Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) practice questions

1. Question 1 of 25

   

   Refer to the exhibits. Which information is provided for traceback analysis when this configuration is applied?

   • Asource interface
   • Bpacket size distribution
   • CIP sub flow cache
   • DBGP version

   Show answer

   Correct answer: A

   How others answered

   • A80%
   • C20%

   Explanation

   I'm voting for A based on this paragraph from Cisco. It specifically talks about tracing the source of an attack and using NetFlow to know the source interface. Keywords are in all caps. "The originator of DoS attacks cannot be easily identified because the IP source address of the device sending the traffic is usually forged. However, you can easily TRACE the traffic BACK through the network to the router on which it is arriving by using the NetFlow Layer 2 and Security Monitoring Exports feature to capture the MAC address and VLAN-ID fields. If the router on which traffic is arriving supports NetFlow, you can configure the NetFlow Layer 2 and Security Monitoring Exports feature on it to identify the INTERFACE on which the traffic is ARRIVING." https://www.cisco.com/en/US/docs/ios-xml/ios/netflow/configuration/15-2s/nf-detct-analy-thrts.html

   Adapted from community discussion by karen1337 · 2024-09-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. K

      KNOPPER

      2020-10-04

      7 upvotes

      I think it would be A, i believe this is referring to the netflow template format which has a field for source interface. Not to be confused with the output from "show ip cache flow" on a device.

   2. R

      rans3001

      2021-07-09

      5 upvotes

      So I would suppose that "information provided for traceback analysis" means netflow export data, not the output of the "show ip cache flow" (wich is a traceback analysis of the raw netflow data that the router itself generates). Is this right ? Packet size distribution and IP sub flow cache are visible in the show ip cache flow output, generated by the router, based on netflow data and they should not be part of the netflow export data. BGP version is not used in netflow export, but source interface it is. I would go with answer A

   3. K

      karen1337

      2024-09-30

      Selected A2 upvotes

      I'm voting for A based on this paragraph from Cisco. It specifically talks about tracing the source of an attack and using NetFlow to know the source interface. Keywords are in all caps. "The originator of DoS attacks cannot be easily identified because the IP source address of the device sending the traffic is usually forged. However, you can easily TRACE the traffic BACK through the network to the router on which it is arriving by using the NetFlow Layer 2 and Security Monitoring Exports feature to capture the MAC address and VLAN-ID fields. If the router on which traffic is arriving supports NetFlow, you can configure the NetFlow Layer 2 and Security Monitoring Exports feature on it to identify the INTERFACE on which the traffic is ARRIVING." https://www.cisco.com/en/US/docs/ios-xml/ios/netflow/configuration/15-2s/nf-detct-analy-thrts.html

   4. E

      EdgardoAC

      2020-10-12

      4 upvotes

      I found this link to be helpful, based on the information it would seem C is correct. https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-netflow/prod_white_paper0900aecd80406232.html

2. Question 2 of 25

   

   Refer to the exhibit. An engineer is trying to implement BGP configuration on a router. Which configuration error prevents the ASBR from establishing a BGP neighborship to a directly connected BGP speaker?

   • AThe routing policy is absent for this Cisco IOS XR eBGP instance.
   • BThe TCP session parameters are not specified.
   • CThe VPNv4 address family interferes with the BGP IPv4 address family negotiations.
   • DThe IPv4 address family configuration under neighbor configuration-mode must be removed.

   Show answer

   Correct answer: C

   How others answered

   • C67%
   • A33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The question says "Establishing BGP Neighborship" so if the RPL is not configured the 2 eBGP Peers still have to form an adjacency but routes will not be propagated between them due to the default drop policy !! IDK this is weird question

   Adapted from community discussion by sherlock0 · 2021-12-02 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. S

      sherlock0

      2021-12-02

      7 upvotes

      The question says "Establishing BGP Neighborship" so if the RPL is not configured the 2 eBGP Peers still have to form an adjacency but routes will not be propagated between them due to the default drop policy !! IDK this is weird question

   2. T

      thejag

      2023-02-28

      3 upvotes

      The ttl-security not really a TCP parameter, the TTL is actually a field in the IP packet which by default is set to 1. For a "DIRECTLY CONNECTED" eBGP neighbor to come up you do not need "ebgp-multihop" OR the "ttl-security",only if the peer is further hops away. "The neighbor ttl-security command cannot be configured for a peer that is already configured with the neighbor ebgp-multihop command. The configuration of these commands is mutually exclusive, and only one of these commands is needed to enable a multihop eBGP peering session. An error message will be displayed in the console if you attempt to configure both commands for the same peering session." Missing routing policy IS a problem because you will not exchange any routes but it does NOT stop the establishing of the BGP neighborship. I changed my mind, it cannot be A. I am not sure about this one.

   3. E

      EdgardoAC

      2021-12-13

      4 upvotes

      This is not a good or clearly formulated question. By process of elimination options C and D make no sense, option B also has no relevance, we know that in order for an eBGP process to exchange routes an RPL is needed in ios XR, even if the neighbor is already established, so A makes the most sense.

   4. U

      uhljeb

      2023-10-28

      Selected C2 upvotes

      It can't be A. The routers will establish a BGP session, but they will not exchange prefixes without a route-policy.

3. Question 3 of 25

   You are testing the capabilities of MPLS OAM ping. Which statement is true?

   • AAn LSP is not required for the reply to reach the ingress MPLS router.
   • BAn LSP breakage results in the ingress MPLS router never receiving any reply.
   • CMPLS OAM ping works solely with P2P LSPs.
   • DMPLS OAM ping works solely with Cisco MPLS TE.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-3/mpls/configuration/guide/b-mpls-cg53x-asr9k/b-mpls-cg53x- asr9k_chapter_01000.html

   Adapted from community discussion by blizzlondon · 2021-07-01 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. B

      blizzlondon

      2021-07-01

      12 upvotes

      correct answer: A. An LSP is not required for the reply to reach the ingress MPLS router. An MPLS echo reply is sent in response to an MPLS echo request. The reply is sent as an IP packet and it is forwarded using IP, MPLS, or a combination of both types of switching. Head-end router will receive an echo-reply from the last router (before the broken binding), and that reply will be: 'U' - unreachable

   2. A

      ariasse

      2024-05-21

      1 upvote

      Actually, the purpose of MPLS LSP Ping is to verify if LSP is working well, that is why you do need LDP. So for this reason it should be “B”. https://www.cisco.com/c/dam/en/us/td/docs/routers/ncs4200/configuration/guide/mpls/mp-em-mibs-ncs4200-book.html “MPLS LSP Ping uses Multiprotocol Label Switching (MPLS) echo request and reply packets to validate a label switched path (LSP). Both an MPLS echo request and an MPLS echo reply are User Datagram Protocol (UDP) packets with source and destination ports set to 3503.”

   3. D

      dhikra

      2022-08-14

      2 upvotes

      i think answer B is correct also https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/mpls/mp-basic-xe-3s-asr920-book/mp-basic-xe-3s-asr903-book_chapter_011.html

   4. T

      thejag

      2024-06-16

      Selected A1 upvote

      A is 100% correct: https://www.cisco.com/c/dam/en/us/td/docs/routers/ncs4200/configuration/guide/mpls/mp-em-mibs-ncs4200-book.html#:~:text=and%20AToM%20VCCV-,MPLS%20LSP%20Ping%20Operation,-MPLS%20LSP%20Ping

4. Question 4 of 25

   Which statement about segment routing prefix segments is true?

   • AIt is the longest path to a node.
   • BIt is linked to an adjacency SID that is globally unique within the router.
   • CIt is linked to a prefix SID that is globally unique within segment routing domain.
   • DIt requires using EIGRP to operate.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Interior gateway protocol (IGP) distributes two types of segments: prefix segments and adjacency segments. A prefix segment is a global segment, so a prefix SID is globally unique within the segment routing domain.

   Adapted from community discussion by Gi0v4ne · 2023-05-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. C

      craterman

      2023-06-30

      Selected C2 upvotes

      Please correct the reference to https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/segment-routing/configuration/guide/b-seg-routing-cg-asr9k/b-seg-routing-cg-asr9k_chapter_010.pdf Your link does not work

   2. G

      Gi0v4ne

      2023-05-30

      Selected C2 upvotes

      Interior gateway protocol (IGP) distributes two types of segments: prefix segments and adjacency segments. A prefix segment is a global segment, so a prefix SID is globally unique within the segment routing domain.

