350-501 Security and Services — Timed 10 Questions

Question 1

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

10 minute time limit — choose an answer to begin.

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. S/RTBH (Source-Based Remotely Triggered Black Hole) works by advertising the victim's IP address (or the attack source, in source-based mode) from the trigger router to edge routers with a specific BGP blackhole community (e.g., 65535:666 for RFC 7999). Edge routers match the community and install a null route, dropping all traffic to that prefix before it consumes backbone bandwidth.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 2

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. In RPKI validation, a route whose origin AS does not match any published ROA (Resource Origin Authorization) for that prefix is classified as 'Not-found' — meaning no ROA exists covering that prefix/AS pair. This is distinct from 'Invalid,' which means a ROA exists for the prefix but the origin AS or prefix length does not match.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 3

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

Answer

Enable MPLS TTL propagation

Answer

Configure uRPF on the PE-CE link

Answer

Use BGP FlowSpec to filter labels

Question 4

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

Accepted Answer

Drop (discard). Option A (Drop/discard) is correct because RFC 5575 defines the "traffic-drop" action, which instructs the receiving router to silently discard matching packets, making it the primary FlowSpec mitigation action for volumetric attacks. Option D (Traffic-rate/rate-limit) is correct because the "traffic-rate" action in bytes per second polices matching traffic to a specified rate, allowing an SP to throttle rather than fully drop attack flows. Option E (Redirect to a next-hop) is correct because the "redirect" action (with a Route Target extended community) steers matching traffic to a VRF or next-hop, typically used to send traffic to a scrubbing center. Option B (Sample) is not a FlowSpec action; packet sampling is handled by NetFlow/IPFIX or sFlow, not by BGP FlowSpec rules. Option C (Mark DSCP) is not a FlowSpec action either; DSCP marking is performed via QoS policy (e.g., MQC set dscp), not through FlowSpec's defined action set.

Answer

Sample (copy to analyzer)

Answer

Mark DSCP

Question 5

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

Accepted Answer

Prefix-lists to filter customer routes. Prefix-lists (A) are correct because they let the SP explicitly permit only the exact prefixes a customer is authorized to advertise, blocking any hijacked or more-specific prefix that falls outside the agreed allocation. RPKI with BGP Origin Validation (B) is correct because it cryptographically validates the origin AS in the AS_PATH against a signed ROA, causing invalid-origin announcements to be marked Invalid and rejected by a configured routing policy. Route-maps (D) are correct because they provide the policy engine that matches prefixes, origin AS, or other attributes and applies permit/deny actions, which is how prefix-lists, RPKI validation states, and other filters are actually enforced on BGP updates. AS-path prepending (C) is not a security mechanism; it only makes a path less preferred for traffic engineering and does not stop a hijacker from announcing a route. BGP communities (E) are just transitive tags used for policy signaling and do not by themselves prevent route hijacking.

Answer

AS-path prepending

Answer

BGP communities to tag routes

Question 6

During a DDoS attack, an SP wants to drop traffic destined to the victim IP at the network edge without affecting other traffic. Which technique should be used to achieve this by propagating a black-hole route from a trigger router to all edge routers?

Accepted Answer

S/RTBH (Remotely Triggered Black Hole) using BGP community. S/RTBH (Source/Remotely Triggered Black Hole) uses a trigger router to originate a black-hole route (typically a /32 for the victim) tagged with a specific BGP community (e.g., 65535:666) and propagates it to edge routers. Edge routers match the community and install a discard/next-hop null route for that prefix, dropping attack traffic at the network edge while leaving other traffic unaffected. This is the standard technique for destination-based black-holing during DDoS.

Answer

Cisco Peakflow to reroute traffic

Answer

BGP FlowSpec to distribute filtering rules

Answer

IDMS to scrub traffic

Question 7

A service provider uses BGP to exchange routes with customers. To prevent the customer from announcing prefixes they do not own (BGP hijacking), which tool should the provider apply on the customer-facing BGP session?

Accepted Answer

Prefix-list and route-map to filter incoming updates. Prefix-lists and route-maps are used to filter incoming BGP advertisements based on prefix and attributes. RPKI validates origin but requires ROA; BGP GSHUT is for maintenance; communities are for tagging.

Answer

BGP Graceful Shutdown

Answer

RPKI Origin Validation only

Answer

Set BGP community to tag customer routes

Question 8

An SP is implementing RPKI to validate BGP origin AS. After configuring RPKI-to-Router (RTR) and setting BGP origin validation, a route is marked as 'invalid'. What action does BGP default take for invalid routes?

Accepted Answer

The route is not installed in the routing table unless it is the only path. By default, BGP does not drop invalid routes; they are considered but with a lower preference (typically not installed in the routing table if a valid route exists). To drop invalid routes, explicit policy is needed.

Answer

The route is installed with a lower local preference

Answer

The route is treated as valid but with a lower preference

Answer

The route is dropped and not considered for best path selection

Question 9

A service provider wants to gracefully shut down a BGP session to a customer for maintenance without causing traffic loss. Which BGP feature should be used to signal the peer to reroute traffic before the session is brought down?

Accepted Answer

BGP Graceful Shutdown (GSHUT). BGP Graceful Shutdown (GSHUT) uses a well-known community or attribute to inform peers that the session is going down, allowing them to reroute traffic. BFD detects failures fast but does not signal; TTL propagation is for MPLS; route refresh is for soft reconfiguration.

Answer

BGP TTL Security

Answer

BGP Route Refresh

Answer

BGP Fast External Failover

Question 10

A service provider is deploying a BNG for subscriber management. Which protocol is typically used to authenticate subscribers and assign IP addresses in a PPPoE-based broadband network?

Accepted Answer

RADIUS. RADIUS is the standard protocol for authentication, authorization, and accounting (AAA) in BNG environments. DHCP assigns IP addresses, but authentication is via RADIUS. TACACS+ is for device administration; IPoE uses DHCP but not typically for authentication.

Answer

DHCP

Answer

IPoE

Answer

TACACS+