350-501 Security and Services Practice Test 3 — 15 Questions

Question 1

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

Accepted Answer

To identify applications regardless of port. The primary purpose of Deep Packet Inspection (DPI) in a service provider network is to identify applications regardless of port. DPI analyzes packet payloads beyond just headers, allowing it to classify traffic based on application signatures, even if they use non-standard ports or encryption. This enables service providers to apply QoS, security policies, and traffic shaping based on application type.

Answer

To block all traffic from a specific IP

Answer

To classify traffic based on port numbers only

Answer

To encrypt traffic

Question 2

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

Accepted Answer

A pre-shared key configured on both NTP client and server. NTP authentication on IOS XR uses symmetric key authentication, which requires a pre-shared key configured identically on both the NTP client and server. The key is referenced by a key number, and the client must mark the server as trusted using the `ntp trusted-key` command. Without matching keys, the client rejects the server's time updates.

Answer

SNMPv3 for secure time exchange

Answer

A digital certificate from a CA

Answer

An ACL permitting NTP traffic

Question 3

An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)

Accepted Answer

Implement AAA with TACACS+. Option A (Implement AAA with TACACS+) is correct because AAA centralizes authentication, authorization, and accounting for management access, and TACACS+ provides per-command authorization and encrypted (full-payload) communication, which is the recommended approach for securing administrative access to IOS XR routers. Option D (Use SSH for remote access) is correct because SSH encrypts the management session and provides strong authentication, replacing insecure cleartext protocols like Telnet for CLI access. Option B is wrong because Telnet transmits credentials and session data in cleartext, making it unsuitable for secure management. Option C is wrong because SNMPv2c uses community strings sent in cleartext and lacks the cryptographic security of SNMPv3, so it does not secure management access. Option E is wrong because disabling all logging removes audit trails and event visibility, which weakens security monitoring rather than improving it.

Answer

Enable Telnet for remote access

Answer

Use SNMPv2c for monitoring

Answer

Disable all logging

Question 4

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

Accepted Answer

Implement CoPP by creating a class-map for ICMP and applying a police rate under a control-plane policy-map. CoPP (Control Plane Policing) on IOS XR allows the administrator to classify control-plane traffic (such as ICMP destined to the router) using a class-map and then apply a police rate in a policy-map attached to the control plane. This rate-limits ICMP without dropping all ICMP, protecting the route processor CPU from exhaustion while still permitting legitimate management traffic. It is the standard, granular mechanism for protecting the control plane on IOS XR.

Answer

Enable MPLS traffic engineering to reroute ICMP

Answer

Use BGP prefix filtering to block ICMP routes

Answer

Configure an ACL to deny ICMP on all interfaces

Question 5

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

Accepted Answer

SSH with AAA via TACACS+ and role-based access using task groups. SSH provides encrypted transport for management sessions, TACACS+ provides centralized AAA with per-command authorization, and IOS XR task groups enable granular role-based access control (RBAC) that limits which commands each user can run. Together these form the strongest management-plane hardening combination on IOS XR. TACACS+ is preferred over RADIUS for device administration because it separates authentication, authorization, and accounting and supports command-level authorization.

Answer

Telnet with local passwords and SNMPv2c read-only

Answer

HTTP with AAA via RADIUS

Answer

SSH with local authentication only

Question 6

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Accepted Answer

Loose mode. Loose mode uRPF checks only that the source address exists in the routing table (FIB), not that the packet arrived on the interface the router would use to reach that source. Because the multihomed customer uses asymmetric routing, return traffic may arrive on a different interface than the one the router would select, so strict mode would drop legitimate packets. Loose mode therefore prevents obvious spoofing (unknown source prefixes) while tolerating asymmetric paths.

Answer

Strict mode

Answer

No uRPF

Answer

Strict mode with allow-default option

Question 7

In an MPLS L3VPN, how can a service provider prevent a CE device from learning the MPLS label stack and potentially spoofing labels?

Accepted Answer

Disable MPLS on the PE-CE interface. Disabling MPLS on the PE-CE interface prevents the CE from receiving or sending labeled packets, so the CE never sees the MPLS label stack and cannot spoof labels into the provider core. The PE still runs MPLS on its core-facing interfaces and performs label imposition/ disposition at the edge, keeping the label domain entirely within the provider network. This is the standard security practice for untrusted CE devices.

Answer

Use LDP authentication between PE and CE

Answer

Configure MPLS VPN route-target filtering

Answer

Enable TTL propagation on the PE-CE link

Question 8

An SP implements Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. For legal compliance, what additional function must be enabled to log subscriber IP-port mappings?

Accepted Answer

NAT logging (syslog or other). Carrier-Grade NAT (CGNAT) is used by service providers to conserve public IPv4 addresses by multiplexing many subscribers behind a small pool of public IPs. For legal compliance (e.g., lawful intercept, abuse investigation), the SP must be able to map a public IP and port back to the specific subscriber at a given time. NAT logging (via syslog or other mechanisms) records these IP-port-subscriber bindings and is the required additional function.

Answer

Port allocation algorithm (deterministic or random)

Answer

Application Layer Gateway (ALG) support

Answer

Deep Packet Inspection (DPI)

Question 9

A service provider uses BGP FlowSpec (RFC 8955) to mitigate DDoS attacks. Which component in the network is responsible for originating the FlowSpec rules and distributing them to routers?

