Cisco 350-501 Practice Test 10
Question 90
For an original SPCOR service-provider engineering scenario, consider: A backbone reserves bandwidth for traffic-engineered flows but fails to check that the selected constraint model permits overlapping reservation across service classes. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Change: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
- Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model.
- Check: Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device.
- Trust every customer high-priority packet and guarantee zero queue loss regardless of physical bandwidth and TE constraints.
Explanation
Correct Answer
A:Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected. Acceptance: Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes.
C:Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected. Evidence: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
Incorrect Answers
B:Change: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. A backbone reserves bandwidth for traffic-engineered flows but fails to check that the selected constraint model permits overlapping reservation across service classes.
D:Check: Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device. Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected.
E:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected.
Question 91
A service provider network engineer is reviewing this backbone or customer-service scenario: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic. A proposed shortcut is: Disable all BGP neighbor authentication and permit unlimited control-plane packets to eliminate session troubleshooting. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use the target OS configuration model and supported platform syntax, validating candidate changes and rollback behavior before deployment.
- Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment.
- Disable all BGP neighbor authentication and permit unlimited control-plane packets to eliminate session troubleshooting.
- Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
Explanation
Correct Answer
D:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic.
Incorrect Answers
A:Use the target OS configuration model and supported platform syntax, validating candidate changes and rollback behavior before deployment. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
C:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
Question 92
A Cisco service provider design review finds: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic. The team proposes: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior.
- DWDM multiplexes wavelength channels over fiber while xPON shares passive optical distribution and DOCSIS and xDSL use distinct access media and systems.
- LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
- 5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements.
Explanation
Correct Answer
C:Demonstrable success requires: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits. Applied case: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic.
Incorrect Answers
A:Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:DWDM multiplexes wavelength channels over fiber while xPON shares passive optical distribution and DOCSIS and xDSL use distinct access media and systems. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
D:5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 93
The service provider operations team has not yet approved a change. Current evidence indicates: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare optic part and platform matrix, channel power, error metrics and line-system span data on a controlled pair of links.
- Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan.
- Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
- Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Explanation
Correct Answer
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Applied case: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic.
Incorrect Answers
A:Compare optic part and platform matrix, channel power, error metrics and line-system span data on a controlled pair of links. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
C:Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 94
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes.
- Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
- The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure.
- Marking and scheduling follow the selected model without unintended exposure of one customer's QoS assumptions to another.
Explanation
Correct Answer
B:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
C:The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
D:Marking and scheduling follow the selected model without unintended exposure of one customer's QoS assumptions to another. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 95
An implementation sign-off request identifies the following problem: A router experiences control-plane CPU exhaustion from unauthorized BGP connection attempts but its proposed safeguard filters only transit data-plane traffic. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability. Verify: Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
- Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. Verify: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Change: Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment. Verify: Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion.
- Change: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings. Verify: Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Explanation
Correct Answer
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. The change is successful only when: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
Incorrect Answers
A:Change: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
C:Change: Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 96
A service provider network engineer is reviewing this backbone or customer-service scenario: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. A proposed shortcut is: Disable all BGP neighbor authentication and permit unlimited control-plane packets to eliminate session troubleshooting. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Select a service model matching customer connectivity and use the required MPLS forwarding and VPN control-plane mechanisms rather than treating a transport label as tenant isolation.
- Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
- Disable all BGP neighbor authentication and permit unlimited control-plane packets to eliminate session troubleshooting.
- Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
Incorrect Answers
A:This option addresses a different service provider engineering topic (Metro Ethernet and MPLS core architecture) rather than the documented Control plane policing LPTS and BGP TTL security decision.
C:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Applied case: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
D:Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 97
A Cisco service provider design review finds: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. The team proposes: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- 5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements.
- uRPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
- LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
- Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior.
Explanation
Correct Answer
C:Demonstrable success requires: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits. Applied case: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
Incorrect Answers
A:5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements. A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
B:URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
D:Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior. A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
Question 98
The service provider operations team has not yet approved a change. Current evidence indicates: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links.
- Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links.
- Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
- Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion.
Explanation
Correct Answer
C:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Confirm afterward that: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
Incorrect Answers
A:Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
D:Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 99
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted.
- Measured traffic follows the intended policy when valid and a known fallback occurs if a segment becomes unreachable.
- The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure.
- Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
Explanation
Correct Answer
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. The approved implementation step was: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
Incorrect Answers
A:Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
B:Measured traffic follows the intended policy when valid and a known fallback occurs if a segment becomes unreachable. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
C:The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure. A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
Question 100
For an original SPCOR service-provider engineering scenario, consider: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model.
- Check: Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links.
- Change: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
- Result: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
- Result: Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits.
- Check: Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Explanation
Correct Answer
C:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Acceptance: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Required intervention: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
F:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Incorrect Answers
A:Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
B:Check: Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
E:Result: Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
