99 free Cisco 350-501 SPCOR practice questions from the CertStash pack of 515, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 99 free here, all 515 in the pack, and each step includes the one before it.
Get all 515 questions (US$39) · Download the first 10 as a PDF
Question 1
Egress PE NAT is being used via a single centralized router to provide Internet access to L3VPN customers. Which description of the NAT operation is true?
Show answer and explanation
Correct answer: A. The NAT table contains a field to identify the inside VRF of a translation.
In Egress PE NAT for L3VPN Internet access, the NAT translation table must maintain VRF context to distinguish which inside VRF a particular translation belongs to. This allows the centralized NAT router to properly handle traffic from multiple overlapping L3VPN customer address spaces by associating each NAT entry with its source VRF, enabling the same inside addresses to be translated differently based on their VRF origin.
Why the other options are wrong
- B. Only a single address pool is needed per outside interface; multiple sites within the same L3VPN share the same pool.
- C. L3VPN customers can have overlapping internal IP addresses because they are isolated within separate VRFs; NAT translation handles the overlap.
- D. Different VRFs can share the same outside global IP address because the NAT table includes VRF context in the translation entry.
Question 2
You are writing an RPL script to accept routes only from certain autonomous systems. Consider this code: RP/0/RP0/CPU0:router(config-rpl)# if as-path in (ios-regex '.*77$') RP/0/RP0/CPU0:router(config-rpl-if)# pass RP/0/RP0/CPU0:router(config-rpl-if)# endif If you apply this code to BGP filters, which effect does the code have on your router?
Show answer and explanation
Correct answer: B. allows routes from AS 7077
The regex pattern '.*77$' matches any AS path ending with 77. The .* matches any characters at the beginning, and $ anchors the match to the end of the string. The pass action accepts routes matching this pattern. Therefore, AS 7077 ends with 77 and matches the pattern, allowing these routes through.
Why the other options are wrong
- A. AS 7070 ends with 70, not 77, so it does not match the pattern and is not denied by this rule.
- C. AS 7007 ends with 07, not 77, so it does not match the pattern.
- D. AS 770 ends with 70, not 77, so it does not match the pattern and is not allowed by this rule.
Question 3
Which regular expression query modifier function indicates the start of a string?
Show answer and explanation
Correct answer: B. ^
The caret symbol (^) is the standard regular expression metacharacter that indicates the start of a string. When ^ appears at the beginning of a regex pattern, it anchors the match to the start of the string, ensuring that the following pattern must be found at the beginning.
Why the other options are wrong
- A. The plus sign (+) is a quantifier meaning one or more occurrences of the preceding element.
- C. The dollar sign ($) indicates the end of a string, not the start.
- D. [^] is a character class negation operator, not a start-of-string anchor.
Question 4
An engineer is trying to implement BGP in a multihomed architecture. What must the engineer configure to influence inbound path selection?
Show answer and explanation
Correct answer: A. A route map with AS-PATH attribute to control the inbound traffic
To influence inbound path selection in BGP, you use a route map with the AS-PATH attribute. This allows you to manipulate how routes from neighboring ASes are processed on inbound traffic, controlling which paths are preferred for incoming connections by matching and modifying AS-PATH values.
Why the other options are wrong
- B. Offset lists are used in IGP protocols like OSPF and EIGRP, not in BGP for inbound path selection.
- C. Access lists identify traffic but do not directly control BGP path selection; they are used for traffic filtering, not BGP route preference.
- D. While WEIGHT is a BGP attribute that influences path selection, it is a Cisco-specific local attribute primarily used for outbound traffic preference, not the standard method for inbound path control across multiple ASes.
Question 5
A network team has failed to implement IS-IS multi-topology. What is the reason for it?
Show answer and explanation
Correct answer: C. The routing process did not support extended metrics
IS-IS multi-topology functionality requires extended metrics support. Extended metrics enable the router to carry additional topology information and metric data beyond basic IS-IS metrics, which is essential for maintaining multiple topologies within a single IS-IS domain.
Why the other options are wrong
- A. Multi-topology IS-IS supports both Level 1 and Level 2, but does not require Level 1 only; in fact, it typically works with both levels.
- B. VRFs are not a requirement for IS-IS multi-topology; multi-topology operates within the standard IS-IS routing process.
- D. CDP and CEF status do not determine whether IS-IS multi-topology can be implemented; these are separate protocol features.
Question 6
What are two factors to consider when implementing NSR High Availability on an MPLS PE router? (Choose two.)
Show answer and explanation
Correct answer: C, D. It consumes more memory and CPU resources than NSF; It operates normally without NSR support on the PE peers
Nonstop Routing keeps the full routing protocol state synchronized between the active and standby route processors, so it uses more memory and CPU than NSF. Because the switchover is handled entirely inside the router, peers do not need NSR or graceful restart support. The PE keeps its sessions up with neighbors that know nothing about the failover.
Why the other options are wrong
- A. NSR is local to the router, so PE-CE peers do not need to support it.
- B. Routing protocol extensions are needed for NSF graceful restart, not for NSR.
- E. Synchronizing state between redundant route processors is exactly what NSR does.
Question 7
A network engineer must enable the helper router to terminate the OSPF graceful restart process if it detects any changes in the LSA. Which command enables this feature?
Show answer and explanation
Correct answer: C. nsf ietf helper strict-lsa-checking
The command 'nsf ietf helper strict-lsa-checking' enables the helper router to terminate the OSPF graceful restart process if it detects any changes in the LSA. This strict checking ensures that if the restarting router's LSA changes during the restart window, the helper immediately terminates the graceful restart process rather than waiting for the full restart timer.
Why the other options are wrong
- A. The 'nsf ietf helper disable' command disables helper support entirely, rather than enabling strict LSA checking.
- B. The 'nsf cisco helper disable' command disables Cisco-specific graceful restart helper functionality, not IETF strict LSA checking.
- D. The 'nsf cisco enforce global' command is not the correct syntax for enabling LSA change detection in the IETF graceful restart process.
Question 8
Which task must be performed first to implement BFD in an IS-IS environment?
Show answer and explanation
Correct answer: A. Configure BFD in an interface configuration mode.
BFD must first be configured in interface configuration mode before it can be enabled under the IS-IS process. The interface-level configuration establishes the BFD session parameters on the physical interface, which is the foundational step required before the IS-IS routing process can reference and use BFD for rapid failure detection.
Why the other options are wrong
- B. Disabling CEF on non-IS-IS interfaces is not a prerequisite for implementing BFD with IS-IS.
- C. Configuring all IS-IS routers as Level 2 devices is not necessary for BFD implementation; BFD works with both Level 1 and Level 2.
- D. While BFD must eventually be configured under the IS-IS process, the interface-level configuration must be performed first to establish the BFD sessions that IS-IS will then use.
Question 9
You are creating new Cisco MPLS TE tunnels. Which type of RSVP message does the headend router send to reserve bandwidth on the path to the tailend router?
Show answer and explanation
Correct answer: A. path
In MPLS Traffic Engineering, the headend router sends RSVP PATH messages to establish the tunnel path to the tailend router. These PATH messages traverse the network along the calculated path and carry traffic engineering parameters. The tailend router then responds with RESV (reservation) messages to complete the bandwidth reservation in the reverse direction.
Why the other options are wrong
- B. TEAR messages are used to remove or tear down established RSVP sessions, not to create new reservations.
- C. ERROR messages are used to report problems or exceptions in RSVP signaling, not to reserve bandwidth.
- D. RESERVATION messages (RESV) are sent by the tailend router in response to PATH messages, not by the headend router to initiate the process.
Question 10
Which statement describes the advantage of a Multi-Layer control plane?
Show answer and explanation
Correct answer: B. It automatically provisions, monitors, and manages traffic across Layer 0 to Layer 3.
A Multi-Layer control plane provides unified, automatic provisioning, monitoring, and management of traffic flows across multiple network layers from Layer 0 (optical) through Layer 3 (routing). This integrated approach enables end-to-end service provisioning and management across the entire network stack without requiring separate management systems for each layer.
Why the other options are wrong
- A. Multi-vendor configuration capabilities are a feature of standardized protocols, not the defining advantage of a multi-layer control plane.
- C. While dynamic wavelength restoration may occur at Layer 0, it is not the primary advantage of a multi-layer control plane architecture.
- D. Minimizing human error is a secondary benefit; the primary advantage is the automatic management across all layers.
What people say about the full 350-501 pack 5.0 from 1
I used to think passing the 350-501 exam would require a lifetime of studying. But these dumps turned it into a weekend project. Thanks Cert Stash.
Question 11
What is a role of NSO?
Show answer and explanation
Correct answer: D. It provides full lifecycle management of a device
NSO provides comprehensive full lifecycle management of network devices, including provisioning, configuration, monitoring, and maintenance throughout the device's operational lifetime. This is a core function that enables end-to-end service orchestration.
Why the other options are wrong
- A. NSO does not reside on hypervisors running Windows OS; it is independent network management software.
- B. NSO is not a wireless LAN controller and does not have built-in access point deployment capabilities.
- C. NSO manages network services and device configurations, not WAN infrastructure through virtual switches.
Question 12
What is the role of NFVI?
Show answer and explanation
Correct answer: C. monitor
NFVI (Network Function Virtualization Infrastructure) is the foundational layer that provides compute, storage, and network resources. Its primary role is to monitor and manage these virtualized resources, ensuring proper allocation and performance of network functions running on the infrastructure. Domain name service, intrusion detection, and network address translation are all functions that run on top of NFVI rather than being NFVI's role.
Why the other options are wrong
- A. Domain name service is an application-level service, not a role of the underlying infrastructure.
- B. Intrusion detection is a security service that operates above the infrastructure layer.
- D. Network address translation is a network function, not the role of the infrastructure itself.
Question 13
A network engineer must implement SNMPv2 with these parameters: • Enable SNMP community string c1sc0 with read-only permissions. • Enable interface index persistence. Restrict the SNMP community to only the monitoring server with IP address 198.18.19.100/32. • Provide view-only access to ospfIfEntry and ospfNbrEntry. Which configuration must the engineer apply?
Show answer and explanation
Correct answer: B. configure terminal access-list 5 permit 198.18.19.100 0.0.0.0 snmp-server view BLOCKED_VIEW internet excluded snmp-server view BLOCKED_VIEW ospfIfEntry included snmp-server view BLOCKED_VIEW ospfNbrEntry included snmp-server community c1sc0 view BLOCKED_VIEW RO 5 snmp ifmib ifindex persist end
The correct configuration creates an access list permitting only the monitoring server IP, defines a custom SNMP view excluding the internet subtree but including ospfIfEntry and ospfNbrEntry, applies the community string c1sc0 with read-only (RO) permission and access list 5 restriction, and enables interface index persistence. The access list number (5) must be referenced in the snmp-server community command to restrict access to that specific IP.
