You are securing a BGP session between two routers that are not directly connected (multi-hop eBGP). You want to protect against spoofed BGP packets. Which feature is most appropriate?

BGP TTL security (GTSM) with a hop count of 1.

BGP TTL security (GTSM) with an appropriate hop count.

You are configuring OSPF on a Cisco IOS router that connects to multiple areas. You need to ensure that only specific routes are advertised between areas and that OSPF adjacencies are authenticated. What is the most efficient configuration?

Enable OSPF TTL security on all interfaces.

Use route-maps to set the metric on routes and rely on area filtering.

Configure OSPF authentication on all interfaces and use distribute-lists to filter routes between areas.

Set all interfaces as passive and use static routes.

Your Cisco ASA is running OSPF in a VRF for a customer. The customer requires OSPF authentication and route filtering to ensure only specific subnets are exchanged. You have configured OSPF authentication, but routes are still being exchanged. What is the likely issue?

The route-map is not configured with the correct match criteria.

The OSPF process is not running in the VRF.

The distribute-list is not applied to the correct OSPF process or VRF.

OSPF authentication is not supported in VRFs on ASA.

You are configuring OSPF on a Cisco FTD device. The FTD is managed by FMC, and you need to implement OSPF authentication and route filtering. However, the FMC GUI does not expose all OSPF security options. What is the best approach?

Use a route-map in the FMC GUI to filter routes.

Use the ASA CLI via SSH to configure OSPF.

Use the FTD CLI directly to configure OSPF.

Use FlexConfig to apply advanced OSPF security configurations.

CCIE Security

Domain 1Objective 10

1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 10)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

20%of the exam

Questions 46–50

46expert · hard
You are securing a BGP session between two routers that are not directly connected (multi-hop eBGP). You want to protect against spoofed BGP packets. Which feature is most appropriate?
Select an answer first
47expert · hard
You are configuring OSPF on a Cisco IOS router that connects to multiple areas. You need to ensure that only specific routes are advertised between areas and that OSPF adjacencies are authenticated. What is the most efficient configuration?
Select an answer first
48expert · hard
Your Cisco ASA is running OSPF in a VRF for a customer. The customer requires OSPF authentication and route filtering to ensure only specific subnets are exchanged. You have configured OSPF authentication, but routes are still being exchanged. What is the likely issue?
Select an answer first
49expert · hard
You are configuring OSPF on a Cisco FTD device. The FTD is managed by FMC, and you need to implement OSPF authentication and route filtering. However, the FMC GUI does not expose all OSPF security options. What is the best approach?
Select an answer first
50expert · hard
Your EIGRP network is experiencing route flapping from a remote router. You want to prevent the flapping router from affecting the rest of the network while still allowing it to exchange routes. What is the best EIGRP feature to use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.