350-501 Security and Services Practice Test 5 — 15 Questions

Question 1

An MPLS L3VPN service provider wants to prevent label spoofing attacks where a customer could inject MPLS labels to bypass ACLs. Which configuration practice should be implemented on PE-CE links?

Accepted Answer

Disable MPLS on PE-CE links. To prevent label spoofing attacks where a customer injects MPLS labels, the PE-CE link should not have MPLS enabled. Customer edge devices should not send labeled packets to the PE; disabling MPLS on PE-CE links ensures that any labeled packets from the customer are dropped or treated as IP, preventing label spoofing.

Answer

Enable MPLS TTL propagation to detect spoofing

Answer

Enable MPLS on PE-CE links with TTL propagation disabled

Answer

Use explicit null labels on PE-CE links

Question 2

An SP is implementing Carrier-Grade NAT (CGNAT) to conserve IPv4 addresses. Which feature must be enabled to support applications that embed IP addresses in the payload, such as SIP or FTP?

Accepted Answer

ALG (Application Layer Gateway). Application Layer Gateway (ALG) is the feature that inspects and rewrites IP addresses and port numbers embedded inside application payloads — such as SIP SDP bodies, FTP PORT/PASV commands, and H.323 — which CGNAT would otherwise break because it only translates IP headers. Without ALG, a SIP client behind CGNAT would advertise its private IP in the SDP, and the remote peer would be unable to route media back. ALG is therefore mandatory for CGNAT deployments supporting such protocols.

Answer

IPSec

Answer

Port forwarding

Answer

NAT traversal

Question 3

An engineer is configuring BGP prefix filtering on a provider edge router to prevent BGP hijacking. They want to allow only customer prefixes that are registered in the RIR database. What is the most effective method to automate this filtering?

Accepted Answer

RPKI Origin Validation using RTR. RPKI with Origin Validation uses ROAs to validate origin AS, which can be automated. IRR-based filtering with prefix-lists requires manual updates, while RPKI can be automated via RTR.

Answer

AS_PATH filtering based on customer AS

Answer

Manual prefix-lists based on IRR data

Answer

BGP community tagging with customer AS

Question 4

An SP is deploying Deep Packet Inspection (DPI) to classify traffic for QoS and security. Which DPI technique is used to identify applications regardless of port numbers?

Accepted Answer

Signature-based pattern matching. DPI inspects packet payloads using signatures, pattern matching, or behavioral analysis to identify applications, even if they use non-standard ports.

Answer

IP address filtering

Answer

Port-based classification

Answer

NetFlow analysis

Question 5

An engineer wants to secure NTP on IOS XR routers. Which configuration is required to prevent unauthorized time synchronization?

Accepted Answer

NTP authentication with a key. NTP authentication using a key ensures that only trusted NTP servers can update the router's clock, preventing spoofing attacks.

Answer

NTP broadcast mode

Answer

NTP access group with ACL

Answer

NTP version 4 only

Question 6

A service provider is using Cisco Peakflow for DDoS detection. Peakflow identifies anomalies based on network traffic telemetry. Which data collection method does Peakflow primarily use?

Accepted Answer

NetFlow/IPFIX. Cisco Peakflow (formerly Arbor Networks) is a NetFlow/IPFIX-based DDoS detection platform. It collects flow telemetry exported by routers and switches, then applies behavioral analysis and anomaly detection to identify volumetric and application-layer attacks. NetFlow/IPFIX provides the per-flow metadata (src/dst IP, ports, protocol, byte/packet counts) that Peakflow's algorithms require.

Answer

Syslog

Answer

SNMP polling

Answer

Packet capture

Question 7

An SP is implementing BGP FlowSpec to mitigate DDoS. The FlowSpec rule should match traffic with destination port 80 and DSCP value 0. Which FlowSpec component is used to specify the destination port?

Accepted Answer

Type 3: Destination Port. FlowSpec defines traffic matching criteria using components like destination port (type 3), source port (type 2), etc. Destination port is type 3.

Answer

Type 2: Source Port

Answer

Type 4: ICMP Type

Answer

Type 1: Destination Prefix

Question 8

A service provider is hardening management plane access on IOS XR routers. Which TWO measures should be implemented to secure management access? (Choose two)

Accepted Answer

Implement AAA with TACACS+. Option D is correct because implementing AAA with TACACS+ centralizes authentication, authorization, and accounting for management access, allowing per-command authorization and audit logging instead of relying on local passwords. Option E is correct because enabling SSH only disables insecure cleartext protocols such as Telnet and enforces encrypted, cryptographically authenticated management sessions on the router. The unmarked options do not belong: SNMPv2c (A) transmits community strings in cleartext and lacks strong security, Telnet (B) sends credentials and session data unencrypted, and disabling password encryption (C) would leave stored passwords in plaintext, weakening rather than hardening management plane access.

Answer

Use SNMPv2c for monitoring

Answer

Enable Telnet for remote access

Answer

Disable password encryption

Question 9

Which TWO protocols are supported by a BNG (Broadband Network Gateway) for subscriber session establishment? (Choose two)

Accepted Answer

PPPoE. PPPoE (A) is correct because a BNG terminates PPPoE sessions, using PPP negotiation (LCP, authentication via PAP/CHAP, IPCP) to establish and manage each subscriber session over Ethernet access networks. IPoE (DHCP) (B) is also correct because a BNG supports IPoE subscriber sessions where DHCP (with Option 82 or similar) is used to assign addresses and trigger session creation, often with per-subscriber policies. IPSec (C) is a security protocol suite for VPNs, not a subscriber session establishment method on a BNG. L2TP (D) is a tunneling protocol often used with LAC/LNS architectures, not a native BNG subscriber session type. PPPoA (E) is used over ATM access, not supported as a BNG subscriber session establishment protocol in this context.

