1.6 Describe Management Plane Security 350-501 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A service provider is experiencing a DDoS attack that is consuming the CPU of the route processor on its edge routers, causing management access to become unresponsive. The attack traffic is destined to the routers' management IP addresses. The engineer needs to protect the management plane while maintaining the ability to manage the routers from the NOC. Which approach should be taken?

   • AUse TACACS+ to authenticate all management traffic and block unauthenticated packets.
   • BIncrease the priority of management traffic in the routing table.
   • CImplement a control plane policer that limits the rate of traffic to the management IP addresses.
   • DDisable all management protocols on the routers until the attack subsides.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A service provider is exposing a REST API on its routers for automated configuration management. The security team is concerned about a potential DDoS attack that could overwhelm the API endpoint. The API must remain available for legitimate automation tools, but the team wants to limit the impact of a flood of requests. Which mechanism should be implemented?

   • ARate limiting on the API endpoint
   • BEncryption with TLS
   • CStrong authentication with API keys
   • DAuthorization with scoped tokens
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of a Distributed Denial of Service (DDoS) attack?

   • ATo modify the routing table to redirect traffic
   • BTo gain unauthorized access to the management plane
   • CTo exhaust the resources of a target so that legitimate users cannot access it
   • DTo steal sensitive configuration data from the device
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network engineer is investigating a security breach where an attacker gained access to a router's management plane. The attacker used a valid username and password, but the source IP was spoofed. The engineer needs to determine the actual source of the attack and also wants to prevent similar attacks in the future by ensuring that all management access is authenticated and authorized. Which approach should the engineer take?

   • AUse NetFlow to identify the source, and implement local usernames with privilege levels
   • BEnable SNMP traps to log access, and use RADIUS for authentication
   • CEnable traceback to identify the true source, and implement TACACS+ with per-command authorization
   • DConfigure an ACL to block the spoofed source, and use syslog for logging
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network administrator is configuring management access to a new service provider router. The security policy requires that all administrative commands be logged with the username, the exact command, and the timestamp. The administrator also needs to ensure that a user's access can be revoked immediately without changing the shared secret. Which AAA protocol and configuration should be used?

   • ATACACS+ with command accounting enabled on the router.
   • BRADIUS with authentication and authorization, and rely on the router's syslog for command logs.
   • CTACACS+ with authentication only and local logging of all commands.
   • DRADIUS with command accounting enabled on the router.
   Reveal Solution Discussion Select an answer first