1.5 Configure and Verify Control Plan Security 350-501 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A large service provider wants to protect its BGP infrastructure from route hijacking and path manipulation. The provider has already implemented BGP TTL security and TCP-AO on all eBGP sessions. The provider now wants to add a mechanism that can cryptographically verify the AS path of BGP routes, so that a route with a forged AS path can be detected and rejected. Which technology should the provider implement?

   • ABGPsec to sign and validate the AS path of BGP routes.
   • BBGP prefix suppression to reduce the number of routes that could be hijacked.
   • CBGP community filtering to reject routes with unknown communities.
   • DBGP Flowspec to filter routes with suspicious AS paths.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A service provider is upgrading core routers. The team wants to protect the control plane from LDP and BGP floods while ensuring that LDP sessions are authenticated. They also need to minimize the impact on legitimate traffic. Which configuration approach should be used?

   • AConfigure BGP TTL security on LDP sessions.
   • BConfigure a single CoPP class for all control plane traffic and enable LDP MD5 authentication.
   • CEnable LDP MD5 authentication only.
   • DConfigure CoPP with separate classes for LDP and BGP traffic, and enable LDP MD5 authentication.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer is configuring a new edge router that will peer with multiple customers using eBGP. The engineer wants to protect the router's control plane from excessive BGP traffic and also ensure that BGP sessions are authenticated. The router is running Cisco IOS XE. Which configuration should the engineer apply?

   • AConfigure BGP prefix suppression and enable TCP-AO authentication.
   • BConfigure CoPP to police BGP traffic and enable BGP MD5 authentication on all eBGP sessions.
   • CConfigure LPTS policers for BGP and enable BGP TTL security.
   • DUse an ACL to limit BGP traffic to the control plane and enable BGPsec.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What does LDP authentication provide?

   • AIntegrity and authentication of LDP messages using MD5
   • BEncryption of LDP messages
   • CFiltering of label advertisements based on prefix lists
   • DPrevention of LDP session establishment with unauthorized peers
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary use case for BGP Flowspec?

   • ATo encrypt BGP updates between peers
   • BTo validate the AS path of BGP routes
   • CTo propagate traffic filtering rules to mitigate DDoS attacks
   • DTo provide redundancy for BGP sessions
   Reveal Solution Discussion Select an answer first