Cisco Service Provider Core Specialist — Practice Set 1

Question 1

A network engineer examines a service provider topology. Traffic from a customer DSL modem flows to a DSLAM, then to a regional aggregation router, then across the MPLS backbone, and finally to an internet peering router that connects to other autonomous systems. Which SP network tier does the regional aggregation router represent?

Accepted Answer

In a standard SP network hierarchy, the access tier directly connects to customer equipment (DSLAMs, ONTs, CPE). The aggregation tier sits above the access tier and collects traffic from multiple access devices, providing traffic concentration and often subscriber management functions. The core tier provides high-speed backbone switching, and the peering tier handles inter-AS connectivity at IXPs. The regional aggregation router in this scenario sits between the DSLAM (access) and the MPLS backbone (core), making it an aggregation-tier device.

Question 2

An engineer reviews an IOS XR system and notices that after a 'process restart bgp' command, IS-IS adjacencies remained stable and MPLS forwarding continued without interruption. Which IOS XR design principle explains this behavior?

Accepted Answer

IOS XR is built on a microkernel architecture (based on QNX) where each routing protocol, management plane application, and forwarding component runs as an independent user-space process in its own protected memory space. A BGP process restart is contained entirely within the BGP process — it cannot write to or corrupt the memory of IS-IS, MPLS, or the forwarding plane processes. The forwarding hardware continues to use its installed FIB entries uninterrupted. This process isolation is a foundational high-availability design principle of IOS XR.

Question 3

A service provider is deploying PE routers at the edge of their MPLS network and P routers in the core. The PE routers need to support BNG subscriber management, L2VPN services, and MPLS L3VPN with complex QoS hierarchies. The P routers need maximum port density and throughput at minimum cost per bit. Which Cisco platform assignment is most appropriate?

Accepted Answer

The Cisco ASR 9000 is a services-oriented modular platform with custom Cisco QuantumFlow Processor (QFP) ASICs designed specifically for rich feature support including BNG subscriber management, hierarchical QoS, L2VPN (VPLS, EVPN), and MPLS L3VPN at the PE edge. The NCS 5500 uses Broadcom Jericho2 merchant silicon which delivers industry-leading port density and throughput at low cost-per-bit — ideal for core P routers performing simple MPLS label switching at very high rates. This heterogeneous deployment is a common and recommended SP design pattern.

Question 4

A service provider examines a router that shows the following output. What does this indicate about the router's HA configuration?

RP/0/RSP0/CPU0:PE1# show redundancy
Active node: 0/RSP0/CPU0
Standby node: 0/RSP1/CPU0
Standby node state: Ready
NSR: Enabled

Accepted Answer

The 'show redundancy' output shows a healthy dual-RP setup: the active RP is in slot 0/RSP0 and the standby RP is in 0/RSP1 with state 'Ready', meaning it is fully synchronized and can take over immediately. 'NSR: Enabled' means Non-Stop Routing is active — routing protocol state (BGP TCP sessions, IS-IS adjacency state, etc.) is continuously replicated from the active RP to the standby RP. If the active RP fails, the standby RP takes over all routing sessions transparently without any BGP session resets or IS-IS adjacency drops.

Question 5

A service provider's carrier Ethernet team is deploying an E-LINE service for a financial institution connecting two sites. The customer requires transparent Ethernet transport with preserved 802.1Q VLAN tags (customer VLANs must pass through unchanged). Which MEF service attribute enables this?

Accepted Answer

MEF E-LINE services can be provisioned as either port-based (all traffic from the UNI port is transported, including any VLAN tags) or VLAN-based (specific 802.1Q VLAN IDs are mapped to an EVC). CE-VLAN ID preservation is a MEF service attribute that specifies whether the customer's original 802.1Q VLAN tags are delivered transparently to the remote UNI — for financial customers requiring transparent LAN extension, preserving CE-VLAN tags is typically required. Q-in-Q (802.1ad) adds an outer SP VLAN tag while preserving the inner customer tag; untagged-only operation is not a standard E-LINE requirement.

Question 6

An engineer runs 'show isis adjacency' on an IOS XR router and sees the following output. What does the 'UP' state and 'L2' level indicate?

