350-501 Practice Test 26 — 15 Questions

Question 1

A network operator wants to distribute traffic filtering rules to multiple routers dynamically during a DDoS attack. Which technology should be used?

Accepted Answer

BGP FlowSpec. BGP FlowSpec (RFC 8955) allows encoding of flow specifications (e.g., source/dest IP, ports, protocol) and distributing them via BGP to routers, which then apply traffic filtering actions (e.g., drop, rate-limit) dynamically.

Answer

uRPF

Answer

S/RTBH

Answer

ACLs

Question 2

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. If no ROA exists for the prefix, the state is 'not-found'. 'Invalid' means the AS does not match an existing ROA. 'Valid' means the AS matches.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 3

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

Accepted Answer

A pre-shared key configured on both NTP client and server. NTP authentication uses a shared key (MD5 or SHA) configured on both client and server. The key must match for the client to accept time updates.

Answer

SNMPv3 for secure time exchange

Answer

A digital certificate from a CA

Answer

An ACL permitting NTP traffic

Question 4

Drag and drop the steps to configure EIGRP on a Cisco router into the correct order.

Accepted Answer

Router(config)# router eigrp 100
Router(config-router)# network 10.0.0.0
Router(config-router)# no auto-summary. EIGRP configuration requires entering the EIGRP process, advertising networks, and optionally disabling auto-summary.

Answer

Router(config)# router eigrp 100
Router(config-router)# no auto-summary
Router(config-router)# network 10.0.0.0

Answer

Router(config)# network 10.0.0.0
Router(config)# router eigrp 100
Router(config-router)# no auto-summary

Answer

Router(config)# router eigrp 100
Router(config-router)# no auto-summary
Router(config-router)# network 10.0.0.0
(Router(config-router)# exit)

Question 5

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. RPKI validates origin AS, prefix-list filters prefixes, and route-maps can apply additional filters. BGP communities are used for tagging, not direct hijacking prevention. AS-path prepending is for path selection, not hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 6

A service provider router running IOS XR is configured with Control Plane Policing (CoPP) to protect the route processor. Which type of traffic is most commonly rate-limited using CoPP in the control plane?

Accepted Answer

BGP update messages. CoPP on IOS XR is used to classify and rate-limit control plane traffic such as routing protocols (BGP, OSPF, IS-IS) and management traffic (SSH, SNMP). Among the options, BGP updates are control plane traffic that can be rate-limited to protect the CPU.

Answer

Multicast data forwarding

Answer

MPLS label imposition

Answer

Layer 2 data plane traffic

Question 7

A service provider is implementing control plane protection (CoPP) on an IOS XR router. Which protocol should be classified and rate-limited to prevent excessive control plane load due to routing updates?

Accepted Answer

BGP. BGP updates are sent to the control plane; without CoPP, a flood of BGP updates can overwhelm the router. CoPP classifies BGP traffic and rate-limits it to protect the control plane.

Answer

ICMP

Answer

SNMP

Answer

SSH

Question 8

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Accepted Answer

Loose mode. Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.

Answer

Strict mode

Answer

No uRPF

Answer

Strict mode with allow-default option

Question 9

An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?

Accepted Answer

NAT logging. CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.

Answer

Destination NAT

Answer

Port block allocation

Answer

ALG support

Question 10

An SP is deploying DDoS mitigation using BGP FlowSpec. Which THREE types of actions can be encoded in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop traffic. FlowSpec rules can include traffic rate-limiting, redirecting to a VRF (e.g., for scrubbing), and dropping traffic. Setting a BGP community is not a FlowSpec action; community is for routing policy. IPsec encryption is not a FlowSpec action.

Answer

Set a BGP community

Answer

Encrypt traffic with IPsec

Question 11

In an MPLS L3VPN, how can a service provider prevent a CE device from learning the MPLS label stack and potentially spoofing labels?

Accepted Answer

Disable MPLS on the PE-CE interface. Disabling MPLS on the PE-CE link ensures the CE does not receive labeled packets. TTL propagation is for traceroute, not for preventing label exposure. LDP authentication secures label distribution but does not prevent CE from receiving labels if MPLS is enabled.

Answer

Use LDP authentication between PE and CE

Answer

Configure MPLS VPN route-target filtering

Answer

Enable TTL propagation on the PE-CE link

Question 12

A service provider wants to prevent IP spoofing at the customer edge by verifying that the source IP address of incoming packets is reachable via the interface they arrive on. Which uRPF mode should be used?

Accepted Answer

Strict mode. Strict mode checks that the source IP is in the FIB and that the best return route is through the same interface. Loose mode only checks that the source IP is in the FIB. Strict mode is used at customer edges where traffic should come from a specific interface.

Answer

ACL-based filtering

Answer

Reverse path filtering disabled

Answer

Loose mode

Question 13

A service provider uses BGP FlowSpec (RFC 8955) to mitigate DDoS attacks. Which component in the network is responsible for originating the FlowSpec rules and distributing them to routers?

Accepted Answer

A FlowSpec controller (e.g., router with policy or SDN controller). In FlowSpec, a controller (or a router acting as controller) originates the FlowSpec NLRI and distributes it to edge routers via BGP. Edge routers apply the actions (e.g., drop, rate-limit). The trigger router is for RTBH; detection system may trigger but does not distribute FlowSpec.

Answer

The trigger router used for RTBH

Answer

The victim's CE router

Answer

An anomaly detection system like Cisco Peakflow

Question 14

During a DDoS attack, an SP wants to drop traffic destined to the victim IP at the network edge without affecting other traffic. Which technique should be used to achieve this by propagating a black-hole route from a trigger router to all edge routers?

Accepted Answer

S/RTBH (Remotely Triggered Black Hole) using BGP community. S/RTBH uses BGP to advertise a /32 route with a specific community to trigger routers to install a null route. This drops traffic to the victim IP at the edge. FlowSpec is more flexible but not specifically for RTBH; Peakflow detects anomalies; IDMS scrubs traffic.

Answer

Cisco Peakflow to reroute traffic

Answer

BGP FlowSpec to distribute filtering rules

Answer

IDMS to scrub traffic

Question 15

Which feature is used to validate that a BGP route origin is authorized by the prefix owner?

Accepted Answer

RPKI Origin Validation. RPKI BGP Origin Validation uses ROAs to validate the origin AS. Routes are marked as valid, invalid, or not-found based on ROA records.

Answer

BGP prefix filtering

Answer

BGP community filtering

Answer

BGP GSHUT