Medium — 350-501 Practice Quiz

Question 1

A service provider automation team is choosing between Ansible and Terraform to manage the running configuration of hundreds of Cisco IOS XR routers. A key requirement is that re-running the same automation job repeatedly must not create duplicate or conflicting configuration if the device is already in the desired state. Which characteristic of Ansible directly satisfies this requirement?

Accepted Answer

Ansible modules are idempotent, applying changes only when the current state differs from the declared desired state

Answer

Ansible uses a persistent agent installed on each router to continuously reconcile drift

Answer

Ansible compiles a stateful graph of resource dependencies stored in a backend state file

Answer

Ansible requires a full device reload to guarantee configuration consistency after each run

Question 2

An SP operator peers with a customer over EBGP. The customer wants certain prefixes learned by the SP's PE to be usable within the SP's IBGP mesh but never advertised to any of the SP's upstream or peer EBGP neighbors. The customer sets a BGP community on these prefixes. Which well-known community achieves exactly this behavior?

Accepted Answer

NO_EXPORT (0xFFFFFF01)

Answer

NO_ADVERTISE (0xFFFFFF02)

Answer

NO_EXPORT_SUBCONFED / LOCAL_AS (0xFFFFFF03)

Answer

INTERNET (0x00000000)

Question 3

A service provider establishes an EBGP session between two routers, R1 (AS 65001) and R2 (AS 65002), that are directly connected via a single physical link. The engineer configures the peering using each router's loopback interface address as the neighbor and update source. Static routes to reach the remote loopbacks are in place, and the loopbacks are reachable via ping. However, the EBGP session remains stuck in Active/Idle. What must be configured to bring this session up?

Accepted Answer

Add 'ebgp-multihop 2' (or 'neighbor ... ttl-security') on both routers so the EBGP TTL check does not drop the packets sourced from the loopbacks

Answer

Change the peering to use the directly connected interface addresses instead, because EBGP cannot use loopback interfaces under any circumstance

Answer

Enable 'next-hop-self' on both neighbors so the loopback next hop is rewritten to the connected interface

Answer

Configure BFD on the link, since EBGP loopback peering requires BFD to establish adjacency

Question 4

A service provider runs a single AS with 12 IBGP-speaking PE routers configured in a full mesh. The network team plans to grow to 40 PEs and wants to reduce IBGP peering overhead without splitting the AS or introducing loops. A senior engineer proposes deploying two route reflectors in the core. When a route reflector receives an IBGP prefix from one of its clients, how will it advertise that prefix, and what loop-prevention attribute is used?

Accepted Answer

It reflects the client route to all other clients and to non-client IBGP peers, and uses the ORIGINATOR_ID and CLUSTER_LIST attributes for loop prevention.

Answer

It reflects the client route only to non-client IBGP peers, relying on the AS_PATH prepend to prevent loops among clients.

Answer

It forwards the route only to its EBGP peers after resetting the NEXT_HOP, using the AS_PATH to detect loops within the cluster.

Answer

It reflects the route to all clients but not to non-client peers, using the LOCAL_PREF attribute to break potential routing loops.

Question 5

An ISP running IOS XR peers with a customer over an EBGP IPv6 session. The operator wants all IPv6 prefixes received from this customer to be tagged with community 65001:100 so downstream route-policies can match them, while leaving all other attributes unchanged. Which routing policy configuration applied inbound on the neighbor achieves this?

Accepted Answer

route-policy TAG-CUST
  set community (65001:100) additive
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Answer

route-policy TAG-CUST
  set community (65001:100)
end-policy  — applied with 'route-policy TAG-CUST out'

Answer

route-policy TAG-CUST
  set local-preference 100
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Answer

route-policy TAG-CUST
  set extcommunity rt (65001:100) additive
  pass
end-policy  — applied with 'route-policy TAG-CUST in'

Question 6

A service provider is migrating a customer's eBGP peering from legacy AS 65010 to a new AS 65020 after a network merger. The customer's CPE is still configured to peer with AS 65010 and cannot be reconfigured during the maintenance window. On the PE router (now in AS 65020), which BGP feature allows the PE to present itself to the customer as if it still belongs to AS 65010, so the existing eBGP session comes up without customer-side changes?

