Free Practice Questions for Cisco 350-501 Exam

R1

router ospf 10

redistribute static

int et0/0

ip ospf hello-interval 5

ip ospf dead-interval 10

ip ospf cost 15

ip ospf 10 area 0

copy run start

R2

router ospf 10

redistribute static

int et0/0

ip ospf hello-interval 5

ip ospf dead-interval 10

ip ospf cost 15

ip ospf 10 area 0

copy run start

In the Pipe model of MPLS QoS, the MPLS EXP bits are set by the Customer Edge (CE) device. This model allows the CE to mark the packets, and these markings are retained throughout the MPLS network until they reach the egress Provider Edge (PE) router. The PE router does not alter the MPLS EXP value, ensuring that the QoS policy applied by the customer is preserved end-to-end.

the configuration should ensure that VRF ABC and XYZ have route targets that allow them to import routes from VRF CENTRAL, but not from each other. This can be achieved by careful manipulation of route targets and import/export policies within the VRF configurations456.

In a multivendor network environment, it is essential to configure OSPF NSF with the IETF standard to ensure compatibility across different vendor devices. The command router ospf 1 nsf ietf enables OSPF NSF capability using the IETF standard, which facilitates uninterrupted forwarding during a route processor switchover.

To enable LDP session protection for LDP neighbors within each VRF, the engineer should configure LDP session protection within the individual VRFs. This ensures that LDP sessions are protected at the VRF level, providing security and stability for MPLS-based services. By enabling LDP session protection within each VRF, the router will take appropriate actions to protect LDP sessions against misbehaving neighbors or potential attacks. References: Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0

The correct configuration for PE1 to connect AS 200 of the service provider with AS 100 of enterprise ABC using BGP, considering the VRF RT 100:10 is already configured, would involve setting up BGP with the correct neighbor and route distinguisher settings. Option C is likely the correct choice as it specifies the BGP neighbor to be within the enterprise ABC’s AS 100 and includes the address family configuration necessary for VRF-aware BGP sessions. References := The Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course materials provide detailed instructions on configuring BGP in a service provider environment, including the use of VRFs and route distinguishers. For more information, please refer to the official Cisco documentation and course materials related to SPCOR1.

In Cisco hardware, when a high bandwidth multicast stream is sent over a Multicast VPN (MVPN), a data Multicast Distribution Tree (MDT) is specifically created for that stream. This data MDT is used in addition to the default MDT, which is used for lower-bandwidth or control traffic. The purpose of the data MDT is to optimize the transmission of high-bandwidth streams through the core of the network, ensuring that the multicast traffic is only sent to those PE routers that have local receivers for the multicast group in question. This mechanism helps in efficiently using network resources and provides a scalable solution for transmitting high-bandwidth multicast streams.

The BGPsec framework is designed to secure the AS path information in BGP updates. It uses digital signatures to validate the AS path and prevent unauthorized route manipulation. Here are the key points related to BGPsec:

Securing AS Path:

BGPsec ensures the integrity of the AS path by allowing routers to sign BGP updates using their private keys.

When a router originates a BGP route, it signs the AS path information with its private key.

Other routers can verify the signature using the corresponding public key.

This prevents malicious AS path modifications and ensures the authenticity of the advertised route.

Private Keys and Router Key Pair:

BGPsec relies on cryptographic keys for signing and verifying BGP updates.

Each router has a router key pair consisting of a private key and a corresponding public key.

The private key is kept confidential and is used for signing route updates.

The public key is distributed to other routers for verification.

Expiration Time:

Unlike regular BGP updates, BGPsec does not assign an expiration time (TTL) to route advertisements.

The absence of an expiration time ensures that the signed AS path remains valid until explicitly withdrawn.

In summary, BGPsec enhances BGP security by securing the AS path using digital signatures and private keys. It does not rely on IPsec tunnels for security1.

 To complete the implementation of the route map “ciscotest” for filtering routes to a BGP peer, the engineer must attach the route map to the BGP neighbor statement in the inbound direction. This will apply the specified filtering criteria to routes received from the BGP neighbor, thereby limiting access to restricted areas within the network as intended by the client. References := The Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course materials discuss the configuration of route maps and their application to BGP neighbors for route filtering purposes

In this scenario, gRPC dial-out mode is being used for telemetry. The receiver with IP address 192.168.1.1 will be assigned one of the subscriptions and will manage the ASR. To configure this, the router needs to use the protocol tcp command. This ensures that telemetry data is streamed out over a TCP connection to the specified receiver. Other options (A, B, and D) are not relevant for this specific use case.

 The configuration shown in the exhibit indicates a BGP FlowSpec policy that is configured locally on CSR1. This policy is designed to drop all traffic destined for TCP ports 80 and 443 for the IP address 10.6.5.0/24. The traffic rate is displayed as 0 bps, which suggests that the policy is not currently dropping any traffic. However, the matched and dropped statistics indicate that the policy has been active in the past, as it has matched and dropped packets.

The ttl-security hops 2 command sets the accepted Time to Live (TTL) value for BGP packets received from a neighbor. It is used to protect against BGP session hijacking by ensuring that BGP packets come from an expected number of router hops away. In this case, the command specifies that BGP packets from neighbor 2.2.2.2 must have a TTL of at least 253, which means they can only be 1 hop away (255 - 2 = 253) to be accepted.