   3. R

      ROJUCS

      2023-04-14

      2 upvotes

      link broken: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/segment-routing/configuration/guide/b-seg-routing-cg-asr9k/b-seg-routing-cg-asr9k_chapter_010.pdf

   4. T

      thejag

      2024-08-27

      1 upvote

      A prefix segment is a global segment, so a prefix SID is globally unique within the segment routing domain. An adjacency segment is a local segment, so the adjacency SID is locally unique relative to a specific router. https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/segment-routing/61x/b-segment-routing-cg-ncs5500/b-segment-routing-cg-ncs5500_chapter_01.pdf

5. Question 5 of 25

   What is a constraint of Cisco MPLS TE tunnel configurations?

   • AQoS-aware tunneling is not supported.
   • BTunnels cannot be configured over IP unnumbered links.
   • CWith ISIS as an IGP, only older-style metrics are used.
   • DTunnels cannot span multiple OSPF areas.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Answer is B, https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-16-12/mp-te-path-setup-xe-17-book/mpls-traffic-engineering-and-enhancements.html The MPLS traffic engineering feature does not support routing and signaling of LSPs over unnumbered IP links. Therefore, do not configure the feature over those links.

   Adapted from community discussion by [Removed] · 2023-06-17 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. [

      [Removed]

      2023-06-17

      6 upvotes

      Answer is B, https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-16-12/mp-te-path-setup-xe-17-book/mpls-traffic-engineering-and-enhancements.html The MPLS traffic engineering feature does not support routing and signaling of LSPs over unnumbered IP links. Therefore, do not configure the feature over those links.

   2. N

      nottoday2077

      2024-02-11

      Selected B1 upvote

      QoS argument is flawed imo, DS-TE is an extension to MPLS-TE to allow that. Meaning it is no longer a constraint. Even configured under the MPLS Traffic engineering commands, be like saying MPLS-TE can't dynamically create paths because it relies on an IGP. However the link posted by another user: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-16-12/mp-te-path-setup-xe-17-book/mpls-traffic-engineering-and-enhancements.html Clearly states that unnumbed links are not supported. XE 17 being a current firmware as well, so not outdated. Also to the user that rebuttaled that, unnumbered link is not the same thing as unnumbed loopback. Even in the documentation linked, the examples have unnumbered loopbacks.

   3. K

      KING_II

      2023-01-18

      3 upvotes

      The constraints of MPLS TE Tunnel is not supporting Qos aware, DS-TE does support Qos aware Tunneling. The correct answer is A

   4. C

      chst

      2023-11-24

      2 upvotes

      I found it , it's B The MPLS traffic engineering feature does not support routing and signaling of LSPs over unnumbered IP links. Therefore, do not configure the feature over those links. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-3s/mp-te-path-setup-xe-3s-book/mp-te-enhance-xe.html#GUID-96C9B528-9D61-4E5E-83EE-3BA1631A34CB

6. Question 6 of 25

   An engineer is implementing a Cisco MPLS TE tunnel to improve the streaming experience for the clients of a video-on-demand server. Which action must the engineer perform to configure extended discovery to support the MPLS LDP session between the headend and tailend routers?

   • AConfigure a targeted neighbor session.
   • BConfigure an access list on the interface to permit TCP and UDP traffic.
   • CConfigure a Cisco MPLS TE tunnel on both ends of the session.
   • DConfigure the interface bandwidth to handle TCP and UDP traffic between the LDP peers.

   Show answer

   Correct answer: A

   How others answered

   • A80%
   • C20%

   Explanation

   A is the best match for me. Anyone agree or disagree? If the LSR is more than one hop from its neighbor, it is nondirectly connected to its neighbor. For these nondirectly connected neighbors, the LSR sends out a targeted Hello message as a UDP packet, but as a unicast message specifically addressed to that LSR. The nondirectly connected LSR responds to the Hello message and the two routers begin to establish an LDP session. This is called EXTENDED DISCOVERY. An MPLS LDP targeted session is a label distribution session between routers that are not directly connected. When you create an MPLS traffic engineering tunnel interface, you need to establish a label distribution session between the tunnel headend and the tailend routers. You establish nondirectly connected MPLS LDP sessions by enabling the transmission of targeted Hello messages. You can use the ****mpls ldp neighbor targeted****command to set up a targeted session when other means of establishing targeted sessions do not apply, such as configuring mpls ip on a traffic engineering (TE)....

   Adapted from community discussion by thejag · 2023-02-16 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. T

      thejag

      2023-02-16

      4 upvotes

      A is the best match for me. Anyone agree or disagree? If the LSR is more than one hop from its neighbor, it is nondirectly connected to its neighbor. For these nondirectly connected neighbors, the LSR sends out a targeted Hello message as a UDP packet, but as a unicast message specifically addressed to that LSR. The nondirectly connected LSR responds to the Hello message and the two routers begin to establish an LDP session. This is called EXTENDED DISCOVERY. An MPLS LDP targeted session is a label distribution session between routers that are not directly connected. When you create an MPLS traffic engineering tunnel interface, you need to establish a label distribution session between the tunnel headend and the tailend routers. You establish nondirectly connected MPLS LDP sessions by enabling the transmission of targeted Hello messages. You can use the ****mpls ldp neighbor targeted****command to set up a targeted session when other means of establishing targeted sessions do not apply, such as configuring mpls ip on a traffic engineering (TE)....

   2. H

      hk9042

      2022-01-27

      7 upvotes

      AToM and some Traffic Engineering scenarios are examples of these applications that require a targeted LDP session between non directly connected routers. The command mpls ldp neighbor [vrf vpn-name] ip-addr targeted [ldp | tdp] can be used to manually configure targeted LDP sessions between peers. Answer A

   3. K

      kirrim

      2024-12-12

      Selected A1 upvote

      https://www.cisco.com/en/US/docs/ios-xml/ios/mp_ldp/configuration/15-2s/mp-ldp-overview.html " Directly Connected MPLS LDP Sessions If an LSR is one hop from its neighbor, it is directly connected to its neighbor. The LSR sends out LDP link Hello messages as User Datagram Protocol (UDP) packets to all the routers on the subnet (multicast). A neighboring LSR may respond to the link Hello message, allowing the two routers to establish an LDP session. This is called basic discovery. ... Nondirectly Connected MPLS LDP Sessions If the LSR is more than one hop from its neighbor, it is nondirectly connected to its neighbor. For these nondirectly connected neighbors, the LSR sends out a targeted Hello message as a UDP packet, but as a unicast message specifically addressed to that LSR. The nondirectly connected LSR responds to the Hello message and the two routers begin to establish an LDP session. This is called extended discovery. "

   4. V

      Vijini

      2022-02-08

      5 upvotes

      its C https://community.cisco.com/t5/mpls/mpls-te-tunnel-targeted-ldp-session/td-p/2863558

7. Question 7 of 25

   

   Refer to the exhibit. Router 1 and router 2 are running OSPF Area 0. The router logs on both routers show that the LDP link has flapped. Which configuration must the engineer apply to the two routers to implement session protection on the link?

   • ARouter 1(config)# ip cef distributed Router 1(config)# mpls ldp session protection global Router 2(config)# ip cef distributed Router 2(config)# mpls ldp session protection global
   • BRouter 1(config)# ip cef distributed Router 1(config)# interface gigabitethernet 0/0 Router 1(config-if)# ip address 192.168.1.1 255.255.255.0 Router 1(config)# mpls ldp session protection Router 2(config)# interface gigabitethernet 0/0 Router 2(config-if)# ip address 192.168.1.2 255.255.255.0 Router 2(config)# mpls ldp session protection
   • CRouter 1(config)# ip cef distributed Router 1(config)# interface gigabitethernet 0/0 Router 1(config-if)# ip address 192.168.1.1 255.255.255.255 Router 1(config-if)# exit Router 1(config)# mpls ldp session protection Router 2(config)# ip cef distributed Router 2(config)# interface gigabitethernet 0/0 Router 2(config-if)# ip address 192.168.1.2 255.255.255.255 Router 2(config-if)# exit Router 2(config)# mpls ldp session protection
   • DRouter 1(config)# ip cef distributed Router 1(config)# interface gigabitethernet 0/0 Router 1(config-if)# ip address 192.168.1.1 255.255.255.0 Router 1(config-if)# mpls label protocol ldp Router 1(config-if)# mpls ip Router 1(config-if)# exit Router 1(config)# mpls ldp session protection Router 2(config)# ip cef distributed Router 2(config)# interface gigabitethernet 0/0 Router 2(config-if)# ip address 192.168.1.2 255.255.255.0 Router 2(config-if)# mpls label protocol ldp Router 2(config-if)# mpls ip Router 2(config-if)# exit Router 2(config)# mpls ldp session protection

   Show answer

   Correct answer: D

   How others answered

   • D73%
   • B27%

   Only 73% agreed on this answer — treat it as contested rather than settled.

