Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

In the Cisco IOS command `snmp-server community ciscotest ro 2`, the string `ciscotest` is the community string, `ro` grants read-only access, and the number `2` at the end is an access list number. This number references a standard IP access list that defines which SNMP managers (by source IP address) are permitted to query the router using this community string. It does not specify the SNMP version, the number of sessions, or the number of managers. This makes option A the correct answer.

Why the other options are incorrect:

B. It dictates the number of sessions that can be open with the SNMP manager
The command does not limit or define the number of SNMP sessions. SNMP sessions are not controlled by this parameter.

C. It indicates two SNMP managers can read and write with the agent using community string ciscotest
The number 2 does not specify a count of managers. It is an ACL reference, and the access is read-only (`ro`), not read-write.

D. It represents the version of SNMP running
SNMP version is not configured with this command. SNMPv1, v2c, and v3 are enabled through different commands such as `snmp-server host` or `snmp-server group`, not by a number appended to the community string.

Reference:
Cisco IOS Network Management Command Reference – snmp-server community; RFC 1157 – A Simple Network Management Protocol (SNMP); Cisco 350-501 SPCOR Official Cert Guide, Network Assurance section.

It means a data fie4d is blank

Explanation

In XML, the syntax `<tag/>` represents an empty element, which is a self-closing tag that contains no content or value. When this appears in a NETCONF or RESTCONF response, it indicates that the data field corresponding to that tag is present in the schema but has no value assigned to it — in other words, the field is blank or empty. This makes option D the correct answer.

Why the other options are incorrect:

A. It shows the ending of the script
A self-closing tag does not indicate the end of a script. Script termination is not represented by `<tag/>` in XML.

B. It indicates a break in a sequence
XML does not use self-closing tags to indicate breaks in a sequence. Sequences are represented by the ordering of elements, not by empty tags.

C. It indicates a value assigned by a network administrator to tag a route
While "tag" is a term used in routing (for example, route tags), in XML `<tag/>` is simply an empty element. It does not inherently represent a route tag or any administrator-assigned value.

Reference:
W3C XML Specification – Empty Element Tags; RFC 6241 – Network Configuration Protocol (NETCONF); RFC 7950 – The YANG 1.1 Data Modeling Language; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

Explanation

The Cisco MPLS TE forwarding adjacency feature allows an MPLS TE tunnel to be advertised into the running IGP as a link. When forwarding adjacency is enabled, the TE tunnel is treated as a directly connected link by the IGP (OSPF or IS-IS), and the headend router advertises the tunnel into the IGP so that other routers can use it for forwarding traffic. This makes the tunnel part of the IGP topology and allows traffic to be routed over it based on IGP metrics, rather than relying solely on autoroute announcements. This makes option D the correct answer.

Why the other options are incorrect:

A. It enables the headend and tailend routers to establish a bidirectional tunnel
MPLS TE tunnels are unidirectional by nature. Forwarding adjacency does not make a single tunnel bidirectional; separate tunnels are needed for each direction.

B. It enables the tailend router to advertise routes to the headend router over the tunnel
Forwarding adjacency is about advertising the tunnel itself into the IGP, not about the tailend advertising routes back to the headend. Route advertisement between the endpoints is a separate function.

C. It enables the MPLS core to use EIGRP as the routing protocol
MPLS TE forwarding adjacency works with OSPF and IS-IS, which are the link-state protocols that support TE extensions. It does not enable EIGRP for the MPLS core.

Reference:
Cisco IOS XR MPLS Configuration Guide – Implementing MPLS Traffic Engineering: Forwarding Adjacency; RFC 4206 – Label Switched Paths (LSP) Hierarchy with Generalized Multi-Protocol Label Switching (GMPLS) Traffic Engineering; Cisco 350-501 SPCOR Official Cert Guide, MPLS Traffic Engineering chapter.

Explanation

The exhibit shows `ip verify unicast reverse-path 12` configured on GigabitEthernet1/0, which enables Unicast Reverse Path Forwarding (uRPF) in strict mode with access list 12. To display per-interface statistics about uRPF drops and suppressed drops, the correct command is `show ip interface`. This command displays detailed IP interface information, including uRPF-related statistics such as the number of packets dropped due to uRPF verification failures and the number of suppressed drops (packets dropped due to uRPF checks on interfaces where uRPF is enabled). This makes option B the correct answer.

Why the other options are incorrect:

A. show ip traffic
This command displays global IP traffic statistics for the router, not per-interface uRPF drop statistics. It does not provide the per-interface breakdown needed for uRPF troubleshooting.

