Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

To enable LDP session protection for LDP neighbors within each VRF, the configuration must be applied within the individual VRFs. LDP session protection is a per-VRF feature, meaning that enabling it globally on the device does not automatically apply it to all VRFs. Each VRF that requires LDP session protection must have the feature configured separately within its own LDP configuration context. This makes option D the correct answer.

Why the other options are incorrect:

A. Configure LDP session protection globally on the device only
Configuring LDP session protection globally does not enable it for VRFs. The feature must be applied per VRF because each VRF maintains its own LDP instance and session state.

B. Configure LDP session protection globally on the device and on each neighbor that requires session protection
While per-neighbor configuration may be needed for some LDP features, LDP session protection is enabled per VRF, not per neighbor. The global configuration alone does not cover VRFs.

C. Configure LDP session authentication on the device to enable LDP session protection on each VRF automatically
LDP session authentication is a separate security feature and does not enable LDP session protection. Authentication and session protection are independent features.

Reference:
Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Session Protection and VRF-Aware LDP; RFC 5036 – LDP Specification; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

To extend Layer 2 connectivity between two campus sites across an MPLS backbone that encapsulates Layer 2 and Layer 3 data, the engineer must configure a pseudowire for E-LINE service. E-LINE is a point-to-point Ethernet service that uses a pseudowire (such as AToM — Any Transport over MPLS) to carry Layer 2 frames across the MPLS backbone. This creates a transparent Layer 2 connection between the two sites, allowing them to appear as if they are on the same LAN segment. This makes option B the correct answer.

Why the other options are incorrect:

A. Configure an EtherChannel for E-LAN
EtherChannel is a link aggregation technology used to bundle multiple physical links into one logical link. It is not used to extend Layer 2 across an MPLS backbone. E-LAN is a multipoint Ethernet service, not a point-to-point pseudowire.

C. Configure Cisco MPLS TE for use with E-TREE
MPLS TE is used for traffic engineering and does not provide the Layer 2 extension service itself. E-TREE is a rooted multipoint service, not the point-to-point Layer 2 extension required here.

D. Configure QoS for MPLS and E-ACCESS
QoS is used to manage traffic prioritization and is not the mechanism for extending Layer 2 connectivity across an MPLS backbone.

Reference:
RFC 4664 – Framework for Layer 2 Virtual Private Networks (L2VPNs); RFC 4448 – Encapsulation Methods for Transport of Ethernet over MPLS Networks; Cisco IOS XR L2VPN Configuration Guide – Configuring E-LINE and Pseudowires; Cisco 350-501 SPCOR Official Cert Guide, MPLS L2VPN chapter.

Explanation

The exhibit shows R2 with interface Ethernet1/0 configured with an IP address (`10.1.1.1/32`). To support MPLS LDP sessions, LDP must be enabled globally and then activated on the interface. Option C correctly configures `mpls ip` globally, `mpls label protocol ldp` globally, and then `mpls ip` on interface Ethernet1/0. The `mpls ip` command on the interface enables LDP on that interface so it can form LDP sessions and exchange label bindings with R1. This makes option C the correct answer.

Why the other options are incorrect:

A. Option A
It enables `mpls label protocol ldp` globally and `mpls bgp forwarding` on the interface. The `mpls bgp forwarding` command is used for BGP labeled unicast (RFC 3107), not for LDP. It does not enable LDP on the interface.

B. Option B
It enables `mpls label protocol ldp` globally but then configures VRF forwarding and OSPF on interface Ethernet1/1, which is not the interface shown in the exhibit. This does not enable LDP on the correct interface.

D. Option D
It enables `mpls label protocol ldp` globally but then configures VRF forwarding and OSPF on Ethernet1/0 instead of enabling MPLS LDP with `mpls ip`. This does not enable LDP on the interface.

Reference:
Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Enabling LDP on Interfaces; RFC 5036 – LDP Specification; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

The scenario describes two dual-stack IPv6 networks separated by an IPv4-only core network, and the operator needs to provide connectivity between them using specific assigned IPv6 space. This is the classic use case for 6rd (IPv6 Rapid Deployment). 6rd tunnels IPv6 packets over an IPv4 core by encapsulating IPv6 inside IPv4, and it allows the operator to use their own assigned IPv6 prefix rather than a shared one like 6to4. This enables the dual-stack sites to communicate across the IPv4 core using the specific IPv6 address space provided by the company's IP administrator. This makes option A the correct answer.

