Services practice questions

A service provider is deploying MPLS Layer 3 VPN and needs to ensure that BGP next-hop resolution works correctly for VPNv4 prefixes learned from a route reflector. The PE routers are directly connected to the RR via iBGP, and there is an IGP running within the MPLS core. Which condition must be met for the PE to install the VPNv4 prefix into its routing table?

Trap 1: The next-hop must be a directly connected interface.

Direct connection is not a requirement; reachability via IGP is sufficient.

Trap 2: The PE must have a VPN label for the next-hop.

VPN label is for per-VRF forwarding, not next-hop resolution.

Trap 3: The IGP must be IS-IS, not OSPF.

Both IS-IS and OSPF are acceptable IGPs.

A
The next-hop must be reachable via the IGP with an MPLS label.
MPLS LSP must exist to the next-hop for label imposition.
B
The next-hop must be a directly connected interface.
Why wrong: Direct connection is not a requirement; reachability via IGP is sufficient.
C
The PE must have a VPN label for the next-hop.
Why wrong: VPN label is for per-VRF forwarding, not next-hop resolution.
D
The IGP must be IS-IS, not OSPF.
Why wrong: Both IS-IS and OSPF are acceptable IGPs.

Question 2hardmultiple choice

A service provider is designing a multicast solution for a Layer 3 VPN. They want to use MVPN with BGP signaling (draft-rosen). The PE routers are configured with VRF and multicast routing enabled. Which BGP address family must be enabled between PE routers to carry multicast routing information?

Trap 1: MVPN does not use BGP; it uses PIM.

draft-rosen uses BGP for auto-discovery and signaling.

Trap 2: VPNv4 address family

VPNv4 carries unicast routes only.

Trap 3: IPv4 multicast address family

Global multicast BGP is not for VPN context.

A
MCAST-VPN address family
The MCAST-VPN address family is used for MVPN signaling.
B
MVPN does not use BGP; it uses PIM.
Why wrong: draft-rosen uses BGP for auto-discovery and signaling.
C
VPNv4 address family
Why wrong: VPNv4 carries unicast routes only.
D
IPv4 multicast address family
Why wrong: Global multicast BGP is not for VPN context.

Question 3easymultiple choice

A network engineer is troubleshooting an MPLS TE tunnel that is not coming up. The tunnel is configured with a strict explicit path, and the path includes an interface that is currently down. Which action should the engineer take to allow the tunnel to use an alternative path?

Trap 1: Increase the path-option preference value.

Preference only orders path-options.

Trap 2: Disable path protection on the tunnel.

Path protection is separate; disabling it does not fix the explicit path issue.

Trap 3: Configure an affinity constraint to exclude the down interface.

Affinity excludes links but doesn't make the path flexible.

A
Increase the path-option preference value.
Why wrong: Preference only orders path-options.
B
Disable path protection on the tunnel.
Why wrong: Path protection is separate; disabling it does not fix the explicit path issue.
C
Change the explicit path to 'loose' for the down interface.
Loose hops allow the tunnel to traverse other interfaces.
D
Configure an affinity constraint to exclude the down interface.
Why wrong: Affinity excludes links but doesn't make the path flexible.

Question 4mediummulti select

Which TWO statements about BGP FlowSpec (RFC 8955) are correct?

Trap 1: FlowSpec uses a separate BGP session from the regular IPv4 unicast…

FlowSpec can be carried in the same session using additional address families.

Trap 2: FlowSpec is designed to replace ACLs on provider edge routers.

FlowSpec provides dynamic traffic filtering but does not replace static ACLs entirely.

Trap 3: FlowSpec requires MPLS forwarding to operate.

FlowSpec can operate on pure IP networks.

