A leaf-spine topology is fundamentally a Layer 3 routed fabric designed to overcome the limitations of traditional Layer 2 networks that rely on Spanning Tree Protocol (STP). The core principle of leaf-spine is to use all available links for forwarding traffic, which is achieved through routing protocols (like BGP or OSPF) and Equal-Cost Multi-Path (ECMP). STP, in contrast, prevents loops by blocking redundant links, which would negate the high-bandwidth, low-latency, and multi-pathing benefits of the leaf-spine architecture. Therefore, a leaf-spine network does not use STP for its core loop-avoidance mechanism; it relies on routing.

A. This statement is true. The design requires every leaf switch to connect to every spine switch to create a full-mesh, non-blocking fabric between the layers.

B. This is a primary benefit. The path for east-west traffic is always leaf-spine-leaf, ensuring predictable and consistent low latency between any two hosts in the data center.

D. This is a core feature. ECMP is used to load-balance traffic across all the available, equal-cost paths between the leaf switches, maximizing bandwidth utilization and resiliency.

1. Nokia Data Center Fabric Solution Guide, Release 21.10, Section 2.1, "Data center network evolution": This document contrasts traditional STP-based networks with modern leaf-spine fabrics. It states, "To overcome the limitations of STP, modern data center networks are built as a Layer 3 fabric of interconnected switches... The leaf-spine topology uses a Layer 3 routing protocol... to provide ECMP (Equal Cost Multipath) forwarding." This explicitly confirms that leaf-spine uses L3 routing and ECMP instead of STP.

2. Nokia SR Linux and Fabric Services System Architecture Overview, Section 2.1, "IP fabric underlay": This document describes the foundation of the Nokia fabric: "The data center fabric is built on a two-stage leaf-spine topology... The underlay is an IP fabric that uses an interior gateway protocol (IGP) or BGP to provide reachability between the nodes." This reinforces the concept of an IP (Layer 3) fabric, which does not use STP for its core operation.

The system-cpu-policer is a software-based policer implemented on the Control Plane Module (CPM). It is designed to rate-limit the aggregate control plane traffic received from all line cards. In contrast, the distributed-policer is the hardware-based policer, implemented on the Network Processor Units (NPUs) of the individual line cards (IOMs/IMMs). Each distributed-policer instance polices traffic on a per-line-card basis before it is forwarded to the CPM. Therefore, the statement that the system-cpu-policer is hardware-based is false.

A. Hierarchical policing is a supported feature, achieved by applying both a distributed-policer (first level, per-card) and a system-cpu-policer (second level, aggregate) to the same traffic flow.

C. The system-cpu-policer is centralized on the CPM, and its specific function is to police the combined, or aggregate, traffic destined for the CPU from all line cards.

D. A single CPM-filter entry can indeed reference both a distributed-policer and a system-cpu-policer. This is the mechanism used to implement hierarchical control plane policing.

1. Nokia 7750 SR OS Router Configuration Guide, Release 22.10.R1, Part: System Management, Section: CPM Filters.

Page/Section Reference: In the "CPM Filter Policers" subsection, the guide describes the two types of policers. It states, "The system CPU policer is implemented on the CPM and polices the aggregate traffic from all line cards." and "The distributed policer is implemented on the line cards (IOM/IMMs)..." This distinction confirms the system-cpu-policer is on the CPM (software) and the distributed-policer is on line cards (hardware). The guide also explicitly mentions that "Hierarchical policing is supported" by using both policer types.

The Zero Touch Provisioning (ZTP) process in Nokia SR Linux obtains the location of the provisioning script from a DHCP server, typically via DHCP option 67 (Bootfile Name). A TLS profile is used to provide the necessary certificates and ciphers for securely downloading the script if the source URL uses HTTPS. However, the TLS profile itself does not define or contain the URL of the script; its purpose is to secure the transport layer for the download, not to specify the file's location.

B. The ZTP process is indeed managed by a dedicated ztp application within the SR Linux operating system, which initiates when the device boots without a configuration file.

C. The initial step of ZTP requires the device to obtain an IP address, default gateway, and other crucial options (like the script location) from a DHCP server.

D. This statement describes the fundamental purpose of ZTP: to enable a factory-default router to automatically download its configuration and become operational without manual intervention.

