Cisco CCNP Service Provider SPCOR (350-501)

Question 1

A service provider automation team is choosing between Ansible and Terraform to manage the running configuration of hundreds of Cisco IOS XR routers. A key requirement is that re-running the same automation job repeatedly must not create duplicate or conflicting configuration if the device is already in the desired state. Which characteristic of Ansible directly satisfies this requirement?

Accepted Answer

Ansible modules are idempotent, applying changes only when the current state differs from the declared desired state

Answer

Ansible uses a persistent agent installed on each router to continuously reconcile drift

Answer

Ansible compiles a stateful graph of resource dependencies stored in a backend state file

Answer

Ansible requires a full device reload to guarantee configuration consistency after each run

Question 2

An SP engineer on an IOS XR ASBR must advertise a single summary prefix 203.0.113.0/22 to an eBGP peer instead of the four contributing /24 routes currently in the BGP table. However, the more-specific 203.0.113.0/24 must still be advertised to the same peer for a downstream customer failover requirement, while the other three /24s remain hidden. Which configuration approach achieves this?

Accepted Answer

Configure the aggregate with a suppress-map (or route-policy) that matches only the three /24s to be suppressed, allowing 203.0.113.0/24 to still be advertised alongside the summary.

Answer

Use 'aggregate-address 203.0.113.0/22 summary-only' — this automatically leaks the first contributing prefix while suppressing the rest.

Answer

Apply 'aggregate-address 203.0.113.0/22 as-set' so the aggregate and all four specifics are advertised with a merged AS_PATH.

Answer

Use an outbound route-policy with 'prefix-set' permitting 203.0.113.0/22 and 203.0.113.0/24 only, without any aggregate-address statement.

Question 3

An SP operator peers with a customer over EBGP. The customer wants certain prefixes learned by the SP's PE to be usable within the SP's IBGP mesh but never advertised to any of the SP's upstream or peer EBGP neighbors. The customer sets a BGP community on these prefixes. Which well-known community achieves exactly this behavior?

Accepted Answer

NO_EXPORT (0xFFFFFF01)

Answer

NO_ADVERTISE (0xFFFFFF02)

Answer

NO_EXPORT_SUBCONFED / LOCAL_AS (0xFFFFFF03)

Answer

INTERNET (0x00000000)

Question 4

A service provider running IOS XR has a large IBGP domain with over 200 routers. To reduce the full-mesh requirement without deploying route reflectors, the design team implements BGP confederations, dividing AS 65000 into sub-ASes 65001, 65002, and 65003. After configuration, an operator notices that when routes are advertised between the sub-ASes, the AS_PATH shows sub-AS numbers in parentheses but external neighbors in AS 100 never see these sub-AS numbers. When these routes reach the external EBGP peer, how does the confederation affect BGP path selection and loop prevention?

Accepted Answer

The confederation sub-AS numbers are stripped when advertised to the true EBGP peer, so the external AS only sees AS 65000; internally the AS_CONFED_SEQUENCE segment is used for loop prevention and does not count toward AS_PATH length in best-path comparison.

Answer

The sub-AS numbers are prepended to the AS_PATH and advertised to the external peer, increasing the AS_PATH length seen by AS 100 and making the route less preferred.

Answer

Confederation peers behave exactly like IBGP peers, so the local preference must be manually set on every inter-sub-AS boundary to prevent routing loops between sub-ASes.

Answer

The AS_CONFED_SEQUENCE is treated identically to a normal AS_SEQUENCE and is counted in AS_PATH length comparisons, so intra-confederation paths appear longer than they physically are.

Question 5

A service provider establishes an EBGP session between two routers, R1 (AS 65001) and R2 (AS 65002), that are directly connected via a single physical link. The engineer configures the peering using each router's loopback interface address as the neighbor and update source. Static routes to reach the remote loopbacks are in place, and the loopbacks are reachable via ping. However, the EBGP session remains stuck in Active/Idle. What must be configured to bring this session up?

Accepted Answer

Add 'ebgp-multihop 2' (or 'neighbor ... ttl-security') on both routers so the EBGP TTL check does not drop the packets sourced from the loopbacks

Answer

Change the peering to use the directly connected interface addresses instead, because EBGP cannot use loopback interfaces under any circumstance

Answer

Enable 'next-hop-self' on both neighbors so the loopback next hop is rewritten to the connected interface

Answer

Configure BFD on the link, since EBGP loopback peering requires BFD to establish adjacency

Question 6

A service provider runs a single AS with 12 IBGP-speaking PE routers configured in a full mesh. The network team plans to grow to 40 PEs and wants to reduce IBGP peering overhead without splitting the AS or introducing loops. A senior engineer proposes deploying two route reflectors in the core. When a route reflector receives an IBGP prefix from one of its clients, how will it advertise that prefix, and what loop-prevention attribute is used?

Accepted Answer

It reflects the client route to all other clients and to non-client IBGP peers, and uses the ORIGINATOR_ID and CLUSTER_LIST attributes for loop prevention.

Answer

It reflects the client route only to non-client IBGP peers, relying on the AS_PATH prepend to prevent loops among clients.

Answer

It forwards the route only to its EBGP peers after resetting the NEXT_HOP, using the AS_PATH to detect loops within the cluster.

Answer

It reflects the route to all clients but not to non-client peers, using the LOCAL_PREF attribute to break potential routing loops.

Question 7

An ISP running IOS XR peers with a customer over an EBGP IPv6 session. The operator wants all IPv6 prefixes received from this customer to be tagged with community 65001:100 so downstream route-policies can match them, while leaving all other attributes unchanged. Which routing policy configuration applied inbound on the neighbor achieves this?

Accepted Answer

route-policy TAG-CUST
  set community (65001:100) additive
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Answer

route-policy TAG-CUST
  set community (65001:100)
end-policy  — applied with 'route-policy TAG-CUST out'

Answer

route-policy TAG-CUST
  set local-preference 100
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Answer

route-policy TAG-CUST
  set extcommunity rt (65001:100) additive
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Question 8

A service provider is migrating a customer's eBGP peering from legacy AS 65010 to a new AS 65020 after a network merger. The customer's CPE is still configured to peer with AS 65010 and cannot be reconfigured during the maintenance window. On the PE router (now in AS 65020), which BGP feature allows the PE to present itself to the customer as if it still belongs to AS 65010, so the existing eBGP session comes up without customer-side changes?

