Cisco 350-501 Practice Test 11
Question 100
For an original SPCOR service-provider engineering scenario, consider: A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model.
- Check: Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links.
- Change: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
- Result: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
- Result: Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits.
- Check: Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Explanation
Correct Answer
C:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Acceptance: Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Required intervention: Restrict and police packets destined to the routing control plane, and coordinate authenticated neighbor sessions and supported TTL-security settings.
F:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Inspect control-plane counters, BGP session state and authentication or TTL error logs during permitted and denied test connections.
Incorrect Answers
A:Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. A provider enables Generalized TTL Security Mechanism on a directly connected BGP session yet peers use incompatible hop assumptions and the adjacency will not establish.
B:Check: Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
E:Result: Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits. LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Question 101
A service provider network engineer is reviewing this backbone or customer-service scenario: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced. A proposed shortcut is: Announce a blanket blackhole for all customer prefixes and assume it provides both source validation and Ethernet encryption. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Place each split RAN function and its xHaul link deliberately, enforcing the transport latency, timing and reliability needs for the selected functional split.
- Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
- Announce a blanket blackhole for all customer prefixes and assume it provides both source validation and Ethernet encryption.
- Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model.
Explanation
Correct Answer
B:Validate the premise using: Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links.
Incorrect Answers
A:Place each split RAN function and its xHaul link deliberately, enforcing the transport latency, timing and reliability needs for the selected functional split. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
C:Announce a blanket blackhole for all customer prefixes and assume it provides both source validation and Ethernet encryption. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. uRPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable. Use this instead: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. Distinguish the two approaches by checking: Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links. Applied case: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced.
D:Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Question 102
A Cisco service provider design review finds: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced. The team proposes: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- 5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements.
- uRPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
- Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected.
- Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior.
Explanation
Correct Answer
B:Demonstrable success requires: Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted.
Incorrect Answers
A:5G RAN functional splits determine where RU DU and CU processing occurs; their transport interfaces have distinct capacity, timing and latency requirements. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
C:Service provider QoS must enforce customer trust and admission limits; DS-TE reservation models affect how traffic-class bandwidth can be shared or protected. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
D:Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Question 103
The service provider operations team has not yet approved a change. Current evidence indicates: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan.
- Map RU DU CU interfaces, packet timing source, loss and delay budgets and measure behavior during a representative congestion window.
- Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links.
- Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion.
Explanation
Correct Answer
C:If confirmed, the proportionate intervention is: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
Incorrect Answers
A:This option addresses a different service provider engineering topic (DWDM and access transport technology selection) rather than the documented uRPF RTBH MACsec and data-plane security decision.
B:Map RU DU CU interfaces, packet timing source, loss and delay budgets and measure behavior during a representative congestion window. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
D:Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Question 104
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
- Routed optical ports establish stable links within their documented performance limits and exposed errors are monitored.
- Marking and scheduling follow the selected model without unintended exposure of one customer's QoS assumptions to another.
- Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted.
Explanation
Correct Answer
D:The approved implementation step was: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
Incorrect Answers
A:Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
B:Routed optical ports establish stable links within their documented performance limits and exposed errors are monitored. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
C:Marking and scheduling follow the selected model without unintended exposure of one customer's QoS assumptions to another. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Question 105
An implementation sign-off request identifies the following problem: A provider sees spoofed-source traffic entering an access interface but relies solely on a server certificate to claim source-address validation is enforced. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use the target OS configuration model and supported platform syntax, validating candidate changes and rollback behavior before deployment. Verify: Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device.
- Change: Select a service model matching customer connectivity and use the required MPLS forwarding and VPN control-plane mechanisms rather than treating a transport label as tenant isolation. Verify: Map each service endpoint, customer attachment, label-switched path and VPN policy against intended reachability using a two-tenant lab.
- Change: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. Verify: Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links.
- Change: Validate coherent optic capabilities, router support, fiber reach and link optical telemetry before enabling routed optical connectivity. Verify: Compare optic part and platform matrix, channel power, error metrics and line-system span data on a controlled pair of links.
Explanation
Correct Answer
C:This pair links the appropriate technical correction with evidence of the actual cause. uRPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Incorrect Answers
A:This option addresses a different service provider engineering topic (Cisco IOS XE and IOS XR software architecture) rather than the documented uRPF RTBH MACsec and data-plane security decision.
B:This option addresses a different service provider engineering topic (Metro Ethernet and MPLS core architecture) rather than the documented uRPF RTBH MACsec and data-plane security decision.
D:Change: Validate coherent optic capabilities, router support, fiber reach and link optical telemetry before enabling routed optical connectivity. URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
Question 106
A service provider network engineer is reviewing this backbone or customer-service scenario: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency. A proposed shortcut is: Configure unrelated IP static routes and assume IS-IS must establish even when its interface hellos are incompatible. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Choose correct OSPF area behavior and summarization boundaries, confirming permitted external and interarea route propagation.