Why the other options are wrong
- A. Missing the access list reference (the 5) in the snmp-server community command, which fails to restrict access to only the specified IP.
- C. Includes 'internet included' which would expose the entire internet subtree, contradicting the requirement to provide view-only access to specific OSPF entries.
- D. Uses RW (read-write) instead of RO (read-only), violating the requirement for read-only permissions.
Question 14
A network engineer is implementing a QoS policy for outbound management traffic classification and marking on a CPE device with these requirements: • Management protocols must be marked with DSCP AF class 2 with low drop probability. • Monitoring protocols must be marked with DSCP AF class 1 with low drop probability. • All remaining traffic must be marked with a DSCP value of 0. Which configuration must the engineer implement to satisfy the requirements?
Show answer and explanation
Correct answer: A. policy-map cpe-mgmt-policy class management set ip dscp af21 class monitoring set ip dscp af11 class class-default set ip dscp default end
The configuration requires management traffic marked with DSCP AF21 (AF class 2, low drop probability), monitoring traffic marked with DSCP AF11 (AF class 1, low drop probability), and all remaining traffic marked with DSCP 0. Option A correctly specifies af21 for management, af11 for monitoring, and uses the default keyword for class-default which applies DSCP 0. The policy-map structure with class definitions is the correct syntax for implementing this QoS policy.
Why the other options are wrong
- B. Uses af0 instead of default for class-default, which explicitly sets DSCP to 0 but is less standard than using the default keyword.
- C. Incorrectly specifies af23 and af13, which represent AF class 2/3 and AF class 1/3 (high drop probability), not the required low drop probability markings.
- D. Incorrectly specifies af23 and af13 with high drop probability, and explicitly sets af0 instead of using the default keyword.
Question 15
An engineer is developing a configuration script to enable dial-out telemetry streams using gRPC on several new devices. TLS must be disabled on the devices. Which configuration must the engineer apply on the network?
Show answer and explanation
Correct answer: C. telemetry model-driven destination-group ciscotest address-family ipv4 192.168.1.0 port 57500 encoding self-describing-gpb protocol grpc no-tls commit
The 'no-tls' parameter in the telemetry model-driven destination configuration explicitly disables TLS encryption on gRPC telemetry streams. This configuration allows the engineer to establish dial-out telemetry without TLS security as required by the scenario.
Why the other options are wrong
- A. This configuration includes 'tls-hostname' which enables TLS, contradicting the requirement to disable TLS.
- B. This uses TCP protocol instead of gRPC and does not provide the required gRPC telemetry streaming.
- D. This configuration does not include the 'no-tls' parameter, which means TLS will remain enabled by default.
Question 16
A network engineer is implementing NetFlow to observe traffic patterns on the network. The engineer is planning to review the patterns to help plan future strategies for monitoring and preventing congestion as the network grows. If the captures must include BGP next-hop flows, which configuration must the engineer apply to the router?
Show answer and explanation
Correct answer: B. ip cef ip flow-export version 9 bgp-next-hop ip flow-export destination 192.168.1.1 9996 interface gigabitethernet 1/0/1 ip flow ingress
To capture BGP next-hop flows with NetFlow, the configuration requires ip cef (Cisco Express Forwarding), ip flow-export version 9 (which supports bgp-next-hop), the bgp-next-hop keyword explicitly, and both ingress and egress flow monitoring. Version 9 (NetFlow v9) supports the bgp-next-hop feature necessary for BGP flow analysis. The destination address and port are configured correctly, and ip flow ingress captures inbound traffic on the interface.
Why the other options are wrong
- A. Version 5 does not support the bgp-next-hop feature; version 9 is required.
- C. Version 5 lacks bgp-next-hop support, and cdp enable is irrelevant to NetFlow configuration.
- D. Disabling CEF (no ip cef) prevents proper NetFlow operation, and version 9 should be enabled.
Question 17
The network-engineering team of a service provider is integrating several recently acquired networks into a more scalable common Unified MPLS architecture. The new network architecture will support end-to-end VPNv4 and VPNv6 services with these requirements: • The IGP of the core layer is IS-IS in Area 0. • The IGP of the aggregation layers is OSPF in Area 0. • The LDP protocol is used to distribute label bindings within each IGP domain. Which task must the network engineer perform when implementing this new architecture?
Show answer and explanation
Correct answer: D. Configure BGP-LU between ABR routers of each IGP domain to carry MPLS label information in NLRI.
When integrating multiple IGP domains (IS-IS in core, OSPF in aggregation) into a unified MPLS architecture, BGP-LU (BGP Label Unicast) must be configured between ABR routers to carry MPLS label information. BGP-LU operates at the IGP domain boundaries and advertises labeled routes via NLRI, enabling end-to-end LSP establishment across different IGP domains. This allows the LDP LSPs within each domain to be stitched together at the ABRs to create seamless end-to-end VPNv4 and VPNv6 services.
Why the other options are wrong
- A. BGP sessions between ABRs exchange VPN prefixes, but this alone does not solve the label distribution problem across IGP domain boundaries.
- B. Mutual IGP redistribution creates routing loops and convergence issues; LDP operates within single IGP domains and cannot span across different IGP domains without BGP-LU.
- C. Preserving next-hop information is not the primary mechanism for solving inter-domain MPLS connectivity; the focus must be on label distribution across domain boundaries.
Question 18
A network engineer is configuring RIP as the routing protocol between multiple PEs and CEs. The engineer must avoid advertising the same routes back to their sources. Which action should be performed on the routers to accomplish this task?
Show answer and explanation
Correct answer: A. Define the site of origin on each interface.
Defining the site of origin on each interface is the mechanism used in MPLS VPN environments to prevent routes learned from one site from being advertised back to that same site. The site of origin is a BGP extended community attribute that tracks which customer site originated a particular route, allowing RIP (and other protocols) to apply split-horizon logic and avoid advertising routes back to their source.
Why the other options are wrong
- B. Route distinguishers are used to create unique prefixes in VPN routing but do not directly prevent routes from being advertised back to their sources.
- C. VRFs separate traffic and routing domains but do not inherently prevent the specific readvertisement issue; site of origin is the specific mechanism for this.
- D. Bidirectional Forwarding Detection is a protocol for detecting link failures and does not prevent route readvertisement.
Question 19
Which component is similar to an EVPN instance?
Show answer and explanation
Correct answer: D. VRF
A VRF (Virtual Routing and Forwarding) instance is the functional equivalent to an EVPN instance. Both provide logical separation of routing and forwarding domains within a network device. A VRF creates an isolated routing table and forwarding domain, much like how an EVPN instance manages a separate virtual network service. Router distinguishers, MPLS labels, and IGP router IDs are all components used within or alongside these instances but are not instances themselves.
Why the other options are wrong
- A. A router distinguisher is a value used to uniquely identify routes within EVPN/VPN contexts, not an instance itself.
- B. An MPLS label is a forwarding mechanism used to carry traffic, not an instance structure.
- C. An IGP router ID identifies a router in the routing protocol, not an instance or service container.
Question 20
Which two IS-IS parameters must match before two Level 2 peers can form an adjacency? (Choose two.)
Show answer and explanation
Correct answer: B, E. authentication settings; MTU
For two Level 2 IS-IS peers to form an adjacency, their authentication settings must match to ensure secure communication, and their MTU values must match to prevent packet fragmentation issues during adjacency formation. Hello timer settings are not required to match between Level 2 peers, they can negotiate timing independently. Area ID is not relevant for Level 2 peers, as Level 2 operates across areas. System ID must be unique but does not need to match between peers.
Why the other options are wrong
- A. Hello timer settings do not need to match between Level 2 peers; they negotiate timing independently.
- C. Area ID is relevant only for Level 1 routers and Level 1-2 routers; Level 2 peers operate across areas.
- D. System IDs must be unique and cannot match between different peers.
Question 21
Which action does the ingress VTEP perform on traffic between EVPN VXLAN overlays?
Show answer and explanation
Correct answer: A. routing and bridging when doing asymmetric IRB
In asymmetric IRB (Integrated Routing and Bridging) on EVPN VXLAN overlays, the ingress VTEP performs both routing and bridging functions. The traffic is routed at the ingress VTEP based on the destination IP, then bridged within the VXLAN overlay. This differs from symmetric IRB where both ingress and egress VTEPs route the traffic.
Why the other options are wrong
- B. In symmetric IRB, bridging occurs at the egress VTEP, not the ingress VTEP.
- C. Symmetric IRB involves routing at both ingress and egress VTEPs, not tunneling.
- D. In asymmetric IRB, routing occurs at the ingress VTEP with bridging, not routing alone at egress.
Question 22
Why do Cisco MPLS TE tunnels require a link-state routing protocol?
Show answer and explanation
Correct answer: D. The tunnel endpoints use the link-state database to evaluate the entire topology and determine the best path.
Cisco MPLS TE tunnels require a link-state routing protocol because the tunnel endpoints need access to a complete view of the network topology to perform intelligent path selection. Link-state protocols like OSPF and IS-IS maintain a database of all network links and their attributes, allowing the tunnel headend router to evaluate the entire topology and calculate the optimal path based on constraints such as bandwidth, delay, and hop count using SPF or similar algorithms.
Why the other options are wrong
- A. While link-state protocols do use areas, area segmentation is not the primary reason TE requires link-state protocols; the focus is topology knowledge, not area-based segmentation.
- B. Tunnel endpoints do not dynamically select a source ID from the link-state database; the source ID is statically configured.
- C. Although SPF calculations are involved, the key requirement is that the tunnel endpoints need the complete topology database to evaluate paths, not just the calculation method itself.
Question 23
Which two PHY modes are available to implement an IOS XR 10 Gigabit Ethernet interface? (Choose two.)
Show answer and explanation
Correct answer: A, D. LAN; WAN
IOS XR 10 Gigabit Ethernet interfaces support two PHY modes: LAN and WAN. LAN mode uses 10GBASE-SR/LR for campus networks, while WAN mode uses 10GBASE-W for long-distance carrier networks. These modes define the optical specifications and signal processing used by the interface.
Why the other options are wrong
- B. SONET is a Layer 1 framing protocol that can be carried over 10GE but is not itself a PHY mode option.
- C. MAN (Metropolitan Area Network) is a network scope classification, not a specific PHY mode for IOS XR interfaces.
- E. WDWM is not a valid PHY mode; DWDM is a multiplexing technique applied above the PHY layer.