C. show cef interface
This command displays Cisco Express Forwarding (CEF) information for interfaces, including CEF-related statistics. While it shows some interface information, it does not specifically display uRPF drop and suppressed drop statistics.

D. show ip interface brief
This command provides a brief summary of IP interfaces, including IP address and interface status. It does not include uRPF statistics.

Reference:
Cisco IOS XR Security Configuration Guide – Unicast Reverse Path Forwarding (uRPF) and show ip interface; RFC 3704 – Ingress Filtering for Multihomed Networks; Cisco 350-501 SPCOR Official Cert Guide, Security section.

Explanation

In a Segment Routing MPLS network, the Segment Prefix (Prefix-SID) is distributed using a link-state routing protocol. OSPF (and IS-IS) can be extended to carry Prefix-SID information in their link-state advertisements, allowing routers to learn the Segment IDs associated with prefixes. This makes OSPF the correct answer among the options provided.

Why the other options are incorrect:

B. LDP
LDP is used to distribute labels in traditional MPLS networks, but Segment Routing does not use LDP for prefix SID distribution. Segment Routing replaces LDP with IGP-based SID advertisement.

C. RSVP-TE
RSVP-TE is used for MPLS Traffic Engineering to signal explicit paths and reserve bandwidth. It does not distribute Segment Prefixes.

D. EIGRP
EIGRP is a Cisco proprietary distance-vector protocol and does not support Segment Routing extensions for Prefix-SID distribution. Segment Routing requires a link-state IGP such as OSPF or IS-IS.

Reference:
RFC 8402 – Segment Routing Architecture; RFC 8665 – OSPF Extensions for Segment Routing; Cisco IOS XR Segment Routing Configuration Guide – Configuring Prefix-SIDs; Cisco 350-501 SPCOR Official Cert Guide, Segment Routing chapter.

Explanation

When Egress PE NAT is used via a single centralized router to provide Internet access to L3VPN customers, the NAT table must be able to distinguish between translations belonging to different VRFs. Because multiple VPN customers can use overlapping private address space (for example, both using 10.0.0.0/8), the NAT table must include a field that identifies the inside VRF of a translation. This allows the NAT process to correctly map return traffic back to the appropriate VRF even when the same inside local IP address is used in different VPNs. This makes option B the correct answer.

Why the other options are incorrect:

A. Users in different VRFs cannot share the same outside global IP address
Users in different VRFs can share the same outside global IP address because the VRF identifier in the NAT table keeps the translations separate. This statement is false.

C. Multiple address pools are needed for the same L3VPN because each site has a separate NAT
A single address pool can be used for a given L3VPN; separate pools are not required for each site. The NAT table handles the translation entries, so this statement is not true.

D. The different L3VPNs using the Internet access must not have IP overlaps internally
Overlapping internal IP addresses are precisely the scenario that NAT with VRF-aware translation is designed to handle. The requirement for non-overlapping addresses is not true when VRF-aware NAT is in place.

Reference:
RFC 4364 – BGP/MPLS IP Virtual Private Networks (VPNs); Cisco IOS XR NAT Configuration Guide – Configuring VRF-Aware NAT for MPLS L3VPN; Cisco 350-501 SPCOR Official Cert Guide, MPLS L3VPN and Services sections.

Explanation

MPLS OAM ping (MPLS LSP ping) uses MPLS echo request and echo reply packets to verify the integrity of an LSP. A key characteristic of MPLS OAM ping is that the echo reply does not necessarily need to follow the LSP back to the ingress router. The reply can be sent back to the ingress router using the IP routing table (via the source address of the echo request), which means an LSP is not required for the reply to reach the ingress MPLS router. This allows the ingress router to receive a reply even if the forward LSP path is partially broken, which is important for fault isolation. This makes option D the correct answer.

Why the other options are incorrect:

A. MPLS OAM ping works solely with Cisco MPLS TE
MPLS OAM ping (LSP ping) works with any MPLS LSP, not only with MPLS TE tunnels. It can be used to test LDP-signaled LSPs, RSVP-TE LSPs, and BGP-labeled LSPs.

B. MPLS OAM ping works solely with P2P LSPs
MPLS OAM ping is not limited to point-to-point LSPs. It can also be used with multipoint LSPs and other MPLS LSP types.

C. An LSP breakage results in the ingress MPLS router never receiving any reply
If the LSP is broken, the ingress router may still receive a reply from an intermediate router that generated the echo reply, or via the IP path. The ingress router can receive replies even when the LSP is broken, which is how the breakage is localized.

Reference:
RFC 4379 – Detecting Multi-Protocol Label Switched (MPLS) Data Plane Failures; Cisco IOS XR MPLS Configuration Guide – MPLS LSP Ping and Traceroute; Cisco 350-501 SPCOR Official Cert Guide, MPLS and Network Assurance sections.