Accepted Answer

Configure the neighbor with the local-as command specifying AS 65010

Answer

Configure allowas-in on the neighbor to accept the customer's routes

Answer

Apply an inbound route-map that sets the AS_PATH to 65010

Answer

Enable eBGP multihop with a TTL of 2 toward the customer CPE

Question 9

A service provider runs IBGP between PE1 and PE2 (both in AS 65100) over an internal /30 link. PE1 has an EBGP session to a customer router in AS 65200 over the subnet 203.0.113.0/30. After the customer advertises 198.51.100.0/24, PE2 receives the prefix in its BGP table but marks it as inaccessible, and the route never enters the RIB. The IGP on the provider core does not carry the 203.0.113.0/30 subnet. Which configuration on PE1 resolves the issue?

Accepted Answer

Configure 'neighbor <PE2> next-hop-self' on PE1 under the IBGP session

Answer

Configure 'neighbor <customer> next-hop-self' on PE1 under the EBGP session

Answer

Enable 'bgp default local-preference 200' on PE1 for the customer prefix

Answer

Configure 'neighbor <PE2> ebgp-multihop 2' on PE1 under the IBGP session

Question 10

An SP network engineer is troubleshooting outbound path selection on an IOS XR PE router. The router receives two eBGP advertisements for prefix 203.0.113.0/24. Both paths have equal weight (0), equal local preference (100), neither is locally originated, both are non-aggregate routes, and MED is not being compared because the paths come from different neighboring autonomous systems. Path 1 has an AS_PATH of '65010 65020 65030' and Path 2 has an AS_PATH of '65040 65030'. All other attributes up to this decision point are equal. Based on the BGP best-path algorithm, which path will the router select and why?

Accepted Answer

Path 2, because its AS_PATH is shorter (fewer AS hops), which is evaluated before origin code and MED.

Answer

Path 1, because it traverses more autonomous systems and is therefore considered more stable.

Answer

Path 2, because the highest-numbered originating AS (65040) is preferred as a tiebreaker.

Answer

Path 1, because BGP prefers the path whose first AS in the AS_PATH is numerically lower.

Question 11

An IBGP-enabled PE router in AS 65000 receives two paths to the same external prefix 203.0.113.0/24 from two different route reflectors. Both paths have identical weight, local preference, AS-path length, origin code, and MED. Both are learned via IBGP (neither is locally originated or EBGP). The BGP next-hop of path 1 (10.0.0.5) is reachable via an IGP metric of 30, while the BGP next-hop of path 2 (10.0.0.9) is reachable via an IGP metric of 20. Assuming 'bgp bestpath compare-routerid' is NOT configured and both paths are still valid, which path will BGP select as best and why?

Accepted Answer

Path 2, because it has the lowest IGP metric to the BGP next-hop

Answer

Path 1, because with equal attributes the oldest received path is preferred

Answer

Path 2, because it is compared using the lowest neighbor router ID first

Answer

Path 1, because IBGP paths always prefer the numerically lower next-hop address

Question 12

An SP operates AS 65000 and receives the same prefix 203.0.113.0/24 from a single neighboring AS 65100 over two separate EBGP sessions. Both received paths have identical weight, local preference, AS-path length, and origin type. The path via session A carries MED 50, and the path via session B carries MED 100. All other attributes up to MED are equal. Assuming default BGP behavior, which path does the router install as best, and why?

Accepted Answer

The path via session A (MED 50), because a lower MED is preferred and both paths originate from the same neighboring AS.

Answer

The path via session B (MED 100), because a higher MED indicates the neighbor's preferred entry point.

Answer

Neither MED value is compared, because MED is only evaluated between paths learned from different autonomous systems.

Answer

The path with the oldest EBGP session, because MED comparison is skipped entirely for EBGP-learned routes.

Question 13

An SP network engineer is troubleshooting inconsistent path selection for prefix 203.0.113.0/24 on an IOS-XR router. Two eBGP paths are received. Both paths have identical weight, local preference, AS_PATH length, and are not locally originated (no AS_PATH via aggregation). The MED values are also equal. Path 1 has an origin code of 'incomplete' (learned via redistribution), while Path 2 has an origin code of 'IGP' (learned via the network statement). Assuming all preceding BGP best-path attributes are tied, which path will the router select and why?

Accepted Answer

Path 2, because IGP origin (i) is preferred over incomplete origin (?) at the origin-code comparison step of the algorithm

Answer

Path 1, because incomplete origin indicates a directly redistributed route which is considered more reliable

Answer

Path 2, because the network statement assigns a higher weight automatically, breaking the tie earlier

Answer

Path 1, because origin code is not evaluated and the oldest eBGP path is preferred instead

Question 14

An ISP peers with two upstream providers, ISP-A and ISP-B, and receives the prefix 203.0.113.0/24 from both. On router R1 (IOS XR), the operator wants all traffic to this prefix to prefer ISP-A but needs the preference to remain local to R1 only, without influencing any other IBGP router in the AS. Both received routes are otherwise identical (same AS-path length, origin, and MED). Which attribute should the operator set inbound from ISP-A to accomplish this?

Accepted Answer

Set a higher Weight on routes received from ISP-A

Answer

Set a higher Local Preference on routes received from ISP-A

Answer

Set a lower MED on routes received from ISP-A

Answer

Prepend the AS-path on routes received from ISP-B

Question 15

A service provider is running out of public IPv4 addresses as its residential subscriber base grows. Management wants to continue offering IPv4 connectivity to subscribers while conserving the provider's dwindling public IPv4 pool, without requiring changes to customer premises equipment (CPE). Which service provider architecture element should the network architect deploy to meet this requirement?

Accepted Answer

Carrier-Grade NAT (CGN) performing NAT44 to share public IPv4 addresses among many subscribers

Answer

6PE to transport IPv6 subscriber traffic across the IPv4 MPLS core

Answer

Anycast RP to distribute multicast rendezvous points across the provider network

Answer

MPLS Traffic Engineering tunnels to steer subscriber traffic along explicit paths

Question 16

A service provider engineer notices that a PE router's route processor CPU spikes to 95% whenever a customer misconfigures a routing peer and floods the router with excessive BGP and ICMP traffic destined to the router itself. The engineer wants to protect the route processor by rate-limiting traffic punted to the control plane, while still permitting legitimate protocol sessions to establish. Which mechanism should be configured to achieve this?

