGP neighbor globally versus under a VRF address-family, tricking candidates into thinking that a neighbor statement under router bgp is sufficient for VRF route installation.

How to eliminate wrong answers

Option A is wrong because the 'redistribute connected' command under the VRF does not overwrite the default route; it only injects directly connected routes into the VRF, and BGP routes have a higher administrative distance (20 for eBGP) compared to connected routes (0), so there is no overwriting. Option C is wrong because 'next-hop-self' is used to change the next-hop attribute of routes advertised to a neighbor, but it does not affect the installation of a received route into the VRF table; the route is not being installed because the neighbor is not activated under the VRF address-family. Option D is wrong because 'default-information originate' is used to originate a default route into BGP from the PE to the CE, not to accept a default route from a CE; the PE is receiving the default route but failing to install it due to the missing VRF address-family configuration.

Practice this question →

42

MCQhard

An ISP operates an MPLS Layer 3 VPN backbone. A customer, Corporation X, has four sites (A, B, C, D) each connected to a different PE router (PE-A, PE-B, PE-C, PE-D). They use OSPF as the CE-PE routing protocol. Sites A, B, and C can exchange routes without issue. However, Site D suddenly loses connectivity to Site B, though it can still reach Sites A and C. Show commands on PE-D reveal that the VRF for Corporation X imports RT:100:200, and the route for Site B (prefix 10.10.20.0/24) is present in the BGP VPNv4 table with RT:100:200 and next-hop 10.0.2.2. The OSPF neighbor between PE-D and the CE at Site D is up, and no route filters are configured. ‘ping 10.10.20.0’ from PE-D fails. What is the most likely cause of the issue?

A.OSPF route redistribution from PE-B into BGP is set to external type 2, while PE-D expects type 1.

B.The route target for Site B is misconfigured on PE-D, not matching the export RT from PE-B.

C.PE-D is not assigning an MPLS label for the route to Site B, causing packets to be dropped.

D.The BGP next-hop (10.0.2.2) for Site B's route is not reachable in PE-D's global routing table.

AnswerD

Correct: If the next-hop is unreachable, the VPNv4 route cannot be installed in the VRF, causing loss of connectivity to that specific site.

Why this answer

The route is in the VPNv4 table with the correct RT, so import is working. The next-hop is 10.0.2.2. For the VPNv4 route to be installed into the VRF, the next-hop must be reachable in the global routing table of PE-D.

If it is not reachable, the route will not be installed, explaining the loss of connectivity to Site B. This can be verified with 'show ip route 10.0.2.2' on PE-D. Option A is incorrect because OSPF route type does not affect BGP redistribution.

Option B is incorrect because the route is present in the VPNv4 table with the correct RT, so import is fine. Option C is incorrect because label allocation is working (the prefix is present with labels).

Practice this question →

43

Multi-Selecteasy

Which TWO of the following are services that can be offered using MPLS Layer 3 VPN (L3VPN) technology? (Select two.)

Select 2 answers

A.IP transit services

B.Layer 2 bridging between sites

C.Transport of Ethernet frames over MPLS

D.Native multicast support without tunnels

E.Internet access for customers

AnswersA, E

L3VPN provides IP routing between sites.

Why this answer

MPLS Layer 3 VPN (L3VPN) uses a peer-to-peer model where the provider edge (PE) router participates in the customer's routing via MP-BGP (RFC 4364). This allows the provider to offer IP transit services by carrying customer IP routes across the MPLS backbone, and Internet access by connecting the customer VRF to an Internet-facing VRF or global routing table. Both services rely on the L3VPN architecture's ability to separate and forward IP traffic based on VRFs and route targets.

Exam trap

Cisco often tests the distinction between L3VPN and L2VPN services, so the trap here is that candidates confuse Layer 2 transport (Ethernet frames, bridging) with Layer 3 IP forwarding, leading them to select options B or C as valid L3VPN services.

Practice this question →

44

MCQhard

A service provider has a network with multiple PE routers providing MPLS L3VPN services. Customers are complaining that some remote sites are unreachable after a recent software upgrade on PE1. Upon investigation, you notice that PE1 is receiving BGP VPNv4 routes from the route reflector, but some routes are not being installed in the VRF routing table. PE1 is configured with BGP additional-path capability and has a route policy that selects only the best path. The VRF on PE1 has import and export route targets configured correctly. The missing routes have a higher local preference but are not selected due to a tie-break in BGP path selection. Which action should be taken to ensure that all valid routes are installed in the VRF?

