350-501 Implementing and Operating Cisco Service Provider Network Core Technologies Exam Topics and Questions

Architecture sets the frame for everything else on this exam. Before you can configure or troubleshoot anything, you need to understand how service provider networks are built: the core forwarding paradigms, the software that runs them, how functions are virtualised, how quality is enforced end to end, and how each plane is protected. Gaps here will cost you in every other topic, because the same architectural assumptions surface repeatedly across the remaining domains.

– Core architectures and transport

The exam expects you to distinguish Metro Ethernet, MPLS, unified MPLS, Segment Routing, SR-TE, and SRv6 by what problem each one solves in a service provider core, not by definition alone. Unified MPLS and SRv6 in particular carry design trade-offs that show up in scenario items. Below the IP layer, transport technologies matter: xDSL, DWDM, DOCSIS, TDM, and xPON each have bandwidth, latency, and multiplexing characteristics that affect how an SP builds its access layer. Routed optical networking collapses IP and DWDM layers and changes the failure domain model. Mobility adds another dimension: 5G vRAN and ORAN transport introduce strict latency budgets for fronthaul, midhaul, and backhaul that constrain design choices. Know which transport type fits which xhaul segment and why.

– Cisco network software platforms

IOS, IOS XE, and IOS XR are not interchangeable. The exam tests whether you know which platform targets which role in a service provider environment. IOS XR is the platform of record for carrier-grade routers; its process-based architecture, separate admin and config planes, and commit-based configuration model all distinguish it from IOS XE. Items may present a platform context and ask you to identify a behaviour or limitation that only holds on one of the three. You do not need to memorise CLI syntax differences exhaustively, but you do need to know why an operator chooses IOS XR for a core role and what operational consequences follow from that choice.

– Virtualisation: NFV, VNFs, containers, and application hosting

Service provider virtualisation moves network functions off dedicated hardware. NFV infrastructure provides the compute, storage, and networking substrate. VNF workloads run atop that infrastructure as software instances of functions that were previously hardware appliances. Containers take the decomposition further, allowing individual microservices to be scheduled independently. Application hosting on platforms such as Cisco IOx extends this to the network device itself. The exam asks you to map these layers correctly: understanding what sits at each layer and where the management boundary lies is more examinable than deep knowledge of any one hypervisor or orchestration platform.

– QoS architecture across the SP boundary

MPLS QoS introduces three models: Pipe, Short Pipe, and Uniform. Each one determines how the inner DSCP marking relates to the EXP/TC bits in the label stack and what happens when labels are popped. Knowing which model preserves the customer's markings and which overwrites them is the kind of distinction that decides an answer. MPLS TE QoS layers on top with MAM, RDM, CBTS, PBTS, and DS-TE, each addressing how bandwidth is allocated across traffic classes in a TE tunnel. DiffServ and IntServ represent the per-hop versus per-flow philosophies. The trust boundary between an enterprise and an SP network determines where remarking happens and who controls it. IPv6 flow labels add a hash-friendly field that SPs use for load balancing without inspecting the payload.

– Control, management, and data plane security

Control plane protection uses LPTS on IOS XR and CoPP on IOS XE to rate-limit traffic destined for the route processor. BGP-TTL security (GTSM) and BGP session authentication reduce the attack surface for external peers. BGP prefix suppression limits what gets advertised during convergence events. LDP security covers both MD5 authentication and label allocation filtering to prevent label spoofing. BGP-sec adds cryptographic path validation. BGP Flowspec pushes traffic-filtering rules into the forwarding plane at scale. On the management plane, traceback, AAA with TACACS+, REST API security, and DDoS mitigation each address a different threat vector. Data plane security ties it together: uRPF drops packets with spoofed sources, ACLs enforce policy, RTBH pulls black-hole routes to drop attack traffic, and MACsec encrypts at Layer 2.