Accepted Answer

Configure the neighbor with the local-as command specifying AS 65010

Answer

Configure allowas-in on the neighbor to accept the customer's routes

Answer

Apply an inbound route-map that sets the AS_PATH to 65010

Answer

Enable eBGP multihop with a TTL of 2 toward the customer CPE

Question 7

A service provider runs IBGP between PE1 and PE2 (both in AS 65100) over an internal /30 link. PE1 has an EBGP session to a customer router in AS 65200 over the subnet 203.0.113.0/30. After the customer advertises 198.51.100.0/24, PE2 receives the prefix in its BGP table but marks it as inaccessible, and the route never enters the RIB. The IGP on the provider core does not carry the 203.0.113.0/30 subnet. Which configuration on PE1 resolves the issue?

Accepted Answer

Configure 'neighbor <PE2> next-hop-self' on PE1 under the IBGP session

Answer

Configure 'neighbor <customer> next-hop-self' on PE1 under the EBGP session

Answer

Enable 'bgp default local-preference 200' on PE1 for the customer prefix

Answer

Configure 'neighbor <PE2> ebgp-multihop 2' on PE1 under the IBGP session

Question 8

An SP network engineer is troubleshooting outbound path selection on an IOS XR PE router. The router receives two eBGP advertisements for prefix 203.0.113.0/24. Both paths have equal weight (0), equal local preference (100), neither is locally originated, both are non-aggregate routes, and MED is not being compared because the paths come from different neighboring autonomous systems. Path 1 has an AS_PATH of '65010 65020 65030' and Path 2 has an AS_PATH of '65040 65030'. All other attributes up to this decision point are equal. Based on the BGP best-path algorithm, which path will the router select and why?

Accepted Answer

Path 2, because its AS_PATH is shorter (fewer AS hops), which is evaluated before origin code and MED.

Answer

Path 1, because it traverses more autonomous systems and is therefore considered more stable.

Answer

Path 2, because the highest-numbered originating AS (65040) is preferred as a tiebreaker.

Answer

Path 1, because BGP prefers the path whose first AS in the AS_PATH is numerically lower.

Question 9

An SP operates AS 65000 and receives the same prefix 203.0.113.0/24 from a single neighboring AS 65100 over two separate EBGP sessions. Both received paths have identical weight, local preference, AS-path length, and origin type. The path via session A carries MED 50, and the path via session B carries MED 100. All other attributes up to MED are equal. Assuming default BGP behavior, which path does the router install as best, and why?

Accepted Answer

The path via session A (MED 50), because a lower MED is preferred and both paths originate from the same neighboring AS.

Answer

The path via session B (MED 100), because a higher MED indicates the neighbor's preferred entry point.

Answer

Neither MED value is compared, because MED is only evaluated between paths learned from different autonomous systems.

Answer

The path with the oldest EBGP session, because MED comparison is skipped entirely for EBGP-learned routes.

Question 10

An SP network engineer is troubleshooting inconsistent path selection for prefix 203.0.113.0/24 on an IOS-XR router. Two eBGP paths are received. Both paths have identical weight, local preference, AS_PATH length, and are not locally originated (no AS_PATH via aggregation). The MED values are also equal. Path 1 has an origin code of 'incomplete' (learned via redistribution), while Path 2 has an origin code of 'IGP' (learned via the network statement). Assuming all preceding BGP best-path attributes are tied, which path will the router select and why?

