1.7 Implement Data Plane Security 350-501 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which configuration element is used to implement RTBH on Cisco IOS XR?

   • AAn ACL that denies all traffic to the victim's IP.
   • BA static route pointing to the Null0 interface, redistributed into BGP.
   • CA policy map that sets the DSCP value to drop.
   • DA VRF with a route target that matches the victim's prefix.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A network engineer is designing an ACL to protect the management plane of a router. The ACL will be applied to the vty lines. Which traffic should be permitted in the ACL?

   • AHTTP from the NOC subnet.
   • BTelnet from any source.
   • CSNMP from any source.
   • DSSH from the NOC subnet only.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A service provider is designing an ACL to protect its infrastructure. The ACL will be applied inbound on all edge routers. The requirements are: allow BGP (TCP 179) from customer edge routers, allow SSH from the NOC subnet, and block all other traffic. The ACL is 100 lines long. What is the best practice for placing the permit statements?

   • APlace the BGP permit first, then the SSH permit, and rely on implicit deny.
   • BPlace a broad deny all statement at the top to block everything, then permit BGP and SSH.
   • CPlace the SSH permit first, then the BGP permit.
   • DPlace the implicit deny at the top of the ACL.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In an RTBH deployment, what role does the trigger router play?

   • AIt injects a BGP route for the victim's prefix with a next-hop of Null0 to propagate the black hole.
   • BIt generates a signature to identify the attack traffic.
   • CIt inspects all traffic and filters malicious packets using ACLs.
   • DIt acts as a DNS server to redirect traffic to a sinkhole.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A service provider is deploying MACsec between two provider edge routers over a dark fiber link. The security team requires encryption and integrity for all traffic on the link. Which MACsec configuration should be used?

   • AConfigure MACsec with a pre-shared key (PSK) on both interfaces
   • BEnable MACsec with a null cipher
   • CConfigure MACsec with 802.1X authentication
   • DUse IPsec instead of MACsec
   Reveal Solution Discussion Select an answer first