350-501 practice questions 201–210

1. Question 201 · 377 in bank

   

   Refer to the exhibit. A network operator recently configured BGP FlowSpec for the internal IT network. What will be inferred from the configuration deployed on the network?

   • AThe policy is configured locally on CSR1 and drops all traffic for TCP ports 80 and 443
   • BThe policy is configured locally on CSR1 and currently has no active traffic
   • CThe policy is learned via BGP FlowSpec and drops all traffic for TCP ports 80 and 443
   • DThe policy is learned via BGP FlowSpec and has active traffic

   Show answer

   Answer: D

   Explanation

   I think this is a trick question where you don't pick the apparent obvious answer, it needs more checking. The output shows what was learned from the BGP flowspec policy and in there it tells us what is configured in the policy to match, what actions and the match/drops for any active traffic: Policy is configured for: Dest:10.6.5.0/24 Destination ports 80 and 443 Actions: traffic-rate: 0 bps So traffic matching the above will be dropped We see there is active traffic from Matched 12 and Dropped 12 packets But the policy is NOT configured to drop ALL traffic (ie to any destination) for TCP ports 80 and 443, only traffic for destination 10.6.5.0/24 and ports 80 and 443. It would include TCP and UDP as the protocol has not been configured for specific protocol 6 (TCP) or 17 (UDP) C is not correct for what we see configured. I still think D is correct because indeed this policy is learned via BGP Flowsec and does have active traffic on it as shows by the Matched and Dropped counters. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSPG-3012.pdf

   Source: Adapted from community discussion — thejag

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

2. Question 202 · 377 in bank

   

   Refer to the exhibit. Tier 2 ISP A on AS 653 is connected to two Tier 1 ISPs on AS 321 and AS 51 respectively. The network architect at ISP A is planning traffic flow inside the network to provide predictable network services. Cisco Express Forwarding is disabled on the edge router. How should the architect implement BGP to direct all traffic via the Tier 1 ISP with next-hop 7.4.5.2?

   • AImplement the BGP routing protocol and run the bgp deterministic-med command.
   • BImplement MP-BGP with a 4-byte AS number with the bgp best path compare-routerid command.
   • CImplement the BGP routing protocol and the maximum-paths 2 configuration.
   • DImplement BGP route-reflector functionality with the bgp always-compare-med configuration.

   Show answer

   Answer: A

   Explanation

   Example 3: bgp deterministic-med Enabled, bgp always-compare-med Disabled When the bgp deterministic-med command is enabled, routes from the same autonomous system are grouped together, and the best entries of each group are compared. The BGP table looks like this: entry1: AS(PATH) 100, med 200, external, rid 1.1.1.1 entry2: AS(PATH) 500, med 100, internal, rid 172.16.8.4 entry3: AS(PATH) 500, med 150, external, rid 172.16.13.1 There is a group for AS 100 and a group for AS 500. The best entries for each group are compared. Entry1 is the best of its group because it is the only route from AS 100. Entry2 is the best for AS 500 because it has the lowest MED. Next, entry1 is compared to entry2. Since the two entries are not from the same neighbor autonomous system, the MED is not considered in the comparison. The external BGP route wins over the internal BGP route, making entry1 the best route. Clearly A, the example is copy/paste from this

   Source: Adapted from community discussion — mohdema

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 203 · 377 in bank

   Select 2

   Which two features describe TI-LFA? (Choose two.)

   • ATI-LFA uses PQ or P and Q nodes on the post-convergence path to compute the backup path.
   • BPost-convergence, TI-LFA considers the next-hop neighbor to calculate the backup repair path.
   • CTI-LFA works with point of local repair when the PQ node supports only LDP capability.
   • DUnlike RLFA, TI-LFA works without the PQ node and provides double segment failure protection.
   • ETI-LFA leverages the post-convergence path that carries data traffic after a failure.

   Show answer

   Answer: AE

   Next question

4. Question 204 · 377 in bank

   How does SR policy operate in Segment Routing Traffic Engineering?

   • AAn SR policy for color and endpoint is deactivated at the headend as soon as the headend learns a valid candidate path for the policy.
   • BWhen "invalidation drop" behavior occurs, the SR policy forwarding entry is removed and the router drops all traffic that is steered into the SR policy.
   • CWhen a set of SID lists is associated with the SR policy designated path, traffic steering is ECMP-based according to the qualified cost of each SID-list.
   • DAn active SR policy installs a BSID-keyed entry in the forwarding table to steer the packets that match the entry to the SR policy SID-list.

   Show answer

   Answer: D

   Explanation

   Correct answer is D. https://datatracker.ietf.org/doc/html/draft-ietf-spring-segment-routing-policy-02 6.3. Forwarding Plane A valid SR Policy installs a BSID-keyed entry in the forwarding plane with the action of steering the packets matching this entry to the selected path of the SR Policy.

   Source: Adapted from community discussion — Mannyx

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 205 · 377 in bank

   

   Refer to the exhibit. A network engineer is implementing multicast Source-A to send a multicast stream for Receiver-A, and multicast Source-B to send a multicast stream for Receiver-B. Router RC forwards the IGMP host a report and leaves messages to IP address 192.168.10.1. How must the multicast features be implemented to prevent RB from receiving multicast flooding from Source-A?

