Cisco Certified Internetwork Expert (CCIE) Service Provider — Practice Set 1

Question 1

An IOS XR router with NSR (Non-Stop Routing) enabled undergoes an unplanned RP switchover. A BGP engineer monitoring the network observes that no BGP session resets occurred on any iBGP or eBGP peers. Which combination of IOS XR mechanisms makes this possible?

Accepted Answer

IOS XR NSR maintains a fully synchronized replica of all routing protocol state on the standby RP, including BGP TCP session state at the socket level (sequence numbers, acknowledgment numbers, window sizes, and segment buffers). During an RP switchover, the standby RP takes ownership of the existing TCP connections transparently — neither the local BGP process nor the remote BGP peers are aware that a switchover occurred, so no session reset is triggered. This is fundamentally different from Graceful Restart (NSF), which requires peer cooperation and does result in a brief session interruption. NSR requires no peer support and is purely local to the restarting router.

Question 2

A service provider is deploying a new backbone using Cisco NCS 5500 routers. The operations team notes that the NCS 5500 uses merchant silicon (Broadcom Jericho2). What is a key operational implication of this design choice compared to a custom Cisco ASIC platform like the ASR 9000?

Accepted Answer

The NCS 5500's use of Broadcom Jericho2 merchant silicon provides significant advantages in port density, power efficiency, and cost-per-bit for high-throughput core transit roles. However, merchant silicon ASICs are designed for a specific, well-defined feature set (IP/MPLS forwarding, ACLs, QoS, ECMP) — complex stateful features like deep packet inspection, subscriber-level BNG, or advanced QoS hierarchies that require custom pipeline stages are not available in hardware. The platform still runs IOS XR and supports full MPLS, SR-MPLS, and SRv6 forwarding within the capabilities of the Jericho2 ASIC.

Question 3

A CCIE candidate is asked to explain the difference between NSR (Non-Stop Routing) and NSF (Non-Stop Forwarding) with Graceful Restart in IOS XR. Which statement is the most accurate technical distinction?

Accepted Answer

NSF (Non-Stop Forwarding) combined with Graceful Restart (GR) keeps the forwarding plane operational during a control-plane restart by retaining stale FIB entries. GR requires that the restarting router's neighbors support the GR capability (RFC 4724 for BGP, RFC 3623 for OSPF, RFC 5306 for IS-IS) — they must hold routes and not send withdrawals for the duration of the restart timer. NSR is a purely local mechanism that synchronizes complete routing protocol state (including TCP socket state for BGP) to the standby RP continuously. On switchover the standby RP takes over all sessions transparently; peers never detect any disruption and no GR capability exchange is required.

Question 4

A SP architect is designing a new IOS XR-based PE router deployment. The architect wants to ensure that if the BGP process crashes, it restarts automatically without operator intervention and without affecting IS-IS adjacencies or MPLS forwarding. Which IOS XR architectural feature enables this?

Accepted Answer

IOS XR's microkernel architecture runs each routing protocol process (BGP, IS-IS, OSPF, LDP, etc.) as an independent user-space process with its own protected memory space. If BGP crashes, the IOS XR System Manager detects the failure and automatically restarts the BGP process — IS-IS, OSPF, and the forwarding plane (which runs in the line card driver space) are completely unaffected. This process-level fault isolation and automatic restart capability is a fundamental high-availability feature of IOS XR that does not exist in monolithic OS designs.

Question 5

A service provider needs to offer E-TREE service to a mobile backhaul customer where multiple base stations (leaves) must send traffic to a central BSC/RNC (root) but must never exchange traffic directly with each other. Which statement about E-TREE implementation in an MPLS-based SP network is correct?

Accepted Answer

RFC 7387 defines E-TREE over VPLS. In a VPLS-based E-TREE implementation, attachment circuits are tagged as either 'root' or 'leaf'. An enhanced split-horizon rule is applied: traffic received on a leaf AC or leaf pseudowire must not be forwarded to any other leaf AC or leaf pseudowire — only to root ports. Root ports can communicate with both leaves and other roots. This allows the full-mesh VPLS pseudowire infrastructure to be reused while enforcing the E-TREE traffic isolation semantics. Cisco IOS XR implements this via the 'leaf' designation in the VPLS bridge domain configuration.

Question 6

An IOS XR BGP engineer needs to match routes where the AS_PATH contains the regular expression that matches any path that passed through AS 65001 (anywhere in the path, not just the origin AS). Which IOS XR as-path-set entry correctly implements this?

