350-501 Security and Services — Timed 15 Questions

Question 1

A service provider is configuring Control Plane Policing (CoPP) on IOS XR routers to protect the control plane. The engineer wants to rate-limit ICMP traffic destined to the router to 1 Mbps, while allowing BGP and OSPF traffic with higher limits. Which type of CoPP classification should be used for the ICMP traffic?

15 minute time limit — choose an answer to begin.

Accepted Answer

Normal priority class. In IOS XR CoPP, traffic is classified into priority classes: Critical (routing protocols like BGP/OSPF), Normal (management protocols like ICMP, SSH, SNMP), and Management (for out-of-band management). ICMP destined to the router is considered normal priority traffic, not critical or management. Therefore, the Normal priority class is appropriate for rate-limiting ICMP to 1 Mbps.

Answer

Critical class

Answer

Management class

Answer

Control-plane class

Question 2

A service provider is implementing BGP security measures to prevent route hijacking. Which TWO mechanisms directly validate the origin AS of BGP prefixes? (Choose two.)

Accepted Answer

RPKI Origin Validation using ROAs [CORRECT]. RPKI Origin Validation uses ROAs to verify that the origin AS is authorized to advertise a prefix. BGPSec cryptographically validates the entire AS path, including the origin AS. Both directly validate the origin AS. Prefix lists and route-maps filter based on attributes but do not validate origin. Community filtering manipulates communities but does not validate origin.

Answer

BGP prefix lists [wrong]

Answer

BGP route-maps with AS path matching [wrong]

Answer

BGP community-based filtering [wrong]

Question 3

A service provider wants to protect its routers from CPU overload caused by excessive traffic to the control plane. Which mechanism should be configured on IOS XR routers to classify and rate-limit management traffic?

Accepted Answer

CoPP (Control Plane Protection). CoPP (Control Plane Protection) on IOS XR uses class maps and policy maps to classify and rate-limit traffic destined to the control plane, protecting the router from CPU overload.

Answer

uRPF strict mode

Answer

BGP Flowspec

Answer

MPLS TTL propagation

Question 4

An engineer is configuring management plane hardening on an IOS XR router. The requirement is to authenticate users against a central server and provide granular command authorization. Which protocol and feature should be used?

Accepted Answer

TACACS+ with AAA and task groups. TACACS+ provides separate authentication, authorization, and accounting, and is commonly used with AAA for centralized management. Role-based access is achieved via task groups in IOS XR.

Answer

SSH with local username/password

Answer

SNMPv3 with ACLs

Answer

RADIUS with local authentication

Question 5

A service provider is deploying uRPF on customer-facing interfaces to prevent IP spoofing. The network has asymmetric routing due to multiple upstream connections. Which uRPF mode should be used?

Accepted Answer

Loose mode. Strict mode requires the source address to be reachable via the incoming interface, which fails with asymmetric routing. Loose mode only checks that the source address exists in the routing table, making it suitable for asymmetric paths.

Answer

Strict mode

Answer

uRPF with allow-default

Answer

uRPF is not recommended for asymmetric routing

Question 6

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

Accepted Answer

Advertise the victim's IP via BGP with a blackhole community to edge routers. Remotely Triggered Black Hole (RTBH) works by advertising a /32 route for the victim's IP address with a specific BGP community (e.g., NO_EXPORT) to a black hole next-hop (e.g., 192.0.2.1). The edge routers must be configured to trigger based on that community.

Answer

Use BGP Flowspec to create a rule that drops traffic to the victim

Answer

Configure a static null route and redistribute into IGP

Answer

Deploy IDMS traffic scrubbing inline

Question 7

An SP wants to filter BGP prefixes received from a customer to prevent hijacking. Which two tools can be used together on the provider edge router to implement inbound prefix filtering?

Accepted Answer

Prefix-list and route-map. Prefix-lists and route-maps are commonly used together to match and filter BGP prefixes. Prefix-lists define the prefixes, and route-maps apply them in BGP neighbor statements.

Answer

Distribute-list and ACL

Answer

RPKI and BGP community

Answer

AS-path access-list and community-list

Question 8

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

Accepted Answer

Not-found. If no ROA exists for the prefix, the state is 'not-found'. 'Invalid' means the AS does not match an existing ROA. 'Valid' means the AS matches.

Answer

Valid

Answer

Unknown

Answer

Invalid

Question 9

A network engineer needs to perform maintenance on a BGP router without causing traffic loss. They plan to use BGP Graceful Shutdown (GSHUT). What does GSHUT do?

Accepted Answer

It sets the local preference to a lower value to withdraw routes gracefully. BGP GSHUT adjusts the local preference of routes to make them less preferred, gracefully draining traffic before the session is shut down. This avoids packet loss.

Answer

It immediately terminates all BGP sessions

Answer

It uses BGP fast external failover to speed up convergence

Answer

It increases the MED to deprefer routes

Question 10

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

Accepted Answer

Disable MPLS on the PE-CE link. Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

Answer

Enable MPLS TTL propagation

Answer

Configure uRPF on the PE-CE link

Answer

Use BGP FlowSpec to filter labels

Question 11

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

Accepted Answer

RADIUS. BNG typically uses RADIUS for authentication, authorization, and accounting of subscribers. DHCP server functionality on BNG assigns IP addresses, but authentication is via RADIUS.

Answer

PPPoE only

Answer

LDAP

Answer

TACACS+

Question 12

An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?

Accepted Answer

NAT logging. CGNAT logging is required for compliance; it logs translation events including port allocation. ALG support handles application protocols but not logging. Port allocation is part of NAT, but logging is the specific feature for compliance.

Answer

Destination NAT

Answer

Port block allocation

Answer

ALG support

Question 13

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

Accepted Answer

To identify applications regardless of port. DPI inspects packet payloads to identify application-layer protocols (e.g., HTTP, BitTorrent), enabling traffic shaping, QoS, or security policies.

Answer

To block all traffic from a specific IP

Answer

To classify traffic based on port numbers only

Answer

To encrypt traffic

Question 14

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

Accepted Answer

A pre-shared key configured on both NTP client and server. NTP authentication uses a shared key (MD5 or SHA) configured on both client and server. The key must match for the client to accept time updates.

Answer

SNMPv3 for secure time exchange

Answer

A digital certificate from a CA

Answer

An ACL permitting NTP traffic

Question 15

An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)

Accepted Answer

Implement AAA with TACACS+. SSH provides encrypted remote access, and AAA with TACACS+ provides centralized authentication and authorization. SNMPv3 is also secure but not a management access method per se; the question asks for access measures.

Answer

Enable Telnet for remote access

Answer

Use SNMPv2c for monitoring

Answer

Disable all logging