1.6 Describe Management Plane Security 350-501 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security mechanism is specifically used to prevent a REST API from being overwhelmed by a high volume of requests?

   • ARate limiting
   • BAuthentication (OAuth 2.0)
   • CAuthorization (RBAC)
   • DEncryption (TLS)
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does traceback help mitigate a DDoS attack that uses spoofed source addresses?

   • AIt rate-limits all traffic to the management plane to prevent the attack from reaching the router
   • BIt blocks the spoofed source IP addresses at the edge of the network
   • CIt identifies the actual ingress point of the attack traffic so that filtering can be applied closer to the source
   • DIt authenticates each packet to ensure it comes from a legitimate source
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A service provider is deploying a new management platform that uses a REST API for configuration changes and TACACS+ for device authentication. The security team wants to ensure that API calls are authorized based on the role of the caller and that all API interactions are logged for audit. Which two mechanisms should be combined?

   • AAPI keys for authorization and RADIUS accounting for API calls
   • BOAuth 2.0 scopes for API authorization and TACACS+ accounting for API calls
   • CBasic authentication for API calls and TACACS+ authentication for devices
   • DClient certificates for authorization and syslog for API logging
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A service provider's management plane is under a DDoS attack that is consuming all CPU on the routers. The attack is a mix of TCP SYN floods and malformed SNMP packets. The operator needs to protect the management plane while allowing legitimate SNMP polling from the NMS. Which mitigation strategy should be used?

   • ADisable SNMP and SSH on all routers until the attack stops
   • BUse IP Source Guard on all management interfaces
   • CApply control-plane policing to rate-limit SYN and SNMP packets, and use ACLs to allow only the NMS source IP for SNMP
   • DIncrease the SNMP timeout and enable TCP keepalives on the NMS
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A service provider exposes a management API that allows customers to query their own service status. The API has been targeted by a botnet that sends a high volume of requests, causing the API to become unresponsive. The provider wants to maintain availability for legitimate customers and also wants to prevent the API from being used as a vector to attack the management plane. Which two measures should be implemented?

   • AIncrease the API timeout and add more API servers
   • BUse a shared API key for all customers and rely on the ISP's DDoS protection
   • CDisable the API during the attack and use CLI for all management
   • DImplement per-client rate limiting and deploy a web application firewall (WAF) in front of the API
   Reveal Solution Discussion Select an answer first