A.Reset the BGP session between PE1 and the route reflector.

B.Configure BGP additional-paths for the VRF and adjust the route policy to allow multiple paths.

C.Disable route target filtering on PE1 to import all routes.

D.Increase the local preference on the route reflector for the missing routes.

AnswerB

Additional-paths allows multiple BGP paths to be installed in the VRF.

Why this answer

B is correct because the issue is that PE1 is configured with BGP additional-path capability but has a route policy that selects only the best path. When BGP path selection ties on local preference and other attributes, additional-path send/receive capability allows multiple paths to be considered, but the route policy must be adjusted to permit multiple paths into the VRF. Without this, only the single best path is installed, even if valid alternative paths exist.

Exam trap

Cisco often tests the distinction between enabling BGP additional-path capability globally and actually configuring the VRF to accept multiple paths; candidates mistakenly think that enabling additional-path alone is sufficient, but the route policy must be adjusted to allow multiple paths into the VRF routing table.

How to eliminate wrong answers

Option A is wrong because resetting the BGP session would not change the route selection logic; the same tie-break would occur again, and the missing routes would still not be installed. Option C is wrong because disabling route target filtering would import all routes regardless of RT, which violates VRF isolation and could introduce incorrect routing, but the problem is not about RT filtering—it is about BGP path selection limiting the number of paths installed. Option D is wrong because increasing local preference on the route reflector would only affect the tie-break if the missing routes had a lower local preference, but the scenario states they have a higher local preference and are still not selected due to a different tie-break; changing local preference would not resolve the fundamental issue of multiple paths not being accepted.

Practice this question →

45

MCQeasy

A service provider is deploying a point-to-point Layer 2 VPN across an MPLS network using Ethernet over MPLS (EoMPLS) with Martini encapsulation. The customer requires transparent transport of VLAN tags (Q-in-Q) between two sites. The provider configures the attachment circuits on the PE routers as VLAN subinterfaces with dot1q encapsulation. After configuration, the customer reports that only untagged frames pass through the pseudowire; double-tagged frames are dropped at the egress PE. Which action resolves the issue?

A.Replace the attachment circuit with a port-mode Layer 2 interface and disable VLAN tagging on the PE

B.Configure the pseudowire to use the 'tag-imposition' keyword to allow double tagging

C.Configure the PE routers to use VLAN translation to map both tags to a single tag before encapsulation

D.Change the encapsulation on the PE subinterfaces to dot1q second-dot1q and enable the preservation of the outer VLAN tag at the ingress PE

AnswerD

Why this answer

EoMPLS with Martini encapsulation (RFC 4448) supports Q-in-Q transparent transport only when the ingress PE is configured to preserve the outer VLAN tag. Using 'dot1q second-dot1q' encapsulation on the subinterface tells the PE to treat the outer tag as part of the payload and not strip it, allowing both tags to be carried across the pseudowire. Without this, the default dot1q encapsulation strips the outer tag, causing double-tagged frames to be dropped at the egress PE.

Exam trap

Cisco often tests the distinction between 'dot1q' and 'dot1q second-dot1q' encapsulation on subinterfaces, where candidates mistakenly think that standard dot1q encapsulation will preserve double tags, but it actually strips the outer tag before encapsulation into the pseudowire.

How to eliminate wrong answers

Option A is wrong because replacing the attachment circuit with a port-mode Layer 2 interface and disabling VLAN tagging would strip all VLAN tags, preventing Q-in-Q transport entirely. Option B is wrong because 'tag-imposition' is not a valid keyword for EoMPLS pseudowires; it is a concept used in MPLS VPN label imposition, not for preserving double tags in Layer 2 VPNs. Option C is wrong because VLAN translation would map both tags to a single tag, which defeats the purpose of transparent Q-in-Q transport and does not preserve the original double-tagged frame structure.

Practice this question →

46

MCQhard

An SP is designing a MPLS L3VPN service with BGP as the PE-CE routing protocol. They want to ensure that the CE router does not become a transit router between two sites. Which BGP feature should be configured on the PE to prevent the CE from advertising routes received from one site to another?

A.Site of Origin (SoO)

B.allowas-in

C.disable-connected-check

D.as-override

AnswerA

SoO marks routes so that a CE will ignore routes with its own SoO, preventing transit.