   Explanation

   By process of elimination, I labbed the commands. A: global keyword is not part of the command, mpls ldp session protection B: mpls ldp session proteccion command can't be entered in the interface configuration C: easiest elimination, bad subnet masks D: Correct answer

   Adapted from community discussion by EdgardoAC · 2021-12-30 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. E

      EdgardoAC

      2021-12-30

      Selected D7 upvotes

      By process of elimination, I labbed the commands. A: global keyword is not part of the command, mpls ldp session protection B: mpls ldp session proteccion command can't be entered in the interface configuration C: easiest elimination, bad subnet masks D: Correct answer

   2. J

      jmbp12

      2022-02-28

      4 upvotes

      The answer is B. The mpls ldp session protection command was not applied to the interface, it was applied in global config mode. Te questions says LDP flapped meaning LDP was previously configured so why should we enable MPLS again on the interfaces? For me the answer should be B.

   3. S

      Seele

      2023-08-06

      2 upvotes

      Router 1(config)# ip cef distributed Router 1(config)# interface gigabitethernet 0/0 Router 1(config-if)# ip address 192.168.1.1 255.255.255.0 Router 1(config-if)# mpls label protocol ldp Router 1(config-if)# mpls ip Router 1(config-if)# exit Router 1(config)# mpls ldp session protection Router 2(config)# ip cef distributed Router 2(config)# interface gigabitethernet 0/0 Router 2(config-if)# ip address 192.168.1.2 255.255.255.0 Router 2(config-if)# mpls label protocol ldp Router 2(config-if)# mpls ip Router 2(config-if)# exit Router 2(config)# mpls ldp session protection D is correct

   4. J

      jefranca

      2021-11-05

      3 upvotes

      The better is D A is wrong, coz there's no "global" in the "mpls ldp session protection" command. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_ldp/configuration/xe-16-5/mp-ldp-xe-16-5-book/mp-ldp-sessn-prot.html

8. Question 8 of 25

   What causes multicast traffic to permanently stay on the shared tree and not switch to the source tree?

   • ASSM range is being used
   • BThe RP announcements are being filtered
   • CThe SPT threshold is set to infinity
   • DThe RP IP address is configured incorrectly

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   I think C is correct: ip pim spt-threshold {kbps| infinity}[group-list access-list] Specifying the infinity keyword causes the router never to move to the shortest-path tree; it remains on the shared tree. This keyword applies to a multicast environment of "many-to-many" communication. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_optim/configuration/12-4t/imc-optim-12-4t-book/imc_pim_sparse.html

   Adapted from community discussion by nolbi · 2022-04-24 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. N

      nolbi

      2022-04-24

      13 upvotes

      I think C is correct: ip pim spt-threshold {kbps| infinity}[group-list access-list] Specifying the infinity keyword causes the router never to move to the shortest-path tree; it remains on the shared tree. This keyword applies to a multicast environment of "many-to-many" communication. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_optim/configuration/12-4t/imc-optim-12-4t-book/imc_pim_sparse.html

   2. B

      beenardino

      2022-05-29

      3 upvotes

      Yes I agree with C. "If the shared tree is not an optimal path between the source and the receiver, the routers dynamically create a source tree and stop traffic from flowing down the shared tree. This behavior is the default behavior in software. Network administrators can force traffic to stay on the shared tree by using the ip pim spt-threshold infinity command." https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_pim/configuration/xe-16/imc-pim-xe-16-book/imc-tech-oview.html

   3. E

      EdgardoAC

      2022-12-30

      Selected C2 upvotes

      Like the others pointed out C is correct, Search the doc for infinity. https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/ip_multicast/White_papers/mcst_ovr.html

   4. S

      serban_17

      2022-06-26

      2 upvotes

      IOS command: ip pim spt-threshold {kbps| infinity}[group-list acl-name] IOS XR command: spt-threshold infinity [group-list acl-name] The infinity keyword will cause all the sources for the specified group to never switch over to an SPT and continue using the shared tree. Answer C

9. Question 9 of 25

   

   Refer to the exhibit. If router A is the RP, which PIM mode can you configure so that devices will send multicast traffic toward the RP?

   • APIM-SM
   • BBIDIR-PIM
   • CPIM-SSM
   • DPIM-DM

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   I can aid in the discussion with the following premises: Based on my research - BIDIR-PIM is an extension to PIM-SM (requires PIM-SM to be pre-configured). Cisco recognizes PIM-DM and PIM-SM as the initial set of protocols. I'm voting for "A" as the answer

   Adapted from community discussion by blizzlondon · 2020-07-02 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

   1. B

      blizzlondon

      2020-07-02

      14 upvotes

      I can aid in the discussion with the following premises: Based on my research - BIDIR-PIM is an extension to PIM-SM (requires PIM-SM to be pre-configured). Cisco recognizes PIM-DM and PIM-SM as the initial set of protocols. I'm voting for "A" as the answer

   2. I

      iliveinspace

      2020-06-28

      9 upvotes

      SSM will skip the RP. PIM-DM will send to the RP inconsequentially. PIM-SM will initially send to RP then swap to SPT. PIM-BIDIR will always keep the RP in the path. Both answers are correct. This question sucks.

   3. J

      jefranca

      2021-11-05

      2 upvotes

      B is correct, coz In section 15.7 e-learning Cisco, we have: PIM-SM is unidirectional in its native form. The traffic from sources to the RP initially flows encapsulated in register messages. This activity presents a significant burden because of the encapsulation and de-encapsulation mechanisms. Additionally, an SPT is built between the RP and the source, which results in (S,G) entries being created between the RP and the source. BIDIR-PIM (Bidirectional PIM) is designed to be used for many-to-many applications. Multicast groups in bidirectional mode can scale to an arbitrary number of sources without incurring overhead due to the number of sources. BIDIR-PIM eliminates the registration and encapsulation process and the (S,G) state. Packets are natively forwarded from a source to the RP using the (*,G) state only. This capability ensures that only (*,G) entries will appear in multicast forwarding tables

   4. S

      serban_17

      2021-06-26

      5 upvotes

      As there is 1 sender and 1 receiver, BIDIR-PIM goes out of the question. I think A is the only correct answer here.

10. Question 10 of 25

    

    Refer to the exhibit. Which statement supports QPPB implementation?

    • AQPPB policies affect only egress traffic.
    • BQoS policies rely exclusively on BGP attributes to manipulate traffic.
    • CQoS policies are identified in the MPLS forwarding table.
    • DQoS policies use BGP to gain full coverage on the network.

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I'm go with Answer B The QoS Policy Propagation via BGP feature allows you to classify packets by IP precedence based on the Border Gateway Protocol (BGP) Attributes like community lists, BGP autonomous system paths, and access lists.

    Adapted from community discussion by Onny · 2021-01-02 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. O

       Onny

       2021-01-02

       12 upvotes

       I'm go with Answer B The QoS Policy Propagation via BGP feature allows you to classify packets by IP precedence based on the Border Gateway Protocol (BGP) Attributes like community lists, BGP autonomous system paths, and access lists.

    2. J

       jmbp12

       2022-09-21

       5 upvotes

       From Cisco BGP book: QoS Policy Propagation via BGP (QPPB) lets you map BGP prefixes and attributes to CEF parameters that can be used to enforce traffic policing. Compared to other QoS methods, QPPB allows BGP policy set in one location of the network to be propagated via BGP to other parts of the network, where appropriate QoS policies can be created. "D" seems to be the correct answer.

    3. M

       Marttino

       2021-03-12

       6 upvotes

       I would choose B, because this kind of Policies are configured based on BGP attributes.

    4. M

       murmelika

       2021-12-10

       2 upvotes

       D - https://www.ciscopress.com/articles/article.asp?p=169556&seqNum=5 QoS Policy Propagation via BGP (QPPB) lets you map BGP prefixes and attributes to CEF parameters that can be used to enforce traffic policing. Compared to other QoS methods, QPPB allows BGP policy set in one location of the network to be propagated via BGP to other parts of the network, where appropriate QoS policies can be created. The policing can be done on the input to the router for traffic destined for 172.16.0.0 or on the output from the router for the return traffic sourced from 172.16.0.0. The policing is created based on the result of the policy lookup and settings done previously.

11. Question 11 of 25

    A network engineer is implementing a QoS policy for outbound management traffic classification and marking on a CPE device with these requirements: ✑ Management protocols must be marked with DSCP AF class 2 with low drop probability. ✑ Monitoring protocols must be marked with DSCP AF class 1 with low drop probability. ✑ All remaining traffic must be marked with a DSCP value of 0. Which configuration must the engineer implement to satisfy the requirements?