Accepted Answer

A FlowSpec controller (e.g., router with policy or SDN controller). BGP FlowSpec rules are originated by a FlowSpec controller—either a router configured with flow-spec policy or an SDN/centralized controller—which encodes match conditions (e.g., source/dest IP, ports, protocols) and actions (drop, rate-limit, redirect) into BGP FlowSpec NLRI. The controller then distributes these rules via iBGP/eBGP to routers across the network, which install them as flow-based filters. This separation of detection/orchestration from enforcement is the standard architecture in RFC 8955 deployments.

Answer

The trigger router used for RTBH

Answer

The victim's CE router

Answer

An anomaly detection system like Cisco Peakflow

Question 10

To secure NTP in a service provider network, which feature should be enabled on IOS XR routers to prevent time synchronization with unauthorized NTP servers?

Accepted Answer

NTP authentication with MD5 keys. NTP authentication with MD5 (or SHA) keys ensures that a router only synchronizes with NTP servers that possess the correct symmetric key, preventing spoofed or rogue time sources. On IOS XR, you configure ntp authentication-key and ntp trusted-key, then associate the key with the server via the key keyword. This directly addresses the requirement to prevent synchronization with unauthorized NTP servers.

Answer

NTP symmetric active mode

Answer

NTP broadcast client mode

Answer

NTP access group with read-only community

Question 11

A service provider is deploying uRPF on peering edges with multiple upstream providers and asymmetric routing. Which two statements are true about uRPF operation in this scenario? (Choose two.)

Accepted Answer

Loose mode may drop traffic if no route to the source exists in the FIB. Option A is correct because loose-mode uRPF only verifies that a route back to the source address exists in the FIB, so if the source prefix is missing from the routing table the packet is dropped even though the return path need not match the incoming interface. Option D is correct because uRPF is supported for both IPv4 (ip verify unicast source reachable-via) and IPv6 (ipv6 verify unicast source reachable-via) on Cisco platforms, making it usable in dual-stack peering designs. Option B is wrong because uRPF depends on Cisco Express Forwarding and the FIB, so CEF must be enabled, not disabled. Option C is wrong because loose mode checks for a specific route to the source in the FIB; a default route alone does not satisfy the check unless it is the matching route. Option E is wrong because strict mode requires the return path to use the same interface the packet arrived on, which breaks in asymmetric routing, so loose mode is preferred there.

Answer

uRPF requires CEF to be disabled

Answer

Loose mode requires a default route to function

Answer

Strict mode is preferred for asymmetric routing environments

Question 12

A service provider is implementing BGP security using RPKI. Which three components are required for RPKI-based BGP origin validation? (Choose three.)

Accepted Answer

Route Origin Authorization (ROA). Option A, Route Origin Authorization (ROA), is correct because a ROA is the signed object published in the RPKI that binds a specific prefix to an authorized origin AS and maximum prefix length, which is exactly the data origin validation checks against. Option C, Relying Party (cache server), is correct because the RP software validates the RPKI repository's signed objects and builds a local cache of validated ROA payloads that routers can query. Option E, RPKI-to-Router (RTR) protocol, is correct because RTR is the standardized protocol (RFC 6810) used to transport validated prefix-origin data from the RP cache to the BGP router performing origin validation. Option B, BGPsec path validation, is not required because BGPsec secures the AS path itself and is a separate mechanism from RPKI-based origin validation. Option D, IS-IS routing protocol, is not required because IS-IS is an interior gateway protocol unrelated to RPKI origin validation.

Answer

BGPsec path validation

Answer

IS-IS routing protocol

Question 13

A service provider is implementing control plane protection (CoPP) on an IOS XR router. Which protocol should be classified and rate-limited to prevent excessive control plane load due to routing updates?

Accepted Answer

BGP. BGP is the routing protocol that generates the bulk of control-plane load on a service provider router, especially during convergence events, route flaps, or prefix leaks. Classifying and rate-limiting BGP (TCP/179) traffic with CoPP prevents excessive UPDATE processing from overwhelming the route processor. This is the standard CoPP design for SP edge routers.

Answer

ICMP

Answer

SNMP

Answer

SSH

Question 14

An engineer is hardening the management plane of an IOS XR router. Which combination is the most secure for remote administration?

Accepted Answer

SSH with TACACS+ authentication and authorization. SSH provides encrypted remote access, and TACACS+ offers granular AAA control with encryption of all traffic, making it more secure than RADIUS (which encrypts only password) or local authentication.

Answer

HTTP with local authentication

Answer

Telnet with local authentication

Answer

SSH with RADIUS authentication

Question 15

A service provider wants to prevent IP spoofing at the customer edge by verifying that the source IP address of incoming packets is reachable via the interface they arrive on. Which uRPF mode should be used?

Accepted Answer

Strict mode. Strict uRPF checks that the source IP of an incoming packet is reachable via the exact same interface the packet arrived on, using the FIB. If the reverse path points to a different interface, the packet is dropped, which directly prevents spoofed source addresses at the customer edge. This is the intended mode when the SP knows the customer's legitimate prefix is only reachable through that specific link.

Answer

ACL-based filtering

Answer

Reverse path filtering disabled

Answer

Loose mode