Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

To enable BFD (Bidirectional Forwarding Detection) on interfaces in a Cisco network, the engineer must ensure that the interfaces are properly configured for BFD operation. Among the tasks listed, the one that is actually required is to remove the log option from any ACLs on the interfaces. When an ACL has the `log` keyword configured, it can cause significant CPU overhead and packet punt to the control plane, which interferes with BFD's fast failure detection and can cause BFD sessions to flap or fail. Removing the log option from ACLs on BFD-enabled interfaces is a best practice to ensure BFD operates correctly. This makes option D the correct answer.

Why the other options are incorrect:

A. Disable Cisco Express Forwarding on the interfaces
CEF must remain enabled for BFD to function properly. Disabling CEF would break forwarding and is not a requirement for enabling BFD.

B. Disable SSO on the interfaces
SSO (Stateful Switchover) is a high-availability feature that is independent of BFD. It does not need to be disabled to enable BFD.

C. Remove any static routes that point to the interfaces
Static routes do not prevent BFD from operating. In fact, BFD is often used to track static routes for faster failover. Removing them is not required.

Reference:
RFC 5880 – Bidirectional Forwarding Detection (BFD); Cisco IOS XR Routing Configuration Guide – Configuring BFD; Cisco 350-501 SPCOR Official Cert Guide, Network Assurance section.

Explanation

In EVPN VXLAN overlays, when the ingress VTEP performs symmetric IRB (Integrated Routing and Bridging), it performs both routing and tunneling. The ingress VTEP routes the packet from the source VLAN to the destination VLAN (Layer 3 routing) and then encapsulates the packet in VXLAN with the appropriate VNI for the destination subnet, tunneling it to the egress VTEP. In symmetric IRB, both the ingress and egress VTEPs perform routing and bridging functions, with the ingress VTEP routing and tunneling, and the egress VTEP decapsulating and routing/bridging to the final destination. This makes option A the correct answer.

Why the other options are incorrect:

B. Routing when doing asymmetric IRB
In asymmetric IRB, the ingress VTEP performs routing and bridging, while the egress VTEP performs only bridging (no routing). The ingress VTEP does more than just routing; it also bridges. This option is incomplete and not specific to the ingress VTEP's full role.

C. Routing and bridging when doing asymmetric IRB
In asymmetric IRB, the ingress VTEP performs routing and bridging, but the question asks what the ingress VTEP does specifically. In symmetric IRB, the ingress VTEP performs routing and tunneling, which is the more precise description. Option A is the better answer because it correctly identifies the symmetric IRB behavior.

D. Bridging when doing symmetric IRB
In symmetric IRB, the ingress VTEP performs routing and tunneling, not just bridging. Bridging alone would not provide Layer 3 connectivity between different subnets.

Reference:
RFC 9135 – Integrated Routing and Bridging in EVPN; Cisco IOS XR EVPN Configuration Guide – Symmetric and Asymmetric IRB; Cisco 350-501 SPCOR Official Cert Guide, EVPN chapter.

Explanation

The scenario describes a network that has experienced outages due to device failures, has been moved to a new central data center, and uses label switching (MPLS) for packet forwarding. The administrator is implementing NSF (Non-Stop Forwarding) to reduce risk during future outages. To support NSF in an MPLS environment, the administrator must implement Graceful Restart to mitigate the delay in MPLS LDP synchronization when the IGP starts up. Graceful Restart for LDP allows the forwarding state to be preserved during a control-plane restart, and the IGP (OSPF or IS-IS) also needs graceful restart so that the routing protocol can re-converge without disrupting forwarding. The combination ensures that MPLS LDP synchronization with the IGP is not delayed during a failover, allowing packets to continue to be forwarded using labels. This makes option D the correct answer.

Why the other options are incorrect:

A. Remove route filtering to speed repopulation of the link-state database
Removing route filtering is not part of NSF implementation and could introduce security or stability issues. NSF does not require removing route filters.

B. Copy the router's existing state information and share the file with its peers to enable BGP soft resets
BGP soft resets are unrelated to NSF implementation, and manually copying state files is not how NSF operates. NSF uses internal state synchronization between RPs, not file sharing with peers.

C. Implement MPLS to forward packets while the RIB updates after a failover
The network already uses label switching (MPLS), and simply implementing MPLS does not provide NSF. The key requirement is Graceful Restart to preserve LDP and IGP state during failover.

Reference:
RFC 3478 – Graceful Restart Mechanism for Label Distribution Protocol (LDP); RFC 3623 – Graceful OSPF Restart; RFC 5306 – Restart Signaling for IS-IS; Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Graceful Restart and NSF; Cisco 350-501 SPCOR Official Cert Guide, MPLS and Network Assurance sections.

Explanation

To protect LDP sessions and provide faster MPLS convergence, the engineer must enable LDP session protection. LDP session protection uses targeted hello messages between LDP peers to maintain the session even when the link-level hello adjacency is lost. When the direct link fails but the targeted LDP session can still be maintained over an alternate path, the label bindings are preserved, allowing faster convergence. Importantly, LDP session protection only needs to be enabled on one of the two routers; the other router will automatically negotiate and maintain the targeted session. This makes option C the correct answer.

