How should I use these Security and Services practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security and Services questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security and Services domain.

350-501 · topic practice

Security and Services practice questions

Practise Cisco SPCOR / CCNP Service Provider Core 350-501 Security and Services practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security and Services

Practice 10 questions Browse domain →

What the exam tests

What to know about Security and Services

Security and Services questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security and Services exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security and Services questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full OSPF breakdown →

A service provider is configuring Control Plane Policing (CoPP) on IOS XR routers to protect the control plane. The engineer wants to rate-limit ICMP traffic destined to the router to 1 Mbps, while allowing BGP and OSPF traffic with higher limits. Which type of CoPP classification should be used for the ICMP traffic?

Trap 1: Critical class

Incorrect: The Critical class is reserved for routing protocols such as BGP and OSPF, not for ICMP.

Trap 2: Management class

Incorrect: The Management class is used for out-of-band management traffic (e.g., SSH, SNMP), not for ICMP.

Trap 3: Control-plane class

Incorrect: There is no standard 'control-plane' class in IOS XR CoPP. The control plane is protected by all classes; ICMP falls under the Normal class.

Study all Security and Services common traps →

A
Critical class
Why wrong: Incorrect: The Critical class is reserved for routing protocols such as BGP and OSPF, not for ICMP.
B
Management class
Why wrong: Incorrect: The Management class is used for out-of-band management traffic (e.g., SSH, SNMP), not for ICMP.
C
Normal priority class
Correct: The Normal priority class is designed for traffic like ICMP, SSH, and SNMP. ICMP destined to the router should be classified as normal priority.
D
Control-plane class
Why wrong: Incorrect: There is no standard 'control-plane' class in IOS XR CoPP. The control plane is protected by all classes; ICMP falls under the Normal class.

Security and Services practice questions

What to know about Security and Services

Common Security and Services exam traps

Security and Services questions

A service provider is implementing BGP security measures to prevent route hijacking. Which TWO mechanisms directly validate the origin AS of BGP prefixes? (Choose two.)

A service provider wants to protect its routers from CPU overload caused by excessive traffic to the control plane. Which mechanism should be configured on IOS XR routers to classify and rate-limit management traffic?

An engineer is configuring management plane hardening on an IOS XR router. The requirement is to authenticate users against a central server and provide granular command authorization. Which protocol and feature should be used?

A service provider is deploying uRPF on customer-facing interfaces to prevent IP spoofing. The network has asymmetric routing due to multiple upstream connections. Which uRPF mode should be used?

During a DDoS attack, an SP uses Cisco Peakflow for detection and wants to drop attack traffic at the edge routers. They decide to use S/RTBH. Which action must be performed on the edge routers to trigger the black hole?

An SP wants to filter BGP prefixes received from a customer to prevent hijacking. Which two tools can be used together on the provider edge router to implement inbound prefix filtering?

An SP is implementing RPKI to validate BGP route origins. They have set up an RPKI cache and configured routers with the RPKI-to-Router (RTR) protocol. During validation, a route is received with an AS that does not match any ROA. What is the validation state?

A network engineer needs to perform maintenance on a BGP router without causing traffic loss. They plan to use BGP Graceful Shutdown (GSHUT). What does GSHUT do?

To prevent MPLS label spoofing in a Layer 3 VPN, which configuration should be applied on the PE-CE link?

A service provider is deploying a BNG for subscriber management. Which protocol is used to authenticate subscribers and assign IP addresses via the BNG?

An SP is implementing CGNAT to conserve IPv4 addresses. For legal compliance, they must log all NAT translations with timestamps and source/destination information. Which CGNAT feature should be enabled?

An SP uses DPI to classify traffic. What is the primary purpose of DPI in a service provider network?

An engineer is configuring NTP authentication on IOS XR routers to ensure secure time synchronization. What is required for NTP authentication to work?

An SP wants to secure management access to IOS XR routers. Which two measures should be implemented? (Choose two.)

An SP is implementing DDoS mitigation using BGP FlowSpec. Which three types of actions can be specified in a FlowSpec rule? (Choose three.)

An SP is deploying BGP security features. Which three mechanisms can be used to prevent BGP route hijacking? (Choose three.)

A service provider wants to protect its core routers from CPU exhaustion caused by excessive ICMP traffic. Which control plane protection mechanism on IOS XR would be most appropriate to rate-limit ICMP packets destined to the router?

An SP engineers want to restrict management access to their IOS XR routers. Which combination provides the most secure management plane hardening?

A service provider deploys uRPF on customer-facing interfaces to prevent IP spoofing. They have a multihomed customer with asymmetric routing. Which uRPF mode should be used to avoid dropping legitimate traffic?

Track your progress over time

Start a Security and Services only practice session

Related 350-501 topic practice pages

MPLS and Segment Routing practice questions

Automation and Quality of Services practice questions

Architecture practice questions

Networking practice questions

Security and Services practice questions

Automation and Quality of Service practice questions

Services practice questions

Automation and Assurance practice questions

350-501 fundamentals practice questions

350-501 scenario practice questions

350-501 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid