350-501 Security and Services Practice Test 5 — 15 Questions

Question 1

An SP is implementing BGP FlowSpec to mitigate DDoS. The FlowSpec rule should match traffic with destination port 80 and DSCP value 0. Which FlowSpec component is used to specify the destination port?

Accepted Answer

Type 3: Destination Port. FlowSpec defines traffic matching criteria using components like destination port (type 3), source port (type 2), etc. Destination port is type 3.

Answer

Type 2: Source Port

Answer

Type 4: ICMP Type

Answer

Type 1: Destination Prefix

Question 2

A service provider is hardening management plane access on IOS XR routers. Which TWO measures should be implemented to secure management access? (Choose two)

Accepted Answer

Implement AAA with TACACS+. Enabling SSH only and using AAA with TACACS+ are key management plane hardening steps. SNMPv3 with encryption is also important but not listed as an option.

Answer

Use SNMPv2c for monitoring

Answer

Enable Telnet for remote access

Answer

Disable password encryption

Question 3

Which TWO protocols are supported by a BNG (Broadband Network Gateway) for subscriber session establishment? (Choose two)

Accepted Answer

PPPoE. BNG supports PPPoE and IPoE (DHCP) for subscriber access. PPPoA is asynchronous transfer mode, not typically used in modern BNG.

Answer

IPSec

Answer

L2TP

Answer

PPPoA

Question 4

A service provider is implementing RPKI to validate BGP routes. Which THREE components are necessary for a complete RPKI deployment on routers? (Choose three)

Accepted Answer

RPKI cache server (Relying Party). RPKI requires three components: Route Origin Authorization (ROA) records created by RIRs to authorize AS origins, an RPKI cache server (Relying Party) that collects ROAs and validates them, and the BGP Origin Validation feature on routers that uses the Relying Party's VRP data to filter invalid routes. The cache server communicates with routers via RTR protocol. Components like prefix-lists or local preference manipulation are not part of RPKI itself.

Answer

Prefix-list for filtering

Answer

BGP path manipulation using local preference

Question 5

A service provider router running IOS XR is configured with Control Plane Policing (CoPP) to protect the route processor. Which type of traffic is most commonly rate-limited using CoPP in the control plane?

Accepted Answer

BGP update messages. CoPP on IOS XR is used to classify and rate-limit control plane traffic such as routing protocols (BGP, OSPF, IS-IS) and management traffic (SSH, SNMP). Among the options, BGP updates are control plane traffic that can be rate-limited to protect the CPU.

Answer

Multicast data forwarding

Answer

MPLS label imposition

Answer

Layer 2 data plane traffic

Question 6

An SP network engineer is hardening management plane access on IOS XR routers. They require authentication, authorization, and accounting (AAA) with per-command authorization and role-based access control. Which combination should be used?

Accepted Answer

SSH with TACACS+ authentication and authorization, and task groups for role-based access. For per-command authorization and role-based access, TACACS+ is preferred over RADIUS. IOS XR uses task groups to define roles. SSH provides encrypted management access.

Answer

SSH with local authentication and privilege levels

Answer

Telnet with RADIUS authentication and authorization

Answer

SNMPv3 with RADIUS authentication

Question 7

A service provider wants to prevent IP spoofing attacks from customer edge devices connected to a PE router. The customer prefixes are known and asymmetric routing is not present. Which uRPF mode should be configured on the PE-CE interface?

Accepted Answer

Strict mode uRPF. Strict mode uRPF checks that the source IP address is reachable via the same interface the packet arrived on, and that the route points back to that interface. This is suitable when symmetric routing is guaranteed, as on PE-CE links in L3VPN.

Answer

No uRPF needed because BGP prefix filtering prevents spoofing

Answer

VRF-aware uRPF

Answer

Loose mode uRPF

Question 8

An SP detects a volumetric DDoS attack targeting a customer network. The SP uses Cisco's S/RTBH technique to drop attack traffic. Which action is performed by the edge routers upon receiving a BGP route with a specific community?

