1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   You administer an OSPF network running on Cisco IOS routers. A security audit requires that OSPF adjacencies only form with trusted neighbors and that OSPF hello packets are not sent to unauthorized segments. What configuration change would you implement?

   • AEnable OSPF authentication on all interfaces and set the interfaces to passive where no neighbors exist.
   • BIncrease the OSPF hello and dead timers to reduce exposure.
   • CUse a distribute-list to filter OSPF routes from untrusted neighbors.
   • DSet the OSPF network type to point-to-point on all interfaces.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   Your Cisco ASA is running OSPF inside a VRF for a customer segment. The customer requires that OSPF adjacencies be authenticated and that only specific routes are exchanged with the customer's router. What is the most efficient way to meet both requirements on the ASA?

   • AEnable OSPF TTL security on the customer-facing interface.
   • BUse a route-map to set the metric on routes and rely on the customer to filter.
   • CConfigure OSPF authentication under the VRF's OSPF process and apply a distribute-list inbound/outbound.
   • DPlace the customer-facing interface in a passive state.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   You are configuring a Cisco FTD device that runs OSPF with a service provider router. The security policy requires that only the service provider router can form an adjacency and that OSPF packets from other sources are ignored. Which configuration approach should you use on the FTD?

   • AConfigure OSPF authentication and OSPF TTL security on the FTD's OSPF interface.
   • BUse a prefix-list to filter OSPF routes from the service provider.
   • CApply a route-map to set the administrative distance for OSPF routes.
   • DSet the OSPF interface as passive.
   Reveal Solution Discussion Select an answer first
5. 54application · easy

   Your BGP router is experiencing route flapping from a peer, causing instability in your network. You want to suppress unstable routes while still allowing stable routes to be advertised. Which BGP feature should you enable?

   • ABGP TTL security
   • BBGP next-hop-self
   • CBGP route dampening
   • DBGP prefix filtering
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   Your EIGRP network includes several remote sites connected via WAN links. You want to ensure that only authorized routers can exchange EIGRP updates and that EIGRP hello packets are not sent to the WAN provider's network. What should you configure on the Cisco IOS routers?

   • ASet the EIGRP hello interval to a higher value on the WAN interface.
   • BConfigure EIGRP stub on the remote routers.
   • CUse a distribute-list to filter EIGRP routes from the WAN.
   • DEnable EIGRP authentication on all interfaces and set the WAN-facing interface as passive.
   Reveal Solution Discussion Select an answer first