350-501 Security and Services — 20 Questions

Question 1

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. S/RTBH (Source-Based Remotely Triggered Black Hole) works by advertising the victim's IP address (or the attack source, in source-based mode) from the trigger router to edge routers with a specific BGP blackhole community (e.g., 65535:666 for RFC 7999). Edge routers match the community and install a null route, dropping all traffic to that prefix before it consumes backbone bandwidth.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 2

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. In RPKI validation, a route whose origin AS does not match any published ROA (Resource Origin Authorization) for that prefix is classified as 'Not-found' — meaning no ROA exists covering that prefix/AS pair. This is distinct from 'Invalid,' which means a ROA exists for the prefix but the origin AS or prefix length does not match.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 3

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

Answer

Enable MPLS TTL propagation

Answer

Configure uRPF on the PE-CE link

Answer

Use BGP FlowSpec to filter labels

Question 4

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). Option A (Drop/discard) is correct because RFC 5575 defines the "traffic-drop" action, which instructs the receiving router to silently discard matching packets, making it the primary FlowSpec mitigation action for volumetric attacks. Option D (Traffic-rate/rate-limit) is correct because the "traffic-rate" action in bytes per second polices matching traffic to a specified rate, allowing an SP to throttle rather than fully drop attack flows. Option E (Redirect to a next-hop) is correct because the "redirect" action (with a Route Target extended community) steers matching traffic to a VRF or next-hop, typically used to send traffic to a scrubbing center. Option B (Sample) is not a FlowSpec action; packet sampling is handled by NetFlow/IPFIX or sFlow, not by BGP FlowSpec rules. Option C (Mark DSCP) is not a FlowSpec action either; DSCP marking is performed via QoS policy (e.g., MQC set dscp), not through FlowSpec's defined action set.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 5

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. Prefix-lists (A) are correct because they let the SP explicitly permit only the exact prefixes a customer is authorized to advertise, blocking any hijacked or more-specific prefix that falls outside the agreed allocation. RPKI with BGP Origin Validation (B) is correct because it cryptographically validates the origin AS in the AS_PATH against a signed ROA, causing invalid-origin announcements to be marked Invalid and rejected by a configured routing policy. Route-maps (D) are correct because they provide the policy engine that matches prefixes, origin AS, or other attributes and applies permit/deny actions, which is how prefix-lists, RPKI validation states, and other filters are actually enforced on BGP updates. AS-path prepending (C) is not a security mechanism; it only makes a path less preferred for traffic engineering and does not stop a hijacker from announcing a route. BGP communities (E) are just transitive tags used for policy signaling and do not by themselves prevent route hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 6

During a DDoS attack, an SP wants to drop traffic destined to the victim IP at the network edge without affecting other traffic. Which technique should be used to achieve this by propagating a black-hole route from a trigger router to all edge routers?

Accepted Answer

S/RTBH (Remotely Triggered Black Hole) using BGP community. S/RTBH (Source/Remotely Triggered Black Hole) uses a trigger router to originate a black-hole route (typically a /32 for the victim) tagged with a specific BGP community (e.g., 65535:666) and propagates it to edge routers. Edge routers match the community and install a discard/next-hop null route for that prefix, dropping attack traffic at the network edge while leaving other traffic unaffected. This is the standard technique for destination-based black-holing during DDoS.

Answer

Cisco Peakflow to reroute traffic

Answer

BGP FlowSpec to distribute filtering rules

Answer

IDMS to scrub traffic

Question 7

A service provider uses BGP to exchange routes with customers. To prevent the customer from announcing prefixes they do not own (BGP hijacking), which tool should the provider apply on the customer-facing BGP session?

Accepted Answer

Prefix-list and route-map to filter incoming updates. Prefix-lists and route-maps are used to filter incoming BGP advertisements based on prefix and attributes. RPKI validates origin but requires ROA; BGP GSHUT is for maintenance; communities are for tagging.

Answer

BGP Graceful Shutdown

Answer

RPKI Origin Validation only

Answer

Set BGP community to tag customer routes

Question 8

An SP is implementing RPKI to validate BGP origin AS. After configuring RPKI-to-Router (RTR) and setting BGP origin validation, a route is marked as 'invalid'. What action does BGP default take for invalid routes?

