Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation
The exhibit shows a URL of the form https://192.168.1.100/api/mo/uni/tn-ciscotest.xml. The /api/mo/uni/ path is specific to the Cisco APIC (Application Policy Infrastructure Controller) REST API, where mo stands for managed object and uni is the policy universe root. The URL targets the tn-ciscotest managed object, which represents a tenant named ciscotest in the ACI fabric. Sending an HTTP request to this URL allows the client to perform operations such as create, read, update, or delete on that managed object. Therefore, this URL is used to send a message to the APIC to perform an operation on a managed object or class operator. This makes option C the correct answer.

Why the Other Options Are Incorrect:

A. It is used to contact a URL filter to determine the efficacy of a web address – The URL is a REST API endpoint for the APIC, not a URL filter or web-reputation service. The path structure clearly indicates ACI managed object access.

B. It is used to send a TACACS+ authentication request to a server – TACACS+ uses TCP port 49 and does not use the /api/mo/uni/ REST path. This URL is unrelated to TACACS+ authentication.

D. It is used to initiate an FTP session to save a running configuration of a device – The URL uses HTTPS, not FTP, and it targets the APIC REST API, not a file transfer mechanism for saving configurations.

Reference:
Cisco APIC REST API Configuration Guide – Managed Objects and the /api/mo/uni/ Path; Cisco ACI Fundamentals; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

Explanation:

To provide Internet access to a major customer through a separate dedicated VPN in an MPLS design, the Internet gateway router must inject the full Internet BGP routing table into that dedicated Internet access VRF. This VRF is then linked to the customer VRF through matching route targets, allowing the customer to receive Internet routes and forward traffic to the Internet gateway. The key design attribute is that the Internet gateway inserts the full Internet BGP routing table into the Internet access VPN, which makes the Internet reachable for the customer through that dedicated VPN. This makes option B the correct answer.

Why the other options are incorrect:

A. The customer that needs the Internet access service is assigned to the same RTs as the Internet gateway – Simply sharing route targets does not automatically provide Internet access. The Internet gateway must also inject the Internet routing table into the VPN, which option B describes. Without the full Internet table, matching RTs alone would not deliver Internet reachability.

C. The Internet gateway router is connected as a PE router to the MPLS backbone – Connecting the Internet gateway as a PE router is part of the topology, but it is not the design attribute that actually provides Internet access. The critical element is the injection of the full Internet BGP table into the Internet access VPN.

D. The CE router supports VRF-Lite and the full BGP routing table – Requiring the CE router to support VRF-Lite and carry the full BGP table would place the burden on the customer edge and is not the standard MPLS design for providing Internet access through a dedicated VPN. The service provider's Internet gateway handles the Internet routing table injection.

Reference:

RFC 4364 – BGP/MPLS IP Virtual Private Networks (VPNs); Cisco IOS XR MPLS Configuration Guide – Implementing MPLS L3VPN: Internet Access and Shared Services; Cisco 350-501 SPCOR Official Cert Guide, MPLS L3VPN chapter.

Explanation
The exhibit shows a route-policy named "ciscotest" with the logic: if the destination matches acl10, then pass; otherwise, set local-preference 300. In Cisco IOS XR route-policy syntax, the pass statement means the route is accepted and no further actions in that policy are applied to it. The else branch applies to routes that do not match acl10, and those routes have their local-preference set to 300. Therefore, traffic matching acl10 is allowed (passed) without any change to its local-preference, while traffic that does not match acl10 gets local-preference 300. This makes option A the correct answer.

Why the Other Options Are Incorrect

B. All traffic that matches acl10 is dropped without any change to its local-preference
The pass statement does not drop traffic; it accepts it. Dropping would require a drop statement, which is not present.

C. If traffic matches acl10, it is allowed and its local-preference is set to 300
The pass statement exits the policy immediately, so the set local-preference 300 in the else branch is not applied to matching traffic. Only non-matching traffic gets local-preference 300.

D. All traffic is assigned a local-preference of 300 regardless of its destination
Traffic that matches acl10 is passed without the local-preference change, so not all traffic receives local-preference 300.

Reference
Cisco IOS XR Routing Configuration Guide – Implementing Routing Policy: Route-Policy Statements and Actions;
RFC 4271 – A Border Gateway Protocol 4 (BGP-4);
Cisco 350-501 SPCOR Official Cert Guide, BGP and Routing Policy sections.

Explanation

Non-Stop Routing (NSR) maintains control-plane state synchronization between the active and standby Route Processors (RPs) so that routing protocols and MPLS LDP sessions continue without disruption during an RP switchover. The two correct factors are: NSR consumes more memory and CPU resources than NSF because it continuously synchronizes protocol state (such as BGP tables, LDP bindings, and RIB) between the active and standby RPs, and NSR operates normally without NSR support on the PE peers because the redundancy is handled internally within the router — the peers do not need to be NSR-capable. This makes options A and B the correct answers.

