A service provider is implementing RTBH to mitigate a DDoS attack. The trigger router is configured to inject a blackhole route for the victim's IP. Which BGP community should be used to signal other routers to discard traffic to the victim?

The community value 65535:666, which is the standard blackhole community.

The community value 0:0, which is the default community.

A well-known community such as NO_EXPORT.

A customer-defined community that is configured on all edge routers to match and install a discard route.

What is the difference between strict and loose mode uRPF on Cisco IOS XR?

Strict mode checks the destination address, while loose mode checks the source address.

Strict mode requires the source address to be reachable via the receiving interface, while loose mode only requires a route to the source in the FIB.

Strict mode drops packets with private source addresses, while loose mode allows them.

Strict mode is used for IPv6, while loose mode is used for IPv4.

In which scenario might unicast Reverse Path Forwarding (uRPF) drop legitimate traffic?

When the destination address is not in the FIB.

When asymmetric routing causes packets from a valid source to arrive on an interface that is not the reverse path to that source.

When the source MAC address is not in the Layer 2 table.

When the packet is fragmented and the first fragment is missing.

A service provider is designing data plane security for a new edge router. The requirements are: (1) block spoofed source addresses from customers, (2) protect the router's own infrastructure addresses from unauthorized access, and (3) allow legitimate BGP sessions with peers. Which of the following configurations should be implemented? (Select all that apply.)

Enable loose uRPF on all interfaces

Configure RTBH for the router's loopback addresses

Enable strict uRPF on customer-facing interfaces

Apply an outbound ACL on customer-facing interfaces to permit only customer prefixes

Apply an inbound ACL on all interfaces to permit only BGP from known peers and deny all other traffic to the router's loopback addresses

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 2)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 6–10

6application · medium
A service provider is implementing RTBH to mitigate a DDoS attack. The trigger router is configured to inject a blackhole route for the victim's IP. Which BGP community should be used to signal other routers to discard traffic to the victim?
Select an answer first
7foundation · easy
Which command can be used to verify that MACsec is operational on a Cisco IOS XR interface?
Select an answer first
8foundation · easy
What is the difference between strict and loose mode uRPF on Cisco IOS XR?
Select an answer first
9foundation · easy
In which scenario might unicast Reverse Path Forwarding (uRPF) drop legitimate traffic?
Select an answer first
10expert · hard · select all that apply
A service provider is designing data plane security for a new edge router. The requirements are: (1) block spoofed source addresses from customers, (2) protect the router's own infrastructure addresses from unauthorized access, and (3) allow legitimate BGP sessions with peers. Which of the following configurations should be implemented? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 2)

Questions 6–10

A service provider is implementing RTBH to mitigate a DDoS attack. The trigger router is configured to inject a blackhole route for the victim's IP. Which BGP community should be used to signal other routers to discard traffic to the victim?

Which command can be used to verify that MACsec is operational on a Cisco IOS XR interface?

What is the difference between strict and loose mode uRPF on Cisco IOS XR?

In which scenario might unicast Reverse Path Forwarding (uRPF) drop legitimate traffic?

Keep studying — Architecture