Question 750
After Bluebird Infrastructure deploys L2VPN pseudowire redundancy to protect a point-to-point Layer-2 service against a failed primary pseudowire, the primary acceptance check passes (traffic transfers to backup without exposing a second active loop path). What remaining operational risk should still be part of the design review?
- The access-side tag rewrite and transport MTU must be compatible at each endpoint.
- Backup path may share the same physical failure domain as primary.
- Per-VRF handoff scaling and operational overhead grow with service count.
- Excess offered load can still cause queue delay or eventual buffer drops.
Explanation
Correct Answer
B:The relevant boundary of L2VPN pseudowire redundancy is that backup path may share the same physical failure domain as primary. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to E-Line attachment circuit binding in a different scenario where operators need to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. For the deployed L2VPN pseudowire redundancy approach, the relevant caution is instead that backup path may share the same physical failure domain as primary.
C:This concern applies to inter-AS VPN option A separation in a different scenario where operators need to interconnect L3VPN sites across two providers without sharing their internal VPNv4 BGP tables. For the deployed L2VPN pseudowire redundancy approach, the relevant caution is instead that backup path may share the same physical failure domain as primary.
D:This concern applies to traffic shaping smoothing in a different scenario where operators need to smooth an egress stream to a slower contracted handoff rather than dropping every burst. For the deployed L2VPN pseudowire redundancy approach, the relevant caution is instead that backup path may share the same physical failure domain as primary.
Question 751
Horizon Exchange must prevent two subscribers with overlapping private addresses from mixing their forwarding routes. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- shared extranet route import
- 802.1ad Q-in-Q tag separation
- VRF customer routing isolation
- PIM bidirectional shared delivery
Explanation
Correct Answer
C:VRF customer routing isolation matches this requirement: the team should create separate VRFs and bind the correct customer interfaces to each table. A relevant outcome would be that the same IPv4 subnet can exist independently in both customer routing tables.
Incorrect Answers
A:shared extranet route import instead addresses a different condition: let only selected tenants reach a common internal service subnet. It would instead require you to create explicit selective route-target import or route-leak policies for the shared service, not the stated goal to prevent two subscribers with overlapping private addresses from mixing their forwarding routes.
B:802.1ad Q-in-Q tag separation instead addresses a different condition: carry duplicate customer VLAN IDs from multiple subscribers over a provider Ethernet access network. It would instead require you to push a provider service VLAN tag while preserving each customer's C-tag, not the stated goal to prevent two subscribers with overlapping private addresses from mixing their forwarding routes.
D:PIM bidirectional shared delivery instead addresses a different condition: support a many-to-many multicast service using appropriate shared distribution state. It would instead require you to configure supported bidirectional PIM and corresponding RP infrastructure, not the stated goal to prevent two subscribers with overlapping private addresses from mixing their forwarding routes.
Question 752
At Cedar Wireless, the engineering change is approved for VRF customer routing isolation. The specific goal is to prevent two subscribers with overlapping private addresses from mixing their forwarding routes. Which implementation step belongs in this change plan?
- Create explicit selective route-target import or route-leak policies for the shared service.
- Push a provider service VLAN tag while preserving each customer's C-tag.
- Configure supported bidirectional PIM and corresponding RP infrastructure.
- Create separate VRFs and bind the correct customer interfaces to each table.
Explanation
Correct Answer
D:Implementing VRF customer routing isolation requires the operator to create separate VRFs and bind the correct customer interfaces to each table. This makes the required goal testable using evidence that the same IPv4 subnet can exist independently in both customer routing tables.
Incorrect Answers
A:The proposed step is for shared extranet route import, whose purpose is to let only selected tenants reach a common internal service subnet. It would not perform the necessary VRF customer routing isolation operation: create separate VRFs and bind the correct customer interfaces to each table.
B:The proposed step is for 802.1ad Q-in-Q tag separation, whose purpose is to carry duplicate customer VLAN IDs from multiple subscribers over a provider Ethernet access network. It would not perform the necessary VRF customer routing isolation operation: create separate VRFs and bind the correct customer interfaces to each table.
C:The proposed step is for PIM bidirectional shared delivery, whose purpose is to support a many-to-many multicast service using appropriate shared distribution state. It would not perform the necessary VRF customer routing isolation operation: create separate VRFs and bind the correct customer interfaces to each table.
Question 753
Willow Regional has deployed VRF customer routing isolation to prevent two subscribers with overlapping private addresses from mixing their forwarding routes. The implementation step was to create separate VRFs and bind the correct customer interfaces to each table. Which observation demonstrates that the requested service is working?
- The same IPv4 subnet can exist independently in both customer routing tables.
- Authorized VRFs reach the shared prefix while unrelated VRFs remain isolated.
- Provider S-tag distinguishes the subscriber services independently of C-tag values.
- Forwarding follows the bidirectional shared tree without source-specific shortest path switching.
