View Full Cisco CCNP Service Provider 350-501 Exam Dumps and Practice Test Dumps.

 

Question 201

Which protocol is commonly used to establish a secure, encrypted CLI session with a network device?

1. Telnet
2. TFTP
3. SSH
4. SNMP

Correct Answer: 3

Explanation

Secure Shell (SSH) provides encrypted remote access to network devices and is widely used for secure CLI management. It protects authentication credentials and management commands from being transmitted in clear text. SSH can also support stronger authentication mechanisms and secure file-transfer functions through related technologies. Telnet provides remote CLI access but does not encrypt the session, making it less appropriate for secure management. TFTP is a lightweight file-transfer protocol, while SNMP is primarily used for monitoring and management operations. Therefore, SSH is the correct protocol for establishing a secure encrypted CLI session.

Question 202

Which AAA protocol commonly provides centralized authentication and authorization for network administrators while also supporting detailed accounting?

1. TACACS+
2. ARP
3. LDP
4. IGMP

Correct Answer: 1

Explanation

TACACS+ is commonly used to provide centralized authentication, authorization, and accounting for network administrators. It separates authentication and authorization functions and can provide granular control over which commands an administrator is permitted to execute. Accounting can also record administrative activity for auditing and operational purposes. ARP resolves IPv4 addresses to MAC addresses, LDP distributes MPLS labels, and IGMP manages IPv4 multicast group membership. Centralized AAA is particularly valuable in service provider environments where many network devices must be managed consistently. Therefore, TACACS+ is the correct answer.

Question 203

Which protocol is commonly used for centralized authentication of users accessing network services and is frequently associated with enterprise Wi-Fi authentication?

1. LDP
2. RADIUS
3. RSVP
4. PIM

Correct Answer: 2

Explanation

RADIUS is a widely used AAA protocol for centralized authentication, authorization, and accounting. It is frequently associated with network access services such as enterprise Wi-Fi, VPN access, and other centralized user authentication systems. A RADIUS server can validate user credentials and return authorization attributes to the network access device. TACACS+ is another AAA protocol and is commonly used for administrative device access, while LDP, RSVP, and PIM perform routing or network-control functions. Therefore, RADIUS is the correct protocol for centralized user authentication in this scenario.

Question 204

Which security mechanism helps protect a router by filtering traffic destined for its control-plane CPU?

1. uRPF
2. CoPP
3. NAT
4. DHCP Snooping

Correct Answer: 2

Explanation

Control Plane Policing (CoPP) protects the control plane by classifying and rate-limiting traffic destined for the router’s CPU. Routing protocols, management services, and other control-plane functions depend on CPU resources, so excessive traffic can negatively affect device operation. CoPP policies can permit legitimate traffic while limiting unwanted or excessive packets. uRPF focuses on source-address validation, NAT translates addresses, and DHCP Snooping provides Layer 2 protection against certain DHCP attacks. Therefore, CoPP is the correct mechanism for protecting a router’s control plane.

Question 205

Which mechanism can help prevent a network device from accepting packets with spoofed source addresses?

1. uRPF
2. NTP
3. LACP
4. LLDP

Correct Answer: 1

Explanation

Unicast Reverse Path Forwarding (uRPF) can help protect networks against source-address spoofing by checking whether the source address of an incoming packet is reachable through an expected interface according to the routing table. Depending on the configured mode, uRPF can perform strict or looser source validation. This is particularly useful at network boundaries where spoofed source addresses may otherwise be introduced into the infrastructure. NTP synchronizes time, LACP manages link aggregation, and LLDP provides neighbor discovery. Therefore, uRPF is the correct mechanism for source-address validation.

Question 206

Which BGP security feature uses a small TTL value to restrict the distance from which a BGP session can be established?

1. RPKI
2. GTSM
3. Route Dampening
4. Add-Path

Correct Answer: 2

Explanation

Generalized TTL Security Mechanism (GTSM) protects BGP sessions by using TTL values to make it difficult for an attacker located several hops away to send packets that appear to originate from a directly connected BGP peer. For eBGP sessions, the configured mechanism can require incoming packets to have an expected high TTL, meaning packets that traverse unexpected hops are discarded. RPKI validates route-origin information, Route Dampening handles route instability, and Add-Path allows multiple paths to be advertised. Therefore, GTSM is the correct security mechanism.

Question 207

Which BGP validation technology uses Route Origin Authorizations to determine whether an AS is authorized to originate a prefix?