System Id      Interface      SNPA           State  Hold Changed  NSF IPv4/IPv6
P-ROUTER-2     Gi0/0/0/1      *PtoP*         Up     26   00:04:32  Capable  Up/None

Accepted Answer

In IS-IS, Level 1 (L1) routing is intra-area (routing within a single IS-IS area), and Level 2 (L2) routing is inter-area (routing between different IS-IS areas — the backbone). An L2 adjacency means both routers are L2 or L1/L2 routers and are exchanging Level 2 LSPs. The 'Up' state confirms the adjacency is active. 'NSF Capable' in the output indicates that the IS-IS neighbor has advertised Graceful Restart (NSF) capability in its IIH hello PDUs. The Hold timer shows the remaining time before the adjacency would expire if no hellos are received — it is constantly refreshed by incoming IIH packets.

Question 7

An IOS XR engineer needs to verify that BFD sessions are active for all BGP neighbors. The engineer runs 'show bfd session'. Which fields in the output confirm the BFD session is actively monitoring the BGP peer?

Accepted Answer

In IOS XR 'show bfd session' output, the key indicators of a healthy active BFD session are: 'State: Up' (session is actively exchanging BFD control packets and the path is verified), and 'H/W: Yes' (the BFD session has been offloaded to line card hardware, enabling microsecond-level packet processing without RP involvement). When BFD detects a failure, it immediately notifies the client protocol (BGP in this case), which triggers fast convergence. 'State: Init' indicates the session is still being established (not a steady state). BFD sessions for all client protocols (BGP, IS-IS, OSPF, RSVP) are visible in 'show bfd session'.

Question 8

An engineer reviews the following IOS XR BGP configuration on a PE router. What is the role of the 'update-source Loopback0' statement?

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2
  remote-as 65000
  update-source Loopback0
  address-family vpnv4 unicast

Accepted Answer

The 'update-source' command specifies the source IP address that IOS XR BGP uses for the TCP session establishing the BGP peering. Using Loopback0 (or any loopback interface) as the source is a best practice for iBGP sessions in SP networks because loopback interfaces never go down as long as the router is operational — they are not affected by physical link failures. If the BGP session were sourced from a physical interface IP address, any failure of that interface would reset the BGP session even if alternative paths exist via other interfaces. The neighbor's BGP configuration must reference the loopback IP, and the loopback must be reachable via the IGP (IS-IS or OSPF).

Question 9

An engineer interprets the following IOS XR 'show bgp vpnv4 unicast all summary' output. PE-1 has neighbor 10.0.0.5 showing 'Idle' state. What is the most likely cause and first troubleshooting step?

Neighbor     Spk  AS MsgRcvd MsgSent  TblVer  InQ OutQ  Up/Down  St/PfxRcd
10.0.0.5       0 65000      0       0       0    0    0 00:00:15   Idle

Accepted Answer

In BGP, 'Idle' with 0 messages sent/received and a very recent Up/Down timestamp (15 seconds) indicates the session has not been able to complete the TCP handshake — the BGP session never reached Active or OpenSent state. The most common causes are: (1) the loopback IP used as the BGP source is not reachable via the IGP from the remote end, (2) incorrect 'update-source' configuration — the local router is sourcing the session from a different address than the remote router expects, or (3) a firewall/ACL blocking TCP port 179. 'show route 10.0.0.5' verifies IGP reachability to the intended neighbor loopback. Idle is never a normal steady state for an expected BGP session.

Question 10

An IOS XR router is configured with IS-IS metric-style wide and segment routing MPLS. The engineer wants to verify that prefix SIDs are being advertised in the IS-IS LSP for the router's loopback. Which IOS XR command displays the IS-IS link state database entry for the local router including SR prefix-SID advertisements?

Accepted Answer

The 'show isis database detail' command displays the full content of the IS-IS Link State Database, including all TLVs and sub-TLVs from all routers in the IS-IS domain. For SR-enabled routers, the LSP will contain SR-specific TLVs including the SR Capabilities sub-TLV (advertising the SRGB range), and for each prefix (such as the loopback), a Prefix-SID sub-TLV in TLV 135/235 containing the SID index value. This is the primary command to verify that a router is correctly advertising its SR capabilities and prefix SIDs to the rest of the IS-IS domain. The detail output shows all TLV types including SR-specific extensions.

Question 11

An IOS XR engineer is configuring QoS on an MPLS core interface to prioritize voice traffic (MPLS EXP 5) and assign it to a strict priority queue. The interface is GigabitEthernet0/0/0/2. Which IOS XR QoS configuration correctly implements this?

