Cisco 350-501 Practice Test 7
Question 60
For an original SPCOR service-provider engineering scenario, consider: An automation controller applies an unreviewed interface change on a service provider router without considering IOS XR candidate configuration and commit validation. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment.
- Check: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Check: Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device.
- Treat IOS XE running-config commands as interchangeable with every IOS XR configuration transaction.
- Change: Use the target OS configuration model and supported platform syntax, validating candidate changes and rollback behavior before deployment.
Explanation
Correct Answer
C:Required intervention: Use the target OS configuration model and supported platform syntax, validating candidate changes and rollback behavior before deployment.
E:Acceptance: Changes are accepted only through supported platform mechanisms and an invalid candidate does not silently alter unrelated service state.
Incorrect Answers
A:Change: Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment. IOS XE and IOS XR have distinct software architectures and management workflows; IOS XR supports a transactional configuration commit model.
B:Check: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test. IOS XE and IOS XR have distinct software architectures and management workflows; IOS XR supports a transactional configuration commit model.
D:IOS XE and IOS XR have distinct software architectures and management workflows; IOS XR supports a transactional configuration commit model. Applied case: An automation controller applies an unreviewed interface change on a service provider router without considering IOS XR candidate configuration and commit validation.
Question 61
A service provider network engineer is reviewing this backbone or customer-service scenario: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing. A proposed shortcut is: Deploy every virtual network function with unlimited privileges and no resource accounting because software images have no physical bottlenecks. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
- Deploy every virtual network function with unlimited privileges and no resource accounting because software images have no physical bottlenecks.
- Place each split RAN function and its xHaul link deliberately, enforcing the transport latency, timing and reliability needs for the selected functional split.
- Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment.
Explanation
Correct Answer
A:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing.
Incorrect Answers
B:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
C:This option addresses a different service provider engineering topic (5G vRAN and O-RAN xHaul transport) rather than the documented NFV VNF containers and application hosting decision.
D:Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 62
A Cisco service provider design review finds: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing. The team proposes: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
- Segment routing encodes forwarding instructions as segments; SR-MPLS labels and SRv6 IPv6 segment identifiers use different data-plane representations.
- Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
- Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior.
Explanation
Correct Answer
C:Demonstrable success requires: The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure. This principle explains the proposed technical approach, which is: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
Incorrect Answers
A:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
B:Segment routing encodes forwarding instructions as segments; SR-MPLS labels and SRv6 IPv6 segment identifiers use different data-plane representations. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:Uniform propagates QoS semantics end to end while pipe and short-pipe separate provider tunnel treatment from customer traffic with different egress behavior. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 63
The service provider operations team has not yet approved a change. Current evidence indicates: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links.
- Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
- Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links.
Explanation
Correct Answer
B:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. Applied case: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing.
Incorrect Answers
A:Examine IGP SID advertisement, SR policy candidate path, segment list and traceroute or telemetry for both normal and failed links. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
C:Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:Test spoofed and valid sources, check BGP blackhole policy scope and verify MACsec session status and counters on supported links. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 64
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted.
- The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure.
- Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes.
- Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits.
Explanation
Correct Answer
B:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. The approved implementation step was: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
Incorrect Answers
A:Spoofed ingress traffic is denied, authorized flows remain, blackholing stays scoped and required Ethernet links are authenticated and encrypted. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
C:Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:Legitimate neighbors remain established and malicious control-plane floods cannot exhaust the router CPU at configured limits. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 65
An implementation sign-off request identifies the following problem: A carrier places a virtual firewall on a congested shared compute node and assumes a VM's virtual NIC can sustain line-rate filtering with no CPU or NIC sizing. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. Verify: Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Change: Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment. Verify: Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan.
- Change: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability. Verify: Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
- Change: Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment. Verify: Capture customer DSCP, MPLS traffic class at ingress and transit, and egress queue or remark behavior under controlled congestion.
Explanation
Correct Answer
C:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. The change is successful only when: The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure.
