Free Implementing Cisco Service Provider VPN Services Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Implementing Cisco Service Provider VPN Services practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A customer wants the provider to participate in routing between its IP sites, with each CE exchanging routes with its attached PE instead of peering directly with remote CEs. Which VPN model matches this requirement?

   1. A. A VPWS model with a circuit between customer sites
   2. B. A BGP/MPLS Layer 3 VPN using the peer model
   3. C. A VPLS model with provider MAC-based bridging
   4. D. An IPsec overlay with routing between customer CEs

   Answer: B

   Explanation: RFC 4364 states, "The CE routers do not peer with each other". In the peer-model IP VPN, CEs send their routes to PEs, which distribute routes to other VPN sites. VPWS and VPLS provide Layer 2 service; the proposed IPsec customer overlay retains routing between customer CEs.

   Reference: RFC 4364 — BGP/MPLS IP Virtual Private Networks (VPNs) — Section 1, Introduction, peer-model route exchange

2. 2An Ethernet pseudowire remains down although its MPLS tunnel is healthy. Its detail output reports local MTU 1500 and remote MTU 1600. Which corrective action addresses the advertised service-parameter mismatch?

   1. A. Make the locally allocated and remotely allocated VC labels identical
   2. B. Make the attachment-circuit interface names identical on both PEs
   3. C. Make the PEs use the same loopback IP address for signaling
   4. D. Align the pseudowire endpoint MTU values to the intended service MTU

   Answer: D

   Explanation: Cisco annotates the MTU fields, "The local and remote values must match". Aligning those advertised service MTUs addresses the observed fault. VC labels and interface names need not be identical; assigning the same signaling address to two PEs would break endpoint identity.

   Reference: Pseudowire Concepts and Troubleshooting — Troubleshooting a Pseudowire, MTU line in show mpls l2transport vc detail

3. 3Which MP-BGP capability must two PEs negotiate to exchange labeled VPNv4 reachability, rather than only ordinary IPv4 unicast routes?

   1. A. AFI 2 and SAFI 1
   2. B. AFI 1 and SAFI 4
   3. C. AFI 25 and SAFI 70
   4. D. AFI 1 and SAFI 128

   Answer: D

   Explanation: RFC 4364 specifies "an AFI of 1 and an SAFI of 128." This identifies labeled VPN-IPv4 NLRI. AFI/SAFI 1/4 is labeled IPv4 unicast, 2/1 is ordinary IPv6 unicast, and 25/70 is EVPN rather than VPNv4. Both peers must support the applicable multiprotocol capability.

   Reference: RFC 4364 — BGP/MPLS IP Virtual Private Networks (VPNs) — Section 4.3.4, How VPN-IPv4 NLRI Is Carried in BGP

4. 4A provider needs separate IPv6 customer VPN routing contexts rather than only global IPv6 connectivity over its IPv4 MPLS core. Which distinction guides the choice between 6PE and 6VPE?

   1. A. 6PE provides IPv6 VPN isolation; 6VPE provides only global IPv6 reachability
   2. B. Both 6PE and 6VPE require per-customer VPNv6 routing contexts
   3. C. 6VPE provides IPv6 VPN service; 6PE provides global IPv6 reachability
   4. D. Both 6PE and 6VPE provide global IPv6 without customer VPN isolation

   Answer: C

   Explanation: RFC 4798 states that 6PE "provides global IPv6 reachability" and directs IPv6 VPN support to RFC 4659. Cisco describes private customer-specific VRFs for 6VPE. Thus 6VPE supplies the requested VPN isolation; 6PE supplies global connectivity. Reversing the services or treating their isolation requirements as identical is incorrect.

   Reference: RFC 4798 — Connecting IPv6 Islands over IPv4 MPLS Using 6PE — Section 1, Introduction, 6PE service boundary

5. 5Several customer sites must share an emulated LAN across a provider WAN. The provider must bridge frames using their destination MAC addresses. Which service architecture provides this behavior?

   1. A. A routed BGP/MPLS IP VPN
   2. B. A set of Layer 3 GRE tunnels
   3. C. A virtual private wire service
   4. D. A virtual private LAN service

   Answer: D

   Explanation: RFC 4664 explains, "Thus, the PE functions as a bridge." Its VPLS description specifies destination-MAC forwarding and a transparently extended LAN. VPWS supplies point-to-point circuits rather than a multipoint bridged LAN; the routed alternatives do not provide the requested MAC-based service.

