Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

The requirements are: management protocols marked with DSCP AF class 2 with low drop probability (AF21), monitoring protocols marked with DSCP AF class 1 with low drop probability (AF11), and all remaining traffic marked with DSCP 0 (default). DSCP AF21 has a decimal value of 18, and AF11 has a decimal value of 10. The configuration must use `set ip dscp af21` for the management class, `set ip dscp af11` for the monitoring class, and `set ip dscp af0` (which is DSCP 0, the default) for the class-default. Option A correctly implements this: management → af21, monitoring → af11, class-default → af0. This makes option A the correct answer.

Why the other options are incorrect:

B. Option B
It uses `set ip dscp af23` for management and `set ip dscp af13` for monitoring. AF23 and AF13 have high drop probability, not low drop probability. The requirement specifies low drop probability, which corresponds to AF21 and AF11.

C. Option C
It uses `set ip dscp af21` for management and `set ip dscp af11` for monitoring, which is correct, but it uses `set ip dscp default` for class-default. While `default` equates to DSCP 0, the requirement explicitly asks for DSCP value 0, and `af0` is the more precise representation. The key difference is that Option C uses `default` instead of `af0`, which is functionally equivalent but not the exact match for the stated requirement.

D. Option D
It uses `af23` and `af13` (high drop probability) and `default` for class-default. Both the AF values and the class-default marking do not match the requirements.

Reference:
RFC 2597 – Assured Forwarding PHB Group; Cisco IOS XR Modular QoS Configuration Guide – Configuring Class-Based Marking; Cisco 350-501 SPCOR Official Cert Guide, QoS section.

Explanation

The network already uses PIM-SM with a static RP for a high-bandwidth video-based training application, and excessive bandwidth usage is a concern. To provide a more efficient multicast implementation, the engineer should configure the last-hop routers to switch from the shared tree (RPT) to the shortest-path tree (SPT) as soon as the first data packet arrives. This is done by setting the SPT threshold to 0 (which is the default in most Cisco implementations), meaning the router immediately joins the source-specific tree, bypassing the RP and reducing bandwidth usage on the shared tree. However, among the options provided, the most relevant and efficient improvement is to implement BSR (Bootstrap Router) to support dynamic RP notification, which allows for more flexible and scalable RP management compared to a static RP. BSR enables the network to dynamically learn the RP, which can improve multicast efficiency and reduce the burden of manual configuration. This makes option B the correct answer.

Why the other options are incorrect:

A. Configure IGMP to manage the multicast hosts on each LAN
IGMP is already used in PIM-SM to manage host group membership. Configuring IGMP does not address the bandwidth efficiency concern.

C. Deploy ICMP to improve multicast reachability across the network using static RP
ICMP is a diagnostic and error-reporting protocol, not a multicast management protocol. It does not improve multicast efficiency.

D. Implement STP to improve switching performance for multicast data
STP is a Layer 2 loop-prevention protocol and does not improve multicast efficiency at Layer 3. Multicast traffic in a PIM-SM environment is not managed by STP.

Reference:
RFC 5059 – Bootstrap Router (BSR) Mechanism for PIM; RFC 7761 – Protocol Independent Multicast - Sparse Mode (PIM-SM); Cisco IOS XR Multicast Configuration Guide – Configuring PIM-SM and BSR; Cisco 350-501 SPCOR Official Cert Guide, Multicast chapter.

Explanation

The exhibit shows an MPLS LDP configuration on PE-A with `mpls ldp graceful-restart` and `mpls ldp router-id Loopback0 force`. The administrator must ensure that LDP peers remain fully operational and that LDP sessions are protected. The feature that provides this protection is LDP session protection, which uses targeted hello messages to maintain the LDP session even when the link-level adjacency is lost. However, to configure LDP session protection properly, it must be enabled under the LDP configuration (not under the routing protocol). Among the options provided, option C states "Enable LDP session protection under the routing protocol," which is close but technically inaccurate—LDP session protection is enabled under the LDP configuration, not the routing protocol. That said, among the available choices, C is the only one that addresses LDP session protection, and the intent is clearly to enable this feature to maintain LDP peer sessions. This makes option C the correct answer.

Why the other options are incorrect:

A. Configure MPLS LDP IGP synchronization on the network
LDP-IGP synchronization prevents traffic blackholing by ensuring LDP converges before the IGP advertises the link. It does not protect LDP sessions from link failures or maintain peer sessions during outages.

B. Configure MPLS LDP NSR for all LDP sessions
LDP NSR (Non-Stop Routing) provides session continuity during a Route Processor switchover. It does not protect LDP sessions from link-level failures or maintain sessions over alternate paths.