Why this answer

The Site of Origin (SoO) BGP community is the correct feature because it prevents routing loops in MPLS L3VPN environments where the same CE router connects to multiple sites. When configured on the PE, SoO tags routes received from a CE with a unique identifier for that site; if the PE receives a route with the same SoO value from another site, it discards the route, ensuring the CE does not become a transit router between sites.

Exam trap

Cisco often tests the confusion between SoO and as-override, as both deal with BGP updates in MPLS L3VPN, but as-override modifies the AS_PATH to allow route acceptance, while SoO prevents route redistribution to avoid transit routing.

How to eliminate wrong answers

Option B (allowas-in) is wrong because it allows the PE to accept BGP updates containing its own AS number, which is used in hub-and-spoke topologies to permit route reflection, not to prevent transit routing. Option C (disable-connected-check) is wrong because it disables the TCP connection check for eBGP multihop sessions, ensuring the BGP session stays up even if the next-hop is not directly connected, which is unrelated to preventing transit routing. Option D (as-override) is wrong because it replaces the CE's AS number with the PE's AS number in BGP updates to overcome the split-horizon rule in hub-and-spoke designs, but it does not prevent the CE from advertising routes between sites.

Practice this question →

47

Drag & Dropmedium

Drag and drop the steps to configure a GRE tunnel on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

GRE tunnel configuration involves creating the tunnel interface, setting source and destination, and assigning an IP address.

Practice this question →

48

MCQeasy

A service provider is configuring VRF-lite between two CE routers connected to the same PE. The CE routers are in different VRFs. Which command allows the PE router to forward traffic between the VRFs?

A.vrf forward RED

B.route-target export RED:100 import BLUE:100

C.ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.1 global

D.ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE

AnswerD

Correct. This command uses the 'vrf' keyword to route between VRFs.

Why this answer

The command `ip route vrf RED 0.0.0.0 0.0.0.0 vrf BLUE` creates a static inter-VRF route on the PE router, allowing traffic from VRF RED to be forwarded to VRF BLUE without requiring MPLS or BGP. This is the standard method for VRF-lite inter-VRF communication on the same PE, using a static route that points to the next-hop VRF instead of an IP address.

Exam trap

Cisco often tests the distinction between VRF-lite static inter-VRF routes and MPLS L3VPN route-target commands, trapping candidates who confuse the simple static route approach with the BGP-based route-target import/export mechanism.

How to eliminate wrong answers

Option A is wrong because `vrf forward RED` is not a valid Cisco IOS command; it does not exist and would not configure inter-VRF forwarding. Option B is wrong because `route-target export RED:100 import BLUE:100` is used in MPLS L3VPN environments to control route distribution between VRFs via MP-BGP, not for direct VRF-lite forwarding on a single PE. Option C is wrong because `ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.1 global` installs a default route in VRF RED pointing to a next-hop in the global routing table, which does not forward traffic into another VRF; it only sends traffic to the global table, not to VRF BLUE.

Practice this question →

49

MCQmedium

A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?

A.The next-hop must be reachable via the IGP with an MPLS label.

B.The next-hop must be a directly connected interface.

C.The PE must have a VPN label for the next-hop.

D.The IGP must be IS-IS, not OSPF.

AnswerA

MPLS LSP must exist to the next-hop for label imposition.

Why this answer

For a PE router to install a VPNv4 prefix learned from a route reflector into its routing table, the BGP next-hop (typically the remote PE) must be reachable via the IGP with an associated MPLS label. This ensures that the transport LSP exists to forward traffic toward the next-hop, which is required for MPLS L3VPN operation. Without an MPLS label in the IGP for the next-hop, the PE cannot build the necessary label stack and will not install the VPNv4 route.

Exam trap

Cisco often tests the misconception that a directly connected next-hop or a VPN label for the next-hop is required, when in fact the critical condition is IGP reachability with an MPLS label for the BGP next-hop.

How to eliminate wrong answers

Option B is wrong because the next-hop does not need to be a directly connected interface; it only needs to be reachable via the IGP with an MPLS label, even if multiple hops away. Option C is wrong because the PE does not need a VPN label for the next-hop; the VPN label is assigned by the remote PE for the specific VPN prefix, not for the next-hop itself. Option D is wrong because the IGP can be either IS-IS or OSPF, as both can carry MPLS label information via extensions like MPLS-TE or LDP; there is no requirement for IS-IS specifically.

Practice this question →

50

MCQmedium

A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?