Accepted Answer

In IOS XR RPL as-path-set, the underscore (_) is a special metacharacter that matches a word boundary — it matches a space, the beginning of the AS_PATH, the end of the AS_PATH, or an open/close brace. The pattern '_65001_' matches AS 65001 as a complete AS number anywhere in the path (surrounded by word boundaries on both sides), which correctly matches paths transiting AS 65001 regardless of position. '^65001$' would only match paths where 65001 is the sole AS (originated by 65001 and directly connected). '65001$' would only match paths where 65001 is the rightmost (origin) AS. '65001' without anchors would match '165001' or '650010' as a substring.

Question 7

An IOS XR BGP route-policy needs to tag routes from a specific peer with a BGP community value of 65000:200 using an inline community-set. Which IOS XR RPL syntax correctly accomplishes this?

Accepted Answer

In IOS XR RPL, the 'set community' action uses an inline community-set enclosed in parentheses. The 'additive' keyword is essential if you want to add the community to any existing communities on the route rather than replacing all existing communities. Without 'additive', all existing communities on the route are removed and replaced with only the specified value. 'set community (65000:200) additive' adds community 65000:200 while preserving existing communities. Option A without 'additive' replaces all communities. Option B is not valid IOS XR RPL syntax (no parentheses). Option D uses an invalid 'add' action.

Question 8

A CCIE candidate is asked about BGP Add-Path (RFC 7911) and its 'advertise best-external' variant on IOS XR. In a route reflector topology, what problem does BGP Add-Path solve that standard BGP RR operation cannot address?

Accepted Answer

In a standard iBGP Route Reflector topology, the RR selects one best path per prefix and reflects only that single best path to its clients. If that path fails, all clients must wait for BGP to reconverge — they have no pre-installed backup path. BGP Add-Path (RFC 7911) extends BGP UPDATE messages with a Path ID that makes multiple paths for the same NLRI distinguishable. With Add-Path, the RR can advertise both the best path and backup paths to all clients simultaneously. Clients install these as additional BGP paths (used with 'maximum-paths'), enabling faster switchover on failure because no re-advertisement from the RR is needed. 'advertise best-external' is a specific Add-Path variant that sends the best external path even when an internal path is preferred.

Question 9

An IOS XR router is configured with BGP Flowspec. The network operations team wants to automatically redirect traffic matching destination prefix 203.0.113.0/24 and TCP destination port 80 to a scrubbing center at next-hop 10.255.0.1. Which Flowspec NLRI action correctly expresses this?

Accepted Answer

BGP Flowspec (RFC 5575) defines both traffic match criteria (NLRI type 1-12 including destination prefix, source prefix, IP protocol, TCP/UDP ports, ICMP type/code, DSCP, and packet length) and action communities (traffic-rate, traffic-marking, redirect-to-IP, redirect-to-VRF). The 'redirect IPv4 next-hop' extended community (RFC 5575 extended: redirect-IP) allows matching traffic to be steered to a specific next-hop — the scrubbing appliance — without affecting non-matching traffic. 'traffic-rate 0' drops the traffic. RFC 5575 Section 7 defines both actions. IOS XR implements Flowspec via RP-based policy distribution and dataplane enforcement in the line cards.

Question 10

An IOS XR network engineer examines the following 'show bgp vpnv4 unicast all' output and notices a route is marked with 'i' (iBGP) and has a next-hop of 10.0.0.2 but shows 'not bestpath reason: Neighbor is not directly connected.' What does this indicate?

Network       Next Hop     Metric LocPrf Weight Path
*>i10.1.1.0/24 10.0.0.2         0    100      0 65001 i
* i10.1.1.0/24  10.0.0.3         0    100      0 65001 i

Accepted Answer

In IOS XR BGP, a VPNv4 route is only selected as best path and installed in the VRF if the iBGP next-hop (the remote PE loopback) can be resolved in the MPLS forwarding table with a valid label. If the MPLS LSP to the next-hop is missing (no LDP binding or SR prefix-SID for that loopback), the route will appear in the VPNv4 BGP table with a 'not bestpath' or 'not installed' indication because the next-hop cannot be resolved with label forwarding. The '*>' in the output shown actually means the route IS the best path — the question describes a different scenario where a 'not bestpath reason' message appears alongside a route entry, which would indicate an MPLS reachability failure for that specific next-hop.

Question 11

An IOS XR engineer is troubleshooting an IS-IS segment routing deployment. The engineer runs 'show isis adjacency detail' and sees 'SR: Not supported' in the neighbor capability field for one adjacency. Traffic engineering paths using explicit segment lists through this adjacency are failing. What is the most likely cause?