Accepted Answer

Path 2, because IGP origin (i) is preferred over incomplete origin (?) at the origin-code comparison step of the algorithm

Answer

Path 1, because incomplete origin indicates a directly redistributed route which is considered more reliable

Answer

Path 2, because the network statement assigns a higher weight automatically, breaking the tie earlier

Answer

Path 1, because origin code is not evaluated and the oldest eBGP path is preferred instead

Question 11

An ISP peers with two upstream providers, ISP-A and ISP-B, and receives the prefix 203.0.113.0/24 from both. On router R1 (IOS XR), the operator wants all traffic to this prefix to prefer ISP-A but needs the preference to remain local to R1 only, without influencing any other IBGP router in the AS. Both received routes are otherwise identical (same AS-path length, origin, and MED). Which attribute should the operator set inbound from ISP-A to accomplish this?

Accepted Answer

Set a higher Weight on routes received from ISP-A

Answer

Set a higher Local Preference on routes received from ISP-A

Answer

Set a lower MED on routes received from ISP-A

Answer

Prepend the AS-path on routes received from ISP-B

Question 12

A service provider is running out of public IPv4 addresses as its residential subscriber base grows. Management wants to continue offering IPv4 connectivity to subscribers while conserving the provider's dwindling public IPv4 pool, without requiring changes to customer premises equipment (CPE). Which service provider architecture element should the network architect deploy to meet this requirement?

Accepted Answer

Carrier-Grade NAT (CGN) performing NAT44 to share public IPv4 addresses among many subscribers

Answer

6PE to transport IPv6 subscriber traffic across the IPv4 MPLS core

Answer

Anycast RP to distribute multicast rendezvous points across the provider network

Answer

MPLS Traffic Engineering tunnels to steer subscriber traffic along explicit paths

Question 13

A service provider engineer notices that a PE router's route processor CPU spikes to 95% whenever a customer misconfigures a routing peer and floods the router with excessive BGP and ICMP traffic destined to the router itself. The engineer wants to protect the route processor by rate-limiting traffic punted to the control plane, while still permitting legitimate protocol sessions to establish. Which mechanism should be configured to achieve this?

Accepted Answer

Control Plane Policing (CoPP) using a policy-map applied to the control-plane interface

Answer

Unicast Reverse Path Forwarding (uRPF) in strict mode on all customer-facing interfaces

Answer

A data-plane ACL applied inbound on the customer-facing physical interface

Answer

Role-Based Access Control (RBAC) with command authorization on the management plane

Question 14

A service provider peers with an external BGP neighbor across a single-hop link. The security team is concerned about spoofed BGP packets originating from remote, multi-hop sources on the Internet that could be used to attack the router's control plane. They want a lightweight mechanism that validates the packets were sourced from a directly connected peer without relying on ACLs or cryptographic overhead. Which control plane protection mechanism should be configured on the eBGP session?

Accepted Answer

Enable BGP TTL Security (GTSM) with a hop count of 1 on the neighbor

Answer

Configure MD5 authentication (TCP-AO) on the BGP session

Answer

Apply a receive-path ACL (rACL) permitting only known BGP ports

Answer

Enable Control Plane Policing (CoPP) to rate-limit inbound BGP traffic

Question 15

A service provider is designing the QoS architecture for its MPLS core. The design team wants a scalable model where traffic is classified and marked once at the network edge, and each core router then applies forwarding treatment based solely on the marking in each packet, without maintaining per-flow state. Which QoS architecture model satisfies these requirements?

Accepted Answer

DiffServ using DSCP marking and per-hop behaviors (PHBs)

Answer

IntServ with RSVP signaling for each traffic flow

Answer

Best-effort forwarding with FIFO queuing on all interfaces

Answer

RSVP-TE bandwidth reservation on every core link per flow

Question 16

An ISP is deploying DS-Lite to allow residential subscribers with IPv6-only access networks to reach the legacy IPv4 Internet. The subscriber CPE receives only an IPv6 prefix from the access network. During design review, an engineer must explain how a subscriber's IPv4 traffic actually traverses the network to reach IPv4 destinations. Which statement correctly describes the DS-Lite data plane behavior?

