350-501 Security and Services — 40 Questions

Question 1

A service provider is configuring Control Plane Policing (CoPP) on IOS XR routers to protect the control plane. The engineer wants to rate-limit ICMP traffic destined to the router to 1 Mbps, while allowing BGP and OSPF traffic with higher limits. Which type of CoPP classification should be used for the ICMP traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Normal priority class. In IOS XR CoPP, traffic is classified into priority classes: Critical (routing protocols like BGP/OSPF), Normal (management protocols like ICMP, SSH, SNMP), and Management (for out-of-band management). ICMP destined to the router is considered normal priority traffic, not critical or management. Therefore, the Normal priority class is appropriate for rate-limiting ICMP to 1 Mbps.

Answer

Critical class

Answer

Management class

Answer

Control-plane class

Question 2

A service provider is implementing BGP security measures to prevent route hijacking. Which TWO mechanisms directly validate the origin AS of BGP prefixes? (Choose two.)

Accepted Answer

RPKI Origin Validation using ROAs [CORRECT]. RPKI Origin Validation uses ROAs to verify that the origin AS is authorized to advertise a prefix. BGPSec cryptographically validates the entire AS path, including the origin AS. Both directly validate the origin AS. Prefix lists and route-maps filter based on attributes but do not validate origin. Community filtering manipulates communities but does not validate origin.

Answer

BGP prefix lists [wrong]

Answer

BGP route-maps with AS path matching [wrong]

Answer

BGP community-based filtering [wrong]

Question 3

A service provider wants to protect its routers from CPU overload caused by excessive traffic to the control plane. Which mechanism should be configured on IOS XR routers to classify and rate-limit management traffic?

Accepted Answer

CoPP (Control Plane Protection). CoPP (Control Plane Protection) on IOS XR uses class maps and policy maps to classify and rate-limit traffic destined to the control plane, protecting the router from CPU overload.

Answer

uRPF strict mode

Answer

BGP Flowspec

Answer

MPLS TTL propagation

Question 4

An engineer is configuring management plane hardening on an IOS XR router. The requirement is to authenticate users against a central server and provide granular command authorization. Which protocol and feature should be used?

Accepted Answer

TACACS+ with AAA and task groups. TACACS+ provides separate authentication, authorization, and accounting, and is commonly used with AAA for centralized management. Role-based access is achieved via task groups in IOS XR.

Answer

SSH with local username/password

Answer

SNMPv3 with ACLs

Answer

RADIUS with local authentication

Question 5

A service provider is deploying uRPF on customer-facing interfaces to prevent IP spoofing. The network has asymmetric routing due to multiple upstream connections. Which uRPF mode should be used?

Accepted Answer

Loose mode. Strict mode requires the source address to be reachable via the incoming interface, which fails with asymmetric routing. Loose mode only checks that the source address exists in the routing table, making it suitable for asymmetric paths.

Answer

Strict mode

Answer

uRPF with allow-default

Answer

uRPF is not recommended for asymmetric routing

Question 6

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 7

An SP wants to filter BGP prefixes received from a customer to prevent hijacking. Which two tools can be used together on the provider edge router to implement inbound prefix filtering?

Accepted Answer

Prefix-list and route-map. Prefix-lists and route-maps are commonly used together to match and filter BGP prefixes. Prefix-lists define the prefixes, and route-maps apply them in BGP neighbor statements.

Answer

Distribute-list and ACL

Answer

RPKI and BGP community

Answer

AS-path access-list and community-list

Question 8

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. If no ROA exists for the prefix, the state is 'not-found'. 'Invalid' means the AS does not match an existing ROA. 'Valid' means the AS matches.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 9

A network engineer needs to perform maintenance on a BGP router without causing traffic loss. They plan to use BGP Graceful Shutdown (GSHUT). What does GSHUT do?

Accepted Answer

It sets the local preference to a lower value to withdraw routes gracefully. BGP GSHUT adjusts the local preference of routes to make them less preferred, gracefully draining traffic before the session is shut down. This avoids packet loss.

Answer

It immediately terminates all BGP sessions

Answer

It uses BGP fast external failover to speed up convergence

Answer

It increases the MED to deprefer routes

Question 10

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

Answer

Enable MPLS TTL propagation

Answer

Configure uRPF on the PE-CE link

Answer

Use BGP FlowSpec to filter labels

Question 11

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 12

An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?

Accepted Answer

NAT logging. CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.

Answer

Destination NAT

Answer

Port block allocation

Answer

ALG support

Question 13

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

Accepted Answer

To identify applications regardless of port. DPI inspects packet payloads to identify application-layer protocols (e.g., HTTP, BitTorrent), enabling traffic shaping, QoS, or security policies.

Answer

To block all traffic from a specific IP

Answer

To classify traffic based on port numbers only

Answer

To encrypt traffic

Question 14

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

Accepted Answer

A pre-shared key configured on both NTP client and server. NTP authentication uses a shared key (MD5 or SHA) configured on both client and server. The key must match for the client to accept time updates.

Answer

SNMPv3 for secure time exchange

Answer

A digital certificate from a CA

Answer

An ACL permitting NTP traffic

Question 15

An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)

Accepted Answer

Implement AAA with TACACS+. SSH provides encrypted remote access, and AAA with TACACS+ provides centralized authentication and authorization. SNMPv3 is also secure but not a management access method per se; the question asks for access measures.

Answer

Enable Telnet for remote access

Answer

Use SNMPv2c for monitoring

Answer

Disable all logging

Question 16

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). BGP FlowSpec can specify actions like traffic-rate (rate-limiting), redirect (to a next-hop or VRF), and drop (discard). Marking DSCP is not typical; sample is used for traffic analysis but not a standard action in FlowSpec.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 17

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. RPKI validates origin AS, prefix-list filters prefixes, and route-maps can apply additional filters. BGP communities are used for tagging, not direct hijacking prevention. AS-path prepending is for path selection, not hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 18

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

Accepted Answer

Implement CoPP by creating a class-map for ICMP and applying a police rate under a control-plane policy-map. CoPP (Control Plane Policing) on IOS XR uses class maps and policy maps to classify and rate-limit control plane traffic, including ICMP. ACL-based policing is less granular, and MPLS TE or BGP prefix filtering do not apply.

Answer

Enable MPLS traffic engineering to reroute ICMP

Answer

Use BGP prefix filtering to block ICMP routes

Answer

Configure an ACL to deny ICMP on all interfaces

Question 19

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted access, TACACS+ centralizes AAA with encryption, and IOS XR task groups allow fine-grained RBAC. Telnet and SNMPv2c are insecure; SNMPv3 is required for security.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 20

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Accepted Answer

Loose mode. Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.

Answer

Strict mode

Answer

No uRPF

Answer

Strict mode with allow-default option