What is the primary purpose of Remotely Triggered Black Hole (RTBH) filtering?

To rate-limit traffic to a victim to reduce the impact of an attack.

To redirect traffic to a security appliance for inspection.

To encrypt traffic to protect it from eavesdropping.

To discard traffic destined to a specific victim or originating from a specific source by routing it to a null interface.

A service provider edge router receives customer traffic on a shared PE-CE link. The customer uses asymmetric routing for some flows, with return traffic entering via a different PE. The team wants to drop packets with spoofed source addresses while avoiding disruption to legitimate asymmetric flows. Which configuration should be applied on the PE interface facing the customer?

Enable loose unicast RPF on the PE-CE interface and permit the customer's aggregate prefix in the RPF allow-list.

Apply an inbound ACL that permits only the customer's assigned prefix and denies all other source addresses.

Configure strict unicast RPF with the 'allow-default' option to bypass the check for default-route entries.

Enable strict unicast RPF with an allow-list for the customer's known source prefixes.

In MACsec, what is a Secure Channel (SC)?

A unidirectional logical connection between two peers that carries secure frames.

A physical port that has MACsec enabled.

A bidirectional tunnel that encrypts all traffic between two switches.

A VLAN that is encrypted on a trunk link.

After configuring MACsec on a link between two routers, the engineer wants to verify that the link is encrypted and that traffic is being protected. Which command should be used?

show interfaces GigabitEthernet0/0/0/0

show macsec interface GigabitEthernet0/0/0/0

Which fields can a standard access control list (ACL) on Cisco IOS XR match to filter packets?

Source IP address and TCP/UDP port numbers

Source MAC address and EtherType

Source and destination IP addresses

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 6)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 26–30

26foundation · easy
What is the primary purpose of Remotely Triggered Black Hole (RTBH) filtering?
Select an answer first
27application · medium
A service provider edge router receives customer traffic on a shared PE-CE link. The customer uses asymmetric routing for some flows, with return traffic entering via a different PE. The team wants to drop packets with spoofed source addresses while avoiding disruption to legitimate asymmetric flows. Which configuration should be applied on the PE interface facing the customer?
Select an answer first
28foundation · easy
In MACsec, what is a Secure Channel (SC)?
Select an answer first
29application · medium
After configuring MACsec on a link between two routers, the engineer wants to verify that the link is encrypted and that traffic is being protected. Which command should be used?
Select an answer first
30foundation · easy
Which fields can a standard access control list (ACL) on Cisco IOS XR match to filter packets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.