1.5 Configure and Verify Control Plan Security 350-501 Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which configuration is used to filter label allocation in LDP on Cisco IOS XR?

   • Ampls ldp label allocation filter prefix-list ALLOWED
   • Bmpls ldp forwarding-labels
   • Cmpls ldp neighbor 192.0.2.1 password cisco
   • Dmpls ldp discovery targeted-hello accept
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A service provider is experiencing a DDoS attack targeting a customer's IP prefix. The attack traffic is being sent to the customer's edge router, and the provider wants to mitigate the attack by propagating a filtering rule to all edge routers in the network. The provider also wants to ensure that the control plane of the edge routers is protected from the attack traffic. Which solution should the provider use?

   • AConfigure BGPsec on all edge routers to validate the source of the attack traffic.
   • BConfigure BGP Flowspec on the edge routers to propagate a rule that drops traffic to the victim prefix, and also apply CoPP to protect the control plane.
   • CApply an ACL on the customer's edge router to drop the attack traffic, and use LDP authentication to secure the MPLS control plane.
   • DUse BGP prefix suppression to stop advertising the victim prefix, and rely on the ISP's upstream filters to drop the attack.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A service provider is mitigating a DDoS attack using BGP Flowspec. The attack is targeting a customer's /24 prefix, and the provider has deployed a Flowspec rule to drop traffic to that prefix. However, the provider notices that the Flowspec rule is not being applied on some edge routers. The provider also wants to ensure that the control plane of the edge routers is protected during the attack. Which troubleshooting step should the provider take first?

   • ACheck the BGP TTL security settings on the edge routers to ensure that the Flowspec updates are not being dropped.
   • BVerify that the Flowspec rule is being advertised to all edge routers and that the routers have the Flowspec feature enabled.
   • CCheck the LPTS policers on the edge routers to ensure that they are not dropping the Flowspec packets.
   • DVerify that the customer's prefix is being advertised with BGPsec to ensure that the Flowspec rule is valid.
   Reveal Solution Discussion Select an answer first