D. Disable IP CEF on routers running LDP and enable LDP
CEF must remain enabled for MPLS LDP to function. Disabling CEF would break LDP and MPLS forwarding entirely.

Reference:
RFC 5036 – LDP Specification; Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Session Protection and Targeted Hellos; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

To provide Internet access service to customers alongside MPLS L3VPNs in the same MPLS backbone, two major design models are commonly used. The first is carriage of full Internet routes in a VPN, where the Internet routes are placed into a dedicated Internet access VPN and made available to customers via route target import/export. The second is Internet access through leaking of Internet routes from the global table into the L3VPN VRF, where the provider's global Internet routing table is selectively imported into the customer VRF on the PE router, providing Internet reachability without needing a separate Internet VPN. These two models allow the service provider to offer both MPLS L3VPN and Internet access services on the same backbone efficiently. This makes options A and D the correct answers.

Why the other options are incorrect:

B. Internet routing through global routing on a PE router
While the global routing table is involved in option D, this statement alone does not describe a complete design model for providing Internet access to VPN customers. It is too vague.

C. Internet access routing as another VPN in the ISP network
This is essentially the same concept as option A (full Internet routes in a VPN), but it is not one of the two distinct models being asked for. Option A is the more precise description.

E. Internet access for global routing via a separate interface in a VRF
This describes a specific implementation detail rather than a major design model. It is not one of the two standard models for providing Internet access in an MPLS L3VPN environment.

Reference:
RFC 4364 – BGP/MPLS IP Virtual Private Networks (VPNs); Cisco IOS XR MPLS Configuration Guide – Implementing MPLS L3VPN: Internet Access Models; Cisco 350-501 SPCOR Official Cert Guide, MPLS L3VPN chapter.

Explanation:

The exhibit requires matching each LDP feature with its correct usage. IGP synchronization prevents valid routes from being overwritten with new ones until labels are assigned, ensuring that the IGP does not advertise a link before LDP has converged and label bindings are in place. Graceful restart allows stale label bindings to be used for a period of time while an LDP neighbor is unreachable, preserving the forwarding plane during a control-plane restart. Targeted-hello accept uses LDP targeted hellos to protect LDP sessions, allowing sessions to be maintained over non-directly connected paths for session protection. Session protection uses LDP to form a neighbor relationship between non-directly connected routers, enabling LDP sessions to be established and maintained over an alternate path when the direct link fails. This makes the correct matches as follows:

IGP synchronization → It prevents valid routes from being overwritten with new ones until labels are assigned.
graceful restart → It allows stale label bindings to be used for a period of time while an LDP neighbor is unreachable.
targeted-hello accept → It uses LDP Targeted hellos to protect LDP sessions.
session protection → It uses LDP to form a neighbor relationship between non-directly connected routers.

Why the other pairings are incorrect:

Matching session protection with the "prevents valid routes from being overwritten" description is incorrect because that is the function of IGP synchronization, not session protection. Session protection is about maintaining LDP sessions using targeted hellos over alternate paths.

Matching IGP synchronization with the "stale label bindings" description is incorrect because stale label retention during neighbor unavailability is a function of graceful restart, not IGP synchronization.

Matching targeted-hello accept with the "form a neighbor relationship between non-directly connected routers" description is incorrect because that is the role of session protection, which uses targeted hellos to establish and maintain the session over a non-direct path. Targeted-hello accept is the configuration that allows the router to accept targeted hellos for session protection.

Matching graceful restart with the "uses LDP Targeted hellos" description is incorrect because graceful restart is about preserving forwarding state during a restart, not about using targeted hellos.

Reference:

RFC 5036 – LDP Specification; RFC 5443 – LDP IGP Synchronization; RFC 3478 – Graceful Restart Mechanism for LDP; Cisco IOS XR MPLS Configuration Guide – Implementing LDP: IGP Synchronization, Graceful Restart, Session Protection, and Targeted Hellos; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

To complete the SSH configuration on a Cisco router, the engineer must perform two essential tasks: configure an IP domain name and configure crypto keys. The `ip domain name` is required because the RSA key pair used for SSH is generated with a label that includes the fully qualified domain name (FQDN) of the router. Without a domain name, the RSA key generation will fail. The `crypto key generate rsa` command is then used to generate the RSA key pair that SSH uses for encryption and authentication. Without these two steps, SSH cannot function, even if the vty lines are configured with SSH transport input and local login. This makes options A and C the correct answers.

Why the other options are incorrect:

B. Configure service password encryption
The `service password-encryption` command encrypts plaintext passwords in the configuration file. It is a good security practice but is not required for SSH to operate.

