Free Cisco 350-501 Practice Questions 2026 | Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR)

Explanation

The exhibit shows a sampler named NetFlow1 with `mode random one-out-of 100`, which means that only one out of every 100 packets is selected for NetFlow analysis. This sampling reduces the number of packets that need to be analyzed and exported, which in turn reduces CPU and memory utilization on the router. Therefore, the two correct results are that CPU and memory utilization are reduced (option A) and the number of packets to be analyzed is reduced (option D). This makes options A and D the correct answers.

Why the other options are incorrect:

B. Only the flows of top 100 talkers are exported – The `one-out-of 100` refers to packet sampling, not to selecting the top 100 talkers. The sampler does not rank or filter by traffic volume; it simply selects one packet out of every 100.

C. The data export flow is more secure – Sampling has no effect on the security of the data export. Security would require encryption or authentication mechanisms such as IPsec or TLS, which are not configured here.

E. The accuracy of the data to be analyzed is improved – Sampling actually reduces accuracy because only a subset of packets is analyzed. It provides a statistical estimate rather than a complete, exact count of all flows.

Reference:
Cisco IOS XR NetFlow Configuration Guide – Configuring Sampled NetFlow and Flexible NetFlow; RFC 5475 – Sampling and Filtering Techniques for IP Packet Selection; Cisco 350-501 SPCOR Official Cert Guide, Network Assurance section.

Explanation

The exhibit shows a class map named WEB with the statement `match protocol http`. A class map is used to classify traffic for use in a policy map as part of the Cisco Modular QoS CLI (MQC). The `match protocol http` command uses NBAR (Network-Based Application Recognition) to identify HTTP traffic, and the resulting class map is then referenced by a policy map to apply actions such as marking, policing, or shaping. This configuration does not apply a service policy by itself, nor does it create an ACL or modify a default policy. It simply defines a traffic class that matches HTTP traffic for use in a policy map. This makes option C the correct answer.

Why the other options are incorrect:

A. It applies a service policy to all interfaces remarking HTTP traffic – A class map only defines the classification. To apply a service policy, the class map must be referenced in a policy map, and the policy map must be attached to an interface with the `service-policy` command. None of that is present here.

B. It creates an ACL named WEB that filters HTTP traffic – The `class-map` command creates a class map, not an ACL. Class maps classify traffic for QoS; ACLs filter traffic for security or routing policy. They are different constructs.

D. It modifies the default policy map to allow all HTTP traffic through the router – The configuration does not reference or modify any policy map, and it does not affect traffic forwarding by itself. A class map without a policy map has no effect on traffic.

Reference:
Cisco IOS XR Modular QoS Configuration Guide – Configuring Class Maps and Policy Maps; Cisco 350-501 SPCOR Official Cert Guide, QoS section.

Explanation

When defining SR-TE explicit path hops on devices using IP unnumbered interfaces, the hops must be identified by something other than a numbered IP address, since unnumbered interfaces do not have unique IP addresses. The two features used in this case are the node address (typically a loopback or router ID that identifies the node) and the output interface (the local interface through which the hop is reached). The node address provides a reachable identifier for the remote node, while the output interface specifies the local interface to use for forwarding toward that hop. This makes options C and E the correct answers.

Why the other options are incorrect:

A. router ID – While the router ID is used by IGPs and BGP, SR-TE explicit path hops are defined using node addresses (such as loopback addresses) rather than the router ID itself. The node address is the routable identifier used in segment routing.

B. labels – Labels are the SIDs (Segment IDs) that are pushed onto packets for segment routing forwarding, but they are not used to define the hops in an explicit path. The path is defined by node addresses and/or adjacency segments, not by the labels themselves.

D. next hop address – On unnumbered interfaces, there is no unique next-hop IP address to specify, because the interface does not have its own IP address. This is precisely why node address and output interface are used instead.