Why the other options are incorrect:

B. NAT46
NAT46 translates between IPv4 and IPv6, allowing IPv6-only hosts to communicate with IPv4-only hosts. However, in this scenario, the sites are dual-stack and need IPv6 connectivity across an IPv4 core, not translation between IPv4 and IPv6 hosts.

C. DS-Lite
DS-Lite (Dual-Stack Lite) is used to provide IPv4 connectivity to IPv4 hosts over an IPv6 access network. It is the opposite of what is needed here, where IPv6 connectivity must traverse an IPv4 core.

D. NAT44
NAT44 translates between IPv4 addresses (RFC 1918 to public IPv4). It does not provide IPv6 connectivity and is unrelated to the requirement.

Reference:
RFC 5569 – IPv6 Rapid Deployment on IPv4 Infrastructures (6rd); RFC 5969 – IPv6 Rapid Deployment on IPv4 Infrastructures (6rd) – Protocol Specification; Cisco 350-501 SPCOR Official Cert Guide, Architecture and Services section.

Explanation

The exhibit shows a REST API script using the Cisco ACI managed object model. The script creates an `fvTenant` named "customer", an `fvCtx` named "customervrf" (which is a VRF instance), an `fvBD` named "bd1" (a bridge domain), an `fvSubnet` with IP `192.168.0.1/24`, and an `fvRsBDToOut` that associates the bridge domain with an L3Out named "l3out1". The central object being configured is the VRF (`fvCtx`), which is the Layer 3 context for the tenant. While the script also creates a bridge domain and subnet, the primary managed object being defined is the VRF (`fvCtx`), which provides Layer 3 isolation. This makes option B the correct answer.

Why the other options are incorrect:

A. Application profile
An application profile in ACI is configured using the `fvAp` managed object, which is not present in this script. The script configures a tenant, VRF, and bridge domain, not an application profile.

C. Public community string for SNMP
SNMP community strings are not configured via the ACI tenant managed objects shown here. The script deals with ACI policy objects, not SNMP.

D. Interface with IP address `192.168.0.1`
The script configures a subnet (`fvSubnet`) with the IP address `192.168.0.1/24`, but this is a gateway address for the bridge domain, not a physical interface. The primary object being configured is the VRF context.

Reference:
Cisco APIC Management Information Model Reference – fvTenant, fvCtx, fvBD, fvSubnet, fvRsBDToOut; Cisco ACI Fundamentals – Tenants, VRFs, and Bridge Domains; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

Explanation

The exhibit shows a BGP configuration with `neighbor 10.10.10.1 distribute-list 1 out` and `ip as-path access-list 1 permit ^$`. The AS-path access list entry `permit ^$` matches routes with an empty AS_PATH. An empty AS_PATH means the route originated locally within the local AS (AS 65001) and was not learned from any other AS. Therefore, only local routes are permitted to be advertised to neighbor `10.10.10.1`, while routes learned from other ASNs (which have non-empty AS_PATHs) are denied by the implicit deny at the end of the access list. This makes option A the correct answer.

Why the other options are incorrect:

B. All routes, whether local or from other ASNs, are denied
This is incorrect because the `permit ^$` statement explicitly permits local routes with empty AS_PATHs. Only routes from other ASNs are denied.

C. Local routes are denied, and routes from other ASNs are permitted
This is the opposite of what the configuration does. The `permit ^$` statement permits local routes (empty AS_PATH) and denies routes with non-empty AS_PATHs.

D. All routes, whether local or from other ASNs, are permitted
This is incorrect because the access list only permits routes with empty AS_PATHs. Routes from other ASNs have non-empty AS_PATHs and are denied.

Reference:
Cisco IOS XR Routing Configuration Guide – Implementing BGP: AS-Path Access Lists and Distribute Lists; RFC 4271 – A Border Gateway Protocol 4 (BGP-4); Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.