How Architecture is tested

At 15% of the exam, Architecture produces a meaningful share of items, and they skew toward design reasoning rather than pure recall. You will be presented with a scenario: a specific SP requirement, a failure condition, or a platform constraint, and asked to identify the architecture, model, or mechanism that fits. Items on QoS models reward knowing the exact behaviour at label disposition, not just the name of the model. Control plane security items reward knowing which tool applies at which layer and on which platform. Candidates lose marks by confusing the scope of a mechanism, applying a CoPP concept to an IOS XR context where LPTS applies, for example, or selecting a QoS model that preserves markings when the scenario calls for one that overwrites them. Virtualisation items tend to test layer boundaries: which component is responsible for what. The platform software items are among the most straightforward in this topic, but only if you have been precise about IOS XR's operational model rather than treating all three platforms as equivalent.

Networking carries the largest weight on this exam, and that weight is earned: this is where SP candidates are most often separated from each other. The scope spans three routing protocols at implementation depth, BGP path selection and policy, IPv6 transition, and high availability. You are expected to configure, verify, and troubleshoot, not just describe. If your IGP or BGP fundamentals have any soft spots, this topic will expose them under timed conditions.

– IS-IS and OSPF implementation

IS-IS is the IGP of choice in most SP cores, and the exam goes deep into it. Area addressing in IS-IS uses NET addresses and L1/L2 boundaries differently from OSPF's area model, and that difference matters when you are asked to determine reachability or explain a routing anomaly. Multitopology IS-IS allows IPv4 and IPv6 to run separate SPF calculations over the same topology, which is critical when the two address families do not share the same link set. Metric styles, wide metrics in particular, affect what prefix costs are advertised and whether TE extensions can operate. OSPF v2 and v3 items focus on neighbour adjacency formation, the conditions that prevent it, multi-area design including stub and NSSA types, and how LSA types map to route types. Both protocols require you to understand route advertisement scope and redistribution behaviour.

– BGP: path selection, attributes, and policy

BGP path selection is examinable both as a standalone topic (the algorithm in order) and embedded in scenario items where you must predict which path wins given a specific attribute configuration. The sequence matters: weight, local preference, originated routes, AS path length, origin, MED, eBGP over iBGP, IGP metric, and the tiebreakers. Items on IBGP and EBGP neighbours test address family activation, update-source, and next-hop behaviour. Prefix advertisement items include aggregate behaviour, the effect of the network statement versus redistribution, and what Additional Paths does for iBGP route diversity. BGP PIC (Prefix Independent Convergence) pre-programs backup paths so that a failure triggers a FIB swap rather than a full BGP reconvergence. Attributes such as MED, local preference, and communities are policy levers; redistribution items ask you to control what crosses protocol boundaries and how the metric is set.

– Routing policy, troubleshooting, and IPv6 transition

Route policy language on IOS XR and route maps on IOS XE/IOS are functionally similar but syntactically distinct. The exam tests whether you can read a policy construct and determine what it does to a prefix: does it match, does it set an attribute, does it drop the route? Troubleshooting neighbour adjacency requires you to work through the conditions for each protocol: IS-IS system ID conflicts, OSPF area type mismatches, BGP AS number errors, and authentication failures all appear. Route advertisement troubleshooting adds filtering, summarisation, and redistribution loops to the picture. IPv6 transition mechanisms each solve a different problem: NAT44 extends IPv4 space, NAT64 bridges address families, CGNAT aggregates many subscribers behind one address, MAP-T and DS-Lite provide stateless or tunnelled translation. Knowing which mechanism applies to which deployment scenario is the testable edge.

– High availability

High availability in an SP network operates at several layers simultaneously. NSF with graceful restart allows a routing protocol to maintain forwarding during a control plane restart, provided the peer supports it; the distinction between NSF-aware and NSF-capable peers is examinable. NSR (Non-Stop Routing) keeps the routing protocol state synchronised between active and standby route processors without requiring peer cooperation, which makes it transparent to neighbours. BFD provides sub-second failure detection independent of the routing protocol's own hello timers; its asynchronous and echo modes and its interaction with IS-IS, OSPF, and BGP are all in scope. Link aggregation covers LACP negotiation, bundle membership, and how hashing affects load distribution. Items in this area reward knowing which mechanism operates at which layer and what its failure detection or recovery time characteristics are.