A.LDP

B.MPLS-TE (RSVP-TE)

C.SR-TE

D.BGP-LU

AnswerC

SR-TE policies enable traffic engineering with Segment Routing.

Why this answer

C is correct because Segment Routing Traffic Engineering (SR-TE) allows the service provider to perform traffic engineering without RSVP-TE by using segment lists (label stacks) to steer traffic along explicit paths. SR-TE leverages the IGP (OSPF or IS-IS) to distribute segment IDs (SIDs) and uses a centralized controller or headend node to compute and enforce TE policies, eliminating the need for RSVP-TE's per-flow signaling and state maintenance.

Exam trap

Cisco often tests the misconception that BGP-LU can replace RSVP-TE for traffic engineering, but BGP-LU only provides label distribution for inter-domain reachability, not explicit path control within a single domain.

How to eliminate wrong answers

Option A is wrong because LDP is a label distribution protocol that only distributes labels for IGP shortest-path forwarding, not for traffic engineering; it lacks explicit path control and cannot replace RSVP-TE. Option B is wrong because MPLS-TE (RSVP-TE) is the technology being migrated away from, and the question explicitly asks for a solution that does not require RSVP-TE. Option D is wrong because BGP-LU (BGP Labeled Unicast) is used for inter-domain label distribution and MPLS VPN services, not for intra-domain traffic engineering with explicit path steering.

Practice this question →

51

MCQhard

Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?

A.Only routes matching 10.1.0.0/16 or more specific will have the community added; other routes remain unchanged.

B.Routes with a mask longer than /24 will be rejected by the prefix-list.

C.All routes from the customer will have their communities replaced with 65000:100.

D.Routes not matching the prefix-list will be denied and not installed.

AnswerA

The route-map permits matching routes with additive community, denies others without affecting acceptance.

Why this answer

The configuration uses a route-map applied to the neighbor with a match clause referencing a prefix-list that permits 10.1.0.0/16 le 32. This matches the exact prefix and any more specific prefix (up to /32). The set community 65000:100 action adds the community without using the additive keyword, but because the route-map does not contain a deny clause for non-matching routes, all routes are still accepted; only matching routes have the community added.

Thus, only routes matching 10.1.0.0/16 or more specific will have community 65000:100 added, and other routes remain unchanged.

Exam trap

Cisco often tests the misconception that a route-map with a match clause and no explicit deny will reject non-matching routes, when in fact unmatched routes are still permitted and unchanged unless a deny sequence is present.

How to eliminate wrong answers

Option B is wrong because the prefix-list permits 10.1.0.0/16 le 32, which allows masks longer than /24 (e.g., /25, /28) — there is no reject condition for masks longer than /24. Option C is wrong because the set community command does not include the additive keyword, so it replaces any existing communities on matching routes, but it does not affect non-matching routes at all; the route-map only applies the set action to matched prefixes, not to all routes. Option D is wrong because the route-map has no explicit deny statement; routes that do not match the prefix-list simply fall through without a set action and are still accepted and installed normally.

Practice this question →

52

MCQeasy

A network engineer is configuring QoS on a Cisco ASR 9000 router to support multiple traffic classes. The policy must ensure that real-time traffic (EF) is not starved by high-volume bulk data (AF11). Which queuing strategy should be applied to the EF class to provide low latency and strict priority?

A.Weighted Round Robin (WRR)

B.Class-Based Weighted Fair Queuing (CBWFQ)

C.Priority Queuing (LLQ)

D.First-In-First-Out (FIFO)

AnswerC

LLQ provides a strict priority queue for EF traffic.

Why this answer

Low Latency Queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that EF (real-time) traffic is always served before other queues. This prevents starvation of delay-sensitive traffic by bulk data (AF11) while still allowing fair treatment of other classes. LLQ is the standard Cisco mechanism for supporting real-time traffic like VoIP with guaranteed low latency.

Exam trap

Cisco often tests the misconception that CBWFQ alone can provide low latency for real-time traffic, but the trap is that CBWFQ lacks a strict priority queue, so candidates must recognize that LLQ is required for EF traffic to avoid delay and jitter.

How to eliminate wrong answers

Option A is wrong because Weighted Round Robin (WRR) does not provide strict priority; it services queues in a round-robin fashion based on weights, which can cause delay for real-time traffic if the bulk data queue is heavy. Option B is wrong because Class-Based Weighted Fair Queuing (CBWFQ) assigns bandwidth guarantees but lacks a strict priority mechanism, so EF traffic could still be delayed by AF11 traffic during congestion. Option D is wrong because First-In-First-Out (FIFO) treats all traffic equally with no differentiation, making it impossible to protect real-time traffic from being starved by bulk data.