A
FlowSpec can be deployed in BGP sessions between a route reflector and a client.
FlowSpec routes can be propagated via BGP within the service provider network.
B
FlowSpec uses a separate BGP session from the regular IPv4 unicast session.
Why wrong: FlowSpec can be carried in the same session using additional address families.
C
FlowSpec is designed to replace ACLs on provider edge routers.
Why wrong: FlowSpec provides dynamic traffic filtering but does not replace static ACLs entirely.
D
FlowSpec requires MPLS forwarding to operate.
Why wrong: FlowSpec can operate on pure IP networks.
E
FlowSpec uses the IPv4 unicast or VPNv4 address family.
FlowSpec uses SAFI 133 (IPv4) or 134 (VPNv4) under the IPv4 AFI.

Question 5hardmulti select

Which THREE characteristics apply to the BGP-LS (BGP Link State) protocol?

Trap 1: It supports only IS-IS, not OSPF.

Both OSPF and IS-IS are supported.

Trap 2: It carries traffic-engineering parameters in the NLRI.

TE parameters are carried in the BGP-LS attribute, not NLRI.

A
It supports only IS-IS, not OSPF.
Why wrong: Both OSPF and IS-IS are supported.
B
It uses a separate address family from VPNv4.
BGP-LS uses AFI 16388, SAFI 71.
C
It distributes link-state information from IGPs like OSPF and IS-IS.
BGP-LS collects topology from IGPs.
D
It uses BGP as the transport protocol.
BGP-LS is an address family within BGP.
E
It carries traffic-engineering parameters in the NLRI.
Why wrong: TE parameters are carried in the BGP-LS attribute, not NLRI.

Study the full QoS explanation →

Question 6hardmultiple choice

Refer to the exhibit. A service provider is applying this QoS policy on a PE-CE interface. The business customer complains that voice traffic (marked with DSCP EF) experiences drops during congestion. What is the likely cause?

Exhibit

interface GigabitEthernet0/0/0/0
 ipv4 address 10.1.1.1 255.255.255.252
 service-policy output QOS_POLICY
!
class-map match-any REALTIME
 match precedence 5
 match dscp ef
!
policy-map QOS_POLICY
 class REALTIME
  priority level 1
  police rate percent 10
 class class-default
  bandwidth remaining ratio 1

Trap 1: The priority level is set too low; voice should be priority level 4.

Priority level only affects the order of multiple priority queues; level 1 is highest.

Trap 2: The 'bandwidth remaining ratio' command under class-default is…

The priority queue is not affected by bandwidth remaining ratio.

Trap 3: The policy is applied in the output direction; it should be input.

Output direction is correct for shaping/policing egress traffic.

A
The police rate under the REALTIME class is limiting voice traffic to 10% of bandwidth.
Policing drops traffic exceeding 10%.
B
The priority level is set too low; voice should be priority level 4.
Why wrong: Priority level only affects the order of multiple priority queues; level 1 is highest.
C
The 'bandwidth remaining ratio' command under class-default is starving the priority queue.
Why wrong: The priority queue is not affected by bandwidth remaining ratio.
D
The policy is applied in the output direction; it should be input.
Why wrong: Output direction is correct for shaping/policing egress traffic.

Question 7mediummultiple choice

Refer to the exhibit. A network engineer is troubleshooting MPLS forwarding for prefix 10.10.10.0/24. The router shows two entries. What does the 'Pop tag' in the outgoing tag indicate?

Exhibit

Router# show mpls forwarding-table 10.10.10.0/24
Local tag  Outgoing tag  Prefix         Outgoing interface  Bytes tag switched
16           Pop tag       10.10.10.0/24   GigabitEthernet0/0/0/0  345678
17           Untagged     10.10.10.0/24   GigabitEthernet0/0/0/1  123456

Trap 1: The router will swap the label with the local label 16.

Local tag is the incoming label, not outgoing.

Trap 2: The router has received an error in label distribution.

PHP is normal behavior.

Trap 3: The router will forward the packet without an MPLS label.

That is indicated by 'Untagged'.

A
The router will swap the label with the local label 16.
Why wrong: Local tag is the incoming label, not outgoing.
B
The router has received an error in label distribution.
Why wrong: PHP is normal behavior.
C
The router will pop the MPLS label before forwarding the packet.
PHP is performed by the penultimate router.
D
The router will forward the packet without an MPLS label.
Why wrong: That is indicated by 'Untagged'.

