What is the purpose of using BGP communities in RTBH configuration?

To automatically remove the black-hole route after a timeout.

To tag black-hole routes so that routers can identify and accept them for Null0 next-hop.

To prioritize black-hole routes over normal routes in the routing table.

To encrypt the BGP updates carrying the black-hole routes.

A network engineer is designing an ACL to protect a BGP peer from unauthorized TCP connections. The ACL will be applied inbound on the interface facing the peer. Which entry should be placed first to ensure the intended behavior?

Permit tcp host 192.0.2.1 host 198.51.100.1 eq 179

Permit tcp any host 198.51.100.1 eq 179

A service provider is deploying MACsec between two routers over a metro Ethernet link. The security policy requires that all data on the link be encrypted and that the encryption keys be rotated automatically. Which MACsec feature should be used?

Static pre-shared key (PSK) with a short key lifetime.

802.1X with MACsec Key Agreement (MKA) to manage dynamic keys.

Static pre-shared key (PSK) with a long key lifetime.

A null cipher suite to provide integrity without encryption.

A service provider wants to block all traffic from a specific customer prefix that is generating excessive traffic, but must allow all other traffic. The ACL will be applied inbound on the PE interface. Which ACL entry should be placed at the top of the ACL?

Deny IP from the customer prefix to any destination.

Permit IP from any source to any destination.

Deny IP from any source to the customer prefix.

Permit IP from the customer prefix to any destination.

Which adjustment can be used to prevent uRPF from dropping legitimate traffic from a known source that is not reachable via the receiving interface?

Add a static route for the source address pointing to the receiving interface.

Disable the FIB on the receiving interface.

Increase the MTU on the interface.

Change the source address to a routable one.

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 3)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 11–15

11foundation · easy
What is the purpose of using BGP communities in RTBH configuration?
Select an answer first
12application · medium
A network engineer is designing an ACL to protect a BGP peer from unauthorized TCP connections. The ACL will be applied inbound on the interface facing the peer. Which entry should be placed first to ensure the intended behavior?
Select an answer first
13application · medium
A service provider is deploying MACsec between two routers over a metro Ethernet link. The security policy requires that all data on the link be encrypted and that the encryption keys be rotated automatically. Which MACsec feature should be used?
Select an answer first
14application · easy
A service provider wants to block all traffic from a specific customer prefix that is generating excessive traffic, but must allow all other traffic. The ACL will be applied inbound on the PE interface. Which ACL entry should be placed at the top of the ACL?
Select an answer first
15foundation · easy
Which adjustment can be used to prevent uRPF from dropping legitimate traffic from a known source that is not reachable via the receiving interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.