5.2 Configure and Verify Infrastructure Security Features 350-401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator is troubleshooting why a newly applied extended ACL is blocking all traffic to a web server, even though the ACL contains a permit statement for HTTP traffic. The ACL is applied inbound on the interface facing the clients. The ACL entries are: 10 permit tcp any host 192.168.2.10 eq 80 20 deny ip any any Which additional configuration is most likely required to allow the web server to respond to clients?

   • AApply the ACL outbound on the same interface instead of inbound, because outbound ACLs automatically allow return traffic.
   • BAdd a permit statement for return traffic (e.g., permit tcp host 192.168.2.10 any established) because the ACL is applied inbound and will block return packets.
   • CVerify that the ACL is applied to the correct interface and direction, because the ACL as shown should allow HTTP requests and the implicit deny would only block other traffic, not the responses.
   • DAdd a permit statement for ICMP traffic, because the web server needs to send ICMP unreachable messages for proper communication.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does an increasing drop counter for a specific class in the CoPP policy indicate?

   • AThe router is forwarding traffic normally
   • BThe policy is permitting all traffic in that class
   • CThe policy is dropping traffic that matches that class, potentially indicating an attack or misconfiguration
   • DThe policy is not applied to the control plane
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A network administrator is concerned about a potential DDoS attack targeting the control plane of a core router. The administrator wants to implement a solution that rate-limits traffic destined to the router's CPU while allowing legitimate management and routing traffic. Which feature should the administrator configure?

   • AControl Plane Policing (CoPP)
   • BIP Source Guard
   • CDynamic ARP Inspection (DAI)
   • DPort Security
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network administrator notices that the CPU utilization on a core router spikes to 95% during a distributed denial-of-service (DDoS) attack. The attack traffic is targeting the router's own IP address with ICMP and TCP SYN packets. The administrator wants to protect the router's control plane without affecting transit traffic. Which solution should be implemented?

   • AEnable IP Source Guard on all access ports
   • BConfigure Control Plane Policing (CoPP) to rate-limit ICMP and TCP SYN packets destined to the router
   • CConfigure uRPF (Unicast Reverse Path Forwarding) on the WAN interface
   • DApply an ACL on all interfaces to block ICMP and TCP SYN packets
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator is implementing CoPP to protect the router's control plane from a potential DDoS attack. They want to allow normal routing protocol traffic (OSPF, BGP) but rate-limit other traffic to the control plane. Which configuration approach is correct?

   • AApply the policy map to the control plane in the output direction to limit traffic leaving the router.
   • BCreate a class map that matches OSPF and BGP traffic and set the police rate to a high value; create another class map that matches all other traffic and set the police rate to a low value.
   • CCreate a single class map that matches all traffic and apply a single police rate to all traffic.
   • DUse an ACL to permit OSPF and BGP traffic and deny all other traffic to the control plane.
   Reveal Solution Discussion Select an answer first