2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A switch port in a public area has experienced a MAC flooding attack. The security team wants to prevent this from happening again while also being able to identify when a new device is connected. Which configuration should be used?

   • ADisable the port when a new device is connected.
   • BEnable port security with a maximum MAC address count and configure the violation mode to 'restrict' or 'shutdown', and enable logging for port-security violations.
   • CEnable DHCP snooping on the switch.
   • DEnable DAI on the switch.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A service provider router is experiencing intermittent OSPF neighbor flaps and high CPU utilization. The network team suspects that an attacker is sending excessive OSPF packets to the router. They want to protect the control plane without disrupting legitimate OSPF adjacency. Which configuration should be applied?

   • AApply an ACL on all interfaces that denies OSPF traffic from unknown source IPs.
   • BEnable IP Source Guard on all interfaces.
   • CDisable OSPF and use static routing.
   • DApply a CoPP policy that classifies OSPF traffic and rate-limits it to a safe threshold, while policing other control-plane traffic more aggressively.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which type of traffic does Control Plane Policing (CoPP) primarily protect?

   • ATraffic from the internet to a web server
   • BTraffic destined to the router's CPU, such as routing protocol updates
   • CTraffic between end-user devices on the same VLAN
   • DTraffic between different VLANs
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which protocol is used to encrypt data in transit over a site-to-site VPN?

   • ATLS
   • BIPsec
   • CSNMPv3
   • DSSH
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A network engineer is configuring CoPP on a router. The router's control plane receives routing protocol updates, SSH management traffic, and ICMP echo requests. The engineer wants to ensure that routing protocol updates are never dropped, SSH is rate-limited to prevent CPU exhaustion, and ICMP is limited to a low rate. Which CoPP policy should be applied?

   • AClassify SSH into a priority queue and routing protocols into a low-priority queue
   • BUse an ACL to block all ICMP traffic to the control plane
   • CClassify all control-plane traffic into a single queue with a moderate rate
   • DClassify routing protocols into a priority queue with a high rate, SSH into a normal queue with a moderate rate, and ICMP into a low-priority queue with a low rate
   Reveal Solution Discussion Select an answer first