3.2 Management Plane Protection Techniques CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network administrator is configuring a Cisco router that will be deployed in a DMZ. The administrator wants to ensure that the router's memory is protected from potential attacks that could cause memory exhaustion. The administrator also wants to monitor memory usage to detect anomalies. Which configuration should the administrator implement?

   • AUse CoPP to police all traffic to the control plane.
   • BConfigure memory thresholds and enable SNMP traps for memory usage.
   • CDisable all management protocols to reduce memory usage.
   • DIncrease the router's memory by adding a new memory module.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is implementing a new network management policy that requires all network devices to be accessed securely. The policy mandates that only authorized administrators can access the devices, and all access must be logged. Which set of configurations should be applied to meet these requirements?

   • AEnable Telnet and use a shared password for all administrators.
   • BEnable SSH, configure AAA for authentication and authorization, and use RBAC to restrict commands.
   • CUse SNMPv3 with a single community string for all management.
   • DDisable all remote access and require console access only.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator is securing a router that is accessible from the internet. The administrator wants to restrict management access to only the IT department's IP addresses and ensure that all management sessions are encrypted. Which configuration should be applied?

   • AUse SNMPv3 with a community string that is kept secret.
   • BDisable all VTY access and use only the console port.
   • CEnable Telnet and apply an ACL that permits all IP addresses.
   • DApply an ACL on the VTY lines that permits only the IT department's IP addresses, and enable SSH.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network engineer is reviewing the security posture of a legacy router. The engineer finds that the router has several insecure services enabled, such as HTTP server, Telnet, and SNMPv1. The engineer wants to apply best practices for management plane protection. Which action should the engineer take?

   • AEnable all services to ensure maximum functionality.
   • BKeep the services enabled but restrict them with ACLs.
   • CDisable insecure services and enable secure alternatives such as HTTPS, SSH, and SNMPv3.
   • DUse CoPP to rate-limit traffic to the insecure services.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is configuring a new router that will be deployed in a high-availability environment. The administrator wants to ensure that the control plane is protected from DoS attacks while maintaining high availability for routing protocols. Which approach should the administrator take?

   • ADisable all routing protocols to reduce CPU load.
   • BImplement CoPP with a class that prioritizes routing protocols and rate-limits other traffic.
   • CIncrease the router's CPU priority to handle more traffic.
   • DUse ACLs to block all traffic to the control plane except from trusted sources.
   Reveal Solution Discussion Select an answer first