Question 8easymultiple choice

A service provider is implementing L2VPN using EoMPLS. The CE devices are connected to two different PE routers, and the PE routers are configured with xconnect under the attachment circuit. Which command is required on the PE routers to establish the pseudowire?

Trap 1: l2vpn xconnect context

This is a global configuration mode, not a command to specify the remote peer.

Trap 2: neighbor 10.1.1.2 remote-as 100

This is BGP configuration, not L2VPN.

Trap 3: pseudowire 10.1.1.2 100 encapsulation mpls

Not a valid Cisco command for EoMPLS.

A
l2vpn xconnect context
Why wrong: This is a global configuration mode, not a command to specify the remote peer.
B
mpls l2transport route 10.1.1.2 100
This defines the peer IP and VC ID for the pseudowire.
C
neighbor 10.1.1.2 remote-as 100
Why wrong: This is BGP configuration, not L2VPN.
D
pseudowire 10.1.1.2 100 encapsulation mpls
Why wrong: Not a valid Cisco command for EoMPLS.

Question 9hardmultiple choice

A service provider is troubleshooting BGP route advertisement for a VPNv4 prefix. The PE router receives the prefix from the route reflector but does not install it in the VRF routing table. The BGP table shows the prefix as valid but not best. What is the most likely cause?

Trap 1: The VRF does not have the correct route-target import.

If route-target import were missing, the route would not be valid in BGP.

Trap 2: The BGP table is full and cannot accept more prefixes.

The route is already in the BGP table.

Trap 3: The MPLS label is missing in the BGP update.

The route is valid, so label is present.

A
The VRF does not have the correct route-target import.
Why wrong: If route-target import were missing, the route would not be valid in BGP.
B
The next-hop is not reachable via the IGP with an MPLS label.
Next-hop unreachability causes the route to be not best.
C
The BGP table is full and cannot accept more prefixes.
Why wrong: The route is already in the BGP table.
D
The MPLS label is missing in the BGP update.
Why wrong: The route is valid, so label is present.

Question 10mediummultiple choice

A service provider is deploying MPLS Layer 3 VPNs and wants to ensure that customer traffic is not dropped when a PE-CE link fails. The CE router is using static routing. Which design should be implemented to provide fast convergence?

Trap 1: Configure OSPF on the PE-CE link and set hello timers to 1 second.

OSPF hello timers improve convergence but OSPF is not used for static routes; also, BFD is faster.

Trap 2: Use IP SLA tracking to monitor the CE and adjust the static route.

IP SLA is slower than BFD and adds configuration complexity.

Trap 3: Increase the administrative distance of the static route to 255.

Changing AD does not affect failure detection speed.

A
Configure OSPF on the PE-CE link and set hello timers to 1 second.
Why wrong: OSPF hello timers improve convergence but OSPF is not used for static routes; also, BFD is faster.
B
Use IP SLA tracking to monitor the CE and adjust the static route.
Why wrong: IP SLA is slower than BFD and adds configuration complexity.
C
Increase the administrative distance of the static route to 255.
Why wrong: Changing AD does not affect failure detection speed.
D
Enable BFD on the PE-CE interface and associate it with the static route.
BFD provides sub-second failure detection, triggering fast route withdrawal.

Question 11hardmultiple choice

Refer to the exhibit. A service provider is receiving BGP prefixes from a customer (AS 64512). The provider wants to tag all routes from that customer that match prefix 10.1.0.0/16 or more specific with community 65000:100, while not modifying other routes. After applying the configuration, which statement is true?