    • Apolicy-map cpe-mgmt-policy class management set ip dscp af21 class monitoring set ip dscp af11 class class-default set ip dscp default end
    • Bpolicy-map cpe-mgmt-policy class management set ip dscp af21 class monitoring set ip dscp af11 class class-default set ip dscp af0 end
    • Cpolicy-map cpe-mgmt-policy class management set ip dscp af23 class monitoring set ip dscp af13 class class-default set ip dscp default end
    • Dpolicy-map cpe-mgmt-policy class management set ip dscp af23 class monitoring set ip dscp af13 class class-default set ip dscp af0 end

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A is correct. af10 as far as I can tell does not exist. Options B and D are eliminated. af23 has high drop probability. Option C is eliminated https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0/qos/configuration/guide/nexus1000v_qos/qos_6dscp_val.pdf

    Adapted from community discussion by EdgardoAC · 2023-06-30 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. E

       EdgardoAC

       2023-06-30

       Selected A7 upvotes

       A is correct. af10 as far as I can tell does not exist. Options B and D are eliminated. af23 has high drop probability. Option C is eliminated https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0/qos/configuration/guide/nexus1000v_qos/qos_6dscp_val.pdf

    2. C

       ccie_race

       2024-04-14

       3 upvotes

       Option A is correct Default value of DSCP is 'Best Effort' which has value of '0' https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0/qos/configuration/guide/nexus1000v_qos/qos_6dscp_val.pdf

    3. P

       pluissenbol

       2024-10-25

       Selected A2 upvotes

       A is correct. Set default value of DSCP is 0, which is 'Best Effort'. https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10103-dscpvalues.html

    4. J

       jefranca

       2023-05-04

       1 upvote

       Yes, it's A, coz all remaining traffic must be marked with a DSCP value of 0, and this is default and not af10

12. Question 12 of 25

    

    Refer to the exhibit. A Cisco engineer is implementing gRPC dial-out on an ASR. Receiver 192.168.1.1 will be assigned one of the subscriptions, and it will manage the ASR. Which command is needed to complete the router configuration?

    • Aprotocol tcp
    • Bprotocol any
    • Cprotocol grpc
    • Dprotocol all

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    It's A supported transport mechanisms: 1. gRPC: used for both dial-in and dial-out modes. 2. TCP: used for only dial-out mode. 3. UDP: used for only dial-out mode But to gRPC command: "protocol grpc tls-hostname <>" or "protocol grpc no-tls". Missing after grpc https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-6/telemetry/configuration/guide/b-telemetry-cg-asr9000-66x/b-telemetry-cg-asr9000-66x_chapter_010.html

    Adapted from community discussion by jefranca · 2023-05-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. D

       DUsoo

       2024-09-01

       Selected C2 upvotes

       gRPC Dial-Out Router Config: RP/0/RP0/CPU0:SunC(config)#telemetry model-driven RP/0/RP0/CPU0:SunC(config-model-driven)# destination-group DGroup2 RP/0/RP0/CPU0:SunC(config-model-driven-dest)# address family ipv4 172.30.8.4 port 57500 RP/0/RP0/CPU0:SunC(config-model-driven-dest-addr)# encoding self-describing-gpb RP/0/RP0/CPU0:SunC(config-model-driven-dest-addr)# protocol grpc RP/0/RP0/CPU0:SunC(config-model-driven-dest-addr)# commit https://xrdocs.io/telemetry/tutorials/2016-07-21-configuring-model-driven-telemetry-mdt/

    2. C

       ccie_race

       2024-04-15

       1 upvote

       Dial-in mode: The receiver dials in to the router and dynamically subscribes to one or more sensor paths or subscriptions. The router acts as the server and the receiver is the client. The router streams telemetry data through the same session. The dial-in mode of subscriptions is dynamic. This dynamic subscription terminates when the receiver cancels the subscription or when the session terminates. Dial-out mode: The router dials out to the receiver. This mode of operation is the default one. The router acts as a client and receiver acts as a server. In this mode, sensor paths and destinations are configured and bound together into one or more subscriptions. The router continually attempts to establish a session with each destination in the subscription and streams data to the receiver. The dial-out mode of subscriptions is persistent. When a session terminates, the router continually attempts to re-establish a new session with the receiver every 30 seconds.

    3. E

       elroy909

       2023-06-07

       4 upvotes

       If the engineer is implementing gRPC dial-out, then surely the protocol used would be gRPC? I think answer should be C

    4. U

       ubuntu1234

       2023-06-30

       3 upvotes

       "If only the protocol grpc is configured without tls option, tls is enabled by default and tls-hostname defaults to the IP address of the destination" , grpc can be configured without any options as well.

13. Question 13 of 25

    The administrator of a small company network notices that intermittent network issues occasionally cause inbound notifications to its SNMP servers to be lost. Which configuration must the administrator apply so that the SNMP servers acknowledge the notifications that they receive?

    • Asnmp-server enable traps snmp
    • Bsnmp-server enable traps bgp snmp-server host 192.168.2.1 informs
    • Csnmp-server host test.cisco.com public snmp-server community ciscotest rw 10
    • Dsnmp-server community ciscotest rw 10

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    I think that the correct answer is A https://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/n5k/commands/snmp-server-enable-traps.html To enable the Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps command. To disable SNMP notifications, use the no form of this command.

    Adapted from community discussion by rokk_cm · 2022-12-03 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. J

       jmbp12

       2023-10-13

       3 upvotes

       Traps and Informs Unsolicited (asynchronous) notifications can be generated as traps or inform requests (informs). Traps are messages alerting the Simple Network Management Protocol (SNMP) manager to a condition on the network. Informs are traps that include a request for confirmation of receipt from the SNMP manager. Notifications can indicate improper user authentication, restarts, the closing of a connection, loss of connection to a neighbor device, or other significant events. Traps are less reliable than informs because the receiver does not send an acknowledgment when it receives a trap. The sender does not know if the trap was received. An SNMP manager that receives an inform acknowledges the message with an SNMP response protocol data unit (PDU). If the sender never receives a response, the inform can be sent again. Thus, informs are more likely to reach their intended destination. B is the correct answer.

    2. P

       Pund

       2022-12-26

       6 upvotes

       B is correct. When router sends informs, the SNMP server has to acknowledge the Informs. If the server does not send ACK, then router will send inform again.

    3. R

       rokk_cm

       2022-12-03

       5 upvotes

       I think that the correct answer is A https://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/n5k/commands/snmp-server-enable-traps.html To enable the Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps command. To disable SNMP notifications, use the no form of this command.

    4. L

       lasalsa

       2023-03-01

       2 upvotes

       You are correct. This example is a bet messed-up I think. The following links has the answer https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-inf-req-review.pdf Traps are less reliable than informs because an acknowledgment is not sent from the receiving end when a trap is received; however, an SNMP manager that receives an inform acknowledges the message with an SNMP response PDU. If the sender does not receive a response for an inform, the inform can be sent again

14. Question 14 of 25

    

    Refer to the exhibit. A network engineer is deploying SNMP configuration on client's routers. Encrypted authentication must be included on router 1 to provide security and protect message confidentiality. Which action should the engineer perform on the routers to accomplish this task?

    • Asnmp-server community public
    • Bsnmp-server group group1 v3 auth
    • Csnmp-server host 192.168.0.254 informs version 3 auth testuser config
    • Dsnmp-server user testuser group1 remote 192.168.0.254 v3 auth md5 testpassword

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    I think D is correct. The question mentions 'encrypted authentication'. I cannot find any encryption option available for group authentication. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/5700/snmp-xe-3se-5700-book/nm-snmp-snmpv3.pdf => on page 5 the snmp-server group and snmp-server user commands are explained

    Adapted from community discussion by serban_17 · 2021-06-26 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. S

       serban_17

       2021-06-26

       8 upvotes

       I think D is correct. The question mentions 'encrypted authentication'. I cannot find any encryption option available for group authentication. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/5700/snmp-xe-3se-5700-book/nm-snmp-snmpv3.pdf => on page 5 the snmp-server group and snmp-server user commands are explained

    2. N

       nottoday2077

       2023-02-08

       6 upvotes

       You would need both B and D to make this correct. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/15-e/snmp-15-e-book.pdf Page 8 has this same exhibit, can clearly see it is for noauth. Right below is the example for auth, would would be answers B and D. Page 2 you can clearly see auth is for authentication encryption. Page 3 also shows that there is no mix and matching from server to router configuration. You can't have no auth and received an auth password, or an auth password with noauth without getting an error.

    3. Z

       zhukov1

       2023-06-27

       Selected D3 upvotes

       The "snmp-server user testuser group1 remote 192.168.0.254" line from the exhibit will not be accepted without at least "v3" keyword, so this eliminates B. I tested the configuration on a router, and user authentication works if entered as in D.