1. CoPP
2. RADIUS
3. RPKI
4. SNMP

Correct Answer: 3

Explanation

Resource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route-origin information. Route Origin Authorizations (ROAs) specify which autonomous system is authorized to originate a particular IP prefix and can also specify a maximum prefix length. Network operators can use RPKI validation results to classify received routes and apply routing policies accordingly. CoPP protects the control plane, RADIUS provides centralized authentication, and SNMP provides network monitoring and management. Therefore, RPKI is the correct technology for validating authorized route origins.

Question 208

Which IPv6 mechanism allows a host to automatically configure an address based on information received from a router?

1. SLAAC
2. NAT
3. ARP
4. LACP

Correct Answer: 1

Explanation

Stateless Address Autoconfiguration (SLAAC) allows IPv6 hosts to automatically configure addresses using information provided by IPv6 routers. Routers send Router Advertisement messages containing network prefix and other configuration information. The host can then construct an IPv6 address without requiring a traditional DHCP server for basic address assignment. IPv6 does not use ARP; Neighbor Discovery uses ICMPv6 instead. NAT is an address translation technology, while LACP provides link aggregation. Therefore, SLAAC is the correct IPv6 mechanism for automatic address configuration.

Question 209

Which ICMPv6 message is sent by a host to request router information on an IPv6 link?

1. Router Advertisement
2. Neighbor Advertisement
3. Router Solicitation
4. Echo Reply

Correct Answer: 3

Explanation

An IPv6 host uses a Router Solicitation (RS) message to request router information from routers on the local link. Routers respond with Router Advertisement (RA) messages containing information such as prefixes, default-router information, and configuration parameters. Neighbor Solicitation and Neighbor Advertisement messages are primarily associated with neighbor discovery and address resolution functions. Echo messages are used for connectivity testing. Therefore, Router Solicitation is the correct ICMPv6 message when a host wants router information.

Question 210

Which IPv6 message provides hosts with prefix and default-router information?

1. Router Advertisement
2. Router Solicitation
3. Neighbor Solicitation
4. Neighbor Advertisement

Correct Answer: 1

Explanation

Router Advertisement (RA) messages are generated by IPv6 routers and provide hosts with important network configuration information. This can include IPv6 prefixes, default-router information, and parameters used by mechanisms such as SLAAC. Hosts can receive RAs periodically or request them by sending Router Solicitation messages. Neighbor Solicitation and Neighbor Advertisement are used primarily for neighbor discovery and address resolution-related functions. Therefore, Router Advertisement is the correct message for providing IPv6 hosts with prefix and default-router information.

Question 211

Which IPv6 routing protocol is specifically designed as an enhanced version of OSPF for IPv6 networks?

1. OSPFv3
2. OSPFv1
3. RIPng only
4. BGP-4

Correct Answer: 1

Explanation

OSPFv3 is the version of OSPF designed to support IPv6 routing. It maintains the link-state and SPF principles of OSPF while adapting protocol operation for IPv6. OSPFv3 uses IPv6 link-local addresses for neighbor relationships and relies on IPv6 mechanisms for packet delivery. BGP can also carry IPv6 routes through appropriate address families, but it is not an IPv6-specific version of OSPF. Therefore, OSPFv3 is the correct answer for an OSPF implementation designed for IPv6 networks.

Question 212

Which BGP address family is commonly used to exchange IPv6 unicast routes?

1. VPNv4
2. IPv4 Unicast
3. IPv6 Unicast
4. L2VPN EVPN only

Correct Answer: 3

Explanation

The BGP IPv6 Unicast address family is used to exchange IPv6 unicast routing information between BGP speakers. Multiprotocol BGP allows different network-layer address families to be carried using BGP UPDATE messages. IPv4 Unicast carries IPv4 routes, while VPNv4 is used for IPv4 MPLS VPN routes that include Route Distinguishers. EVPN is another BGP address family used for Ethernet VPN services. Therefore, the IPv6 Unicast address family is the correct choice for exchanging ordinary IPv6 routing information.

Question 213

Which MPLS VPN address family is used to exchange IPv6 VPN routes between PE routers?

1. VPNv4
2. VPNv6
3. IPv4 Unicast
4. EVPN only

Correct Answer: 2

Explanation

VPNv6 is the Multiprotocol BGP address family used to exchange IPv6 VPN routes between provider-edge routers. It extends the MPLS Layer 3 VPN architecture to IPv6 customer prefixes. Like VPNv4, VPNv6 uses Route Distinguishers to make otherwise overlapping customer prefixes unique and Route Targets to control route import and export between VRFs. VPNv4 is used for IPv4 VPN routes, while ordinary IPv4 or IPv6 unicast address families are used for non-VPN routes. Therefore, VPNv6 is correct.

Question 214

Which MPLS VPN component provides the separation of customer IPv6 routing information on a PE router?