Accepted Answer

In IOS XR, MPLS EXP-based QoS requires: (1) a class-map using 'match mpls experimental topmost <value>' to match the EXP bits in the topmost MPLS label — 'topmost' specifies the outermost label in the stack; (2) a policy-map with the class assigned to 'priority level 1' (strict priority/LLQ); (3) the policy-map applied to the interface output direction using 'service-policy output'. Option A has a 'service-policy' statement inside the policy-map which is invalid (that's a nested policy-map, not an interface application). Options C and D use incorrect syntax for MPLS EXP matching.

Question 12

An engineer configures PIM-SM on an IOS XR router. The RP address is 10.255.255.1 and must be statically configured. The interface toward the RP is GigabitEthernet0/0/0/0. Which IOS XR command correctly configures the static RP?

Accepted Answer

In IOS XR, PIM-SM configuration is done within the 'router pim' configuration hierarchy. The RP address is configured under the address-family context: 'router pim' → 'address-family ipv4' → 'rp-address <RP-IP>'. The optional 'group-list' parameter can restrict which multicast groups use this RP. Option A uses IOS (classic) syntax ('ip pim'). Option C incorrectly places the RP address under the 'multicast-routing' interface configuration — this section configures multicast forwarding on interfaces, not the RP address. Option D uses invalid 'rp-static' syntax that is not standard IOS XR.

Question 13

An engineer is troubleshooting BGP route policy application on IOS XR. The engineer needs to check which routes from eBGP peer 198.51.100.5 are being accepted after the inbound route-policy is applied. Which command directly shows the routes received from a specific neighbor after policy processing?

Accepted Answer

In IOS XR (consistent with IOS behavior), BGP provides two views of received routes per neighbor: 'show bgp neighbors received-routes' shows the Adj-RIB-In (pre-policy) — all routes received from the neighbor BEFORE any inbound route-policy is applied (requires 'soft-reconfiguration inbound' or 'route-policy-changed' to be stored). 'show bgp neighbors routes' shows the routes that actually passed the inbound policy and were accepted into the BGP table — the Adj-RIB-In post-policy view. To debug which routes a policy is accepting or rejecting, comparing the two outputs reveals which prefixes the policy filtered.

Question 14

An IOS XR router shows the following BFD session output for an IS-IS neighbor. The state is 'Down'. The IS-IS adjacency is still 'Up'. What does this indicate?

RP/0/RSP0/CPU0:PE1# show bfd session
IPv4:
Neighbor     State  Detect Mult  Desired TX Interval  Required RX Interval
10.1.1.2     Down   3            300ms                300ms

Accepted Answer

When BFD is enabled under the IS-IS interface configuration ('bfd minimum-interval multiplier '), IOS XR registers IS-IS as a client of the BFD session. If BFD detects the neighbor as down (the BFD session state transitions to 'Down'), BFD immediately notifies IS-IS, which should cause IS-IS to tear down the adjacency immediately — much faster than waiting for the IS-IS hold timer to expire. If BFD shows 'Down' but IS-IS is still 'Up', it may indicate a timing window (IS-IS notification is pending), a misconfiguration where BFD is not registered to IS-IS on this interface, or an IOS XR software issue. The correct behavior is IS-IS adjacency teardown within milliseconds of BFD declaring the session down.

Question 15

An engineer runs 'show mpls ldp neighbor' on an IOS XR router. The output shows a neighbor with state 'Operational'. What does this indicate?

Accepted Answer

In IOS XR, LDP neighbor states progress from discovery (UDP hello received) to TCP session establishment to label binding exchange. The 'Operational' state in 'show mpls ldp neighbor' output indicates the LDP session has fully established — the TCP connection is up, the LDP initialization exchange is complete, and label bindings are actively being advertised and received. This is the steady-state for a functioning LDP peer relationship. Partial states (such as 'TCP connecting' or 'Init') indicate the session is still being established.

Question 16

An engineer verifies MPLS L3VPN forwarding and runs 'show mpls forwarding' on a PE router. For the remote PE's loopback prefix 10.0.0.2/32, the output shows label operation 'Swap 16002' on outgoing interface GigabitEthernet0/0/0/0. What does the 'Swap 16002' operation indicate?

