1.6 Describe Management Plane Security 350-501 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of securing management plane access, what is the role of the authorization component of AAA?

   • ATo encrypt the management session to prevent eavesdropping
   • BTo determine what commands and actions a user is permitted to perform after authentication
   • CTo record and log the actions performed by the user for audit purposes
   • DTo verify the identity of the user attempting to access the device
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When securing a REST API used for management plane configuration, which combination of mechanisms provides both confidentiality and access control?

   • ATLS encryption and OAuth 2.0 authentication/authorization
   • BBasic authentication and rate limiting
   • CRate limiting and IP allowlisting
   • DAPI keys and TLS encryption
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A service provider is experiencing a DDoS attack targeting the management plane of its edge routers. The attack consists of a flood of TCP SYN packets to the routers' management IP addresses. The engineer needs to mitigate the attack while ensuring that legitimate management traffic from the NOC is still able to reach the routers. Which mitigation strategy should be applied?

   • AApply a standard ACL on the edge routers that blocks all TCP traffic from the internet to the management IP addresses.
   • BEnable traceback on the management plane to identify the attack source and then manually block each source IP.
   • CDisable the management plane on the edge routers until the attack subsides.
   • DDeploy a control plane policer that limits the rate of SYN packets to the management IP addresses.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A service provider is deploying a REST API to allow partners to automate the provisioning of Layer 3 VPNs. The API must ensure that each partner can only manage their own VPNs, and all API calls must be encrypted. Which combination of mechanisms should be implemented?

   • AOAuth 2.0 with scoped access tokens and TLS.
   • BBasic authentication with a common username and password.
   • CA shared API key for all partners and TLS.
   • DTACACS+ for authentication and per-command authorization.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A service provider is experiencing a DDoS attack that is targeting the management plane of its edge routers. The attack uses a mix of SYN floods and malformed SNMP packets. The provider has a limited budget and cannot deploy new hardware. The NOC requires that legitimate SNMP polling from the NMS must continue, and the provider must be able to identify the source of the attack for legal action. Which strategy best meets these constraints?

   • AUse RTBH to drop all traffic to the management network
   • BImplement control-plane policing to rate-limit SYN and SNMP packets, and use traceback to identify the attack source
   • CDeploy a dedicated DDoS mitigation appliance in front of the management network
   • DDisable SNMP and SSH on all routers until the attack subsides
   Reveal Solution Discussion Select an answer first