nerdexam
Cisco

352-001 · Question #216

Which of these can you use to effectively and dynamically reduce IP address spoofing?

The correct answer is E. unicast Reverse Path Forwarding. Unicast Reverse Path Forwarding (uRPF) dynamically prevents IP address spoofing by verifying that incoming packets arrive on the interface the router would use to reach the claimed source address.

Designing Security

Question

Which of these can you use to effectively and dynamically reduce IP address spoofing?

Options

  • AEgress Packet Filtering
  • BIngress Packet Filtering
  • CEgress Route Filtering
  • Droute dampening
  • Eunicast Reverse Path Forwarding

How the community answered

(36 responses)
  • B
    3% (1)
  • C
    3% (1)
  • E
    94% (34)

Why each option

Unicast Reverse Path Forwarding (uRPF) dynamically prevents IP address spoofing by verifying that incoming packets arrive on the interface the router would use to reach the claimed source address.

AEgress Packet Filtering

Egress packet filtering operates on outbound traffic leaving the network and cannot intercept spoofed source addresses as they enter at ingress interfaces.

BIngress Packet Filtering

Ingress packet filtering via ACLs can block known spoofed ranges but requires manually maintained static rules that do not adapt dynamically when routing topology changes.

CEgress Route Filtering

Egress route filtering controls which BGP/routing prefixes are advertised to peers and has no effect on data-plane packets with spoofed source IP addresses.

Droute dampening

Route dampening suppresses unstable BGP prefixes to reduce routing table churn and is entirely unrelated to blocking spoofed source IP addresses in forwarded traffic.

Eunicast Reverse Path ForwardingCorrect

uRPF consults the live FIB/routing table to check that the source IP of each incoming packet is reachable via the interface it arrived on, dropping packets whose source addresses fail this symmetry check. Because it references the live routing table, it adapts automatically as routes change - making it dynamic unlike static ACLs. In strict mode it requires an exact path match, while loose mode checks only for route existence, both effectively blocking spoofed non-routable source addresses.

Concept tested: Unicast Reverse Path Forwarding for anti-spoofing

Source: https://www.cisco.com/c/en/us/about/security-center/unicast-reverse-path-forwarding.html

Topics

#uRPF#IP spoofing#ingress filtering#anti-spoofing

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice