A network engineer is troubleshooting uRPF drops on a router. The router has a default route and uses strict uRPF. The engineer discovers that legitimate traffic from a directly connected network is being dropped. The source IP is reachable via the directly connected interface, but the FIB has a default route that points to the ISP. What is the most likely cause and solution?

The router is using loose uRPF; change to strict

The directly connected network is not in the FIB; add a static route

The default route is causing the FIB to point to the ISP interface, so strict uRPF fails; use the 'allow-default' option

The source IP is not in the routing table; use 'ip verify unicast source reachable-via any'

A network architect is designing a QoS strategy for a data center that hosts critical applications. The architect wants to protect the control plane from DoS attacks while also ensuring that critical application traffic is not dropped during congestion. Which combination of QoS mechanisms should be used?

Use shaping on the control plane and policing on the data plane

Use classification and marking, but no policing or queuing

Use only policing on all interfaces to limit traffic rates

Use CoPP to rate-limit control plane traffic and apply a priority queue for critical application traffic

A service provider is using RTBH to mitigate DDoS attacks. They have a customer who wants to trigger blackholing for a specific IP, but the provider wants to ensure that the customer can only blackhole IPs they own. The provider also wants to minimize the risk of accidental blackholing. Which mechanism should be used?

Allow the customer to advertise any prefix with the blackhole community, but rely on trust

Require the customer to send a signed email to trigger blackholing

Use a BGP community that is only accepted for prefixes registered in the customer's IRR record

Use a BGP route-reflector to filter blackhole routes based on the customer's AS

A network administrator is configuring QoS to mitigate a DoS attack that is consuming all available bandwidth on an internet link. The administrator wants to drop traffic from the attack source while preserving legitimate traffic. Which QoS mechanism is most appropriate?

Apply a policer that drops traffic matching the attack signature

Apply a shaper to the attack source IP to limit its rate

Use a priority queue for legitimate traffic

Apply a policer that drops all traffic from the attack source IP

A network engineer has configured uRPF in loose mode on an interface of an IOS-XE router. After deployment, the team reports that some legitimate traffic is being dropped. The engineer suspects the FIB does not contain a route for some valid source prefixes. Which verification command should the engineer use to confirm that uRPF is checking the correct source prefixes?

show ip cef exact-route source destination

CCIE Security

Domain 3Objective 3

3.3 Data Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 6)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

15%of the exam

Questions 26–30

26expert · hard
A network engineer is troubleshooting uRPF drops on a router. The router has a default route and uses strict uRPF. The engineer discovers that legitimate traffic from a directly connected network is being dropped. The source IP is reachable via the directly connected interface, but the FIB has a default route that points to the ISP. What is the most likely cause and solution?
Select an answer first
27expert · hard
A network architect is designing a QoS strategy for a data center that hosts critical applications. The architect wants to protect the control plane from DoS attacks while also ensuring that critical application traffic is not dropped during congestion. Which combination of QoS mechanisms should be used?
Select an answer first
28expert · hard
A service provider is using RTBH to mitigate DDoS attacks. They have a customer who wants to trigger blackholing for a specific IP, but the provider wants to ensure that the customer can only blackhole IPs they own. The provider also wants to minimize the risk of accidental blackholing. Which mechanism should be used?
Select an answer first
29expert · hard
A network administrator is configuring QoS to mitigate a DoS attack that is consuming all available bandwidth on an internet link. The administrator wants to drop traffic from the attack source while preserving legitimate traffic. Which QoS mechanism is most appropriate?
Select an answer first
30application · medium
A network engineer has configured uRPF in loose mode on an interface of an IOS-XE router. After deployment, the team reports that some legitimate traffic is being dropped. The engineer suspects the FIB does not contain a route for some valid source prefixes. Which verification command should the engineer use to confirm that uRPF is checking the correct source prefixes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.3 Data Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

A network administrator is configuring QoS to mitigate a DoS attack that is consuming all available bandwidth on an internet link. The administrator wants to drop traffic from the attack source while preserving legitimate traffic. Which QoS mechanism is most appropriate?

Keep studying — 3.0 Security Infrastructure