Accepted Answer

The route is not installed in the routing table unless it is the only path. By default, BGP does not drop invalid routes; they are considered but with a lower preference (typically not installed in the routing table if a valid route exists). To drop invalid routes, explicit policy is needed.

Answer

The route is installed with a lower local preference

Answer

The route is treated as valid but with a lower preference

Answer

The route is dropped and not considered for best path selection

Question 9

A service provider wants to gracefully shut down a BGP session to a customer for maintenance without causing traffic loss. Which BGP feature should be used to signal the peer to reroute traffic before the session is brought down?

Accepted Answer

BGP Graceful Shutdown (GSHUT). BGP Graceful Shutdown (GSHUT) uses a well-known community or attribute to inform peers that the session is going down, allowing them to reroute traffic. BFD detects failures fast but does not signal; TTL propagation is for MPLS; route refresh is for soft reconfiguration.

Answer

BGP TTL Security

Answer

BGP Route Refresh

Answer

BGP Fast External Failover

Question 10

A service provider is deploying a BNG for subscriber management. Which protocol is typically used to authenticate subscribers and assign IP addresses in a PPPoE-based broadband network?

Accepted Answer

RADIUS. RADIUS is the standard protocol for authentication, authorization, and accounting (AAA) in BNG environments. DHCP assigns IP addresses, but authentication is via RADIUS. TACACS+ is for device administration; IPoE uses DHCP but not typically for authentication.

Answer

DHCP

Answer

IPoE

Answer

TACACS+

Question 11

A service provider wants to protect its core routers from control plane attacks. Which two mechanisms are effective in mitigating such attacks on IOS XR? (Choose two.)

Accepted Answer

Unicast Reverse Path Forwarding (uRPF). Option B, Unicast Reverse Path Forwarding (uRPF), is correct because it validates the source address of incoming packets against the routing table (or FIB) and drops packets whose source is not reachable via the receiving interface, which prevents spoofed-source traffic from reaching and exhausting the control plane. Option C, Control Plane Policing (CoPP), is correct because it applies a modular QoS policy to the control plane (via the control-plane interface in IOS XR) to rate-limit and filter traffic destined to the RP, directly protecting protocols such as BGP, OSPF, and ICMP from DoS floods. Option A, MPLS TTL propagation, is not a control plane protection mechanism; it only controls whether the IP TTL is copied into the MPLS header and has no filtering or rate-limiting effect. Option D, BGP prefix filtering, is a routing policy that controls which prefixes are accepted or advertised and does not mitigate control plane attacks such as packet floods or spoofing. Option E, NTP authentication, only secures time synchronization between NTP peers and provides no protection against control plane attacks.

Answer

MPLS TTL propagation

Answer

BGP prefix filtering

Answer

NTP authentication

Question 12

During a DDoS attack, a service provider uses Cisco Peakflow to detect anomalous traffic and then triggers S/RTBH. What must be configured on the router to black hole attack traffic using a /32 null route?

Accepted Answer

A static route to Null0 for the victim IP and a BGP community to trigger blackholing. S/RTBH relies on BGP to propagate a /32 route with a specific community (commonly no-export) pointing to a null interface (e.g., Null0). The trigger router sets the next-hop to a static route pointing to Null0 and advertises it via BGP.

Answer

QoS policy to rate-limit attack traffic

Answer

An inbound ACL blocking the attack source IPs

Answer

PBR to redirect traffic to a scrubbing center

Question 13

In an MPLS L3VPN network, which security measure should be taken on PE-CE links to prevent MPLS label spoofing?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on the PE-CE link ensures that the customer cannot send labeled packets into the MPLS core, preventing label spoofing. Additionally, disabling TTL propagation can hide the core topology but does not prevent spoofing.

Answer

Enable MPLS OAM

Answer

Use BGP prefix filtering

Answer

Enable TTL propagation

Question 14

A service provider is configuring Control Plane Policing (CoPP) on IOS XR routers to protect the control plane. The engineer wants to rate-limit ICMP traffic destined to the router to 1 Mbps, while allowing BGP and OSPF traffic with higher limits. Which type of CoPP classification should be used for the ICMP traffic?