Reference:
RFC 8402 – Segment Routing Architecture; Cisco IOS XR Segment Routing Configuration Guide – Configuring SR-TE Explicit Paths with Unnumbered Interfaces; Cisco 350-501 SPCOR Official Cert Guide, Segment Routing chapter.

Explanation

The exhibit shows `ip verify unicast source reachable-via any` on interface gigabitethernet0/1, which is uRPF in loose mode (also called "any" mode). In loose mode, uRPF checks whether the source address of an incoming packet exists in the FIB, regardless of which interface the FIB points to. If the source address is reachable through any interface in the FIB, the packet is accepted; if the source address is not in the FIB at all, the packet is dropped. Therefore, the router accepts source addresses that have a match in the FIB indicating they are reachable through a real interface. This makes option D the correct answer.

Why the other options are incorrect:

A. Router 1 drops all traffic that ingresses interface gigabitethernet0/1 that has a FIB entry that exits a different interface – This describes strict mode (`ip verify unicast source reachable-via rx`), which requires the source address to be reachable through the same interface the packet arrived on. The exhibit uses `any`, which is loose mode, so packets are not dropped just because the FIB points to a different interface.

B. Router 1 accepts source addresses on interface gigabitethernet0/1 that are private addresses – Loose uRPF does not make any special exception for private addresses. If a private source address is not in the FIB, it is dropped. There is no rule that private addresses are automatically accepted.

C. Router 1 accepts all traffic that ingresses and egresses interface gigabitethernet0/1 – Loose uRPF still drops packets whose source address is not in the FIB. It does not accept all traffic unconditionally, so this statement is false.

Reference:
RFC 3704 – Ingress Filtering for Multihomed Networks; Cisco IOS XR Security Configuration Guide – Unicast Reverse Path Forwarding (uRPF) Loose and Strict Modes; Cisco 350-501 SPCOR Official Cert Guide, Security section.

Explanation

To enable LDP-IGP Synchronization on R2's L2 IS-IS adjacencies, the configuration must enable LDP-IGP sync under the IS-IS routing process and then apply it to the interfaces participating in L2 adjacencies. R2 has three interfaces: Gi1, Gi2, and Gi3. Gi1 and Gi2 connect to R1 and R3 respectively over L1 links, while Gi3 connects to R4 over an L2 link. The requirement is specifically for L2 IS-IS adjacencies, so the configuration must enable `mpls ldp sync` under `router isis 1` and then apply it on the L2-facing interface, which is Gi3. Option A correctly places `mpls ldp igp sync` under `router isis 1` and then configures `mpls ldp igp sync delay 5` on GigabitEthernet1 (which represents the L2-facing interface toward R4). This enables LDP-IGP synchronization for the L2 adjacency. This makes option A the correct answer.

Why the other options are incorrect:

B. Option B – It applies `mpls ldp igp sync delay 5` under an interface range but does not enable `mpls ldp sync` under the IS-IS routing process. LDP-IGP sync must be enabled globally under the IGP first, so this configuration is incomplete.

C. Option C – It enables `mpls ldp sync` under `router isis 1` but does not apply any interface-level LDP-IGP sync configuration. Without interface-level configuration, LDP-IGP sync is not activated on the L2 adjacency.

D. Option D – It enables `mpls ldp sync` under `router isis 1` but then explicitly disables LDP-IGP sync on GigabitEthernet1 with `no mpls ldp igp sync`, which is the opposite of what is required for the L2 adjacency.

Reference:
Cisco IOS XR MPLS Configuration Guide – Implementing LDP: LDP-IGP Synchronization; RFC 5443 – LDP IGP Synchronization; Cisco 350-501 SPCOR Official Cert Guide, MPLS and IS-IS chapters.