Practice this question →

53

MCQhard

In EVPN multihoming with all-active mode, what is the purpose of the aliasing capability?

A.It permits the use of a single ESI label across all PEs in the ES.

B.It reduces the number of BGP updates by aggregating MAC routes.

C.It allows load balancing of traffic across all PEs.

D.It enables one PE to advertise MAC addresses for another PE in the same ES.

AnswerD

Correct. Aliasing allows a PE to advertise MACs for other PEs in the same ES, making all active paths known.

Why this answer

In EVPN all-active multihoming, the aliasing capability allows a PE that has learned a MAC address via local attachment to the Ethernet Segment (ES) to advertise that MAC address on behalf of other PEs in the same ES. This enables remote PEs to load-balance traffic destined to that MAC across all multihomed PEs, even if only one PE actually learned the MAC locally. Without aliasing, traffic would be forced to the specific PE that learned the MAC, defeating the purpose of all-active redundancy.

Exam trap

Cisco often tests the distinction between aliasing (advertising MACs for other PEs) and load balancing (the forwarding behavior that aliasing enables), causing candidates to mistakenly select 'load balancing' as the purpose of aliasing itself.

How to eliminate wrong answers

Option A is wrong because the aliasing capability does not involve a single ESI label; each PE in the ES advertises its own MPLS label (e.g., the ESI label or MAC/IP advertisement label), and the aliasing function is about MAC address advertisement, not label consolidation. Option B is wrong because aliasing does not reduce BGP updates or aggregate MAC routes; in fact, it may increase the number of MAC/IP advertisement routes as each PE advertises the same MAC addresses, and aggregation is not a feature of EVPN aliasing. Option C is wrong because aliasing itself does not perform load balancing; it enables load balancing by allowing remote PEs to see multiple next hops for the same MAC, but the actual load balancing is a forwarding decision made by the remote PE based on the received aliased routes.

Practice this question →

54

Multi-Selectmedium

Which two of the following are characteristics of MPLS Traffic Engineering that differentiate it from pure MPLS forwarding?

Select 2 answers

A.Requires LDP for LSP creation

B.Allows bandwidth reservation

C.Supports explicit path selection

D.Provides optimal load balancing based on topology

E.Uses RSVP for label distribution

AnswersB, C

Correct. MPLS TE can reserve bandwidth along a path to guarantee QoS.

Why this answer

MPLS Traffic Engineering (MPLS-TE) explicitly supports bandwidth reservation, which allows an operator to guarantee a certain amount of bandwidth for a traffic-engineered LSP. This is a key differentiator from pure MPLS forwarding, where LSPs are created without any bandwidth awareness and simply forward packets based on the label-swapping mechanism.

Exam trap

Cisco often tests the misconception that MPLS-TE requires LDP for LSP creation, but in reality, MPLS-TE uses RSVP-TE for signaling and does not depend on LDP for the TE LSPs themselves.

Practice this question →

55

MCQhard

A service provider is troubleshooting BGP route advertisement for a VPNv4 prefix. The PE router receives the prefix from the route reflector but does not install it in the VRF routing table. The BGP table shows the prefix as valid but not best. What is the most likely cause?

A.The VRF does not have the correct route-target import.

B.The next-hop is not reachable via the IGP with an MPLS label.

C.The BGP table is full and cannot accept more prefixes.

D.The MPLS label is missing in the BGP update.

AnswerB

Next-hop unreachability causes the route to be not best.

Why this answer

For a VPNv4 prefix to be installed in the VRF routing table, BGP must select it as the best path. A key requirement for best-path selection is that the next-hop address must be reachable via the IGP with an associated MPLS label (via LDP or other label distribution protocol). If the next-hop is not reachable with a label, the route remains valid but not best, and thus is not installed in the VRF.

Exam trap

Cisco often tests the distinction between a route being valid (accepted into BGP table) versus best (eligible for installation into the VRF), and the trap here is that candidates assume a valid route should automatically be installed, overlooking the next-hop reachability with label requirement for MPLS VPNs.