    4. E

       enco

       2024-07-21

       Selected D1 upvote

       Option D achieves the goal. The group sets the min security level for all users. From the snip, the min level is no auth. No need to change it to auth. What is needed is to define users with a no auth or higher security level. Option D creates a user with a higher security level.

15. Question 15 of 25

    

    Refer to the exhibit. What does this REST API script configure?

    • AVRF
    • Binterface with IP address 192.168.0.1
    • Capplication profile
    • Dpublic community string for SNMP

    Show answer

    Correct answer: A

    How others answered

    • A50%
    • B50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    From this link: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/rest-api-config/Cisco-APIC-REST-API-Configuration-Guide-401/Cisco-APIC-REST-API-Configuration-Guide-401_chapter_01101.html Configure the tenant, VRF, and bridge domain. (Answer A) The example is pretty much identical to the question. Now, on step 3 of link: Configure the node and interface. This example configures VRF v1 on node 103 (the border leaf switch), with the node profile, nodep1, and router ID 11.11.11.103. It also configures interface eth1/3 as a routed interface (Layer 3 port), with IP address 12.12.12.1/24 and Layer 3 domain dom1. Clearly, what the step said is configure node and INTERFACE. Basically Answer B is talking about this one. Correct answer is A.

    Adapted from community discussion by Seele · 2024-07-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. S

       Seele

       2024-07-30

       3 upvotes

       From this link: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/rest-api-config/Cisco-APIC-REST-API-Configuration-Guide-401/Cisco-APIC-REST-API-Configuration-Guide-401_chapter_01101.html Configure the tenant, VRF, and bridge domain. (Answer A) The example is pretty much identical to the question. Now, on step 3 of link: Configure the node and interface. This example configures VRF v1 on node 103 (the border leaf switch), with the node profile, nodep1, and router ID 11.11.11.103. It also configures interface eth1/3 as a routed interface (Layer 3 port), with IP address 12.12.12.1/24 and Layer 3 domain dom1. Clearly, what the step said is configure node and INTERFACE. Basically Answer B is talking about this one. Correct answer is A.

    2. H

       hk9042

       2023-01-27

       4 upvotes

       https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/rest-api-config/Cisco-APIC-REST-API-Configuration-Guide-401/Cisco-APIC-REST-API-Configuration-Guide-401_chapter_01101.html onfigure the tenant, VRF, and bridge domain. This example configures tenant t1 with VRF v1 and bridge domain bd1. The tenant, VRF, and BD are not yet deployed. Example: />

    3. E

       elroy909

       2022-12-09

       4 upvotes

       I doubt its A as can’t see and RD or RT, more likely to be B as would be adding ip to an exiting interface where the vrf is already configured. So I’d go with B

    4. R

       rm868

       2022-11-11

       2 upvotes

       I think its A. This is a script for a tenant, vrf and a bridge-domain. Reference. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/rest_cfg/2_1_x/b_Cisco_APIC_REST_API_Configuration_Guide/b_Cisco_APIC_REST_API_Configuration_Guide_chapter_01110.html

16. Question 16 of 25

    An engineer must apply an 802.1ad-compliant configuration to a new switchport with these requirements: ✑ The switchport must tag all traffic when it enters the port. ✑ The switchport is expected to provide the same level of service to traffic from any customer VLAN. Which configuration must the engineer use?

    • Ainterface GigabitEthernet1/0/1 switchport mode trunk switchport trunk encapsulation dot1q encapsulation ISL bridge-domain 12
    • Binterface GigabitEthernet1/0/1 ethernet dot1ad uni c-port service instance 12 encapsulation dot1q rewrite ingress tag push dot1ad 21 symmetric bridge-domain 12
    • Cinterface GigabitEthernet1/0/1 ethernet dot1ad uni s-port service instance 12 encapsulation default rewrite ingress tag push dot1ad 21 symmetric bridge-domain 12
    • Dinterface GigabitEthernet1/0/1 ethernet dot1ad nni service instance 12 encapsulation dot1ad bridge-domain 12

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C looks correct A. there is no "encapsulation isl" option B. "C-UNI—an be either an access port or an 802.1Q trunk port. The port uses the customer bridge addresses. C. "S-UNI—an access port that provides the same service to all customer VLANs entering the interface, marking all C-VLANs entering the port with the same S-VLAN. In this mode, the customer's port is configured as a trunk port, and traffic entering the S-UNI is tagged. D. there is no "encapsulation dot1ad" option https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cether/configuration/xe-3s/asr903/16-12-1/b-ce-xe-16-12-asr900/m_ce_802_1ad_900.html https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/en/us/td/docs/switches/metro/me3600x_3800x/software/release/15-4_3_S/configuration/guide/3800x3600xscg/sw802_one_ad.html.xml

    Adapted from community discussion by thejag · 2024-08-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. T

       thejag

       2024-08-22

       4 upvotes

       C looks correct A. there is no "encapsulation isl" option B. "C-UNI—an be either an access port or an 802.1Q trunk port. The port uses the customer bridge addresses. C. "S-UNI—an access port that provides the same service to all customer VLANs entering the interface, marking all C-VLANs entering the port with the same S-VLAN. In this mode, the customer's port is configured as a trunk port, and traffic entering the S-UNI is tagged. D. there is no "encapsulation dot1ad" option https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cether/configuration/xe-3s/asr903/16-12-1/b-ce-xe-16-12-asr900/m_ce_802_1ad_900.html https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/en/us/td/docs/switches/metro/me3600x_3800x/software/release/15-4_3_S/configuration/guide/3800x3600xscg/sw802_one_ad.html.xml

    2. B

       bass12345678

       2025-02-12

       Selected C1 upvote

       https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/ce/17-1-1/b-ce-xe-17-1-asr920/b-ce-xe-17-1-asr920_chapter_01111.pdf

17. Question 17 of 25

    FRR is configured on a network. What occurs when the headend router on the path is alerted to a link failure over IGP?

    • ALSP attempts fast switching on the backup path until the primary path returns to the active state.
    • BThe headend router uses a presignaled LSP to bypass the failure point.
    • CA new backup tunnel is established past the PLR to pass through the protected nodes.
    • DBackup tunnel is established and intersects with the primary tunnel at the headend.

    Show answer

    Correct answer: B

    How others answered

    • B73%
    • A27%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer: B https://www.cisco.com/en/US/docs/ios/12_0st/12_0st10/feature/guide/fastrout.html Fast Reroute provides link protection to LSPs. This enables all traffic carried by LSPs that traverse a failed link to be rerouted around the failure. The reroute decision is completely controlled locally by the router interfacing the failed link. The headend of the tunnel is also notified of the link failure through the IGP or through RSVP; the headend then attempts to establish a new LSP that bypasses the failure.

    Adapted from community discussion by sushil_bhattacharjee · 2024-03-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. E

       Emre84

       2023-04-03

       6 upvotes

       It should be B: MPLS Fast Reroute (FRR) is a fast recovery local protection technique that protects TE LSPs from link, shared risk link group (SRLG), and node failure. One or more TE LSPs (called backup LSPs) are preestablished to protect against the failure of a link, node, or SRLG. If there is a failure, each protected TE LSP traversing the failed resource is rerouted onto the appropriate backup tunnels.

    2. S

       sushil_bhattacharjee

       2024-03-07

       Selected B2 upvotes

       Answer: B https://www.cisco.com/en/US/docs/ios/12_0st/12_0st10/feature/guide/fastrout.html Fast Reroute provides link protection to LSPs. This enables all traffic carried by LSPs that traverse a failed link to be rerouted around the failure. The reroute decision is completely controlled locally by the router interfacing the failed link. The headend of the tunnel is also notified of the link failure through the IGP or through RSVP; the headend then attempts to establish a new LSP that bypasses the failure.

    3. M

       MMP

       2023-07-10

       Selected B2 upvotes

       For me is B. FRR is always pre-signaled, backup tunnel and FRR are totally two different things. https://www.ciscopress.com/articles/article.asp?p=520184&seqNum=4 " FRR uses a local protection approach that relies on a presignaled backup TE LSP to reroute traffic in case of a failure. The node immediately next to the failure is responsible for rerouting the traffic and is the headend of the backup TE LSP."

