An engineer is configuring RTBH on a Cisco IOS XR router. The trigger router will advertise a blackhole route for a victim IP. Which configuration is required on the edge routers to ensure they discard traffic to the victim?

Configure a static route to Null0 and redistribute it into BGP

Apply an inbound ACL on the edge routers to deny traffic to the victim

Configure a route-policy that matches the RTBH community and sets the next-hop to discard

Enable uRPF strict mode on all edge interfaces

A network engineer is implementing RTBH on a Cisco IOS XR router. The trigger router must inject a route for the victim's IP that will be propagated to all edge routers. Which configuration step is required on the trigger router?

Create a static route to the victim's IP with next-hop discard and redistribute it into BGP with a blackhole community.

Configure an ACL that denies the victim's IP and apply it to all edge router interfaces.

Advertise the victim's IP as a normal BGP route with a high local preference.

Enable uRPF strict mode on the trigger router's uplink interface.

A service provider wants to protect its core routers from unsolicited management traffic while still allowing BGP sessions from customer edge routers and SSH from the NOC subnet. The ACL will be applied inbound on the core-facing interfaces. Which ACL design best meets these requirements?

Permit TCP port 179 from customer edge addresses, permit TCP port 22 from the NOC subnet, then deny all other traffic.

Permit all traffic from the NOC subnet and customer edge addresses, then deny all other traffic.

Deny all traffic except TCP port 22 from anywhere, then permit BGP from customer edges.

Apply the ACL outbound on the core-facing interfaces to filter traffic leaving the router.

A service provider is deploying MACsec on a link between two routers. The link is a long-haul dark fiber with a propagation delay of 10 ms. The security team requires encryption and integrity, but the network team is concerned about the impact of MACsec on link utilization and latency. Which MACsec configuration should be used to minimize overhead while meeting the security requirements?

Use GCM-AES-256 with a 32-byte ICV.

Use GCM-AES-256 with a 16-byte ICV.

Use a null cipher suite with a 16-byte ICV.

Use GCM-AES-128 with a 16-byte ICV.

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 7)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 31–35

31application · medium
An engineer is configuring RTBH on a Cisco IOS XR router. The trigger router will advertise a blackhole route for a victim IP. Which configuration is required on the edge routers to ensure they discard traffic to the victim?
Select an answer first
32application · medium
A network engineer is implementing RTBH on a Cisco IOS XR router. The trigger router must inject a route for the victim's IP that will be propagated to all edge routers. Which configuration step is required on the trigger router?
Select an answer first
33application · medium
A service provider wants to protect its core routers from unsolicited management traffic while still allowing BGP sessions from customer edge routers and SSH from the NOC subnet. The ACL will be applied inbound on the core-facing interfaces. Which ACL design best meets these requirements?
Select an answer first
34expert · hard
A service provider is deploying MACsec on a link between two routers. The link is a long-haul dark fiber with a propagation delay of 10 ms. The security team requires encryption and integrity, but the network team is concerned about the impact of MACsec on link utilization and latency. Which MACsec configuration should be used to minimize overhead while meeting the security requirements?
Select an answer first
35foundation · easy
Which command is used to enable MACsec with a pre-shared key on a Cisco IOS XR interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 7)

Questions 31–35

An engineer is configuring RTBH on a Cisco IOS XR router. The trigger router will advertise a blackhole route for a victim IP. Which configuration is required on the edge routers to ensure they discard traffic to the victim?

A network engineer is implementing RTBH on a Cisco IOS XR router. The trigger router must inject a route for the victim's IP that will be propagated to all edge routers. Which configuration step is required on the trigger router?

A service provider wants to protect its core routers from unsolicited management traffic while still allowing BGP sessions from customer edge routers and SSH from the NOC subnet. The ACL will be applied inbound on the core-facing interfaces. Which ACL design best meets these requirements?

Which command is used to enable MACsec with a pre-shared key on a Cisco IOS XR interface?

Keep studying — Architecture