Why the Other Options Are Incorrect

C. It requires all PE-CE sessions to support NSR
NSR does not require the PE-CE sessions or any peer to support NSR. The state synchronization occurs internally between the active and standby RPs on the same router, so the remote peers are unaware of the switchover.

D. It requires routing protocol extensions
NSR does not require routing protocol extensions. It relies on internal state synchronization between RPs, not on protocol extensions or helper mechanisms like those used by graceful restart (NSF). This is one of its advantages over NSF.

E. It cannot sync state information across redundant RPs
This is the opposite of what NSR does. The core function of NSR is precisely to synchronize state information across redundant RPs so that a switchover is seamless and does not disrupt routing or forwarding.

Reference
Cisco IOS XR High Availability Configuration Guide – Non-Stop Routing (NSR);
Cisco 350-501 SPCOR Official Cert Guide, Network Assurance and High Availability sections.

Explanation
The exhibit shows the LPTS (Local Packet Transport Services) PIFIB hardware entry for ICMP traffic on XR1. The Port/Type field shows Port:8, which corresponds to ICMP. The DestAddr is Punt, meaning ICMP traffic destined to a local address on XR1 is punted to the control plane for processing. The Po/Ar/Bu field shows 19/0pps/100ms, which indicates that ICMP traffic is policed at a rate of 19 packets per second per 100 ms. The State is pl_pifib_state_complete, meaning the entry is fully programmed and operational. Therefore, when pinging an XR1 local address, ICMP traffic works but is policed at a rate of 19 packets every 100 ms. This makes option D the correct answer.

Why the Other Options Are Incorrect

A. ICMP traffic works at a policed rate of 19 bytes per second every 100 ms
The Po/Ar/Bu field shows 19 pps, not 19 bytes per second. The unit is packets per second, not bytes.

B. All ICMP traffic responds successfully
The entry shows a policed rate of 19 pps, meaning that traffic exceeding this rate will be dropped. Not all ICMP traffic responds successfully if the rate is exceeded.

C. All ICMP traffic is dropped
The DestAddr is Punt, meaning traffic is accepted and sent to the control plane, not dropped. The Accepted/Dropped counters (16810/14) show that most traffic is accepted, with only a small number dropped due to policing.

Reference
Cisco IOS XR LPTS (Local Packet Transport Services) Configuration Guide – LPTS PIFIB Entries and Control-Plane Policing;
Cisco 350-501 SPCOR Official Cert Guide, Network Assurance and Security sections.

Explanation

A full separation model for Internet access and MPLS L3VPN services means that Internet traffic and VPN traffic are kept entirely separate, typically using dedicated edge routers or dedicated VRFs for each service. This design gives the service provider the flexibility to decide, on a per-service basis, whether to separate or centralize each individual service. It allows independent scaling, independent policy enforcement, and independent routing for Internet and VPN services, which is the primary reason for choosing this model. This makes option A the correct answer.

Why the Other Options Are Incorrect

B. It is easier to manage a system in which services are mixed
The full separation model does the opposite of mixing services. It separates them, which is chosen for control and security reasons, not because mixing is easier to manage.

C. It requires only one edge router
A full separation model typically requires separate edge routers or separate logical instances for Internet and VPN services. It does not reduce the design to a single edge router.

D. It enables EGP and IGP to operate independently
While separation can involve different routing domains, this is not the primary reason for choosing a full separation model. The main driver is the ability to independently separate or centralize each service.

Reference
Cisco IOS XR MPLS Configuration Guide – Implementing MPLS L3VPN: Internet Access Models (Full Separation, Shared Services, Hybrid);
Cisco 350-501 SPCOR Official Cert Guide, MPLS L3VPN chapter.

Explanation

A VNF (Virtual Network Function) is a software-based implementation of a network function that traditionally ran on dedicated hardware. A firewall is a classic example of a VNF role because firewalls can be virtualized and deployed as software instances in an NFV (Network Functions Virtualization) environment, performing security functions such as packet filtering, stateful inspection, and intrusion prevention. This makes option C the correct answer.

Why the Other Options Are Incorrect

A. Compute
Compute is a resource domain (CPU, memory) in NFV infrastructure, not a VNF role. It provides the processing capacity on which VNFs run.

B. Network
Network is also a resource domain (switching, routing, connectivity) in NFV infrastructure, not a VNF role. It provides the connectivity between VNFs and external networks.

D. Storage
Storage is a resource domain (disk, object storage) in NFV infrastructure, not a VNF role. It provides the persistent data storage for VNFs and management systems.