Accepted Answer

Normal priority class. In IOS XR CoPP, traffic is classified into priority classes: Critical (routing protocols like BGP/OSPF), Normal (management protocols like ICMP, SSH, SNMP), and Management (for out-of-band management). ICMP destined to the router is considered normal priority traffic, not critical or management. Therefore, the Normal priority class is appropriate for rate-limiting ICMP to 1 Mbps.

Answer

Critical class

Answer

Management class

Answer

Control-plane class

Question 15

A service provider wants to mitigate DDoS attacks by blackholing traffic destined to a victim IP address. They plan to use Remotely Triggered Black Hole (RTBH) filtering. What BGP community is commonly used to trigger the blackhole route?

Accepted Answer

Community 666. In Remotely Triggered Black Hole (RTBH) filtering, BGP community 666 (often written as 666:666) is commonly used to signal that a route should be blackholed. When a router receives a route with this community, it sets the next-hop to a null interface, dropping traffic to the victim IP.

Answer

Community 100

Answer

Community no-export

Answer

Community local-AS

Question 16

A service provider is deploying a Broadband Network Gateway (BNG) for subscriber management. Which protocol is used by the BNG to authenticate subscribers via a RADIUS server?

Accepted Answer

RADIUS. The question states that the BNG authenticates subscribers via a RADIUS server, so the protocol used is RADIUS. RADIUS (Remote Authentication Dial-In User Service) is the standard AAA protocol for subscriber authentication, authorization, and accounting in broadband networks. It is explicitly referenced in the question, making RADIUS the correct answer.

Answer

LDAP

Answer

Diameter

Answer

TACACS+

Question 17

An SP detects a volumetric DDoS attack targeting a customer network. The SP uses Cisco's S/RTBH technique to drop attack traffic. Which action is performed by the edge routers upon receiving a BGP route with a specific community?

Accepted Answer

The edge router installs a /32 route pointing to a discard interface. In S/RTBH (Source-Based Remote Triggered Black Hole), the edge router receives a BGP route with a specific community (often the blackhole community) and installs a route pointing to a discard interface (e.g., null0). This drops all traffic to the attacked destination, mitigating the DDoS.

Answer

The edge router applies a BGP FlowSpec rule to rate-limit the traffic

Answer

The edge router forwards the attack traffic to a scrubbing center

Answer

The edge router sends ICMP unreachable messages to the attacker

Question 18

A service provider wants to prevent BGP hijacking of its customer prefixes. The SP implements RPKI with BGP Origin Validation. When a route is received with an origin AS that does not match any ROA, what is the validation state?

Accepted Answer

Not-found. In RPKI, if no ROA exists for the prefix, the state is 'not-found'. If the origin AS matches a ROA, it's 'valid'; if it conflicts, it's 'invalid'.

Answer

Invalid

Answer

Valid

Answer

Unknown

Question 19

An SP engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. What does the GSHUT community do to the BGP best path selection process?

Accepted Answer

It sets the local preference to 0. BGP GSHUT uses a well-known community (0xFFFF0000) that lowers the local preference by 100 (to 0 by default) to make the routes less preferred, thus draining traffic gracefully.

Answer

It prepends the AS path

Answer

It removes the route from the BGP table

Answer

It increases the MED value by 100

Question 20

Which MPLS security best practice helps prevent label spoofing attacks where an attacker injects MPLS packets with a forged label stack to bypass ACLs?

Accepted Answer

Disabling TTL propagation on PE-CE interfaces. Disabling TTL propagation on PE-CE interfaces prevents an attacker from using the MPLS TTL field to map the provider network and craft packets that bypass ACLs. When TTL propagation is disabled, the ingress PE sets the MPLS TTL to 255, and the egress PE does not copy the IP TTL to the MPLS TTL, making it harder for an attacker to predict label values or inject spoofed labels that traverse the core. This best practice is recommended in Cisco MPLS security guidelines to mitigate label spoofing and reconnaissance.

Answer

Enabling MPLS on all interfaces including CE-facing

Answer

Enabling TTL propagation on all PE routers

Answer

Using IP explicit null labels on all LSPs