hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation operates a private…
A multinational corporation operates a private MPLS VPN network connecting 50 branch offices to a central data center. The network uses BGP as the routing protocol within the VPN, with each branch announcing its internal prefixes to the data center routers. Over the past week, several branch offices have reported intermittent connectivity issues, with traffic being routed to incorrect destinations before recovering. Network logs show that during these incidents, the data center router receives unexpected BGP updates from one of the branch routers, advertising prefixes that belong to other branches. BGP sessions remain established without flaps. The security team is concerned that this could be a route leak or intentional hijack. The network engineer has verified that all BGP sessions are authenticated with MD5 and that RPKI validation is not currently deployed. Which course of action should the engineer take first to mitigate the issue?
⚠ Common exam trap
Test-takers frequently assume RPKI is the best first step because it is a modern security mechanism, but the question explicitly states it is not deployed and asks for the first action to mitigate the issue, making immediate inbound filtering the correct answer over a longer-term deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure inbound BGP prefix filtering on the data center routers.
The intermittent connectivity issues are caused by a branch router advertising prefixes that belong to other branches, which is a classic route leak or hijack scenario. Configuring inbound BGP prefix filtering on the data center routers is the immediate and most effective mitigation because it allows the engineer to explicitly define which prefixes are accepted from each BGP neighbor, preventing unauthorized or incorrect routes from being installed in the routing table. This approach does not require additional infrastructure or protocol changes and directly addresses the root cause of the traffic misdirection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure inbound BGP prefix filtering on the data center routers.
Why this is correct
Configuring inbound BGP prefix filtering on data center routers is a direct and immediate control mechanism to prevent route leaks. By explicitly defining which prefixes are acceptable to receive from branch routers, the data center routers can block any unauthorized or unexpected prefixes from being propagated further into the core network or other VPN segments. This ensures that only legitimate routes are learned and advertised, effectively containing the leak at its ingress point.
- ✗
Implement BGP Flowspec to rate-limit traffic to the affected prefixes.
Why it's wrong here
BGP Flowspec is designed to distribute traffic filtering rules, such as Access Control Lists (ACLs) or rate limits, to network devices based on various traffic characteristics (e.g., source/destination IP, port). While Flowspec can mitigate the *effects* of a route leak by controlling traffic destined for leaked prefixes, it does not prevent the *advertisement* of the unauthorized routes themselves. The problematic routes would still exist in the routing tables, even if traffic to them is shaped or dropped, meaning the underlying routing issue persists.
- ✗
Deploy RPKI validation across all routers.
Why it's wrong here
Resource Public Key Infrastructure (RPKI) provides a cryptographic framework to validate the origin of BGP routes, ensuring that an Autonomous System (AS) is authorized to advertise a specific IP prefix. While RPKI is a critical long-term solution for preventing prefix hijacking and improving BGP security, its deployment involves significant infrastructure setup, including Certificate Authorities (CAs), Route Origin Authorizations (ROAs), and validator software. It is a strategic, preventative measure, not an immediate tactical solution for an ongoing route leak, and its effectiveness relies on widespread adoption by all involved ASes.
- ✗
Increase the BGP hold timer on data center routers.
Why it's wrong here
The BGP hold timer defines the maximum time a BGP router will wait for a Keepalive or Update message from a peer before declaring the session down. Increasing this timer would merely prolong the time before a router detects a peer failure, potentially delaying the detection of a legitimate network issue or a BGP session flap. It has no bearing on the content of BGP Update messages, nor does it influence which prefixes are advertised or accepted, as its function is solely related to BGP session liveness, not route policy enforcement.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.