Free Cisco Implementing and Operating Cisco Service Provider Network Core Technologies 350-501 Exam Questions

Question 1

A network engineer is testing an automation platform that interacts with Cisco networking devices via NETCONF over SSH. In accordance with internal security requirements:

NETCONF sessions are permitted only from trusted sources in the 172.16.20.0/24 subnet.

CLI SSH access is permitted from any source.

Which configuration must the engineer apply on R1?

Aconfigure terminal
hostname R1
ip domain-name mydomain.com
crypto key generate rsa
ip ssh version 1
access-list 1 permit 172.16.20.0 0.0.0.255
netconf ssh acl 1
line vty 0 4
transport input ssh
end

Bconfigure terminal
hostname R1
ip domain-name mydomain.com
crypto key generate rsa
ip ssh version 2
access-list 1 permit 172.16.20.0 0.0.0.255
access-list 1 permit any
netconf ssh
line vty 0 4
access-class 1 in
transport input ssh
end

Cconfigure terminal
hostname R1
ip domain-name mydomain.com
crypto key generate rsa
ip ssh version 1
access-list 1 permit 172.16.20.0 0.0.0.255
access-list 2 permit any
netconf ssh
line vty 0 4
access-class 2 in
transport input ssh
end

Dconfigure terminal
hostname R1
ip domain-name mydomain.com
crypto key generate rsa
ip ssh version 2
access-list 1 permit 172.16.20.0 0.0.0.255
netconf ssh acl 1
line vty 0 4
transport input ssh
end

Correct Answer: D. configure terminal hostname R1 ip domain-name mydomain.com crypto key generate rsa ip ssh version 2 access-list 1 permit 172.16.20.0 0.0.0.255 netconf ssh acl 1 line vty 0 4 transport input ssh end

Question 2

Why is the keyword none needed when implementing management plane security using TACACS?

AIt aItovSWMB6ter to query a RADIUS server when the TACACS+ server is unreachable.

BIt allows the local database to authenticate when the TACACS^ server is unreachable.

CIt allows authentication to succeed when the TACACS+ server is unreachable.

DIt prevents all users from accessing router 1 unless the TACACS+ server is reachable,

Correct Answer: C. It allows authentication to succeed when the TACACS+ server is unreachable.

Explanation:

The keyword 'none' is essential in management plane security using TACACS to ensure that authentication can still succeed when the TACACS+ server is unreachable. This fallback mechanism allows network resources to remain accessible even if the TACACS+ server fails or becomes unreachable.Reference: Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) - Management Plane Security section.

Question 3

How does TI-LFA reduce packet loss in Segment routing?

AIt determines which link to use when load balancing to prevent packet fragmentation loss.

BIt establishes multiple labels per path using more than one IGP.

CIt calculates loop-free backup paths that are rapidly implemented in case of a link failure.

DIt enables path selection in SR-TE to support MPLS label allocation.

Correct Answer: C. It calculates loop-free backup paths that are rapidly implemented in case of a link failure.

Question 4

Refer to the exhibit.

A network operator has two IPv4 and IPv6 dual-stacked network on each side of the IPv4 core network. The operator must be able to provide connectivity between them while using specific assigned IPv6 space provided from the company IP administrator team. Which technology should the network operator use to accomplish this goal?

A6rd

BNAT46

CDS-Lite

DNAT44

Correct Answer: B. NAT46

Explanation:

The network operator needs to provide connectivity between two IPv4 and IPv6 dual-stacked networks using specific assigned IPv6 space.NAT46(Network Address Translation 46) is the appropriate technology for this scenario. It allows translation between IPv4 and IPv6 addresses, enabling communication between the dual-stack networks. NAT46 maps IPv6 addresses to IPv4 addresses and vice versa, facilitating seamless communication across different address families.Reference: Implementing and Operating Cisco Service Provider Network Core Technologies

Question 5

A customer of an ISP requests support to setup a BGP routing policy. Which BGP attribute should be configured to choose specific BGP speakers as preferred exit points for the customer AS?

