A network engineer is designing CoPP for a router that is experiencing frequent DDoS attacks. The engineer wants to ensure that the router's CPU is protected, but also wants to maintain the ability to troubleshoot by allowing ICMP echo requests from a specific network operations center (NOC). Which CoPP configuration best meets these requirements?

Create a class that matches ICMP from the NOC subnet and apply a police action with a high rate, and a separate class for all other ICMP with a low rate or drop.

Create a single class for all ICMP traffic and apply a police action with a moderate rate.

Disable ICMP echo replies on the router entirely.

Use an iACL to permit ICMP from the NOC and deny all other ICMP to the router.

A security consultant is reviewing a router's configuration and finds that IP source routing is enabled. The router also has an iACL that permits traffic from a specific partner network to access a management interface. The consultant is concerned about the combination of these two settings. What is the most significant risk?

The iACL will be more effective because source routing provides additional path control.

The router will drop all packets that have source routing options.

The router will automatically disable the iACL when source routing is enabled.

An attacker from the partner network could use source routing to bypass the iACL and access other infrastructure devices.

A security engineer is configuring CoPP on a new edge router. They have created a class map that matches SSH, SNMP, and BGP traffic. What is the next step to apply the policy?

Apply the class map to all physical interfaces using the 'service-policy' command.

Use the 'control-plane' command to enter the control plane configuration mode and then apply the class map.

Create a policy map that assigns an action (e.g., police or drop) to the class, then apply the policy map to the control plane with the 'service-policy' command.

Apply the class map directly to the control plane interface using the 'service-policy' command.

A network architect is designing a defense-in-depth strategy for the management plane of network devices. They plan to use both iACLs and CoPP. What is the primary advantage of using iACLs in addition to CoPP?

iACLs are applied on the control plane, while CoPP is applied on interfaces.

iACLs provide coarse-grained filtering based on source/destination IP addresses, while CoPP provides rate-limiting and prioritization of control plane traffic.

iACLs can inspect application-layer payloads, while CoPP cannot.

iACLs are easier to configure than CoPP and can replace CoPP entirely.

CCIE Security

Domain 3Objective 1

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 6)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

15%of the exam

Questions 26–30

26expert · hard
A network engineer is designing CoPP for a router that is experiencing frequent DDoS attacks. The engineer wants to ensure that the router's CPU is protected, but also wants to maintain the ability to troubleshoot by allowing ICMP echo requests from a specific network operations center (NOC). Which CoPP configuration best meets these requirements?
Select an answer first
27expert · hard
A security consultant is reviewing a router's configuration and finds that IP source routing is enabled. The router also has an iACL that permits traffic from a specific partner network to access a management interface. The consultant is concerned about the combination of these two settings. What is the most significant risk?
Select an answer first
28application · medium
A security engineer is configuring CoPP on a new edge router. They have created a class map that matches SSH, SNMP, and BGP traffic. What is the next step to apply the policy?
Select an answer first
29expert · hard
A network architect is designing a defense-in-depth strategy for the management plane of network devices. They plan to use both iACLs and CoPP. What is the primary advantage of using iACLs in addition to CoPP?
Select an answer first
30application · medium
After implementing CoPP on a router, the network team wants to confirm that the policy is working and not dropping legitimate control plane traffic. Which command should they use to check the number of packets dropped by each class?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

A security engineer is configuring CoPP on a new edge router. They have created a class map that matches SSH, SNMP, and BGP traffic. What is the next step to apply the policy?

A network architect is designing a defense-in-depth strategy for the management plane of network devices. They plan to use both iACLs and CoPP. What is the primary advantage of using iACLs in addition to CoPP?

After implementing CoPP on a router, the network team wants to confirm that the policy is working and not dropping legitimate control plane traffic. Which command should they use to check the number of packets dropped by each class?

Keep studying — 3.0 Security Infrastructure