Cisco 350-501 Practice Test 56
Question 550
For an original SPCOR service-provider engineering scenario, consider: Two customers use overlapping IPv4 addresses and a provider places their routes in the same global routing table, causing misdelivery. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Map UNI endpoints and approved source-destination pairs, then test leaf-to-leaf and root-to-leaf reachability in the staged EVC.
- Set the same global VRF for all tenants and assume changing the RD alone enforces all route import policy.
- Change: Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability.
- Check: Examine VRF route tables, RD, RT extended communities, MP-BGP updates and the transport plus VPN label stack.
- Change: Enable supported ring protection and Ethernet OAM mechanisms to enforce a loop-free normal state and verify service continuity after failure.
Explanation
Correct Answer
C:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. Acceptance: Each customer reaches only its own remote sites despite overlapping addresses and the expected VPN routes import correctly.
D:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. Required intervention: Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability.
Incorrect Answers
A:Check: Map UNI endpoints and approved source-destination pairs, then test leaf-to-leaf and root-to-leaf reachability in the staged EVC. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
B:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
E:Change: Enable supported ring protection and Ethernet OAM mechanisms to enforce a loop-free normal state and verify service continuity after failure. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
Question 551
A service provider network engineer is reviewing this backbone or customer-service scenario: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing. A proposed shortcut is: Set the same global VRF for all tenants and assume changing the RD alone enforces all route import policy. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Configure consistent service and customer VLAN tag handling with explicit encapsulation and correct cross-PE mapping.
- Set the same global VRF for all tenants and assume changing the RD alone enforces all route import policy.
- Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability.
- Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths.
Explanation
Correct Answer
C:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
Incorrect Answers
A:Configure consistent service and customer VLAN tag handling with explicit encapsulation and correct cross-PE mapping. A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
B:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. Applied case: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
D:Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
Question 552
A Cisco service provider design review finds: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing. The team proposes: Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Inter-AS L3VPN designs extend VPN signaling across AS boundaries with option-specific control-plane and label requirements; route visibility does not alone prove data-plane continuity.
- IGMP manages IPv4 multicast listener memberships, MLD handles IPv6, and source-specific filtering depends on listener protocol and switch or router support.
- PIM-SM may use a rendezvous point for shared-tree discovery, while SSM uses explicit source-group state and normally avoids RP discovery.
- A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
Explanation
Correct Answer
D:Demonstrable success requires: Each customer reaches only its own remote sites despite overlapping addresses and the expected VPN routes import correctly. Applied case: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
Incorrect Answers
A:Inter-AS L3VPN designs extend VPN signaling across AS boundaries with option-specific control-plane and label requirements; route visibility does not alone prove data-plane continuity. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
B:IGMP manages IPv4 multicast listener memberships, MLD handles IPv6, and source-specific filtering depends on listener protocol and switch or router support. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
C:This option addresses a different service provider engineering topic (PIM sparse-mode SSM and rendezvous-point behavior) rather than the documented MPLS L3VPN RD RT and VRF import export decision.
Question 553
The service provider operations team has not yet approved a change. Current evidence indicates: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine VRF route tables, RD, RT extended communities, MP-BGP updates and the transport plus VPN label stack.
- Compare ESI advertisements, DF election, MAC mobility sequence and traffic behavior before and after one PE uplink failure.
- Check labeled route handoff, VRF or transport separation, next-hop reachability and a representative downstream customer LSP.
- Check class-map matches, DSCP or MPLS TC, policer violations, shaping queue depth, WRED counters and customer throughput during controlled congestion.
Explanation
Correct Answer
A:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. Confirm afterward that: Each customer reaches only its own remote sites despite overlapping addresses and the expected VPN routes import correctly.
Incorrect Answers
B:Compare ESI advertisements, DF election, MAC mobility sequence and traffic behavior before and after one PE uplink failure. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
C:Check labeled route handoff, VRF or transport separation, next-hop reachability and a representative downstream customer LSP. A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
D:This option addresses a different service provider engineering topic (QoS classification marking policing shaping and WRED) rather than the documented MPLS L3VPN RD RT and VRF import export decision.
