Question 760
After Harbor Metro deploys route distinguisher VPN identity to make otherwise identical customer prefixes unique in MP-BGP VPNv4 advertisements, the primary acceptance check passes (remote BGP tables distinguish the same IPv4 prefix from separate VPN contexts). What remaining operational risk should still be part of the design review?
- Packet loss can reflect core MTU or data-plane policy even with labels installed.
- Failover convergence remains limited by Ethernet segment state timing.
- The access-side tag rewrite and transport MTU must be compatible at each endpoint.
- The RD identifies a route but does not by itself control route import.
Explanation
Correct Answer
D:The relevant boundary of route distinguisher VPN identity is that the RD identifies a route but does not by itself control route import. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to L3VPN label blackhole diagnosis in a different scenario where operators need to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
B:This concern applies to EVPN single-active access design in a different scenario where operators need to make only one provider edge forward traffic for a protected customer Ethernet segment. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
C:This concern applies to E-Line attachment circuit binding in a different scenario where operators need to bind an existing customer Ethernet UNI into the correct E-Line pseudowire and transport endpoint. For the deployed route distinguisher VPN identity approach, the relevant caution is instead that the RD identifies a route but does not by itself control route import.
Question 761
Summit Service Provider must control which provider-edge VRFs import a shared customer's VPN routes. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- route target VPN membership
- L3VPN label blackhole diagnosis
- EVPN MAC/IP route type 2
- E-Tree root and leaf isolation
Explanation
Correct Answer
A:route target VPN membership matches this requirement: the team should configure matching import and export route-target policies between authorized VRFs. A relevant outcome would be that only the intended remote VRFs import the labeled customer routes.
Incorrect Answers
B:L3VPN label blackhole diagnosis instead addresses a different condition: investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It would instead require you to check transport label and VPN service label resolution from ingress to egress, not the stated goal to control which provider-edge VRFs import a shared customer's VPN routes.
C:EVPN MAC/IP route type 2 instead addresses a different condition: advertise a reachable customer MAC address over a provider EVPN fabric. It would instead require you to enable MAC learning and Type-2 EVPN route advertisement for the correct service, not the stated goal to control which provider-edge VRFs import a shared customer's VPN routes.
D:E-Tree root and leaf isolation instead addresses a different condition: allow a hub to reach remote leaves while preventing leaf-to-leaf communication. It would instead require you to configure an E-Tree rooted multipoint Ethernet service with leaf restrictions, not the stated goal to control which provider-edge VRFs import a shared customer's VPN routes.
Question 762
At Ridgeway Networks, the engineering change is approved for route target VPN membership. The specific goal is to control which provider-edge VRFs import a shared customer's VPN routes. Which implementation step belongs in this change plan?
- Check transport label and VPN service label resolution from ingress to egress.
- Configure matching import and export route-target policies between authorized VRFs.
- Enable MAC learning and Type-2 EVPN route advertisement for the correct service.
- Configure an E-Tree rooted multipoint Ethernet service with leaf restrictions.
Explanation
Correct Answer
B:Implementing route target VPN membership requires the operator to configure matching import and export route-target policies between authorized VRFs. This makes the required goal testable using evidence that only the intended remote VRFs import the labeled customer routes.
Incorrect Answers
A:The proposed step is for L3VPN label blackhole diagnosis, whose purpose is to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It would not perform the necessary route target VPN membership operation: configure matching import and export route-target policies between authorized VRFs.
C:The proposed step is for EVPN MAC/IP route type 2, whose purpose is to advertise a reachable customer MAC address over a provider EVPN fabric. It would not perform the necessary route target VPN membership operation: configure matching import and export route-target policies between authorized VRFs.
D:The proposed step is for E-Tree root and leaf isolation, whose purpose is to allow a hub to reach remote leaves while preventing leaf-to-leaf communication. It would not perform the necessary route target VPN membership operation: configure matching import and export route-target policies between authorized VRFs.