Exhibit

router bgp 65000
 neighbor 192.168.1.1 remote-as 64512
 address-family ipv4 unicast
  neighbor 192.168.1.1 route-map SET_COMMUNITY in
 !
route-map SET_COMMUNITY permit 10
 match ip address prefix-list MATCH_CUST_A
 set community 65000:100 additive
!
route-map SET_COMMUNITY deny 20
!
ip prefix-list MATCH_CUST_A seq 5 permit 10.1.0.0/16 le 24

Trap 1: Routes with a mask longer than /24 will be rejected by the…

The le 24 allows masks up to /24, not longer.

Trap 2: All routes from the customer will have their communities replaced…

The additive keyword appends, not replaces.

Trap 3: Routes not matching the prefix-list will be denied and not…

Deny in route-map does not filter routes; it only skips setting community.

A
Only routes matching 10.1.0.0/16 or more specific will have the community added; other routes remain unchanged.
The route-map permits matching routes with additive community, denies others without affecting acceptance.
B
Routes with a mask longer than /24 will be rejected by the prefix-list.
Why wrong: The le 24 allows masks up to /24, not longer.
C
All routes from the customer will have their communities replaced with 65000:100.
Why wrong: The additive keyword appends, not replaces.
D
Routes not matching the prefix-list will be denied and not installed.
Why wrong: Deny in route-map does not filter routes; it only skips setting community.

Question 12easymulti select

A service provider is planning to offer L2VPN services using MPLS. Which TWO statements are true regarding Ethernet over MPLS (EoMPLS) and Virtual Private LAN Service (VPLS)?

Trap 1: VPLS requires all PE routers to be in the same VLAN.

VPLS uses bridge domains, not necessarily the same VLAN.

Trap 2: VPLS uses a hub-and-spoke topology to interconnect multiple sites.

VPLS uses a full-mesh of pseudowires.

Trap 3: EoMPLS supports MAC address learning between sites.

EoMPLS does not perform MAC learning.

A
EoMPLS provides a point-to-point pseudowire between two PE routers.
EoMPLS is a point-to-point service.
B
VPLS requires all PE routers to be in the same VLAN.
Why wrong: VPLS uses bridge domains, not necessarily the same VLAN.
C
VPLS uses a hub-and-spoke topology to interconnect multiple sites.
Why wrong: VPLS uses a full-mesh of pseudowires.
D
VPLS emulates a multipoint Ethernet service over MPLS.
VPLS provides a multipoint service.
E
EoMPLS supports MAC address learning between sites.
Why wrong: EoMPLS does not perform MAC learning.

Question 13hardmultiple choice

A service provider has a network with multiple PE routers providing MPLS L3VPN services. Customers are complaining that some remote sites are unreachable after a recent software upgrade on PE1. Upon investigation, you notice that PE1 is receiving BGP VPNv4 routes from the route reflector, but some routes are not being installed in the VRF routing table. PE1 is configured with BGP additional-path capability and has a route policy that selects only the best path. The VRF on PE1 has import and export route targets configured correctly. The missing routes have a higher local preference but are not selected due to a tie-break in BGP path selection. Which action should be taken to ensure that all valid routes are installed in the VRF?

Trap 1: Reset the BGP session between PE1 and the route reflector.

Resetting the session does not change path selection logic.

Trap 2: Disable route target filtering on PE1 to import all routes.

Disabling RT filtering would import routes from other VRFs, breaking isolation.

Trap 3: Increase the local preference on the route reflector for the…

Local preference is already higher; the issue is that only one path is selected.

A
Reset the BGP session between PE1 and the route reflector.
Why wrong: Resetting the session does not change path selection logic.
B
Configure BGP additional-paths for the VRF and adjust the route policy to allow multiple paths.
Additional-paths allows multiple BGP paths to be installed in the VRF.
C
Disable route target filtering on PE1 to import all routes.
Why wrong: Disabling RT filtering would import routes from other VRFs, breaking isolation.
D
Increase the local preference on the route reflector for the missing routes.
Why wrong: Local preference is already higher; the issue is that only one path is selected.

Read the full VPN explanation →

Question 14hardmulti select

Which THREE of the following L3VPN services require the use of a dedicated control plane per VPN instance?

