nerdexam
Cisco

350-501 · Question #558

Refer to the exhibit. After network monitoring detected unusual traffic between CE1 and the file server, the network security team identified an attempted DDoS attack against the file server from…

The correct answer is D. Implement RTBH and redirect the unwanted traffic to Null0 at the edge oft he service provider. To reduce network load from a DDoS attack originating outside the service provider network, the team must implement Remotely Triggered Black Hole (RTBH) routing to redirect and drop unwanted traffic at the network edge.

Services

Question

Refer to the exhibit. After network monitoring detected unusual traffic between CE1 and the file server, the network security team identified an attempted DDoS attack against the file server from outside the service provider network. How must the team reduce the network load from over utilization?

Exhibit

350-501 question #558 exhibit

Options

  • AImplement port security on PE1 and PE2 to drop traffic entering the network from unwanted MAC
  • BImplement CDP to identify neighbors and block those that are suspicious.
  • CImplement two-factor authentication on the server to prevent unwanted users from accessing the
  • DImplement RTBH and redirect the unwanted traffic to Null0 at the edge oft he service provider

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    9% (4)
  • C
    7% (3)
  • D
    81% (35)

Why each option

To reduce network load from a DDoS attack originating outside the service provider network, the team must implement Remotely Triggered Black Hole (RTBH) routing to redirect and drop unwanted traffic at the network edge.

AImplement port security on PE1 and PE2 to drop traffic entering the network from unwanted MAC

Port security operates at Layer 2 and is typically applied on access ports to control traffic based on MAC addresses, which is not suitable for mitigating a DDoS attack originating from outside the service provider's network.

BImplement CDP to identify neighbors and block those that are suspicious.

CDP (Cisco Discovery Protocol) is used for discovering directly connected Cisco devices and has no mechanism to identify or block suspicious traffic related to a DDoS attack.

CImplement two-factor authentication on the server to prevent unwanted users from accessing the

Two-factor authentication is an access control mechanism for user logins and does not help in reducing network load from a volumetric DDoS attack at the network layer.

DImplement RTBH and redirect the unwanted traffic to Null0 at the edge oft he service providerCorrect

Remotely Triggered Black Hole (RTBH) routing is an effective technique to mitigate DDoS attacks by advertising a route for the attack's destination (the file server) to a null interface (Null0) at the network's edge. This causes all traffic destined for the attacked server to be dropped as close to the source as possible within the service provider's network, preventing it from consuming resources deeper in the network.

Concept tested: DDoS mitigation with Remotely Triggered Black Hole

Source: https://www.cisco.com/c/en/us/products/collateral/security/remote-triggered-black-hole-rtbh-routing/prod_white_paper0900aecd8046714a.html

Topics

#DDoS Mitigation#RTBH#Service Provider Security#BGP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-501 Practice