    4. T

       thejag

       2023-06-11

       1 upvote

       From Cisco training (no link) if it even helps? The important fact to remember is that when using fast reroute, the protection kicks in as soon as the protected interface fails, which in turn forces the head end to recalculate a new path for the dynamic Cisco MPLS TE tunnel. In that brief period of time, between when the head-end of tunnel 1 realizes that the path is invalid and when the new path is calculated, the fast reroute happens via a predefined tunnel. Fast Reroute prevents end to end traffic loss during the path recalculation. When the headend of the tunnel is notified of the path failure through the IGP or through RSVP, it attempts to establish a new LSP. The headend is notified of the failure through the IGP and through RSVP. The headend then attempts to establish a new LSP that bypasses the failure (LSP rerouting).

18. Question 18 of 25

    

    Refer to the exhibit. A network administrator implemented MPLS routing between routers R1, R2, R3, and R4. AToM is configured between R1 and R4 to allow Layer 2 traffic from hosts on RA1 and RA2. A targeted MPLS session is established between R1 and R4. Which additional action must the administrator take on all routers so that LDP synchronization occurs between connected LDP sessions?

    • ADisable the MPLS LDP IGP sync holddown.
    • BConfigure OSPF or IS-IS as the routing protocol.
    • CConfigure EIGRP as the routing protocol using stub areas only.
    • DEnable MPLS LDP sync delay timers.

    Show answer

    Correct answer: B

    How others answered

    • B43%
    • D29%
    • A29%

    Only 43% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The answer is B because LDP IGP Sync is only supported on OSPF and IS-IS enabled interfaces. With EIGRP not supported, answer C is incorrect. LDP-IGP sync works like this: When a new LDP neighbor is discovered on an interface, LDP checks if the remote LDP neighbor loopback IP-address is reachable via any other interface. - If yes, LDP is first established via that other interface before IGP is allowed to setup an adjacency on this interface. - If no, the IGP adjacency is established on the interface to learn the route for the LDP neighbor loopback address, but the link is advertised with max-metric to minimize the risk of blackholing user traffic. Once LDP has established, the IGP readvertises the link with its normal metric, allowing traffic to flow over the link. Disabling the holddown only limits the length of time the IGP will wait before establishing a session on the interface, so answer A is incorrect. Sync delay is used to delay the "synchronized" message from LDP to the IGP. This is not necessary for LDP-IGP sync to function, so answer D is incorrect. https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/mpls/b-mpls/m_mp-ldp-igp-synch.html

    Adapted from community discussion by gollog · 2023-04-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. G

       gollog

       2023-04-05

       Selected B2 upvotes

       The answer is B because LDP IGP Sync is only supported on OSPF and IS-IS enabled interfaces. With EIGRP not supported, answer C is incorrect. LDP-IGP sync works like this: When a new LDP neighbor is discovered on an interface, LDP checks if the remote LDP neighbor loopback IP-address is reachable via any other interface. - If yes, LDP is first established via that other interface before IGP is allowed to setup an adjacency on this interface. - If no, the IGP adjacency is established on the interface to learn the route for the LDP neighbor loopback address, but the link is advertised with max-metric to minimize the risk of blackholing user traffic. Once LDP has established, the IGP readvertises the link with its normal metric, allowing traffic to flow over the link. Disabling the holddown only limits the length of time the IGP will wait before establishing a session on the interface, so answer A is incorrect. Sync delay is used to delay the "synchronized" message from LDP to the IGP. This is not necessary for LDP-IGP sync to function, so answer D is incorrect. https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/mpls/b-mpls/m_mp-ldp-igp-synch.html

    2. T

       thejag

       2023-06-12

       3 upvotes

       If we configure OSPF or IS-IS (Answer B) on all routers, how does LDP IGP synchronization work when there is the AToM and a targeted MPLS session between R1 and R4? Cisco say "This feature does not support targeted Label Distribution Protocol (LDP) sessions. Therefore, Any Transport over MPLS (AToM) sessions are not supported."? Can somebody explain this?

    3. A

       akm88

       2023-12-15

       2 upvotes

       i think is D When LDP is fully established and synchronized, LDP checks the delay timer: If you configured a delay time, LDP starts the timer. When the timer expires, LDP checks that synchronization is still valid and notifies the Open Shortest Path First (OSPF) process. If you did not configure a delay time, if synchronization is disabled or down, or if an interface was removed from an IGP process, LDP stops the timer and immediately notifies the OSPF process. https://www.cisco.com/content/en/us/td/docs/ios-xml/ios/mp_ldp/configuration/15-s/mp-ldp-15-s-book/mp-ldp-igp-synch.html

    4. C

       chst

       2023-01-18

       3 upvotes

       Restrictions for MPLS LDP IGP Synchronization • This feature does not support targeted Label Distribution Protocol (LDP) sessions. Therefore, Any Transport over MPLS (AToM) sessions are not supported. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_ldp/configuration/xe-3s/mp-ldp-xe-3s-book/mp-ldp-igp-synch.pdf

19. Question 19 of 25

    

    Refer to the exhibit. A network operator recently configured BGP FlowSpec for the internal IT network. What will be inferred from the configuration deployed on the network?

    • AThe policy is configured locally on CSR1 and drops all traffic for TCP ports 80 and 443
    • BThe policy is configured locally on CSR1 and currently has no active traffic
    • CThe policy is learned via BGP FlowSpec and drops all traffic for TCP ports 80 and 443
    • DThe policy is learned via BGP FlowSpec and has active traffic

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • C36%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think this is a trick question where you don't pick the apparent obvious answer, it needs more checking. The output shows what was learned from the BGP flowspec policy and in there it tells us what is configured in the policy to match, what actions and the match/drops for any active traffic: Policy is configured for: Dest:10.6.5.0/24 Destination ports 80 and 443 Actions: traffic-rate: 0 bps So traffic matching the above will be dropped We see there is active traffic from Matched 12 and Dropped 12 packets But the policy is NOT configured to drop ALL traffic (ie to any destination) for TCP ports 80 and 443, only traffic for destination 10.6.5.0/24 and ports 80 and 443. It would include TCP and UDP as the protocol has not been configured for specific protocol 6 (TCP) or 17 (UDP) C is not correct for what we see configured. I still think D is correct because indeed this policy is learned via BGP Flowsec and does have active traffic on it as shows by the Matched and Dropped counters. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSPG-3012.pdf

    Adapted from community discussion by thejag · 2023-03-07 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. M

       murmelika

       2021-06-03

       10 upvotes

       C: (bgp.1) is displayed in the clients that receive policies from bgp flowspec https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/215637-configure-bgp-ipv6-flowspec.html

    2. T

       thejag

       2023-03-07

       4 upvotes

       I think this is a trick question where you don't pick the apparent obvious answer, it needs more checking. The output shows what was learned from the BGP flowspec policy and in there it tells us what is configured in the policy to match, what actions and the match/drops for any active traffic: Policy is configured for: Dest:10.6.5.0/24 Destination ports 80 and 443 Actions: traffic-rate: 0 bps So traffic matching the above will be dropped We see there is active traffic from Matched 12 and Dropped 12 packets But the policy is NOT configured to drop ALL traffic (ie to any destination) for TCP ports 80 and 443, only traffic for destination 10.6.5.0/24 and ports 80 and 443. It would include TCP and UDP as the protocol has not been configured for specific protocol 6 (TCP) or 17 (UDP) C is not correct for what we see configured. I still think D is correct because indeed this policy is learned via BGP Flowsec and does have active traffic on it as shows by the Matched and Dropped counters. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSPG-3012.pdf

    3. N

       nolbi

       2021-04-28

       7 upvotes

       The difference between learned via BGP and locally configured https://www.noction.com/blog/ddos-mitigation

    4. E

       enco

       2024-07-12

       Selected D4 upvotes

       For a locally configured we see: RP/0/0/CPU0:P1#show flowspec ipv4 detail Fri Jul 12 02:05:45.266 UTC AFI: IPv4 Flow :Dest:88.88.88.88/32 Actions :Traffic-rate: 0 bps (policy.1.FLOWSPEC-PMAP.FLOWSPEC) For a BGP learnt wee see: PE1#show flowspec ipv4 detail AFI: IPv4 Flow :Dest:88.88.88.88/32 Actions :Traffic-rate: 0 bps (bgp.1) Statistics (packets/bytes) Matched : 0/0 Dropped : 0/0 Hence, answer is D. We are not dropping ALL traffic, only traffic for ports 80/443 to addresses 10.6.5.0/24

20. Question 20 of 25

    

    Refer to the exhibit. While troubleshooting the network, a network operator with an employee id: 1234:55:678 is trying to ping XR1. Which result should the operator expect when trying to ping to an XR1 local address?

