A network administrator is reviewing security best practices for edge routers. They notice that IP source routing is enabled by default. What is the primary security concern with leaving IP source routing enabled?

It causes the router to forward packets with private IP addresses to the internet.

It increases the CPU load on the router because it requires additional processing for each packet.

It allows attackers to bypass access control lists and route traffic through unintended paths, potentially reaching protected infrastructure.

It enables the router to accept routing updates from unauthorized peers.

A network architect is designing security controls for a new data center. They want to prevent external attackers from sending traffic directly to the management interfaces of core switches and routers. Which technique should they implement?

Use a single VLAN for all management traffic and rely on VLAN separation.

Configure CoPP to drop all traffic to the control plane.

Enable IP source routing on all devices to allow only trusted paths.

Deploy infrastructure access control lists (iACLs) on edge interfaces to filter traffic destined to infrastructure device IP addresses.

A network engineer is designing an iACL to protect the management plane of a router. The router has a loopback interface with IP 10.0.0.1/32 used for management. The engineer wants to allow SSH from a management subnet 192.168.1.0/24 and deny all other traffic to the loopback. Which ACL configuration is correct?

access-list 101 permit ip any host 10.0.0.1 access-list 101 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 22

access-list 101 deny ip any host 10.0.0.1 access-list 101 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 22

access-list 101 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 22 access-list 101 deny ip any host 10.0.0.1

access-list 101 permit tcp host 10.0.0.1 192.168.1.0 0.0.0.255 eq 22

A network team is implementing iACLs to protect their core infrastructure. They have two edge routers connecting to the internet. Where should the iACL be applied to be most effective?

On the management interface of the router.

On the inbound direction of the core switch's interface facing the edge router.

On the inbound direction of the edge router's internet-facing interface.

On the outbound direction of the edge router's internet-facing interface.

CCIE Security

Domain 3Objective 1

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 7)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

15%of the exam

Questions 31–35

31application · medium
A network administrator is reviewing security best practices for edge routers. They notice that IP source routing is enabled by default. What is the primary security concern with leaving IP source routing enabled?
Select an answer first
32application · easy
A company's security policy requires that all routers and switches disable IP source routing to prevent packet redirection attacks. Which configuration command should be applied on Cisco IOS devices?
Select an answer first
33application · medium
A network architect is designing security controls for a new data center. They want to prevent external attackers from sending traffic directly to the management interfaces of core switches and routers. Which technique should they implement?
Select an answer first
34application · medium
A network engineer is designing an iACL to protect the management plane of a router. The router has a loopback interface with IP 10.0.0.1/32 used for management. The engineer wants to allow SSH from a management subnet 192.168.1.0/24 and deny all other traffic to the loopback. Which ACL configuration is correct?
Select an answer first
35application · medium
A network team is implementing iACLs to protect their core infrastructure. They have two edge routers connecting to the internet. Where should the iACL be applied to be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.1 Device Hardening Techniques and Control Plane Protection Methods CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

A network administrator is reviewing security best practices for edge routers. They notice that IP source routing is enabled by default. What is the primary security concern with leaving IP source routing enabled?

A company's security policy requires that all routers and switches disable IP source routing to prevent packet redirection attacks. Which configuration command should be applied on Cisco IOS devices?

A network architect is designing security controls for a new data center. They want to prevent external attackers from sending traffic directly to the management interfaces of core switches and routers. Which technique should they implement?

A network team is implementing iACLs to protect their core infrastructure. They have two edge routers connecting to the internet. Where should the iACL be applied to be most effective?

Keep studying — 3.0 Security Infrastructure