350-501 Security and Services Practice Test 4 — 15 Questions

Question 1

A network operator wants to distribute traffic filtering rules to multiple routers dynamically during a DDoS attack. Which technology should be used?

Accepted Answer

BGP FlowSpec. BGP FlowSpec (RFC 5575) allows a network operator to distribute flow specification rules — matching on source/destination prefix, protocol, port, packet length, and other fields — along with actions such as drop, rate-limit, or redirect, to multiple routers via BGP. This makes it ideal for dynamically propagating DDoS traffic filtering rules to many routers at once during an attack.

Answer

uRPF

Answer

S/RTBH

Answer

ACLs

Question 2

Which feature is used to validate that a BGP route origin is authorized by the prefix owner?

Accepted Answer

RPKI Origin Validation. RPKI (Resource Public Key Infrastructure) Origin Validation uses cryptographically signed Route Origin Authorizations (ROAs) to prove that an Autonomous System is authorized to originate a given prefix. Routers configured with RPKI validate BGP announcements against the ROA database and mark routes as Valid, Invalid, or NotFound. This directly answers the question of whether a route origin is authorized by the prefix owner.

Answer

BGP prefix filtering

Answer

BGP community filtering

Answer

BGP GSHUT

Question 3

A service provider is preparing for maintenance on a BGP-speaking router. To minimize packet loss, they want to signal to neighbors that the session is being shut down gracefully. Which BGP feature should be used?

Accepted Answer

BGP GSHUT. BGP Graceful Shutdown (GSHUT) uses a well-known community (GRACEFUL_SHUTDOWN) to inform peers to lower the local preference, draining traffic before session termination.

Answer

BGP Route Refresh

Answer

BGP Multipath

Answer

BGP Fast External Failover

Question 4

Which protocol is used by a BNG to authenticate and authorize subscribers?

Accepted Answer

RADIUS. RADIUS (Remote Authentication Dial-In User Service) is the standard AAA protocol used by Broadband Network Gateways (BNGs) to authenticate and authorize subscribers, typically via PPPoE or IPoE sessions. The BNG acts as a RADIUS client, sending Access-Request messages to a RADIUS server that returns Access-Accept with attributes such as Framed-IP-Address, Session-Timeout, and QoS profiles. This is the canonical deployment in carrier broadband networks.

Answer

DIAMETER

Answer

LDAP

Answer

TACACS+

Question 5

A service provider implements CGNAT to conserve IPv4 addresses. Which feature is required to ensure that application-level protocols such as SIP or FTP function correctly?

Accepted Answer

ALG support. CGNAT translates many private IPv4 addresses to a single public address, which breaks application-layer protocols like SIP and FTP that embed IP addresses and port numbers inside the payload. ALG (Application Layer Gateway) support inspects and rewrites those embedded addresses/ports so the protocols continue to function through NAT. Without an ALG, SIP signaling and FTP data channels would reference unreachable private addresses.

Answer

Port block allocation

Answer

Logging

Answer

Session limits

Question 6

Which IOS XR feature allows an administrator to grant specific commands to a user based on their role, using task groups?

Accepted Answer

Role-based access control (RBAC) with task groups. IOS XR's role-based access control (RBAC) uses task groups to bundle specific CLI commands and permissions, which are then assigned to user groups and users. This lets an administrator grant granular command-level access — for example, allowing a NOC user to run 'show' commands but not 'configure' — without giving full administrative rights. Task groups are the mechanism that maps roles to permitted tasks.

Answer

SNMPv3

Answer

IP access lists

Answer

AAA with RADIUS

Question 7

What is the purpose of NTP authentication in a service provider network?

Accepted Answer

To verify the identity of the NTP server. NTP authentication (RFC 5905) uses symmetric key cryptography (MD5, SHA-1, or SHA-256) to verify that time updates come from a trusted NTP server. Its purpose is to prevent an attacker from spoofing NTP packets and injecting false time, which could disrupt logging, certificates, and routing protocols. It authenticates the source, not the content's confidentiality.

Answer

To encrypt NTP traffic

Answer

To rate-limit NTP packets

Answer

To synchronize time across devices

Question 8

A service provider wants to deploy DDoS mitigation using BGP FlowSpec. Which two actions can FlowSpec rules specify? (Choose two.)

Accepted Answer

Redirect to a nexthop. Option C (Redirect to a nexthop) is correct because BGP FlowSpec defines traffic-action rules that can include a redirect action, which sends matching flows to a specified next-hop (e.g., a scrubbing center) using the redirect-to-IP extended community. Option E (Rate-limit traffic) is correct because FlowSpec supports a traffic-rate action that applies a policer/rate-limit to matching flows, expressed in bytes per second, which is a core DDoS mitigation capability. Options A, B, and D are not FlowSpec rule actions: advertising a static route is standard BGP routing rather than a FlowSpec component, logging traffic is not a defined FlowSpec traffic-action, and setting a BGP community is a routing attribute manipulation rather than a FlowSpec action (FlowSpec uses extended communities to encode actions, but 'set BGP community' as such is not a FlowSpec rule action).

