What is the primary purpose of RFC 2827 (BCP 38)?

To define encryption standards for IP traffic

To specify routing protocols for the internet

To prevent IP spoofing by implementing ingress filtering

To provide guidelines for network address translation (NAT)

Which type of attack is RFC 2827 specifically designed to mitigate?

Denial-of-service attacks that use spoofed source addresses

What is the primary action taken when implementing ingress filtering at a network boundary?

Drop packets whose source addresses are not within the network's allocated address range

Allow all packets to pass through to avoid disrupting traffic

Log all incoming packets without any filtering

A regional bank is implementing RFC 2827 (BCP 38) ingress filtering on its internet edge router to comply with ISO 27001 Annex A.12.6.1 (management of technical vulnerabilities) and internal security policies. The router has two interfaces: Gi0/0 connects to the ISP, and Gi0/1 connects to the internal network. The network uses public IP range 203.0.113.0/24 internally. Which ACL configuration should be applied to Gi0/0 to enforce BCP 38?

ip access-group 101 in with ACL 101 denying 203.0.113.0/24 and permitting all other source addresses

ip access-group 101 in with ACL 101 permitting 203.0.113.0/24 and denying all other source addresses

ip access-group 101 in with ACL 101 permitting all source addresses except 0.0.0.0/8

ip access-group 101 out with ACL 101 permitting 203.0.113.0/24 and denying all other source addresses

A manufacturing company is implementing ISO 27001 and needs to protect its industrial control system (ICS) network from the corporate network. The ICS network has legacy devices that cannot be patched. Which control from ISO 27001 Annex A is most relevant to this requirement?

Annex A.13.1.3 - Segregation in networks

Annex A.8.1.1 - Inventory of assets

Annex A.12.6.1 - Management of technical vulnerabilities

Annex A.9.1.1 - Access control policy

CCIE Security

Domain 3Objective 7

3.7 Security Features to Comply with Organizational Security Policies, Procedures, and Standards BCP 38 CCIE-SECURITY Practice Questions (Page 4)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

15%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of RFC 2827 (BCP 38)?
Select an answer first
17foundation · easy
Which type of attack is RFC 2827 specifically designed to mitigate?
Select an answer first
18foundation · easy
What is the primary action taken when implementing ingress filtering at a network boundary?
Select an answer first
19application · medium
A regional bank is implementing RFC 2827 (BCP 38) ingress filtering on its internet edge router to comply with ISO 27001 Annex A.12.6.1 (management of technical vulnerabilities) and internal security policies. The router has two interfaces: Gi0/0 connects to the ISP, and Gi0/1 connects to the internal network. The network uses public IP range 203.0.113.0/24 internally. Which ACL configuration should be applied to Gi0/0 to enforce BCP 38?
Select an answer first
20application · medium
A manufacturing company is implementing ISO 27001 and needs to protect its industrial control system (ICS) network from the corporate network. The ICS network has legacy devices that cannot be patched. Which control from ISO 27001 Annex A is most relevant to this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.