How to eliminate wrong answers

Option A is wrong because the VRF route-target import configuration determines whether the prefix is accepted into the VRF at all; if the import RT matches, the prefix enters the BGP table, but the issue here is that it is already in the BGP table as valid, so RT import is not the problem. Option C is wrong because a full BGP table would prevent new prefixes from being accepted, but the prefix is already present in the BGP table as valid, so table capacity is not the limiting factor. Option D is wrong because if the MPLS label were missing in the BGP update, the prefix would likely be marked as invalid or not installed at all, but the question states the prefix is valid, indicating the label is present in the update; the problem is that the next-hop itself is not reachable via the IGP with a label.

Practice this question →

56

MCQmedium

A customer is experiencing packet loss during congestion on a link. The service provider wants to implement a QoS policy that drops less important traffic before more important traffic. Which queuing mechanism is best suited?

A.Class-Based Weighted Fair Queuing (CBWFQ) with WRED

B.FIFO queuing

C.Low Latency Queuing (LLQ)

D.Traffic shaping

AnswerA

CBWFQ allocates bandwidth per class, WRED drops low priority before high priority.

Why this answer

CBWFQ with WRED is the best choice because CBWFQ provides per-class queuing with guaranteed bandwidth, while WRED proactively drops less important traffic (based on IP precedence or DSCP) before the queue becomes full, preventing tail drop and ensuring that higher-priority traffic is preserved during congestion. This combination allows the service provider to selectively discard lower-priority packets under congestion, meeting the requirement to drop less important traffic before more important traffic.

Exam trap

Cisco often tests the misconception that LLQ alone can prioritize traffic during congestion, but the trap here is that LLQ provides strict priority queuing without proactive dropping, so it does not selectively drop less important traffic; WRED is required for that function.

How to eliminate wrong answers

Option B (FIFO queuing) is wrong because it treats all traffic equally, dropping packets from the tail of the queue regardless of importance, which does not differentiate between traffic classes. Option C (LLQ) is wrong because it is designed to provide strict priority queuing for delay-sensitive traffic (e.g., voice), but it does not inherently drop less important traffic before more important traffic; it can starve other queues if not policed, and it lacks the proactive dropping mechanism of WRED. Option D (Traffic shaping) is wrong because it buffers excess traffic to smooth out bursts and does not drop packets; it delays them, which does not address the requirement to drop less important traffic during congestion.

Practice this question →

57

MCQmedium

During a multicast deployment, some receivers are not receiving the stream. The PIM neighbor table shows the upstream interface is correct. Which command would verify whether the multicast routing table has the correct outgoing interface list?

A.show ip igmp groups

B.show ip pim neighbor

C.show ip mroute

D.show ip route

AnswerC

Shows multicast routing table, including incoming and outgoing interfaces.

Why this answer

The 'show ip mroute' command displays the multicast routing table, including the outgoing interface list (OIL) for each multicast group. Since the PIM neighbor table confirms the upstream interface is correct, the issue likely lies in the OIL, which 'show ip mroute' directly verifies. This command shows which interfaces are forwarding multicast traffic and whether they are pruned or in a forwarding state.

Exam trap

Cisco often tests the distinction between the multicast routing table (show ip mroute) and PIM neighbor or IGMP group commands, trapping candidates who confuse neighbor reachability with correct forwarding interface configuration.

How to eliminate wrong answers

Option A is wrong because 'show ip igmp groups' shows IGMP membership on a router, not the multicast routing table's outgoing interface list; it only indicates which hosts have joined a group on local interfaces. Option B is wrong because 'show ip pim neighbor' displays PIM neighbor relationships and their states, but the question already states the upstream interface is correct, so this command does not help verify the OIL. Option D is wrong because 'show ip route' shows the unicast routing table, which is unrelated to multicast forwarding state or the outgoing interface list for multicast groups.

Practice this question →

58

MCQhard

In a Segment Routing network with TI-LFA enabled, which mechanism prevents micro-loops during a link failure?

A.Constraint Shortest Path First computation

B.Explicit path with segment list and delay timer

C.Loop-Free Alternate precomputed backup paths

D.Prefix Independent Convergence with fast reroute

AnswerB

Correct. TI-LFA encodes a post-convergence path as an explicit segment list and introduces a delay to allow other routers to converge, preventing micro-loops.

Why this answer

In Segment Routing with TI-LFA, micro-loops are prevented by using an explicit path with a segment list and a delay timer. When a link fails, the protecting router installs a backup path with a segment list that steers traffic around the failure, and a delay timer ensures that the backup path is not activated until the network has converged, preventing transient loops.