Accepted Answer

Control Plane Policing (CoPP) using a policy-map applied to the control-plane interface

Answer

Unicast Reverse Path Forwarding (uRPF) in strict mode on all customer-facing interfaces

Answer

A data-plane ACL applied inbound on the customer-facing physical interface

Answer

Role-Based Access Control (RBAC) with command authorization on the management plane

Question 17

A service provider peers with an external BGP neighbor across a single-hop link. The security team is concerned about spoofed BGP packets originating from remote, multi-hop sources on the Internet that could be used to attack the router's control plane. They want a lightweight mechanism that validates the packets were sourced from a directly connected peer without relying on ACLs or cryptographic overhead. Which control plane protection mechanism should be configured on the eBGP session?

Accepted Answer

Enable BGP TTL Security (GTSM) with a hop count of 1 on the neighbor

Answer

Configure MD5 authentication (TCP-AO) on the BGP session

Answer

Apply a receive-path ACL (rACL) permitting only known BGP ports

Answer

Enable Control Plane Policing (CoPP) to rate-limit inbound BGP traffic

Question 18

A service provider is designing the QoS architecture for its MPLS core. The design team wants a scalable model where traffic is classified and marked once at the network edge, and each core router then applies forwarding treatment based solely on the marking in each packet, without maintaining per-flow state. Which QoS architecture model satisfies these requirements?

Accepted Answer

DiffServ using DSCP marking and per-hop behaviors (PHBs)

Answer

IntServ with RSVP signaling for each traffic flow

Answer

Best-effort forwarding with FIFO queuing on all interfaces

Answer

RSVP-TE bandwidth reservation on every core link per flow

Question 19

An ISP is deploying DS-Lite to allow residential subscribers with IPv6-only access networks to reach the legacy IPv4 Internet. The subscriber CPE receives only an IPv6 prefix from the access network. During design review, an engineer must explain how a subscriber's IPv4 traffic actually traverses the network to reach IPv4 destinations. Which statement correctly describes the DS-Lite data plane behavior?

Accepted Answer

The B4 element in the CPE encapsulates the subscriber's private IPv4 packets in IPv6 and tunnels them to the AFTR, which decapsulates and performs NAT44 to a public IPv4 address.

Answer

The CPE performs stateful NAT64 locally, translating IPv4 packets into IPv6 before forwarding them natively across the access network to an IPv4 server.

Answer

The AFTR assigns a unique public IPv4 address to each subscriber's B4 element via DHCPv4-over-IPv6, eliminating the need for address translation.

Answer

The B4 element translates IPv4 into IPv6 using stateless MAP-T rules, and the border relay reverses the translation without maintaining per-flow state.

Question 20

A service provider deploys EVPN with a dual-homed CE connected to two PE routers (PE1 and PE2) using the same Ethernet Segment Identifier (ESI) in all-active redundancy mode. Remote PE3 learns a customer MAC address via an EVPN Type 2 route advertised only by PE1. Operators observe that PE3 load-balances traffic toward the CE across both PE1 and PE2, even though only PE1 advertised the MAC. Which EVPN mechanism enables PE3 to forward toward PE2 for a MAC it never received from PE2?

Accepted Answer

The EVPN Type 1 (Ethernet Auto-Discovery per-ES/per-EVI) route combined with aliasing allows PE3 to install both PE1 and PE2 as valid next hops for MACs reachable via the shared ESI.

Answer

The EVPN Type 3 (Inclusive Multicast Ethernet Tag) route signals BUM replication, enabling PE3 to unicast the MAC to both PEs.

Answer

MAC mobility extended community on the Type 2 route instructs PE3 to duplicate the MAC entry toward both PE1 and PE2.

Answer

The Type 4 (Ethernet Segment) route performs designated forwarder election, which forces PE3 to hash flows across all PEs in the segment.

Question 21

A service provider deploys EVPN to offer a multi-tenant Ethernet service on their IOS XR PEs. The design team wants a single EVPN Instance (EVI) to carry multiple customer VLANs, where each VLAN maps to its own broadcast domain but all share the same EVI and route targets to conserve control-plane resources. Which EVPN service type must be configured to meet this requirement?

Accepted Answer

VLAN-aware bundle service, associating multiple bridge domains with a single EVI

Answer

VLAN-based service, mapping one VLAN to one EVI with a dedicated RD/RT per VLAN

Answer

Port-based service, mapping all frames on the attachment circuit to one EVI regardless of VLAN

Answer

VLAN-bundle service, mapping multiple VLANs to a single bridge domain within one EVI

Question 22

A network engineer is bringing a new IOS XR router into a streaming telemetry platform. Before subscribing to any paths, the engineer wants the collector to programmatically discover which YANG models, gNMI version, and data encodings (JSON, JSON_IETF, PROTO) the router supports so the collector can select a compatible encoding. Which gNMI RPC should the collector issue to obtain this information?

Accepted Answer

Capabilities

Answer

Subscribe with a SAMPLE subscription mode and inspect the returned notifications

Answer

Get with a path pointing to the openconfig-interfaces model

Answer

Set with an update operation targeting the telemetry configuration container

Question 23

A service provider is deploying model-driven telemetry from an IOS XR router to a centralized collector. The network team wants the collector to initiate a persistent gNMI session to the router, and the router should stream operational data continuously as counters change, rather than at fixed intervals. Which combination of gNMI transport model and subscription mode should be configured to meet this requirement?

Accepted Answer

Dial-in telemetry using a gNMI Subscribe RPC in ON_CHANGE mode

Answer

Dial-out telemetry using a gRPC Subscribe RPC in SAMPLE mode

Answer

Dial-out telemetry using a gNMI Subscribe RPC in STREAM SAMPLE mode

Answer

Dial-in telemetry using a gNMI Get RPC with a periodic polling loop

Question 24

A service provider is deploying model-driven telemetry from an IOS XR router to a collector. Security policy requires that both the router and the collector mutually authenticate each other using X.509 certificates before any telemetry data is streamed, and the router must initiate the connection to the collector. Which combination of gRPC/gNMI settings satisfies these requirements?

Accepted Answer

Configure a dial-out telemetry subscription over gRPC with TLS and mutual authentication (mTLS), installing a trustpoint on the router and requiring client certificate validation on the collector.

Answer

Configure a dial-in gNMI Subscribe session with TLS enabled, presenting only the server certificate on the router.

Answer

Configure a dial-out telemetry subscription over plain TCP and rely on an IPsec tunnel between the router and collector for authentication.

Answer

Configure a dial-in gRPC session with mTLS so the collector initiates the connection and both sides exchange certificates.