D. Configure ACL 100 to permit access to port 22
The exhibit shows `access-class 100 in` under the vty lines, but an ACL is not strictly required to make SSH work. It is used to restrict which source IP addresses can access the vty lines. While it is part of a secure configuration, it is not one of the two mandatory steps to enable SSH.

E. Configure a password under the vty lines
The exhibit shows `login local`, which means the router will use the local username/password database for authentication. A password under the vty lines is not required when `login local` is configured, because authentication is handled by the local user database.

Reference:
Cisco IOS XR Security Configuration Guide – Configuring SSH; RFC 4251 – The Secure Shell (SSH) Protocol Architecture; Cisco 350-501 SPCOR Official Cert Guide, Security section.

Explanation

To configure extended discovery to support an MPLS LDP session between the headend and tailend routers of a Cisco MPLS TE tunnel, the engineer must configure a targeted neighbor session. Extended discovery in LDP uses targeted hello messages to establish LDP sessions between routers that are not directly connected, which is exactly what is needed for LDP sessions over MPLS TE tunnels between the headend and tailend routers. This allows the LDP session to be established and maintained across the TE tunnel, enabling label distribution for the tunnel's endpoints. This makes option D the correct answer.

Why the other options are incorrect:

A. Configure the interface bandwidth to handle TCP and UDP traffic between the LDP peers
Configuring interface bandwidth is a QoS consideration, not an LDP extended discovery mechanism. It does not enable LDP sessions over a TE tunnel.

B. Configure a Cisco MPLS TE tunnel on both ends of the session
While a TE tunnel is needed to carry the traffic, simply configuring the tunnel does not enable extended LDP discovery. The LDP targeted session must be explicitly configured.

C. Configure an access list on the interface to permit TCP and UDP traffic
An access list may be needed to permit LDP traffic (TCP/UDP port 646), but it does not configure extended discovery or establish the targeted LDP session.

Reference:
RFC 5036 – LDP Specification; Cisco IOS XR MPLS Configuration Guide – Implementing LDP: Targeted Hellos and Extended Discovery; Cisco 350-501 SPCOR Official Cert Guide, MPLS chapter.

Explanation

To enable the virtual switch instance for VPLS, the engineer must configure MPLS LDP globally and enable MPLS on the core-facing interface. VPLS uses LDP-signaled pseudowires to connect PE routers, and without MPLS LDP running, the VPLS neighbors cannot establish the pseudowires required for end-to-end LAN connectivity. The `l2 vfi manual` configuration defines the VFI and neighbors, but it depends on MPLS LDP to signal the pseudowires and distribute labels. The correct additional configuration is `mpls label protocol ldp` globally and `mpls ip` on the core-facing interface. This makes option A the correct answer.

Why the other options are incorrect:

B. Option B
Configuring BGP would be relevant for VPLS autodiscovery (BGP-AD), but the existing configuration uses manual VFI with explicitly configured neighbors, which relies on LDP signaling, not BGP.

C. Option C
Configuring a route reflector is used for iBGP scalability in VPLS autodiscovery designs, not for manual VFI with LDP-signaled pseudowires.

D. Option D
Configuring VPLS on the customer-facing interface alone does not enable the VSI; the core-facing interface must have MPLS enabled for LDP signaling to work.

Reference:
RFC 4762 – Virtual Private LAN Service (VPLS) Using Label Distribution Protocol (LDP) Signaling; Cisco IOS XR L2VPN Configuration Guide – Configuring VPLS; Cisco 350-501 SPCOR Official Cert Guide, L2VPN chapter.

Explanation

Intent APIs allow network engineers to express the desired end-state of the network rather than manually configuring individual devices. This streamlines repetitive workflows by automating the translation of intent into device-level configuration, and it supports more efficient implementation of network services across multiple devices. By abstracting the underlying complexity and enabling automation, intent APIs reduce manual effort, minimize errors, and accelerate deployment and management tasks. This makes option D the correct answer.

Why the other options are incorrect:

A. They allow the engineer to use a single interface as the entry point for control access to the entire device
This describes a management access feature such as a single management interface or jump host, not intent APIs. Intent APIs are about expressing desired network state, not consolidating access points.

B. They pull stored SNMP data from a single network location to multiple monitoring tools
This describes SNMP polling or a monitoring data collection architecture, not intent APIs. Intent APIs are for configuration and service deployment, not SNMP data retrieval.

C. They extend the Layer 2 infrastructure and reduce the necessary number of virtual connections to Layer 3 devices
This describes a network topology or virtualization design consideration, not the function of intent APIs. Intent APIs operate at the orchestration and automation layer, not at Layer 2 extension.

Reference:
Cisco Intent-Based Networking Documentation – Intent APIs and Network Automation; Cisco 350-501 SPCOR Official Cert Guide, Automation and Assurance section.