A provider edge router has strict uRPF enabled on a customer interface. The customer has a legitimate multi-homed connection where traffic from the same source prefix arrives via two different interfaces. The provider is seeing drops of legitimate traffic. Which action should be taken to resolve the issue while maintaining spoofing protection?

Create a static route for the customer's prefix via both interfaces

Apply an ACL to allow the customer's prefix from both interfaces

Switch to loose uRPF on the customer interface

Disable uRPF on the customer interface

A service provider is experiencing a DDoS attack targeting a customer's public IP. The attack traffic is sourced from many spoofed addresses. The provider wants to drop all traffic to the victim IP as close to the network edge as possible. Which technique should be used?

Enable uRPF on the edge routers to drop spoofed traffic

Apply an inbound ACL on the edge routers to drop traffic to the victim IP

Configure a static route for the victim IP pointing to Null0 on the edge routers

Use Remotely Triggered Black Hole (RTBH) filtering with a trigger router and BGP communities

A provider edge router is configured with strict uRPF on a customer-facing interface. After deployment, the customer reports that legitimate traffic from a specific /24 prefix is being dropped. The router's FIB shows a more specific route for that /24 via a different interface. What is the most likely cause and the appropriate fix?

The /24 is not in the FIB; add a static route for it

The ACL applied to the interface is blocking the /24; remove the ACL

The more specific route causes strict uRPF to fail; switch to loose uRPF or adjust the FIB to prefer the customer-facing interface

The customer is sending spoofed traffic; configure an allow-list for the /24

When constructing an ACL to protect infrastructure services, why is the order of access control entries (ACEs) important?

Because the first matching ACE determines the action, so more specific rules must come before broader ones.

Because the order only matters for logging, not for filtering.

Because ACEs are evaluated in random order for performance.

Because the last matching ACE determines the action, so broader rules must come first.

A service provider is facing a DDoS attack on a customer's IP. The attack is consuming bandwidth on multiple edge links. The provider wants to blackhole the victim IP quickly, but also wants to allow legitimate traffic to other destinations. Which approach best meets these requirements?

Use RTBH with a trigger router and BGP communities to advertise a blackhole route for the victim IP

Enable uRPF strict mode on all edge interfaces

Manually configure a static Null0 route on each edge router

Apply an ACL on the edge routers to drop traffic to the victim IP

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 4)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 16–20

16expert · hard
A provider edge router has strict uRPF enabled on a customer interface. The customer has a legitimate multi-homed connection where traffic from the same source prefix arrives via two different interfaces. The provider is seeing drops of legitimate traffic. Which action should be taken to resolve the issue while maintaining spoofing protection?
Select an answer first
17application · medium
A service provider is experiencing a DDoS attack targeting a customer's public IP. The attack traffic is sourced from many spoofed addresses. The provider wants to drop all traffic to the victim IP as close to the network edge as possible. Which technique should be used?
Select an answer first
18application · medium
A provider edge router is configured with strict uRPF on a customer-facing interface. After deployment, the customer reports that legitimate traffic from a specific /24 prefix is being dropped. The router's FIB shows a more specific route for that /24 via a different interface. What is the most likely cause and the appropriate fix?
Select an answer first
19foundation · easy
When constructing an ACL to protect infrastructure services, why is the order of access control entries (ACEs) important?
Select an answer first
20expert · hard
A service provider is facing a DDoS attack on a customer's IP. The attack is consuming bandwidth on multiple edge links. The provider wants to blackhole the victim IP quickly, but also wants to allow legitimate traffic to other destinations. Which approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 4)

Questions 16–20

A service provider is experiencing a DDoS attack targeting a customer's public IP. The attack traffic is sourced from many spoofed addresses. The provider wants to drop all traffic to the victim IP as close to the network edge as possible. Which technique should be used?

When constructing an ACL to protect infrastructure services, why is the order of access control entries (ACEs) important?

A service provider is facing a DDoS attack on a customer's IP. The attack is consuming bandwidth on multiple edge links. The provider wants to blackhole the victim IP quickly, but also wants to allow legitimate traffic to other destinations. Which approach best meets these requirements?

Keep studying — Architecture