A network engineer is configuring CoPP on a router that carries both OSPF and BGP. The engineer wants to ensure that OSPF hellos are never dropped, but BGP updates can be rate-limited if necessary. Which policy-map configuration best achieves this?

Create a class for OSPF with a police action that has a high rate, and a class for BGP with a lower police rate

Create a class for OSPF with a 'police' action that has a very high rate and a 'conform-action transmit' and 'exceed-action transmit'

Use a class for OSPF with a 'police rate percent 50' and a class for BGP with 'police rate percent 10'

A service provider is implementing RTBH to mitigate DDoS attacks. They have multiple customers and want to allow customers to trigger blackholing for their own IPs, but only for prefixes they own. The provider uses BGP communities. Which configuration is the most secure and scalable?

Require customers to use static routes to Null0 on their own routers

Use BGP prefix-list filters to only accept blackhole routes for customer-owned prefixes

Allow customers to advertise any prefix with the blackhole community

Use a separate BGP session for blackhole routes

A network engineer is configuring uRPF on a router that has a default route pointing to an ISP. The router also has a directly connected network. The engineer wants to use strict uRPF but is concerned about dropping traffic from the directly connected network if the default route is used. What should the engineer do?

Enable strict uRPF and add a static route for the directly connected network

Enable loose uRPF with the 'allow-default' option

Enable strict uRPF without any options

Enable strict uRPF with the 'allow-default' option

A network administrator is designing QoS to protect the control plane of a router that receives both legitimate management traffic (SSH) and potential DoS traffic. The administrator wants to ensure that SSH is always available, but also wants to limit the impact of a DoS attack. Which approach is most effective?

Use a class-map for SSH and apply a police action with a high rate and conform-action transmit, exceed-action drop

Block all SSH traffic from untrusted sources

Apply a control plane policer that rate-limits SSH to a low rate

Use shaping on the control plane to smooth SSH traffic

A network engineer is implementing RTBH using BGP. Which two configurations are required on the edge routers to ensure that blackhole routes are installed and traffic is dropped? (Select all that apply.)

Enable BGP additional-paths to advertise multiple routes

Configure the BGP neighbor to accept the blackhole community

Configure a static route to Null0 for the blackhole prefix

Configure a route-map that matches the blackhole community and sets the next-hop to Null0

CCIE Security

Domain 3Objective 3

3.3 Data Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 5)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

15%of the exam

Questions 21–25

21expert · hard
A network engineer is configuring CoPP on a router that carries both OSPF and BGP. The engineer wants to ensure that OSPF hellos are never dropped, but BGP updates can be rate-limited if necessary. Which policy-map configuration best achieves this?
Select an answer first
22expert · hard
A service provider is implementing RTBH to mitigate DDoS attacks. They have multiple customers and want to allow customers to trigger blackholing for their own IPs, but only for prefixes they own. The provider uses BGP communities. Which configuration is the most secure and scalable?
Select an answer first
23expert · hard
A network engineer is configuring uRPF on a router that has a default route pointing to an ISP. The router also has a directly connected network. The engineer wants to use strict uRPF but is concerned about dropping traffic from the directly connected network if the default route is used. What should the engineer do?
Select an answer first
24expert · hard
A network administrator is designing QoS to protect the control plane of a router that receives both legitimate management traffic (SSH) and potential DoS traffic. The administrator wants to ensure that SSH is always available, but also wants to limit the impact of a DoS attack. Which approach is most effective?
Select an answer first
25expert · hard · select all that apply
A network engineer is implementing RTBH using BGP. Which two configurations are required on the edge routers to ensure that blackhole routes are installed and traffic is dropped? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.3 Data Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

A network engineer is configuring CoPP on a router that carries both OSPF and BGP. The engineer wants to ensure that OSPF hellos are never dropped, but BGP updates can be rate-limited if necessary. Which policy-map configuration best achieves this?

A service provider is implementing RTBH to mitigate DDoS attacks. They have multiple customers and want to allow customers to trigger blackholing for their own IPs, but only for prefixes they own. The provider uses BGP communities. Which configuration is the most secure and scalable?

A network engineer is implementing RTBH using BGP. Which two configurations are required on the edge routers to ensure that blackhole routes are installed and traffic is dropped? (Select all that apply.)

Keep studying — 3.0 Security Infrastructure