- Match IS-IS level operation and interface parameters before expecting LSP exchange and route installation across a service provider core link.
- Diagnose the affected protocol's actual session prerequisites and advertisement scope before changing unrelated routing controls.
- Configure unrelated IP static routes and assume IS-IS must establish even when its interface hellos are incompatible.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency.
Incorrect Answers
A:Choose correct OSPF area behavior and summarization boundaries, confirming permitted external and interarea route propagation. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
C:Diagnose the affected protocol's actual session prerequisites and advertisement scope before changing unrelated routing controls. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
D:IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
Question 107
A Cisco service provider design review finds: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency. The team proposes: Match IS-IS level operation and interface parameters before expecting LSP exchange and route installation across a service provider core link. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
- OSPF area types control which LSA classes are accepted while ABRs can summarize routes; a summary may hide unavailable more-specifics if chosen carelessly.
- BGP TCP sessions depend on correct peer identity and routed transport; external versus internal peer behavior changes next-hop and forwarding assumptions.
- OSPF SPF evaluates cumulative link costs, including configured interface cost and supported reference-bandwidth scaling, not geographic distance.
Explanation
Correct Answer
A:Demonstrable success requires: The intended Level-1 or Level-2 adjacency forms and the routers exchange consistent link-state information without dropping required hello traffic. Applied case: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency.
Incorrect Answers
B:OSPF area types control which LSA classes are accepted while ABRs can summarize routes; a summary may hide unavailable more-specifics if chosen carelessly. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
C:BGP TCP sessions depend on correct peer identity and routed transport; external versus internal peer behavior changes next-hop and forwarding assumptions. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
D:OSPF SPF evaluates cumulative link costs, including configured interface cost and supported reference-bandwidth scaling, not geographic distance. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
Question 108
The service provider operations team has not yet approved a change. Current evidence indicates: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect IS-IS neighbor state, hello capture, interface MTU and level configuration at both endpoints.
- Compare area LSDB LSA types, ABR summaries, default injection and actual endpoint reachability for inside and outside addresses.
- Check route-reflector client relationships, originator and cluster attributes, BGP next-hop resolution and the RIB versus FIB.
- Evaluate a test table with allowed, denied and boundary prefixes against actual show-policy and BGP advertised-routes evidence.
Explanation
Correct Answer
A:IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor. Applied case: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency.
Incorrect Answers
B:Compare area LSDB LSA types, ABR summaries, default injection and actual endpoint reachability for inside and outside addresses. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
C:Check route-reflector client relationships, originator and cluster attributes, BGP next-hop resolution and the RIB versus FIB. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
D:Evaluate a test table with allowed, denied and boundary prefixes against actual show-policy and BGP advertised-routes evidence. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
Question 109
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Both address families receive valid advertised next hops for the chosen topology mode and failures are diagnosed per family.
- Selected paths follow intended costs and the backup route takes over safely after a neighbor or link failure.
- The intended Level-1 or Level-2 adjacency forms and the routers exchange consistent link-state information without dropping required hello traffic.
- Stub or normal areas receive only intended advertisements and no unreachable discontiguous summary is treated as valid service connectivity.
Explanation
Correct Answer
C:IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Both address families receive valid advertised next hops for the chosen topology mode and failures are diagnosed per family. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
B:Selected paths follow intended costs and the backup route takes over safely after a neighbor or link failure. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
D:Stub or normal areas receive only intended advertisements and no unreachable discontiguous summary is treated as valid service connectivity. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
Question 110
For an original SPCOR service-provider engineering scenario, consider: Two P routers have matching IPv4 reachability but their IS-IS hello packets show mismatched Level capabilities, preventing the expected adjacency. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Check neighbor state transitions, interface MTU, hello and dead intervals, area type and network type on both peers.
- Configure unrelated IP static routes and assume IS-IS must establish even when its interface hellos are incompatible.
- Change: Match IS-IS level operation and interface parameters before expecting LSP exchange and route installation across a service provider core link.
- Change: Apply supported consistent metric style and tune link costs to the provider's intended shortest-path and capacity policy.
- Check: Inspect IS-IS neighbor state, hello capture, interface MTU and level configuration at both endpoints.
Explanation
Correct Answer
C:IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor. Acceptance: The intended Level-1 or Level-2 adjacency forms and the routers exchange consistent link-state information without dropping required hello traffic.
E:IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor. Required intervention: Match IS-IS level operation and interface parameters before expecting LSP exchange and route installation across a service provider core link.
Incorrect Answers
A:Check: Check neighbor state transitions, interface MTU, hello and dead intervals, area type and network type on both peers. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
B:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
D:Change: Apply supported consistent metric style and tune link costs to the provider's intended shortest-path and capacity policy. IS-IS adjacencies use link-local protocol hellos and compatible level, circuit and network settings; IP reachability alone does not create a neighbor.
