Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

To provide traceback information with NetFlow, a classification ACL must be configured to identify which type of traffic will be analyzed. Traceback analysis requires the ability to distinguish and classify specific traffic flows (for example, by source/destination, protocol, or port) so that the NetFlow records can be tied to the traffic of interest. The classification ACL defines the traffic that NetFlow should track and report on, enabling the traceback of specific flows through the network. This makes option B the correct answer.

Why the other options are incorrect:

A. Cisco Express Forwarding must be configured for traffic that is egressing from the router to be properly reported – CEF is required for NetFlow to function on most platforms, but it is not specifically an additional configuration for traceback information. CEF is a general prerequisite for NetFlow operation.

C. The BGP routing process must be started for any ingress or egress data to be reported when using NetFlow Version 5 – BGP is not required for NetFlow to report traffic. NetFlow can operate without BGP, and BGP is only relevant if BGP-related fields (such as AS numbers) are being exported.

D. LLDP must be configured or the device will be unable to locate a NetFlow analyzer – LLDP is a neighbor discovery protocol and is not required for NetFlow export. The NetFlow analyzer is configured by specifying the destination IP address for flow export, not through LLDP.

Reference:
Cisco IOS NetFlow Configuration Guide – Configuring NetFlow and Traceback Analysis; RFC 3954 – Cisco Systems NetFlow Services Export Version 9; Cisco 350-501 SPCOR Official Cert Guide, Network Assurance section.

Explanation

Cisco IOS XR Gigabit Ethernet interfaces can be configured in two PHY modes: LAN and WAN. The LAN PHY mode is used for standard Gigabit Ethernet operation within a local area network, while the WAN PHY mode allows the Gigabit Ethernet interface to be carried over a SONET/SDH infrastructure by adapting the Ethernet frames into the SONET/SDH framing. These two modes are the standard options available for configuring the PHY type on IOS XR Gigabit Ethernet interfaces. This makes options D and E the correct answers.

Why the other options are incorrect:

A. SONET – SONET is a transport technology over which the WAN PHY mode operates. It is not a PHY mode of the Gigabit Ethernet interface itself.

B. MAN – MAN (Metropolitan Area Network) is a network scope or topology, not a PHY mode for a Gigabit Ethernet interface.

C. WDWM – This appears to be a misspelling of DWDM (Dense Wavelength Division Multiplexing), which is an optical transport technology, not a PHY mode for a Gigabit Ethernet interface.

Reference:
Cisco IOS XR Interface and Hardware Component Configuration Guide – Configuring Gigabit Ethernet Interfaces: LAN and WAN PHY Modes; IEEE 802.3z – Gigabit Ethernet; Cisco 350-501 SPCOR Official Cert Guide, Architecture and Transport section.

Explanation

In a Cisco Unified MPLS (also called Seamless MPLS) solution, the architecture uses BGP labeled unicast (RFC 3107) between the PE routers (Seamless MPLS Clients) and the ABR routers (Seamless MPLS ABRs). This allows the access and aggregation domains to use their own IGP (typically OSPF or IS-IS) while the BGP labeled unicast session between the PE and ABR provides the end-to-end MPLS forwarding across the core. BGP is used to exchange labeled IPv4 routes between the PE and ABR, stitching together the separate IGP domains into a unified MPLS domain. This makes option D the correct answer.

Why the other options are incorrect:

A. EIGRP is deployed between the PEs and ABRs with RFC 3107 – EIGRP is not used in Unified MPLS for inter-domain label distribution. BGP labeled unicast is the standard mechanism.

B. OSPF is deployed between the PEs and ABRs with RFC 3107 – OSPF does not carry BGP labels (RFC 3107). It can be used as the IGP within each domain, but it is not the protocol used to exchange labeled routes between PEs and ABRs.

C. IS-IS is deployed between the PEs and ABRs with RFC 3107 – Like OSPF, IS-IS can be used as the IGP within each domain, but it does not carry BGP labels. BGP labeled unicast is the protocol used for inter-domain label exchange.

Reference:
RFC 3107 – Carrying Label Information in BGP-4; Cisco IOS XR MPLS Configuration Guide – Unified MPLS and Seamless MPLS; Cisco 350-501 SPCOR Official Cert Guide, MPLS and Segment Routing chapters.

Explanation

In a Unified MPLS architecture with separate IGP domains (IS-IS in the core and OSPF in the aggregation layers), the domains must be stitched together to provide end-to-end MPLS forwarding. The correct task is to configure BGP-LU (BGP Labeled Unicast) between the ABR routers of each IGP domain to carry MPLS label information in the NLRI. BGP-LU (RFC 3107) allows the ABRs to exchange labeled IPv4 routes across domain boundaries, stitching the LDP LSPs of each IGP domain into a continuous end-to-end LSP. This enables VPNv4 and VPNv6 services to be transported across the unified architecture. This makes option A the correct answer.

