A network engineer is configuring CoPP on a router that carries both management traffic (SSH, SNMP) and routing protocols (BGP, OSPF). The engineer wants to ensure that routing protocol traffic is never dropped, even during an attack, while management traffic should be rate-limited. Which CoPP policy design is most appropriate?

Create separate classes for routing protocols with a high committed rate and a police action that exceeds to drop, and a class for management traffic with a lower committed rate.

Apply the same police rate to all classes to ensure fairness.

Use a class for routing protocols with a police action that drops all excess, and a class for management traffic with no police action.

Put all control plane traffic into a single class with a high committed rate.

A network team is implementing iACLs to protect their infrastructure. They have multiple edge routers and a core network. The iACL must allow BGP (TCP 179) from a specific peer, allow SSH from a management subnet, and deny all other traffic to infrastructure IPs. However, the team also needs to ensure that the iACL does not break OSPF adjacencies. What should they include in the iACL?

Permit all IP traffic from the OSPF neighbors and BGP peer, but deny SSH.

Apply the iACL only on the management interface to avoid affecting routing protocols.

Only permit BGP and SSH, and deny all other traffic including OSPF.

Permit OSPF (protocol 89) from all OSPF neighbors, permit BGP from the specific peer, permit SSH from the management subnet, and deny all other traffic to infrastructure IPs.

A security engineer is hardening a router that connects to multiple external partners. The router has an iACL that permits only specific partner IPs to access certain services. The engineer wants to disable IP source routing to prevent bypassing the iACL. However, one partner uses an application that relies on source routing for load balancing. What should the engineer do?

Enable CoPP to drop all packets with source routing options.

Disable IP source routing globally and work with the partner to redesign their application to not rely on source routing.

Disable IP source routing only on the interface facing the partner, but keep it enabled on other interfaces.

Keep IP source routing enabled to maintain partner functionality, but add additional ACLs to block source-routed packets.

A network administrator has implemented CoPP on a router and is monitoring its performance. They notice that the 'show policy-map control-plane' output shows an increasing number of dropped packets in the class that matches SSH traffic. The administrator is concerned that legitimate SSH sessions are being dropped. What is the best course of action?

Increase the committed rate for the SSH class to allow more SSH traffic, but keep the police action to drop excess.

Remove the police action from the SSH class to allow unlimited SSH traffic.

Ignore the drops because CoPP is supposed to drop all excess traffic.

Change the SSH class to use a 'transmit' action instead of 'police'.

A network team is deploying iACLs across their enterprise. They have a mix of Cisco routers and switches. The team wants to verify that the iACL is actually blocking unwanted traffic to infrastructure devices. Which method is most effective for verification?

Use the 'ping' command from an external source to test connectivity to the infrastructure device.

Use the 'show ip interface' command to verify that the ACL is applied to the correct interface.

Use the 'show running-config' to confirm the ACL is present.

Use the 'show access-lists' command to check the hit counts on the ACL entries, and compare them with expected traffic patterns.

CCIE Security

Domain 3Objective 1

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 5)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

15%of the exam

Questions 21–25

21expert · hard
A network engineer is configuring CoPP on a router that carries both management traffic (SSH, SNMP) and routing protocols (BGP, OSPF). The engineer wants to ensure that routing protocol traffic is never dropped, even during an attack, while management traffic should be rate-limited. Which CoPP policy design is most appropriate?
Select an answer first
22expert · hard
A network team is implementing iACLs to protect their infrastructure. They have multiple edge routers and a core network. The iACL must allow BGP (TCP 179) from a specific peer, allow SSH from a management subnet, and deny all other traffic to infrastructure IPs. However, the team also needs to ensure that the iACL does not break OSPF adjacencies. What should they include in the iACL?
Select an answer first
23expert · hard
A security engineer is hardening a router that connects to multiple external partners. The router has an iACL that permits only specific partner IPs to access certain services. The engineer wants to disable IP source routing to prevent bypassing the iACL. However, one partner uses an application that relies on source routing for load balancing. What should the engineer do?
Select an answer first
24expert · hard
A network administrator has implemented CoPP on a router and is monitoring its performance. They notice that the 'show policy-map control-plane' output shows an increasing number of dropped packets in the class that matches SSH traffic. The administrator is concerned that legitimate SSH sessions are being dropped. What is the best course of action?
Select an answer first
25expert · hard
A network team is deploying iACLs across their enterprise. They have a mix of Cisco routers and switches. The team wants to verify that the iACL is actually blocking unwanted traffic to infrastructure devices. Which method is most effective for verification?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

A network team is deploying iACLs across their enterprise. They have a mix of Cisco routers and switches. The team wants to verify that the iACL is actually blocking unwanted traffic to infrastructure devices. Which method is most effective for verification?

Keep studying — 3.0 Security Infrastructure