Question 24
An engineer is implementing IGMP with SSM on a multicampus network that supports video streaming. Which task must the engineer perform as part of the process?
Show answer and explanation
Correct answer: D. Configure the network to use IGMPv3.
IGMPv3 is a mandatory requirement for implementing IGMP with Source-Specific Multicast (SSM) on a network. SSM functionality depends on the ability of IGMP to signal specific (source, group) pairs, which is a core feature of IGMPv3. Without IGMPv3, the network cannot support the SSM model where hosts specify both the source and the group they wish to receive multicast from.
Why the other options are wrong
- A. SSM uses source-specific groups and does not require static RP assignments; in fact, SSM eliminates the need for RPs entirely.
- B. The PIM BSR (Bootstrap Router) candidate is used in PIM-SM with dynamic RP discovery, not required for SSM which operates without RPs.
- C. Bidirectional PIM is an alternative PIM mode used for specific topologies but is not required or typically used with SSM; SSM works with PIM-SM.
Question 25
Which additional feature does MPLS DiffServ tunneling support?
Show answer and explanation
Correct answer: B. PHB layer management
MPLS DiffServ tunneling supports PHB (Per-Hop Behavior) layer management as an additional feature. This allows the MPLS network to apply and manage Per-Hop Behaviors defined in DiffServ, enabling quality-of-service differentiation based on DiffServ codepoints. PHB management within MPLS tunnels ensures consistent QoS treatment across the MPLS domain while maintaining service differentiation.
Why the other options are wrong
- A. MPLS DiffServ focuses on mapping between EXP and DSCP but does not simply match them; it provides translation and preservation mechanisms.
- C. GRE tunnels are separate encapsulation technologies; DiffServ tunneling does not use GRE to hide markings.
- D. While DiffServ tunneling interacts with IGP through traffic engineering, this is not an additional feature specific to DiffServ tunneling itself.
Question 26
In an MPLS network, which protocol can be used to distribute a Segment Prefix?
Show answer and explanation
Correct answer: C. OSPF
OSPF is used to distribute Segment Prefixes in Segment Routing. Segment Routing leverages existing Interior Gateway Protocols, with OSPF being a primary protocol for distributing prefix segments. These segments are advertised within OSPF extensions to enable source routing along shortest paths.
Why the other options are wrong
- A. LDP is used for label distribution but not specifically for distributing Segment Prefixes.
- B. EIGRP can be used for routing but is not the standard protocol for Segment Prefix distribution.
- D. RSVP-TE is used for MPLS Traffic Engineering tunnels, not for Segment Prefix distribution.
Question 27
Which QoS model allows hosts to report their QoS needs to the network?
Show answer and explanation
Correct answer: A. IntServ
Integrated Services (IntServ) is the QoS model that allows individual hosts to report their specific QoS needs and requirements to the network using the RSVP protocol. Hosts signal their bandwidth and delay requirements, and the network reserves resources along the entire path to guarantee those service levels.
Why the other options are wrong
- B. CB-WFQ (Class-Based Weighted Fair Queuing) is a queuing mechanism that implements QoS but does not allow hosts to report their QoS needs.
- C. DiffServ (Differentiated Services) provides QoS by marking packets at ingress and applying policies at network nodes, but does not rely on hosts reporting their needs.
- D. MQC (Modular QoS CLI) is a configuration framework for implementing QoS policies, not a QoS model that accepts host requests.
Question 28
Which CLI mode must be used to configure the BGP keychain in Cisco IOS XR Software?
Show answer and explanation
Correct answer: C. global configuration mode
BGP keychain configuration in Cisco IOS XR Software is performed in global configuration mode. The keychain is a global resource that defines authentication keys and their properties, which can then be referenced by BGP neighbors or other routing protocols. This follows the hierarchical configuration structure where global-level security objects are defined before being applied to specific protocol instances.
Why the other options are wrong
- A. Routing configuration mode is not the correct level for keychain setup.
- B. BGP neighbor configuration mode is where you reference the keychain, not where you define it.
- D. BGP address-family configuration mode is too specific; keychains are global objects.
Question 29
How can shared services in an MPLS Layer 3 VPN provide Internet access to the Customers of a central service provider?
Show answer and explanation
Correct answer: C. The customer VRF uses route targets to import and export routes to and from a shared services VRF.
In MPLS Layer 3 VPNs, shared services (such as Internet access) are provided through route targets, which allow customer VRFs to selectively import and export routes to and from a shared services VRF. This mechanism enables centralized service delivery while maintaining VPN isolation. Route targets control which routes are exchanged between different VRFs in a controlled manner.
Why the other options are wrong
- A. Static routes on CE routers do not enable route leakage from the PE global routing table in a controlled way.
- B. CE routers do not establish BGP peering directly with PE routers for Internet access in this architecture.
- D. Route distinguishers identify routes within VRFs but do not facilitate Internet access through shared services.
Question 30
Which statement about Network Services Orchestrator (NSO) is true?
Show answer and explanation
Correct answer: B. It uses YANG modeling language to automate devices.
Network Services Orchestrator (NSO) uses YANG as its data modeling language to define device configurations and automate network services. YANG provides the schema for NSO to understand and manage device configurations across heterogeneous network equipment.
Why the other options are wrong
- A. NSO does not require SDN as an overlay; it works with traditional network devices and protocols.
- C. NSO is used in both service provider and enterprise environments, not exclusively in service provider networks.
- D. NSO supports multiple encoding formats including JSON and NETCONF/XML, not XML coding exclusively.
Question 31
A network engineer is testing an automation platform that interacts with Cisco networking devices via NETCONF over SSH. In accordance with internal security requirements: • NETCONF sessions are permitted only from trusted sources in the 172.16.20.0/24 subnet. • CLI SSH access is permitted from any source. Which configuration must the engineer apply on R1?
Show answer and explanation
Correct answer: D. configure terminal hostname R1 ip domain-name mydomain.com crypto key generate rsa ip ssh version 2 access-list 1 permit 172.16.20.0 0.0.0.255 netconf ssh acl 1 line vty 0 4 transport input ssh end
The configuration must use SSH version 2 for security, create an ACL permitting only the trusted 172.16.20.0/24 subnet for NETCONF, and apply the netconf ssh acl command to restrict NETCONF sessions to that ACL while allowing CLI SSH from any source. Option D correctly implements this with the proper commands.
Why the other options are wrong
- A. Using SSH version 1 is a security vulnerability; version 2 is required. The netconf ssh acl command syntax is correct, but the SSH version is wrong.
- B. This configuration applies the ACL to the vty lines, which would restrict all SSH access including CLI, violating the requirement to permit CLI SSH from any source.
- C. Using SSH version 1 is insecure. Additionally, applying ACL 2 to vty lines restricts CLI access, which violates the requirement to allow CLI SSH from any source.
Question 32
Which statement about the Cisco MPLS TE forwarding adjacency feature is true?
Show answer and explanation
Correct answer: B. It enables the Cisco MPLS TE tunnel to be advertised into the running IGP.
The forwarding adjacency feature enables MPLS TE tunnels to be advertised as links into the running IGP (OSPF or IS-IS). This allows the tunnel to appear as a direct link in the IGP topology, enabling other routers to use the tunnel as a path in their routing calculations. This feature effectively creates logical adjacencies in the IGP based on MPLS TE tunnels, improving traffic engineering capabilities.
Why the other options are wrong
- A. Forwarding adjacency does not enable EIGRP in the MPLS core; it works with link-state IGPs like OSPF and IS-IS.
- C. Forwarding adjacency does not enable the tailend router to advertise routes to the headend over the tunnel; it advertises the tunnel itself into the IGP.
- D. Forwarding adjacency does not create bidirectional tunnels; it advertises unidirectional tunnels as IGP links.
Question 33
Which BGP attribute is used first when determining the best path?
Show answer and explanation
Correct answer: D. weight
Weight is a Cisco-specific attribute that is evaluated first in the BGP best path selection algorithm. It is a local value (0-65535) that is not advertised to other routers and has the highest priority in path selection. All other attributes like local preference, AS path, and origin are evaluated only after weight-based filtering. This makes weight the primary determinant when selecting the best path among multiple routes.
Why the other options are wrong
- A. Origin is evaluated much later in the BGP decision process, not first.
- B. AS path length is evaluated after weight and local preference.
- C. Local preference is evaluated before AS path but after weight.
Question 34
An engineer working for telecommunication company needs to secure the LAN network using a prefix list. Which best practice should the engineer follow when he implements a prefix list?
Show answer and explanation
Correct answer: D. An engineer must use nonsequential sequence numbers in the prefix list so that he can insert additional entries later.
When implementing prefix lists, using nonsequential sequence numbers is a best practice because it allows an engineer to insert additional entries between existing entries without renumbering the entire list. For example, using sequence numbers 10, 20, 30 allows new entries to be added at 15 or 25. This provides flexibility and ease of management when modifying prefix lists over time.
Why the other options are wrong
- A. Prefix lists can be identified by name or number; using only numbers is not a requirement or best practice.
- B. The final entry in a prefix list does not need to be /32; it depends on the network requirements and what traffic needs to be matched.
- C. A prefix list should include all prefixes that need to be controlled or matched, not only those requiring logging activity.
Question 35
Which two actions describe LSP delegation to PCE servers? (Choose two.)
Show answer and explanation
Correct answer: C, D. entering the mpls traffic-eng reoptimize command; adding a new PCE server with lower precedence than the primary PCE
LSP delegation to PCE servers involves two key actions: entering the mpls traffic-eng reoptimize command which triggers the PCE to compute and optimize LSPs, and adding new PCE servers with appropriate precedence levels to define which PCE takes priority for delegation. Adding a PCE with higher precedence makes it the primary server for delegation decisions, allowing operators to control which PCE handles LSP computation and reoptimization.
Why the other options are wrong
- A. Removing TE re-optimization timers does not configure PCE delegation; it affects timing behavior independent of PCE server assignment.
- B. Changing precedence of existing PCE servers is not an action that describes delegation setup; precedence is already set during initial configuration.
- E. While adding a PCE with higher precedence may be part of failover design, the explicit delegation action requires the reoptimize command to activate it.
Question 36
What occurs when a high bandwidth multicast stream is sent over an MVPN using Cisco hardware?
Show answer and explanation
Correct answer: D. A data MDT is created to allow for the best transmission through the core for (S, G) multicast route entries.
When a high bandwidth multicast stream is sent over an MVPN on Cisco hardware, a data MDT (Multicast Distribution Tree) is created to optimize the transmission through the core network specifically for (S, G) source-specific multicast route entries. This allows the high bandwidth stream to be transmitted more efficiently rather than riding on the default MDT, which is meant for low-bandwidth control traffic. The data MDT provides dedicated bandwidth and optimal path selection for the source-specific multicast flow.
