3.2 Management Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network engineer is configuring a new Cisco router that will be deployed at a branch office. The router's control plane has been experiencing high CPU utilization due to excessive ICMP and SNMP traffic. The engineer wants to protect the control plane CPU while still allowing legitimate management traffic. Which configuration approach should the engineer implement?

   • AIncrease the router's CPU clock speed to handle the extra load.
   • BDisable ICMP and SNMP services on all interfaces to eliminate the excessive traffic.
   • CApply a CoPP policy that classifies and rate-limits control plane traffic, with a dedicated class for ICMP and SNMP.
   • DUse an access list to permit only specific source IP addresses to reach the control plane.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network administrator is concerned about a potential memory exhaustion attack on a core switch. The administrator wants to configure the switch to automatically take action when memory usage reaches a critical level. Which configuration should be implemented?

   • AConfigure memory thresholds with actions such as dropping packets or generating syslog messages.
   • BUse CoPP to limit all traffic to the control plane.
   • CDisable all features that use memory to reduce usage.
   • DIncrease the switch's memory by adding more RAM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network engineer is configuring a router that will be managed remotely. The engineer wants to ensure that memory usage is monitored and that the router sends alerts when memory usage is high. Which configuration should be applied?

   • AConfigure memory thresholds and enable SNMP traps for memory usage.
   • BDisable all management protocols to reduce memory usage.
   • CEnable SSH and configure AAA for remote access.
   • DUse CoPP to police all traffic to the control plane.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is implementing a new security policy that requires all network devices to use role-based access control (RBAC) to limit the commands that administrators can execute. The policy also requires that all management access be encrypted. Which configuration should be applied to meet these requirements?

   • AUse SNMPv3 with a single community string for all management.
   • BEnable Telnet and use a single password for all administrators.
   • CDisable all remote access and use only the console port.
   • DConfigure AAA with RBAC and enable SSH for remote access.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A large enterprise is deploying a new core router. The security team has identified that the router is vulnerable to control plane DoS attacks. The team wants to implement a solution that protects the control plane CPU while ensuring that legitimate management traffic (SSH, SNMP) and routing protocols (OSPF, BGP) are not dropped. The solution must also restrict management access to only the network operations center (NOC) IP addresses. Which configuration approach should be implemented?

   • AImplement CoPP with separate classes for routing protocols (high priority), management traffic (medium priority), and other traffic (low priority), and apply an ACL on VTY lines to restrict management access to NOC IPs.
   • BDisable all management protocols and use only console access for management.
   • CImplement CoPP with a single class that rate-limits all control plane traffic equally, and use SSH for management.
   • DUse ACLs to permit only NOC IPs to reach the control plane, and enable Telnet for management.
   Reveal Solution Discussion Select an answer first