350-501 · Question #211
Refer to the exhibit. An engineer is securing a customer's network. Which command completes this configuration and the engineer must use to prevent a DoS attack?
The correct answer is C. ttl-security. The question asks to identify the command that completes a BGP security configuration to prevent Denial of Service (DoS) attacks by validating packet TTL.
Question
Refer to the exhibit. An engineer is securing a customer's network. Which command completes this configuration and the engineer must use to prevent a DoS attack?
Options
- Aneighbor ebgp-multihop
- Bebgp'multihop
- Cttl-security
- Dneighbor ttl-security
How the community answered
(45 responses)- A18% (8)
- B4% (2)
- C71% (32)
- D7% (3)
Why each option
The question asks to identify the command that completes a BGP security configuration to prevent Denial of Service (DoS) attacks by validating packet TTL.
`neighbor ebgp-multihop` allows establishing eBGP sessions between non-directly connected peers but does not, by itself, provide security against DoS attacks by validating TTL values.
`ebgp'multihop` appears to be a syntactical error or typo; the correct command is `ebgp-multihop`.
The `ttl-security` command is a BGP feature used to protect eBGP sessions by verifying the Time-to-Live (TTL) value of incoming BGP packets. It ensures that packets originate from expected distances (e.g., direct neighbor with TTL 255) and drops those with unexpected TTLs, mitigating certain DoS attacks.
`neighbor ttl-security` is part of the command structure, but 'ttl-security' is the core keyword representing the feature being enabled to complete the security configuration, typically followed by `hops <value>`.
Concept tested: BGP TTL security for DoS protection
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/15-mt/irs-15-mt-book/irs-bgp-ttl-security.html
Topics
Community Discussion
No community discussion yet for this question.