1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network engineer is securing BGP on a router that peers with multiple ISPs. The engineer is concerned about spoofed BGP packets and wants to ensure that only packets from directly connected peers are accepted. Which feature should be enabled?

   • ABGP prefix filtering
   • BBGP TTL security
   • CBGP MD5 authentication
   • DBGP route dampening
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A service provider is experiencing route flapping from a customer edge router. The provider wants to suppress unstable routes while still allowing the customer to recover quickly after the flapping stops. Which BGP feature should be configured on the provider's router?

   • ABGP prefix filtering
   • BBGP TTL security
   • CBGP route dampening
   • DBGP next-hop-self
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network administrator is configuring OSPF on a Cisco IOS router and wants to prevent OSPF hello packets from being sent on an interface that connects to a LAN with no other OSPF routers. The administrator also wants to ensure that OSPF updates on other interfaces are authenticated. Which configuration should be applied?

   • ASet the interface as passive and configure OSPF authentication on the OSPF process.
   • BConfigure OSPF authentication on the interface and use a distribute-list to filter OSPF routes.
   • CConfigure OSPF authentication on the OSPF process and use a prefix-list to filter OSPF routes.
   • DSet the interface as passive and configure OSPF authentication on the interface.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network engineer is configuring EIGRP on a Cisco IOS router and wants to authenticate EIGRP updates to prevent route injection. The engineer also wants to ensure that EIGRP hello packets are not sent on an interface that connects to a stub network. Which configuration should be used?

   • AConfigure EIGRP authentication on the EIGRP process and use a distribute-list to filter routes.
   • BConfigure EIGRP MD5 authentication on the interface and set the interface as passive.
   • CConfigure EIGRP authentication on the interface and use a prefix-list to filter EIGRP routes.
   • DConfigure EIGRP authentication with a clear-text key and set the interface as passive.
   Reveal Solution Discussion Select an answer first
6. 40application · hard

   A service provider uses MPLS VPNs and wants to secure routing protocols within each VRF. The provider is using OSPF as the PE-CE routing protocol and wants to authenticate OSPF updates between the PE and CE routers. Which configuration is required on the Cisco IOS PE router?

   • AConfigure OSPF authentication using a route-map under the VRF.
   • BConfigure OSPF authentication on the VRF interface using 'ip ospf authentication-key' and 'ip ospf authentication'.
   • CConfigure OSPF authentication under the VRF OSPF process and apply it to the VRF interface.
   • DConfigure OSPF authentication globally and it will apply to all VRFs.
   Reveal Solution Discussion Select an answer first