Accepted Answer

The edge router installs a /32 route pointing to a discard interface. S/RTBH works by advertising a /32 prefix (the victim's IP) with a special BGP community (e.g., NO_EXPORT) and a next-hop of the discard interface (e.g., Null0). Edge routers install the route pointing to Null0, dropping traffic to that IP.

Answer

The edge router applies a BGP FlowSpec rule to rate-limit the traffic

Answer

The edge router forwards the attack traffic to a scrubbing center

Answer

The edge router sends ICMP unreachable messages to the attacker

Question 9

A service provider wants to prevent BGP hijacking of its customer prefixes. The SP implements RPKI with BGP Origin Validation. When a route is received with an origin AS that does not match any ROA, what is the validation state?

Accepted Answer

Not-found. In RPKI, if no ROA exists for the prefix, the state is 'not-found'. If the origin AS matches a ROA, it's 'valid'; if it conflicts, it's 'invalid'.

Answer

Invalid

Answer

Valid

Answer

Unknown

Question 10

An SP engineer is configuring BGP Graceful Shutdown (GSHUT) for maintenance on a router. What does the GSHUT community do to the BGP best path selection process?

Accepted Answer

It sets the local preference to 0. BGP GSHUT uses a well-known community (0xFFFF0000) that lowers the local preference by 100 (to 0 by default) to make the routes less preferred, thus draining traffic gracefully.

Answer

It prepends the AS path

Answer

It removes the route from the BGP table

Answer

It increases the MED value by 100

Question 11

Which MPLS security best practice helps prevent label spoofing attacks where an attacker injects MPLS packets with a forged label stack to bypass ACLs?

Accepted Answer

Disabling TTL propagation on PE-CE interfaces. None of the provided options are the direct best practice to prevent label spoofing. The primary Cisco-recommended method is to disable MPLS on PE-CE interfaces or apply inbound label filtering to reject labeled packets from untrusted sources.

Answer

Enabling MPLS on all interfaces including CE-facing

Answer

Enabling TTL propagation on all PE routers

Answer

Using IP explicit null labels on all LSPs

Question 12

A BNG (Broadband Network Gateway) is used for subscriber management. Which protocol is typically used between the BNG and the subscriber's modem (CPE) for authentication and IP address assignment in a PPPoE environment?

Accepted Answer

PPPoE with PPP authentication and IPCP. In a PPPoE environment, the BNG acts as the access concentrator. Authentication is performed using PAP or CHAP, and IP address assignment is done via IPCP (IP Control Protocol). The BNG also uses RADIUS for centralized authentication but between BNG and CPE, PPPoE uses PPP for authentication and IPCP for IP address.

Answer

DHCP

Answer

RADIUS directly to CPE

Answer

L2TP

Question 13

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. SSH provides encrypted remote access, and SNMPv3 with encryption and authentication secures monitoring. Telnet and SNMPv2c are insecure. Disabling all access is not practical.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access

Question 14

An SP is deploying DDoS mitigation using BGP FlowSpec. Which THREE types of actions can be encoded in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop traffic. FlowSpec rules can include traffic rate-limiting, redirecting to a VRF (e.g., for scrubbing), and dropping traffic. Setting a BGP community is not a FlowSpec action; community is for routing policy. IPsec encryption is not a FlowSpec action.

Answer

Set a BGP community

Answer

Encrypt traffic with IPsec

Question 15

An SP engineer is configuring NTP authentication on IOS XR routers in the management plane. Which TWO statements about NTP authentication are correct? (Choose two.)

Accepted Answer

NTP authentication uses pre-shared keys to authenticate time sources. NTP authentication uses a symmetric key (MD5 or SHA) to authenticate NTP packets. The key must be trusted on the client. NTP authentication does not encrypt packets; it only provides integrity. Multiple keys can be configured.

Answer

NTP authentication is only supported on IOS XR, not on classic IOS

Answer

Only one NTP authentication key can be configured on a router

Answer

NTP authentication encrypts the NTP packets to ensure confidentiality