Explanation

The exhibit requires matching each multicast concept with its correct description. IGMP is the technology that manages the process of joining and leaving multicast groups, as it is the protocol used by hosts to signal their multicast group membership to routers. PIM-DM is the multicast routing protocol that floods traffic to all peers, using a flood-and-prune mechanism to build distribution trees. PIM-SM is the technology that requires an RP, because it uses a Rendezvous Point as the root of the shared tree. The shared tree is the technology that uses the RP as the single common root, also known as the RPT (Rendezvous Point Tree). The source tree is the shortest-path tree, which is rooted at the source and built using SPT (Shortest Path Tree) calculations. This makes the correct matches as follows:

* IGMP → technology that manages the process of joining and leaving multicast groups
* PIM-DM → multicast routing protocol that floods traffic to all peers
* PIM-SM → technology that requires an RP
* shared tree → technology that uses the RP as the single common root
* source tree → shortest-path tree

Why the other pairings are incorrect:

Matching IGMP with any routing-related description is incorrect because IGMP is a host-to-router signaling protocol, not a multicast routing protocol. It manages group membership but does not route multicast traffic.

Matching PIM-DM with descriptions involving an RP or shared tree is incorrect because PIM-DM does not use an RP. It uses flood-and-prune to build source-based distribution trees.

Matching PIM-SM with the flooding description is incorrect because PIM-SM is a sparse-mode protocol that uses explicit joins and an RP, not flooding to all peers.

Matching shared tree with the shortest-path tree description is incorrect because the shared tree is rooted at the RP, not at the source. The source tree is the one that follows the shortest path from the source.

Matching source tree with the RP description is incorrect because the source tree is rooted at the multicast source, not at the RP. It is built using the shortest path from the receiver to the source.

Reference:
RFC 2236 – Internet Group Management Protocol, Version 2; RFC 7761 – Protocol Independent Multicast - Sparse Mode (PIM-SM); RFC 3973 – Protocol Independent Multicast - Dense Mode (PIM-DM); Cisco 350-501 SPCOR Official Cert Guide, Multicast chapter.

Explanation

BGP uses TCP as its transport protocol and operates on TCP port 179. The `neighbor 192.168.1.2 password cisco` command enables MD5 authentication for the BGP session between R1 and R2. MD5 authentication causes the TCP segments to be authenticated using an MD5 hash computed over the TCP header, the BGP payload, and the password, which protects the session from spoofing and unauthorized BGP peers. Therefore, R1 establishes TCP connections that are authenticated with an MD5 password. This makes option D the correct answer.

Why the other options are incorrect:

A. R1 establishes UDP connections that are authenticated with an MD5 password – BGP does not use UDP. It uses TCP port 179 as its transport, so this option is incorrect regardless of the authentication type.

B. R1 establishes TCP connections that are authenticated with a clear-text password – The BGP `password` command uses MD5 authentication, not clear-text authentication. The password is never sent in clear text across the wire.

C. R1 establishes UDP connections that are authenticated with a clear-text password – BGP does not use UDP, and the password is not sent in clear text. Both parts of this option are incorrect.

Reference:
RFC 4271 – A Border Gateway Protocol 4 (BGP-4); RFC 2385 – Protection of BGP Sessions via the TCP MD5 Signature Option; Cisco IOS XR Routing Configuration Guide – Implementing BGP: Neighbor Password Authentication; Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.

Explanation

The exhibit shows `neighbor 192.168.1.1 send-label` under `router bgp 1`. The `send-label` command enables BGP labeled unicast (BGP-LU, RFC 3107) for the neighbor, which causes the router to advertise an MPLS label along with each IPv4 prefix it sends to that peer. This allows the peer to use the label for MPLS forwarding toward those prefixes. Therefore, the router sends BGP labels for its prefixes to this peer. This makes option C the correct answer.

Why the other options are incorrect:

A. The router must have TDP configured for the send-label command to operate – TDP (Tag Distribution Protocol) is a legacy Cisco protocol that is not required for BGP labeled unicast. The `send-label` command works with BGP itself and does not depend on TDP.

B. The neighbor router receives at least four labels from this router – There is no indication that four labels are sent. The number of labels depends on the number of prefixes advertised with labels, not on the configuration shown. The exhibit does not specify a fixed number.