Accepted Answer

IS-IS SR capabilities are advertised in IS-IS Hello PDUs (IIH) and Link State PDUs (LSP) via SR-specific TLVs (TLV 22 extended reachability sub-TLVs for Adj-SID, TLV 135/235 for Prefix-SID, and the SR Capabilities sub-TLV). If the neighbor has not enabled 'segment-routing mpls' under its router isis configuration, it will not include SR capability TLVs in its hellos, and the local router will display 'SR: Not supported' in the adjacency detail. SRGB values do not need to be identical (they are per-node ranges and label values are derived from each node's own SRGB base + index). Wide metrics are required for IS-IS SR in practice but the specific symptom described points directly to missing SR enablement on the peer.

Question 12

A service provider implements IS-IS topology-independent LFA (ti-LFA) for microloop avoidance with SR-MPLS. After enabling ti-LFA, the engineer verifies with 'show isis fast-reroute summary'. Which statement correctly describes how ti-LFA differs from classic LFA (RFC 5286)?

Accepted Answer

Classic LFA (RFC 5286) can only provide protection if a loop-free alternate next-hop exists as a direct neighbor — in many topologies (ring networks, certain hub-and-spoke designs) no classic LFA neighbor exists, leaving traffic unprotected. Topology-independent LFA (ti-LFA) uses SR segment lists to construct an explicit backup path through the P-space (nodes reachable from the PLR without traversing the failed link/node) and Q-space (nodes that can reach the post-convergence next-hop without traversing the failed element). Because SR can encode any explicit path as a label stack, ti-LFA achieves 100% coverage for any topology, providing both link and node protection. The backup path is computed and the label stack pre-programmed locally on each PLR without requiring a PCE.

Question 13

A network engineer checks 'show mpls ldp neighbor detail' on an IOS XR router and sees that graceful restart is shown as 'Enabled (Peer)' for one neighbor but 'Enabled (Local and Peer)' for another. What is the operational significance of this difference?

Accepted Answer

In LDP graceful restart (RFC 3478), GR capability is negotiated bidirectionally. 'Enabled (Peer)' means the remote LDP neighbor has advertised GR support — if the peer's LDP process restarts, the local router will hold its LDP session state and label bindings for the peer's recovery period. 'Enabled (Local and Peer)' means both the local router and the peer have GR configured — protection applies in both directions. If only the peer has GR enabled, the local router benefits (the peer holds state if the local LDP restarts) but the local router doesn't provide GR protection to the peer's restarts unless the local router also has GR enabled.

Question 14

In SRv6 (Segment Routing over IPv6), what is the structure of an SRv6 SID and what is the function of the 'End' behavior with PSP (Penultimate Segment Pop)?

Accepted Answer

An SRv6 SID is a full 128-bit IPv6 address divided into three parts: the Locator (a routable IPv6 prefix, typically /48 or /64, used for inter-domain routing to reach the node owning the SID), the Function (identifies the specific behavior/endpoint function to execute, e.g., End, End.DT4, End.X), and optional Arguments (per-packet context data for stateful functions). The 'End' behavior is the basic SR endpoint — when a router receives a packet with its own SID as the active segment, it decrements the Segments Left counter and updates the IPv6 DA to the next SID. With PSP (Penultimate Segment Pop), the SRH is removed at the penultimate node (the node before the final destination), so the last hop receives a plain IPv6 packet without an SRH, reducing per-packet overhead at the endpoint.

Question 15

In SRv6 L3VPN, which SRv6 endpoint behavior is used on the egress PE to perform a per-VRF IPv4 routing lookup for decapsulated VPN traffic, and how does it differ from End.DT46?

Accepted Answer

SRv6 defines several endpoint behaviors for VPN services. End.DT4 (Decapsulate and Table Lookup for IPv4) removes the outer SRv6 IPv6 encapsulation and the SRH, then performs a lookup in the specified IPv4 VRF routing table — it is used for IPv4 L3VPN services where only IPv4 customer traffic is carried. End.DT6 is the equivalent for IPv6-only VPN traffic. End.DT46 (defined in RFC 9252) handles both IPv4 and IPv6 customer traffic in the same VRF with a single SID, performing the appropriate lookup based on the inner payload IP version. Using End.DT46 simplifies SID allocation when a VRF carries dual-stack customer traffic.

Question 16

An engineer is troubleshooting MPLS L3VPN connectivity and runs 'show bgp vpnv4 unicast all' on the ingress PE. The customer prefix 10.100.0.0/16 appears with the correct VPN label and remote PE next-hop, but the customer still cannot reach the remote site. The MPLS core uses SR-MPLS with IS-IS. Which IOS XR command sequence would BEST verify end-to-end label forwarding to the remote PE?