How Networking is tested

At 30% of the exam, Networking will dominate your score. Items here are frequently multi-step: a scenario describes a topology, a configuration snippet, and a symptom, and you must identify the cause or the fix. BGP items in particular reward precision about attribute scope. Local preference is iBGP-scoped; MED is compared only between paths from the same AS by default. Candidates who treat these as interchangeable lose marks. IS-IS troubleshooting items reward working through the adjacency formation checklist systematically rather than jumping to the most exotic cause. High availability items reward knowing which mechanism requires peer cooperation and which does not. The BGP path selection algorithm is tested both directly and indirectly: an item may describe a topology and ask you to determine the active path without naming path selection at all. Policy items reward reading the policy construct carefully rather than assuming intent from the name of the policy. Redistribution items are traps for candidates who do not account for administrative distance when two protocols both have a route to the same prefix.

After the routing protocols that build the underlay, the next layer to master is how traffic is forwarded across the SP core. MPLS and Segment Routing are the two dominant forwarding paradigms, and the exam tests both at a level of detail that goes well past conceptual familiarity. You need to understand LDP's operational mechanics, how traffic engineering extends the basic forwarding model, and where Segment Routing changes the architecture fundamentally. Candidates who treat SR as simply a newer MPLS often lose marks on the distinctions that matter.

– MPLS and LDP operations

LDP sync addresses the problem of traffic being forwarded over a link before LDP has fully converged on it; the mechanism holds the IGP metric high until the LDP session is established. LDP session protection maintains the LDP session via a targeted LDP session when the directly connected link fails, so that re-establishment after recovery is faster. LDP neighbour discovery and session establishment have specific conditions that must be met, and troubleshooting items test whether you know those conditions. Unified MPLS stitches together multiple MPLS domains, typically an access domain and a core domain, using BGP-labelled unicast to carry labels across the boundary. MPLS OAM covers LSP ping and LSP traceroute, the tools you use to verify label-switched path integrity and locate a break in the forwarding path.

– Traffic engineering

MPLS traffic engineering requires the IGP to flood link attributes that the shortest-path algorithm does not normally carry. IS-IS and OSPF both have TE extensions that advertise bandwidth, administrative groups, and SRLG membership into the topology database. RSVP-TE signals explicit paths and reserves bandwidth along them; understanding the RSVP Path and Resv message exchange, and what happens when reservation fails, is directly in scope. Fast Reroute provides pre-computed backup paths that activate in sub-second time when a primary path fails. The distinction between link protection and node protection FRR, and the conditions under which each applies, is the kind of detail that separates a correct answer from a plausible-looking distractor.

– Segment Routing architecture and extensions

Segment Routing replaces the distributed label distribution of LDP and the per-flow state of RSVP with a source-routing model where the path is encoded in the packet header. Segment types (node segments, adjacency segments, prefix segments, and in SRv6, function segments) each have a different scope and forwarding behaviour. The SR control plane uses BGP, OSPF, or IS-IS to distribute segment identifiers; knowing which extension carries what information is examinable. SR-TE programs explicit paths using segment lists, achieving TE outcomes without RSVP state in the network. TI-LFA (Topology-Independent Loop-Free Alternates) provides fast reroute with coverage that classic LFA cannot achieve, by using a post-convergence path encoded as a segment list. PCE-PCC architecture separates the path computation from the head-end router, allowing a centralised controller to optimise paths across the domain. Flexible Algorithm allows operators to define custom routing metrics or constraints and run a separate SPF for each algorithm. SRv6 introduces a locator, micro-segment, encapsulation model and interworking gateways that bridge SR-MPLS and SRv6 domains.