Accepted Answer

In MPLS, the three fundamental label operations are Push (add a label to the stack), Pop (remove the top label), and Swap (replace the top label with a new value). A 'Swap 16002' operation at a transit LSR (P router or PE forwarding toward a remote PE) means: receive the packet with the current top label, replace that label value with 16002, and forward out the specified interface. Label 16002 is a Segment Routing label derived from the SRGB base plus the prefix-SID index of the remote PE's loopback (e.g., SRGB base 16000 + index 2 = 16002). The packet continues through the MPLS network with the swapped label until it reaches the label owner.

Question 17

An engineer runs 'show segment-routing traffic-eng policy detail' on an IOS XR router and sees the following:

Policy: SR-TE-POLICY-1  Color: 100  End-point: 10.0.0.5
  Status: Up  Admin: up  Operational: up
  Candidate-paths:
    Preference: 200 (explicit)  Active
      Explicit: segment-list SL-PRIMARY
        10.0.0.2  [16002]  16003  16005
    Preference: 100 (dynamic)
      Weight: 0  Metric Type: TE

What does the candidate-path with Preference 200 indicate?

Accepted Answer

In IOS XR SR-TE policy, candidate-paths can be explicit (operator-defined segment lists) or dynamic (PCE or local computation). When multiple candidate-paths exist for the same policy, the one with the HIGHEST preference value is selected as the active path — higher preference wins (this is the opposite of OSPF/IS-IS metric where lower is better). The segment list [16002, 16003, 16005] is an ordered stack of SR labels (prefix-SIDs or adjacency-SIDs) that define the explicit path through the network. The packet enters the network with this label stack imposed and follows the explicit path through nodes 10.0.0.2 → next → next → 10.0.0.5. The dynamic path (preference 100) is a backup activated only if the explicit path becomes unavailable.

Question 18

An IOS XR PE router is configured with MPLS LDP. The engineer verifies the LDP configuration with 'show mpls ldp parameters' and notices the LDP router-id is set to 10.0.0.1 (Loopback0). Why is it important to configure the LDP router-id explicitly as the loopback address?

Accepted Answer

IOS XR LDP selects a router-id automatically if not explicitly configured — it chooses the highest numerical IP address from any interface that is up. If a physical interface is selected and that interface goes down (link failure, maintenance), the LDP router-id changes or becomes unavailable, causing all LDP sessions to reset and all label bindings to be withdrawn and re-established. Explicitly configuring the LDP router-id to a loopback address ('mpls ldp router-id Loopback0 force' in IOS XR) ensures stability because loopback interfaces are always up as long as the router is running. This is a critical best practice in SP deployments.

Question 19

An engineer runs 'show mpls ldp bindings 10.1.1.0 24 detail' on an IOS XR PE router and sees the prefix has a local binding with label 24001 and a remote binding from neighbor 10.0.0.2 with label 16001. The entry is marked 'Used' for the remote binding. What does 'Used' indicate for the remote binding?

Accepted Answer

In IOS XR 'show mpls ldp bindings' output, the LIB (Label Information Base) stores all label bindings received from all LDP neighbors (remote bindings) and locally assigned bindings (local bindings). For remote bindings, the 'Used' flag indicates that this particular binding has been selected as the best/active binding and has been installed in the LFIB (Label Forwarding Information Base) — it is the label that will be used in the MPLS label swap operation when forwarding traffic toward prefix 10.1.1.0/24 via the next-hop neighbor. Bindings from other neighbors for the same prefix will be in the LIB but not marked 'Used' if they lost the best-path selection.

Question 20

An IOS XR PE router is configured with an L2VPN xconnect group for a pseudowire to a remote PE at 10.0.0.8. The engineer runs 'show l2vpn xconnect' and sees the pseudowire state is 'UP UP'. What does the 'UP UP' status represent?

Accepted Answer

In IOS XR 'show l2vpn xconnect' output, the two-field status (e.g., 'UP UP') reports the state of the two components that make up a point-to-point xconnect: the first field is the state of the AC (Attachment Circuit) — the customer-facing interface (e.g., an Ethernet subinterface or port); the second field is the state of the PW (Pseudowire) — the MPLS-encapsulated tunnel to the remote PE. Both must be 'UP' for end-to-end L2VPN service to work. Common failure states include 'DN DN' (both down), 'UP DN' (AC is up but pseudowire is down, often due to MPLS connectivity issue), or 'DN UP' (pseudowire is up but the customer interface is down).