Accepted Answer

The B4 element in the CPE encapsulates the subscriber's private IPv4 packets in IPv6 and tunnels them to the AFTR, which decapsulates and performs NAT44 to a public IPv4 address.

Answer

The CPE performs stateful NAT64 locally, translating IPv4 packets into IPv6 before forwarding them natively across the access network to an IPv4 server.

Answer

The AFTR assigns a unique public IPv4 address to each subscriber's B4 element via DHCPv4-over-IPv6, eliminating the need for address translation.

Answer

The B4 element translates IPv4 into IPv6 using stateless MAP-T rules, and the border relay reverses the translation without maintaining per-flow state.

Question 17

A network engineer is bringing a new IOS XR router into a streaming telemetry platform. Before subscribing to any paths, the engineer wants the collector to programmatically discover which YANG models, gNMI version, and data encodings (JSON, JSON_IETF, PROTO) the router supports so the collector can select a compatible encoding. Which gNMI RPC should the collector issue to obtain this information?

Accepted Answer

Capabilities

Answer

Subscribe with a SAMPLE subscription mode and inspect the returned notifications

Answer

Get with a path pointing to the openconfig-interfaces model

Answer

Set with an update operation targeting the telemetry configuration container

Question 18

A service provider is deploying model-driven telemetry from an IOS XR router to a centralized collector. The network team wants the collector to initiate a persistent gNMI session to the router, and the router should stream operational data continuously as counters change, rather than at fixed intervals. Which combination of gNMI transport model and subscription mode should be configured to meet this requirement?

Accepted Answer

Dial-in telemetry using a gNMI Subscribe RPC in ON_CHANGE mode

Answer

Dial-out telemetry using a gRPC Subscribe RPC in SAMPLE mode

Answer

Dial-out telemetry using a gNMI Subscribe RPC in STREAM SAMPLE mode

Answer

Dial-in telemetry using a gNMI Get RPC with a periodic polling loop

Question 19

A service provider is deploying model-driven telemetry from an IOS XR router to a collector. Security policy requires that both the router and the collector mutually authenticate each other using X.509 certificates before any telemetry data is streamed, and the router must initiate the connection to the collector. Which combination of gRPC/gNMI settings satisfies these requirements?

Accepted Answer

Configure a dial-out telemetry subscription over gRPC with TLS and mutual authentication (mTLS), installing a trustpoint on the router and requiring client certificate validation on the collector.

Answer

Configure a dial-in gNMI Subscribe session with TLS enabled, presenting only the server certificate on the router.

Answer

Configure a dial-out telemetry subscription over plain TCP and rely on an IPsec tunnel between the router and collector for authentication.

Answer

Configure a dial-in gRPC session with mTLS so the collector initiates the connection and both sides exchange certificates.

Question 20

A network engineer is configuring gNMI dial-out (target-initiated) telemetry on an IOS-XR router toward a collector that is reachable only across a fully trusted, isolated out-of-band management network. Management insists on the simplest possible transport configuration for a lab validation, so the engineer configures the gRPC session without any certificate trustpoint or TLS parameters. After committing, the router attempts to establish the session but the collector, which is listening for plaintext gRPC on port 57400, never receives a connection. What is the most likely reason the session fails to come up?

Accepted Answer

By default gRPC on IOS-XR enables TLS, so without explicitly disabling TLS (no-tls) the router presents a TLS handshake that the plaintext collector rejects

Answer

gNMI dial-out is only supported over UDP, so a TCP-listening collector on port 57400 can never accept the connection

Answer

gRPC requires mTLS in all deployments, so the missing client certificate causes the router to abort before sending any packets

Answer

The collector must initiate the connection in dial-out mode, so the router will never attempt to connect regardless of transport settings

Question 21

A network engineer configures a gNMI dial-in subscription over TLS between a Cisco IOS XR router and a telemetry collector. The router presents a server certificate whose Common Name and Subject Alternative Name contain only the router's loopback IP address (10.0.0.1), but the collector initiates the session using the router's DNS hostname (rtr1.example.com). SNMP and NETCONF over SSH work fine. The gNMI session fails during the TLS handshake with a certificate validation error on the collector. Which action resolves the failure while keeping TLS validation enabled?

