Mpls practice questions

The control policy is not attached to the appropriate site list or VPN list.

Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.

In VRF-lite, each VRF maintains its own independent routing table.

Correct because the core concept of VRF-lite is per-VRF routing tables for path isolation.

Interfaces are assigned to a VRF using the 'ip vrf forwarding' command under interface configuration.

Correct because 'ip vrf forwarding <vrf-name>' associates an interface with a specific VRF.

PE routers use MP-BGP to exchange VPNv4 routes that include the route distinguisher and the VPN label.

Correct because MP-BGP carries VPNv4 routes (with route distinguisher) and the VPN label in the NLRI, enabling MPLS Layer 3 VPN operation.

Each VRF on a PE router maintains a separate routing table and forwarding table per customer.

Correct because a VRF creates an isolated routing and forwarding instance for each customer on the PE.

Customer edge (CE) routers exchange routing information with provider edge (PE) routers using static routing, RIP, OSPF, EIGRP, or BGP.

Correct because PE-CE routing can use any of these protocols, as supported by the provider's configuration.

VRF (Virtual Routing and Forwarding) instances are used on PE routers to maintain separate routing tables for each VPN customer.

Correct because VRFs isolate customer routes on the PE, ensuring traffic separation.

MP-BGP (Multiprotocol BGP) is used between PE routers to exchange VPNv4 routes, which include an RD and RT.

Correct because MP-BGP carries VPN-IPv4 prefixes with route distinguishers (RD) and route targets (RT) for VPN membership.

Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.

Correct because the control plane (vSmart to edge) uses DTLS by default, with TLS as an option.

Data plane tunnels between edge devices are encrypted using IPsec with IKEv2 key exchange.

Correct because IPsec is used for secure data plane tunnels between vEdge/cEdge routers.

A TLOC (Transport Location) is defined by the combination of system IP, color, and encapsulation type.

Correct because TLOC is uniquely identified by the system IP, color, and encapsulation (IPsec/GRE).

VRF-lite allows multiple routing instances on a single router using static or dynamic routing protocols.

Correct because VRF-lite supports RIP, EIGRP, OSPF, and static routes per VRF.

VRF-lite does not require MPLS to operate.

Correct because VRF-lite is a pure Layer 3 VPN without label switching.

VRF-lite provides path isolation by maintaining separate forwarding tables.

Correct because each VRF has independent routing and forwarding tables.

The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.

Correct because without this, the VRF routes are not injected into BGP VPNv4.

Route targets are used to control which routes are imported into a VRF.

Correct because the 'route-target import' command specifies which RTs cause a route to be installed in the VRF.

Route targets are used to control which routes are exported from a VRF.

Correct because the 'route-target export' command attaches RTs to routes originating from the VRF.

A VRF can have multiple import and export route targets configured.

Correct because you can specify multiple RTs for import and export to enable complex VPN topologies.

VRFs allow multiple customers to share the same physical infrastructure while keeping their traffic isolated.

Correct because each VRF maintains separate forwarding tables, providing Layer 3 isolation.

In MPLS VPN, VRFs are combined with route targets to control route distribution between PE routers.

Correct because route targets (import/export) determine which VRFs receive which routes.

VRF-aware features such as NAT, QoS, and ACLs can be applied per VRF to enforce path isolation policies.

Correct because Cisco IOS supports VRF-aware services for granular control.

The trust boundary can be configured using the 'mls qos trust' command on a switch port to trust the CoS or DSCP value received from an attached device.

Correct. The trust boundary is set with 'mls qos trust' to honor incoming markings.

NBAR (Network-Based Application Recognition) can classify traffic based on application signatures, including HTTP URLs and SSL certificate fields.

Correct. NBAR performs deep packet inspection and can match on many application attributes.

Layer 2 CoS marking uses a 3-bit field in the 802.1Q tag, providing 8 possible values, while DSCP uses 6 bits for 64 values.

Correct. CoS is 3 bits (0–7), DSCP is 6 bits (0–63).

VRFs allow overlapping IP addresses between different virtual networks on the same router.

Correct because each VRF has its own routing table, so overlapping addresses are isolated.

VRF-lite can provide path isolation without the use of MPLS.

Correct because VRF-lite uses separate routing tables and interface assignments to isolate traffic.

A VRF can be used to separate customer traffic in a service provider network.

Correct because service providers commonly use VRFs to isolate different customer networks.