Accepted Answer

A methodical MPLS L3VPN troubleshooting approach requires verifying three layers: (1) IGP reachability to the remote PE loopback — 'show isis route /32 detail' confirms the loopback is in the IS-IS LSPDB and has a valid next-hop; (2) MPLS label forwarding — 'show mpls forwarding prefix /32' confirms the SR label (prefix-SID derived label) is installed in the LFIB with the correct outgoing interface and label operation; (3) VRF route installation — 'show bgp vrf ' or 'show route vrf ' confirms the VPN prefix is installed in the customer VRF with the correct label. This three-layer verification systematically isolates whether the failure is in IGP, MPLS transport, or VPN route distribution.

Question 17

In inter-AS MPLS L3VPN Option B, eBGP VPNv4 sessions are established between the ASBRs of AS 65001 and AS 65002. The engineer configures 'next-hop-self' on the ASBR in AS 65001 for the VPNv4 address family. What is the operational effect of this configuration?

Accepted Answer

In inter-AS L3VPN Option B, each ASBR maintains a VPNv4 eBGP session with the other AS's ASBR. When the ASBR receives a VPNv4 route from the remote ASBR with the remote PE's IP address as the BGP next-hop, the internal PEs in the local AS cannot resolve that next-hop (it belongs to a different AS and is not reachable via intra-AS MPLS). Configuring 'next-hop-self' on the ASBR makes it re-advertise VPNv4 routes into the local AS with its own loopback as the BGP next-hop — local PEs can then build an MPLS LSP to the local ASBR loopback using LDP or SR. The ASBR then performs label swapping between the intra-AS label and the inter-AS label received from the remote ASBR.

Question 18

A service provider is comparing inter-AS L3VPN Option A, Option B, and Option C. Which statement correctly characterizes Option C (also called 'Multihop eBGP for labeled routes')?

Accepted Answer

Inter-AS L3VPN Option C (RFC 4364 Option C) avoids the scalability limitations of Option A (per-VRF VLANs between ASBRs) and Option B (VPNv4 state on ASBRs). In Option C, VPNv4 routes are exchanged directly between RRs (or PEs) of different ASes via multihop eBGP sessions — ASBRs do not need to maintain VPN state. Inter-AS labeled transport is provided by exchanging IPv4 labeled unicast routes between ASBRs (eBGP with 'send-label' for the PE loopbacks) and using LDP or SR-MPLS within each AS. This allows end-to-end VPN label stacks to be built from PE to PE across AS boundaries without the ASBR processing VPN routes.

Question 19

An engineer configures BGP-based VPLS on IOS XR. The 'show bgp l2vpn vpls' table shows remote PE MAC-learned routes but customer traffic is not flooding correctly across the VPLS instance. The engineer suspects a split-horizon issue. Which IOS XR command helps verify the pseudowire role and split-horizon status within the VPLS bridge domain?

Accepted Answer

On IOS XR, 'show l2vpn bridge-domain detail' provides comprehensive information about a VPLS bridge domain including: all attachment circuits (ACs) and pseudowires with their operational state, the split-horizon group assignment for each member (members in the same split-horizon group cannot forward to each other — this is what implements the VPLS split-horizon rule), MAC address table entries, and flooding/learning counters. This command is the primary tool for diagnosing VPLS forwarding issues including split-horizon misconfigurations. 'show bgp l2vpn vpls' shows BGP signaling state but not the data-plane bridge domain behavior.

Question 20

An IOS XR BNG router is performing subscriber management for PPPoE sessions. A RADIUS server sends a CoA-Request to update the QoS policy on a live subscriber session. The BNG responds with a CoA-NAK. What is the most common reason a BNG rejects a CoA-Request with a NAK?

Accepted Answer

A RADIUS CoA-NAK (Change of Authorization Negative Acknowledgment) from a BNG most commonly indicates that the session specified in the CoA-Request cannot be located. RADIUS CoA-Requests must include a session identification attribute (typically Acct-Session-Id, NAS-Port, or Cisco VSA session-id) that the BNG uses to find the target session. If the session has already disconnected, if the identifier value doesn't match any active session, or if the request is sent to the wrong BNG (e.g., after a failover), the BNG will return CoA-NAK with Error-Cause attribute 503 (Session Context Not Found). Authentication failures (wrong shared secret) cause the packet to be silently discarded, not NAKed.

