350-501 Networking Practice Question
Which routing protocol is used between CE and PE routers in a typical MPLS L3VPN deployment?
⚠ Common exam trap
The most common mistake is assuming that BGP is mandatory between CE and PE in MPLS L3VPN because VPNv4 routes use BGP attributes. However, VPNv4 routes (with RD/RT) are exchanged only between PEs via MP‑BGP. Between CE and PE, any routing protocol (including static, RIP, EIGRP, OSPF, or BGP) can be used; BGP is common but not required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BGP
While BGP is a common choice for routing between CE and PE in MPLS L3VPN deployments due to its scalability, policy control, and support for multi-homing, it is not the only protocol. Other dynamic routing protocols such as OSPF, EIGRP, RIP, and static routing are also valid. In a typical deployment, CE and PE can exchange routes using any routing protocol; the PE then redistributes those routes into MP‑BGP for VPN‑v4 advertisement between PEs. The question’s correct answer is BGP because it is the most common and recommended protocol for many scenarios, but candidates should know that the CE‑PE routing protocol is not limited to BGP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RIP
Why it's wrong here
RIP is possible but outdated; not typical for modern SP networks.
- ✓
BGP
Why this is correct
eBGP is commonly used for CE-PE routing in L3VPN to carry customer routes and support multi-homing.
- ✗
EIGRP
Why it's wrong here
EIGRP is Cisco proprietary and less common in multi-vendor SP environments.
- ✗
IS-IS
Why it's wrong here
IS-IS is typically used within the provider core, not between CE and PE.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 350-501 question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.