Hard — 350-501 Practice Quiz

Question 1

An SP engineer on an IOS XR ASBR must advertise a single summary prefix 203.0.113.0/22 to an eBGP peer instead of the four contributing /24 routes currently in the BGP table. However, the more-specific 203.0.113.0/24 must still be advertised to the same peer for a downstream customer failover requirement, while the other three /24s remain hidden. Which configuration approach achieves this?

Accepted Answer

Configure the aggregate with a suppress-map (or route-policy) that matches only the three /24s to be suppressed, allowing 203.0.113.0/24 to still be advertised alongside the summary.

Answer

Use 'aggregate-address 203.0.113.0/22 summary-only' — this automatically leaks the first contributing prefix while suppressing the rest.

Answer

Apply 'aggregate-address 203.0.113.0/22 as-set' so the aggregate and all four specifics are advertised with a merged AS_PATH.

Answer

Use an outbound route-policy with 'prefix-set' permitting 203.0.113.0/22 and 203.0.113.0/24 only, without any aggregate-address statement.

Question 2

A service provider running IOS XR has a large IBGP domain with over 200 routers. To reduce the full-mesh requirement without deploying route reflectors, the design team implements BGP confederations, dividing AS 65000 into sub-ASes 65001, 65002, and 65003. After configuration, an operator notices that when routes are advertised between the sub-ASes, the AS_PATH shows sub-AS numbers in parentheses but external neighbors in AS 100 never see these sub-AS numbers. When these routes reach the external EBGP peer, how does the confederation affect BGP path selection and loop prevention?

Accepted Answer

The confederation sub-AS numbers are stripped when advertised to the true EBGP peer, so the external AS only sees AS 65000; internally the AS_CONFED_SEQUENCE segment is used for loop prevention and does not count toward AS_PATH length in best-path comparison.

Answer

The sub-AS numbers are prepended to the AS_PATH and advertised to the external peer, increasing the AS_PATH length seen by AS 100 and making the route less preferred.

Answer

Confederation peers behave exactly like IBGP peers, so the local preference must be manually set on every inter-sub-AS boundary to prevent routing loops between sub-ASes.

Answer

The AS_CONFED_SEQUENCE is treated identically to a normal AS_SEQUENCE and is counted in AS_PATH length comparisons, so intra-confederation paths appear longer than they physically are.

Question 3

An IBGP-enabled PE router in AS 65000 receives two paths to the same external prefix 203.0.113.0/24 from two different route reflectors. Both paths have identical weight, local preference, AS-path length, origin code, and MED. Both are learned via IBGP (neither is locally originated or EBGP). The BGP next-hop of path 1 (10.0.0.5) is reachable via an IGP metric of 30, while the BGP next-hop of path 2 (10.0.0.9) is reachable via an IGP metric of 20. Assuming 'bgp bestpath compare-routerid' is NOT configured and both paths are still valid, which path will BGP select as best and why?

Accepted Answer

Path 2, because it has the lowest IGP metric to the BGP next-hop

Answer

Path 1, because with equal attributes the oldest received path is preferred

Answer

Path 2, because it is compared using the lowest neighbor router ID first

Answer

Path 1, because IBGP paths always prefer the numerically lower next-hop address

Question 4

A service provider deploys EVPN with a dual-homed CE connected to two PE routers (PE1 and PE2) using the same Ethernet Segment Identifier (ESI) in all-active redundancy mode. Remote PE3 learns a customer MAC address via an EVPN Type 2 route advertised only by PE1. Operators observe that PE3 load-balances traffic toward the CE across both PE1 and PE2, even though only PE1 advertised the MAC. Which EVPN mechanism enables PE3 to forward toward PE2 for a MAC it never received from PE2?

Accepted Answer

The EVPN Type 1 (Ethernet Auto-Discovery per-ES/per-EVI) route combined with aliasing allows PE3 to install both PE1 and PE2 as valid next hops for MACs reachable via the shared ESI.

Answer

The EVPN Type 3 (Inclusive Multicast Ethernet Tag) route signals BUM replication, enabling PE3 to unicast the MAC to both PEs.

Answer

MAC mobility extended community on the Type 2 route instructs PE3 to duplicate the MAC entry toward both PE1 and PE2.

Answer

The Type 4 (Ethernet Segment) route performs designated forwarder election, which forces PE3 to hash flows across all PEs in the segment.

Question 5

A service provider deploys EVPN to offer a multi-tenant Ethernet service on their IOS XR PEs. The design team wants a single EVPN Instance (EVI) to carry multiple customer VLANs, where each VLAN maps to its own broadcast domain but all share the same EVI and route targets to conserve control-plane resources. Which EVPN service type must be configured to meet this requirement?