Explanation

In Cisco IOS XE Software, the `mpls ldp graceful-restart` command is applied in global configuration mode. This command enables LDP Graceful Restart globally on the router, allowing LDP sessions to survive a control-plane restart or switchover by preserving the MPLS forwarding state. It is not applied under the interface, LDP neighbor, or MPLS configuration submode. This makes option C the correct answer.

Why the other options are incorrect:

A. MPLS
There is no separate "MPLS" configuration mode in IOS XE where this command is applied. The command is entered directly in global configuration mode.

B. LDP neighbor
LDP neighbor configuration mode is used for per-neighbor LDP parameters, such as password or session protection. The graceful-restart command is a global LDP setting, not a per-neighbor setting.

D. Interface
Interface configuration mode is used for interface-specific LDP settings such as `mpls ip` or `mpls ldp discovery`. The graceful-restart command is not applied at the interface level.

Reference:
Cisco IOS XE MPLS LDP Configuration Guide – Configuring LDP Graceful Restart; RFC 3478 – Graceful Restart Mechanism for Label Distribution Protocol (LDP); Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

A Segment Routing prefix segment is associated with a Prefix-SID, which is a globally unique identifier within the Segment Routing domain. The Prefix-SID is advertised by the IGP (OSPF or IS-IS) and represents the shortest path to the prefix (typically a loopback address) of a node. Because it identifies a specific node's prefix across the entire SR domain, the Prefix-SID must be unique within that domain to ensure correct forwarding. This makes option A the correct answer.

Why the other options are incorrect:

B. It is the longest path to a node
A prefix segment represents the shortest path to the node's prefix, not the longest path. Segment routing uses the IGP shortest path for prefix segments.

C. It is linked to an adjacency SID that is globally unique within the router
Adjacency SIDs are locally significant and unique only within the router that advertises them, not globally. Prefix segments are linked to Prefix-SIDs, not adjacency SIDs.

D. It requires using EIGRP to operate
Segment Routing prefix segments require a link-state IGP such as OSPF or IS-IS. EIGRP does not support Segment Routing extensions for Prefix-SID distribution.

Reference:
RFC 8402 – Segment Routing Architecture; RFC 8665 – OSPF Extensions for Segment Routing; Cisco IOS XR Segment Routing Configuration Guide – Configuring Prefix-SIDs; Cisco 350-501 SPCOR Official Cert Guide, Segment Routing chapter.

Explanation

The requirement is to rewrite VLAN tags 12 and 21 for traffic between R1 and R2 on CSR1. R1 sends traffic with VLAN 12 toward CSR1 on GigabitEthernet2, and R2 expects VLAN 21 on GigabitEthernet3. Therefore, CSR1 must translate VLAN 12 to VLAN 21 on ingress from R1 and translate VLAN 21 back to VLAN 12 on egress toward R1. Similarly, on GigabitEthernet3, CSR1 must translate VLAN 21 to VLAN 12 on ingress from R2 and translate VLAN 12 back to VLAN 21 on egress toward R2. Both interfaces must be in the same bridge domain so that Layer 2 traffic is bridged between them. Option A correctly configures this: GigabitEthernet2 uses `encapsulation dot1q 12` with `rewrite ingress tag translate 1-to-1 dot1q 21` and `rewrite egress tag translate 1-to-1 dot1q 12`, and it is placed in `bridge-domain 12`. GigabitEthernet3 uses `encapsulation dot1q 21` with `rewrite ingress tag translate 1-to-1 dot1q 12` and `rewrite egress tag translate 1-to-1 dot1q 21`, and it is placed in `bridge-domain 21`. This makes option A the correct answer.

Why the other options are incorrect:

B. Option B
It uses the same encapsulation (`dot1q 12`) on both interfaces, which is incorrect because GigabitEthernet3 must match VLAN 21 from R2. It also places both interfaces in different bridge domains (or the same domain with mismatched encapsulations), which breaks the Layer 2 bridging.

C. Option C
It configures GigabitEthernet2 with `encapsulation dot1q 12` and the correct rewrites, but GigabitEthernet3 also uses `encapsulation dot1q 21` with rewrites that are reversed incorrectly (ingress translate 21-to-12 and egress 12-to-21 should be the other way around for this interface). Additionally, the bridge domain assignments are incorrect.

Reference:
Cisco IOS XE Ethernet Services Configuration Guide – Configuring VLAN Rewrite and Bridge Domains; IEEE 802.1Q – Virtual Bridged Local Area Networks; Cisco 350-501 SPCOR Official Cert Guide, Layer 2 VPN and Services section.