5.2 Configure and Verify Infrastructure Security Features 350-401 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which command provides statistics on packets dropped by a Control Plane Policing policy?

   • Ashow running-config
   • Bshow control-plane
   • Cshow access-lists
   • Dshow policy-map control-plane
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A service provider router is experiencing high CPU utilization due to excessive ICMP traffic destined to the router's control plane. The network engineer wants to implement CoPP to limit ICMP traffic while ensuring that OSPF hellos and BGP keepalives are not affected. Which CoPP configuration approach is the most appropriate?

   • ACreate a single class map that matches all control plane traffic and apply a police rate of 1 Mbps.
   • BApply CoPP to the control plane in the output direction to limit ICMP traffic leaving the router.
   • CCreate a class map that matches ICMP traffic and apply a police rate of 100 kbps; create another class map that matches OSPF and BGP traffic and apply a police rate of 1 Mbps.
   • DUse an ACL to permit OSPF and BGP traffic and deny all other traffic to the control plane.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What happens to traffic that does not match any entry in an access control list?

   • AIt is forwarded to the next hop for further processing
   • BIt is permitted because the ACL has no explicit permit for it
   • CIt is logged and then permitted
   • DIt is denied by the implicit deny at the end of the ACL
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A network administrator is implementing CoPP on a router that carries both management traffic (SSH, SNMP) and routing protocols (OSPF, EIGRP). The administrator wants to ensure that management traffic is always available, but also wants to prevent a DDoS attack from overwhelming the control plane. Which CoPP policy design is most effective?

   • ACreate separate class maps for management traffic and routing protocols, and assign higher police rates to management traffic
   • BCreate a single class map for all control plane traffic and police it to a single rate
   • CCreate a class map for routing protocols and police it, leaving management traffic unclassified
   • DCreate a class map for management traffic and drop all other traffic
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which show command displays the contents of an access list named BLOCK_HTTP?

   • Ashow running-config | include BLOCK_HTTP
   • Bshow access-lists BLOCK_HTTP
   • Cshow ip interface BLOCK_HTTP
   • Dshow ip access-list BLOCK_HTTP
   Reveal Solution Discussion Select an answer first