1.6 Describe Management Plane Security 350-501 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A service provider is facing a sophisticated DDoS attack that targets the management plane of its edge routers. The attack uses a mix of spoofed SYN floods and legitimate-looking HTTPS requests to the management interface. The NOC must maintain access to the routers for emergency configuration changes. The engineer has the following tools available: control plane policing (CoPP), traceback, TACACS+ with per-command authorization, and a REST API with rate limiting. Which combination of actions provides the most effective defense while preserving NOC access?

   • ADisable the management interface on the edge routers and rely on out-of-band management from the NOC.
   • BImplement CoPP to rate-limit SYN packets, enable traceback to identify the ingress interface, and use TACACS+ to restrict management commands to NOC users.
   • CUse the REST API with rate limiting to block all management traffic, and rely on traceback to identify the source.
   • DConfigure TACACS+ to require multi-factor authentication for all management access, and disable traceback to reduce CPU load.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network administrator is configuring AAA on a service provider router. The security policy requires that all configuration changes be logged with the username, the exact command, and the timestamp. The administrator also needs to ensure that if the AAA server is unreachable, the router can still be accessed via the console for emergency recovery. Which configuration should be implemented?

   • ARADIUS for authentication and accounting, with no fallback.
   • BRADIUS for authentication, with a local fallback for console access.
   • CTACACS+ for authentication only, with local logging of all commands.
   • DTACACS+ for authentication, authorization, and accounting, with a local fallback for console access.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A service provider's management network is experiencing a DDoS attack that is saturating the link to the management plane. The attack traffic appears to come from many different source IPs and is targeting the SSH port on the management routers. The operator needs to mitigate the attack while maintaining legitimate administrative access. Which approach is most effective?

   • AAdd a static route for the management network to Null0 and disable SSH temporarily
   • BIncrease the SSH timeout and enable TCP keepalives on the routers
   • CDeploy RTBH filtering upstream and use control-plane policing to rate-limit SSH packets
   • DChange the SSH port to a non-standard port and rely on obscurity
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A service provider is integrating a third-party orchestration system with its router management API. The orchestration system needs to retrieve configuration data but must not be able to modify configurations. The security team also wants to ensure that the API traffic is not intercepted. Which approach should be used?

   • AUse a shared secret in the URL and rely on the internal network
   • BProvide the orchestration system with full admin credentials and rely on network segmentation
   • CCreate a read-only API key and use HTTPS for all API calls
   • DUse TACACS+ for API authentication and allow all methods
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A service provider is designing a management plane for a new network. The design must support both CLI and REST API access, with centralized authentication and authorization. The provider also wants to ensure that the management plane is resilient to DDoS attacks. The security team is considering using TACACS+ for CLI and OAuth 2.0 for the API. Which additional measure is essential to meet the DDoS resilience requirement?

   • AUse a single shared secret for both CLI and API authentication
   • BRely on the ISP's DDoS protection service
   • CDisable the REST API during peak hours
   • DImplement control-plane policing on all management interfaces
   Reveal Solution Discussion Select an answer first