Explanation
Correct Answer
A:For VRF customer routing isolation, successful verification means that the same IPv4 subnet can exist independently in both customer routing tables. That evidence directly tests whether the provider can prevent two subscribers with overlapping private addresses from mixing their forwarding routes after deployment.
Incorrect Answers
B:The observation would verify shared extranet route import under the separate requirement to let only selected tenants reach a common internal service subnet. It does not demonstrate the needed VRF customer routing isolation result: the same IPv4 subnet can exist independently in both customer routing tables.
C:The observation would verify 802.1ad Q-in-Q tag separation under the separate requirement to carry duplicate customer VLAN IDs from multiple subscribers over a provider Ethernet access network. It does not demonstrate the needed VRF customer routing isolation result: the same IPv4 subnet can exist independently in both customer routing tables.
D:The observation would verify PIM bidirectional shared delivery under the separate requirement to support a many-to-many multicast service using appropriate shared distribution state. It does not demonstrate the needed VRF customer routing isolation result: the same IPv4 subnet can exist independently in both customer routing tables.
Question 754
While troubleshooting VRF customer routing isolation at Atlas Backbone, the intended acceptance outcome is still missing: the same IPv4 subnet can exist independently in both customer routing tables. Which fault condition should be investigated first for this particular design?
- All customer routes are mutually imported to enable one shared application.
- Both CE interfaces enter the global table and routes collide.
- Customer C-tag alone is treated as globally unique across unrelated tenants.
- PIM-SM source tree behavior is expected to apply to BIDIR shared-tree traffic.
Explanation
Correct Answer
B:The suspected defect directly frustrates VRF customer routing isolation: both CE interfaces enter the global table and routes collide. Correcting it should allow verification that the same IPv4 subnet can exist independently in both customer routing tables.
Incorrect Answers
A:This defect belongs to shared extranet route import, where the affected outcome is to let only selected tenants reach a common internal service subnet. It is not the direct failure mode identified for the VRF customer routing isolation design in this case: both CE interfaces enter the global table and routes collide.
C:This defect belongs to 802.1ad Q-in-Q tag separation, where the affected outcome is to carry duplicate customer VLAN IDs from multiple subscribers over a provider Ethernet access network. It is not the direct failure mode identified for the VRF customer routing isolation design in this case: both CE interfaces enter the global table and routes collide.
D:This defect belongs to PIM bidirectional shared delivery, where the affected outcome is to support a many-to-many multicast service using appropriate shared distribution state. It is not the direct failure mode identified for the VRF customer routing isolation design in this case: both CE interfaces enter the global table and routes collide.
Question 755
After Starlight IP Services deploys VRF customer routing isolation to prevent two subscribers with overlapping private addresses from mixing their forwarding routes, the primary acceptance check passes (the same IPv4 subnet can exist independently in both customer routing tables). What remaining operational risk should still be part of the design review?
- Overly broad import policies break isolation and complicate return routing.
- Link MTU must allow the additional Ethernet tag bytes.
- Intentional shared services require explicit route-leak controls.
- Bidirectional mode has distinct DF and topology design requirements.
Explanation
Correct Answer
C:The relevant boundary of VRF customer routing isolation is that intentional shared services require explicit route-leak controls. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to shared extranet route import in a different scenario where operators need to let only selected tenants reach a common internal service subnet. For the deployed VRF customer routing isolation approach, the relevant caution is instead that intentional shared services require explicit route-leak controls.
B:This concern applies to 802.1ad Q-in-Q tag separation in a different scenario where operators need to carry duplicate customer VLAN IDs from multiple subscribers over a provider Ethernet access network. For the deployed VRF customer routing isolation approach, the relevant caution is instead that intentional shared services require explicit route-leak controls.
D:This concern applies to PIM bidirectional shared delivery in a different scenario where operators need to support a many-to-many multicast service using appropriate shared distribution state. For the deployed VRF customer routing isolation approach, the relevant caution is instead that intentional shared services require explicit route-leak controls.
Question 756
Northstar Carrier must make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- L3VPN label blackhole diagnosis
- EVPN single-active access design
- E-Line attachment circuit binding
- route distinguisher VPN identity
Explanation
Correct Answer
D:route distinguisher VPN identity matches this requirement: the team should assign suitable unique route distinguishers to the customer VPN routes. A relevant outcome would be that remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
Incorrect Answers
A:L3VPN label blackhole diagnosis instead addresses a different condition: investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It would instead require you to check transport label and VPN service label resolution from ingress to egress, not the stated goal to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements.
B:EVPN single-active access design instead addresses a different condition: make only one provider edge forward traffic for a protected customer Ethernet segment. It would instead require you to configure supported single-active EVPN multihoming and designated-forwarder behavior, not the stated goal to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements.
