350-501 Security and Services Practice Test 4 — 15 Questions

Question 1

When implementing RPKI for BGP origin validation, which three states can a route be marked as? (Choose three.)

Accepted Answer

Invalid. RPKI validation results in three states: valid (matches a ROA), invalid (conflicts with a ROA), and not-found (no ROA exists). These states are used to influence BGP decision.

Answer

Trusted

Answer

Unknown

Question 2

A service provider is implementing security for BGP peering. Which two methods help prevent BGP route hijacking? (Choose two.)

Accepted Answer

RPKI origin validation. Prefix filtering (with prefix-lists and route-maps) ensures only expected prefixes are accepted from peers. RPKI validation provides cryptographic verification of origin AS. Both prevent hijacking.

Answer

BGP next-hop-self

Answer

BGP multipath

Answer

BGP GSHUT

Question 3

An SP engineer is hardening management plane access on IOS XR routers. They want to enforce role-based access control using task groups. Which AAA protocol is required to support attribute-based authorization on IOS XR?

Accepted Answer

TACACS+. TACACS+ supports per-command authorization and attribute-value pairs for role-based access, while RADIUS has limited authorization capabilities. IOS XR uses TACACS+ for task group-based authorization.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 4

An engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a provider edge (PE) router to mitigate IP spoofing. The customer-facing interface has a single static default route. Which uRPF mode should be used to provide anti-spoofing without causing false drops?

Accepted Answer

Loose mode. With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Answer

VRF mode

Answer

Strict mode

Answer

Feasible mode

Question 5

A service provider wants to mitigate DDoS attacks by blackholing traffic destined to a victim IP address. They plan to use Remotely Triggered Black Hole (RTBH) filtering. What BGP community is commonly used to trigger the blackhole route?

Accepted Answer

Community 666. RTBH works by advertising a /32 route with a specific community (often 666 or a locally defined one) that causes the router to forward traffic to a null interface. The well-known community for RTBH is often 666 or custom.

Answer

Community 100

Answer

Community no-export

Answer

Community local-AS

Question 6

An SP is deploying BGP FlowSpec (RFC 8955) to distribute traffic filtering rules. Which component is responsible for disseminating FlowSpec rules to routers in the network?

Accepted Answer

MP-BGP. BGP FlowSpec uses a separate BGP address family (AFI 1, SAFI 133) to carry flow specifications. The rules are encoded as BGP NLRIs and distributed via BGP sessions.

Answer

OSPF

Answer

PIM

Answer

LDP

Question 7

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 8

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0

Question 9

An MPLS L3VPN service provider wants to prevent label spoofing attacks where a customer could inject MPLS labels to bypass ACLs. Which configuration practice should be implemented on PE-CE links?

Accepted Answer

Disable MPLS on PE-CE links. To prevent label spoofing, MPLS should be disabled on PE-CE links so that customers cannot send labeled packets. Additionally, disabling TTL propagation prevents label stack visibility.

Answer

Enable MPLS TTL propagation to detect spoofing

Answer

Enable MPLS on PE-CE links with TTL propagation disabled

Answer

Use explicit null labels on PE-CE links

Question 10

A service provider is deploying a Broadband Network Gateway (BNG) for subscriber management. Which protocol is used by the BNG to authenticate subscribers via a RADIUS server?

Accepted Answer

RADIUS. The BNG acts as a RADIUS client and uses RADIUS protocol to send authentication requests (Access-Request) for PPPoE or IPoE sessions.

Answer

LDAP

Answer

Diameter

Answer

TACACS+

Question 11

An SP is implementing Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. Which feature must be enabled to support applications that embed IP addresses in the payload, such as SIP or FTP?

Accepted Answer

ALG (Application Layer Gateway). Application Layer Gateway (ALG) is required to inspect and modify payloads for protocols like SIP and FTP that carry IP addresses in the data stream.

Answer

IPSec

Answer

Port forwarding

Answer

NAT traversal

Question 12

An engineer is configuring BGP prefix filtering on a provider edge router to prevent BGP hijacking. They want to allow only customer prefixes that are registered in the RIR database. What is the most effective method to automate this filtering?

Accepted Answer

RPKI Origin Validation using RTR. RPKI with Origin Validation uses ROAs to validate origin AS, which can be automated. IRR-based filtering with prefix-lists requires manual updates, while RPKI can be automated via RTR.

Answer

AS_PATH filtering based on customer AS

Answer

Manual prefix-lists based on IRR data

Answer

BGP community tagging with customer AS

Question 13

An SP is deploying Deep Packet Inspection (DPI) to classify traffic for QoS and security. Which DPI technique is used to identify applications regardless of port numbers?

Accepted Answer

Signature-based pattern matching. DPI inspects packet payloads using signatures, pattern matching, or behavioral analysis to identify applications, even if they use non-standard ports.

Answer

IP address filtering

Answer

Port-based classification

Answer

NetFlow analysis

Question 14

An engineer wants to secure NTP on IOS XR routers. Which configuration is required to prevent unauthorized time synchronization?

Accepted Answer

NTP authentication with a key. NTP authentication using a key ensures that only trusted NTP servers can update the router's clock, preventing spoofing attacks.

Answer

NTP broadcast mode

Answer

NTP access group with ACL

Answer

NTP version 4 only

Question 15

A service provider is using Cisco Peakflow for DDoS detection. Peakflow identifies anomalies based on network traffic telemetry. Which data collection method does Peakflow primarily use?

Accepted Answer

NetFlow/IPFIX. Peakflow uses NetFlow (or IPFIX) data exported from routers to analyze traffic patterns and detect anomalies.

Answer

Syslog

Answer

SNMP polling

Answer

Packet capture