Incorrect Answers
A:Change: Establish explicit QoS trust boundaries, bounded class marking and TE reservation policies that match measured capacity and the selected bandwidth model. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
B:Change: Match the physical access or transport technology to the fiber plant, sharing model, reach and capacity requirements before choosing optics or termination equipment. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:Change: Select and consistently implement the intended MPLS QoS tunneling model with explicit ingress classification and egress treatment. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 66
A service provider network engineer is reviewing this backbone or customer-service scenario: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning. A proposed shortcut is: Deploy every virtual network function with unlimited privileges and no resource accounting because software images have no physical bottlenecks. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Select a service model matching customer connectivity and use the required MPLS forwarding and VPN control-plane mechanisms rather than treating a transport label as tenant isolation.
- Define the selected SR data plane and explicit policy segments, then verify headend steering, supported SIDs and actual egress path.
- Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
- Deploy every virtual network function with unlimited privileges and no resource accounting because software images have no physical bottlenecks.
Explanation
Correct Answer
C:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
Incorrect Answers
A:Select a service model matching customer connectivity and use the required MPLS forwarding and VPN control-plane mechanisms rather than treating a transport label as tenant isolation. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
B:Define the selected SR data plane and explicit policy segments, then verify headend steering, supported SIDs and actual egress path. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. Use this instead: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
Question 67
A Cisco service provider design review finds: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning. The team proposes: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
- uRPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable.
- Routed optical architectures integrate packet routing and optical transport interfaces but physical-layer impairments and equipment compatibility still constrain operation.
- LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently.
Explanation
Correct Answer
A:Demonstrable success requires: The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure. Applied case: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
Incorrect Answers
B:URPF checks source reachability, RTBH can discard selected routed traffic during attacks and MACsec protects appropriate Ethernet links; none is interchangeable. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
C:Routed optical architectures integrate packet routing and optical transport interfaces but physical-layer impairments and equipment compatibility still constrain operation. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
D:LPTS and CoPP protect route-processor traffic, while BGP TTL security and authentication restrict unauthorized control sessions when configured consistently. A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
Question 68
The service provider operations team has not yet approved a change. Current evidence indicates: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device.
- Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test.
- Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan.
- Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
Explanation
Correct Answer
D:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. Applied case: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
Incorrect Answers
A:Confirm exact software release, target command hierarchy, candidate diff, commit outcome and rollback in a lab device. A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
B:Inspect received DSCP distributions, policer counters, class queue drops and reservation availability on a link saturation test. A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
C:Review span attenuation, termination equipment, optical power budget, splitter ratio and supported service rates in a documented link plan. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 69
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- The virtualized network function meets service capacity and isolation objectives under peak traffic and controlled node failure.
- Routed optical ports establish stable links within their documented performance limits and exposed errors are monitored.
- Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes.
- Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits.
Explanation
Correct Answer
A:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Routed optical ports establish stable links within their documented performance limits and exposed errors are monitored. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
C:Real-time traffic receives policy-compliant treatment while untrusted markings cannot starve other paid service classes. A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning.
D:Each access or backbone circuit uses compatible physical technology and operates within verified loss and throughput limits. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
Question 70
For an original SPCOR service-provider engineering scenario, consider: A service provider moves a routing application into containers but grants it unrestricted host privileges while omitting lifecycle and failure-domain planning. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required.
- Deploy every virtual network function with unlimited privileges and no resource accounting because software images have no physical bottlenecks.
- Change: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
- Check: Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
- Check: Map each service endpoint, customer attachment, label-switched path and VPN policy against intended reachability using a two-tenant lab.
Explanation
Correct Answer
C:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. Evidence: Benchmark representative packet rates, CPU pinning or acceleration, virtual NIC queues, failure recovery and privilege boundaries.
D:Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces. Required intervention: Size and isolate NFVI compute, networking and storage resources for each VNF or container workload and validate orchestration and availability.
Incorrect Answers
A:Change: Apply source validation or ACL policy at the correct ingress, coordinate RTBH only for approved attack targets and enable link-layer encryption where required. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
B:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.
E:Check: Map each service endpoint, customer attachment, label-switched path and VPN policy against intended reachability using a two-tenant lab. Network functions can be virtualized as VM or container workloads, but packet throughput and security depend on reserved resources and supported host interfaces.