Why the other options are wrong
- A. The default MDT is used for control traffic, not high bandwidth data streams, and is not the primary mechanism for (S, G) entries.
- B. Data MDTs are created for (S, G) entries, not (*, G) entries; (*, G) entries represent any-source multicast which is different from source-specific multicast.
- C. Only a data MDT is created for high bandwidth streams, not both data and default MDTs flooded to all PIM-SM neighbors; this would be inefficient.
Question 37
A network engineer has configured TE tunnels in the MPLS provider core. Which two steps ensure traffic traverse? (Choose two.)
Show answer and explanation
Correct answer: B, E. The IGP metric of a tunnel is configured to prefer a certain path; Forwarding adjacency feature allows a tunnel to be installed in the IGP table as a link.
To ensure traffic traverses TE tunnels, the IGP metric of a tunnel can be configured to make it preferred in path selection, influencing which routes IGP chooses. Additionally, the forwarding adjacency feature allows tunnels to be installed in the IGP topology table as links, enabling automatic traffic steering into tunnels without explicit route configuration.
Why the other options are wrong
- A. ECMP between tunnels is a forwarding mechanism but does not ensure proper RSVP function; RSVP operates independently of ECMP.
- C. Tunnel weight is not configured in the SPF database the same way as native links; tunnels are treated as adjacencies through forwarding adjacency, not direct SPF metrics.
- D. Static routes are optional; forwarding adjacency and IGP metric adjustment provide dynamic, preferred alternatives for tunnel traffic steering.
Question 38
Which statement about segment routing prefix segments is true?
Show answer and explanation
Correct answer: C. It is linked to a prefix SID that is globally unique within segment routing domain.
A prefix segment identifier (prefix SID) is a label that is globally unique within the segment routing domain and is assigned to a specific prefix (typically a loopback address of a node). This allows the prefix to be reached consistently across the entire SR domain. Prefix SIDs enable path computation and forwarding based on node and prefix identifiers rather than explicit hop-by-hop routing.
Why the other options are wrong
- A. Prefix SIDs represent the shortest path to a node via SPF, not the longest path.
- B. Adjacency SIDs are linked to specific adjacencies and have local significance, not global uniqueness.
- D. Segment routing operates independently of any single IGP and does not require EIGRP; it works with OSPF, IS-IS, and others.
Question 39
What are two features of stateful NAT64? (Choose two.)
Show answer and explanation
Correct answer: A, B. It uses address overloading; It provides 1:N translations, so it supports an unlimited number of endpoints.
Stateful NAT64 keeps per-flow state and uses address overloading, so many IPv6 hosts share a small pool of IPv4 addresses. This 1:N translation means the number of IPv6 endpoints is not tied to the number of IPv4 addresses. IPv6 hosts can use any address assignment method, including SLAAC, DHCPv6 or manual.
Why the other options are wrong
- C. IPv4-translatable IPv6 addresses are required by stateless NAT64, not stateful NAT64.
- D. Requiring manual or DHCPv6 address assignment is a stateless NAT64 limitation; stateful NAT64 works with any method, including SLAAC.
- E. 1:1 translation with a limited number of endpoints describes stateless NAT64.
Question 40
An engineer is moving all of an organization's Cisco IOS XE BGP routers to the address-family identifier format. Which command should be used to perform this upgrade quickly with the minimum service disruption?
Show answer and explanation
Correct answer: B. bgp upgrade-cli
The bgp upgrade-cli command is used on Cisco IOS XE to quickly migrate BGP configurations from the legacy format to the address-family identifier format with minimal service disruption. This command automates the conversion process while maintaining BGP functionality.
Why the other options are wrong
- A. vrf upgrade-cli is not a valid command for BGP address-family format upgrades.
- C. The address-family ipv4 command is used to enter address-family configuration mode but does not perform format conversion or upgrades.
- D. ip bgp-community new-format modifies BGP community format handling but is not the command for upgrading to address-family identifier format.
Question 41
Which feature will an operator use while implementing MPLS TE on customer's network, to prevent an LSP from using any overseas links?
Show answer and explanation
Correct answer: D. affinity
Affinity is the MPLS TE feature that allows operators to tag links with specific attributes (colors) and configure LSPs to include or exclude links based on those affinity values. By marking overseas links with a specific affinity color and configuring LSPs to exclude that color, the operator prevents tunnels from using those links.
Why the other options are wrong
- A. Bandwidth constraints only control capacity reservation, not link geography or routing behavior.
- B. SRLG (Shared Risk Link Group) is used for diversity and protection mechanisms, not for geographic path exclusion.
- C. Explicit paths require manual specification of every hop in the route, which is not practical for preventing use of any overseas links across multiple paths.
Question 42
An engineer needs to implement QOS mechanism on customer's network as some applications going over the Internet are slower than others. Which two actions must the engineer perform when implementing traffic shaping on the network in order to accomplish this task? (Choose two.)
Show answer and explanation
Correct answer: B, C. Configure a queue with sufficient memory to buffer excess packets; Implement a scheduling function to handle delayed packets
Traffic shaping requires buffering excess traffic in a queue with sufficient memory to hold packets temporarily, and a scheduling function to manage when delayed packets are transmitted. These two mechanisms work together to smooth traffic and prevent it from exceeding the configured rate.
Why the other options are wrong
- A. Packet remarking is associated with policing, not traffic shaping.
- D. Token bucket algorithms use token values, but this is an implementation detail, not a required action for implementing shaping.
- E. Threshold-based packet discard is a characteristic of policing, not traffic shaping, which buffers rather than drops.
Question 43
You are testing the capabilities of MPLS OAM ping. Which statement is true?
Show answer and explanation
Correct answer: A. An LSP is not required for the reply to reach the ingress MPLS router.
MPLS OAM ping does not require an LSP in the reverse direction for the reply to reach the ingress MPLS router. The reply can be sent using the IP routing table or other mechanisms, allowing detection of LSP breaks even when the reverse path is unavailable. This is a key capability of MPLS OAM that distinguishes it from relying solely on bidirectional LSPs.
Why the other options are wrong
- B. An LSP breakage does result in the ingress router receiving a reply notification, indicating the fault condition.
- C. MPLS OAM ping works with P2P LSPs and other LSP types, not solely P2P.
- D. MPLS OAM ping is not restricted to Cisco MPLS TE; it works across different MPLS implementations.
Question 44
How is a telemetry session established for data analytics?
Show answer and explanation
Correct answer: A. A router initiates a session using the dial-out mode to a destination.
In telemetry dial-out mode, a router (the telemetry source) initiates an outbound connection to a telemetry collector or destination. This is the standard operational mode for model-driven telemetry where the network device pushes data to the collector rather than waiting to be pulled. The router connects to the destination address and port specified in the telemetry configuration.
Why the other options are wrong
- B. Telnet is a legacy protocol for command-line access, not the mechanism for establishing telemetry data sessions.
- C. Dial-out mode is initiated by the router, not the destination; dial-in mode would involve the collector initiating to the router.
- D. While a destination may initiate a session in dial-in telemetry mode, dial-out mode (the standard approach) has the router initiating the connection.
Question 45
Which module refers to the network automation using Ansible?
Show answer and explanation
Correct answer: B. the iosxr_command module to issue run commands on remote devices
The iosxr_command module in Ansible is used to execute commands on remote IOS XR devices and retrieve their output. This module enables network automation by allowing administrators to issue run commands across multiple devices.
Why the other options are wrong
- A. The iosxr_system module is used to collect facts but is not the primary module for general network automation commands.
- C. The iosxr_user module manages user accounts and authentication, not banners.
- D. The iosxr_logging module configures logging settings but does not run debugging commands.
Question 46
What is the function of the FEC field within the OTN signal structure?
Show answer and explanation
Correct answer: C. It allows receivers to correct errors upon data arrival
The Forward Error Correction (FEC) field in the OTN (Optical Transport Network) signal structure enables receivers to detect and correct transmission errors automatically upon data arrival. This redundancy-based mechanism allows single-bit error correction and multi-bit error detection without requiring retransmission, improving overall data integrity and reducing latency in optical networks.
Why the other options are wrong
- A. FEC is not used for QoS application; QoS is handled by separate traffic engineering mechanisms.
- B. FEC does not enable deep packet inspection; it only corrects transmission errors.
- D. FEC cannot discard errors before transmission; it corrects errors at the receiving end after transmission.
Question 47
A network architect decides to expand the scope of the multicast deployment within the company network. The network is already using PIM-SM with a static RP that supports a high-bandwidth, video-based training application that is heavily used by the employees, but excessive bandwidth usage is a concern. How must the engineer update the network to provide a more efficient multicast implementation?
Show answer and explanation
Correct answer: C. Implement BSR to support dynamic RP notification.
Bootstrap Router (BSR) provides dynamic RP discovery and redundancy, improving multicast efficiency compared to static RP. It automatically notifies PIM-SM routers about available RPs, enabling load distribution and failover, which reduces bandwidth waste from suboptimal RP placement in large deployments.
Why the other options are wrong
- A. IGMP manages multicast group membership on LANs but does not address the efficiency issue of RP placement or redundancy.
- B. ICMP is not a multicast protocol and cannot improve multicast reachability; this option confuses unrelated protocols.
- D. STP operates at Layer 2 and improves switching performance for unicast traffic, not multicast efficiency or RP optimization.
Question 48
What is the role of NSO?
Show answer and explanation
Correct answer: B. Controls the turn-up of a device.
Cisco NSO controls the turn-up of network devices by managing initial provisioning, configuration, and onboarding of new devices into the network. It orchestrates the complete lifecycle of device deployment from discovery through activation.
Why the other options are wrong
- A. NSO does not provide public cloud services; it is an on-premises or private cloud orchestration platform.
- C. NSO is not a Layer 3 monitoring service; it is a configuration and provisioning orchestrator.
- D. NSO does not maintain data storage; it manages configurations and services across network devices.
Question 49
How does model-driven telemetry use YANG?
Show answer and explanation
Correct answer: C. to subscribe to data that is streamed from a device
Model-driven telemetry uses YANG to enable devices to stream operational data continuously to collectors through subscriptions. The YANG model defines the structure of data that is pushed from network devices in real-time rather than being polled periodically.
Why the other options are wrong
- A. YANG does not control polling intervals; telemetry can use subscriptions for continuous streaming.
- B. YANG does not configure SNMP informs and traps; it defines data models for streaming telemetry.
