1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A network engineer is configuring BGP on a Cisco ASA firewall that connects to a service provider. The engineer wants to authenticate the BGP session and also ensure that only the provider's routes are accepted. Which configuration is correct on the ASA?

   • AConfigure BGP MD5 authentication using the 'neighbor password' command and a prefix-list to filter routes.
   • BConfigure BGP TTL security and use a distribute-list to filter routes.
   • CConfigure BGP MD5 authentication using the 'neighbor password' command and a route-map to filter routes.
   • DConfigure BGP authentication using the 'neighbor password' command and use a route-map to set next-hop-self.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security engineer is configuring BGP on a Cisco FTD device and needs to implement BGP TTL security to protect against spoofed packets. However, the FTD management interface does not expose this option. What should the engineer do?

   • AConfigure BGP MD5 authentication instead, as it provides the same protection.
   • BUse FlexConfig to apply the 'neighbor ttl-security' command to the BGP configuration.
   • CUse the FTD web interface to enable BGP TTL security.
   • DUse the FTD CLI to configure BGP TTL security directly.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A service provider is implementing MPLS L3VPN and wants to secure the routing protocol between PE and CE routers. The provider uses EIGRP as the PE-CE protocol and wants to authenticate EIGRP updates within a VRF. Which configuration is required on the Cisco IOS PE router?

   • AConfigure EIGRP authentication using a route-map under the VRF.
   • BConfigure EIGRP authentication on the VRF interface using a key chain.
   • CConfigure EIGRP authentication under the VRF EIGRP process.
   • DConfigure EIGRP authentication globally and it will apply to all VRFs.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A network engineer is troubleshooting an OSPF adjacency problem on a Cisco IOS router. The engineer has verified that OSPF authentication is configured correctly on both sides, but the adjacency is still not forming. Which command should be used to see if OSPF packets are being dropped due to authentication mismatch?

   • Ashow ip ospf interface
   • Bshow ip ospf neighbor
   • Cdebug ip ospf adjacency
   • Dshow logging
   Reveal Solution Discussion Select an answer first
6. 30expert · hard · select all that apply

   A network architect is designing BGP security for a multi-homed enterprise. The architect wants to protect against route injection, spoofing, and route flapping. Which of the following measures should be implemented? (Select all that apply.)

   • ABGP route dampening
   • BBGP next-hop-self
   • CBGP prefix filtering
   • DBGP TTL security
   Check answers Discussion Select an answer first