Ahighest local preference outbound

Blowest local preference inbound

Chighest local preference inbound

Dlowest multi-exit discriminator

Correct Answer: A. highest local preference outbound

Explanation:

In BGP, the Local Preference attribute is used to influence the exit point from an AS (Autonomous System). A higher local preference value is preferred, and all routes received inherit the local preference value of the route that is installed in the IP routing table. So, configuring a higher local preference outbound will make specific BGP speakers as preferred exit points for customer AS.Reference:=Cisco

Question 6

Refer to the exhibit.

A network engineer is implementing an LDP-based MPLS solution to enable packet flow between the two bank sites The engineer was given two requirements

* LDP peering must stay up when there is a link failure between R3 and R6

* LDP peering must not flap when there is a link failure between R5 and R6

Which action meets these requirements?

AEnable Link LDP on R4 and R6

BReset the LDP session between R4 and R6

CConfigure LDP Session Protection on R4

DImplement an LDP targeted session with R4 on R6

Correct Answer: C. Configure LDP Session Protection on R4

Question 7

When implementing a REST API, how does an engineer mitigate security risks?

Aby configuring the system to authenticate the client's identity and avoid broken authentication

Bby configuring object properties to protect data

Cby configuring separate authorization schemes to securely compartmentalize different areas of the business

Dby configuring rate limiting to reduce the risk of DOS and DDOS attacks against the system

Correct Answer: D. by configuring rate limiting to reduce the risk of DOS and DDOS attacks against the system

Question 8

Refer to the exhibit.

While troubleshooting the network, a network operator with an employee id: 3812:12:993 is trying to ping XR1. Which result should the operator expect when trying to ping to an XR1 local address?

AICMP traffic works at a policed rate of 19 bytes per second every 100 ms

BAll ICMP traffic responds successfully.

CAll ICMP traffic is dropped.

DICMP traffic works at a policed rate of 19 packets every 100 ms.

Correct Answer: C. All ICMP traffic is dropped.

Explanation:

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-5/ip-addresses/configuration/guide/b-ip-addresses-cg-asr9000-65x/m-implementing-lpts-asr9000-crs.html

Question 9

Which control plane protocol is used between Cisco SD-WAN routers and vSmart controllers?

AOTCP

BOMP

CUDP

DBGP

Correct Answer: B. OMP

Explanation:

The control plane protocol used between Cisco SD-WAN routers and vSmart controllers is the Overlay Management Protocol (OMP). OMP is a proprietary protocol of Cisco SD-WAN that facilitates the exchange of routing, policy, and management information across the network.It operates within the secure environment provided by the Datagram Transport Layer Security (DTLS) or Transport Layer Security (TLS) control connection, ensuring that the communication between the routers and controllers is encrypted and authenticated1.

Question 10

A network operator needs to implement PIM-SSM multicast configuration on customer's network so that users in different domains are able to access and stream live traffic. Which two actions must the engineer perform on the network

to make the streaming work? (Choose two.)

AConfigure at least one MSDP peer on the network

BEnable IGMP version 2 at the interface lever.

CEnable PIM sparse mode on the device.

DEnable IGMP version 3 at the interface level.

EEnable PM dense mode on the device.

Correct Answer: C. Enable PIM sparse mode on the device.; D. Enable IGMP version 3 at the interface level.

Explanation:

Remember that SSM is an extension of IP multicast where datagram traffic is forwarded only from explicitly joined multicast sources to receivers. It creates source-specific multicast distribution trees without shared trees.

Cisco PIM-SSM Configuration Example

Cisco IP Multicast: PIM Configuration Guide

Question 11

Refer to the exihibit.

Refer to the exhibit. R1 has two upstream Tier 1 service providers. BGP is in use as the exterior routing protocol, and ISP_A and ISP_B are sending the full BGP table. A network engineer must assign local-preference 70 to all routes with multiple exit discriminator 30. Which configuration must the network engineer apply?