Question 25

A network engineer is configuring gNMI dial-out (target-initiated) telemetry on an IOS-XR router toward a collector that is reachable only across a fully trusted, isolated out-of-band management network. Management insists on the simplest possible transport configuration for a lab validation, so the engineer configures the gRPC session without any certificate trustpoint or TLS parameters. After committing, the router attempts to establish the session but the collector, which is listening for plaintext gRPC on port 57400, never receives a connection. What is the most likely reason the session fails to come up?

Accepted Answer

By default gRPC on IOS-XR enables TLS, so without explicitly disabling TLS (no-tls) the router presents a TLS handshake that the plaintext collector rejects

Answer

gNMI dial-out is only supported over UDP, so a TCP-listening collector on port 57400 can never accept the connection

Answer

gRPC requires mTLS in all deployments, so the missing client certificate causes the router to abort before sending any packets

Answer

The collector must initiate the connection in dial-out mode, so the router will never attempt to connect regardless of transport settings

Question 26

A network engineer configures a gNMI dial-in subscription over TLS between a Cisco IOS XR router and a telemetry collector. The router presents a server certificate whose Common Name and Subject Alternative Name contain only the router's loopback IP address (10.0.0.1), but the collector initiates the session using the router's DNS hostname (rtr1.example.com). SNMP and NETCONF over SSH work fine. The gNMI session fails during the TLS handshake with a certificate validation error on the collector. Which action resolves the failure while keeping TLS validation enabled?

Accepted Answer

Reissue the router's server certificate so that its SAN includes the DNS name rtr1.example.com used by the collector to connect

Answer

Switch the gNMI session from TLS to mTLS so the collector also presents a client certificate

Answer

Disable TLS on the gNMI server and rely on the underlying TCP session for transport security

Answer

Increase the gNMI sample-interval so the subscription negotiates before the TLS timer expires

Question 27

A service provider offers a business-grade Ethernet service to a customer whose CE connects at 1 Gbps physically, but the customer purchased only a 300 Mbps subscription tier. Within that 300 Mbps, voice traffic must receive strict low-latency treatment while remaining data classes share the leftover bandwidth proportionally. On the PE egress interface toward the customer, which QoS mechanism correctly enforces this design?

Accepted Answer

A hierarchical QoS policy where a parent policy shapes to 300 Mbps and a child policy provides priority for voice and bandwidth allocation for data classes

Answer

A single flat policy-map applying priority to voice and bandwidth to data classes, attached directly to the physical interface

Answer

A parent policing policy dropping all traffic above 300 Mbps with a child policy marking voice with EF

Answer

A per-class shaper on each traffic class summing to 300 Mbps, applied directly to the physical interface

Question 28

A service provider's PE router receives the same prefix 10.50.0.0/16 from two different route reflectors, each advertising a distinct next-hop. The network engineer wants the PE to install both paths into the RIB for load balancing. All BGP attributes for both paths are identical up to and including the IGP metric to the next-hop, but by default only one path is being used. Which configuration change enables the PE to install both IBGP paths?

Accepted Answer

Configure 'maximum-paths ibgp 2' under the BGP IPv4 address family

Answer

Configure 'bgp bestpath as-path multipath-relax' under the BGP process

Answer

Configure 'maximum-paths 2' under the BGP IPv4 address family

Answer

Configure 'bgp bestpath compare-routerid' under the BGP process

Question 29

A service provider runs IBGP with two route reflectors (RR1 and RR2) serving the same set of clients for redundancy. To avoid unnecessary route storage and ensure loop prevention within the redundant reflector design, both RRs are configured with the same cluster-id. A network engineer troubleshooting missing paths observes that when an RR receives a reflected route, it silently discards updates that contain its own cluster identifier. Which attribute is responsible for this loop-prevention behavior among route reflectors sharing a cluster-id?

Accepted Answer

The CLUSTER_LIST attribute, which the RR checks for its own CLUSTER_ID and discards the update if found

Answer

The ORIGINATOR_ID attribute, which lists every RR that reflected the route so duplicates are dropped

Answer

The AS_PATH attribute, which accumulates the cluster-id as if it were a private AS number

Answer

The ORIGIN attribute, which is set to incomplete when a route passes through a reflector cluster

Question 30

A service provider operates an IOS XR PE router that establishes a multihop eBGP session with a customer's router located two Layer 3 hops away. The security team wants to ensure that spoofed BGP packets originating from remote parts of the internet cannot reach and attack the BGP process on the PE, while still permitting the legitimate two-hop peer. Which control plane protection mechanism should be configured on the eBGP neighbor to meet this requirement most effectively?

Accepted Answer

Configure BGP TTL security (ttl-security) so the PE accepts packets only if their received TTL is within the expected hop count

Answer

Configure an inbound interface ACL permitting TCP port 179 from the peer's IP address

Answer

Enable BGP MD5 authentication on the neighbor to hash each BGP segment

Answer

Increase the ebgp-multihop value to 255 so distant packets are dropped by the routing engine

Question 31

A service provider operates IOS XR routers and must delegate operational access to a NOC team. The NOC engineers should be able to view interface counters, run show commands, and clear counters, but must NOT be able to modify routing protocol configuration or system settings. Following the management plane security model in IOS XR, what is the correct approach to enforce this least-privilege access?

Accepted Answer

Assign the NOC users to a custom user group associated with task groups that grant read and execute permissions on the relevant task IDs (e.g., interface, basic-services) but withhold write permission on protocol and system task IDs

Answer

Place the NOC users in the predefined root-lr group and rely on a commit confirmed policy to roll back any unauthorized configuration changes they make

Answer

Configure a single shared local username with privilege level 5 and distribute the credentials to all NOC engineers

Answer

Apply an ingress ACL on the management VTY lines that permits show and clear commands while denying configure terminal

Question 32

A service provider is standardizing on Cisco IOS XR routers and wants to host a lightweight third-party monitoring agent and custom Python telemetry scripts directly on the router without impacting the core routing processes. The network architect needs the hosted application to run in an isolated environment with its own file system and libraries, while sharing the router's Linux kernel for efficiency. Which IOS XR software architecture capability should the architect leverage to meet this requirement?

Accepted Answer

Application hosting using Linux containers (LXC/Docker) within the IOS XR 64-bit Linux-based operating system

Answer

Deploying the agent as a standalone hypervisor-based VM on the route processor using KVM full virtualization

Answer

Installing the agent as a native IOS XR process via a Software Maintenance Upgrade (SMU) package

Answer

Running the agent inside the control plane using the Cisco Discovery Protocol process namespace

Question 33

A service provider is designing its IOS XR software architecture on a distributed platform. The network operations team wants to understand how a routing protocol process (such as BGP) obtains forwarding-related state and interacts with the underlying line card hardware without being written for a specific ASIC. Which component of the IOS XR software architecture provides this abstraction so that upper-layer processes remain independent of the specific forwarding hardware?