1. Nokia SR Linux Basic System Configuration Guide, Release 23.10, Section: "Zero touch provisioning".

This section states, "The DHCP server can provide the location of the provisioning script in DHCP option 67 (Bootfile Name)." This confirms that the DHCP server, not a TLS profile, provides the script location.

It also clarifies the role of the TLS profile: "If the provisioning script is downloaded from an HTTPS server, you can configure a TLS profile to be used for the download." This supports that the TLS profile is for security, not for defining the script's source.

The guide describes the ZTP process starting with a DHCP Discover message, confirming the reliance on a DHCP server (Option C) and the goal of automated provisioning (Option D). The existence of the ZTP process itself confirms a managing application (Option B).

In Nokia's SR Linux, the logging architecture is composed of three main components: sources, destinations, and filters. A logging source is an entity that generates log messages. SR Linux defines two primary types of sources: its own applications/subsystems (e.g., BGP, OSPF) and the underlying Linux system's facilities (e.g., kern, daemon). A syslog filter, by contrast, is not a source of logs. It is a set of rules or a mechanism used to process log streams, selecting which messages from a source should be sent to a specific destination. Therefore, a syslog filter is a processing element, not an originator of logs.

A. Linux facility + priority: This is a valid logging source in SR Linux. It allows the system to collect and manage log messages generated by the underlying Linux kernel and system daemons, categorized by standard syslog facilities.

B. Console: This is a primary log destination in SR Linux, used for displaying log messages. It is a recipient of logs, not a source that generates them. While it is not a source, a syslog filter is a processing rule, which is a more fundamentally different concept.

C. SR Linux subsystem + priority: This is a valid logging source. It represents the native applications running within SR Linux, such as routing protocols or system management agents, which generate logs categorized by severity.

1. Nokia SR Linux System Management Guide (Release R21.6.1)

Section: Logging > Logger process

Content: This section explicitly describes the components of the logging architecture. It states, "The logger process sends log entries to one or more destinations: the console, a log file, or a remote log server." This identifies the console (Option B) as a destination. It also states, "You can create filters to control which log messages are sent to which destinations," defining a filter (Option D) as a control mechanism, not a source.

Section: Logging > Log sources

Content: This section details the valid log sources. It specifies, "Log messages are identified by the application that generated them and a severity level." (Option C) and "The logging utility can also collect messages from the Linux syslog." (Option A). This confirms that Linux facilities and SR Linux applications are the defined sources.

The “nhgrp” keyword shown in the route entry indicates that the static route does not carry a single next-hop but is bound to a next-hop group object.

A next-hop group can only be referenced in the routing table when it contains two or more next-hops; otherwise the router would reference the single address directly and the keyword “nhgrp” would not appear. Therefore the presence of “nhgrp” guarantees that at least two next-hops have been configured for this static route, making option C the only true statement.

A. Recursive resolution is not shown; 10.2.1.0 already appears as a resolved entry, so no further lookup via 10.1.1.0 is occurring.

B. Same reasoning as A, but with addresses reversed; no evidence of a further lookup step is displayed.

D. Within a next-hop group SR OS first honours preference, but if all next-hops share the same preference (default), selection is by weight; exhibit provides no differing preferences.

1. Nokia SR OS Router Configuration Guide 21.7.R1, “Static Routes – Next-hop Groups”, p. 892-893: states that a route referencing “nhgrp” implies multiple next-hops.

2. Nokia SR OS 7750 SR Routing Protocols Guide 21.7.R1, §4.3.2 “Next-hop group behaviour”: explains preference/weight handling and that single-next-hop groups are optimised away.

3. Nokia SR OS CLI Reference Guide 21.7.R1, cmd “show router route …”: description of output fields, notes “nhgrp” appears only when more than one next-hop is present.

An EVPN Inclusive Multicast Ethernet Tag (IMET) route, or Route Type 3, is advertised by a VTEP to signal its membership in a broadcast domain for handling Broadcast, Unknown Unicast, and Multicast (BUM) traffic. According to RFC 7432, this route advertisement includes the originating VTEP's IP address, the Route Distinguisher (RD) of the EVPN Instance (EVI), and a PMSI Tunnel Attribute that carries the VNI. Receiving VTEPs collect these individual IMET routes from all participating peers to dynamically build their own local flooding list for ingress replication. The advertised route itself contains only a single entry for this list (the originator's IP), not the complete flooding list.

