1.6 Describe Management Plane Security 350-501 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network operator is deploying a REST API on a service provider router to allow customers to programmatically configure their own VPN services. The API must authenticate each request, ensure that a customer can only modify their own VPN, and prevent a single customer from overwhelming the API with requests. Which set of mechanisms should the engineer implement?

   • AOAuth 2.0 for authentication, scoped access tokens for authorization, and per-customer rate limiting.
   • BA shared API key for all customers, a single administrator account for authorization, and global rate limiting.
   • CTACACS+ for API authentication, per-command authorization, and connection-level rate limiting.
   • DBasic authentication with a common username, a single role for all users, and no rate limiting.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A service provider network engineer is troubleshooting a series of failed SSH login attempts to the core router's management interface. The source IP addresses appear to be spoofed, and the engineer needs to determine the actual ingress interface of the attack traffic. The router is configured with AAA using TACACS+ for management access. Which combination of actions will provide the most direct evidence of the true attack source?

   • AEnable traceback on the management plane and review the syslog output for the ingress interface of the spoofed packets.
   • BReview the TACACS+ server logs to correlate the failed authentication attempts with the source IP addresses.
   • CEnable AAA accounting on the management plane to log all failed login attempts with the source MAC address.
   • DConfigure an ACL to block the spoofed source IP addresses and monitor the interface counters for dropped packets.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network operator exposes a REST API on its routers for programmatic configuration changes. The security team requires that only authenticated NOC applications can modify configurations, that all API traffic is encrypted in transit, and that a single misbehaving client cannot overwhelm the API endpoint. Which set of mechanisms should the operator implement?

   • AOAuth 2.0 tokens with TLS, but no rate limiting because the API is internal
   • BBasic authentication over HTTP, with a shared secret and global rate limiting
   • CAPI keys with HTTPS, role-based access control, and per-client rate limiting
   • DClient certificates with TLS, but no authorization checks because the certificate proves identity
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A service provider's management API is being targeted by a DDoS attack that uses a large number of legitimate-looking requests from distributed sources. The API is protected by rate limiting, but the attack is still causing performance degradation. The provider wants to identify the attack sources and also wants to ensure that the API remains available for legitimate users. Which approach should be taken?

   • ABlock all traffic from the IP ranges used by the attack
   • BIncrease the rate limit for all clients to allow more traffic
   • CUse traceback to identify the true sources, and implement adaptive rate limiting based on traffic patterns
   • DDisable the API and use CLI for all management
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which technique is commonly used to mitigate a DDoS attack targeting the management plane of a router?

   • ADisabling SSH and using Telnet for management
   • BIncreasing the MTU on management interfaces
   • CEnabling CDP on all interfaces
   • DControl plane policing (CoPP)
   Reveal Solution Discussion Select an answer first