Your company's BGP edge router receives full Internet routes from two ISPs. A recent route leak caused traffic to be black-holed for 30 minutes. Management wants to minimize the risk of accepting invalid or malicious prefixes while keeping operational overhead low. Which two actions should you implement on the edge router?

Configure a passive interface on the BGP neighbor-facing interface.

Apply inbound prefix-list filters to both ISP neighbors and enable BGP TTL security.

Enable BGP route dampening and set a high penalty for all prefixes.

Use a route-map to set a lower local preference on all inbound routes.

Your BGP edge router receives full Internet routes from two ISPs. You need to prevent the acceptance of your own AS's prefixes (to avoid routing loops) and also protect against BGP session spoofing. You have limited CPU resources. Which two actions are most efficient and effective?

Apply an inbound prefix-list that denies your own prefixes and enable BGP TTL security.

Enable BGP next-hop-self on all eBGP sessions.

Configure a route-map to set a lower local preference on your own prefixes.

Use BGP route dampening and set a high penalty for all prefixes.

You are migrating an OSPF network from MD5 authentication to HMAC-SHA256 for stronger security. During the migration, you need to maintain adjacency without downtime. What is the best approach?

Change all routers at the same time to HMAC-SHA256.

Use a route-map to change the authentication type dynamically.

Disable authentication temporarily and then re-enable with new algorithm.

Configure multiple OSPF keys with different key IDs and roll over gradually.

Your BGP network is experiencing route flapping from a peer, causing instability. You want to suppress unstable routes while still allowing stable routes to be advertised. However, you also need to ensure that legitimate new routes are not suppressed immediately. What is the best configuration?

Enable BGP route dampening with a high suppress threshold and a low reuse threshold.

Enable BGP route dampening with default values.

Set a high administrative distance for the flapping peer's routes.

Use BGP prefix filtering to block flapping routes.

CCIE Security

Domain 1Objective 10

1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 9)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

20%of the exam

Questions 41–45

41application · medium
Your company's BGP edge router receives full Internet routes from two ISPs. A recent route leak caused traffic to be black-holed for 30 minutes. Management wants to minimize the risk of accepting invalid or malicious prefixes while keeping operational overhead low. Which two actions should you implement on the edge router?
Select an answer first
42application · medium
You are troubleshooting an OSPF adjacency problem on a Cisco IOS router. The neighbor is not coming up, and you suspect that OSPF authentication is failing. Which debug command would provide the most useful information?
Select an answer first
43expert · hard
Your BGP edge router receives full Internet routes from two ISPs. You need to prevent the acceptance of your own AS's prefixes (to avoid routing loops) and also protect against BGP session spoofing. You have limited CPU resources. Which two actions are most efficient and effective?
Select an answer first
44expert · hard
You are migrating an OSPF network from MD5 authentication to HMAC-SHA256 for stronger security. During the migration, you need to maintain adjacency without downtime. What is the best approach?
Select an answer first
45expert · hard
Your BGP network is experiencing route flapping from a peer, causing instability. You want to suppress unstable routes while still allowing stable routes to be advertised. However, you also need to ensure that legitimate new routes are not suppressed immediately. What is the best configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.10 Routing Protocols Security on Cisco IOS, Cisco ASA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

You are troubleshooting an OSPF adjacency problem on a Cisco IOS router. The neighbor is not coming up, and you suspect that OSPF authentication is failing. Which debug command would provide the most useful information?

Your BGP edge router receives full Internet routes from two ISPs. You need to prevent the acceptance of your own AS's prefixes (to avoid routing loops) and also protect against BGP session spoofing. You have limited CPU resources. Which two actions are most efficient and effective?

You are migrating an OSPF network from MD5 authentication to HMAC-SHA256 for stronger security. During the migration, you need to maintain adjacency without downtime. What is the best approach?

Your BGP network is experiencing route flapping from a peer, causing instability. You want to suppress unstable routes while still allowing stable routes to be advertised. However, you also need to ensure that legitimate new routes are not suppressed immediately. What is the best configuration?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention