1.6 Describe Management Plane Security 350-501 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which statement correctly describes a difference between TACACS+ and RADIUS?

   • ATACACS+ is primarily used for network access, while RADIUS is used for device administration
   • BTACACS+ uses UDP, while RADIUS uses TCP
   • CTACACS+ encrypts the entire packet, while RADIUS only encrypts the password
   • DTACACS+ separates authentication and authorization, while RADIUS combines them
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of the traceback feature in management plane security?

   • ATo automatically block all traffic from a source IP address that has been identified as malicious
   • BTo encrypt management traffic so that attackers cannot intercept it
   • CTo identify the true source of malicious or spoofed traffic by tracing it back to its origin
   • DTo trace the path of a packet through the network and identify the interface where it was dropped
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer is troubleshooting a security incident where a router's management interface was accessed from an unknown source. The engineer wants to determine the source of the malicious traffic and also wants to ensure that future access attempts are logged with the username. Which two features should be enabled?

   • AACL logging and syslog
   • BTraceback on the router and TACACS+ accounting for management access
   • CSNMP traps and RADIUS authentication
   • DNetFlow on the management interface and local logging
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A service provider is hardening the management plane of its PE routers. The NOC team wants to ensure that every administrative command entered on the routers is recorded with the username, the exact command, and the timestamp, and that authentication for device access is centralized. The team also wants to be able to trace the source of a recent burst of malformed SNMP requests that caused high CPU on a core router. Which combination of features should the team implement?

   • ATACACS+ for authentication only, and enable SNMP traps to a syslog server
   • BLocal username/password with privilege levels, and configure an ACL to block SNMP from unknown sources
   • CRADIUS for AAA with command authorization, and enable NetFlow on the management interface
   • DTACACS+ for AAA with command accounting, and enable SNMP traceback to log the source IP of the offending requests
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A service provider is investigating a security incident where an attacker sent spoofed packets to the management interface of a core router. The engineer needs to determine which interface the attack traffic entered the network. The router is running Cisco IOS XR. Which feature should the engineer use to trace the attack traffic back to its source?

   • ANetFlow
   • BTraceback
   • CSyslog
   • DSNMP
   Reveal Solution Discussion Select an answer first