Accepted Answer

VLAN-aware bundle service, associating multiple bridge domains with a single EVI

Answer

VLAN-based service, mapping one VLAN to one EVI with a dedicated RD/RT per VLAN

Answer

Port-based service, mapping all frames on the attachment circuit to one EVI regardless of VLAN

Answer

VLAN-bundle service, mapping multiple VLANs to a single bridge domain within one EVI

Question 6

Two IOS-XR routers, PE1 and PE2, are directly connected over a point-to-point link and configured for IS-IS Level-2. The adjacency repeatedly cycles between INIT and DOWN, never reaching UP. Logs on PE1 show IIH packets received from PE2, but PE2 never sees PE1's hellos acknowledged. PE1's interface MTU is 1500; PE2's interface MTU was recently changed to 1400 during a maintenance window. What is the most likely cause of the failure?

Accepted Answer

IS-IS pads its hello PDUs to the full interface MTU by default, so the 1500-byte padded hellos from PE1 are dropped by PE2's smaller 1400-byte MTU, preventing the adjacency from forming.

Answer

The two routers have mismatched IS-IS system IDs, which prevents the three-way handshake from completing on the point-to-point link.

Answer

One router is configured for narrow metrics and the other for wide metrics, causing the hellos to be silently discarded.

Answer

The area addresses differ between PE1 and PE2, which is required to match for Level-2 adjacencies to form.

Question 7

A service provider runs a two-level IS-IS domain. Branch routers in a Level 1 area only receive a default route toward the nearest L1/L2 router via the ATT bit, which causes suboptimal exit selection when a specific prefix in another area is actually best reached through a different L1/L2 router. The network engineer wants the L1 routers to make optimal forwarding decisions for a set of important L2 prefixes without converting the entire area to Level 1-2. Which action achieves this?

Accepted Answer

Configure route leaking on the L1/L2 routers to redistribute selected L2 prefixes into Level 1 with the up/down bit set

Answer

Set the overload bit on the L1/L2 routers so L1 routers prefer the closest exit only

Answer

Widen the IS-IS metric style to narrow on the L1 routers so they accept external routes

Answer

Disable the ATT bit on all L1/L2 routers to force full topology flooding into Level 1

Question 8

A service provider runs IS-IS on all IOS XR core routers for both IPv4 and IPv6. Historically the network used a single topology (default) for both address families. An engineer enables 'address-family ipv6 unicast' under a new router's IS-IS process and configures 'multi-topology' on that router only. After the change, IPv6 routes learned via IS-IS from that new router are missing on adjacent routers, although IPv4 routing and the IS-IS adjacency itself remain fully up. What is the most likely cause?

Accepted Answer

The adjacent routers use single-topology (single SPF) IS-IS, so they advertise IPv6 reachability using the standard IPv4 TLVs, and the multi-topology router only processes MT TLVs — the topology mode mismatch prevents IPv6 prefix exchange.

Answer

Enabling multi-topology automatically disables the IPv4 address family, so the adjacency is only exchanging IPv6 in a separate topology that the neighbors cannot see.

Answer

IS-IS cannot carry IPv6 prefixes unless wide metrics (metric-style wide) are disabled globally on all routers in the area.

Answer

The new router formed an adjacency in a different IS-IS level, so IPv6 prefixes are being leaked incorrectly between Level-1 and Level-2.

Question 9

A service provider offers an EVPL service to a customer using an IOS XR PE router. The customer sends frames tagged with an outer VLAN 100 and inner VLAN 200 (QinQ). The PE must match these double-tagged frames on the access interface, remove the outer service-delimiting VLAN 100 before forwarding across the VPWS pseudowire, and re-impose VLAN 100 toward the customer on egress. Which Ethernet flow point (EFP) configuration on the ingress attachment circuit achieves this behavior?

Accepted Answer

encapsulation dot1q 100 second-dot1q 200 with rewrite ingress tag pop 1 symmetric

Answer

encapsulation dot1q 100 with rewrite ingress tag pop 2 symmetric

Answer

encapsulation dot1q 100 second-dot1q 200 with rewrite ingress tag push dot1q 100 symmetric

Answer

encapsulation default with rewrite ingress tag translate 1-to-1 dot1q 200 symmetric

Question 10

A service provider runs an EVPN-based L2VPN across its IOS XR core. A dual-homed customer VM is migrated from a server behind PE1 to a server behind PE2. After the move, PE1 continues to advertise the VM's MAC as a local route while PE2 also advertises the same MAC, causing intermittent Layer 2 reachability and MAC flapping between the two PEs. Which EVPN mechanism resolves this by determining which PE currently owns the MAC?

