350-501 Security and Services Practice Test 2 — 15 Questions

Question 1

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). BGP FlowSpec can specify actions like traffic-rate (rate-limiting), redirect (to a next-hop or VRF), and drop (discard). Marking DSCP is not typical; sample is used for traffic analysis but not a standard action in FlowSpec.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 2

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. RPKI validates origin AS, prefix-list filters prefixes, and route-maps can apply additional filters. BGP communities are used for tagging, not direct hijacking prevention. AS-path prepending is for path selection, not hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 3

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

Accepted Answer

Implement CoPP by creating a class-map for ICMP and applying a police rate under a control-plane policy-map. CoPP (Control Plane Policing) on IOS XR uses class maps and policy maps to classify and rate-limit control plane traffic, including ICMP. ACL-based policing is less granular, and MPLS TE or BGP prefix filtering do not apply.

Answer

Enable MPLS traffic engineering to reroute ICMP

Answer

Use BGP prefix filtering to block ICMP routes

Answer

Configure an ACL to deny ICMP on all interfaces

Question 4

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted access, TACACS+ centralizes AAA with encryption, and IOS XR task groups allow fine-grained RBAC. Telnet and SNMPv2c are insecure; SNMPv3 is required for security.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 5

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Accepted Answer

Loose mode. Strict uRPF checks that the source IP matches the best route in the FIB and that the incoming interface matches the outgoing interface for that route. Loose uRPF only checks that a route to the source exists in the FIB, which accommodates asymmetric routing.

Answer

Strict mode

Answer

No uRPF

Answer

Strict mode with allow-default option

Question 6

During a DDoS attack, an SP wants to drop traffic destined to the victim IP at the network edge without affecting other traffic. Which technique should be used to achieve this by propagating a black-hole route from a trigger router to all edge routers?

Accepted Answer

S/RTBH (Remotely Triggered Black Hole) using BGP community. S/RTBH uses BGP to advertise a /32 route with a specific community to trigger routers to install a null route. This drops traffic to the victim IP at the edge. FlowSpec is more flexible but not specifically for RTBH; Peakflow detects anomalies; IDMS scrubs traffic.

Answer

Cisco Peakflow to reroute traffic

Answer

BGP FlowSpec to distribute filtering rules

Answer

IDMS to scrub traffic

Question 7

A service provider uses BGP to exchange routes with customers. To prevent the customer from announcing prefixes they do not own (BGP hijacking), which tool should the provider apply on the customer-facing BGP session?

Accepted Answer

Prefix-list and route-map to filter incoming updates. Prefix-lists and route-maps are used to filter incoming BGP advertisements based on prefix and attributes. RPKI validates origin but requires ROA; BGP GSHUT is for maintenance; communities are for tagging.

Answer

BGP Graceful Shutdown

Answer

RPKI Origin Validation only

Answer

Set BGP community to tag customer routes

Question 8

An SP is implementing RPKI to validate BGP origin AS. After configuring RPKI-to-Router (RTR) and setting BGP origin validation, a route is marked as 'invalid'. What action does BGP default take for invalid routes?

Accepted Answer

The route is not installed in the routing table unless it is the only path. By default, BGP does not drop invalid routes; they are considered but with a lower preference (typically not installed in the routing table if a valid route exists). To drop invalid routes, explicit policy is needed.

Answer

The route is installed with a lower local preference

Answer

The route is treated as valid but with a lower preference

Answer

The route is dropped and not considered for best path selection

Question 9

A service provider wants to gracefully shut down a BGP session to a customer for maintenance without causing traffic loss. Which BGP feature should be used to signal the peer to reroute traffic before the session is brought down?

Accepted Answer

BGP Graceful Shutdown (GSHUT). BGP Graceful Shutdown (GSHUT) uses a well-known community or attribute to inform peers that the session is going down, allowing them to reroute traffic. BFD detects failures fast but does not signal; TTL propagation is for MPLS; route refresh is for soft reconfiguration.

Answer

BGP TTL Security

Answer

BGP Route Refresh

Answer

BGP Fast External Failover

Question 10

In an MPLS L3VPN, how can a service provider prevent a CE device from learning the MPLS label stack and potentially spoofing labels?

Accepted Answer

Disable MPLS on the PE-CE interface. Disabling MPLS on the PE-CE link ensures the CE does not receive labeled packets. TTL propagation is for traceroute, not for preventing label exposure. LDP authentication secures label distribution but does not prevent CE from receiving labels if MPLS is enabled.

Answer

Use LDP authentication between PE and CE

Answer

Configure MPLS VPN route-target filtering

Answer

Enable TTL propagation on the PE-CE link

Question 11

A service provider is deploying a BNG for subscriber management. Which protocol is typically used to authenticate subscribers and assign IP addresses in a PPPoE-based broadband network?

Accepted Answer

RADIUS. RADIUS is the standard protocol for authentication, authorization, and accounting (AAA) in BNG environments. DHCP assigns IP addresses, but authentication is via RADIUS. TACACS+ is for device administration; IPoE uses DHCP but not typically for authentication.

Answer

DHCP

Answer

IPoE

Answer

TACACS+

Question 12

An SP implements Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. For legal compliance, what additional function must be enabled to log subscriber IP-port mappings?

Accepted Answer

NAT logging (syslog or other). CGNAT logging is required for lawful intercept and auditing. ALG support is for application layer protocols, not logging. Port allocation is part of NAT operation. DPI classifies traffic.

Answer

Port allocation algorithm (deterministic or random)

Answer

Application Layer Gateway (ALG) support

Answer

Deep Packet Inspection (DPI)

Question 13

A service provider uses BGP FlowSpec (RFC 8955) to mitigate DDoS attacks. Which component in the network is responsible for originating the FlowSpec rules and distributing them to routers?

Accepted Answer

A FlowSpec controller (e.g., router with policy or SDN controller). In FlowSpec, a controller (or a router acting as controller) originates the FlowSpec NLRI and distributes it to edge routers via BGP. Edge routers apply the actions (e.g., drop, rate-limit). The trigger router is for RTBH; detection system may trigger but does not distribute FlowSpec.

Answer

The trigger router used for RTBH

Answer

The victim's CE router

Answer

An anomaly detection system like Cisco Peakflow

Question 14

To secure NTP in a service provider network, which feature should be enabled on IOS XR routers to prevent time synchronization with unauthorized NTP servers?

Accepted Answer

NTP authentication with MD5 keys. NTP authentication ensures that the router only synchronizes with trusted servers that have the correct key. Access lists can also limit, but authentication provides cryptographic verification. NTP broadcast mode is less secure; symmetric mode is for peer-to-peer.

Answer

NTP symmetric active mode

Answer

NTP broadcast client mode

Answer

NTP access group with read-only community

Question 15

A service provider is deploying uRPF on peering edges with multiple upstream providers and asymmetric routing. Which two statements are true about uRPF operation in this scenario? (Choose two.)

Accepted Answer

Loose mode may drop traffic if no route to the source exists in the FIB. Loose uRPF only checks that a route to the source exists, suitable for asymmetric routing. Strict uRPF requires the incoming interface to match the best return route, which can drop legitimate traffic with asymmetric routing. Default routes do not affect loose mode.

Answer

uRPF requires CEF to be disabled

Answer

Loose mode requires a default route to function

Answer

Strict mode is preferred for asymmetric routing environments