1. VRF
2. LFIB
3. RIB only
4. ARP cache

Correct Answer: 1

Explanation

A Virtual Routing and Forwarding (VRF) instance provides logical separation of customer routing information on a PE router. Each customer VRF can maintain its own IPv4 or IPv6 routing table, allowing overlapping address spaces and independent routing policies. In an IPv6 MPLS VPN, the PE can use the appropriate VPNv6 control-plane information and MPLS labels to transport traffic between customer sites. The LFIB handles MPLS forwarding, while an ARP cache does not provide complete routing-table separation. Therefore, VRF is the correct component.

Question 215

Which MPLS VPN interconnection option connects two autonomous systems using an external MP-BGP session carrying VPN routes?

1. Option A
2. Option B
3. Option C
4. Option D

Correct Answer: 3

Explanation

MPLS VPN Inter-AS Option C uses MP-BGP to exchange VPN routing information between provider networks, typically allowing VPN routes and labeled reachability to be exchanged across the autonomous-system boundary. Option A generally connects ASBRs using VRF-to-VRF connectivity, while Option B exchanges VPN-IPv4 routes between ASBRs using an external BGP mechanism. Option C provides greater scalability by maintaining VPN route information through BGP across the participating autonomous systems. Therefore, Option C is the correct answer for the described architecture.

Question 216

Which MPLS VPN inter-AS option typically uses VRF-to-VRF connectivity between ASBRs?

1. Option A
2. Option B
3. Option C
4. Option D

Correct Answer: 1

Explanation

Inter-AS Option A connects the participating provider networks through VRF-to-VRF interfaces on the autonomous system boundary routers. Each ASBR treats the connection similarly to a customer-facing VPN connection, maintaining separate VRF contexts for the relevant services. This approach can be straightforward conceptually but may require more configuration and resources as the number of VPNs grows. Option B uses VPN route exchange between ASBRs, while Option C uses a more scalable inter-provider MP-BGP and labeled architecture. Therefore, Option A is correct.

Question 217

Which MPLS VPN inter-AS option exchanges VPN-IPv4 routes directly between ASBRs using eBGP?

1. Option A
2. Option B
3. Option C
4. Option D

Correct Answer: 2

Explanation

Inter-AS Option B uses eBGP between the autonomous system boundary routers to exchange VPN-IPv4 routes. The ASBRs participate in the VPN control plane and exchange VPN route information across the autonomous-system boundary. This differs from Option A, where VRF-to-VRF connections are established between ASBRs, and Option C, where a more scalable model uses MP-BGP and labeled reachability across the provider networks. Therefore, Option B is the correct inter-AS VPN architecture for direct VPN-IPv4 route exchange between ASBRs.

Question 218

Which service provider architecture allows a provider to carry another provider’s customer VPN traffic while maintaining separate provider roles?

1. Carrier Supporting Carrier
2. Route Dampening
3. Anycast-RP
4. BGP Add-Path

Correct Answer: 1

Explanation

Carrier Supporting Carrier (CSC) allows one service provider to support another service provider’s VPN customers. The supporting carrier provides transport across its network while the customer carrier maintains its own VPN services and customer relationships. This architecture is useful when service providers need to extend VPN connectivity across another provider’s infrastructure without completely merging their control planes. Route Dampening addresses BGP instability, Anycast-RP provides multicast RP redundancy, and Add-Path allows multiple BGP paths. Therefore, Carrier Supporting Carrier is the correct architecture.

Question 219

Which high-availability technology allows a router’s forwarding plane to continue operating while the control plane is restarted?

1. SSO
2. Route Target
3. LDP
4. IGMP

Correct Answer: 1

Explanation

Stateful Switchover (SSO) is a high-availability technology designed to maintain forwarding operations during certain control-plane failures or switchover events. In systems with redundant supervisor or control-plane components, SSO can synchronize important state information so that the standby component can take over more quickly. When combined with appropriate nonstop forwarding capabilities, this can reduce service disruption during control-plane events. Route Targets control VPN route policies, LDP distributes MPLS labels, and IGMP handles multicast membership. Therefore, SSO is the correct high-availability technology.

Question 220

Which technology is designed to upgrade network software while minimizing service disruption by keeping traffic forwarding during the upgrade process?

1. ISSU
2. ARP
3. RPKI
4. PIM

Correct Answer: 1

Explanation

In-Service Software Upgrade (ISSU) is designed to allow supported network software upgrades while minimizing disruption to packet forwarding and network services. The exact behavior depends on the platform, software architecture, redundancy model, and feature support. ISSU can coordinate software changes between active and standby control-plane components while maintaining forwarding as much as possible. ARP handles address resolution, RPKI validates BGP route origins, and PIM provides multicast routing. Therefore, ISSU is the correct technology for minimizing service disruption during supported software upgrades.