Why the other options are incorrect:

A. Enable communication over TCP port 646 for T-LDP hello messages
LDP uses TCP port 646 for session establishment, and targeted hello messages use UDP port 646. However, simply enabling communication over TCP port 646 does not enable LDP session protection. Session protection must be explicitly configured.

B. Enable RSVP-TE FRR on the LDP interface to protect the LDP session between routers
RSVP-TE FRR is a traffic engineering mechanism for fast reroute of TE tunnels. It does not protect LDP sessions. LDP session protection is a separate feature.

D. Set the LDP session protection timer on each router to the same value
The LDP session protection timer does not need to be set to the same value on both routers. Session protection is negotiated, and only one router needs to have it enabled. Setting the timer identically is not a requirement.

Reference:
RFC 5036 – LDP Specification; Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Session Protection and Targeted Hellos; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

The requirements are: SNMP community string `c1sc0` with read-only permissions, interface index persistence enabled, community restricted to the monitoring server `198.18.19.100/32`, and view-only access to `ospfIfEntry` and `ospfNbrEntry`. Option A correctly implements all of these: `access-list 5 permit 198.18.19.100 0.0.0.0` restricts access to the monitoring server, `snmp-server view BLOCKED_VIEW internet excluded` blocks general access while `ospfIfEntry` and `ospfNbrEntry` are included for view-only access, `snmp-server community c1sc0 view BLOCKED_VIEW RO 5` applies read-only permissions with ACL 5, and `snmp ifmib ifindex persist` enables interface index persistence. This makes option A the correct answer.

Why the other options are incorrect:

B. Option B
The community string is configured with `RW` (read-write) instead of `RO` (read-only), which violates the requirement for read-only permissions.

C. Option C
The view is configured with `internet included` instead of `internet excluded`. This would allow access to the entire internet MIB tree rather than restricting access to only the OSPF entries, violating the view-only requirement.

D. Option D
The configuration is incomplete: it is missing the `snmp-server community` statement that applies the community string and ACL, and it is also missing the `snmp ifmib ifindex persist` command for interface index persistence.

Reference:
Cisco IOS XR Network Management Configuration Guide – Configuring SNMPv2 Communities, Views, and ACLs; RFC 3411–3418 – SNMPv3 Framework (applies to SNMPv2c community and view concepts); Cisco 350-501 SPCOR Official Cert Guide, Network Assurance section.

Explanation

The exhibit shows Area 1 with Level 1 routers (R1, R2, R3) and Area 2 with Level 2 routers (R4, R5, R6). For hosts in Area 1 and Area 2 to communicate in both directions, there must be at least one Level 1/Level 2 router that acts as an Area Border Router (ABR), connecting the Level 1 area to the Level 2 backbone. Currently, R3 is a Level 1 router in Area 1, and R4 is a Level 2 router in Area 2. To enable inter-area communication, either R3 or R4 must be reconfigured as a Level 1/Level 2 router. This allows the router to maintain Level 1 adjacencies within its area and Level 2 adjacencies with the backbone, thereby redistributing routes between Area 1 and Area 2. This makes option A the correct answer.

Why the other options are incorrect:

B. Reconfigure routers R1, R2, R5, and R6 as Level 1/Level 2 routers
Configuring all routers as Level 1/Level 2 is unnecessary and would increase complexity without providing additional benefit. Only one ABR is needed to connect the areas.

C. Reconfigure routers R2 and R5 as Level 1/Level 2 routers
R2 is in Area 1 and R5 is in Area 2. Configuring both as Level 1/Level 2 would create ABRs, but it is not required and would add unnecessary overhead. A single ABR (either R3 or R4) is sufficient.

D. Reconfigure routers R4, R5, and R6 as Level 1 routers
This would eliminate the Level 2 backbone entirely, preventing communication between the areas and breaking the IS-IS hierarchy.

Reference:
ISO/IEC 10589 – IS-IS for Routing Information Exchange; Cisco IOS XR Routing Configuration Guide – Implementing IS-IS: Level 1/Level 2 Routers and Area Boundaries; Cisco 350-501 SPCOR Official Cert Guide, IS-IS chapter.

Explanation

The exhibit shows a Cisco switch configured with RESTCONF and `netconf-yang cisco-ia snmp-community-string cisco`. The engineer is trying to retrieve SNMP MIBs via RESTCONF but is failing. The `netconf-yang cisco-ia snmp-community-string` command tells the Cisco IOS XE RESTCONF/NETCONF agent which SNMP community string to use when translating RESTCONF requests into SNMP MIB operations. In the exhibit, this community string is set to `cisco`, but the actual SNMP community configured on the device is `private RW` (as shown by `snmp-server community private RW`). For RESTCONF to successfully retrieve SNMP MIB data, the community string configured under `netconf-yang cisco-ia snmp-community-string` must match the SNMP community string configured with `snmp-server community`. Option D (`netconf-yang cisco-ia snmp-community-string Private`) aligns the RESTCONF SNMP community string with the configured SNMP community `private`, allowing RESTCONF to query SNMP MIBs successfully. This makes option D the correct answer.