Explanation

The scenario describes a failure between IG and R2, with R2's configuration lost due to a power outage, and the USER in AS 100 needs to reach an application hosted behind CE2. To resolve the issue on R3 and R4, the best action is to set R4 as a route reflector for R3 and CE2. This ensures that iBGP routes are properly reflected between R3, R4, and CE2, maintaining BGP reachability within AS 100 even when one path (via R2) is lost. Since R3 and R4 are iBGP peers within the same AS, and CE2 is also in AS 100, configuring R4 as a route reflector allows it to reflect routes between R3 and CE2, providing an alternate path and restoring connectivity for the USER's application. This makes option A the correct answer.

Why the other options are incorrect:

B. Apply high Local Preference on R3 toward R1
Local preference affects outbound path selection within AS 100. Setting a high local preference on R3 toward R1 would influence which exit point R3 prefers, but it does not address the iBGP reachability issue caused by the failure between IG and R2 or the loss of R2's configuration.

C. Set R3 as a route reflector for R4 and CE1
While route reflection is a valid solution, setting R3 as the route reflector for R4 and CE1 does not directly address the requirement to reach the application behind CE2. R4 as the route reflector for R3 and CE2 is more appropriate because CE2 hosts the application the USER needs to reach.

D. Apply low Local Preference on R4 toward R2
R2 is in AS 200, and local preference is used for outbound path selection within the local AS. Setting a low local preference on R4 toward R2 would make the path via R2 less preferred, but the issue is not about path preference; it is about restoring iBGP reachability after R2's failure. This action does not resolve the connectivity problem.

Reference:
RFC 4456 – BGP Route Reflection: An Alternative to a Full Mesh Internal BGP (IBGP); RFC 4271 – A Border Gateway Protocol 4 (BGP-4); Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.

**Explanation**

To display the login time of each user that activated a NETCONF session, the administrator must use the `show netconf-yang sessions detail` command. This command provides detailed information about each active NETCONF session, including the user name, the login time (when the session was activated), the source IP address, and other session-specific details. This makes option A the correct answer.

Why the other options are incorrect:

B. show netconf-yang datastores
This command displays information about the NETCONF datastores (such as running, candidate, startup), not user login times or session details.

C. show platform software yang-management process
This command shows the status of the YANG management processes on the platform, not user session login times.

D. show netconf-yang sessions
While this command lists active NETCONF sessions, it does not provide the detailed login time information for each user. The `detail` keyword is required to display the login time and other per-session details.

Reference:
Cisco IOS XE NETCONF/YANG Configuration Guide – Monitoring NETCONF Sessions; RFC 6241 – Network Configuration Protocol (NETCONF); Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

Explanation

The requirements describe an 802.1ad provider bridging configuration where the switchport must tag all frames entering the port and provide the same level of service to traffic from any customer VLAN. This is achieved by configuring the port as an s-port (service port). The `ethernet dot1ad uni s-port` command sets the port as a service provider port, and `encapsulation default` matches all traffic entering the port regardless of the customer VLAN. The `rewrite ingress tag push dot1ad 21 symmetric` command pushes an S-VLAN tag (21) onto all incoming frames, ensuring every frame is tagged and treated uniformly. This makes option C the correct answer.

Why the other options are incorrect:

A. Option A
This uses traditional 802.1Q trunking with `switchport mode trunk`, which does not implement 802.1ad provider bridging. It does not push a service VLAN tag onto all incoming frames, and the syntax mixing `encapsulation ISL` with `bridge-domain` is invalid.

B. Option B
This uses `ethernet dot1ad uni c-port`, which is a customer port. A c-port accepts customer-tagged traffic and does not push a service VLAN tag on all frames entering the port. It does not meet the requirement to tag all frames.

D. Option D
This uses `ethernet dot1ad nni`, which is a network-to-network interface. An NNI port is used between provider bridges and expects already-tagged provider traffic. It does not push a service tag on frames entering from a customer, so it does not satisfy the requirement.

Reference:
IEEE 802.1ad – Provider Bridges; Cisco IOS XR Ethernet Services Configuration Guide – Configuring 802.1ad Provider Bridging (s-port configuration).