D. The router sends only a label for the prefix for Loopback0 – The `send-label` command applies to all IPv4 prefixes advertised to the neighbor, not just to the Loopback0 prefix. There is no restriction in the configuration limiting label advertisement to a single prefix.

Reference:
RFC 3107 – Carrying Label Information in BGP-4; Cisco IOS XR Routing Configuration Guide – Implementing BGP: BGP Labeled Unicast and send-label; Cisco 350-501 SPCOR Official Cert Guide, BGP and MPLS chapters.

Explanation

The exhibit shows `show flowspec ipv4 detail` output on CSR1. The Flow entry shows `Dest:10.6.5.0/24,DPort:=80|=443`, meaning it matches traffic destined to 10.6.5.0/24 with destination ports 80 or 443. The Actions line shows `Traffic-rate: 0 bps (bgp.1)`, meaning the policy is a traffic-rate action set to 0 bps, which drops the matching traffic. The `(bgp.1)` annotation indicates that the policy was learned via BGP FlowSpec rather than configured locally. The Statistics section shows Matched: 12/696 and Dropped: 12/696, meaning 12 packets/696 bytes have matched the policy and all of them have been dropped. This confirms that the policy is learned via BGP FlowSpec, drops traffic for TCP ports 80 and 443, and has active traffic being dropped. This makes option B the correct answer.

Why the other options are incorrect:

A. The policy is configured locally on CSR1 and drops all traffic for TCP ports 80 and 443 – The `(bgp.1)` annotation indicates the policy was learned via BGP FlowSpec, not configured locally. The policy is valid and dropping traffic, so the "configured locally" part is incorrect.

C. The policy is learned via BGP FlowSpec and has active traffic – While this is partially true, it is incomplete. The policy drops all traffic for TCP ports 80 and 443, and the statistics confirm active traffic is being dropped. Option B captures all of this, while option C omits the drop action and the specific ports.

D. The policy is configured locally on CSR1 and currently has no active traffic – The statistics show Matched: 12/696 and Dropped: 12/696, which means there is active traffic. Additionally, the policy was learned via BGP, not configured locally, so this option is incorrect on both counts.

Reference:
RFC 5575 – Dissemination of Flow Specification Rules; RFC 8955 – Dissemination of Flow Specification Rules (updated); Cisco IOS XR Routing Configuration Guide – Implementing BGP FlowSpec; Cisco 350-501 SPCOR Official Cert Guide, BGP and Security sections.

Explanation

The exhibit shows `show bgp neighbors 192.168.2.2` output on an IOS XR router. The key line is `eBGP neighbor with no inbound or outbound policy; defaults to 'drop'`. In Cisco IOS XR, when an eBGP neighbor is configured but no inbound or outbound route policy is applied, the default behavior is to drop all routes. This means the router will not accept any routes from the neighbor, nor will it advertise any routes to the neighbor, even after the BGP session is established. The session may come up (reach Established state), but no prefix exchange will occur until explicit route policies are applied. This makes option C the correct answer.

Why the other options are incorrect:

A.The IOS XR router advertises all routes to the neighbor 192.168.2.2, but it does not accept any routes from 192.168.2.2 – This is incorrect because the default 'drop' behavior applies in both directions. The router does not advertise any routes either.

B. The IOS XR router advertises and accepts all routes to and from eBGP neighbor 192.168.2.2 – This is incorrect because the default behavior in IOS XR for eBGP without policies is to drop, not to advertise and accept all routes.

D. The IOS XR router does not advertise any routes to the neighbor 192.168.2.2, but it accepts all routes from 192.168.2.2 – This is incorrect because the default 'drop' behavior applies to inbound routes as well. The router does not accept any routes from the neighbor without an explicit inbound policy.

Reference:

Cisco IOS XR Routing Configuration Guide – Implementing BGP: Default Behavior for eBGP Neighbors Without Policies; RFC 4271 – A Border Gateway Protocol 4 (BGP-4); Cisco 350-501 SPCOR Official Cert Guide, BGP chapter.