   • AChange the helper-address value to 192.168.10.2 on RC.
   • BEnable ip pim neighbor-filter on RC interface Ge0/0.
   • CConfigure PIM-SSM on RB and RC interface Ge 0/0.
   • DEnable ip pim passive on RB interface Ge0/0.

   Show answer

   Answer: A

   Explanation

   B and D are incorrect because this will just prevent RC and RB from becoming PIM neighbors, but traffic still gets dense-mode flooded from RC to RB. That's how multicast stub routing behaves. And now RC has no way to prune it back via normal PIM mechanisms. C: It is true that PIM-SSM would stop the flooding since multicast stub routing requires dense mode flooding to work. But SSM is not configured on an interface, it's enabled globally (and any modified SSM range ACL would also have to be configured globally, if the multicast group ranges fell outside the default SSM group range) By process of elimination, A is all that's left. And it would work, although it's clumsy as hell. Ideally you'd just delete the IGMP helper-address altogether, you don't want to point it to the wrong router IP to stop it from forwarding traffic to RB.

   Source: Adapted from community discussion — kirrim

   References

   • Cisco documentation

   Next question

6. Question 206 · 377 in bank

   How does an untrusted interface at the boundary of an administrative domain handle incoming packets?

   • AIt remarks all values to a CoS of 0.
   • BIt forwards only traffic with a DSCP value of 48.
   • CIt translates the IP precedence value to the corresponding DSCP value.
   • DIt drops all traffic ingressing the network.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 207 · 377 in bank

   

   Refer to the exhibit. A network engineer wants to monitor traffic from the application server and send the output to the external monitoring device at 172.16.20.5. Application server traffic should pass through the R1 Eth2/1 interface for further analysis after it is monitored. Which configuration must be applied on the R1 router?

   • AConfigure the FLOW-MONITOR-20 command.
   • BConfigure the flow exporter EXPORTER-10 destination 192.168.20.4 command.
   • CConfigure the ip flow monitor FLOW-MONITOR-10 input command on the Ethernet1/0 interface.
   • DConfigure the ip flow monitor FLOW-MONITOR-10 output command on the Ethernet 2/1 interface.

   Show answer

   Answer: C

   Explanation

   This is simpler than it sounds. We are just monitoring the traffic for the server on Eth1/0 and sending it via the flow exporter to 172.16.20.5 which is on Eth2/1

   Source: Adapted from community discussion — thejag

   Next question

8. Question 208 · 377 in bank

   An engineering team must implement Unified MPLS to scale an MPLS network. Devices in the core layer use different IGPs, so the team decided to split the network into different areas. The team plans to keep the MPLS services as they are and introduce greater scalability. Which additional action must the engineers take to implement the Unified MPLS?

   • ARedistribute the IGP prefixes from one IGP into the other routers to ensure end-to-end LSPs.
   • BConfigure the ABR routers as route reflectors that redistribute IGP into BGP.
   • CRedistribute the IGP prefixes into another IGP to ensure end-to-end LSPs.
   • DMove the IGP prefixes into IS-IS as the loopback prefixes of the PE routers to distribute the prefixes to other routers to create end-to-end LSPs.

   Show answer

   Answer: B

   Explanation

   When using IGP in the network, the next-hop address of the prefixes is the loopback prefix of the PE routers. This prefix is not known to the IGP being used in other parts of the network. The next hop address cannot be used to recurse to an IGP prefix. To avoid this the prefixes are carried in BGP. The ABRs are configured as Route Reflectors (RR). And the RRs are configured to set the next hop to self even for the reflected iBGP prefixes. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/16-12/configuration_guide/mpls/b_1612_mpls_9600_cg/configuring_seamless_mpls.html

   Source: Adapted from community discussion — thejag

   References

   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 209 · 377 in bank

   Which OS uses a distributed subsystem architecture?

   • AIOS XE
   • BIOS
   • CIOS XR
   • DCatOS

   Show answer

   Answer: C

   Next question

10. Question 210 · 377 in bank

    

    Refer to the exhibit. ISP A provides MPLS L3VPN service to customer A with BGP as the external routing protocol. Customer A has just opened a new branch office in London and requested the service provider to implement lossless service between its two offices. The LDP is enabled over the MPLS backbone and label exchange is working normally. Which action must the ISP engineering team take to enable the service?

    • AConfigure LDP and redistribute the route from EIGRP.
    • BConfigure BGP address family VPNv4.
    • CConfigure IGP and redistribute the route from BGP.
    • DConfigure IGP LDP synchronization

    Show answer

    Answer: D

    Explanation

    They mention to provide 'lossless service' so with that maybe hinting to a feature that provides that within the MPLS backbone, being the IGP and LDP and thus synchronisation to prevent loss during convergence. I'd say D is correct but like many other questions it leaves so many variables out...

    Source: Adapted from community discussion — JoostAtExamtopics

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-501 practice, question 201. 377 questions available.