Question 763
Lakeside Transport has deployed route target VPN membership to control which provider-edge VRFs import a shared customer's VPN routes. The implementation step was to configure matching import and export route-target policies between authorized VRFs. Which observation demonstrates that the requested service is working?
- The programmed FIB includes valid next hop and VPN egress label disposition.
- Remote PEs learn the MAC via BGP EVPN and can forward to its advertising PE.
- Only the intended remote VRFs import the labeled customer routes.
- Leaf nodes exchange frames with the root but not directly with one another.
Explanation
Correct Answer
C:For route target VPN membership, successful verification means that only the intended remote VRFs import the labeled customer routes. That evidence directly tests whether the provider can control which provider-edge VRFs import a shared customer's VPN routes after deployment.
Incorrect Answers
A:The observation would verify L3VPN label blackhole diagnosis under the separate requirement to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It does not demonstrate the needed route target VPN membership result: only the intended remote VRFs import the labeled customer routes.
B:The observation would verify EVPN MAC/IP route type 2 under the separate requirement to advertise a reachable customer MAC address over a provider EVPN fabric. It does not demonstrate the needed route target VPN membership result: only the intended remote VRFs import the labeled customer routes.
D:The observation would verify E-Tree root and leaf isolation under the separate requirement to allow a hub to reach remote leaves while preventing leaf-to-leaf communication. It does not demonstrate the needed route target VPN membership result: only the intended remote VRFs import the labeled customer routes.
Question 764
While troubleshooting route target VPN membership at Coastal Communications, the intended acceptance outcome is still missing: only the intended remote VRFs import the labeled customer routes. Which fault condition should be investigated first for this particular design?
- BGP reachability alone is accepted as proof that labeled forwarding is correct.
- Only an IP-prefix route is advertised and MAC reachability remains unknown.
- An E-LAN service permits prohibited lateral leaf communication.
- Matching RDs are incorrectly assumed to grant VPN route import authorization.
Explanation
Correct Answer
D:The suspected defect directly frustrates route target VPN membership: matching RDs are incorrectly assumed to grant VPN route import authorization. Correcting it should allow verification that only the intended remote VRFs import the labeled customer routes.
Incorrect Answers
A:This defect belongs to L3VPN label blackhole diagnosis, where the affected outcome is to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. It is not the direct failure mode identified for the route target VPN membership design in this case: matching RDs are incorrectly assumed to grant VPN route import authorization.
B:This defect belongs to EVPN MAC/IP route type 2, where the affected outcome is to advertise a reachable customer MAC address over a provider EVPN fabric. It is not the direct failure mode identified for the route target VPN membership design in this case: matching RDs are incorrectly assumed to grant VPN route import authorization.
C:This defect belongs to E-Tree root and leaf isolation, where the affected outcome is to allow a hub to reach remote leaves while preventing leaf-to-leaf communication. It is not the direct failure mode identified for the route target VPN membership design in this case: matching RDs are incorrectly assumed to grant VPN route import authorization.
Question 765
After Bluebird Infrastructure deploys route target VPN membership to control which provider-edge VRFs import a shared customer's VPN routes, the primary acceptance check passes (only the intended remote VRFs import the labeled customer routes). What remaining operational risk should still be part of the design review?
- Incorrect route targets can leak sensitive routes across tenants.
- Packet loss can reflect core MTU or data-plane policy even with labels installed.
- Rapid MAC moves need dampening and loop-protection policy.
- Accurate root and leaf port roles are essential for policy enforcement.
Explanation
Correct Answer
A:The relevant boundary of route target VPN membership is that incorrect route targets can leak sensitive routes across tenants. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
B:This concern applies to L3VPN label blackhole diagnosis in a different scenario where operators need to investigate a VPNv4 route that exists in BGP but does not carry packets end to end. For the deployed route target VPN membership approach, the relevant caution is instead that incorrect route targets can leak sensitive routes across tenants.
C:This concern applies to EVPN MAC/IP route type 2 in a different scenario where operators need to advertise a reachable customer MAC address over a provider EVPN fabric. For the deployed route target VPN membership approach, the relevant caution is instead that incorrect route targets can leak sensitive routes across tenants.