Accepted Answer

The MAC Mobility extended community carrying an incrementing sequence number in the Type 2 MAC/IP advertisement route

Answer

The Ethernet Segment Identifier (ESI) label exchanged in the Type 4 Ethernet Segment route

Answer

The split-horizon group applied to the pseudowire to suppress duplicate flooding

Answer

The designated forwarder election performed via the Type 3 Inclusive Multicast Ethernet Tag route

Question 11

A service provider runs a VPLS instance across three PE routers (PE1, PE2, PE3) in a full mesh of pseudowires. A dual-homed customer site connects to PE1 (active) and PE2 (standby) using MST for loop prevention. When the active uplink to PE1 fails and traffic shifts to PE2, remote PE3 continues black-holing customer traffic for the affected MAC addresses until they naturally age out. Which mechanism should be enabled to force PE3 to immediately relearn the MAC addresses on the correct pseudowire?

Accepted Answer

MAC address withdrawal via LDP Address Withdraw message

Answer

MAC address aging timer reduced to zero on all PEs

Answer

Split-horizon forwarding on the VPLS full mesh

Answer

Control word insertion on all VPLS pseudowires

Question 12

You are deploying an EoMPLS point-to-point pseudowire (VPWS) between two IOS XR PE routers across a core that performs equal-cost load balancing based on a deep packet hash. Customers report intermittent packet reordering and dropped frames on the emulated Ethernet circuit, though the pseudowire is up on both ends. What should you configure on the pseudowire to resolve this issue?

Accepted Answer

Enable the control word on the pseudowire at both PEs

Answer

Change the pseudowire encapsulation type from Ethernet to VLAN mode

Answer

Increase the MTU on the attachment circuits to accommodate the label stack

Answer

Configure a static pseudowire label instead of using LDP signaling

Question 13

A service provider offers a shared central-services VRF (hosting DNS and NTP servers) that all customer VRFs must reach, but individual customers must NOT be able to reach each other through the central-services VRF. Customer VRFs use RT 65000:100 (customer A) and 65000:200 (customer B). The central-services VRF uses RT 65000:999. Which route-target configuration on the central-services PE VRF achieves the required any-to-central but not customer-to-customer reachability?

Accepted Answer

Central-services VRF imports 65000:100 and 65000:200 and exports 65000:999; each customer VRF imports 65000:999 and exports its own customer RT

Answer

Central-services VRF imports and exports 65000:999 only; each customer VRF imports and exports 65000:999

Answer

Central-services VRF exports 65000:100 and 65000:200 and imports 65000:999; each customer VRF exports 65000:999 and imports its own customer RT

Answer

All VRFs import and export 65000:100, 65000:200, and 65000:999 to guarantee full reachability

Question 14

Two service providers operate separate MPLS L3VPN backbones and must interconnect a customer VPN across their ASBRs. The design team chooses Inter-AS Option B (VPNv4 exchange between ASBRs). On the ASBR of AS 100, VPNv4 routes are being received from the peer ASBR in AS 200, but the customer PE devices in AS 100 cannot forward traffic toward the remote prefixes even though the VPNv4 routes appear in BGP. What must be verified on the AS 100 ASBR for Option B to forward customer traffic correctly?

Accepted Answer

That the ASBR rewrites the BGP next hop to itself and allocates a new local MPLS label for each VPNv4 prefix, so a valid label swap exists across the AS boundary

Answer

That the full customer VRF is configured on the ASBR with matching route targets so the routes are imported into a local routing table

Answer

That an LDP session is established directly between the two ASBRs to distribute transport labels across the inter-AS link

Answer

That the ASBR redistributes the received VPNv4 routes into the IGP so the local PEs can learn the remote prefixes

Question 15

A service provider runs an MPLS L3VPN for a customer that uses OSPF as the PE-CE routing protocol at two sites, Site A and Site B. Both sites also have a direct backdoor OSPF link between them within the same OSPF area. The customer complains that traffic between the two sites always takes the low-speed backdoor link instead of the high-speed MPLS backbone. The PEs redistribute customer routes into MP-BGP and back into OSPF as type-3 inter-area routes. What must the SP engineer configure to make the MPLS backbone the preferred path?