- D. YANG is not used to reset malfunctioning devices; it defines data structures for telemetry collection.
Question 50
Which utility can you use to locate MPLS faults?
Show answer and explanation
Correct answer: C. MPLS traceroute
MPLS traceroute is used to locate MPLS faults by tracing the path of an LSP and identifying where failures occur along the label switched path. It provides hop-by-hop visibility into LSP traversal and can pinpoint where a path breaks or becomes unavailable, making it the primary utility for fault localization in MPLS networks.
Why the other options are wrong
- A. MPLS LSP ping verifies connectivity but does not trace the path to locate faults.
- B. QoS is used for traffic prioritization and shaping, not for fault location.
- D. EEM (Embedded Event Manager) is used for event-driven automation, not for MPLS fault location.
Question 51
What is the characteristic of the TI-LFA?
Show answer and explanation
Correct answer: D. It applies on the area and instance and makes all the interfaces inherit the configuration
Topology Independent Loop-Free Alternate (TI-LFA) is a fast reroute mechanism that applies at both the area and instance levels, and it makes all interfaces within that scope inherit the loop-free alternate configuration. This ensures consistent protection across the configured domain. TI-LFA guarantees loop-free backup paths by computing alternates that are inherently loop-free based on the network topology, eliminating the need for each interface to be individually configured.
Why the other options are wrong
- A. TI-LFA provides loop-free guarantees at the configured scope level (area and instance), not necessarily for all areas in the OSPF domain.
- B. TI-LFA operates on configured areas and instances, not specifically limited to the OSPF super backbone or all interfaces within it.
- C. TI-LFA applies to both the area and instance levels, not just a single instance with inheritance.
Question 52
A remote operation center is deploying a set of I-BGP and E-BGP connections for multiple IOSXR platforms using the same template. The I-BGP sessions exchange prefixes with no apparent issues, but the E-BGP sessions do not exchange routes. What causes this issue?
Show answer and explanation
Correct answer: B. The E-BGP neighbors are not allowed to exchange Information due to the customer platform's default policy.
Cisco IOS XR implements a default deny-all policy for E-BGP route exchange in many platform configurations unless an explicit allow policy is configured. This is a security feature that prevents unauthorized route propagation. I-BGP sessions may have different default behavior or the policy was already configured in the template. The E-BGP sessions fail because the customer platform's default implicit deny policy blocks route advertisement without an explicit permit policy being applied.
Why the other options are wrong
- A. Mistyped I-BGP neighbors would cause session failures, not selective route non-exchange; also HELLO packets would fail on both I-BGP and E-BGP.
- C. A PASS ALL policy is not required for I-BGP sessions to function; the issue is specific to E-BGP.
- D. While next-hop-self is often configured on E-BGP sessions, its absence would not completely prevent route exchange, only affect reachability.
Question 53
Which additional configuration is required for NetFlow to provide traceback information?
Show answer and explanation
Correct answer: C. Cisco Express Forwarding must be configured for traffic that is egressing from the router to be property reported.
Cisco Express Forwarding (CEF) must be enabled for NetFlow to properly function and provide accurate traffic analysis and reporting. CEF is the underlying packet forwarding mechanism that NetFlow requires to capture and report egress traffic data.
Why the other options are wrong
- A. While ACLs can be used to filter NetFlow data collection, they are not required for NetFlow traceback functionality.
- B. BGP is not a requirement for NetFlow Version 5 to report ingress and egress data.
- D. LLDP is a link discovery protocol and has no relationship to NetFlow operation or analyzer connectivity.
Question 54
A network engineer is deploying VPLS configuration between multiple PE routers so that customer's remote offices have end-to-end LAN connectivity. Which additional configuration should the engineer perform on the PE routers to enable the virtual switch instance?
Show answer and explanation
Correct answer: A. l2 vfi ciscotest manual vpn id 100 neighbor 192.168.2.2 encapsulation mpls neighbor 192.168.3.3 encapsulation mpls
The l2 vfi configuration command creates the virtual switch instance (VSI) for VPLS by defining a Virtual Forwarding Instance with a manual pseudowire configuration. This command specifies the VPN ID and neighbor PE routers with their encapsulation methods, establishing the logical switch that connects the remote offices with end-to-end LAN connectivity. This is the essential configuration step for enabling the VPLS virtual switch.
Why the other options are wrong
- B. Switchport trunk configuration is for physical switch interfaces, not for creating VPLS virtual switch instances.
- C. The xconnect command connects an interface to a VFI but does not create the VFI itself; the l2 vfi command creates the instance first.
- D. Assigning an IP address to a VLAN interface does not create a virtual switch instance; this configures an SVI for routing, not a VPLS VSI.
Question 55
Which three OSPF parameters must match before two devices can establish an OSPF adjacency? (Choose three.)
Show answer and explanation
Correct answer: B, E, F. subnet mask; area number; hello timer setting
For two OSPF devices to establish an adjacency, the subnet mask must match (ensuring they are on the same network), the area number must match (ensuring they operate in the same OSPF area), and the hello timer settings must match (ensuring they can detect each other's keepalive messages). These three parameters are critical to OSPF neighbor discovery and adjacency formation. IP address is not required to match (they need to be on the same network but different), interface cost does not affect adjacency establishment, and process ID is locally significant.
Why the other options are wrong
- A. IP addresses must differ on the same subnet, not match.
- C. Interface cost does not affect whether adjacency is established, only path selection.
- D. Process ID is locally significant only and does not affect adjacency with other routers.
Question 56
An engineer implemented LDP protocol on the ISP network. The engineer must ensure that there are no packet loss issues when IGP and LDP protocols are not synchronized. Which configuration must the engineer implement so that the IGP routing protocol will wait until LDP convergence is completed?
Show answer and explanation
Correct answer: D. Configure MPLS LDP IGP synchronization on the network.
MPLS LDP IGP synchronization must be configured to ensure the IGP routing protocol waits for LDP convergence before considering links available for forwarding. This prevents packet loss during the convergence window when IGP has converged but LDP labels have not yet been distributed, ensuring labels are installed before traffic is forwarded.
Why the other options are wrong
- A. Disabling LDP IGP synchronization would increase packet loss risk, not prevent it.
- B. LDP session protection prevents session flaps but does not synchronize IGP and LDP convergence timing.
- C. Disabling IP CEF and enabling LDP protocol separately does not address the synchronization issue between protocols.
Question 57
A router RP is configured to perform MPLS LDP graceful restart. Which three steps are included when the RP sends an LDP initialization message to a neighbor to establish an LDP session? (Choose three.)
Show answer and explanation
Correct answer: A, B, D. Learn from Neighbor (N) flag, set to 1; Recovery Time field; Reconnect Timeout field
When an RP sends an LDP initialization message to establish an LDP session with graceful restart capability, it includes three key components: the Learn from Neighbor (N) flag in the Graceful Restart Capability TLV to indicate graceful restart support, the Recovery Time field to specify how long the neighbor should wait before declaring the session down, and the Reconnect Timeout field to indicate the maximum time allowed to re-establish the session. The Graceful Restart capability itself is signaled in the OPEN message, but the specific timing parameters are included in the initialization exchange.
Why the other options are wrong
- C. Type-9 LSAs are OSPF constructs and are not part of LDP message exchanges.
- E. While Graceful Restart capability is signaled in the OPEN message, this is not a step within the initialization message content itself; the specific parameters are in separate TLVs.
- F. The Learn from Network (L) flag is not a standard component of LDP graceful restart initialization; the N flag is what indicates neighbor learning capability.
Question 58
After implementing MPLS protocol for multiple VRFs on a single Cisco device, the engineer notices all VRFs on the router still do not have the LDP session protection feature enabled. Which configuration must the engineer apply to enable the LDP session protection feature for LDP neighbors within each VRF?
Show answer and explanation
Correct answer: B. Configure LDP session protection within the individual VRFs.
LDP session protection in multi-VRF environments must be configured within each individual VRF context because LDP operates separately per VRF. Each VRF maintains its own LDP neighbors and adjacencies, requiring protection settings to be applied at the VRF level rather than globally. Global configuration alone does not propagate protection settings to individual VRF LDP sessions.
Why the other options are wrong
- A. Global LDP session protection configuration does not automatically enable the feature for LDP neighbors within separate VRFs.
- C. LDP session authentication is independent of session protection and does not enable protection as a side effect.
- D. Configuring at both global and neighbor levels is unnecessary and not the correct approach for VRF-specific LDP sessions.
Question 59
After you analyze your network environment, you decide to implement a full separation model for Internet access and MPLS L3VPN services. For which reason do you make this decision?
Show answer and explanation
Correct answer: B. It enables you to choose whether to separate or centralize each individual service.
Implementing a full separation model for Internet access and MPLS L3VPN services enables flexibility in managing each service independently. This architectural choice allows operators to decide whether to separate or centralize individual services based on specific business requirements, security policies, and operational needs. Each service can be optimized independently with its own routing policies, QoS settings, and security controls.
Why the other options are wrong
- A. While separation can help with independent operation, it does not directly enable EGP and IGP to operate independently; they operate independently regardless of service separation.
- C. A full separation model makes systems easier to manage and scale, not harder; mixing services increases complexity.
- D. A full separation model typically requires multiple edge routers for redundancy and service isolation, not just one.
Question 60
Which configuration enables BGP FlowSpec client function and installation of policies on all local interfaces?
Show answer and explanation
Correct answer: A. flowspec address-family ipv4 local-install interface-all
The correct configuration syntax for enabling BGP FlowSpec client function with installation of policies on all local interfaces is 'flowspec address-family ipv4 local-install interface-all'. The 'local-install' keyword enables local policy installation, and 'interface-all' specifies that policies should be applied to all local interfaces.
Why the other options are wrong
- B. The word order 'install interface-all local' does not match the correct Cisco configuration syntax.
- C. This omits the 'local-install' keyword which is required to enable local policy installation on interfaces.
- D. The syntax 'all-interface' is incorrect; the proper keyword is 'interface-all'.
Question 61
While implementing TTL security, you issue the PE(config-router-af)#neighbor 2.2.2.2 ttl-security hops 2 command. After you issue this command, which BGP packets does the PE accept?
Show answer and explanation
Correct answer: D. from 2.2.2.2, with a TTL of 253 or more
When configuring BGP TTL security with the command neighbor 2.2.2.2 ttl-security hops 2, the PE router accepts BGP packets FROM 2.2.2.2 with a TTL of 253 or more. The TTL security mechanism works by calculating an expected minimum TTL based on the hop distance. With 2 hops specified, the router expects a TTL of at least 255 minus 2 (the number of hops), which equals 253. Packets arriving with TTL values lower than this threshold are rejected as potential spoofing attempts.