D:This concern applies to E-Tree root and leaf isolation in a different scenario where operators need to allow a hub to reach remote leaves while preventing leaf-to-leaf communication. For the deployed route target VPN membership approach, the relevant caution is instead that incorrect route targets can leak sensitive routes across tenants.
Question 766
Horizon Exchange must exchange labeled VPN-IPv4 reachability among provider PEs. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- L3VPN overlapping subnet migration
- MP-BGP vpnv4 peering
- VLAN tag pop at handoff
- EVPN IP prefix type 5
Explanation
Correct Answer
B:MP-BGP vpnv4 peering matches this requirement: the team should enable compatible vpnv4 unicast address-family BGP neighbor sessions. A relevant outcome would be that remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
Incorrect Answers
A:L3VPN overlapping subnet migration instead addresses a different condition: move a customer site to a new PE while another tenant uses the same IP block. It would instead require you to retain unique VRF and RD identities during the CE handoff change, not the stated goal to exchange labeled VPN-IPv4 reachability among provider PEs.
C:VLAN tag pop at handoff instead addresses a different condition: deliver untagged Ethernet to a customer while transporting a provider service tag. It would instead require you to apply an explicit VLAN tag rewrite pop operation at the intended EFP boundary, not the stated goal to exchange labeled VPN-IPv4 reachability among provider PEs.
D:EVPN IP prefix type 5 instead addresses a different condition: advertise an IP prefix through a routed EVPN service without relying solely on individual MAC advertisements. It would instead require you to use supported EVPN IP prefix route advertisement with the correct VRF mapping, not the stated goal to exchange labeled VPN-IPv4 reachability among provider PEs.
Question 767
At Cedar Wireless, the engineering change is approved for MP-BGP vpnv4 peering. The specific goal is to exchange labeled VPN-IPv4 reachability among provider PEs. Which implementation step belongs in this change plan?
- Retain unique VRF and RD identities during the CE handoff change.
- Apply an explicit VLAN tag rewrite pop operation at the intended EFP boundary.
- Enable compatible vpnv4 unicast address-family BGP neighbor sessions.
- Use supported EVPN IP prefix route advertisement with the correct VRF mapping.
Explanation
Correct Answer
C:Implementing MP-BGP vpnv4 peering requires the operator to enable compatible vpnv4 unicast address-family BGP neighbor sessions. This makes the required goal testable using evidence that remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
Incorrect Answers
A:The proposed step is for L3VPN overlapping subnet migration, whose purpose is to move a customer site to a new PE while another tenant uses the same IP block. It would not perform the necessary MP-BGP vpnv4 peering operation: enable compatible vpnv4 unicast address-family BGP neighbor sessions.
B:The proposed step is for VLAN tag pop at handoff, whose purpose is to deliver untagged Ethernet to a customer while transporting a provider service tag. It would not perform the necessary MP-BGP vpnv4 peering operation: enable compatible vpnv4 unicast address-family BGP neighbor sessions.
D:The proposed step is for EVPN IP prefix type 5, whose purpose is to advertise an IP prefix through a routed EVPN service without relying solely on individual MAC advertisements. It would not perform the necessary MP-BGP vpnv4 peering operation: enable compatible vpnv4 unicast address-family BGP neighbor sessions.
Question 768
Willow Regional has deployed MP-BGP vpnv4 peering to exchange labeled VPN-IPv4 reachability among provider PEs. The implementation step was to enable compatible vpnv4 unicast address-family BGP neighbor sessions. Which observation demonstrates that the requested service is working?
- The migrated site's VPN paths resolve without disrupting the unrelated tenant.
- The customer handoff sends untagged frames while core transport retains its expected tag.
- Remote PEs install the Type-5 prefix into the intended routing context.
- Remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
Explanation
Correct Answer
D:For MP-BGP vpnv4 peering, successful verification means that remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels. That evidence directly tests whether the provider can exchange labeled VPN-IPv4 reachability among provider PEs after deployment.
