350-501 Security and Services Practice Test 3 — 15 Questions

Question 1

A service provider is implementing control plane protection (CoPP) on an IOS XR router. Which protocol should be classified and rate-limited to prevent excessive control plane load due to routing updates?

Accepted Answer

BGP. BGP updates are sent to the control plane; without CoPP, a flood of BGP updates can overwhelm the router. CoPP classifies BGP traffic and rate-limits it to protect the control plane.

Answer

ICMP

Answer

SNMP

Answer

SSH

Question 2

An engineer is hardening the management plane of an IOS XR router. Which combination is the most secure for remote administration?

Accepted Answer

SSH with TACACS+ authentication and authorization. SSH provides encrypted remote access, and TACACS+ offers granular AAA control with encryption of all traffic, making it more secure than RADIUS (which encrypts only password) or local authentication.

Answer

HTTP with local authentication

Answer

Telnet with local authentication

Answer

SSH with RADIUS authentication

Question 3

A service provider wants to prevent IP spoofing at the customer edge by verifying that the source IP address of incoming packets is reachable via the interface they arrive on. Which uRPF mode should be used?

Accepted Answer

Strict mode. Strict mode checks that the source IP is in the FIB and that the best return route is through the same interface. Loose mode only checks that the source IP is in the FIB. Strict mode is used at customer edges where traffic should come from a specific interface.

Answer

ACL-based filtering

Answer

Reverse path filtering disabled

Answer

Loose mode

Question 4

During a DDoS attack, a service provider uses Cisco Peakflow to detect anomalous traffic and then triggers S/RTBH. What must be configured on the router to black hole attack traffic using a /32 null route?

Accepted Answer

A static route to Null0 for the victim IP and a BGP community to trigger blackholing. S/RTBH relies on BGP to propagate a /32 route with a specific community (commonly no-export) pointing to a null interface (e.g., Null0). The trigger router sets the next-hop to a static route pointing to Null0 and advertises it via BGP.

Answer

QoS policy to rate-limit attack traffic

Answer

An inbound ACL blocking the attack source IPs

Answer

PBR to redirect traffic to a scrubbing center

Question 5

A network operator wants to distribute traffic filtering rules to multiple routers dynamically during a DDoS attack. Which technology should be used?

Accepted Answer

BGP FlowSpec. BGP FlowSpec (RFC 8955) allows encoding of flow specifications (e.g., source/dest IP, ports, protocol) and distributing them via BGP to routers, which then apply traffic filtering actions (e.g., drop, rate-limit) dynamically.

Answer

uRPF

Answer

S/RTBH

Answer

ACLs

Question 6

Which feature is used to validate that a BGP route origin is authorized by the prefix owner?

Accepted Answer

RPKI Origin Validation. RPKI BGP Origin Validation uses ROAs to validate the origin AS. Routes are marked as valid, invalid, or not-found based on ROA records.

Answer

BGP prefix filtering

Answer

BGP community filtering

Answer

BGP GSHUT

Question 7

A service provider is preparing for maintenance on a BGP-speaking router. To minimize packet loss, they want to signal to neighbors that the session is being shut down gracefully. Which BGP feature should be used?

Accepted Answer

BGP GSHUT. BGP Graceful Shutdown (GSHUT) uses a well-known community (GRACEFUL_SHUTDOWN) to inform peers to lower the local preference, draining traffic before session termination.

Answer

BGP Route Refresh

Answer

BGP Multipath

Answer

BGP Fast External Failover

Question 8

In an MPLS L3VPN network, which security measure should be taken on PE-CE links to prevent MPLS label spoofing?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on the PE-CE link ensures that the customer cannot send labeled packets into the MPLS core, preventing label spoofing. Additionally, disabling TTL propagation can hide the core topology but does not prevent spoofing.

Answer

Enable MPLS OAM

Answer

Use BGP prefix filtering

Answer

Enable TTL propagation

Question 9

Which protocol is used by a BNG to authenticate and authorize subscribers?

Accepted Answer

RADIUS. BNG uses RADIUS for AAA (authentication, authorization, and accounting) of subscribers. RADIUS exchanges messages with a backend server to validate credentials and assign policies.

Answer

DIAMETER

Answer

LDAP

Answer

TACACS+

Question 10

A service provider implements CGNAT to conserve IPv4 addresses. Which feature is required to ensure that application-level protocols such as SIP or FTP function correctly?

Accepted Answer

ALG support. Many application protocols embed IP addresses in payload. ALGs (Application Level Gateways) inspect and modify these payloads to ensure proper translation. Without ALGs, these protocols may break.

Answer

Port block allocation

Answer

Logging

Answer

Session limits

Question 11

Which IOS XR feature allows an administrator to grant specific commands to a user based on their role, using task groups?

Accepted Answer

Role-based access control (RBAC) with task groups. IOS XR uses task groups (e.g., cisco-support, cisco-config) to define sets of commands or operations. Users are assigned to task groups to control access to specific router functions.

Answer

SNMPv3

Answer

IP access lists

Answer

AAA with RADIUS

Question 12

What is the purpose of NTP authentication in a service provider network?

Accepted Answer

To verify the identity of the NTP server. NTP authentication ensures that time synchronization messages are from a trusted source, preventing spoofed NTP packets that could cause time changes affecting logs, protocols, and security.

Answer

To encrypt NTP traffic

Answer

To rate-limit NTP packets

Answer

To synchronize time across devices

Question 13

A service provider wants to deploy DDoS mitigation using BGP FlowSpec. Which two actions can FlowSpec rules specify? (Choose two.)

Accepted Answer

Redirect to a nexthop. FlowSpec actions include 'traffic-rate' (rate-limit), 'traffic-action' (drop), 'redirect', etc. The correct actions among the options are rate-limiting and dropping.

Answer

Advertise a static route

Answer

Log traffic

Answer

Set BGP community

Question 14

When implementing RPKI for BGP origin validation, which three states can a route be marked as? (Choose three.)

Accepted Answer

Invalid. RPKI validation results in three states: valid (matches a ROA), invalid (conflicts with a ROA), and not-found (no ROA exists). These states are used to influence BGP decision.

Answer

Trusted

Answer

Unknown

Question 15

A service provider is implementing security for BGP peering. Which two methods help prevent BGP route hijacking? (Choose two.)

Accepted Answer

RPKI origin validation. Prefix filtering (with prefix-lists and route-maps) ensures only expected prefixes are accepted from peers. RPKI validation provides cryptographic verification of origin AS. Both prevent hijacking.

Answer

BGP next-hop-self

Answer

BGP multipath

Answer

BGP GSHUT