    • AAII ICMP traffic is dropped
    • BAII ICMP traffic responds successfully
    • CICMP traffic works at a policed rate of 19 bytes per second every 100 ms
    • DICMP traffic works at a policed rate of 19 packets every 100 ms

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Answer should be A, "Ar" is Average rate limit and it's being set 0pps, so all icmp packet destined to the router will be dropped. I verified with my lab XRv9000 with setting. RP/0/RP0/CPU0:PE1#sh running-config lpts Fri Jun 11 23:53:01.911 UTC lpts pifib hardware police flow icmp local rate 0 ! RP/0/RP0/CPU0:PE1# RP/0/RP0/CPU0:PE1#show lpts pifib hardware entry location 0/0/Cpu0 | begin ICMP Fri Jun 11 23:53:41.135 UTC L4 Protocol : ICMP VRF ID : any Destination IP : any Source IP/BFD Disc: any Port/Type : Port:8 Source Port : any Is Fragment : 0 Is SYN : any Is Bundle : na Is Virtual : na Interface : any Slice : 0 V/L/T/F : 0/IPv4_STACK/0/ICMP-local DestNode : Local DestAddr : Punt Accepted/Dropped : 5/10 Po/Ar/Bu : 12/0pps/750ms State : pl_pifib_state_complete

    Adapted from community discussion by Golden_Yen · 2022-12-11 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. G

       Golden_Yen

       2022-12-11

       14 upvotes

       Answer should be A, "Ar" is Average rate limit and it's being set 0pps, so all icmp packet destined to the router will be dropped. I verified with my lab XRv9000 with setting. RP/0/RP0/CPU0:PE1#sh running-config lpts Fri Jun 11 23:53:01.911 UTC lpts pifib hardware police flow icmp local rate 0 ! RP/0/RP0/CPU0:PE1# RP/0/RP0/CPU0:PE1#show lpts pifib hardware entry location 0/0/Cpu0 | begin ICMP Fri Jun 11 23:53:41.135 UTC L4 Protocol : ICMP VRF ID : any Destination IP : any Source IP/BFD Disc: any Port/Type : Port:8 Source Port : any Is Fragment : 0 Is SYN : any Is Bundle : na Is Virtual : na Interface : any Slice : 0 V/L/T/F : 0/IPv4_STACK/0/ICMP-local DestNode : Local DestAddr : Punt Accepted/Dropped : 5/10 Po/Ar/Bu : 12/0pps/750ms State : pl_pifib_state_complete

    2. M

       Mrtadge

       2023-02-11

       2 upvotes

       I don’t think you can control the average rate though ? I.e you can’t set it to 0, it populate automatically based on the flow that’s coming in over a certain period of time. As far as I know, this just means it’s been idle for a bit but it’s not configured to 0. It also has a high number of accepted and a low number of dropped, suggesting it’s working for ICMP most of the time. C and D aren’t right because the The police rate is in PPS (the Bu is for burst traffic so that 100 isn’t relevant things in the answers). So I think ICMP traffic responds successfully since there is no average traffic at present, therefor no reason for the police to kick in when an ICMP comes in. Answer for me I is B

    3. I

       ijangulashvili

       2023-10-27

       Selected A3 upvotes

       The correct answer is A tested on ASR9001, set "AR" rate to 0 with this command: lpts pifib hardware police flow icmp local rate 0 and there were no ICMP replies at all

    4. M

       mr_warrior

       2024-09-04

       Selected A3 upvotes

       I also did the same tests. icmp ping stops working as soon as 0pps is set.

21. Question 21 of 25

    

    Refer to the exhibit. The CE router is peering with both PE routers and advertising a public prefix to the internet. Routing to and from this prefix will be asymmetric under certain network conditions, but packets must not be discarded. Which configuration must an engineer apply to the two PE routers so that they validate reverse packet forwarding for packets entering their Gi2 interfaces and drop traffic from the RFC1918 space?

    • Aip verify unicast source reachable-via rx allow-default
    • Binterface GigabitEthernet 2 ip verify unicast source reachable-via rx
    • Cip verify unicast source reachable-via any allow-default interface GigabitEthernet 2
    • Dip verify unicast source reachable-via any

    Show answer

    Correct answer: B

    How others answered

    • B54%
    • D46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    By the way: line "interface GigabitEthernet 2" does not belong to option C, is an error. That entry actually belongs to option D, so: interface GigabitEthernet 2 ip verify unicast source reachable-via any Here is the difference btween "any" and "rx" any: Examines incoming packets to determine whether the source address is in the Forwarding Information Base (FIB) and permits the packet if the source is reachable through any interface (sometimes referred to as loose mode). rx: Examines incoming packets to determine whether the source address is in the FIB and permits the packet only if the source is reachable through the interface on which the packet was received (sometimes referred to as strict mode). With this in place, for asymetric routing to occur (I have seen this when unexpected failovers) option "any" is the best. Go for option D 100%.

    Adapted from community discussion by Mephystopheles · 2023-06-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. K

       karen1337

       2023-10-23

       3 upvotes

       I think this question is trying to trick you by talking about asymmetric routing. It's hoping you'll see "asymmetric" and just reflexively choose D without reading the question carefully. Loose mode should be used if we were enabling URPF on the CE router's Gi2 and Gi3 interfaces. But since we're configuring this on the PE routers towards the customer, and each PE only has one connection to the CE, strict mode will not cause any problems. Loose mode is only needed when you have more than one interface that can be used to reach a certain destination. In this case, each PE only has one interface to the CE.

    2. M

       Mephystopheles

       2023-06-27

       2 upvotes

       By the way: line "interface GigabitEthernet 2" does not belong to option C, is an error. That entry actually belongs to option D, so: interface GigabitEthernet 2 ip verify unicast source reachable-via any Here is the difference btween "any" and "rx" any: Examines incoming packets to determine whether the source address is in the Forwarding Information Base (FIB) and permits the packet if the source is reachable through any interface (sometimes referred to as loose mode). rx: Examines incoming packets to determine whether the source address is in the FIB and permits the packet only if the source is reachable through the interface on which the packet was received (sometimes referred to as strict mode). With this in place, for asymetric routing to occur (I have seen this when unexpected failovers) option "any" is the best. Go for option D 100%.

    3. I

       IcQ

       2023-05-24

       3 upvotes

       Because of this statement: "Routing to and from this prefix will be asymmetric under certain network conditions, but packets must not be discarded" if traffic can be asymmetric means that traffic can arrive to an interface that is NOT the one you will forward traffic, but since you don't want to discard packets you need the "any" keyword. And since you don't want RFC1918 (private) address then you don't need the "allow-default" keyword

    4. J

       JoostAtExamtopics

       2023-04-20

       3 upvotes

       I'd say answer D. "interface GigabitEthernet 2 ip verify unicast source reachable-via any" Reasoning here is, we cannot drop asymetric traffic, hence the need for 'loose mode'. RFC1918 will not be in the internet space thus will not be in the RIB and therefore dropped as per loose mode RPF check. Default-allow would cause RFC1918 to be resolved under 0/0 making these answers invalid.

22. Question 22 of 25

    SIMULATION -

    

    Guidelines - This is a lab item in which tasks will be performed on virtual devices. • Refer to the Tasks tab to view the tasks for this lab item. • Refer to the Topology tab to access the device console(s) and perform the tasks. • Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. • All necessary preconfigurations have been applied. • Do not change the enable password or hostname for any device. • Save your configurations to NVRAM before moving to the next item. • Click Next at the bottom of the screen to submit this lab and move to the next question. • When Next is clicked, the lab closes and cannot be reopened. Topology -

    

    Tasks - Configure the IS-IS routing protocol for R1, R2, and R3 according to the topology to achieve these goals: 1. Configure HMAC-MD5 authentication for R1, R2, and R3 links that form the IS-IS adjacency using the ISIS commands on the interfaces using these parameters: • key-chain name: AUTH_ISIS • key ID: 2 • password: C1sc0! 2. Configure ISIS metric on R1, R2, and R3 to: • 15 for each level on all interfaces that form adjacency on router R1 • 20 for each level on all interfaces that form adjacency on router R2 • 25 for each level on all interface that form adjacency on R3 3. Configure IS-IS route redistribution for all static routes and connected interfaces on R1, R2, and R3.