C:E-Line attachment circuit binding instead addresses a different condition: bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. It would instead require you to associate the customer attachment circuit with the configured point-to-point xconnect and pseudowire, not the stated goal to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements.
Question 757
At Orion Transit, the engineering change is approved for route distinguisher VPN identity. The specific goal is to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements. Which implementation step belongs in this change plan?
- Assign suitable unique route distinguishers to the customer VPN routes.
- Check transport label and VPN service label resolution from ingress to egress.
- Configure supported single-active EVPN multihoming and designated-forwarder behavior.
- Associate the customer attachment circuit with the configured point-to-point xconnect and pseudowire.
Explanation
Correct Answer
A:Implementing route distinguisher VPN identity requires the operator to assign suitable unique route distinguishers to the customer VPN routes. This makes the required goal testable using evidence that remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
Incorrect Answers
B:The proposed step is for L3VPN label blackhole diagnosis, whose purpose is to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It would not perform the necessary route distinguisher VPN identity operation: assign suitable unique route distinguishers to the customer VPN routes.
C:The proposed step is for EVPN single-active access design, whose purpose is to make only one provider edge forward traffic for a protected customer Ethernet segment. It would not perform the necessary route distinguisher VPN identity operation: assign suitable unique route distinguishers to the customer VPN routes.
D:The proposed step is for E-Line attachment circuit binding, whose purpose is to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. It would not perform the necessary route distinguisher VPN identity operation: assign suitable unique route distinguishers to the customer VPN routes.
Question 758
Meridian Networks has deployed route distinguisher VPN identity to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements. The implementation step was to assign suitable unique route distinguishers to the customer VPN routes. Which observation demonstrates that the requested service is working?
- The programmed FIB includes valid next hop and VPN egress label disposition.
- Remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
- One active access PE forwards while backup takes over after failover.
- The access EFP frames are forwarded over the intended pseudowire to the other handoff.
Explanation
Correct Answer
B:For route distinguisher VPN identity, successful verification means that remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts. That evidence directly tests whether the provider can make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements after deployment.
Incorrect Answers
A:The observation would verify L3VPN label blackhole diagnosis under the separate requirement to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It does not demonstrate the needed route distinguisher VPN identity result: remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
C:The observation would verify EVPN single-active access design under the separate requirement to make only one provider edge forward traffic for a protected customer Ethernet segment. It does not demonstrate the needed route distinguisher VPN identity result: remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
D:The observation would verify E-Line attachment circuit binding under the separate requirement to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. It does not demonstrate the needed route distinguisher VPN identity result: remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
Question 759
While troubleshooting route distinguisher VPN identity at Kestrel Broadband, the intended acceptance outcome is still missing: remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts. Which fault condition should be investigated first for this particular design?
- BGP reachability alone is accepted as proof that labeled forwarding is correct.
- Both PEs forward simultaneously despite a single-active customer requirement.
- Equal customer prefixes are treated as one plain IPv4 route before VPN signaling.
- The attachment circuit exists on the port but has no matching xconnect binding.
Explanation
Correct Answer
C:The suspected defect directly frustrates route distinguisher VPN identity: equal customer prefixes are treated as one plain IPv4 route before VPN signaling. Correcting it should allow verification that remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts.
Incorrect Answers
A:This defect belongs to L3VPN label blackhole diagnosis, where the affected outcome is to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It is not the direct failure mode identified for the route distinguisher VPN identity design in this case: equal customer prefixes are treated as one plain IPv4 route before VPN signaling.
B:This defect belongs to EVPN single-active access design, where the affected outcome is to make only one provider edge forward traffic for a protected customer Ethernet segment. It is not the direct failure mode identified for the route distinguisher VPN identity design in this case: equal customer prefixes are treated as one plain IPv4 route before VPN signaling.
D:This defect belongs to E-Line attachment circuit binding, where the affected outcome is to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. It is not the direct failure mode identified for the route distinguisher VPN identity design in this case: equal customer prefixes are treated as one plain IPv4 route before VPN signaling.
Question 760
After Harbor Metro deploys route distinguisher VPN identity to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements, the primary acceptance check passes (remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts). What remaining operational risk should still be part of the design review?
- Packet loss can reflect core MTU or data-plane policy even with labels installed.
- Failover convergence remains limited by Ethernet segment state timing.
- The access-side tag rewrite and transport MTU must be compatible at each endpoint.
- The RD identifies a route but does not by itself control route import.
Explanation
Correct Answer
D:The relevant boundary of route distinguisher VPN identity is that the RD identifies a route but does not by itself control route import. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to L3VPN label blackhole diagnosis in a different scenario where operators need to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
B:This concern applies to EVPN single-active access design in a different scenario where operators need to make only one provider edge forward traffic for a protected customer Ethernet segment. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
C:This concern applies to E-Line attachment circuit binding in a different scenario where operators need to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) (350-501) Practice Tests