Reference
ETSI GS NFV 002 – Network Functions Virtualisation (NFV): Architectural Framework;
Cisco 350-501 SPCOR Official Cert Guide, Architecture and Virtualization section.

Explanation

The command neighbor 2.2.2.2 ttl-security hops 2 enables BGP TTL security (GTSM, Generalized TTL Security Mechanism) for the neighbor 2.2.2.2 with a hop count of 2. This means the router expects to receive BGP packets from 2.2.2.2 with a TTL value of at least 255 minus 2, which equals 253. Packets with a TTL lower than 253 are dropped. This mechanism protects against spoofed BGP packets from attackers that are more than 2 hops away. Therefore, the PE accepts BGP packets from 2.2.2.2 with a TTL of 253 or more. This makes option A the correct answer.

Why the Other Options Are Incorrect

B. From 2.2.2.2, with a TTL of less than 2
TTL security does not accept low TTL values. It requires the minimum TTL to be 253, so packets with a TTL less than 2 would be dropped, not accepted.

C. To 2.2.2.2, with a TTL of less than 253
The command applies to packets received from the neighbor, not sent to the neighbor, and it accepts TTLs of 253 or more, not less than 253.

D. To 2.2.2.2, with a TTL of 2 or more
The direction is wrong (inbound, not outbound), and the TTL threshold is wrong (253 or more, not 2 or more).

Reference
RFC 5082 – The Generalized TTL Security Mechanism (GTSM);
Cisco IOS XR Routing Configuration Guide – Implementing BGP: TTL Security;
Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.

Explanation

The exhibit shows R1 configured with router isis area1, a loopback 0 with IPv6 address, and Ethernet 1/2 with IPv6 address and ipv6 router isis area1. The requirement is to advertise only network prefixes associated with passive interfaces. To accomplish this, the engineer must configure passive-interface on the interfaces that should be advertised but not form adjacencies, and then use the advertise passive-only command under the IPv6 address family to advertise only those passive interface prefixes. Option A correctly configures passive-interface loopback 0 under the IS-IS process, then enters address-family ipv6 and configures advertise passive-only. This ensures that only the loopback prefix (the passive interface) is advertised, while the Ethernet interface does not have its prefix advertised. This makes option A the correct answer.

Why the Other Options Are Incorrect

B. Option B
It configures address-family ipv6 with advertise passive-only but does not configure any passive interface. Without a passive interface defined, no prefixes are advertised, so this does not satisfy the requirement.

C. Option C
It includes passive-interface loopback 0 but uses the incorrect syntax loopback 0 passive-interface and includes prc-interval 20, which is unrelated to the requirement. The syntax is wrong, so this configuration would not work as intended.

D. Option D
It configures passive-interface loopback 0 but does not include the advertise passive-only command under the IPv6 address family. Without that command, IS-IS would advertise prefixes from all interfaces, not just passive ones.

Reference
Cisco IOS XR Routing Configuration Guide – Implementing IS-IS: Passive Interfaces and Advertise Passive-Only;
RFC 5308 – Routing IPv6 with IS-IS;
Cisco 350-501 SPCOR Official Cert Guide, IS-IS chapter.

Explanation

R1 is configured with neighbor 192.168.1.2 remote-as 65012, and R2 is configured with neighbor 192.168.1.3 remote-as 65000 plus neighbor 192.168.1.3 local-as 65112. The local-as 65112 on R2 tells R2 to present itself as AS 65112 to R1 during BGP peering. However, R1 expects the peer to be in AS 65012, not AS 65112. Because the AS number R1 expects (65012) does not match the AS number R2 presents (65112), the BGP session will not establish. R1 will reject R2's OPEN message due to the AS mismatch. This makes option B the correct answer.

Why the Other Options Are Incorrect

A. The neighbor relationship will be up only if the two devices have activated the correct neighbor relationships under the IPv4 address family
While address family activation is required for prefix exchange, the primary reason the session fails here is the AS number mismatch caused by the local-as configuration, not address family activation.

C. The neighbor relationship is up
The relationship is not up because R1 expects AS 65012 while R2 presents AS 65112. The AS numbers do not match, so the session fails.

D. The neighbor relationship is down because the local-as value for R2 is missing in the R1 neighbor statement
The local-as keyword is configured on R2, which is correct. The problem is that R2's local-as 65112 does not match the remote-as 65012 configured on R1. R1 does not need a local-as statement for R2; it needs its remote-as to match what R2 presents.

Reference
Cisco IOS XR Routing Configuration Guide – Implementing BGP: Neighbor local-as and remote-as;
RFC 4271 – A Border Gateway Protocol 4 (BGP-4);
Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.