Exam trap

Cisco often tests the distinction between TI-LFA and traditional LFA, where candidates mistakenly think LFA alone prevents micro-loops, but TI-LFA specifically adds segment lists and delay timers to address this issue.

How to eliminate wrong answers

Option A is wrong because Constraint Shortest Path First (CSPF) computation is used in MPLS-TE for path calculation under constraints, not for micro-loop prevention in TI-LFA. Option C is wrong because Loop-Free Alternate (LFA) precomputed backup paths provide fast reroute but do not inherently prevent micro-loops during convergence; TI-LFA extends LFA with segment lists and delay timers to address this. Option D is wrong because Prefix Independent Convergence (PIC) with fast reroute is a mechanism for fast convergence in MPLS networks, but it does not specifically prevent micro-loops; TI-LFA uses explicit segment lists and timers for that purpose.

Practice this question →

59

MCQeasy

Which multicast RP model is recommended for large-scale networks to provide redundancy and load sharing?

A.Auto-RP

B.BSR

C.Anycast-RP

D.Static RP

AnswerC

Correct. Anycast-RP uses the same IP address for multiple RPs, enabling load sharing and redundancy.

Why this answer

Anycast-RP is recommended for large-scale networks because it allows multiple RPs to share the same IP address, providing redundancy and load sharing without requiring dynamic RP discovery protocols. This model uses MSDP (Multicast Source Discovery Protocol) or PIM (Protocol Independent Multicast) to synchronize multicast state between RPs, ensuring that sources and receivers can register with the nearest RP for optimal path selection.

Exam trap

Cisco often tests the misconception that BSR or Auto-RP provide load sharing, but the trap here is that only Anycast-RP explicitly supports both redundancy and load sharing by allowing multiple RPs to actively serve different groups or sources simultaneously.

How to eliminate wrong answers

Option A is wrong because Auto-RP uses a flood-and-prune mechanism with a designated RP announcement group (224.0.1.39/40), which can cause scalability issues and lacks built-in load sharing across multiple RPs. Option B is wrong because BSR (Bootstrap Router) uses a single elected BSR to distribute RP information, creating a single point of failure and not inherently supporting load sharing across multiple RPs. Option D is wrong because Static RP requires manual configuration on every router, offers no redundancy if the single RP fails, and cannot provide load sharing without additional complex configurations like Anycast-RP.

Practice this question →

60

Multi-Selectmedium

Which TWO statements about QoS policy propagation via BGP (QPPB) are correct?

Select 2 answers

A.QPPB can be applied on inbound direction only.

B.QPPB is an IETF standard.

C.It uses BGP communities to mark QoS on traffic received from customer.

D.It uses MPLS EXP bits to propagate QoS.

E.It dynamically adjusts BGP attributes based on QoS policy.

AnswersA, C

It applies to traffic coming from customers.

Why this answer

QPPB can be applied on inbound direction only. QPPB uses BGP policy to classify traffic based on IP precedence or QoS group, and the classification is performed on incoming traffic before any routing decision. The outbound direction is not supported for QPPB classification.

Exam trap

Cisco often tests the misconception that QPPB is an IETF standard or that it can be applied bidirectionally, when in fact it is a Cisco proprietary feature limited to inbound direction only.

Practice this question →

61

MCQmedium

A service provider is migrating from LDP to Segment Routing. What is the correct order of operations to ensure uninterrupted MPLS forwarding?

A.Enable SR on each router one by one while LDP remains active, then remove LDP after SR is stable.

B.Enable SR on all routers simultaneously.

C.Configure IS-IS SR extensions on all routers, then disable LDP.

D.Disable LDP first to free labels, then enable SR.

AnswerA

Correct. This gradual migration ensures continuous forwarding via LDP while SR is established.

Why this answer

It follows the recommended migration strategy of running LDP and Segment Routing (SR) in parallel. By enabling SR on each router one by one while LDP remains active, MPLS forwarding continues uninterrupted via LDP until SR is fully deployed and stable. Once SR is verified on all routers, LDP can be safely removed without causing any forwarding black holes.

Exam trap

Cisco often tests the misconception that you must disable the old protocol before enabling the new one, but the correct approach is to run both protocols in parallel to maintain forwarding continuity during migration.

