Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is implementing CoPP on a Cisco IOS XE router to protect the route processor from excessive ICMP traffic. The engineer has created a class map that matches ICMP packets destined to the router's IP addresses. Which additional configuration is required to apply the policy to the control plane?

   • AUse the control-plane host sub-interface to apply the policy.
   • BApply the policy map to the physical interface using the service-policy input command.
   • CEnable the policy globally using the policy-map global command.
   • DApply the policy map to the control-plane interface using the service-policy command.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network administrator wants to implement AAA on a router to ensure that users are authenticated, authorized for specific commands, and that all actions are logged. Which sequence of configuration steps is correct?

   • AConfigure accounting, then authorization, then authentication.
   • BConfigure authentication, then authorization, then accounting.
   • CConfigure authorization, then authentication, then accounting.
   • DConfigure all three in any order; the router will apply them correctly.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A network engineer is designing CoPP for a core router. The router must continue to receive routing protocol updates (OSPF, BGP) and allow SSH management, but must drop excessive ICMP and other unwanted traffic. The engineer wants to ensure that routing protocols are never dropped, even under attack. Which CoPP design is most appropriate?

   • ACreate a single class for all control-plane traffic and police it at a moderate rate.
   • BCreate a class for routing protocols with a high police rate and a class for ICMP with a low rate, then apply the policy to the control plane.
   • CApply an access list to the physical interface to block all ICMP.
   • DUse CPPr with a policy on the host sub-interface only.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A router is experiencing high CPU usage due to a flood of packets that are being process-switched and forwarded to the control plane. The engineer wants to use CPPr to police only these transit packets, but must ensure that packets destined to the router itself (like SSH) are not affected. Which CPPr configuration should be used?

   • AUse standard CoPP on the control-plane interface.
   • BApply a policy to the control-plane cef-exception sub-interface.
   • CApply a policy to the control-plane transit sub-interface that polices the transit traffic.
   • DApply a policy to the control-plane host sub-interface that polices all traffic.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An enterprise uses RADIUS for authentication and TACACS+ for authorization and accounting. The network team is configuring a new router and wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication, but if the TACACS+ server is unreachable, authorization should fail closed (deny access). Which configuration should be used?

   • Aaaa authentication login default group radius; aaa authorization commands 15 default group tacacs+ local
   • Baaa authentication login default group radius; aaa authorization commands 15 default local
   • Caaa authentication login default group radius local; aaa authorization commands 15 default group tacacs+
   • Daaa authentication login default local group radius; aaa authorization commands 15 default group tacacs+
   Reveal Solution Discussion Select an answer first