350-501 Security and Services Practice Test 4 — 15 Questions

Question 1

A service provider is configuring Control Plane Policing (CoPP) on IOS XR routers to protect the control plane. The engineer wants to rate-limit ICMP traffic destined to the router to 1 Mbps, while allowing BGP and OSPF traffic with higher limits. Which type of CoPP classification should be used for the ICMP traffic?

Accepted Answer

Control-plane class. CoPP on IOS XR uses different classes for classification. ICMP traffic destined to the router is classified as 'control-plane' (or 'management') traffic, not 'normal' or 'critical'. The 'control-plane' class is appropriate for ICMP.

Answer

Critical class

Answer

Management class

Answer

Normal priority class

Question 2

An SP engineer is hardening management plane access on IOS XR routers. They want to enforce role-based access control using task groups. Which AAA protocol is required to support attribute-based authorization on IOS XR?

Accepted Answer

TACACS+. TACACS+ supports per-command authorization and attribute-value pairs for role-based access, while RADIUS has limited authorization capabilities. IOS XR uses TACACS+ for task group-based authorization.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 3

An engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a provider edge (PE) router to mitigate IP spoofing. The customer-facing interface has a single static default route. Which uRPF mode should be used to provide anti-spoofing without causing false drops?

Accepted Answer

Loose mode. With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Answer

VRF mode

Answer

Strict mode

Answer

Feasible mode

Question 4

A service provider wants to mitigate DDoS attacks by blackholing traffic destined to a victim IP address. They plan to use Remotely Triggered Black Hole (RTBH) filtering. What BGP community is commonly used to trigger the blackhole route?

Accepted Answer

Community 666. RTBH works by advertising a /32 route with a specific community (often 666 or a locally defined one) that causes the router to forward traffic to a null interface. The well-known community for RTBH is often 666 or custom.

Answer

Community 100

Answer

Community no-export

Answer

Community local-AS

Question 5

An SP is deploying BGP FlowSpec (RFC 8955) to distribute traffic filtering rules. Which component is responsible for disseminating FlowSpec rules to routers in the network?

Accepted Answer

MP-BGP. BGP FlowSpec uses a separate BGP address family (AFI 1, SAFI 133) to carry flow specifications. The rules are encoded as BGP NLRIs and distributed via BGP sessions.

Answer

OSPF

Answer

PIM

Answer

LDP

Question 6

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 7

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0

Question 8

An MPLS L3VPN service provider wants to prevent label spoofing attacks where a customer could inject MPLS labels to bypass ACLs. Which configuration practice should be implemented on PE-CE links?

Accepted Answer

Disable MPLS on PE-CE links. To prevent label spoofing, MPLS should be disabled on PE-CE links so that customers cannot send labeled packets. Additionally, disabling TTL propagation prevents label stack visibility.

Answer

Enable MPLS TTL propagation to detect spoofing

Answer

Enable MPLS on PE-CE links with TTL propagation disabled

Answer

Use explicit null labels on PE-CE links

Question 9

A service provider is deploying a Broadband Network Gateway (BNG) for subscriber management. Which protocol is used by the BNG to authenticate subscribers via a RADIUS server?

Accepted Answer

RADIUS. The BNG acts as a RADIUS client and uses RADIUS protocol to send authentication requests (Access-Request) for PPPoE or IPoE sessions.

Answer

LDAP

Answer

Diameter

Answer

TACACS+

Question 10

An SP is implementing Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. Which feature must be enabled to support applications that embed IP addresses in the payload, such as SIP or FTP?

Accepted Answer

ALG (Application Layer Gateway). Application Layer Gateway (ALG) is required to inspect and modify payloads for protocols like SIP and FTP that carry IP addresses in the data stream.

Answer

IPSec

Answer

Port forwarding

Answer

NAT traversal

Question 11

An engineer is configuring BGP prefix filtering on a provider edge router to prevent BGP hijacking. They want to allow only customer prefixes that are registered in the RIR database. What is the most effective method to automate this filtering?

Accepted Answer

RPKI Origin Validation using RTR. RPKI with Origin Validation uses ROAs to validate origin AS, which can be automated. IRR-based filtering with prefix-lists requires manual updates, while RPKI can be automated via RTR.

Answer

AS_PATH filtering based on customer AS

Answer

Manual prefix-lists based on IRR data

Answer

BGP community tagging with customer AS

Question 12

An SP is deploying Deep Packet Inspection (DPI) to classify traffic for QoS and security. Which DPI technique is used to identify applications regardless of port numbers?

Accepted Answer

Signature-based pattern matching. DPI inspects packet payloads using signatures, pattern matching, or behavioral analysis to identify applications, even if they use non-standard ports.

Answer

IP address filtering

Answer

Port-based classification

Answer

NetFlow analysis

Question 13

An engineer wants to secure NTP on IOS XR routers. Which configuration is required to prevent unauthorized time synchronization?

Accepted Answer

NTP authentication with a key. NTP authentication using a key ensures that only trusted NTP servers can update the router's clock, preventing spoofing attacks.

Answer

NTP broadcast mode

Answer

NTP access group with ACL

Answer

NTP version 4 only

Question 14

A service provider is using Cisco Peakflow for DDoS detection. Peakflow identifies anomalies based on network traffic telemetry. Which data collection method does Peakflow primarily use?

Accepted Answer

NetFlow/IPFIX. Peakflow uses NetFlow (or IPFIX) data exported from routers to analyze traffic patterns and detect anomalies.

Answer

Syslog

Answer

SNMP polling

Answer

Packet capture

Question 15

An SP is implementing BGP FlowSpec to mitigate DDoS. The FlowSpec rule should match traffic with destination port 80 and DSCP value 0. Which FlowSpec component is used to specify the destination port?

Accepted Answer

Type 3: Destination Port. FlowSpec defines traffic matching criteria using components like destination port (type 3), source port (type 2), etc. Destination port is type 3.

Answer

Type 2: Source Port

Answer

Type 4: ICMP Type

Answer

Type 1: Destination Prefix