3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which global configuration command disables IP source routing on a Cisco IOS router?

   • Ano ip forward-protocol
   • Bno ip redirects
   • Cno ip source-route
   • Dno ip routing
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network team notices that the CPU of the core router spikes to 95% during a distributed denial-of-service (DDoS) attack, causing BGP sessions to flap. The team wants to ensure that routing protocol traffic is always processed while limiting the impact of attack traffic. What should they implement?

   • AImplement an iACL on the router to block all traffic destined to the router's IP addresses except BGP.
   • BEnable IP source routing on the router to allow BGP packets to bypass the control plane queue.
   • CIncrease the BGP hold timer to make sessions more resilient to CPU spikes.
   • DApply a CoPP policy that classifies BGP traffic and places it in a high-priority class with a high committed rate, while policing other control plane traffic.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security auditor is reviewing the configuration of a router and finds that IP source routing is enabled. The auditor also notes that the router has an iACL that permits traffic from a specific partner network. What is the risk of having IP source routing enabled in this scenario?

   • AThe iACL will be more effective because source routing provides additional path control.
   • BThe router will drop all packets that have source routing options.
   • CThe router will automatically disable the iACL when source routing is enabled.
   • DAn attacker could use source routing to bypass the iACL and reach the router's management interface.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After configuring CoPP, the network team notices that OSPF neighbor adjacencies are flapping. They suspect that CoPP is dropping OSPF hello packets. Which command should they use to verify whether OSPF packets are being dropped by CoPP?

   • Ashow access-lists
   • Bshow ip ospf neighbor
   • Cshow policy-map control-plane
   • Dshow ip route
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator is tasked with protecting the management plane of all network devices. They plan to implement iACLs. What is a key design consideration when creating the iACL?

   • AApply the iACL only on the management interface of each device.
   • BInclude explicit deny statements for all traffic to infrastructure device IPs, and place the ACL on all interfaces facing untrusted networks.
   • COnly permit traffic from the internet to the management IPs to allow remote management.
   • DUse a single ACL that permits all traffic from internal networks to infrastructure devices.
   Reveal Solution Discussion Select an answer first