A network administrator is configuring a router to protect the control plane from DoS attacks. They have identified that ICMP traffic is causing high CPU usage. They want to rate-limit ICMP traffic to the control plane while allowing other traffic. Which configuration should they use?

Use a QoS policy on the interface to shape ICMP traffic

Apply an ACL on the interface that denies ICMP traffic

Configure a control plane policy that classifies ICMP traffic and applies a police rate

A dual-stack network is experiencing IPv6 neighbor cache exhaustion attacks on a router. The attacker sends many NS messages with different source addresses. The network team wants to mitigate this while also preventing rogue RA messages. Which two features should be implemented?

IPv6 source guard and DHCPv6 guard

IPv6 ACL to drop NS messages and DHCPv6 guard

RA guard and IPv6 ACL to drop RA messages

IPv6 neighbor discovery rate limiting and RA guard

A network engineer is troubleshooting a security issue on a switch. The switch has DHCP snooping, DAI, and IP source guard enabled. A legitimate user's PC is unable to communicate with other devices on the same VLAN. The PC obtained its IP address via DHCP, and the DHCP snooping binding table shows the correct entry. However, the PC cannot ping the default gateway. What is the most likely cause?

DAI is dropping ARP replies from the default gateway because the gateway's IP-MAC binding is not in the DHCP snooping table

DHCP snooping is blocking the PC's DHCP renewal

IP source guard is dropping the PC's traffic because the binding is not in the table

Port-security is blocking the PC because the MAC address is not allowed

A network administrator is configuring a router with AAA for device access. They want to use a RADIUS server for authentication, but if the server is unreachable, they want to fall back to local authentication. Which configuration should they use?

Configure AAA authentication login with a method list that includes RADIUS and local as fallback

Configure AAA authentication login with only RADIUS

Configure local usernames and use RADIUS for authorization only

Configure AAA authentication login with local and RADIUS in that order

A network engineer is securing BGP sessions between two routers. They want to prevent an attacker from spoofing BGP packets and also ensure that only the intended peer can establish a session. Which combination of features should be used?

BGP next-hop-self and a distribute list

BGP MD5 authentication and a route map

BGP MD5 authentication and a neighbor ACL

BGP TTL security and a prefix list

CCIE Enterprise Infrastructure

Domain 4Objective 2

Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 6)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

3concepts

15%of the exam

Questions 26–30

26expert · hard
A network administrator is configuring a router to protect the control plane from DoS attacks. They have identified that ICMP traffic is causing high CPU usage. They want to rate-limit ICMP traffic to the control plane while allowing other traffic. Which configuration should they use?
Select an answer first
27expert · hard
A dual-stack network is experiencing IPv6 neighbor cache exhaustion attacks on a router. The attacker sends many NS messages with different source addresses. The network team wants to mitigate this while also preventing rogue RA messages. Which two features should be implemented?
Select an answer first
28expert · hard
A network engineer is troubleshooting a security issue on a switch. The switch has DHCP snooping, DAI, and IP source guard enabled. A legitimate user's PC is unable to communicate with other devices on the same VLAN. The PC obtained its IP address via DHCP, and the DHCP snooping binding table shows the correct entry. However, the PC cannot ping the default gateway. What is the most likely cause?
Select an answer first
29expert · hard
A network administrator is configuring a router with AAA for device access. They want to use a RADIUS server for authentication, but if the server is unreachable, they want to fall back to local authentication. Which configuration should they use?
Select an answer first
30expert · hard
A network engineer is securing BGP sessions between two routers. They want to prevent an attacker from spoofing BGP packets and also ensure that only the intended peer can establish a session. Which combination of features should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.