350-501 Security and Services — 30 Questions

Question 1

A service provider wants to protect its routers from CPU overload caused by excessive traffic to the control plane. Which mechanism should be configured on IOS XR routers to classify and rate-limit management traffic?

Accepted Answer

CoPP (Control Plane Protection). CoPP (Control Plane Protection) on IOS XR uses class maps and policy maps to classify and rate-limit traffic destined to the control plane, protecting the router from CPU overload.

Answer

uRPF strict mode

Answer

BGP Flowspec

Answer

MPLS TTL propagation

Question 2

An engineer is configuring management plane hardening on an IOS XR router. The requirement is to authenticate users against a central server and provide granular command authorization. Which protocol and feature should be used?

Accepted Answer

TACACS+ with AAA and task groups. TACACS+ provides separate authentication, authorization, and accounting, and is commonly used with AAA for centralized management. Role-based access is achieved via task groups in IOS XR.

Answer

SSH with local username/password

Answer

SNMPv3 with ACLs

Answer

RADIUS with local authentication

Question 3

A service provider is deploying uRPF on customer-facing interfaces to prevent IP spoofing. The network has asymmetric routing due to multiple upstream connections. Which uRPF mode should be used?

Accepted Answer

Loose mode. Strict mode requires the source address to be reachable via the incoming interface, which fails with asymmetric routing. Loose mode only checks that the source address exists in the routing table, making it suitable for asymmetric paths.

Answer

Strict mode

Answer

uRPF with allow-default

Answer

uRPF is not recommended for asymmetric routing

Question 4

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 5

An SP wants to filter BGP prefixes received from a customer to prevent hijacking. Which two tools can be used together on the provider edge router to implement inbound prefix filtering?

Accepted Answer

Prefix-list and route-map. Prefix-lists and route-maps are commonly used together to match and filter BGP prefixes. Prefix-lists define the prefixes, and route-maps apply them in BGP neighbor statements.

Answer

Distribute-list and ACL

Answer

RPKI and BGP community

Answer

AS-path access-list and community-list

Question 6

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. If no ROA exists for the prefix, the state is 'not-found'. 'Invalid' means the AS does not match an existing ROA. 'Valid' means the AS matches.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 7

A network engineer needs to perform maintenance on a BGP router without causing traffic loss. They plan to use BGP Graceful Shutdown (GSHUT). What does GSHUT do?

Accepted Answer

It sets the local preference to a lower value to withdraw routes gracefully. BGP GSHUT adjusts the local preference of routes to make them less preferred, gracefully draining traffic before the session is shut down. This avoids packet loss.

Answer

It immediately terminates all BGP sessions

Answer

It uses BGP fast external failover to speed up convergence

Answer

It increases the MED to deprefer routes

Question 8

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

Answer

Enable MPLS TTL propagation

Answer

Configure uRPF on the PE-CE link

Answer

Use BGP FlowSpec to filter labels

Question 9

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 10

An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?

Accepted Answer

NAT logging. CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.

Answer

Destination NAT

Answer

Port block allocation

Answer

ALG support

Question 11

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

Accepted Answer

To identify applications regardless of port. DPI inspects packet payloads to identify application-layer protocols (e.g., HTTP, BitTorrent), enabling traffic shaping, QoS, or security policies.

Answer

To block all traffic from a specific IP

Answer

To classify traffic based on port numbers only

Answer

To encrypt traffic

Question 12

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

Accepted Answer

A pre-shared key configured on both NTP client and server. NTP authentication uses a shared key (MD5 or SHA) configured on both client and server. The key must match for the client to accept time updates.

Answer

SNMPv3 for secure time exchange

Answer

A digital certificate from a CA

Answer

An ACL permitting NTP traffic

Question 13

An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)

Accepted Answer

Implement AAA with TACACS+. SSH provides encrypted remote access, and AAA with TACACS+ provides centralized authentication and authorization. SNMPv3 is also secure but not a management access method per se; the question asks for access measures.

Answer

Enable Telnet for remote access

Answer

Use SNMPv2c for monitoring

Answer

Disable all logging

Question 14

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). BGP FlowSpec can specify actions like traffic-rate (rate-limiting), redirect (to a next-hop or VRF), and drop (discard). Marking DSCP is not typical; sample is used for traffic analysis but not a standard action in FlowSpec.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 15

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. RPKI validates origin AS, prefix-list filters prefixes, and route-maps can apply additional filters. BGP communities are used for tagging, not direct hijacking prevention. AS-path prepending is for path selection, not hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 16

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

Accepted Answer

Implement CoPP by creating a class-map for ICMP and applying a police rate under a control-plane policy-map. CoPP (Control Plane Policing) on IOS XR uses class maps and policy maps to classify and rate-limit control plane traffic, including ICMP. ACL-based policing is less granular, and MPLS TE or BGP prefix filtering do not apply.

Answer

Enable MPLS traffic engineering to reroute ICMP

Answer

Use BGP prefix filtering to block ICMP routes

Answer

Configure an ACL to deny ICMP on all interfaces

Question 17

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted access, TACACS+ centralizes AAA with encryption, and IOS XR task groups allow fine-grained RBAC. Telnet and SNMPv2c are insecure; SNMPv3 is required for security.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 18

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Accepted Answer

Loose mode. Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.

Answer

Strict mode

Answer

No uRPF

Answer

Strict mode with allow-default option

Question 19

During a DDoS attack, an SP wants to drop traffic destined to the victim IP at the network edge without affecting other traffic. Which technique should be used to achieve this by propagating a black-hole route from a trigger router to all edge routers?

Accepted Answer

S/RTBH (Remotely Triggered Black Hole) using BGP community. S/RTBH uses BGP to advertise a /32 route with a specific community to trigger routers to install a null route. This drops traffic to the victim IP at the edge. FlowSpec is more flexible but not specifically for RTBH; Peakflow detects anomalies; IDMS scrubs traffic.

Answer

Cisco Peakflow to reroute traffic

Answer

BGP FlowSpec to distribute filtering rules

Answer

IDMS to scrub traffic

Question 20

A service provider uses BGP to exchange routes with customers. To prevent the customer from announcing prefixes they do not own (BGP hijacking), which tool should the provider apply on the customer-facing BGP session?

Accepted Answer

Prefix-list and route-map to filter incoming updates. Prefix-lists and route-maps are used to filter incoming BGP advertisements based on prefix and attributes. RPKI validates origin but requires ROA; BGP GSHUT is for maintenance; communities are for tagging.

Answer

BGP Graceful Shutdown

Answer

RPKI Origin Validation only

Answer

Set BGP community to tag customer routes