3.3 Data Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A network engineer is configuring CoPP on a router that has both a management interface and a data plane interface. The engineer wants to ensure that SSH management traffic is always allowed, but also wants to protect the control plane from ICMP floods. Which configuration is best?

   • AApply a CoPP policy that rate-limits all traffic equally
   • BUse an ACL to block all ICMP traffic
   • CApply a CoPP policy that rate-limits ICMP to a low rate and allows SSH with a high rate
   • DUse shaping on the control plane to smooth ICMP traffic
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial institution wants to ensure that latency-sensitive trading traffic is prioritized over bulk data transfers on their WAN edge routers. They also want to protect the control plane from being overwhelmed by excessive traffic. Which QoS strategy should be implemented?

   • AImplement strict priority queuing for all traffic
   • BUse only shaping on the WAN interface to limit bulk traffic
   • CApply a control plane policer that rate-limits all traffic destined to the router, and use a separate policy for data plane prioritization
   • DClassify and mark trading traffic with a high DSCP value, then apply a policy map that prioritizes it in the output queue
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's internet edge router is experiencing intermittent DoS attacks that cause link saturation. The security team wants to mitigate the impact by limiting the rate of certain traffic types without dropping all traffic. They also need to ensure that legitimate business-critical traffic is not affected. Which QoS mechanism should be applied?

   • AUse a class-based policer that only polices traffic matching known attack signatures
   • BApply shaping to buffer excess traffic and smooth the rate
   • CImplement a priority queue for all traffic
   • DApply policing to drop excess traffic above a configured rate
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network administrator is configuring control plane protection on a router that receives BGP, OSPF, and SSH traffic. The router has been experiencing high CPU usage due to excessive SSH connection attempts. The administrator wants to limit SSH traffic without affecting routing protocols. Which configuration should be used?

   • AApply QoS shaping on the control plane interface
   • BUse an access-list to block all SSH traffic
   • CCreate a class-map for SSH traffic and apply a police action in the control plane policy
   • DApply a control plane policer that rate-limits all traffic to the router
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A large enterprise is facing a volumetric DDoS attack targeting a specific server IP. The attack is saturating the internet link. The security team wants to drop all traffic to the victim IP at the edge routers while minimizing impact on other traffic. Which technique should be used?

   • AApply an access-list to block the victim IP on the edge router
   • BConfigure a static route to the victim IP pointing to Null0 on the edge router
   • CUse RTBH with BGP to advertise a blackhole route for the victim IP to upstream providers
   • DUse QoS policing to rate-limit traffic to the victim IP
   Reveal Solution Discussion Select an answer first