A network architect plans to implement MPLS OAM to provide additional troubleshooting functionality for the NOC team. After analyzing the configuration on the MPLS P/PE nodes, the architect decides…

Question

Options

• AAllow port 3505 in the outbound direction only.
• BAllow the ICMP protocol only.
• CAllow the TCP and UDP protocols.
• DAllow the UDP protocol only.
• EAllow port 3503 in the inbound direction only.

• A
  5% (2)
• B
  20% (9)
• C
  9% (4)
• D
  66% (29)

Explanation

MPLS OAM (specifically LSP Ping/Traceroute per RFC 4379) uses UDP port 3503 exclusively for echo request/reply operations. A secure CoPP policy should permit only what is strictly necessary: UDP only (D) because MPLS OAM has no TCP dependency, and port 3503 inbound only (E) because echo requests arrive at the control plane from outside - limiting to inbound prevents attackers from exploiting an outbound-facing permit entry to craft malicious responses.

Why the distractors fail:

• A - Port 3505 is not used by MPLS OAM (3503 is the IANA-assigned port), and "outbound only" is the wrong direction for control-plane protection.
• B - ICMP alone would completely block MPLS OAM, which requires UDP; this breaks the feature entirely.
• C - Allowing both TCP and UDP violates least-privilege; TCP is unnecessary and widens the attack surface on the control plane.

Memory tip: Think "3503 UDP In" - MPLS OAM echo requests arrive in to the router on UDP port 3503. If a choice says TCP, 3505, or outbound, eliminate it immediately.

No community discussion yet for this question.