Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A network engineer is implementing Control Plane Protection (CPPr) on a router to provide more granular control than CoPP. They need to allow routing protocol updates (e.g., OSPF) and drop any traffic that is not explicitly permitted, while still allowing CEF-exception traffic like ICMP unreachables. Which CPPr sub-interface configuration should be used?

   • AApply a policy to the host sub-interface that permits OSPF and denies all else, and a separate policy to the CEF-exception sub-interface that permits ICMP unreachables.
   • BUse CoPP instead of CPPr because CPPr cannot filter CEF-exception traffic.
   • CApply a single policy to the transit sub-interface that permits OSPF and denies all else.
   • DApply a policy to the host sub-interface that permits OSPF and denies all else, and rely on the default behavior for CEF-exception traffic.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A user is able to authenticate to a router via AAA, but when they try to run a command, they receive an authorization failure. The TACACS+ server is configured to allow the command, but the router is still denying it. Which configuration issue is most likely the cause?

   • AAAA authorization for commands is not configured on the router.
   • BThe router is configured to use RADIUS for authorization instead of TACACS+.
   • CThe TACACS+ server is not configured with the correct shared secret.
   • DThe user's privilege level on the router is too low to run the command.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   After implementing CoPP on a core router, the operations team notices that BGP sessions are flapping. They suspect that BGP keepalives are being dropped by the CoPP policy. Which command should be used to verify whether BGP traffic is being dropped by the control-plane policy?

   • Ashow access-lists
   • Bshow policy-map control-plane
   • Cshow ip bgp summary
   • Ddebug ip bgp
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company wants to authenticate administrators on their Cisco routers using a central TACACS+ server, but also wants to allow local authentication as a fallback if the server is unreachable. Which AAA authentication configuration should be used?

   • Aaaa authentication login default group tacacs+ local
   • Baaa authentication login default group tacacs+
   • Caaa authentication login default radius local
   • Daaa authentication login default local group tacacs+
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   An organization requires that network administrators be authorized to run only 'show' commands on their routers, and they want to enforce this using a TACACS+ server. Which AAA configuration is necessary?

   • AConfigure AAA accounting for commands using the TACACS+ server group.
   • BConfigure AAA authorization for exec using the TACACS+ server group.
   • CConfigure AAA authorization for commands using the TACACS+ server group.
   • DConfigure AAA authentication for login using the TACACS+ server group.
   Reveal Solution Discussion Select an answer first