Incorrect Answers
A:The observation would verify L3VPN overlapping subnet migration under the separate requirement to move a customer site to a new PE while another tenant uses the same IP block. It does not demonstrate the needed MP-BGP vpnv4 peering result: remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
B:The observation would verify VLAN tag pop at handoff under the separate requirement to deliver untagged Ethernet to a customer while transporting a provider service tag. It does not demonstrate the needed MP-BGP vpnv4 peering result: remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
C:The observation would verify EVPN IP prefix type 5 under the separate requirement to advertise an IP prefix through a routed EVPN service without relying solely on individual MAC advertisements. It does not demonstrate the needed MP-BGP vpnv4 peering result: remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
Question 769
While troubleshooting MP-BGP vpnv4 peering at Atlas Backbone, the intended acceptance outcome is still missing: remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels. Which fault condition should be investigated first for this particular design?
- Ordinary IPv4 unicast only is activated and remote VRFs remain empty.
- The shared prefix is leaked into the global routing table during migration.
- The S-tag leaks to a customer interface contracted for untagged delivery.
- A Type-2 MAC route alone is expected to advertise a complete IP aggregate.
Explanation
Correct Answer
A:The suspected defect directly frustrates MP-BGP vpnv4 peering: ordinary IPv4 unicast only is activated and remote VRFs remain empty. Correcting it should allow verification that remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels.
Incorrect Answers
B:This defect belongs to L3VPN overlapping subnet migration, where the affected outcome is to move a customer site to a new PE while another tenant uses the same IP block. It is not the direct failure mode identified for the MP-BGP vpnv4 peering design in this case: ordinary IPv4 unicast only is activated and remote VRFs remain empty.
C:This defect belongs to VLAN tag pop at handoff, where the affected outcome is to deliver untagged Ethernet to a customer while transporting a provider service tag. It is not the direct failure mode identified for the MP-BGP vpnv4 peering design in this case: ordinary IPv4 unicast only is activated and remote VRFs remain empty.
D:This defect belongs to EVPN IP prefix type 5, where the affected outcome is to advertise an IP prefix through a routed EVPN service without relying solely on individual MAC advertisements. It is not the direct failure mode identified for the MP-BGP vpnv4 peering design in this case: ordinary IPv4 unicast only is activated and remote VRFs remain empty.
Question 770
After Starlight IP Services deploys MP-BGP vpnv4 peering to exchange labeled VPN-IPv4 reachability among provider PEs, the primary acceptance check passes (remote PEs learn RD-qualified VPN NLRI with corresponding next-hop and labels). What remaining operational risk should still be part of the design review?
- Temporary duplicate site advertisements require careful route preference.
- PE loopbacks and MPLS transport must be reachable independent of VPN routes.
- Tag rewrite direction must be configured symmetrically on return traffic.
- Route-target and next-hop resolution remain prerequisites.
Explanation
Correct Answer
B:The relevant boundary of MP-BGP vpnv4 peering is that PE loopbacks and MPLS transport must be reachable independent of VPN routes. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to L3VPN overlapping subnet migration in a different scenario where operators need to move a customer site to a new PE while another tenant uses the same IP block. For the deployed MP-BGP vpnv4 peering approach, the relevant caution is instead that PE loopbacks and MPLS transport must be reachable independent of VPN routes.
C:This concern applies to VLAN tag pop at handoff in a different scenario where operators need to deliver untagged Ethernet to a customer while transporting a provider service tag. For the deployed MP-BGP vpnv4 peering approach, the relevant caution is instead that PE loopbacks and MPLS transport must be reachable independent of VPN routes.
D:This concern applies to EVPN IP prefix type 5 in a different scenario where operators need to advertise an IP prefix through a routed EVPN service without relying solely on individual MAC advertisements. For the deployed MP-BGP vpnv4 peering approach, the relevant caution is instead that PE loopbacks and MPLS transport must be reachable independent of VPN routes.
Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) (350-501) Practice Tests