Question 21

An engineer needs to verify that a VPLS instance on IOS XR is learning customer MAC addresses correctly on both local attachment circuits and remote pseudowires. Which IOS XR command displays the MAC address table for a specific VPLS bridge domain?

Accepted Answer

In IOS XR, VPLS MAC address tables are maintained within L2VPN bridge domains. The command 'show l2vpn bridge-domain bd-name <NAME> mac detail' displays the MAC address table for the specified bridge domain, including: learned MAC addresses, the interface or pseudowire through which each MAC was learned, aging timers, and static vs. dynamic entries. The 'detail' keyword shows additional information including the MPLS label used to reach remote MAC addresses via pseudowires. 'show mac-address-table vlan' is IOS/NX-OS syntax. 'show arp' shows Layer 3 ARP entries, not Layer 2 MAC forwarding tables.

Question 22

A service provider configures a VPLS service on IOS XR using LDP signaling. Two PE routers (PE1 and PE2) are configured in the same VPLS instance. An engineer on PE1 runs 'show l2vpn bridge-domain detail' and sees the pseudowire to PE2 is in 'Standby' state despite both PE routers being reachable. What is the most likely cause?

Accepted Answer

In MPLS pseudowire and VPLS signaling via LDP (RFC 4447), LDP Label Mapping messages include interface parameters TLVs that must match on both endpoints for the pseudowire to transition to 'Up' state. One critical parameter is MTU — both PEs must agree on the MTU of the pseudowire. If PE1 signals MTU 1500 and PE2 signals MTU 9000 (or any mismatch), LDP will refuse the label mapping and the pseudowire remains in 'Standby' (signaled but not operationally active). Other parameters that can cause this include encapsulation type and VLAN ID. The VC ID mismatch would prevent LDP signaling from matching the pseudowire at all (the pseudowire wouldn't be found). The 'show l2vpn xconnect detail' command shows the specific mismatch reason.

Question 23

A BNG engineer on IOS XR configures subscriber access for PPPoE sessions. The subscribers need to be authenticated via RADIUS and have their IP addresses assigned from a local IP pool. Which IOS XR configuration component defines the local IP address pool for PPPoE subscriber assignment?

Accepted Answer

In IOS XR BNG, local IPv4 address pools for subscriber assignment are configured under the 'pool vrf ipv4 ' configuration hierarchy: 'pool vrf default ipv4 PPPoE-POOL' → 'address range 100.64.0.1 100.64.1.254'. This creates a named pool in the context of a specific VRF. The pool name is then referenced in the subscriber service profile or directly in the RADIUS response via the Framed-Pool attribute. Option A uses IOS (classic) syntax. Option C uses DHCP pool syntax which is separate from PPPoE IP address assignment. Option D uses invalid syntax.

Question 24

An IOS XR engineer wants to retrieve the running configuration of a router using NETCONF. Which NETCONF RPC operation and datastore target are used to retrieve the running configuration?

Accepted Answer

NETCONF (RFC 6241) defines the 'get-config' RPC for retrieving configuration data from a specific datastore. The running datastore contains the active configuration currently being used by the device. The correct RPC is:

. The 'get' RPC (without '-config') retrieves operational state data as well as configuration from the device's operational state tree — it does not target a specific configuration datastore. The candidate datastore is an optional writeable workspace for staging configuration changes before committing them to running — it does not automatically mirror running.

Question 25

A service provider deploys model-driven telemetry on IOS XR routers and streams BGP session state data to a time-series database. The engineer needs to verify on the router that the telemetry subscription is active and data is being sent. Which IOS XR command shows the telemetry subscription status and counters?

Accepted Answer

In IOS XR, 'show telemetry model-driven subscription' displays the status of all configured model-driven telemetry subscriptions. The output shows: subscription name and ID, associated sensor-groups and destination-groups, operational state (Active/Inactive), collection intervals, and critically — counters showing the number of collection cycles completed and data messages sent to the destination collector. This command is the primary operational tool for verifying that telemetry streaming is working correctly. 'show telemetry model-driven destination' shows the connection status to the collector. 'show grpc trace' shows gRPC transport-level debugging but not subscription-level telemetry status.

350-501 SPCOR — Cisco Service Provider Core Specialist