How to eliminate wrong answers

Option B is wrong because enabling SR on all routers simultaneously is operationally risky; any misconfiguration or instability in SR could cause widespread forwarding disruption without a fallback. Option C is wrong because configuring IS-IS SR extensions alone does not automatically enable SR MPLS forwarding; you must also enable SR globally and on interfaces, and disabling LDP before SR is stable would break MPLS forwarding. Option D is wrong because disabling LDP first removes the existing label bindings, causing immediate MPLS forwarding failures before SR can provide replacement labels.

Practice this question →

62

Multi-Selecthard

Which three of the following are valid methods for protecting a pseudowire in an MPLS network?

Select 3 answers

A.Multi-segment PW with backup

B.Ethernet OAM CFM

C.RSVP FRR for link protection

D.PW redundancy with active/standby

E.LSP ping for fault detection

AnswersA, C, D

Correct. Multi-segment pseudowires can be configured with a backup path for redundancy.

Why this answer

Multi-segment PW (MS-PW) with backup is a valid protection method because it allows a pseudowire to be established across multiple MPLS segments, with a backup PW path that can take over if the primary MS-PW fails. This provides end-to-end pseudowire redundancy by using a secondary switched path, ensuring service continuity in multi-domain or multi-area MPLS networks.

Exam trap

Cisco often tests the distinction between fault detection tools (like LSP ping or Ethernet OAM) and actual protection mechanisms (like FRR or PW redundancy), leading candidates to mistakenly select detection methods as valid protection answers.

Practice this question →

63

MCQhard

An SP is troubleshooting an MPLS L2VPN VPLS network where MAC flapping is occurring between two PEs. Which mechanism in VPLS prevents loops and ensures that a broadcast frame from one PE is not reflected back to the originating PE?

A.Split horizon

B.Spanning Tree Protocol (STP)

C.Rapid Spanning Tree Protocol (RSTP)

D.MAC address aging

AnswerA

Split horizon prevents forwarding out of incoming pseudowire.

Why this answer

In a VPLS environment, split horizon is the mechanism that prevents loops by ensuring that a broadcast, multicast, or unknown unicast frame received from a pseudowire (PW) is never forwarded back to any other PW on the same PE. This rule, defined in RFC 4761 and RFC 4762, stops the originating PE from receiving its own reflected frames, thus eliminating the MAC flapping that would occur if the frame were looped through the MPLS core.

Exam trap

Cisco often tests the distinction between loop prevention mechanisms used in the customer-facing domain (STP/RSTP) versus those used in the service provider core (split horizon), and the trap here is assuming that STP or RSTP can be applied to the MPLS pseudowires, when in fact VPLS explicitly relies on split horizon to prevent loops within the full-mesh of PEs.

How to eliminate wrong answers

Option B (Spanning Tree Protocol) is wrong because STP is a Layer 2 loop-prevention protocol used in bridged Ethernet networks (e.g., access or customer networks), but it is not designed to operate across the MPLS core of a VPLS; VPLS relies on split horizon instead. Option C (Rapid Spanning Tree Protocol) is wrong for the same reason as STP—it is a faster variant of STP but still operates only on the customer-facing interfaces, not on the pseudowires between PEs, and cannot prevent loops within the VPLS core. Option D (MAC address aging) is wrong because MAC aging is a mechanism to remove stale MAC entries from the forwarding table after a timeout (default 300 seconds on Cisco IOS), but it does not prevent loops or frame reflection; it only cleans up old entries, and MAC flapping can still occur even with aging enabled.

Practice this question →

64

Multi-Selecthard

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Select 3 answers

A.VPLS

B.6VPE

C.MPLS L3VPN

D.Carrier Supporting Carrier (CSC) VPN

E.MDT VPN

AnswersB, C, D

Why this answer

6VPE (IPv6 VPN Provider Edge) requires a dedicated control plane per VPN instance because it uses separate per-VPN routing tables and a distinct BGP session (typically MP-BGP with the IPv6 address family) to exchange IPv6 VPN routes. This ensures that each customer's IPv6 routing information is isolated and processed independently, which is a core requirement for L3VPN services that maintain per-VPN forwarding and control plane separation.

Exam trap

Cisco often tests the misconception that all MPLS-based VPN services (including VPLS and MDT VPN) require per-VPN control planes, but only L3VPN services that maintain per-VPN routing tables and separate routing protocol instances (like MPLS L3VPN, 6VPE, and CSC VPN) actually need dedicated control planes per VPN instance.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Sp Services questions.

Start 20-question session