Why the other options are incorrect:

A. `netconf-yang cisco-ia snmp-community-string Public`
This sets the community string to `Public`, which does not match the configured SNMP community `private`. It would still fail.

B. `snmp-server community cisco RW`
This changes the SNMP community to `cisco`, but it does not align the RESTCONF SNMP community string with the existing SNMP community. It also changes the read-write community unnecessarily.

C. `snmp-server community public RO`
This configures a new read-only community `public`, but the RESTCONF SNMP community string is still `cisco`, so it would not match. It does not resolve the mismatch.

Reference:
Cisco IOS XE RESTCONF API Configuration Guide – Configuring RESTCONF and SNMP Community Strings; RFC 8040 – RESTCONF Protocol; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

Explanation

Chef and Puppet are both configuration management and automation tools that share the common characteristic of using Ruby in their implementation. Puppet is written in Ruby and uses a Ruby-based DSL for its manifests, while Chef uses Ruby for its recipes and cookbooks. This common use of Ruby is a defining technical similarity between the two tools. This makes option A the correct answer.

Why the other options are incorrect:

B. Use a master server
While both Chef and Puppet traditionally use a master server architecture (Chef Server and Puppet Master/Puppet Server), this is not unique to them and is not the best description of what they have in common, as many automation tools use a master server. Additionally, both can operate in agentless or masterless modes.

C. Require modules to be created from scratch
Both Chef and Puppet have large communities and repositories of pre-built modules (Puppet Forge for Puppet, Chef Supermarket for Chef). They do not require modules to be created from scratch.

D. Manage agents referred to as minions
"Minions" is the term used specifically by SaltStack for its agents. Chef uses `chef-client` and Puppet uses `puppet agent`, not minions.

Reference:
Chef Documentation – Chef Infra Overview; Puppet Documentation – Puppet Architecture; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.

R2(config)# access-list 1 permit 172.16.33.0 0.0.0.255

Explanation

The exhibit shows R2 with `distribute-list 1 in` under OSPF, and `access-list 1 permit 172.16.32.0 0.0.0.255`. This access list only permits routes from the `172.16.32.0/24` subnet. R1 has an interface with the address `172.16.33.1/32`, which is in the `172.16.33.0/24` subnet. Because the access list does not permit `172.16.33.0/24`, the route `172.16.33.1/32` is being filtered out and not installed in R2's routing table. To fix the problem, the engineer must add a permit entry for the `172.16.33.0/24` subnet. The correct wildcard mask for a `/24` subnet is `0.0.0.255`, and the correct syntax is `access-list 1 permit 172.16.33.0 0.0.0.255`. This makes option C the correct answer.

Why the other options are incorrect:

A. `access-list 1 permit 172.16.33.0 255.0.0.0`
This uses an incorrect wildcard mask (`255.0.0.0`), which would match a much larger range of addresses and is not the correct mask for a `/24` subnet.

B. `access-list 1 permit 172.16.33.0 255.255.255.0`
This uses a subnet mask (`255.255.255.0`) instead of a wildcard mask. Cisco access lists require wildcard masks, not subnet masks.

D. `access-list 1 permit 172.16.33.0 255.255.0.0`
This uses an incorrect wildcard mask (`255.255.0.0`) and would not correctly match the `172.16.33.0/24` subnet.

Reference:
Cisco IOS XR Routing Configuration Guide – Implementing OSPF: Distribute Lists and Access Lists; RFC 2328 – OSPF Version 2; Cisco 350-501 SPCOR Official Cert Guide, OSPF chapter.

Explanation

When an MPLS LSP is down, MPLS OAM (LSP ping) echo request packets must be prevented from being forwarded beyond the service provider domain, which could leak information or cause unintended behavior. This is achieved by implementing the destination address for the LSP echo request packet in the `127.x.y.z/8` network (the loopback range). By using a destination address from the `127.0.0.0/8` range, the echo request packet is guaranteed to be dropped by any router outside the MPLS domain if it escapes the LSP, because `127.0.0.0/8` is reserved for loopback and is not routable on the public Internet. This prevents the packets from being forwarded beyond the service provider domain. This makes option B the correct answer.

Why the other options are incorrect:

A. Disable IP redirects only on outbound interfaces
Disabling IP redirects is a security best practice but does not specifically prevent MPLS OAM packets from leaving the service provider domain when an LSP is down.

C. Disable IP redirects on all ingress interfaces
Similar to option A, this is a general security measure and does not address the specific requirement of preventing LSP echo request packets from being forwarded beyond the domain.

D. Configure a private IP address as the destination address of the headend router of Cisco MPLS TE
Configuring a private IP address on the headend router does not prevent MPLS OAM packets from being forwarded beyond the domain. The standard mechanism is to use the `127.x.y.z/8` range for LSP echo request destination addresses.

Reference:
RFC 4379 – Detecting Multi-Protocol Label Switched (MPLS) Data Plane Failures; Cisco IOS XR MPLS Configuration Guide – MPLS LSP Ping and Traceroute; Cisco 350-501 SPCOR Official Cert Guide, MPLS and Network Assurance sections.