A. The VXLAN Network Identifier (VNI) is essential for identifying the broadcast domain. It is carried within the PMSI Tunnel Attribute of the IMET route advertisement.

C. The Route Distinguisher (RD) is a mandatory field in the IMET route's Network Layer Reachability Information (NLRI) to ensure the route is unique across the BGP domain for that specific MAC-VRF/EVI.

D. The IP address of the originating VTEP is explicitly included in the "Originating Router's IP Address" field of the IMET route NLRI.

1. RFC 7432: BGP MPLS-Based Ethernet VPN.

Section 7.3, "Inclusive Multicast Ethernet Tag Route": This section specifies the format of the Route Type 3 NLRI, which explicitly includes an 8-octet Route Distinguisher and the Originating Router's IP Address.

Section 8.3, "Ingress Replication": This section describes how the PMSI Tunnel Attribute is used with the IMET route. It states, "The PMSI Tunnel Attribute... MUST be attached to the Inclusive Multicast Ethernet Tag routes... The MPLS label in this attribute is the VNI." It also explains that a PE router builds its flooding list from the received IMET routes.

2. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "EVPN-VXLAN".

In the section on "EVPN Route Types", the documentation for "Route Type 3: Inclusive Multicast Ethernet Tag (IMET) Route" confirms that the NLRI for the IMET route contains the configured route-distinguisher and the originating VTEP IP address, and that it carries the PMSI attribute which includes the VNI. This confirms that options A, C, and D are included in the route.

The provided exhibit displays the configuration for a logging destination named "bgp-log". The configuration explicitly defines it as a file (file "bgp-log"). In the Nokia SR Linux CLI, the show command is used to display operational state and data, such as the contents of a log file. The info command is used to display configuration. Since the objective is to view the contents of the log, which is operational data, the show command is appropriate. Combining this with the object type (file) and its name (bgp-log) leads to the correct command.

A. show system logging buffer bgp-log is incorrect because the exhibit clearly defines "bgp-log" as a file, not a memory buffer.

C. info system logging buffer bgp-log is incorrect as info displays configuration, not content, and "bgp-log" is a file, not a buffer.

D. info system logging file bgp-log is incorrect because the info command displays the configuration of the log file, not its contents.

1. Nokia SR Linux R22.10.1 System Management Guide, Section: "Monitoring logs".

Page 11: "To display the contents of a log file, use the show system logging file command." This directly validates the correct answer (B). The guide also shows that the info command is used to display the configuration, which confirms why option D is incorrect.

2. Nokia SR Linux R22.10.1 System Management Guide, Section: "Configuring logging to a file".

Page 9: This section details the configuration syntax system logging file , which matches the structure shown in the exhibit and confirms that "bgp-log" is the identifier for a log file. This supports the reasoning for why options A and C, which refer to a buffer, are incorrect.

The statement that BGP neighbors automatically discover each other is factually incorrect. BGP is a path-vector protocol that requires neighbors (peers) to be manually and explicitly configured with each other's IP addresses and autonomous system numbers. Unlike link-state protocols such as OSPF or IS-IS, which use multicast Hello packets on a shared link to dynamically discover neighbors, BGP has no such native mechanism. Since automatic neighbor discovery is not a feature of BGP, it cannot be a reason for its use in the data center. The other options listed are all well-established reasons for BGP's adoption in modern data center fabrics.

A. This is a valid reason. In large-scale data center fabrics (e.g., leaf-spine), BGP is considered more efficient and scalable than link-state protocols because it avoids the overhead of flooding link-state databases across the entire fabric.

C. This is a valid reason. BGP has been the core routing protocol of the global internet for decades. Its maturity, stability, and the widespread operational expertise surrounding it make it a trusted choice for critical infrastructure.

D. This is a valid reason. Multi-Protocol BGP (MP-BGP) extensions allow BGP to carry routing information for various address families (AFI/SAFI), including IPv4, IPv6, and EVPN, making it highly versatile for modern, multi-service data centers.

1. RFC 7938: Use of BGP for Routing in Large-Scale Data Centers.

Section 3, "Why BGP?": This section details the advantages of using BGP in the data center, listing scalability, faster reconvergence (in specific DC designs), support for multiple address families (IPv4, IPv6, L2VPN, L3VPN), and its mature, widely implemented nature. It makes no mention of automatic discovery, as this is not a BGP feature. The configuration of BGP peers is always explicit.