Accepted Answer

The Forwarding Information Base (FIB) combined with a hardware abstraction layer that programs platform-specific ASICs

Answer

The System Database (SysDB) acting as the sole packet-forwarding engine

Answer

The VTY line process handling all inter-process communication

Answer

The BGP Speaker process directly writing microcode into each ASIC

Question 34

A service provider is deploying a QoS policy on an IOS XR aggregation router carrying both voice (VoIP) and best-effort internet traffic. The design team wants to guarantee that VoIP experiences minimal latency and jitter even during periods of congestion, while ensuring the voice queue cannot completely starve other traffic classes indefinitely. Which QoS architectural mechanism best meets these requirements?

Accepted Answer

Apply a low-latency queue (priority level 1) to the VoIP class combined with a policer to cap the priority traffic rate

Answer

Assign the VoIP class a class-based weighted fair queue (CBWFQ) with a high bandwidth percent value

Answer

Configure WRED on the VoIP class to drop packets before the queue fills

Answer

Use a shaper on the best-effort class so the VoIP class always receives the remaining bandwidth

Question 35

A service provider runs Cisco IOS XR on its core routers. During a maintenance window, an engineer must patch the BGP process to fix a defect. Management insists that the router must NOT reload and that OSPF, LDP, and interface forwarding must remain unaffected while BGP is updated. Which characteristic of the IOS XR software architecture makes this possible?

Accepted Answer

IOS XR uses a modular microkernel design where each process runs in a protected memory space, allowing an individual process to be restarted or patched independently

Answer

IOS XR runs all routing protocols as a single monolithic image, so patching requires an in-service software upgrade of the entire control plane

Answer

IOS XR relies on a shared memory pool for all processes so that restarting one process automatically refreshes all others

Answer

IOS XR requires that the standby route processor take over before any protocol process can be modified, forcing an RP switchover

Question 36

Two IOS-XR routers, PE1 and PE2, are directly connected over a point-to-point link and configured for IS-IS Level-2. The adjacency repeatedly cycles between INIT and DOWN, never reaching UP. Logs on PE1 show IIH packets received from PE2, but PE2 never sees PE1's hellos acknowledged. PE1's interface MTU is 1500; PE2's interface MTU was recently changed to 1400 during a maintenance window. What is the most likely cause of the failure?

Accepted Answer

IS-IS pads its hello PDUs to the full interface MTU by default, so the 1500-byte padded hellos from PE1 are dropped by PE2's smaller 1400-byte MTU, preventing the adjacency from forming.

Answer

The two routers have mismatched IS-IS system IDs, which prevents the three-way handshake from completing on the point-to-point link.

Answer

One router is configured for narrow metrics and the other for wide metrics, causing the hellos to be silently discarded.

Answer

The area addresses differ between PE1 and PE2, which is required to match for Level-2 adjacencies to form.

Question 37

A service provider runs a two-level IS-IS domain. Branch routers in a Level 1 area only receive a default route toward the nearest L1/L2 router via the ATT bit, which causes suboptimal exit selection when a specific prefix in another area is actually best reached through a different L1/L2 router. The network engineer wants the L1 routers to make optimal forwarding decisions for a set of important L2 prefixes without converting the entire area to Level 1-2. Which action achieves this?

Accepted Answer

Configure route leaking on the L1/L2 routers to redistribute selected L2 prefixes into Level 1 with the up/down bit set

Answer

Set the overload bit on the L1/L2 routers so L1 routers prefer the closest exit only

Answer

Widen the IS-IS metric style to narrow on the L1 routers so they accept external routes

Answer

Disable the ATT bit on all L1/L2 routers to force full topology flooding into Level 1

Question 38

You are migrating a large IS-IS backbone from narrow metrics to wide metrics on IOS XR routers. To avoid routing loops and suboptimal paths during the transition, you configure the routers to advertise and accept both TLV formats simultaneously before completing the migration. Which metric-style configuration should you apply during this transition window?

Accepted Answer

metric-style transition, which sends and accepts both old-style and new-style TLVs

Answer

metric-style narrow, which sends and accepts only the legacy 6-bit metric TLVs

Answer

metric-style wide, which immediately sends and accepts only the 32-bit extended metric TLVs

Answer

metric-style wide-only combined with the ignore-attached-bit command to suppress old TLVs

Question 39

A service provider runs IS-IS on all IOS XR core routers for both IPv4 and IPv6. Historically the network used a single topology (default) for both address families. An engineer enables 'address-family ipv6 unicast' under a new router's IS-IS process and configures 'multi-topology' on that router only. After the change, IPv6 routes learned via IS-IS from that new router are missing on adjacent routers, although IPv4 routing and the IS-IS adjacency itself remain fully up. What is the most likely cause?

Accepted Answer

The adjacent routers use single-topology (single SPF) IS-IS, so they advertise IPv6 reachability using the standard IPv4 TLVs, and the multi-topology router only processes MT TLVs — the topology mode mismatch prevents IPv6 prefix exchange.

Answer

Enabling multi-topology automatically disables the IPv4 address family, so the adjacency is only exchanging IPv6 in a separate topology that the neighbors cannot see.

Answer

IS-IS cannot carry IPv6 prefixes unless wide metrics (metric-style wide) are disabled globally on all routers in the area.

Answer

The new router formed an adjacency in a different IS-IS level, so IPv6 prefixes are being leaked incorrectly between Level-1 and Level-2.

Question 40

You are an SP engineer running IS-IS with the default narrow metric-style on a core router. You attempt to configure an interface with 'isis metric 100' on Level-2, but you also need to raise several other links to values that reflect a new 10G-versus-1G design. The design team asks you to set one uplink to a metric of 200, but the router rejects the command. Assuming metric-style has NOT been changed, what is the maximum interface metric value IS-IS will accept, and why?

Accepted Answer

63, because narrow metrics use a 6-bit field limiting the per-interface metric to a maximum of 63

Answer

255, because narrow metrics use an 8-bit field limiting the per-interface metric to a maximum of 255

Answer

1023, because narrow metrics use a 10-bit field for interface metrics

Answer

16777215, because IS-IS interface metrics always use the wide 24-bit field

Question 41

A service provider is inserting a new IS-IS router into a Level-2 backbone. During the boot process, BGP takes about 90 seconds to fully converge and install all VPNv4 routes. Operations reports that immediately after the router's IS-IS adjacencies come up, transit traffic is black-holed for over a minute because packets are forwarded through the new node before its BGP table is complete. Which IS-IS configuration should be applied to prevent the router from being used as a transit path until BGP has converged?