Accepted Answer

Reissue the router's server certificate so that its SAN includes the DNS name rtr1.example.com used by the collector to connect

Answer

Switch the gNMI session from TLS to mTLS so the collector also presents a client certificate

Answer

Disable TLS on the gNMI server and rely on the underlying TCP session for transport security

Answer

Increase the gNMI sample-interval so the subscription negotiates before the TLS timer expires

Question 22

A service provider offers a business-grade Ethernet service to a customer whose CE connects at 1 Gbps physically, but the customer purchased only a 300 Mbps subscription tier. Within that 300 Mbps, voice traffic must receive strict low-latency treatment while remaining data classes share the leftover bandwidth proportionally. On the PE egress interface toward the customer, which QoS mechanism correctly enforces this design?

Accepted Answer

A hierarchical QoS policy where a parent policy shapes to 300 Mbps and a child policy provides priority for voice and bandwidth allocation for data classes

Answer

A single flat policy-map applying priority to voice and bandwidth to data classes, attached directly to the physical interface

Answer

A parent policing policy dropping all traffic above 300 Mbps with a child policy marking voice with EF

Answer

A per-class shaper on each traffic class summing to 300 Mbps, applied directly to the physical interface

Question 23

A service provider's PE router receives the same prefix 10.50.0.0/16 from two different route reflectors, each advertising a distinct next-hop. The network engineer wants the PE to install both paths into the RIB for load balancing. All BGP attributes for both paths are identical up to and including the IGP metric to the next-hop, but by default only one path is being used. Which configuration change enables the PE to install both IBGP paths?

Accepted Answer

Configure 'maximum-paths ibgp 2' under the BGP IPv4 address family

Answer

Configure 'bgp bestpath as-path multipath-relax' under the BGP process

Answer

Configure 'maximum-paths 2' under the BGP IPv4 address family

Answer

Configure 'bgp bestpath compare-routerid' under the BGP process

Question 24

A service provider runs IBGP with two route reflectors (RR1 and RR2) serving the same set of clients for redundancy. To avoid unnecessary route storage and ensure loop prevention within the redundant reflector design, both RRs are configured with the same cluster-id. A network engineer troubleshooting missing paths observes that when an RR receives a reflected route, it silently discards updates that contain its own cluster identifier. Which attribute is responsible for this loop-prevention behavior among route reflectors sharing a cluster-id?

Accepted Answer

The CLUSTER_LIST attribute, which the RR checks for its own CLUSTER_ID and discards the update if found

Answer

The ORIGINATOR_ID attribute, which lists every RR that reflected the route so duplicates are dropped

Answer

The AS_PATH attribute, which accumulates the cluster-id as if it were a private AS number

Answer

The ORIGIN attribute, which is set to incomplete when a route passes through a reflector cluster

Question 25

A service provider operates an IOS XR PE router that establishes a multihop eBGP session with a customer's router located two Layer 3 hops away. The security team wants to ensure that spoofed BGP packets originating from remote parts of the internet cannot reach and attack the BGP process on the PE, while still permitting the legitimate two-hop peer. Which control plane protection mechanism should be configured on the eBGP neighbor to meet this requirement most effectively?

Accepted Answer

Configure BGP TTL security (ttl-security) so the PE accepts packets only if their received TTL is within the expected hop count

Answer

Configure an inbound interface ACL permitting TCP port 179 from the peer's IP address

Answer

Enable BGP MD5 authentication on the neighbor to hash each BGP segment

Answer

Increase the ebgp-multihop value to 255 so distant packets are dropped by the routing engine