Why the other options are incorrect:

B. Configure a BGP session between the ABR routers of each IGP domain to exchange VPNv4 or VPNv6 prefixes – While VPNv4/VPNv6 sessions are needed between PE routers, the ABRs in a Unified MPLS architecture use BGP-LU to exchange labeled IPv4 routes for the transport LSP, not VPNv4/VPNv6 prefixes directly.

C. Configure the ABR in each IGP domain to preserve next-hop information on all VPNv4 and VPNv6 prefixes advertised by the PE – Preserving next-hop information is a general BGP best practice, but it is not the specific task required to stitch the IGP domains together in a Unified MPLS architecture.

D. Configure mutual redistribution of each IGP domain's loopback prefix to provide end-to-end LDP LSP – Mutual redistribution between IS-IS and OSPF would not provide an end-to-end LDP LSP across domains, because LDP label bindings are not redistributed by IGPs. BGP-LU is required to carry labels across domain boundaries.

Reference:
RFC 3107 – Carrying Label Information in BGP-4; Cisco IOS XR MPLS Configuration Guide – Unified MPLS and Seamless MPLS; Cisco 350-501 SPCOR Official Cert Guide, MPLS and Segment Routing chapters.

Explanation

Traffic policing is a QoS mechanism that monitors traffic rates and drops packets that exceed a configured threshold, rather than delaying them (which is traffic shaping). To implement traffic policing, the engineer must configure a policy map with a policer that specifies the committed rate and the action to take when traffic exceeds that rate (typically drop or mark down). Among the options provided, setting IP precedence values to take effect when traffic exceeds a given threshold describes the marking action that can accompany policing — the policer can re-mark excess traffic (for example, set a lower precedence) or drop it. This makes option D the correct answer.

Why the other options are incorrect:

A. Configure RSVP to reserve bandwidth on all interfaces when a path is congested – RSVP is a resource reservation protocol used for MPLS TE or IntServ, not for traffic policing. It reserves bandwidth rather than dropping excess traffic.

B. Enable Cisco Discovery Protocol on the interface sending the packets – CDP is a Layer 2 discovery protocol and has no role in traffic policing or congestion management.

C. Enable Cisco Express Forwarding on the interfaces sending and receiving the packets – CEF is a forwarding mechanism and is a prerequisite for many QoS features, but it does not implement traffic policing by itself.

Reference:
Cisco IOS XR Modular QoS Configuration Guide – Configuring Traffic Policing; RFC 2475 – An Architecture for Differentiated Services; Cisco 350-501 SPCOR Official Cert Guide, QoS section.

Explanation

When configuring a route map for BGP redistribution, every route map has an implicit deny at the end. If the goal is to permit all unmatched routes, the engineer must add an explicit `permit` statement as the last entry in the route map. This ensures that any route not matching the earlier entries is still permitted rather than being dropped by the implicit deny. Without a final permit statement, all unmatched routes would be denied. This makes option D the correct answer.

Why the other options are incorrect:

A. Include a permit statement as the first entry – A permit statement at the beginning would only match routes based on the first entry's criteria. It would not ensure that all unmatched routes are permitted.

B. Include at least one explicit deny statement – Adding a deny statement would block certain routes, which is the opposite of permitting all unmatched routes.

C. Remove the implicit deny entry – The implicit deny at the end of a route map cannot be removed. It is an inherent part of route map processing. The only way to override it is to add an explicit permit statement as the final entry.

Reference:
Cisco IOS XR Routing Configuration Guide – Implementing Routing Policy: Route Maps and Implicit Deny; RFC 4271 – A Border Gateway Protocol 4 (BGP-4); Cisco 350-501 SPCOR Official Cert Guide, Routing Policy and BGP sections.

Explanation

Segment Routing with OSPF requires wide metrics to be enabled in the OSPF configuration. The Prefix-SID and Adjacency-SID information is carried in OSPF Extended Link Opaque LSAs (Type 10), which use the extended metric format. Without wide metrics, OSPF cannot properly advertise the Segment Routing extensions, and the SR implementation will not function correctly. This is a fundamental prerequisite for SR-OSPF. This makes option A the correct answer.

Why the other options are incorrect:

B. The segment will run without any further configuration – Segment Routing with OSPF requires explicit configuration, including enabling SR under the OSPF process and configuring prefix SIDs. It does not run without any configuration.

C. Area authentication must be enabled before segment routing will run – Authentication is a security feature and is not a prerequisite for Segment Routing to operate. SR does not require area authentication.