Why the other options are wrong
- A. The command specifies incoming packets FROM the neighbor, not outgoing packets TO the neighbor.
- B. TTL security requires TTL values to be greater than or equal to the minimum threshold, not less than it.
- C. With 2 hops configured, the minimum acceptable TTL is 253, not less than 253.
Question 62
Which feature describes the adjacency SID?
Show answer and explanation
Correct answer: D. It is locally unique.
An Adjacency SID is locally unique, meaning it is significant and unique only within the context of a single router and its adjacent node. Each router assigns its own adjacency SIDs independently, and these values have no global significance across the network. This local scope allows for efficient use of the SID space.
Why the other options are wrong
- A. Adjacency SIDs apply to point-to-point links, multipoint links, and broadcast links.
- B. Adjacency SIDs are locally unique, not globally unique.
- C. Adjacency SIDs apply to all link types, including multipoint and broadcast links.
Question 63
What does DWDM use to combine multiple optical signals?
Show answer and explanation
Correct answer: B. wavelength
Dense Wavelength Division Multiplexing (DWDM) uses different wavelengths (colors) of light to combine multiple optical signals onto a single fiber. Each signal is assigned a specific wavelength in the optical spectrum, allowing many independent channels to be transmitted simultaneously over the same physical fiber without interference.
Why the other options are wrong
- A. IP protocols operate at the network layer and are not the mechanism DWDM uses to combine signals.
- C. Time slots are used in Time Division Multiplexing (TDM), not in DWDM.
- D. While wavelength and frequency are related in physics, DWDM specifically uses wavelength division, not frequency division, as its primary organizing principle.
Question 64
You are configuring MPLS traffic-engineering tunnels in the core. Which two ways exist for the tunnel path across the core? (Choose two.)
Show answer and explanation
Correct answer: B, E. Tunnels can be configured with dynamic path or explicitly defined path; Tunnel links inherit IGP metrics by default unless overridden.
MPLS TE tunnels support two fundamental path definition methods: dynamic path selection, where the tunnel headend calculates the path based on the current topology and constraints, and explicitly defined path (also called loose or strict hop lists), where the path is manually specified in the configuration. Option B correctly identifies both methods. Option E is also correct because tunnel links do inherit IGP metrics by default unless overridden with explicit metric configuration, which affects path calculations.
Why the other options are wrong
- A. Dynamic path selection is supported by both IS-IS and OSPF link-state protocols, not exclusively IS-IS.
- C. A zero bandwidth tunnel is valid; it represents a tunnel without a hard bandwidth reservation.
- D. While the bandwidth statement does reserve bandwidth on links, characterizing it only as creating a 'hard' reservation is incomplete; it can be configured with various reservation types.
Question 65
Which two uses of the YANG data modeling language are true? (Choose two.)
Show answer and explanation
Correct answer: A, D. It can be used to model the configuration used by NETCONF operations; It can be used to shape state data of network elements.
YANG is a data modeling language used to model both configuration and state data of network elements. Option A is correct because YANG defines the structure of configuration data consumed by NETCONF operations. Option D is correct because YANG models the operational state and configuration state of network devices. Together, these two options capture the primary uses of YANG in modern network automation.
Why the other options are wrong
- B. YANG is a data model, not a protocol; HTTP is not accessed by YANG itself, RESTCONF uses YANG models over HTTP, but YANG does not directly access devices.
- C. YANG is a data modeling language for network configuration and state, not a troubleshooting framework; it does not replace the OSI model for network troubleshooting.
- E. YANG defines data models, while RESTCONF is a protocol for transport; YANG does not replace RESTCONF, they are complementary technologies where YANG provides the schema and RESTCONF provides the mechanism.
Question 66
What must a network engineer consider when designing a Cisco MPLS TE solution with OSPF?
Show answer and explanation
Correct answer: A. The OSPF extensions and RSVP-TE must be enabled on all routers in the network.
Cisco MPLS TE with OSPF requires OSPF extensions (opaque LSAs that carry TE information) and RSVP-TE (Resource Reservation Protocol for Traffic Engineering) to be enabled on all routers participating in the network. These extensions allow OSPF to advertise link state information necessary for TE LSP computation and establishment across the entire network.
Why the other options are wrong
- B. OSPF extensions for RSVP-TE are supported in all areas, not just Area 1.
- C. Both ingress and egress routers, along with all transit routers, must have these features enabled.
- D. OSPF TE extensions use Type 10 opaque LSAs, not Type 6, 7, and 8.
Question 67
Which service is a VNF role?
Show answer and explanation
Correct answer: B. Firewall
A Virtual Network Function (VNF) is a software-based network service that runs on virtualized infrastructure. Network services like firewalls are common VNF implementations that perform security functions. A firewall is a network service packaged as a VNF to provide packet filtering and security policy enforcement in a virtualized environment.
Why the other options are wrong
- A. Network is too generic and refers to the infrastructure itself, not a specific VNF role or service.
- C. Storage is an infrastructure service, not a network function; VNFs focus on network and security services.
- D. Compute is a resource or infrastructure component, not a VNF role; VNFs consume compute resources but are not themselves compute services.
Question 68
After a possible security breach, the network administrator of an ISP must verify the times that several different users logged into the network. Which command must the administrator enter to display the login time of each user that activated a session?
Show answer and explanation
Correct answer: A. show netconf-yang sessions detail
The 'show netconf-yang sessions detail' command displays detailed information about active NETCONF sessions, including login times and session details for each user. The 'detail' keyword provides comprehensive timing information for each authenticated session.
Why the other options are wrong
- B. The 'show netconf-yang sessions' command without the 'detail' keyword provides only summary session information without login times.
- C. The 'show netconf-yang datastores' command displays available data models and datastores, not user session login times.
- D. The 'show platform software yang-management process' command shows process information, not user session details.
Question 69
How much must the MTU be increased when configuring the 802.1q VLAN tag?
Show answer and explanation
Correct answer: B. 4 bytes
The 802.1q VLAN tag adds 4 bytes to the Ethernet frame header (2 bytes for the tag protocol identifier and 2 bytes for the tag control information). When implementing VLANs, the MTU must be increased by 4 bytes to accommodate this additional header information while maintaining the same payload capacity. This is commonly done by increasing the MTU from the standard 1500 bytes to 1504 bytes (or 1522 bytes when considering FCS).
Why the other options are wrong
- A. 2 bytes is insufficient; the complete VLAN tag is 4 bytes.
- C. 8 bytes exceeds the VLAN tag overhead.
- D. 12 bytes is excessive for a single VLAN tag.
Question 70
A network administrator must monitor network usage to provide optimal performance to the network end users when the network is under heavy load. The administrator asked the engineer to install a new server to receive SNMP traps at destination 192.168.1.2. Which configuration must the engineer apply so that all traps are sent to the new server?
Show answer and explanation
Correct answer: D. snmp-server enable traps snmp-server host 192.168.1.2 public
To send all SNMP traps to a destination server, the configuration must enable traps globally without specifying a particular trap type. The command 'snmp-server enable traps' without parameters enables all trap types, and 'snmp-server host' specifies the destination. This ensures comprehensive trap forwarding to the monitoring server.
Why the other options are wrong
- A. Limiting to entity traps only captures entity-specific events, not all traps.
- B. Limiting to BGP traps only captures BGP-specific events, not all traps.
- C. Limiting to ISDN traps only captures ISDN-specific events, not all traps.
Question 71
What is a characteristic of MVPN?
Show answer and explanation
Correct answer: C. It allows VRF traffic to use the service provider MPLS VPN to route multicast traffic.
MVPN (Multicast VPN) allows VRF traffic to use the service provider MPLS VPN infrastructure to route multicast traffic across the provider core. This enables multicast communication within and between customer VPNs while leveraging the existing MPLS VPN framework. The service extends VPN capabilities from unicast-only to include multicast support.
Why the other options are wrong
- A. MVPN uses MPLS within the service provider core, not IP-only transmission.
- B. While pseudowires are used in some VPN technologies, MVPN specifically uses MPLS LSPs and multicast-specific protocols, not pseudowires for multicast.
- D. MVPN does not create GRE tunnels; it operates within the MPLS framework.
Question 72
An engineer must extend Layer 2 between two campus sites connected through an MPLS backbone that encapsulates Layer 2 and Layer 3 data. Which action must the engineer perform on the routers to accomplish this task?
Show answer and explanation
Correct answer: C. Configure a pseudowire for E-LINE.
A pseudowire for E-LINE is the correct mechanism to extend Layer 2 connectivity between two campus sites across an MPLS backbone. A pseudowire emulates a point-to-point connection at Layer 2, encapsulating Layer 2 frames within MPLS packets, which is exactly what the requirement describes for extending Layer 2 between sites through an MPLS backbone.
Why the other options are wrong
- A. QoS configuration for MPLS and E-ACCESS does not extend Layer 2 connectivity; it only provides quality of service parameters.
- B. EtherChannel is a link aggregation technology for combining multiple physical links; it does not extend connectivity across MPLS backbones.
- D. MPLS TE with E-TREE is used for traffic engineering and multipoint connectivity; E-LINE is the appropriate service type for point-to-point Layer 2 extension.
Question 73
A customer of an ISP requests support to setup a BGP routing policy. Which BGP attribute should be configured to choose specific BGP speakers as preferred points for the customer AS?
Show answer and explanation
Correct answer: D. highest local preference inbound
Local preference is a BGP attribute used to influence outbound route selection within an autonomous system. A higher local preference value indicates a preferred path. When configured with the highest local preference inbound (meaning routes learned from preferred neighbors are assigned high values), it causes the router to prefer those specific BGP speakers as entry points and directs traffic to exit through those preferred points, making it the mechanism for choosing preferred BGP speakers for customer AS traffic.
Why the other options are wrong
- A. Multi-exit discriminator influences path selection based on exit point preference from external ASes, not for choosing preferred speakers.
- B. Local preference does not apply outbound in the direction described; it is applied to received routes.
- C. Lowest local preference would deprioritize routes, not select preferred speakers.
Question 74
What do Ansible and SaltStack have in common?
Show answer and explanation
Correct answer: D. They both use YAML configuration language.
Both Ansible and SaltStack use YAML (YAML Ain't Markup Language) as their configuration language for defining playbooks, states, and tasks. YAML's human-readable syntax is the common standard for configuration definition in both tools, making this a key similarity between them.
Why the other options are wrong
- A. Ansible is agentless and uses SSH for communication; SaltStack can operate with or without agents (agentless mode is available), but this is not a commonality, Ansible explicitly avoids agents.