Accepted Answer

An OSPF sham-link between the two PE routers within the customer VRF

Answer

A matching OSPF domain-id on both PE routers so routes are advertised as intra-area

Answer

Increase the OSPF cost on the backdoor link at both CE routers to a higher value than the backbone

Answer

Configure the backdoor link as an OSPF virtual link terminating on the PE routers

Question 16

A service provider runs MPLS L3VPN with OSPF as the PE-CE routing protocol for customer ACME. Routes learned from a remote CE via MP-BGP are redistributed back into OSPF on the local PE toward the CE. The customer complains that these VPN routes appear on their CE routers as OSPF external Type 5 (E2) LSAs, but they require the routes to be seen as inter-area (Type 3) summary LSAs so that internal SPF metric behavior is preserved end-to-end. Both customer sites use the same OSPF process and are in different, non-zero areas connected through the MPLS backbone. What must be configured on the PEs to achieve this?

Accepted Answer

Configure a matching OSPF domain-id on both PEs so the MPLS VPN backbone is treated as an OSPF super-backbone and routes are advertised as inter-area Type 3 LSAs

Answer

Configure an OSPF sham-link between the two PEs to force the routes into Type 1 router LSAs across the backbone

Answer

Set the redistribution metric-type to 1 on both PEs so the routes become E1 LSAs that carry cumulative internal cost

Answer

Enable capability vrf-lite on both PE OSPF processes to suppress the down-bit and export routes as intra-area Type 1 LSAs

Question 17

A service provider runs LDP across its core using default Cisco IOS behavior. A network engineer notices that during an IGP convergence event, some LSRs begin advertising a label mapping for a FEC to their upstream neighbors before the downstream label mapping for that same FEC has been received. This creates a brief window where an LSR advertises a label but has no valid downstream label to swap to. Which LDP label distribution control mode explains this behavior, and what is its key characteristic?

Accepted Answer

Independent label distribution control — each LSR advertises label mappings for a FEC independently, without waiting to receive a label from the downstream next hop.

Answer

Ordered label distribution control — an LSR advertises a label mapping only after it has received a label mapping from the downstream next hop (or is the egress) for that FEC.

Answer

Downstream-on-demand label advertisement — an LSR advertises labels only when explicitly requested by an upstream peer.

Answer

Conservative label retention — an LSR retains only the label mapping received from its current next-hop neighbor and discards all others.

Question 18

A service provider is deploying RSVP-TE tunnels and wants a specific tunnel to traverse only links that are colored as 'high-bandwidth' (bit 0x01) while avoiding any link colored as 'satellite' (bit 0x04). The core links have their attribute-flags configured accordingly. Which tunnel configuration correctly enforces this path constraint using affinity and mask values?

Accepted Answer

tunnel mpls traffic-eng affinity 0x01 mask 0x05

Answer

tunnel mpls traffic-eng affinity 0x05 mask 0x05

Answer

tunnel mpls traffic-eng affinity 0x01 mask 0x01

Answer

tunnel mpls traffic-eng affinity 0x04 mask 0x04

Question 19

A service provider deploys an MPLS TE tunnel across a core where every physical link supports a 1500-byte IP MTU. Customers send 1500-byte IP packets with the DF bit set. After the TE tunnel is activated, users report that large TCP transfers fail while small pings succeed. What is the most likely cause and correct remedy?

Accepted Answer

The MPLS label stack adds overhead that pushes labeled packets beyond the core link MTU, causing drops of DF-set packets; increase the core interface MPLS MTU to accommodate the label stack (e.g., 1500 + label bytes).

Answer

TE tunnels cannot carry packets larger than 576 bytes; enable IP fragmentation on the tunnel headend to split traffic.

Answer

The DF bit forces the tunnel into pipe mode; clear the DF bit on the PE to allow the core to fragment the packets.

Answer

RSVP-TE signaling reserves MTU bandwidth incorrectly; lower the tunnel bandwidth reservation so smaller packets are prioritized.

Question 20

A service provider runs RSVP-TE across its core. Two tunnels traverse a link with 100 Mbps of reservable bandwidth. Tunnel-A (already established) reserves 70 Mbps and was configured with setup priority 7 and hold priority 7. Tunnel-B is now being signaled with a 50 Mbps reservation, setup priority 3 and hold priority 3. The link cannot accommodate both reservations simultaneously. What happens when Tunnel-B is signaled?

Accepted Answer

Tunnel-B preempts Tunnel-A because Tunnel-B's setup priority (3) is better than Tunnel-A's hold priority (7), and Tunnel-A is torn down and re-signaled.

Answer

Tunnel-B fails to establish because Tunnel-A was signaled first and holds the reservation regardless of priority values.

Answer

Both tunnels remain up because RSVP-TE oversubscribes the link when priorities differ by more than three levels.

Answer

Tunnel-A preempts Tunnel-B because a hold priority of 7 is stronger than a setup priority of 3.