D. Area Authentication must be enabled before segment routing will run – This is a duplicate of option C (likely a typo in the question). Authentication is not required for SR to function.

Reference:
RFC 8665 – OSPF Extensions for Segment Routing; Cisco IOS XR Segment Routing Configuration Guide – Configuring SR-OSPF; Cisco 350-501 SPCOR Official Cert Guide, Segment Routing chapter.

Explanation

The exhibit shows R5 in Area 15, connected to R3, with R3 connected to R4 (also Area 15) and R2 (Area 15 and Area 0). R2 is connected to R1 (Area 0) and R4 (Area 0). Traffic from R5 to R1 currently has two potential paths: R5 → R3 → R2 → R1, or R5 → R3 → R4 → R2 → R1 (since R4 is in both Area 15 and Area 0). To make Area 15 traffic from R5 to R1 prefer the path through R4, the engineer should implement a multiarea adjacency on the link between R2 and R4, with the cost manipulated to make the path through R4 preferred. A multiarea adjacency allows an interface to participate in both Area 0 and Area 15, which is exactly what is needed here because the R2-R4 link is in Area 0, and R4 is also in Area 15. This creates a direct Area 15 path through R4, and manipulating the cost makes it preferred over the path through R2. This makes option C the correct answer.

Why the other options are incorrect:

A. Place the link between R3 and R5 in a stub area to force traffic to use the route through R4 – A stub area would affect external route propagation, not the internal path selection between R3 and R4. It would not force traffic through R4.

B. Increase the cost on the link between R2 and R4 to influence the path over R3 and R4 – Increasing the cost on R2-R4 would make the path through R2 less preferred, but it would not create a direct Area 15 path through R4. The multiarea adjacency is required to make R4 a direct Area 15 next-hop.

D. Implement a sham link between R3 and R2 to extend Area 0 over Area 15 – A sham link is used in MPLS L3VPN to create a virtual link between two Area 0 routers over a VPN backbone. It is not applicable in this plain OSPF topology and does not address the requirement.

Reference:
RFC 2328 – OSPF Version 2; Cisco IOS XR Routing Configuration Guide – Implementing OSPF: Multiarea Adjacencies; Cisco 350-501 SPCOR Official Cert Guide, OSPF chapter.

Explanation

Traffic policing is the QoS mechanism that monitors traffic rates on an interface and drops packets that exceed a configured threshold (the committed rate). When the goal is to drop excess traffic on the link between R2 and R3 due to congestion, traffic policing is the correct service to implement. Policing enforces a maximum rate by dropping or remarking packets that exceed the configured limit, which directly addresses the requirement. This makes option D the correct answer.

Why the other options are incorrect:

A. First-in, first-out – FIFO is a basic queuing discipline that forwards packets in the order they arrive. It does not drop traffic when a threshold is exceeded, nor does it enforce rate limits.

B. Traffic shaping – Traffic shaping delays (buffers) excess packets rather than dropping them, to smooth out bursts and conform to a configured rate. The requirement is to drop traffic, not delay it.

C. Class-based weighted fair queueing – CBWFQ is a queuing mechanism that provides weighted bandwidth allocation to different traffic classes. It manages congestion but does not drop traffic based on a configured threshold in the way policing does.

Reference:
Cisco IOS XR Modular QoS Configuration Guide – Configuring Traffic Policing; RFC 2475 – An Architecture for Differentiated Services; Cisco 350-501 SPCOR Official Cert Guide, QoS section.

Explanation

In Cisco IOS XR software, the BGP keychain is configured in global configuration mode. The keychain itself is defined globally using the `key chain ` command, where you configure the keys, cryptographic algorithms, and lifetimes. Once the keychain is defined globally, it is then referenced under the BGP neighbor configuration using the `keychain ` command. Since the question asks which CLI mode must be used to configure the BGP keychain (i.e., to create and define the keychain), the correct answer is global configuration mode. This makes option A the correct answer.

Why the other options are incorrect:

B. Routing configuration mode – Routing configuration mode (`router bgp`) is used to configure BGP process-level settings, but the keychain itself is defined in global configuration mode. The keychain is then applied under the neighbor.

C. BGP neighbor configuration – BGP neighbor configuration mode is where the keychain is referenced (applied to the neighbor), not where the keychain is defined. The keychain must first be created in global configuration mode.

D. BGP address-family configuration mode – BGP address-family configuration mode is used for address-family-specific settings such as activating neighbors and applying policies. It is not where the keychain is defined.

Reference:
Cisco IOS XR Security Configuration Guide – Configuring Keychains; Cisco IOS XR Routing Configuration Guide – Implementing BGP: BGP Keychain Authentication; Cisco 350-501 SPCOR Official Cert Guide, Security and BGP sections.