Question 554
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Subscribers receive only authorized group and source traffic with no unnecessary replication to idle access ports.
- The customer carrier preserves its own service topology while the backbone transports authorized labeled traffic without core route explosion.
- Each customer reaches only its own remote sites despite overlapping addresses and the expected VPN routes import correctly.
- Customers reach only approved shared services and internet egress while peer-to-peer tenant access remains restricted.
Explanation
Correct Answer
C:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. The approved implementation step was: Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability.
Incorrect Answers
A:Subscribers receive only authorized group and source traffic with no unnecessary replication to idle access ports. A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing.
B:The customer carrier preserves its own service topology while the backbone transports authorized labeled traffic without core route explosion. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
D:Customers reach only approved shared services and internet egress while peer-to-peer tenant access remains restricted. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
Question 555
An implementation sign-off request identifies the following problem: A remote PE receives VPNv4 prefixes but does not import them into the expected VRF because its route-target policy is missing. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Select the supported Inter-AS VPN option and validate labeled VPN route exchange, route targets and transport next-hop resolution at each boundary. Verify: Trace VPNv4 advertisements, ASBR or RR roles, per-hop label stack and route-target import on a two-AS test topology.
- Change: Match ingress encapsulation, symmetric tag rewrite and EVC service instances to the contracted UNI format end to end. Verify: Capture tagged or untagged frames at both UNIs, check service instance counters and confirm expected VLAN identity after a full round trip.
- Change: Configure a consistent Ethernet Segment Identifier and supported designated-forwarder or split-horizon behavior for the multihoming model. Verify: Compare ESI advertisements, DF election, MAC mobility sequence and traffic behavior before and after one PE uplink failure.
- Change: Define separate VRFs with correct route distinguishers and coordinated route-target import and export policies and confirm PE-to-PE labeled reachability. Verify: Examine VRF route tables, RD, RT extended communities, MP-BGP updates and the transport plus VPN label stack.
Explanation
Correct Answer
D:A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information. The change is successful only when: Each customer reaches only its own remote sites despite overlapping addresses and the expected VPN routes import correctly.
Incorrect Answers
A:Change: Select the supported Inter-AS VPN option and validate labeled VPN route exchange, route targets and transport next-hop resolution at each boundary. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
B:Change: Match ingress encapsulation, symmetric tag rewrite and EVC service instances to the contracted UNI format end to end. A route distinguisher makes overlapping VPN routes uniquely identifiable, whereas route targets control membership and distribution of VPN routing information.
C:Change: Configure a consistent Ethernet Segment Identifier and supported designated-forwarder or split-horizon behavior for the multihoming model.
Question 556
A service provider network engineer is reviewing this backbone or customer-service scenario: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF. A proposed shortcut is: Import every customer VRF route into every other VRF as the only way to offer a single shared DNS service. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Import every customer VRF route into every other VRF as the only way to offer a single shared DNS service.
- Build the supported carrier-supporting-carrier transport and routing boundary, retaining customer-carrier control where intended and validating labeled reachability.
- Configure the supported mVPN multicast control-plane and provider transport distribution according to receiver membership and traffic scale.
- Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths.
Explanation
Correct Answer
D:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF.
Incorrect Answers
A:L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
B:Build the supported carrier-supporting-carrier transport and routing boundary, retaining customer-carrier control where intended and validating labeled reachability. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
C:Configure the supported mVPN multicast control-plane and provider transport distribution according to receiver membership and traffic scale. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
Question 557
A Cisco service provider design review finds: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF. The team proposes: Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- EVC tag operations such as push pop and translation are contextual to a service instance and may require symmetric rewrite at both attachment points.
- Carrier supporting carrier lets a provider transport another carrier's VPN or MPLS reachability without needing full visibility into every downstream end-customer route.
