350-601 · Question #420
An engineer must implement protection against ICMP DoS attacks on a Cisco Nexus 9000 Series Switch. The requirement is to rate-limit ICMP without denying all other ICMP traffic. The ICMP trafic curren
The correct answer is D. Apply a control plane service policy that matches all ICMP traffic to drop the traffic fiat exceeds. To protect a Cisco Nexus 9000 Series Switch against ICMP DoS attacks by rate-limiting without denying other ICMP traffic, Control Plane Policing (CoPP) must be configured.
Question
An engineer must implement protection against ICMP DoS attacks on a Cisco Nexus 9000 Series Switch. The requirement is to rate-limit ICMP without denying all other ICMP traffic. The ICMP trafic currently passing through the Cisco Nexus 9000 device must not be affected. Which configuration accomplishes these goals?
Options
- AConfigure SNMP traps to send the ICMP notification if the CPU utilization is more than 90%.
- BReconfigure the Layer 3 interfaces to be in the non-default VRF and ICMP broadcast storm
- CCreate an access list to deny ICMP traffic and apply it to all interlaces in the inside direction.
- DApply a control plane service policy that matches all ICMP traffic to drop the traffic fiat exceeds
How the community answered
(47 responses)- A2% (1)
- B11% (5)
- C6% (3)
- D81% (38)
Why each option
To protect a Cisco Nexus 9000 Series Switch against ICMP DoS attacks by rate-limiting without denying other ICMP traffic, Control Plane Policing (CoPP) must be configured.
Configuring SNMP traps to send notifications is a monitoring and alerting mechanism, not a proactive protection or rate-limiting solution for DoS attacks.
Reconfiguring Layer 3 interfaces to a non-default VRF segments traffic but does not inherently provide rate-limiting protection against ICMP DoS attacks to the control plane.
Creating an access list to *deny* ICMP traffic would block it entirely, which contradicts the requirement to rate-limit without denying all other ICMP traffic.
Applying a control plane service policy that matches ICMP traffic and rate-limits (drops traffic exceeding a threshold) effectively protects the switch's CPU from DoS attacks while allowing legitimate ICMP traffic to pass below the configured rate, satisfying all requirements.
Concept tested: Control Plane Policing (CoPP) for DoS protection
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/qos/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_QoS_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_QoS_Configuration_Guide_7x_chapter_010.html
Topics
Community Discussion
No community discussion yet for this question.