10 free Cisco 350-501 SPCOR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 515 questions. Work through them, then open each answer to check your reasoning.
Get all 515 questions (US$39) · Download these 10 as a PDF
Question 1
Refer to the exhibit. P3 and PE4 are at the edge of the service provider core and serve as ABR routers. Aggregation areas are on either side of the core.
Which statement about the architecture is true?
Show answer and explanation
Correct answer: B. If each area is running its own IGP, BGP must provide an end-to-end MPLS LSP.
In a seamless MPLS architecture where each aggregation area runs its own IGP and the core runs a separate IGP, BGP must provide end-to-end MPLS LSP connectivity between PE routers across the multiple IGP domains. The ABR routers (P3 and PE4) act as domain boundaries, and BGP enables label distribution and LSP establishment across these independent IGP domains, creating a seamless MPLS path from PE1 to PE4 despite the fragmented IGP topology.
Why the other options are wrong
- A. BGP route reflectors are standard in MPLS architectures and do not need to be disabled for seamless MPLS to function.
- C. While redistribution between IGP and BGP may occur, it is not a required statement for this architecture; BGP provides LSP capability independently.
- D. TDP (Tag Distribution Protocol) is obsolete; seamless MPLS uses LDP or BGP-LU for label distribution, not TDP.
Question 2
Which component is similar to an EVPN instance?
Show answer and explanation
Correct answer: D. VRF
A VRF (Virtual Routing and Forwarding) instance is the functional equivalent to an EVPN instance. Both provide logical separation of routing tables and create isolated forwarding domains. A VRF on a device operates similarly to how an EVPN instance provides service isolation in a network, making them directly analogous concepts.
Why the other options are wrong
- A. A router distinguisher is a component used within EVPN to create unique identifiers but is not itself equivalent to an EVPN instance.
- B. An MPLS label is a forwarding mechanism used by EVPN but does not represent an instance structure.
- C. An IGP router ID is a network-wide identifier for a router and is unrelated to EVPN instance functionality.
Question 3
Why do Cisco MPLS TE tunnels require a link-state routing protocol?
Show answer and explanation
Correct answer: D. The tunnel endpoints use the link-state database to evaluate the entire topology and determine the best path.
MPLS TE requires a link-state protocol because the headend must see the complete topology, including the TE extensions that carry available bandwidth, affinities and TE metrics, before it can pick a path. Distance-vector protocols only advertise reachability and metrics learned from neighbors, so a router could never evaluate the network end to end. With the full link-state database, the tunnel endpoints can weigh every candidate path against the configured constraints and install the best one.
Why the other options are wrong
- A. Dividing a network into areas helps IGP scalability, and it actually limits TE path computation because the headend cannot see beyond its own area.
- B. A tunnel source is taken from the locally configured interface or router ID, not chosen from the link-state database.
- C. Running SPF is a property of any link-state IGP and does not by itself build a tunnel: the headend must apply the configured constraints to the TE topology database to compute and signal the path.
Question 4
Refer to the exhibit. BGPsec is implemented on R1, R2, R3, and R4. BGP peering is established between neighboring autonomous systems.
Which statement about implementation is true?
Show answer and explanation
Correct answer: D. BGP updates from the eBGP peers are appended with a BGPsec attribute sequence that includes a public key hash and digital signature.
BGPsec is a security extension to BGP that protects the AS path in BGP updates by appending a BGPsec attribute sequence to eBGP-received routes. This sequence contains cryptographic material including a public key hash and a digital signature created by each AS as the update traverses the path. When R1 receives BGP updates from eBGP peers (R2), those updates are cryptographically signed with the originating AS's private key and include hash values of public keys, allowing downstream routers to verify the authenticity and integrity of the AS path. This is the fundamental security mechanism that distinguishes BGPsec from standard BGP.
Why the other options are wrong
- A. BGP communities like local-as are standard BGP attributes used for routing policy, not specific to BGPsec implementation.
- B. The no-export community is a standard well-known community for route filtering policy and is not a characteristic of BGPsec attribute handling.
- C. BGPsec does not use statically configured AS path values; instead, it uses cryptographic signatures and public key hashes to dynamically validate and secure the AS path.
Question 5
You are configuring MPLS traffic-engineering tunnels in the core.
Which two ways exist for the tunnel path across the core? (Choose two.)
Show answer and explanation
Correct answer: B, E
B. Tunnels can be configured with dynamic path or explicitly defined path. E. Tunnel links inherit IGP metrics by default unless overridden. A TE tunnel path can be produced two ways: a dynamic path option, where the headend computes the route itself from the TE topology database, or an explicit path option, where the administrator lists the hops the tunnel must follow. Path computation and tunnel preference are based on the TE metric, which takes the IGP link metric by default and can be changed with an administrative weight or by selecting the TE metric type on the tunnel. Together these describe how the tunnel path is chosen across the core.