Question 21

A service provider offers an MPLS L3VPN hub-and-spoke topology for a customer. All spoke sites must send traffic to the hub site but must not communicate directly with each other. The hub PE has two VRFs: VRF-HUB-IN (receives spoke routes) and VRF-HUB-OUT (advertises hub routes). Each spoke VRF must import hub routes and export its own routes to the hub only. Which route-target configuration correctly enforces this hub-and-spoke behavior?

Accepted Answer

Spoke VRFs export RT 100:1 and import RT 100:2; VRF-HUB-IN imports RT 100:1; VRF-HUB-OUT exports RT 100:2.

Answer

Spoke VRFs export RT 100:1 and import RT 100:1; the hub VRF imports and exports RT 100:1.

Answer

Spoke VRFs export RT 100:2 and import RT 100:1; VRF-HUB-IN exports RT 100:1; VRF-HUB-OUT imports RT 100:2.

Answer

All VRFs (spoke and hub) import and export both RT 100:1 and RT 100:2.

Question 22

A service provider deploys PIM Bidirectional (Bidir-PIM) in a data-center distribution segment to support a many-to-many financial multicast application where every host is both a source and a receiver. On a multi-access LAN segment that connects to the rendezvous point (RP) tree, the engineer notices that multicast traffic sourced on the segment is being forwarded upstream toward the RP by more than one router, causing duplicate packets. Which Bidir-PIM mechanism is responsible for electing a single router per link to forward traffic toward the RP, and what must the engineer verify?

Accepted Answer

The Designated Forwarder (DF) election; verify that exactly one DF is elected per RPF link based on the best unicast metric to the RP address

Answer

The PIM Designated Router (DR) election; verify that the highest-IP-address router became DR and is registering sources to the RP

Answer

The IGMP querier election; verify that the lowest-IP-address router is acting as querier to suppress duplicate forwarding

Answer

The Assert mechanism used in PIM Sparse Mode; verify that the router with the lowest administrative distance wins the assert on the shared segment

Question 23

You are troubleshooting an OSPFv2 area 0 that spans four routers on IOS XR. Users report intermittent reachability to prefixes advertised by R3. On R1 you notice the SPF calculation runs repeatedly, and 'show ospf database router' displays two Type-1 LSAs with the same Router ID (10.0.0.3) but originating from different interfaces and with conflicting link information. Adjacencies flap on R3 and R4. What is the most likely root cause of this instability?

Accepted Answer

Two routers in area 0 have been configured with the same OSPF Router ID, causing LSA ID collisions and continuous SPF recalculation.

Answer

R3 is missing the 'network' statement for the link to R4, so its Type-1 LSA is incomplete.

Answer

The area 0 routers have mismatched MTU values, preventing the LSDB from fully synchronizing.

Answer

An OSPF authentication key mismatch on R3 is corrupting the Type-1 LSA payload.

Question 24

In a service provider network, area 0 connects to a non-backbone area 10 through an ABR named R2. An ASBR named R5 resides inside area 10 and redistributes external routes into OSPF. A router in area 0 (R1) can see the Type 5 external LSAs in its database but shows the external routes as unreachable. Which condition explains why R1 cannot install these external routes?

Accepted Answer

R1 is not receiving the Type 4 ASBR Summary LSA that provides reachability to the ASBR R5 from another area

Answer

R1 must have the Type 5 LSAs re-originated by the ABR as Type 7 LSAs before installation

Answer

The Type 5 LSAs cannot be flooded across area boundaries into area 0

Answer

R1 needs a Type 3 Summary LSA for the ASBR's loopback because Type 4 LSAs are only used within stub areas

Question 25

A service provider runs OSPFv2 with a not-so-stubby area (NSSA) that connects to a customer network redistributing static routes. The customer's routes appear as Type-7 LSAs inside the NSSA. Operations reports that these customer routes are NOT reaching routers in the backbone (area 0) or other regular areas. There are two ABRs attached to the NSSA. Which statement correctly explains the expected behavior and the most likely cause?

Accepted Answer

Only the ABR with the highest router ID in the NSSA translates Type-7 LSAs into Type-5 LSAs by default, and translation or the P-bit is likely misconfigured or clear.

Answer

Type-7 LSAs are flooded domain-wide unchanged; the backbone routers are simply filtering them with a route map that must be removed.

Answer

Type-7 LSAs must be manually converted to Type-3 summary LSAs on each ABR before they can enter area 0.

Answer

NSSAs cannot originate external routes at all, so the customer statics should have been injected as Type-1 LSAs on the ABR instead.