- B. SaltStack supports multiple master servers in a master-of-masters architecture, but Ansible does not typically operate with multiple master servers in the same way.
- C. Neither tool uses a traditional DSL (Domain Specific Language); both use YAML, which is a general-purpose data serialization language, not a DSL.
Question 75
How do intent APIs make it easier for network engineers to deploy and manage networks?
Show answer and explanation
Correct answer: C. They streamline repetitive workflows and support more efficient implementation.
Intent APIs abstract complex network configurations and allow engineers to declare desired outcomes rather than step-by-step commands. They streamline repetitive workflow tasks and enable more efficient implementation by automating common patterns and reducing manual configuration errors.
Why the other options are wrong
- A. Intent APIs are not focused on pulling SNMP data for monitoring tools; they are about configuration and service deployment.
- B. While intent APIs may provide centralized control, this description better fits single-pane-of-glass management rather than the specific purpose of intent APIs.
- D. Intent APIs do not extend Layer 2 infrastructure or manage virtual connections to Layer 3 devices; this is unrelated to their core function.
Question 76
The engineering team at a large ISP has been alerted that a customer network is experiencing high traffic congestion. After a discussion between the ISP and technical personnel at the customer site, the team agrees that traffic to the customer network that exceeds a specific threshold will be dropped. Which task must the engineer perform on the network to implement traffic policing changes?
Show answer and explanation
Correct answer: D. Set IP precedence values to take effect when traffic exceeds a given threshold.
Traffic policing uses IP precedence values (or DSCP) to mark packets when they exceed a threshold, and then drops packets based on these markings to enforce the rate limit. When traffic exceeds the specified threshold, the engineer sets precedence values that determine which packets are dropped during congestion.
Why the other options are wrong
- A. RSVP reserves bandwidth proactively, whereas policing reactively drops excess traffic.
- B. CDP is a discovery protocol and is not related to traffic policing implementation.
- C. CEF is a forwarding mechanism and does not implement the dropping behavior needed for traffic policing.
Question 77
What causes multicast traffic to permanently stay on the shared tree and not switch to the source tree?
Show answer and explanation
Correct answer: C. The SPT threshold is set to infinity
When the SPT (Shortest Path Tree) threshold is set to infinity, multicast traffic never switches from the shared tree (rooted at the RP) to the source tree. This configuration prevents the join mechanism to the source from triggering, keeping all traffic on the RP-based tree permanently.
Why the other options are wrong
- A. SSM (Source-Specific Multicast) uses a different forwarding model entirely and does not prevent tree switching in ASM.
- B. Filtering RP announcements would prevent the RP from being known, not cause traffic to stay on the shared tree.
- D. An incorrect RP IP address would prevent proper RP communication but would not specifically lock traffic to the shared tree.
Question 78
An engineer is implementing a route map to support redistribution within BGP. The route map must be configured to permit all unmatched routes. Which action must the engineer perform to complete this task?
Show answer and explanation
Correct answer: D. Include a permit statement as the last entry.
Route maps have an implicit deny statement at the end by default, which rejects any routes that do not match any permit statement. To permit all unmatched routes, an engineer must add an explicit permit statement as the last entry with no match criteria, which matches everything that has not been explicitly matched by earlier entries.
Why the other options are wrong
- A. Including a permit statement as the first entry would match only those routes and would not capture unmatched routes.
- B. The implicit deny cannot be removed; instead, an explicit permit must be added to override it.
- C. Adding explicit deny statements would further restrict traffic and does not permit unmatched routes.
Question 79
What is the role of NSO in network automation?
Show answer and explanation
Correct answer: A. It is a tool used to bridge automation to the physical network infrastructure.
Cisco NSO (Network Services Orchestrator) is a platform designed to bridge automation to physical network infrastructure by providing a single control point for multi-vendor network device management. It abstracts the complexity of different device types and enables service-centric provisioning across heterogeneous networks.
Why the other options are wrong
- B. NSO is not a GUI for managing wireless devices; that function is served by tools like Cisco DNA Center or Catalyst Center.
- C. NSO is not a REST API for APIC configuration; it is an orchestration platform that can interact with various APIs including those of APIC.
- D. NSO supports multiple configuration methods including NETCONF, YANG models, and REST APIs, not CLI only, and it manages both physical and virtual devices.
Question 80
Which protocol is used for communication between the PCE and PCC?
Show answer and explanation
Correct answer: C. PCEP
PCEP (Path Computation Element Protocol) is the protocol used for communication between a PCE (Path Computation Element) and a PCC (Path Computation Client). PCEP defines the messaging and procedures through which PCCs request path computations from PCEs and receive path computation results, making it the standard protocol for this interaction in MPLS Traffic Engineering.
Why the other options are wrong
- A. POP is the Post Office Protocol used for email, not for PCE-PCC communication.
- B. CEF is Cisco Express Forwarding, a switching method, not a protocol for PCE-PCC communication.
- D. ICMP is the Internet Control Message Protocol used for diagnostics and error reporting, not for PCE-PCC communication.
Question 81
Which two routing protocols support Cisco MPLS TE tunnels? (Choose two.)
Show answer and explanation
Correct answer: D, E. IS-IS; OSPF
Cisco MPLS TE tunnels are supported by both IS-IS and OSPF routing protocols. Both IGP protocols have been extended with traffic engineering capabilities to support MPLS TE, allowing them to advertise link bandwidth and other TE metrics needed for constraint-based routing.
Why the other options are wrong
- A. RIP does not support MPLS TE extensions.
- B. EIGRP does not support MPLS TE; it is not an IGP with TE capabilities.
- C. BGP is an EGP and does not directly support MPLS TE tunnels in the way IGPs do.
Question 82
How can a network administrator secure rest APIs?
Show answer and explanation
Correct answer: B. They can authenticate user sessions and provide the appropriate privilege level.
Securing REST APIs requires proper user authentication and authorization through privilege levels. By authenticating user sessions and assigning appropriate privilege levels, administrators ensure that each user can only perform actions consistent with their role and permissions. This implements the principle of least privilege and prevents unauthorized access or operations.
Why the other options are wrong
- A. Sharing a general administrator login across multiple users eliminates accountability and audit trails, violating security best practices.
- C. While TACACS+ is a strong authentication method, restricting to TACACS+ only is unnecessarily limiting; other authentication mechanisms like OAuth, API keys, or certificate-based auth are also valid.
- D. Allowing read and write privileges to all users bypasses access control entirely and violates the principle of least privilege.
Question 83
A network operator needs to implement PIM-SSM multicast configuration on a customer's network so that users in different domains are able to access and stream live traffic. Which two actions must the engineer perform on the network to make the streaming work? (Choose two.)
Show answer and explanation
Correct answer: A, C. Enable IGMP version 3 at the interface level; Enable PIM sparse mode on the device.
Two actions are required for PIM-SSM multicast configuration: First, enable IGMPv3 at the interface level because SSM relies on IGMPv3's source-specific group capabilities to signal (source, group) pairs. Second, enable PIM sparse mode on the device because SSM operates within the PIM sparse mode framework, using source trees without requiring an RP. These two configurations work together to enable the SSM model for streaming traffic.
Why the other options are wrong
- B. PIM dense mode floods traffic to all interfaces and is not used with SSM; SSM requires sparse mode.
- D. IGMPv2 only supports group-specific joins and does not provide the source-specific signaling required for SSM functionality.
- E. MSDP peers are used for PIM-SM interdomain communication with RPs, not for SSM which operates without RPs.
Question 84
A regional MPLS VPN provider operates in two regions and wants to provide MPLS L3VPN service for a customer with two sites in these separate locations. The VPN provider approaches another organization to provide backbone carrier services so that the provider can connect to these two locations. Which statement about this scenario is true?
Show answer and explanation
Correct answer: C. When BGP is used for both route and label exchange, the neighbor a.b.c.d send-label command is used under the address-family VPNv4 command mode.
When BGP is used for both route and label exchange in an MPLS VPN scenario with a backbone carrier, the neighbor command with the send-label option is configured under the VPNv4 address-family. This enables BGP to exchange both VPNv4 routes and their corresponding MPLS labels between PE routers.
Why the other options are wrong
- A. MP-eBGP exchanging customer VPNv4 routes directly between regional sites is not the correct approach for CSC; the backbone carrier handles this differently.
- B. While eBGP send-label is used in CSC, MPLS-BGP forwarding is not configured under the PE-to-CE interface in this manner.
- D. When using IGP and LDP for label exchange, MPLS must be enabled on the actual data-carrying interfaces, not just the VRF interface.
Question 85
Which MPLS design attribute can you use to provide Internet access to a major customer through a separate dedicated VPN?
Show answer and explanation
Correct answer: A. The Internet gateway router is connected as a PE router to the MPLS backbone.
To provide Internet access to a customer through a separate dedicated VPN in an MPLS environment, the Internet gateway router must be connected as a PE (Provider Edge) router to the MPLS backbone. This allows the gateway to function as both a VPN endpoint and an Internet access point, enabling the customer to reach both their private VPN and public Internet resources through the same service provider infrastructure.
Why the other options are wrong
- B. While VRF-Lite is useful for VPN separation, requiring the CE router to support the full BGP Internet table is not the primary design attribute for this solution.
- C. Inserting the full Internet BGP routing table into a customer VPN violates the segmentation principle and is not a best practice for dedicated VPN Internet access.
- D. Assigning the customer to the same RTs as the Internet gateway would leak all Internet routes to the customer, which is inefficient and not the proper design approach.
Question 86
An engineer is implementing a Cisco MPLS TE tunnel to improve the streaming experience for the clients of a video-on-demand server. Which action must the engineer perform to configure extended discovery to support the MPLS LDP session between the headend and tailend routers?
Show answer and explanation
Correct answer: A. Configure a targeted neighbor session.
Extended LDP discovery between headend and tailend routers requires configuring a targeted neighbor session. This explicitly establishes an LDP session between non-directly connected routers without relying on link-local adjacencies, enabling the MPLS TE tunnel to support LDP label distribution across the tunnel path.
Why the other options are wrong
- B. Access lists for TCP and UDP traffic are not required for extended discovery; LDP uses port 646 and dynamic port ranges handled separately.
- C. Configuring MPLS TE tunnels on both ends is not the configuration step for extended discovery; extended discovery is an LDP configuration.
- D. Interface bandwidth configuration does not enable extended LDP discovery; bandwidth is a separate parameter for capacity management.
Question 87
What do Chef and Puppet have in common?
Show answer and explanation
Correct answer: C. use a master server
Both Chef and Puppet use a master-server architecture where a central master server manages configurations for distributed agent nodes. This contrasts with agentless tools like Ansible that push configurations without requiring agents on managed devices.