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    The routers have IPv6 on their interfaces. We may want to add metric wide for IPv6 af. It will be something like this: router isis 1 net 49.0000.0000.0000.0001.00 metric-style wide log-adjacency-changes all ! address-family ipv6 multi-topology exit-address-family interface range E0/0 ip router isis 1 ipv6 router isis 1 Regarding the Authentication, it really depend on what type of authentication they are asking in the exam, it could be Hello Authentication or Domain authentication or Area/LSP authentication. https://www.cisco.com/c/en/us/support/docs/ip/integrated-intermediate-system-to-intermediate-system-is-is/13792-isis-authent.html

    Adapted from community discussion by EAS22 · 2023-11-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    Answer figure

    

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. P

       picho707

       2024-06-05

       2 upvotes

       key chain AUTH_ISIS key 2 key-string C1sc0! ! interface Loopback0 ip address 10.1.1.1 255.255.255.255 ipv6 address 2000:CC13:CC13:2011::1/128 ! interface Ethernet0/0 ip address 172.20.1.1 255.255.255.0 ip router isis ipv6 address 2000:CC13:CC13:2020::1/64 ipv6 router isis isis metric 15 level-2 ! interface Ethernet0/1 ip address 172.20.2.1 255.255.255.0 ip router isis ipv6 address 2000:CC13:CC13:2030::1/64 ipv6 router isis isis metric 15 level-2 ! router isis net 49.0000.0000.0001.00 authentication mode md5 level-1 authentication mode md5 level-2 authentication key-chain AUTH_ISIS level-1 authentication key-chain AUTH_ISIS level-2 metric-style wide redistribute connected redistribute static ip !

    2. E

       EAS22

       2023-11-17

       2 upvotes

       The routers have IPv6 on their interfaces. We may want to add metric wide for IPv6 af. It will be something like this: router isis 1 net 49.0000.0000.0000.0001.00 metric-style wide log-adjacency-changes all ! address-family ipv6 multi-topology exit-address-family interface range E0/0 ip router isis 1 ipv6 router isis 1 Regarding the Authentication, it really depend on what type of authentication they are asking in the exam, it could be Hello Authentication or Domain authentication or Area/LSP authentication. https://www.cisco.com/c/en/us/support/docs/ip/integrated-intermediate-system-to-intermediate-system-is-is/13792-isis-authent.html

    3. K

       kagurakaguya

       2024-08-06

       1 upvote

       https://www.cisco.com/c/en/us/support/docs/ip/integrated-intermediate-system-to-intermediate-system-is-is/200293-IS-IS-Adjacency-and-Area-Types.html https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_isis/command/irs-cr-book/irs-a1.html https://notes.networklessons.com/isis-circuit-type-command https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_isis/configuration/15-mt/irs-15-mt-book/irs-scty.html#GUID-C7D24C37-83C2-41BB-ADA2-5DCA8C241EDC R1 enable config terminal ipv6 unicast-routing key chain AUTH_ISIS key 2 key-string C1sc0! interface Ethernet 0/0 isis circuit-type level-2-only isis authentication mode md5 isis authentication key-chain AUTH_ISIS isis metric 15 level-2 interface Ethernet 1/0 isis circuit-type level-2-only isis authentication mode md5 isis authentication key-chain AUTH_ISIS isis metric 15 level-2

    4. A

       akm88

       2023-12-23

       1 upvote

       key chain AUTH_ISIS key 2 key-string C1sco! ! ! ! ! ! cts logging verbose ! ! ! redundancy ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Ethernet0/0 ip address 172.20.3.3 255.255.255.0 ip router isis ipv6 address 2000:CC13:CC13:2040::3/64 ipv6 router isis isis circuit-type level-1 isis metric 25 level-1 isis ipv6 metric 25 level-1 ! interface Ethernet0/1 ip address 172.20.2.3 255.255.255.0 ip router isis ipv6 address 2000:CC13:CC13:2030::3/64 ipv6 router isis isis circuit-type level-2-only isis metric 25 level-2 isis ipv6 metric 25 level-2 ! interface Ethernet0/2 ip address 30.30.30.30 255.255.255.0 ! interface Ethernet0/3 no ip address shutdown ! router isis net 49.0000.0000.0003.00 authentication mode md5 authentication key-chain AUTH_ISIS metric-style wide log-adjacency-changes all redistribute connected

23. Question 23 of 25

    Which CLI mode must be used to configure the BGP keychain in Cisco IOS XR Software?

    • Arouting configuration mode
    • BBGP neighbor configuration mode
    • Cglobal configuration mode
    • DBGP address-family configuration mode

    Show answer

    Correct answer: B

    How others answered

    • B50%
    • C50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I'd say it's C as in B you only _enable that keychain to be used there for that neighbor_, but you have to actually _configure_ it in the global..

    Adapted from community discussion by martinko_f3f · 2022-03-14 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. M

       martinko_f3f

       2022-03-14

       11 upvotes

       I'd say it's C as in B you only _enable that keychain to be used there for that neighbor_, but you have to actually _configure_ it in the global..

    2. K

       KING_II

       2021-12-26

       7 upvotes

       Correct answer is B, BGP keychain is configured under nbr config modes https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/bgp/63x/b-bgp-cg-ncs5500-63x/b-bgp-cg-ncs5500-63x_chapter_010.html#task_81A7295F447946F880AB22C5D647CFF8

    3. K

       Kippie036

       2022-06-10

       Selected B3 upvotes

       I would say the answer is B. In the global configuration mode you can create a keychain, which can be used for BGP but also for ISIS or OSPF. The question is asking specifically for a BGP keychain which can be configured under the BGP neighbor configuration mode. For this reason I would say B is a more specific answer

    4. M

       Mephystopheles

       2023-02-19

       2 upvotes

       It is: B. SUMMARY STEPS configure router bgp [as-number] neighbor [ip-address] remote-as [as-number] keychain [name] Use the [commit] or [end] command. So, "Keychain Configuration" actually takes place from here: key chain key accept-lifetime key-string send-lifetime cryptographic-algorithm ! https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/bgp/63x/b-bgp-cg-ncs5500-63x/b-bgp-cg-ncs5500-63x_chapter_010.html#id_77358

24. Question 24 of 25

    

    Refer to the exhibit. While troubleshooting a connectivity issue on router R2, a network engineer with an employee id: 1234:44:876 notices that although it detects three OSPF links from R1, the OSPF prefixes are missing from the routing table. What is the reason for the problem?

    • AThe serial interfaces have different MTUs
    • BBoth loopback interfaces on R1 are configured as stub
    • CThe subnet masks on the serial interfaces are mismatched
    • DThe R2 Serial1/0 interface is configured with an IP address, but the R1 Serial1/0 interface is unnumbered

    Show answer

    Correct answer: D

    How others answered

    • D75%

    Explanation

    Answer is D. You can create an unnumbered OSPF link, however both sides need to be unnumbered and PtP. If one side is IP and the other unnumbered, OSPF stays in EXSTART and will eventually go DOWN due to to many retransmissions.

    Adapted from community discussion by nottoday2077 · 2024-06-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. B

       BobBakker

       2022-10-11

       7 upvotes

       I would guess D too. This link shows prefixes even when the interface is configured as a stub: https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/47869-ospfdb10.html

    2. C

       craterman

       2023-06-28

       Selected D6 upvotes

       The right answer is D https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7112-26.html#anc10

    3. T

       thejag

       2024-08-13

       Selected D4 upvotes

       Thanks to Craterman to the excellent Cisco guide which explains the issue and solution: https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7112-26.html#anc10

    4. N

       nottoday2077

       2024-06-28

       Selected D2 upvotes

       Answer is D. You can create an unnumbered OSPF link, however both sides need to be unnumbered and PtP. If one side is IP and the other unnumbered, OSPF stays in EXSTART and will eventually go DOWN due to to many retransmissions.

25. Question 25 of 25

    Which task must be performed first to implement BFD in an IS-IS environment?

    • AConfigure BFD in an interface configuration mode.
    • BDisable Cisco Express Forwarding on all interfaces running routing protocols other than IS-IS.
    • CConfigure all IS-IS routers as Level 2 devices.
    • DConfigure BFD under the IS-IS process.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fs_bfd.html#wp1131797

    Adapted from community discussion by cipikacipiki · 2022-03-11 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-501 or CertExamHQ.

    1. C

       cipikacipiki

       2022-03-11

       13 upvotes

       A is seems to be a correct answer and it is possible to do it that way. but if we think deeper about the questions there are 2 steps involved. it asked "first" steps to do, which is to enable "bfd all-interfaces" in the routing process and then only disable isis bfd on unnecessary interfaces. So I vote for D answer.

    2. B

       bobby_t

       2021-09-18

       4 upvotes

       A is correct because you can enable it on per interface basis rather than in the routing process for all interfaces

    3. [

       [Removed]

       2021-10-11

       4 upvotes

       I hate this question too... IOS XR - router isis config.. IOS XE - Interface config

    4. S

       serban_17

       2022-06-24

       3 upvotes

       For IOS: Step 1. Disable sending ICMP redirect messages Step 2. Enable BFD on an interface. Step 3. Configure the routing protocol client. For IOS XR all bfd configuration is done under the routing protocol. I guess the IOS type is clearly mentioned on the exam.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-501 practice, question 1 of 25