Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A router is experiencing high CPU utilization due to excessive traffic destined to the control plane. The engineer wants to implement CPPr to provide granular control. They need to allow OSPF hello packets, but drop all other host traffic, while still allowing CEF-exception traffic such as ICMP unreachables. Which configuration is correct?

   • AApply a policy to the host sub-interface that permits OSPF and denies all else, and rely on the default behavior for CEF-exception traffic.
   • BApply a policy to the host sub-interface that permits OSPF and denies all else, and a separate policy to the CEF-exception sub-interface that permits ICMP unreachables.
   • CUse CoPP instead of CPPr because CPPr cannot filter CEF-exception traffic.
   • DApply a single policy to the transit sub-interface that permits OSPF and denies all else.
   Reveal Solution Discussion Select an answer first
2. 47expert · medium

   After implementing CoPP, the network team notices that some legitimate OSPF updates are being dropped. They need to verify whether the drops are due to CoPP. Which command should they use to check the CoPP drop counters?

   • Ashow access-lists
   • Bshow ip ospf neighbor
   • Cshow policy-map control-plane
   • Ddebug ip ospf
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company has a mix of RADIUS and TACACS+ servers. They want to use RADIUS for authentication and TACACS+ for authorization and accounting. However, they also want to use local authentication as a fallback if the RADIUS server is unreachable. Which configuration is correct?

   • AConfigure AAA authentication using a method list that includes TACACS+ and local, and configure AAA authorization and accounting using RADIUS.
   • BConfigure AAA authentication using a method list that includes RADIUS and TACACS+, and configure AAA authorization and accounting using local.
   • CConfigure AAA authentication using a method list that includes RADIUS and local, and configure AAA authorization and accounting using TACACS+.
   • DConfigure AAA authentication using a method list that includes local and RADIUS, and configure AAA authorization and accounting using RADIUS.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A network administrator wants to restrict a group of users to only 'show' commands on a router. They have a TACACS+ server that supports per-command authorization. However, they also want to allow these users to use 'enable' to enter privileged EXEC mode. Which AAA configuration is required?

   • AConfigure AAA authentication for login with the TACACS+ server group.
   • BConfigure AAA accounting for commands with the TACACS+ server group.
   • CConfigure AAA authorization for commands with the TACACS+ server group only.
   • DConfigure AAA authorization for commands with the TACACS+ server group, and configure AAA authorization for exec with the TACACS+ server group.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security team needs to audit all configuration changes on their routers. They want to record every command entered, including the username and timestamp, to a TACACS+ server. However, they also want to ensure that the accounting records are sent even if the TACACS+ server is temporarily unreachable. Which configuration is necessary?

   • AConfigure AAA authorization for commands with the TACACS+ server group.
   • BConfigure AAA accounting for commands with the TACACS+ server group only.
   • CConfigure AAA accounting for commands with the TACACS+ server group, and enable logging of accounting records locally as a fallback.
   • DConfigure AAA accounting for exec with the TACACS+ server group.
   Reveal Solution Discussion Select an answer first