Why the other options are wrong
- A. Dynamic path computation works with both IS-IS and OSPF, since both carry the TE extensions needed to build the TE database.
- C. A zero bandwidth tunnel is perfectly valid and is commonly used when the tunnel is needed for path steering or FRR rather than for bandwidth admission control.
- D. The bandwidth statement is an RSVP-TE admission control reservation in the control plane that decrements available bandwidth on each link, it does not police or guarantee traffic in the forwarding plane.
Question 6
Which configuration mode do you use to apply the mpls ldp graceful-restart command in IOS XE Software?
Show answer and explanation
Correct answer: D. global
The mpls ldp graceful-restart command is configured in global configuration mode. This command enables graceful restart functionality for the entire LDP process, affecting all LDP neighbors and sessions across the router. It is not a neighbor-specific, interfac-pecific, or MPLS submenu command.
Why the other options are wrong
- A. MPLS LDP neighbor mode is used for neighbor-specific policies, not for global LDP features like graceful restart.
- B. Interface mode is used for interface-specific MPLS and LDP settings, not for global protocol features.
- C. MPLS configuration mode is for MPLS-specific settings but graceful restart is an LDP global feature, not an MPLS feature.
Question 7
After you analyze your network environment, you decide to implement a full separation model for Internet access and MPLS L3VPN services.
For which reason do you make this decision?
Show answer and explanation
Correct answer: B. It enables you to choose whether to separate or centralize each individual service.
Implementing a full separation model for Internet access and MPLS L3VPN services allows network operators to independently choose whether to separate or centralize each individual service. This architectural flexibility enables different operational models for different services based on business requirements, performance needs, and management preferences.
Why the other options are wrong
- A. While separation can help with independent operation, the primary benefit is not about EGP and IGP independence specifically.
- C. Separation actually makes a system easier to manage, not harder; mixed services increase complexity.
- D. A full separation model typically requires multiple edge routers to handle different service types, not just one edge router.
Question 8
Which statement about the Cisco MPLS TE forwarding adjacency feature is true?
Show answer and explanation
Correct answer: B. It enables the Cisco MPLS TE tunnel to be advertised into the running IGP.
The MPLS TE forwarding adjacency feature enables an MPLS TE tunnel to be advertised as a link into the running IGP. This allows the tunnel to appear as a virtual adjacency in the IGP topology, enabling other routers to use the tunnel as part of their routing decisions and potentially forwarding traffic across it.
Why the other options are wrong
- A. Forwarding adjacency does not change the IGP or EGP protocols; it works with existing IGP implementations.
- C. The tailend router does not advertise routes back to the headend over the tunnel; the tunnel itself is advertised as a link.
- D. Forwarding adjacency is not about establishing bidirectional tunnels; it is about advertising a unidirectional tunnel as an IGP link.
Question 9
While implementing TTL security, you issue the PE(config-router-af)#neighbor 2.2.2.2 tt-ecurity hops 2 command.
After you issue this command, which BGP packets does the PE accept?
Show answer and explanation
Correct answer: D. from 2.2.2.2, with a TTL of 253 or more
When configuring neighbor 2.2.2.2 ttl-security hops 2, the PE router calculates the expected TTL as 255 minus 2 (the hop count), resulting in 253. The router accepts BGP packets from 2.2.2.2 that have a TTL of 253 or higher, rejecting any packets with lower TTL values as potential security threats.
Why the other options are wrong
- A. TTL security is not based on sending packets to the neighbor with a specific TTL; it validates incoming packets.
- B. The command does not accept packets with TTL less than 2; it accepts packets with TTL 253 or more.
- C. The direction is wrong; packets are received from 2.2.2.2, not sent to it, and the TTL threshold is 253 or more, not less than.
Question 10
Refer to the exhibits.
Which information is provided for traceback analysis when this configuration is applied?
Show answer and explanation
Correct answer: A. source interface
The configuration shown enables NetFlow version 9 export to destination 192.168.1.2 on interface gigabitethernet0/1 with ingress flow collection. NetFlow v9 exports flow records that include source interface information among other fields, which is critical for traceback analysis. When a packet is captured in a flow, the source interface indicates which physical or logical interface the traffic entered, allowing network administrators to trace back the origin of traffic for security analysis, troubleshooting, or forensic purposes. The source interface is one of the fundamental fields exported in NetFlow v9 records.
Why the other options are wrong
- B. Packet size distribution is not a standard NetFlow v9 export field; NetFlow exports individual flow records with packet counts and byte counts, not distribution metrics.
- C. IP sub flow cache refers to internal flow cache management, not information provided in the export output for analysis.
- D. BGP version is unrelated to NetFlow configuration; BGP is a routing protocol and has no connection to flow export for traceback analysis.
That was 10 of 515.
The full Cisco 350-501 SPCOR pack has all 515 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.