Answer

IPSec

Answer

L2TP

Answer

PPPoA

Question 10

A service provider is implementing RPKI to validate BGP routes. Which THREE components are necessary for a complete RPKI deployment on routers? (Choose three)

Accepted Answer

RPKI cache server (Relying Party). A complete RPKI deployment requires a Relying Party (RP) cache server (option A), which fetches and validates signed objects from the global RPKI repositories and serves the resulting Validated ROA Payload (VRP) data to routers via the RPKI-to-Router (RTR) protocol on TCP port 323. Option B, the Route Origin Authorization (ROA), is essential because it is the signed object published in the RPKI that authorizes a specific AS to originate a given prefix with a defined maximum length, forming the basis for origin validation. Option E, the BGP Origin Validation feature on routers, is necessary because the router must compare each received BGP prefix's origin AS against the VRPs and assign a validation state of Valid, Invalid, or NotFound, which is what actually enables RPKI-based route filtering. Options C and D are not part of RPKI: a prefix-list is a manual ACL-based filtering mechanism that does not use RPKI validation state, and BGP local preference is a path-selection attribute used for traffic engineering, not for origin validation.

Answer

Prefix-list for filtering

Answer

BGP path manipulation using local preference

Question 11

A service provider router running IOS XR is configured with Control Plane Policing (CoPP) to protect the route processor. Which type of traffic is most commonly rate-limited using CoPP in the control plane?

Accepted Answer

BGP update messages. CoPP on IOS XR is designed to protect the route processor (RP) by policing traffic destined to the control plane — that is, traffic the router itself must process. BGP update messages are the classic example: a flapping peer or a route leak can flood the RP with UPDATEs, so rate-limiting BGP control traffic is a primary CoPP use case. This protects CPU and memory on the RP from being overwhelmed by routing protocol churn.

Answer

Multicast data forwarding

Answer

MPLS label imposition

Answer

Layer 2 data plane traffic

Question 12

An SP network engineer is hardening management plane access on IOS XR routers. They require authentication, authorization, and accounting (AAA) with per-command authorization and role-based access control. Which combination should be used?

Accepted Answer

SSH with TACACS+ authentication and authorization, and task groups for role-based access. TACACS+ provides separate authentication, authorization, and accounting, and supports per-command authorization, which is essential for granular control. Task groups in IOS XR enable role-based access control by defining sets of commands. Together, SSH with TACACS+ and task groups meet the requirements.

Answer

SSH with local authentication and privilege levels

Answer

Telnet with RADIUS authentication and authorization

Answer

SNMPv3 with RADIUS authentication

Question 13

A service provider wants to prevent IP spoofing attacks from customer edge devices connected to a PE router. The customer prefixes are known and asymmetric routing is not present. Which uRPF mode should be configured on the PE-CE interface?

Accepted Answer

Strict mode uRPF. Strict mode uRPF checks that the source IP of incoming packets is reachable via the same interface the packet arrived on. Since customer prefixes are known and asymmetric routing is not present, strict mode is appropriate and provides the strongest anti-spoofing protection. It ensures packets from customer prefixes only enter via the correct PE-CE interface.

Answer

No uRPF needed because BGP prefix filtering prevents spoofing

Answer

VRF-aware uRPF

Answer

Loose mode uRPF

Question 14

A BNG (Broadband Network Gateway) is used for subscriber management. Which protocol is typically used between the BNG and the subscriber's modem (CPE) for authentication and IP address assignment in a PPPoE environment?

Accepted Answer

PPPoE with PPP authentication and IPCP. In a PPPoE broadband environment, the subscriber CPE establishes a PPPoE session to the BNG, and within that PPP session, PPP authentication (PAP/CHAP) authenticates the subscriber while IPCP (IP Control Protocol) negotiates and assigns the IPv4 address. The BNG typically acts as the PPPoE server and may relay authentication to RADIUS, but the on-the-wire protocol between BNG and CPE is PPPoE carrying PPP/IPCP.

Answer

DHCP

Answer

RADIUS directly to CPE

Answer

L2TP

Question 15

A network engineer is configuring management plane security on IOS XR. Which TWO of the following are recommended practices? (Choose two.)

Accepted Answer

Use SNMPv3 with authentication and encryption. Option A is correct because SNMPv3 with authPriv provides both authentication (MD5/SHA) and encryption (DES/AES) of management traffic, protecting credentials and MIB data from eavesdropping and spoofing, which is the recommended SNMP configuration on IOS XR. Option E is correct because SSH (typically SSHv2) encrypts remote CLI sessions and is the recommended secure replacement for cleartext protocols like Telnet on the management plane. Option B is not recommended because SNMPv2c community strings are sent in cleartext and offer no authentication or privacy. Option C is impractical and unnecessary since secure remote management via SSH is available and preferred. Option D is wrong because Telnet transmits credentials and session data in cleartext and should be disabled in favor of SSH.

Answer

Use SNMPv2c with read-only community strings

Answer

Disable all remote access and use console only

Answer

Enable Telnet for remote access