   Reference: RFC 4664 — Framework for Layer 2 Virtual Private Networks (L2VPNs) — Section 3.1.2, Virtual Private LAN Service (VPLS)

6. 6Two IOS XR PEs have working targeted LDP connectivity, but their intended single-segment Ethernet pseudowire uses pw-id 101 at one end and pw-id 102 at the other. What should be corrected?

   1. A. Configure the same PW ID for that pseudowire at both endpoints
   2. B. Configure identical local MPLS label numbers at both endpoints
   3. C. Configure identical physical interface names at both endpoints
   4. D. Configure the same router ID on both independent PE routers

   Answer: A

   Explanation: Cisco specifies "a PW ID that must match on each side". The PW ID identifies the intended service between this peer pair. Local label values and access-interface names can differ, and independent routers require distinct identities.

   Reference: Understand IOS XR L2VPN Services and Features — Section 3.2.1, Virtual Private Wire Services, xconnect configuration

7. 7A provider wants to distribute VPNv4 routes among many PEs without maintaining a full mesh of iBGP sessions between those PEs. Which BGP design meets this requirement?

   1. A. Use VPNv4 route reflectors with the PEs as clients
   2. B. Use an ordinary iBGP star with no route reflection
   3. C. Use disjoint pairs of iBGP peers with no route reflection
   4. D. Use a chain of ordinary iBGP peers with no route reflection

   Answer: A

   Explanation: RFC 4364 says, "Rather than having a complete IBGP mesh among the PEs" it is advantageous to use route reflectors. Reflection supplies VPNv4 distribution without a PE full mesh. Ordinary iBGP star, pair, or chain topologies do not relay iBGP-learned routes as a reflector would and cannot provide the required all-PE distribution.

   Reference: RFC 4364 — BGP/MPLS IP Virtual Private Networks (VPNs) — Section 4.3.3, Use of Route Reflectors, opening paragraph

8. 8For Cisco 6VPE over an existing IPv4-signaled MPLS core, where is dual-stack IPv4/IPv6 capability required for the VPN service?

   1. A. On the PEs; the transit P routers can remain IPv4 MPLS devices
   2. B. Only on the P routers; the PEs can remain IPv4-only devices
   3. C. On every P router, with IPv6 customer routes in the core IGP
   4. D. Only on the CEs, with IPv6-to-IPv4 translation at each provider link

   Answer: A

   Explanation: Cisco states, "For 6VPE, the PE devices are dual-stack (IPv4 and IPv6) devices." It also allows P devices to support only IPv4. MPLS transports the service without requiring core customer IPv6 routing or translation of customer IPv6 packets.

   Reference: IPv6 VPN over MPLS — MPLS Layer 3 VPNs Configuration Guide, IOS XE 17 — IPv6 VPN Architecture Overview

9. 9How does a VPWS PE determine the remote CE to which a customer's frame is delivered?

   1. A. By the virtual circuit on which the frame arrives
   2. B. By a longest-prefix match on the frame's IP destination
   3. C. By a learned destination MAC entry for a multipoint LAN
   4. D. By the IP routing adjacency advertised by the remote CE

   Answer: A

   Explanation: RFC 4664 states, "The PE thus acts as a virtual circuit switch." In VPWS, the selected circuit determines delivery to the other endpoint, regardless of the frame contents. IP lookup describes routing; destination-MAC learning describes VPLS bridging; a remote CE routing adjacency does not select the VPWS circuit.

   Reference: RFC 4664 — Framework for Layer 2 Virtual Private Networks (L2VPNs) — Section 3.1.1, Virtual Private Wire Service (VPWS)

10. 10After a change, an IOS XR E-Line pseudowire reports PW type mismatched. One PE now signals Ethernet VLAN type 4, while the other still signals Ethernet type 5. Which repair addresses the reported cause?

    1. A. Change only the customer VLAN numbers to make them equal
    2. B. Make the two local VC label numbers numerically equal
    3. C. Configure a compatible pseudowire type at both endpoints
    4. D. Increase the transport LSP MTU without changing PW parameters

    Answer: C

    Explanation: Cisco notes, "If you configure a type 4 on one side only, the PW stays down". The mismatch concerns the negotiated PW type, so both endpoints need compatible type configuration. Equal access VLANs or labels and a larger transport MTU do not resolve a type-4/type-5 signaling disagreement.

    Reference: Understand IOS XR L2VPN Services and Features — Type 4 and Type 5 PWs, type-4 pw-class example, PW type mismatched note