1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is securing OSPF on a Cisco IOS router that connects to a service provider over an Ethernet link. The engineer wants to prevent OSPF adjacencies from being formed with unauthorized devices on the shared segment, while also ensuring that OSPF hello packets are not sent to devices that do not need to participate. Which two actions should the engineer take?

   • AConfigure OSPF HMAC-SHA256 authentication and use a prefix-list to filter OSPF routes.
   • BConfigure OSPF MD5 authentication on the interface and use a distribute-list to filter OSPF routes.
   • CConfigure OSPF authentication with a clear-text password and set the interface to passive.
   • DConfigure OSPF MD5 authentication on the interface and set the interface as passive.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A network engineer is troubleshooting an OSPF adjacency issue on a Cisco IOS router. The engineer suspects that OSPF authentication is failing. Which command should be used to verify the authentication configuration on the interface?

   • Ashow ip ospf interface
   • Bshow ip ospf neighbor
   • Cdebug ip ospf adjacency
   • Dshow ip route ospf
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise is deploying BGP between its edge routers and two ISPs. The security team requires that BGP sessions be protected from spoofing and that only legitimate prefixes from each ISP be accepted. The team also wants to minimize the risk of route flapping affecting the network. Which combination of features should be implemented?

   • ABGP MD5 authentication, route dampening, and next-hop-self
   • BBGP TTL security, prefix-list filtering, and route dampening
   • CBGP TTL security, route dampening, and maximum-prefix limit
   • DBGP prefix-list filtering, route dampening, and passive interface
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network engineer is upgrading OSPF authentication from MD5 to HMAC-SHA256 on a Cisco IOS router to meet new security compliance. The engineer must ensure that the transition does not cause an adjacency flap. What is the best approach?

   • AConfigure the new HMAC key and remove the old MD5 key simultaneously.
   • BConfigure the new HMAC key and keep the old MD5 key until all neighbors are updated.
   • CChange the authentication type to HMAC and then configure the key.
   • DUse a route-map to gradually change authentication.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A service provider is configuring BGP on a new edge router and wants to enforce strict inbound route filtering for customers. The provider has a list of customer prefixes and wants to ensure that customers cannot advertise more-specific routes than what is allocated. Which filtering technique should be used?

   • AUse a distribute-list with an access-list that matches the exact prefixes.
   • BUse a route-map with a match statement on the AS-path access-list.
   • CUse a prefix-list with ge and le operators to match only the exact prefix lengths.
   • DUse BGP route dampening to suppress more-specific routes.
   Reveal Solution Discussion Select an answer first