2. Nokia Data Center Fabric Solution Guide.

Section "Underlay and Overlay Routing Protocols": This section typically explains the choice of eBGP for the fabric. It highlights BGP's scalability to handle a large number of leaf and spine nodes, its robust policy control, and its multi-protocol capabilities for services like EVPN. The configuration examples provided in such guides always demonstrate the manual configuration of BGP neighbors, reinforcing that auto-discovery is not a feature.

3. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 5.3, "BGP - The Internet's Inter-AS Routing Protocol": University-level textbooks on networking describe the fundamental operation of BGP. They explicitly state that BGP sessions are established over TCP between manually configured peers. This contrasts with their description of OSPF/IS-IS, where neighbor discovery via Hello packets is a key feature.

The Zero Touch Provisioning (ZTP) process on a Nokia SR Linux node is a device-centric mechanism initiated at boot time. It fundamentally relies on DHCP to acquire network connectivity and the location of a provisioning script. The device then downloads this script, along with any necessary software packages (RPMs) or images, from a web or FTP server and executes it to complete its configuration.

Nokia’s Fabric Services System (FSS) is a higher-level orchestration and automation platform for data center fabrics. While FSS utilizes ZTP to onboard new switches into the fabric, the ZTP process itself is independent of FSS. The deployment of a digital sandbox is a function managed by FSS, not a direct action performed by the device's native ZTP autoboot process.

A. DHCP is the primary mechanism used during ZTP to provide the device with its initial IP address, default gateway, and the location of the provisioning server via DHCP options.

B. A web (HTTP/HTTPS) or FTP server is the standard repository from which the device downloads its provisioning script, configuration files, and any required software packages or images.

C. The core of ZTP's automation is the downloading and execution of a provisioning script (e.g., a Python script), which performs the device's specific configuration tasks.

1. Nokia SR Linux R23.10.R1 System Management Guide, Section: "Zero touch provisioning". This section details the ZTP workflow: "When ZTP is enabled, the SR Linux device sends a DHCP discovery message on its management interface... The DHCP server responds with an offer that includes an IP address for the management interface and the location of a provisioning script... The SR Linux device downloads the script and executes it." This confirms that A, B, and C are integral parts of the process.

2. Nokia Data Center Fabric Solution Guide, Chapter 3: "Nokia Fabric Services System". This guide describes FSS as a platform for "fabric lifecycle automation," which includes "Day 0" operations like device onboarding via ZTP. It positions FSS as the orchestrator that leverages ZTP, confirming that FSS functions (like deploying a digital sandbox) are distinct from the ZTP process running on the switch itself.

In Nokia's SR Linux, the CPM-filter is a system-generated Access Control List (ACL) specifically designed for control plane protection. It is automatically instantiated on all line cards. Its primary function is to filter and rate-limit traffic from the data plane that is destined for the Control Plane Module (CPM). This mechanism is crucial for preventing Denial-of-Service (DoS) attacks and ensuring the stability of the router's control plane by managing the flow of protocol and management packets directed to the CPU.

A. Capture-filter ACL: This is used for traffic mirroring and debugging purposes to select specific packets to be copied to a destination for analysis, not for system-wide control plane protection.

C. Ingress ACL: This is a user-defined data plane filter applied to a subinterface to control transit traffic entering the router; it does not specifically target CPM-bound traffic by default.

D. Egress ACL: This is a user-defined data plane filter applied to a subinterface to control traffic leaving the router, which is irrelevant for incoming packets destined for the CPM.

---

1. Nokia SR Linux R23.10.R1 System Management Guide, Section: "ACLs".

Page/Section Reference: In the "ACLs" overview section, it states: "SR Linux uses CPM-filter ACLs to protect the CPM from being overwhelmed by traffic from the data plane. CPM-filter ACLs are system-generated and applied to all line card ports." This directly confirms that CPM-filters are instantiated on all line cards to manage traffic to the CPM.

2. Nokia SR Linux R23.10.R1 Data Center Fabric Configuration Guide, Section: "ACL filter policies".

Page/Section Reference: The section on "Filter policies" describes ingress and egress ACLs (ip-filter, ipv6-filter, mac-filter) as user-configured policies applied to subinterfaces for data plane traffic, distinguishing them from the system-level function of the CPM-filter.