Question 21

A carrier Ethernet provider uses Y.1731 OAM for SLA monitoring on customer E-LINE services. Which Y.1731 OAM function measures one-way frame delay variation (jitter) between two MEPs and requires synchronized clocks between the measurement endpoints?

Accepted Answer

ITU-T Y.1731 defines several OAM PDU types for performance monitoring. The One-way Frame Delay Measurement (1DM) PDU embeds a TxTimestampf field with the transmission timestamp. The receiving MEP records the arrival time and computes the one-way frame delay (FD) and one-way frame delay variation (FDV / jitter) by comparing successive measurements. Because only the transmission timestamp is embedded (no reply mechanism), the receiving MEP must have a synchronized clock (typically IEEE 1588 PTP or GPS) to compute absolute one-way delay accurately. The Two-way DMM/DMR mechanism provides round-trip measurements without requiring clock synchronization but cannot directly measure asymmetric one-way delay.

Question 22

An IOS XR PE is configured for MPLS L3VPN. A customer site uses eBGP (PE-CE BGP) to exchange routes with the PE. The PE's VRF configuration includes 'rd 65000:200', 'import route-target 65000:200', and 'export route-target 65000:200'. Under the VRF BGP configuration, the CE is a neighbor in AS 65200. Which IOS XR configuration stanza correctly enables the VRF-specific PE-CE BGP session?

Accepted Answer

In IOS XR, PE-CE BGP for L3VPN is configured within a VRF sub-context of the global 'router bgp' configuration. The correct structure is: router bgp → vrf → neighbor → remote-as → address-family ipv4 unicast → route-policy attachments. The VRF context automatically scopes the BGP session to that VRF's routing table. Option B incorrectly places the CE neighbor under the VPNv4 global address family. Option C uses the CE's AS number as the local ASN, which is incorrect. Option D uses invalid IOS XR syntax — BGP is not configured directly under the VRF context.

Question 23

An IOS XR network engineer wants to stream interface traffic statistics to an external time-series database every 30 seconds using model-driven telemetry with gRPC dial-out transport. Which IOS XR telemetry configuration correctly implements this?

Accepted Answer

IOS XR model-driven telemetry requires three distinct configuration blocks: (1) sensor-group — specifies the YANG sensor paths to stream (here the interface statistics path from the Cisco-IOS-XR-infra-statsd-oper model); (2) destination-group — specifies the collector address, port, encoding format (self-describing-gpb, gpb, or json), and transport protocol (grpc with or without TLS); (3) subscription — links the sensor-group to the destination-group and sets the sample-interval in milliseconds (30000 ms = 30 seconds). Option C uses an incorrect condensed format mixing the three components and uses seconds instead of milliseconds. Options B and D configure SNMP and NETCONF/gRPC server access, not telemetry streaming.

Question 24

A service provider is evaluating Cisco NSO (Network Services Orchestrator) for service automation. Which statement BEST describes the primary role of NSO in an SP network automation architecture?

Accepted Answer

Cisco NSO (formerly Tail-f NCS) is a service orchestration and network automation platform. It uses YANG-based Network Service Packages (NSPs) to model services at an abstract level (e.g., 'L3VPN service' or 'BGP peer') and translates these service intents into device-specific configurations for multi-vendor environments. NSO maintains a Configuration Database (CDB) that tracks the desired state of all devices and can deploy, modify, and delete services atomically. It communicates with devices via NETCONF (primary), CLI over SSH, REST, or vendor-specific protocols using Network Element Drivers (NEDs). It integrates with Crosswork, OSS/BSS systems, and service portals for end-to-end automation.

Question 25

An IOS XR engineer uses NETCONF to retrieve the operational state of all IS-IS adjacencies. The NETCONF RPC uses the 'get' operation with a subtree filter targeting the 'Cisco-IOS-XR-clns-isis-oper' YANG module. Which statement about NETCONF operational data retrieval on IOS XR is correct?

Accepted Answer

In NETCONF (RFC 6241), the 'get-config' RPC retrieves configuration data from a specific datastore (running, startup, or candidate). Operational state data — such as routing adjacencies, interface counters, protocol state, and hardware statistics — is not stored in a configuration datastore. Instead, operational state is retrieved using the 'get' RPC (without a datastore argument), which returns both configuration and operational state data from the device's operational state tree. Subtree filters (or XPath filters) are used to narrow the response to a specific YANG module and path (e.g., the IS-IS adjacency container in Cisco-IOS-XR-clns-isis-oper). IOS XR also supports gNMI Get operations for the same data via the gRPC interface.

350-501 SPCOR — Cisco Certified Internetwork Expert (CCIE) Service Provider