Question 15mediummultiple choice

Read the full VPN explanation →

Refer to the exhibit. CE1 is not receiving the VPNv4 route for the 192.168.1.0/24 subnet. What is the most likely cause?

Exhibit

Refer to the exhibit.

PE1 configuration snippet:
 router bgp 65000
  neighbor 10.0.0.2 remote-as 65000
  neighbor 10.0.0.2 update-source Loopback0
  !
  address-family vpnv4
   neighbor 10.0.0.2 activate
   neighbor 10.0.0.2 send-community extended
  !
  address-family ipv4 vrf CUSTOMER_A
   redistribute connected
  !

CE1 configuration snippet:
 interface GigabitEthernet0/0
  ip address 192.168.1.1 255.255.255.0
  no shutdown
 !
 router bgp 65001
  network 192.168.1.0 mask 255.255.255.0
  neighbor 10.1.1.1 remote-as 65000

Question 16easymultiple choice

Review the full routing breakdown →

A service provider is deploying a point-to-point Layer 2 VPN across an MPLS network using Ethernet over MPLS (EoMPLS) with Martini encapsulation. The customer requires transparent transport of VLAN tags (Q-in-Q) between two sites. The provider configures the attachment circuits on the PE routers as VLAN subinterfaces with dot1q encapsulation. After configuration, the customer reports that only untagged frames pass through the pseudowire; double-tagged frames are dropped at the egress PE. Which action resolves the issue?

Question 17mediumdrag order

Drag and drop the steps to configure a GRE tunnel on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Review the full routing breakdown →

Match each Segment Routing component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Segment Identifier, an instruction in the SR header

Segment Routing Global Block of label values

Segment Routing over MPLS data plane

Topology-Independent Loop-Free Alternate for fast reroute

Path Computation Element Protocol for SR path computation

Question 19mediummultiple choice

A service provider is migrating its MPLS core from LDP to Segment Routing with MPLS data plane (SR-MPLS). The network currently uses TE tunnels with RSVP-TE for traffic engineering. Which technology can the provider use to continue performing traffic engineering after the migration without requiring RSVP-TE?

Trap 1: LDP

LDP does not support traffic engineering.

Trap 2: MPLS-TE (RSVP-TE)

RSVP-TE is the protocol being migrated away from.

Trap 3: BGP-LU

BGP-LU only provides label distribution for LSPs, not TE.

A
LDP
Why wrong: LDP does not support traffic engineering.
B
MPLS-TE (RSVP-TE)
Why wrong: RSVP-TE is the protocol being migrated away from.
C
SR-TE
SR-TE policies enable traffic engineering with Segment Routing.
D
BGP-LU
Why wrong: BGP-LU only provides label distribution for LSPs, not TE.

Read the full VPN explanation →

Question 20hardmultiple choice

A service provider is deploying EVPN-VPWS to replace legacy pseudowire connections for point-to-point Layer 2 services. They notice that MAC addresses learned from a CE device are not properly advertised to the remote PE. Which EVPN route type is responsible for advertising MAC address reachability information in a VPWS scenario?

Trap 1: Route Type 2 (MAC/IP Advertisement)

Route Type 2 is for MAC/IP advertisement but not mandatory for VPWS.

Trap 2: Route Type 5 (IP Prefix)

Route Type 5 is for IP prefix advertisement, not MAC.

Trap 3: Route Type 3 (Inclusive Multicast)

Route Type 3 is used for multicast, not unicast MAC.

A
Route Type 1 (Ethernet Auto-Discovery)
Ethernet AD routes include MAC address information for split-horizon.
B
Route Type 2 (MAC/IP Advertisement)
Why wrong: Route Type 2 is for MAC/IP advertisement but not mandatory for VPWS.
C
Route Type 5 (IP Prefix)
Why wrong: Route Type 5 is for IP prefix advertisement, not MAC.
D
Route Type 3 (Inclusive Multicast)
Why wrong: Route Type 3 is used for multicast, not unicast MAC.