Answer

Advertise a static route

Answer

Log traffic

Answer

Set BGP community

Question 9

When implementing RPKI for BGP origin validation, which three states can a route be marked as? (Choose three.)

Accepted Answer

Invalid. In RPKI-based BGP origin validation (RFC 6811), a route prefix/origin pair is compared against the validated ROA payload and assigned exactly one of three validation states. Option A, Invalid, is correct because it is the state assigned when a covering ROA exists but the route's origin AS does not match any of the ROA's authorized ASNs (or the prefix length exceeds the ROA's maxLength). Option C, Not-found, is correct because it is the state when no ROA covers the prefix at all, meaning the validator has no data to confirm or deny the origin (often treated as 'unknown' in policy but formally named NotFound). Option E, Valid, is correct because it is the state when at least one covering ROA exists and the route's origin AS and prefix length match the ROA's authorized parameters. Option B, Trusted, is not a BGP origin validation state; it belongs to other trust models (e.g., route origin authorization trust anchors or BGPsec path validation concepts), not the RFC 6811 origin validation tri-state. Option D, Unknown, is not the formal state name in origin validation; the correct term for 'no ROA covers this prefix' is Not-found, so Unknown is a distractor.

Answer

Trusted

Answer

Unknown

Question 10

A service provider is implementing security for BGP peering. Which two methods help prevent BGP route hijacking? (Choose two.)

Accepted Answer

RPKI origin validation. RPKI origin validation (C) is correct because it cryptographically binds a prefix to an authorized origin AS via signed ROAs, letting a router mark a BGP announcement as Valid, Invalid, or NotFound and reject routes whose origin AS does not match the ROA, which directly thwarts origin hijacking. BGP prefix filtering (D) is correct because inbound/outbound prefix lists and filters limit which prefixes a peer may advertise or accept, so a hijacker cannot inject unauthorized or more-specific prefixes into the table. BGP next-hop-self (A) only rewrites the NEXT_HOP attribute for iBGP-learned routes and has no effect on route origin legitimacy. BGP multipath (B) merely allows installation of multiple equal-cost paths and can even worsen hijacking exposure by accepting alternate paths. BGP GSHUT (E) is the graceful shutdown community (65535:0) used to deprefer a path during maintenance, not to validate or filter route origins.

Answer

BGP next-hop-self

Answer

BGP multipath

Answer

BGP GSHUT

Question 11

An SP engineer is hardening management plane access on IOS XR routers. They want to enforce role-based access control using task groups. Which AAA protocol is required to support attribute-based authorization on IOS XR?

Accepted Answer

TACACS+. TACACS+ is required for attribute-based authorization on IOS XR because it separates authentication, authorization, and accounting (AAA) and supports per-command authorization with custom attributes. IOS XR uses TACACS+ to send task IDs and task group information in authorization requests, allowing the AAA server to return specific privilege levels or task permissions. RADIUS combines authentication and authorization and does not support the granular, attribute-based control needed for task groups. Thus, TACACS+ is the correct choice for enforcing role-based access control with task groups.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 12

An engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a provider edge (PE) router to mitigate IP spoofing. The customer-facing interface has a single static default route. Which uRPF mode should be used to provide anti-spoofing without causing false drops?

Accepted Answer

Loose mode. Loose mode uRPF checks that the source IP of a packet has a route in the FIB (any route, not necessarily via the receiving interface). Since the customer-facing interface has only a static default route, strict mode would drop legitimate traffic whose source is reachable via other paths. Loose mode provides anti-spoofing by ensuring the source is at least routable, without requiring the return path to match the ingress interface.

Answer

VRF mode

Answer

Strict mode

Answer

Feasible mode

Question 13

An SP is deploying BGP FlowSpec (RFC 8955) to distribute traffic filtering rules. Which component is responsible for disseminating FlowSpec rules to routers in the network?

Accepted Answer

MP-BGP. BGP FlowSpec uses a separate BGP address family (AFI 1, SAFI 133) to carry flow specifications. The rules are encoded as BGP NLRIs and distributed via BGP sessions.

Answer

OSPF

Answer

PIM

Answer

LDP

Question 14

A service provider wants to prevent BGP hijacking by validating the origin AS of received routes. They deploy RPKI with Route Origin Authorizations (ROAs). When a router receives a prefix with an origin AS that matches the ROA, what is the BGP Origin Validation state?

Accepted Answer

Valid. If the prefix and origin AS match a ROA exactly, the validation state is 'valid'. If no ROA is found, it's 'not-found'. If there is a mismatch, it's 'invalid'.

Answer

Invalid

Answer

Unknown

Answer

Not-found

Question 15

An engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. Which BGP attribute is set to trigger the graceful shutdown behavior?

Accepted Answer

Community GRACEFUL_SHUTDOWN. BGP GSHUT uses a specific community (GRACEFUL_SHUTDOWN, value 65535:0) to signal peers that the session is being gracefully shut down, causing them to depreference the routes.

Answer

MED to maximum

Answer

AS_PATH prepend

Answer

Local preference to 0