- MVPN extends multicast services through customer VPN contexts, using signaling and core replication trees distinct from ordinary unicast VPN route exchange.
- L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
Explanation
Correct Answer
D:Demonstrable success requires: Customers reach only approved shared services and internet egress while peer-to-peer tenant access remains restricted. Applied case: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF.
Incorrect Answers
A:EVC tag operations such as push pop and translation are contextual to a service instance and may require symmetric rewrite at both attachment points. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
B:Carrier supporting carrier lets a provider transport another carrier's VPN or MPLS reachability without needing full visibility into every downstream end-customer route. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
C:MVPN extends multicast services through customer VPN contexts, using signaling and core replication trees distinct from ordinary unicast VPN route exchange. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
Question 558
The service provider operations team has not yet approved a change. Current evidence indicates: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare imported RT lists, VRF next hops, shared service return routing and firewall policy using two customer tenants.
- Trace VPNv4 advertisements, ASBR or RR roles, per-hop label stack and route-target import on a two-AS test topology.
- Check labeled route handoff, VRF or transport separation, next-hop reachability and a representative downstream customer LSP.
- Compare ESI advertisements, DF election, MAC mobility sequence and traffic behavior before and after one PE uplink failure.
Explanation
Correct Answer
A:L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility. Applied case: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF.
Incorrect Answers
B:Trace VPNv4 advertisements, ASBR or RR roles, per-hop label stack and route-target import on a two-AS test topology. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
C:Check labeled route handoff, VRF or transport separation, next-hop reachability and a representative downstream customer LSP. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
D:This option addresses a different service provider engineering topic (EVPN multihoming Ethernet segment and split horizon) rather than the documented L3VPN extranet shared service and internet breakout decision.
Question 559
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Only authorized receiving VPN sites get the multicast data and replication uses the intended provider transport resources.
- Customers reach only approved shared services and internet egress while peer-to-peer tenant access remains restricted.
- High-priority services meet policy while excess traffic is bounded and ordinary customer classes retain their contracted forwarding share.
- Each customer's original VLAN identity is preserved or intentionally translated and service isolation remains intact across the provider.
Explanation
Correct Answer
B:L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Only authorized receiving VPN sites get the multicast data and replication uses the intended provider transport resources. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
C:High-priority services meet policy while excess traffic is bounded and ordinary customer classes retain their contracted forwarding share. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
D:This option addresses a different service provider engineering topic (Provider bridging 802.1ad Q-in-Q and VLAN boundaries) rather than the documented L3VPN extranet shared service and internet breakout decision.
Question 560
For an original SPCOR service-provider engineering scenario, consider: A customer VRF needs controlled access to a shared DNS service but the operator exports all customer routes into every other customer VRF. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths.
- Import every customer VRF route into every other VRF as the only way to offer a single shared DNS service.
- Change: Match multicast routing mode and receiver source selection, then verify PIM RPF and RP or source-tree behavior for the chosen model.
- Check: Compare imported RT lists, VRF next hops, shared service return routing and firewall policy using two customer tenants.
- Check: Inspect customer PIM state, mVPN BGP or tree signaling, receiver joins, replication counters and stream reachability between PEs.
Explanation
Correct Answer
A:L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility. Acceptance: Customers reach only approved shared services and internet egress while peer-to-peer tenant access remains restricted.
D:L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility. Required intervention: Build selective route leaking or shared-service VRF connectivity with scoped route targets and explicit security controls for shared and internet paths.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
C:Change: Match multicast routing mode and receiver source selection, then verify PIM RPF and RP or source-tree behavior for the chosen model. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
E:Check: Inspect customer PIM state, mVPN BGP or tree signaling, receiver joins, replication counters and stream reachability between PEs. L3VPN extranet services require controlled cross-VRF routing and return reachability; sharing a few service routes need not grant full tenant-to-tenant visibility.