Why the other options are wrong
- A. While Chef uses Ruby, Puppet uses its own domain-specific language (DSL), so this is not a shared common feature.
- B. Both Chef and Puppet provide pre-built modules and cookbooks that can be reused without creating everything from scratch.
- D. Minions are agent nodes in Salt, not in Chef or Puppet, which use different terminology for their managed nodes.
Question 88
An engineer is implementing MPLS OAM to monitor traffic within the MPLS domain. Which action must the engineer perform to prevent packets from being forwarded beyond the service provider domain when the LSP is down?
Show answer and explanation
Correct answer: D. Implement the destination address for the LSP echo request packet in the 127.x.y.z/8 network.
Using destination addresses in the 127.x.y.z/8 (loopback) network for LSP echo request packets ensures packets are not forwarded beyond the service provider domain when the LSP is down. This loopback address range is non-routable externally, so if the LSP fails and packets are not label-switched, they will be discarded locally rather than forwarded into the external network.
Why the other options are wrong
- A. Configuring a private IP address on the headend router does not directly control OAM packet forwarding behavior when LSPs fail.
- B. Disabling IP redirects only on outbound interfaces does not prevent packets from being forwarded beyond the domain on LSP failure.
- C. Disabling IP redirects on ingress interfaces does not specifically address OAM packet forwarding constraints during LSP failure.
Question 89
An engineer working for a private service provider with employee Id: 1234:56:789 is configuring a Cisco device to redistribute OSPF into BGP. Which task enables the device to filter routes?
Show answer and explanation
Correct answer: B. Configure a route map and reference it with the redistribute command.
A route map is the standard mechanism in Cisco devices to filter routes during redistribution. Route maps provide granular control over which routes are redistributed and allow for route modification through match and set statements. Access lists, prefix lists, and distribute lists are not used directly with the redistribute command for this filtering purpose.
Why the other options are wrong
- A. Access lists cannot be referenced directly with the redistribute command for filtering.
- C. Prefix lists are associated with BGP peers for inbound/outbound filtering, not with redistribution.
- D. Distribute lists are used with routing protocols like OSPF and EIGRP, not with BGP redistribution.
Question 90
What are two characteristics of MPLS TE tunnels? (Choose two.)
Show answer and explanation
Correct answer: A, D. They are unidirectional; They use RSVP to provide bandwidth for the tunnel
MPLS TE tunnels are unidirectional, meaning a separate tunnel must be configured in the opposite direction to create bidirectional traffic flow. TE tunnels use RSVP (Resource Reservation Protocol) to reserve and provide bandwidth guarantees along the tunnel path, enabling traffic engineering capabilities. This allows operators to steer traffic along specific paths and reserve network resources end-to-end.
Why the other options are wrong
- B. The headend and tailend routers do not require a BGP relationship; MPLS TE tunnels operate at Layer 2 and are independent of BGP peering.
- C. MPLS TE tunnels are not limited to Ethernet cores; they function over any MPLS-capable infrastructure including Frame Relay, ATM, and other transport technologies.
- E. MPLS TE does not require EIGRP to operate; it works with any IGP including OSPF and IS-IS, and can function independently of dynamic IGP control.
Question 91
Which configuration mode do you use to apply the mpls ldp graceful-restart command in IOS XE Software?
Show answer and explanation
Correct answer: D. global
The mpls ldp graceful-restart command is applied in global configuration mode in IOS XE Software. This command enables graceful restart functionality for the entire LDP process on the router, allowing the router to maintain label bindings and continue forwarding during planned or unplanned restarts. Global mode is used for system-wide MPLS LDP settings, while neighbor, interface, or MPLS-specific modes would be used for more granular configurations.
Why the other options are wrong
- A. MPLS LDP neighbor configuration mode is used for neighbor-specific settings, not global graceful restart.
- B. Interface mode is used for per-interface MPLS configurations, not global LDP graceful restart.
- C. MPLS configuration mode is used for specific MPLS features but graceful restart is a global LDP command.
Question 92
What is the difference between SNMP and model-driven telemetry?
Show answer and explanation
Correct answer: C. Telemetry allows for modeled network data to be pushed to the network administrator on an as-needed basis.
Model-driven telemetry allows network data modeled with YANG to be pushed proactively to collectors on an as-needed basis (subscription-based, event-driven), rather than waiting for polls. This contrasts with SNMP's pull-based polling model. Telemetry delivers structured, modeled data continuously or on-demand, providing more efficient and timely data collection compared to SNMP's reactive polling approach.
Why the other options are wrong
- A. SNMP does not use YANG; it uses ASN.1 and MIB definitions, whereas telemetry uses YANG data models.
- B. This describes SNMP's trap/inform mechanism, not telemetry; these are SNMP's methods for asynchronous notification, but they still operate within SNMP's framework.
- D. SNMP operates on a pull model (the manager queries the agent); the agent does not push data when queried, the manager pulls it.
Question 93
A network engineer is configuring a newly installed PE router at the regional gateway location. The new PE router must use MPLS core routing protocols with the existing P router, and LDP sessions between the two routers must be protected to provide faster MPLS convergence. Which configuration must the engineer perform on the network so that LDP sessions are established?
Show answer and explanation
Correct answer: D. Enable LDP session protection on either one of the routers, which allows them to autonegotiate.
LDP session protection is configured on one router, and the feature automatically negotiates between the two routers to establish protected LDP sessions. This allows faster MPLS convergence by maintaining backup LDP sessions without requiring manual configuration on both routers.
Why the other options are wrong
- A. RSVP-TE FRR protects data plane traffic, not LDP session establishment.
- B. TCP port 646 is for targeted LDP, not for T-LDP hello message protection.
- C. LDP session protection does not require manually setting timers to the same value on each router.
Question 94
Which two tasks must you perform when you implement LDP NSF on your network? (Choose two.)
Show answer and explanation
Correct answer: A, E. Enable NSF for BGP; Enable NSF for the link-state routing protocol that is in use on the network.
LDP NSF (Nonstop Forwarding) requires two key configurations: enabling NSF for BGP to ensure BGP gracefully handles LDP peer restarts, and enabling NSF for the link-state routing protocol in use (OSPF or IS-IS) so that the control plane can recover while forwarding continues. These two steps ensure that the network maintains forwarding during LDP convergence events. Direct LDP peer connections are operational requirements not specific to NSF. CEF must remain enabled for NSF to function. EIGRP NSF is not required unless EIGRP is the link-state protocol in use.
Why the other options are wrong
- B. Direct connections for LDP peers are standard practice but not specific to NSF implementation.
- C. EIGRP NSF is only needed if EIGRP is the IGP; the question asks for generic LDP NSF tasks.
- D. Cisco Express Forwarding must be enabled for NSF to work, not disabled.
Question 95
Why do packet loops occur during the configuration of BIDIR-PIM?
Show answer and explanation
Correct answer: B. The network is partially upgraded to support BIDIR-PIM.
Packet loops occur during BIDIR-PIM configuration when the network is only partially upgraded to support it. Legacy routers running other PIM modes may interpret BIDIR-PIM traffic incorrectly, causing packets to loop between routers that understand BIDIR-PIM and those that do not.
Why the other options are wrong
- A. If the network does not support BIDIR-PIM at all, it would fail rather than cause loops.
- C. Router advertisement configuration affects RP discovery, not packet loop generation during BIDIR-PIM setup.
- D. Multicast group interfaces are not the root cause of packet loops during BIDIR-PIM configuration.
Question 96
What is a characteristic of prefix segment identifier?
Show answer and explanation
Correct answer: D. It is globally unique.
A prefix segment identifier (Prefix-SID) is globally unique and represents a prefix in an SR domain. It allows a node to be uniquely identified across the entire segment routing network, enabling consistent forwarding decisions regardless of where packets enter the SR domain.
Why the other options are wrong
- A. Interface addresses are specific to individual links and are not what a Prefix-SID represents.
- B. A Prefix-SID identifies a prefix/node, not a route to a neighbor.
- C. Prefix-SIDs are globally unique within the SR domain, not just locally unique.
Question 97
What is a constraint of Cisco MPLS TE tunnel configurations?
Show answer and explanation
Correct answer: B. Tunnels cannot be configured over IP unnumbered links.
Cisco MPLS TE tunnels cannot be configured over IP unnumbered links because MPLS TE requires explicit IP interface addresses for tunnel endpoints, link identification, and RSVP signaling. IP unnumbered interfaces lack unique IP addresses and are incompatible with the TE tunnel architecture.
Why the other options are wrong
- A. QoS-aware tunneling is supported in Cisco MPLS TE through bandwidth reservation and traffic engineering policies.
- C. IS-IS supports both wide and narrow metrics for MPLS TE, not limited to older-style metrics.
- D. MPLS TE tunnels can span multiple OSPF areas when configured appropriately with inter-area routing support.
Question 98
The administrator of a small company network notices that intermittent network issues occasionally cause inbound notifications to its SNMP servers to be lost. Which configuration must the administrator apply so that the SNMP servers acknowledge the notifications that they receive?
Show answer and explanation
Correct answer: B. snmp-server enable traps bgp snmp-server host 192.168.2.1 informs
SNMP informs (as opposed to traps) require acknowledgment from the receiving server, ensuring that notifications are not lost. The command 'snmp-server host 192.168.2.1 informs' configures the device to send SNMP informs with acknowledgment requirements to the specified server.
Why the other options are wrong
- A. This enables trap generation but does not guarantee server acknowledgment of received notifications.
- C. This configures a community string and host but does not specify informs for guaranteed delivery.
- D. This only defines the SNMP community string and does not configure server notification delivery.
Question 99
When configuring traffic engineering tunnels in Cisco MPLS core network, you see the traffic is not tacking the expected path in the core. Which command do you use to quickly check path of a TE tunnel?
Show answer and explanation
Correct answer: D. traceroute mpls ipv4
The command `traceroute mpls ipv4` is specifically designed to trace the path of MPLS Traffic Engineering tunnels by following the labeled path through the core network. This command provides hop-by-hop visibility of the actual path taken by a TE tunnel, allowing quick verification against the expected path configuration.
Why the other options are wrong
- A. The standard traceroute command operates at the IP layer and does not follow MPLS labels.
- B. The show mpls traffic-engineering tunnels command displays tunnel configuration and statistics but does not trace the actual path taken.
- C. Ping verifies basic connectivity but does not trace the path of a TE tunnel.
That was 99 of 515.
The full Cisco 350-501 SPCOR pack has all 515 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 229 free as one PDF by email. Get the Half Pack →