A network engineer is configuring OSPF on a Cisco IOS router and wants to ensure that OSPF packets are not sent on an interface that connects to a public segment. The engineer also wants to authenticate OSPF updates on other interfaces. Which configuration should be used?

Set the interface as passive and configure OSPF authentication on the interface.

Configure OSPF authentication on the interface and use a distribute-list to filter routes.

Configure OSPF authentication on the OSPF process and use a prefix-list to filter routes.

Set the interface as passive and configure OSPF authentication on the OSPF process.

An engineer is configuring OSPF on a Cisco ASA firewall that connects to a corporate router. The ASA must authenticate OSPF updates to prevent route injection, and the engineer needs to verify that authentication is working. Which configuration and verification steps are correct?

Configure OSPF authentication with 'area 0 authentication message-digest' and verify with 'show ospf interface' on the ASA.

Configure OSPF authentication using 'ip ospf authentication-key' on the ASA and verify with 'show running-config ospf'.

Configure OSPF authentication with the 'area 0 authentication' command and verify with 'show ospf' on the ASA.

Configure OSPF authentication with 'area 0 authentication' and verify with 'debug ospf adjacency' on the ASA.

A service provider is configuring BGP on a new edge router and wants to protect against route flapping from a customer. The provider also wants to ensure that the customer cannot advertise more routes than what is agreed upon. Which two features should be configured?

BGP TTL security and prefix-list filtering

BGP route dampening and maximum-prefix limit

BGP maximum-prefix limit and TTL security

BGP route dampening and prefix-list filtering

A security engineer is configuring BGP on a Cisco Firepower Threat Defense (FTD) device that peers with an ISP. The engineer must ensure that only the ISP's expected routes are accepted and that BGP sessions are authenticated. Which configuration approach should be used on FTD?

Use FlexConfig to configure a distribute-list under BGP and enable BGP TTL security.

Use FlexConfig to apply a route-map that filters incoming BGP routes and configure BGP MD5 authentication.

Use the FTD CLI to configure a prefix-list and apply it to the BGP neighbor with a route-map.

Use the FTD web interface to configure BGP authentication and a prefix-list for filtering.

A network administrator is configuring route filtering on a Cisco IOS router that runs BGP with multiple customers. The administrator wants to prevent customers from advertising routes that are not their own, and also wants to limit the number of routes received from each customer. Which two mechanisms should be used?

Use a route-map to filter customer routes and enable BGP TTL security to prevent spoofed routes.

Use a distribute-list to filter customer routes and BGP route dampening to limit route flapping.

Use a prefix-list to filter customer routes and a route-map to set a maximum-prefix limit.

Use a prefix-list to filter customer routes and configure the 'maximum-prefix' command on the BGP neighbor.

CCIE Security

Domain 1Objective 10

1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 7)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

20%of the exam

Questions 31–35

31expert · medium
A network engineer is configuring OSPF on a Cisco IOS router and wants to ensure that OSPF packets are not sent on an interface that connects to a public segment. The engineer also wants to authenticate OSPF updates on other interfaces. Which configuration should be used?
Select an answer first
32application · medium
An engineer is configuring OSPF on a Cisco ASA firewall that connects to a corporate router. The ASA must authenticate OSPF updates to prevent route injection, and the engineer needs to verify that authentication is working. Which configuration and verification steps are correct?
Select an answer first
33expert · hard
A service provider is configuring BGP on a new edge router and wants to protect against route flapping from a customer. The provider also wants to ensure that the customer cannot advertise more routes than what is agreed upon. Which two features should be configured?
Select an answer first
34application · hard
A security engineer is configuring BGP on a Cisco Firepower Threat Defense (FTD) device that peers with an ISP. The engineer must ensure that only the ISP's expected routes are accepted and that BGP sessions are authenticated. Which configuration approach should be used on FTD?
Select an answer first
35application · medium
A network administrator is configuring route filtering on a Cisco IOS router that runs BGP with multiple customers. The administrator wants to prevent customers from advertising routes that are not their own, and also wants to limit the number of routes received from each customer. Which two mechanisms should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.