How MPLS and Segment Routing is tested

At 20% of the exam, this topic produces a significant number of items, and they tend to be the ones candidates find hardest to reason through under time pressure. MPLS items reward operational precision: knowing what LDP sync actually prevents, not just that it exists, or knowing what MPLS OAM tool to apply to a specific failure scenario. Traffic engineering items reward understanding the interaction between the IGP extension and the RSVP signalling process, rather than treating TE as a single monolithic feature. Segment Routing items are where the exam is most likely to present a scenario that requires you to distinguish between SR-MPLS and SRv6 behaviour, or between TI-LFA and classic FRR coverage. Flexible Algorithm items reward knowing that each algorithm runs its own SPF and that a node must support the algorithm to participate in it. Candidates lose marks by applying RSVP-TE reasoning to an SR-TE scenario, or by conflating adjacency segment scope with node segment scope. PCE-PCC items reward understanding which entity initiates path computation and which installs the resulting segment list.

Services is where the SP network earns its revenue, and the exam reflects that. This topic covers the full stack of customer-facing services built on the MPLS and routing foundation from the previous topics: VPNs at both Layer 2 and Layer 3, multicast delivery, and QoS enforcement. Configuration and verification are explicitly in scope here, so you need to move beyond describing how these services work to knowing what a correctly configured service looks like and how to identify when it is not.

– VPN services: EVPN, Inter-AS, CSC, and mVPN

EVPN uses BGP to distribute MAC and IP reachability information, replacing older VPLS flood-and-learn behaviour with a control-plane-driven model. The exam tests EVPN route types and what each one carries; knowing that a Type 2 route carries MAC/IP binding while a Type 3 route signals inclusive multicast is the level of precision required. Inter-AS VPN extends L3VPN across AS boundaries; Options A, B, and C each have different scalability and security trade-offs, and the exam will present a scenario that requires you to identify which option applies. CSC (Carrier Supporting Carrier) allows one SP to carry another SP's MPLS traffic, requiring careful attention to label stacking. Multicast VPN uses a provider tunnel to deliver multicast across the MPLS core; understanding the default MDT and data MDT roles and when traffic switches between them is directly examinable.

– L2VPN and Carrier Ethernet

Carrier Ethernet service types map to specific MEF definitions: E-Line is a point-to-point service, E-LAN is multipoint-to-multipoint, E-Tree enforces a root-and-leaf topology, and E-Access provides a wholesale access service. The exam tests which service type satisfies a given customer topology requirement. IEEE 802.1ad (Q-in-Q) stacks VLAN tags to separate customer and provider VLAN spaces; 802.1ah (MAC-in-MAC or PBB) adds a provider backbone MAC header for scalability. ITU G.8032 provides Ethernet ring protection switching, and its timing behaviour (recovery time, guard timer) is testable. Ethernet OAM covers 802.3ah for link-level monitoring and 802.1ag for end-to-end path verification. VLAN tag manipulation, push, pop, and swap operations, determines how frames are handled at service boundaries and is a common source of misconfiguration in exam scenarios.

– L3VPN and multicast services

Intra-AS L3VPN is the foundational service: VRFs, route distinguishers, route targets, and MP-BGP carrying VPNv4/VPNv6 prefixes. The exam expects you to know how route targets control import and export, and how a shared services design uses route target manipulation to give VPN customers selective access to extranet or Internet resources without full mesh connectivity. Multicast services add PIM to the picture. PIM-SM uses a rendezvous point and a shared tree before switching to a source tree; PIM-SSM bypasses the RP entirely by using source-specific group addresses; PIM-BIDIR always uses a shared tree and is suited to many-to-many applications. IGMP versions differ in their group membership report mechanisms and source-specific support; MLDv1 and v2 are the IPv6 equivalents. Items test which PIM mode fits a described deployment and what IGMP version is required for SSM.

– QoS services

QoS at the service layer begins with classification and marking: identifying traffic by DSCP, CoS, or ACL match and assigning it to a class. The precision of the classification boundary between enterprise and SP matters here because it was established in the Architecture topic's trust boundary discussion. Congestion avoidance uses WRED to drop lower-priority traffic probabilistically before a queue fills completely, reducing TCP synchronisation. Traffic policing enforces a rate contract by dropping or remarking traffic that exceeds the committed rate; shaping buffers excess traffic to smooth the output rate. The distinction between policing and shaping is a reliable source of exam items: policing discards or remarks, shaping delays. Knowing which mechanism applies at an ingress versus egress policy, and what happens to burst traffic under each, is the level of detail the exam rewards.