AOption A

BOption B

COption C

DOption D
The configuration in Option C uses a route policy that checks if the MED is equal to 30 and then sets the local-preference to 70. This aligns with the requirement to prioritize routes with a MED of 30 by assigning them a higher local-preference value, which influences the BGP path selection process in favor of these routes.

Correct Answer: C. Option C

Question 12

Refer to the exihibit.

Refer to the exhibit. A network engineer is configuring router RB to secure BGP advertisements against route hijacking activity. RB must validate all prefixes that it receives from origin AS 200 before installing them in the BGP route table. Which configuration meets the requirement?

ARB(config)# router bgp 100
RB(config-router)# address-family ipv4 unicast
RB(config-router-af)# bgp bestpath origin-as use validity

BRB(config-bgp)# router bgp 100
RB(config-bgp)# bgp origin-as validation signal ibgp
RB(config-bgp)# bgp bestpath origin-as allow invalid

CRB(config-bgp)# router bgp 100
RB(config-bgp)# bgp origin-as validation time off

DRB(config)# router bgp 100
RB(config-router)# address-family ipv4 unicast
PB(config-router-af)# bgp origin-as validation enable

Correct Answer: C. RB(config-bgp)# router bgp 100 RB(config-bgp)# bgp origin-as validation time off

Question 13

Refer to the exhibit.

What is the result of this configuration?

ARouter 1 opens and closes a TCP connection to the TACACS+ server every time a user requires authorization.

BRouter 1 and the TACACS+ server maintain one open connection between them only when network administrator is accessing the router with password ciscotest.

CRouter 1 and the TACACS+ server maintain one open connection between them.

DRouter 1 opens and closes a TCP connection to the TACACS+ server every time a user requires authentication.

Correct Answer: C. Router 1 and the TACACS+ server maintain one open connection between them.

Explanation:

In the given configuration, ''tacacs-server host 192.168.1.2 single-connection'' indicates that Router 1 will maintain a single connection to the TACACS+ server at IP address 192.168.1.2 for multiple authorization requests instead of opening a new connection for each request. This can be efficient in scenarios where there are frequent authorization requests as it reduces the overhead associated with establishing a new TCP connection each time.

Question 14

Refer to the exihibit.

Refer to the exhibit. EIGRP is running between routers R5 and R1, and OSPF is used in the rest of the network. Users in a network attached to router R3 need to access a server connected to R5. Which task must the engineer perform so that only the users attached to R3 are able to access the server, but no other network is shared to OSPF?

AConfigure redistribution using route maps to filter the routes that are shared

BConfigure redistribution using an offset list to filter the routes that are shared.

CConfigure an OSPF virtual link between R1 and R3 to route traffic between the two areas.

DConfigure R1 as a stub router for EIGRP and OSPF so that only the default route is shared

Correct Answer: A. Configure redistribution using route maps to filter the routes that are shared

Question 15

How does an untrusted interface at the boundary of an administrative domain handle incoming packets?

AIt remarks all values to a CoS of 0.

BIt forwards only traffic with a DSCP value of 48.

CIt translates the IP precedence value to the corresponding DSCP value.

DIt drops all traffic ingressing the network.

Correct Answer: A. It remarks all values to a CoS of 0.

AI Usage Disclosure

This page contains 15 free Cisco 350-501 practice questions with correct answers and explanations, taken from a question bank of 547 questions for the Implementing and Operating Cisco Service Provider Network Core Technologies exam.

Page: Cisco Implementing and Operating Cisco Service Provider Network Core Technologies 350-501 Exam Questions
URL: https://www.certsprime.com/cisco/350-501/practice-questions
Exam: Cisco 350-501 - Implementing and Operating Cisco Service Provider Network Core Technologies
Questions on this page: 15 free questions with answers and explanations
Total questions in exam: 547
Publisher: CertsPrime
Last updated: October 8, 2026

Cite as

CertsPrime. (2026, October 8). Cisco Implementing and Operating Cisco Service Provider Network Core Technologies 350-501 Exam Questions. Retrieved from https://www.certsprime.com/cisco/350-501/practice-questions