Accepted Answer

Configure the overload bit with the set-overload-bit on-startup wait-for-bgp option

Answer

Increase the IS-IS hello and hold timers so adjacencies form more slowly

Answer

Configure a maximum interface metric of 16777214 permanently on all links

Answer

Enable IS-IS mesh-group blocking on all backbone interfaces

Question 42

A service provider offers an EVPL service to a customer using an IOS XR PE router. The customer sends frames tagged with an outer VLAN 100 and inner VLAN 200 (QinQ). The PE must match these double-tagged frames on the access interface, remove the outer service-delimiting VLAN 100 before forwarding across the VPWS pseudowire, and re-impose VLAN 100 toward the customer on egress. Which Ethernet flow point (EFP) configuration on the ingress attachment circuit achieves this behavior?

Accepted Answer

encapsulation dot1q 100 second-dot1q 200 with rewrite ingress tag pop 1 symmetric

Answer

encapsulation dot1q 100 with rewrite ingress tag pop 2 symmetric

Answer

encapsulation dot1q 100 second-dot1q 200 with rewrite ingress tag push dot1q 100 symmetric

Answer

encapsulation default with rewrite ingress tag translate 1-to-1 dot1q 200 symmetric

Question 43

A service provider runs an EVPN-based L2VPN across its IOS XR core. A dual-homed customer VM is migrated from a server behind PE1 to a server behind PE2. After the move, PE1 continues to advertise the VM's MAC as a local route while PE2 also advertises the same MAC, causing intermittent Layer 2 reachability and MAC flapping between the two PEs. Which EVPN mechanism resolves this by determining which PE currently owns the MAC?

Accepted Answer

The MAC Mobility extended community carrying an incrementing sequence number in the Type 2 MAC/IP advertisement route

Answer

The Ethernet Segment Identifier (ESI) label exchanged in the Type 4 Ethernet Segment route

Answer

The split-horizon group applied to the pseudowire to suppress duplicate flooding

Answer

The designated forwarder election performed via the Type 3 Inclusive Multicast Ethernet Tag route

Question 44

A service provider deploys an EVPN-VPWS service on IOS XR to connect two customer sites across the MPLS core. The customer's CE at Site A is dual-homed to two PEs (PE1 and PE2) using a single LACP bundle (Ethernet Segment). The requirement is that only one PE forwards traffic for the pseudowire at any time, while the other remains as a hot standby that takes over instantly on failure. Which EVPN Ethernet Segment redundancy mode must be configured to meet this requirement?

Accepted Answer

Single-active mode, where DF election designates one PE per Ethernet Segment to forward traffic

Answer

All-active mode, so both PEs forward and load-balance flows across the Ethernet Segment

Answer

Port-active mode with both PEs advertising the same MAC and flooding unknown unicast

Answer

Static pseudowire redundancy using manual primary/backup neighbor priority values

Question 45

A service provider offers a multipoint VPLS service to a customer connecting five sites. Recently, one customer site experienced a Layer 2 loop caused by a misconfigured switch, and the resulting MAC learning storm exhausted the PE router's MAC address table for that bridge domain, degrading service for all five sites. The provider wants to limit the impact of a single misbehaving site so that only that site's forwarding is affected while the bridge domain remains stable. Which configuration should the engineer apply on the PE?

Accepted Answer

Configure a per-attachment-circuit MAC address limit with an action to shut down or restrict learning on the offending bridge-domain member

Answer

Enable split-horizon forwarding on all pseudowires in the VPLS full mesh

Answer

Configure MAC withdrawal (LDP MAC address withdraw) on the VFI to flush stale entries

Answer

Increase the MAC aging timer on the bridge domain to retain more entries

Question 46

A service provider runs a VPLS instance across three PE routers (PE1, PE2, PE3) in a full mesh of pseudowires. A dual-homed customer site connects to PE1 (active) and PE2 (standby) using MST for loop prevention. When the active uplink to PE1 fails and traffic shifts to PE2, remote PE3 continues black-holing customer traffic for the affected MAC addresses until they naturally age out. Which mechanism should be enabled to force PE3 to immediately relearn the MAC addresses on the correct pseudowire?

Accepted Answer

MAC address withdrawal via LDP Address Withdraw message

Answer

MAC address aging timer reduced to zero on all PEs

Answer

Split-horizon forwarding on the VPLS full mesh

Answer

Control word insertion on all VPLS pseudowires

Question 47

A service provider deploys a VPLS instance across four PE routers using an LDP-signaled full mesh of pseudowires. During testing, an engineer observes that a broadcast frame injected at PE1 is correctly received by CE devices attached to PE2, PE3, and PE4 exactly once, with no duplicate frames or forwarding loops — even though no spanning tree protocol is running in the provider core. Which VPLS mechanism explains this loop-free behavior across the pseudowire mesh?

Accepted Answer

Split-horizon forwarding on the VSI prevents frames received on one pseudowire from being forwarded to another pseudowire

Answer

MAC address withdrawal messages flush stale entries after each broadcast

Answer

The control word inserted in each pseudowire enforces frame ordering and drops loops

Answer

BGP auto-discovery prunes redundant pseudowires from the full mesh

Question 48

You are deploying an EoMPLS point-to-point pseudowire (VPWS) between two IOS XR PE routers across a core that performs equal-cost load balancing based on a deep packet hash. Customers report intermittent packet reordering and dropped frames on the emulated Ethernet circuit, though the pseudowire is up on both ends. What should you configure on the pseudowire to resolve this issue?

Accepted Answer

Enable the control word on the pseudowire at both PEs

Answer

Change the pseudowire encapsulation type from Ethernet to VLAN mode

Answer

Increase the MTU on the attachment circuits to accommodate the label stack

Answer

Configure a static pseudowire label instead of using LDP signaling

Question 49

A service provider engineer configures a point-to-point EoMPLS (VPWS) pseudowire between two IOS XR PE routers using the l2vpn xconnect group. The attachment circuits are up on both PEs and the targeted LDP session is established, but the pseudowire remains in the DOWN state. On PE1 the interface MTU under the attachment circuit is set to 1500, while on PE2 the corresponding attachment circuit interface MTU is set to 1600. What is the most likely reason the pseudowire fails to come up?