How Services is tested

At 20% of the exam, Services items are heavily scenario-based. A typical item describes a customer requirement or a misconfiguration symptom and asks you to identify the cause or select the configuration that produces the described behaviour. EVPN items reward knowing the route type taxonomy precisely. Inter-AS VPN items reward mapping the option number to its architectural characteristic, particularly around where VPNv4 routes are exchanged and where labels are imposed. L2VPN items frequently turn on the difference between service types or on VLAN tag operation at a specific interface. L3VPN items reward understanding route target logic in shared-services designs, where an incorrectly applied import target either leaks routes or fails to import them. Multicast items reward knowing PIM mode selection criteria. QoS items reward distinguishing the action taken on out-of-profile traffic: a policer acts immediately, a shaper queues. Candidates who know the mechanism name but are imprecise about its behaviour under load consistently lose marks in this topic.

The exam closes with the operational layer that sits above the protocols: how you programmatically manage, configure, and monitor an SP network. This topic is less about deep protocol mechanics and more about knowing which tool does what, how data models relate to the interfaces that expose them, and how telemetry and monitoring protocols give you visibility into the network you have built across the previous four topics. Candidates with a traditional CLI background often underestimate this topic and lose marks that are straightforward to recover.

– Programmable APIs and automation tools

Cisco devices expose programmable interfaces through REST APIs, and the exam expects you to interpret an external script that uses one. You do not need to write a script from scratch, but you do need to read a code snippet, identify what it is doing, and determine whether it will produce the intended result. NSO (Network Services Orchestration) provides a service abstraction layer above individual device APIs, allowing operators to define services once and render them to any device type. Configuration management tools such as Ansible and Terraform approach automation differently: Ansible is agentless and procedural in its playbook model, while Terraform is declarative and state-based. Knowing which tool fits which operational pattern is the testable distinction. Secure ZTP (Zero Touch Provisioning) automates initial device bring-up in a way that does not require physical access, and its security model, how the device authenticates the provisioning server, is in scope.

– Data models, streaming telemetry, and management protocols

YANG is a data modelling language that defines the structure of configuration and operational data. The exam tests high-level principles: YANG modules, the relationship between a YANG model and the NETCONF or RESTCONF interface that exposes it, and how a model constrains what can be configured. gRPC with gNMI provides streaming telemetry; dial-in and dial-out modes differ in who initiates the connection, and TLS and mTLS certificates secure those sessions. Configuring and verifying NETCONF and RESTCONF covers the transport, the operations (get, get-config, edit-config), and the data encoding. SNMP v2c and v3 remain in scope; v3 adds authentication and encryption that v2c lacks, and the exam tests the security model differences. NetFlow and IPFIX provide flow-level visibility; knowing what each exports and how a collector receives the data is the practical angle the exam takes.

How Automation and Assurance is tested

At 15% of the exam, Automation and Assurance is not the heaviest topic, but it rewards candidates who have actually worked with these tools rather than only read about them. Script interpretation items reward reading code carefully: the question presents a snippet and you must determine its effect, so precision with HTTP methods, endpoint paths, and data payloads matters. YANG items reward understanding the relationship between the model and the interface, not memorising module names. NSO items reward knowing where it sits in the management stack and what it abstracts. gRPC and gNMI items reward knowing the difference between dial-in and dial-out telemetry and what the certificate model secures. NETCONF and RESTCONF items reward knowing which operations are available and what encoding each protocol uses. SNMP items reward the v3 security model: authNoPriv versus authPriv and what each protects. NetFlow and IPFIX items reward knowing what a flow record contains and how export works. Candidates lose marks by confusing the role of the data model with the role of the transport protocol.