Pass the Cisco CCNP Service Provider 350-501 Questions and answers with CertsForce

Option B is the correct answer because it meets all the given requirements. The configuration “snmp-server community comaccess ro 10” allows read-only access for all objects to members of Access-List 10 that use the comaccess community string. The “snmp-server host ABC.com informs version 2c public” command ensures SNMP authentication failure traps are sent to SNMPv2c and then to the host using SNMPv2c with the public community string.

The correct configuration for extending the layer 2 domain between the company’s two locations involves setting up the interface with L2 transport, specifying the encapsulation method as dot1q with the VLAN tag of 12, and applying the appropriate rewrite ingress tag rules. This setup ensures that the VLAN tag is preserved across the service provider’s core, maintaining the layer 2 domain continuity.

References := Implementing and Operating Cisco Service Provider Network Core Technologies

For encrypted authentication on Router 1, the correct action is to configure an SNMP user with an authentication password and associate it with a group. Option B includes the use of MD5 authentication, which provides the required security for message confidentiality.

When implementing LDP NSF (Nonstop Forwarding) on the network, an engineer must perform the following tasks:

Implement direct connections for LDP peers: This ensures that LDP sessions can be reestablished quickly after a switchover.

Enable NSF for the link-state routing protocol in use on the network: This allows the routing protocol to maintain its state during a switchover, ensuring seamless operation.

For example, if OSPF is the link-state routing protocol, enabling NSF for OSPF ensures that OSPF adjacencies are maintained during a switchover

The OSPF adjacency issue between R1 and R2 is likely due to mismatched OSPF network types or hello/dead interval settings. The command ip ospf network point-to-point is used on point-to-point network types, which do not require matching hello/dead intervals, thus allowing OSPF adjacency to form even if these intervals are mismatched on the two routers. References: = Implementing and Operating Cisco Service Provider Network Core Technologies course materials. (

The configuration in Option C uses a route policy that checks if the MED is equal to 30 and then sets the local-preference to 70. This aligns with the requirement to prioritize routes with a MED of 30 by assigning them a higher local-preference value, which influences the BGP path selection process in favor of these routes.

References := The Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course provides insights into configuring route policies for BGP, which includes setting local-preference based on MED values

To mitigate DDoS attacks in a BGP environment, an engineer can apply BGP FlowSpec, which allows for the creation of traffic filtering policies that can be distributed across the network. This configuration enables the network to respond quickly to DDoS attacks by filtering or redirecting malicious traffic based on predefined criteria, such as source IP, destination IP, and port numbers456.

The command “show policy-map control-plane” is used to display the control plane policies applied on a Cisco device, including the statistics related to packets matched by the class-maps of the policy-map. In this context, it helps in troubleshooting by providing detailed insights into how different types of traffic are being processed and controlled as they pass through the control plane.

In the given scenario, the goal is to restrict users on the network between R1 and R2 from accessing the external network through R5, while still allowing them access to all resources within the administrative domain. The correct approach is to configure an Access Control List (ACL) that permits traffic to all internal networks and denies traffic to any external address. This ACL should be applied to the R2 interface that connects to R1 in the ingress direction. By doing so, traffic originating from users between R1 and R2 destined for external networks will be blocked, while internal traffic will be allowed.

 To achieve this, we need to apply an access control list (ACL) on PE-R9 that permits SSH traffic from the management network 192.168.0.0/16 while denying other traffic. The correct ACL configuration is as follows:

access-list 100 permit tcp 192.168.0.0 0.0.255.255 any eq 22

access-list 100 deny ip any any

The first line permits TCP traffic from the management network to any destination with destination port 22 (SSH).

The second line denies all other IP traffic.