Accepted Answer

The interface MTU values signaled in the LDP label mapping messages do not match, so the pseudowire negotiation fails

Answer

The control word setting is enabled on PE1 but disabled on PE2, causing a signaling mismatch

Answer

The pseudowire IDs (VC IDs) are different on the two PEs, so the label bindings cannot be paired

Answer

The route distinguishers configured under the xconnect group differ between the two PEs

Question 50

A service provider offers a shared central-services VRF (hosting DNS and NTP servers) that all customer VRFs must reach, but individual customers must NOT be able to reach each other through the central-services VRF. Customer VRFs use RT 65000:100 (customer A) and 65000:200 (customer B). The central-services VRF uses RT 65000:999. Which route-target configuration on the central-services PE VRF achieves the required any-to-central but not customer-to-customer reachability?

Accepted Answer

Central-services VRF imports 65000:100 and 65000:200 and exports 65000:999; each customer VRF imports 65000:999 and exports its own customer RT

Answer

Central-services VRF imports and exports 65000:999 only; each customer VRF imports and exports 65000:999

Answer

Central-services VRF exports 65000:100 and 65000:200 and imports 65000:999; each customer VRF exports 65000:999 and imports its own customer RT

Answer

All VRFs import and export 65000:100, 65000:200, and 65000:999 to guarantee full reachability

Question 51

A service provider runs an MPLS L3VPN. A PE router imports routes into VRF CUSTOMER-A using route-target import 65000:100. The network team notices that a specific set of customer prefixes tagged with an additional extended community must be prevented from entering the VRF even though they carry RT 65000:100. Which mechanism should be applied on the PE to selectively block those prefixes while continuing to import all other 65000:100 routes?

Accepted Answer

Apply an import route-map (import map) referencing an extended community list under the VRF to filter the unwanted prefixes

Answer

Remove route-target import 65000:100 and add a separate RD to the VRF

Answer

Configure an outbound BGP route-map on the remote PE to set a lower local preference

Answer

Enable per-VRF label allocation mode to isolate the prefixes at the data plane

Question 52

Two service providers operate separate MPLS L3VPN backbones and must interconnect a customer VPN across their ASBRs. The design team chooses Inter-AS Option B (VPNv4 exchange between ASBRs). On the ASBR of AS 100, VPNv4 routes are being received from the peer ASBR in AS 200, but the customer PE devices in AS 100 cannot forward traffic toward the remote prefixes even though the VPNv4 routes appear in BGP. What must be verified on the AS 100 ASBR for Option B to forward customer traffic correctly?

Accepted Answer

That the ASBR rewrites the BGP next hop to itself and allocates a new local MPLS label for each VPNv4 prefix, so a valid label swap exists across the AS boundary

Answer

That the full customer VRF is configured on the ASBR with matching route targets so the routes are imported into a local routing table

Answer

That an LDP session is established directly between the two ASBRs to distribute transport labels across the inter-AS link

Answer

That the ASBR redistributes the received VPNv4 routes into the IGP so the local PEs can learn the remote prefixes

Question 53

A service provider runs MP-BGP for its L3VPN backbone. Two PE routers (PE1 and PE2) both have VRF CUSTOMER-A configured with matching route-targets, but CUSTOMER-A routes learned on PE1 are not appearing in the VRF routing table on PE2. On PE2, the command 'show bgp vpnv4 unicast all' shows the VPNv4 prefixes from PE1 are present in the BGP table but are not imported into the VRF. What is the MOST likely cause?

Accepted Answer

The import route-target configured under the VRF on PE2 does not match the export route-target set by PE1, so the prefixes remain in the BGP table but are not installed in the VRF.

Answer

The route distinguisher on PE1 and PE2 differs, preventing the VPNv4 prefixes from being advertised between PEs.

Answer

MP-BGP is not carrying the VPNv4 address family, so the prefixes cannot be exchanged at all.

Answer

The PE-CE routing protocol on PE2 has not been redistributed into BGP, so the VRF has no routes.

Question 54

A service provider uses AS 65500 for its MPLS L3VPN backbone. A customer owns two sites that both use the same private AS 65001 for their PE-CE eBGP sessions. Users at Site 1 report they cannot reach any prefixes advertised from Site 2, even though both CE-PE sessions are up and the VPNv4 routes are present on the PEs. What should the provider configure on the PE routers to resolve this?

Accepted Answer

Enable 'as-override' on the PE-CE BGP neighbor configuration under the VRF address family

Answer

Configure 'allowas-in' on the PE-CE BGP neighbor toward the customer CE

Answer

Set the route target import/export values to match on both PE VRFs

Answer

Apply 'neighbor next-hop-self' on the PE toward the CE routers

Question 55

A service provider runs an MPLS L3VPN for a customer that uses OSPF as the PE-CE routing protocol at two sites, Site A and Site B. Both sites also have a direct backdoor OSPF link between them within the same OSPF area. The customer complains that traffic between the two sites always takes the low-speed backdoor link instead of the high-speed MPLS backbone. The PEs redistribute customer routes into MP-BGP and back into OSPF as type-3 inter-area routes. What must the SP engineer configure to make the MPLS backbone the preferred path?

Accepted Answer

An OSPF sham-link between the two PE routers within the customer VRF

Answer

A matching OSPF domain-id on both PE routers so routes are advertised as intra-area

Answer

Increase the OSPF cost on the backdoor link at both CE routers to a higher value than the backbone

Answer

Configure the backdoor link as an OSPF virtual link terminating on the PE routers

Question 56

A service provider runs MPLS L3VPN with OSPF as the PE-CE routing protocol for customer ACME. Routes learned from a remote CE via MP-BGP are redistributed back into OSPF on the local PE toward the CE. The customer complains that these VPN routes appear on their CE routers as OSPF external Type 5 (E2) LSAs, but they require the routes to be seen as inter-area (Type 3) summary LSAs so that internal SPF metric behavior is preserved end-to-end. Both customer sites use the same OSPF process and are in different, non-zero areas connected through the MPLS backbone. What must be configured on the PEs to achieve this?

Accepted Answer

Configure a matching OSPF domain-id on both PEs so the MPLS VPN backbone is treated as an OSPF super-backbone and routes are advertised as inter-area Type 3 LSAs

Answer

Configure an OSPF sham-link between the two PEs to force the routes into Type 1 router LSAs across the backbone

Answer

Set the redistribution metric-type to 1 on both PEs so the routes become E1 LSAs that carry cumulative internal cost

Answer

Enable capability vrf-lite on both PE OSPF processes to suppress the down-bit and export routes as intra-area Type 1 LSAs

Question 57

A service provider runs an MPLS L3VPN for a customer that uses RIPv2 as the PE-CE routing protocol on both sites. On PE1, the VRF 'CUST-A' learns customer routes from the CE via RIPv2 and redistributes them into MP-BGP. At the remote PE2, these routes are received via VPNv4 and must be redistributed back into RIPv2 toward the remote CE. After configuration, PE2 advertises the routes to its CE but the remote CE marks them as unreachable. Which action on PE2 resolves the problem?

