A police records bureau traces a civic packet that enters the provider edge as plain IP, crosses the core labeled, and leaves unlabeled toward the far CE. Which describe-level sequence best matches that MPLS behavior?

When a police records bureau traces a civic packet that enters the provider edge as plain IP, crosses the core labeled, and leaves unlabeled toward the far CE, the describe-level MPLS sequence is ingress label imposition, transit label swap, then egress label disposition. The ingress PE pushes the label (or stack) as traffic enters the MPLS domain; transit LSRs swap labels along the LSP; the egress PE (often after PHP of the transport label) disposes of remaining label context and forwards native IP toward the CE. That matches IP-in, labeled-middle, IP-out behavior.

Egress imposition first, then CE-based label swap, then ingress disposition only reverses and misassigns roles. Imposition is at ingress into the MPLS domain; CEs in classic PE-CE IP attachment do not perform core label swap; disposition is at egress, not only as an ingress-only action.

NHRP registration on every P router followed by spoke-to-spoke label shortcuts describes DMVPN overlay behavior, not the standard PE/P MPLS forwarding sequence for a provider-labeled path between civic sites.

CoPP re-marking of EXP bits so IP packets never receive an MPLS header confuses control-plane policing and experimental-bit QoS marking with whether a packet is labeled at all. CoPP does not replace imposition/swap/disposition.

Exam caveat: PHP means the penultimate hop may pop the top transport label before the egress PE, but the conceptual triad remains impose / swap / dispose. VPN services add an inner VPN label; do not let that stack detail erase the basic sequence.

Operational check: capture or use MPLS-aware traceroute from PE to PE; confirm push at ingress, swap in the core, and unlabeled delivery on the PE-CE link. show mpls forwarding-table on ingress should show outgoing labels; on egress, disposition toward the CE interface.