Accepted Answer

Set a valid seed metric under the 'redistribute bgp' statement in the RIP address-family for the VRF

Answer

Enable 'no auto-summary' under the RIP process for the VRF address-family

Answer

Configure a matching RIP authentication key-chain on the PE2-CE link

Answer

Increase the RIP 'timers basic' hold-down value on PE2

Question 58

A service provider runs an MPLS L3VPN where the VRF 'CUST-A' on a PE imports route-target 65000:100. The customer now wants this PE to import only the specific prefix 10.50.0.0/16 that carries route-target 65000:100, while all other prefixes tagged with that same RT must be excluded from the VRF. Which configuration approach accomplishes this requirement?

Accepted Answer

Attach an import map (route-map matching a prefix-list for 10.50.0.0/16) to the VRF that already imports route-target 65000:100

Answer

Change the VRF to import a different route-target and ask the remote PE to re-tag only 10.50.0.0/16

Answer

Apply an outbound distribute-list on the BGP VPNv4 session to block all prefixes except 10.50.0.0/16

Answer

Configure a static route for 10.50.0.0/16 in the VRF and remove the route-target import statement entirely

Question 59

A service provider runs Cisco IOS XR on its aggregation routers. The security team wants to protect the router from being overwhelmed by high rates of exception and for-us packets (such as ARP, ICMP, and routing protocol traffic) punted to the CPU, without manually configuring a policy for every protocol. Which built-in IOS XR mechanism automatically polices these locally destined packet flows in hardware to protect the control and management planes?

Accepted Answer

Local Packet Transport Services (LPTS)

Answer

Modular QoS CLI (MQC) service-policy applied inbound on each interface

Answer

Unicast Reverse Path Forwarding (uRPF) in strict mode

Answer

Management Plane Protection (MPP) with device-management protocols

Question 60

A service provider security engineer must harden the management plane of a Cisco IOS XE PE router. The requirement is to ensure that in-band management protocols such as SSH and SNMP can only be received on a single designated loopback-facing interface (GigabitEthernet0/0/3), while all other data-carrying interfaces silently reject management traffic destined to the router itself. Which feature directly satisfies this requirement?

Accepted Answer

Management Plane Protection (MPP) to designate specific management interfaces

Answer

Control Plane Policing (CoPP) with a rate-limit policy for SSH and SNMP

Answer

An infrastructure ACL applied inbound on every WAN-facing interface

Answer

Unicast Reverse Path Forwarding in strict mode on the management interface

Question 61

A service provider is migrating its residential access network to an IPv6-only core while still delivering IPv4 connectivity to subscribers. The design team requires a solution that is fully stateless in the provider network (no per-flow session tables on the border relay), embeds the IPv4 address and port-set information directly inside the IPv6 packet using an algorithmic mapping, and allows the border relay to translate rather than encapsulate at the IPv4/IPv6 boundary. Which IPv6 transition technology meets ALL of these requirements?

Accepted Answer

MAP-T with a Border Relay performing stateless translation

Answer

DS-Lite using a B4 element and a stateful AFTR

Answer

Stateful NAT64 with DNS64 at the provider edge

Answer

MAP-E with a Border Relay performing encapsulation

Question 62

A service provider runs OSPF with LDP for label distribution across the core. After a link flap on a P router, operators notice that transit traffic is temporarily black-holed: the OSPF adjacency comes up and the IGP starts forwarding over the restored link before LDP has re-established its session and exchanged labels, causing unlabeled packets to be dropped on the LSP. Which feature should be configured on the affected interface to prevent this behavior?

Accepted Answer

MPLS LDP-IGP synchronization, so the IGP advertises the link with maximum metric until the LDP session and label bindings are established

Answer

LDP session protection, so the targeted hello session survives the interface flap over an alternate path

Answer

LDP graceful restart, so the router retains forwarding state while the neighbor's control plane recovers

Answer

OSPF BFD, so the adjacency fails faster and reroutes traffic away from the recovering link

Question 63

A service provider runs LDP across its core using default Cisco IOS behavior. A network engineer notices that during an IGP convergence event, some LSRs begin advertising a label mapping for a FEC to their upstream neighbors before the downstream label mapping for that same FEC has been received. This creates a brief window where an LSR advertises a label but has no valid downstream label to swap to. Which LDP label distribution control mode explains this behavior, and what is its key characteristic?

Accepted Answer

Independent label distribution control — each LSR advertises label mappings for a FEC independently, without waiting to receive a label from the downstream next hop.

Answer

Ordered label distribution control — an LSR advertises a label mapping only after it has received a label mapping from the downstream next hop (or is the egress) for that FEC.

Answer

Downstream-on-demand label advertisement — an LSR advertises labels only when explicitly requested by an upstream peer.

Answer

Conservative label retention — an LSR retains only the label mapping received from its current next-hop neighbor and discards all others.

Question 64

A service provider runs LDP across all core and edge routers. The network team wants to reduce the number of labels advertised in the core so that only loopback (/32) host routes used as BGP next-hops receive labels, while all other IGP prefixes are not assigned local labels. Which LDP feature should be configured to achieve this goal?

Accepted Answer

An LDP label advertisement (allocation) filter using an access list that permits only the /32 loopback prefixes

Answer

LDP session protection to preserve labels during link flaps

Answer

LDP-IGP synchronization to align label distribution with the IGP

Answer

LDP autoconfiguration to enable LDP on all IGP-enabled interfaces

Exam domain	Exam weight	Practice
Architecture	15%	Practice this topic
Networking	30%	Practice this topic
MPLS and Segment Routing	20%	Practice this topic
Services	20%	Practice this topic
Automation and Assurance	15%	Practice this topic

Cisco CCNP Service Provider SPCOR (350-501) (350-501) practice exam & study guide

Start studying 350-501

All 350-501 study resources

350-501 exam domains

Sample 350-501 questions

Key 350-501 terms

350-501 frequently asked questions

Architecture (15%)

Networking (30%)

MPLS and Segment Routing (20%)

Services (20%)

Automation and Assurance (15%)