352-001 · Question #665
What are two base components of both a source-based remotely triggered black hole and a destination- based remotely triggered black hole filtering solution? (Choose two.)
The correct answer is B. static route withthe next hop pointing to the Null0 interface D. triggered IBGP update setting next hop to a predetermined, unused IP address. Both source-based and destination-based RTBH require a Null0 static route as the actual drop mechanism and an iBGP trigger to signal all routers to install the black hole.
Question
What are two base components of both a source-based remotely triggered black hole and a destination- based remotely triggered black hole filtering solution? (Choose two.)
Options
- ANetFlow
- Bstatic route withthe next hop pointing to the Null0 interface
- Cinfrastructure access list
- Dtriggered IBGP update setting next hop to a predetermined, unused IP address
- EuRPF
How the community answered
(29 responses)- A3% (1)
- B83% (24)
- C7% (2)
- E7% (2)
Why each option
Both source-based and destination-based RTBH require a Null0 static route as the actual drop mechanism and an iBGP trigger to signal all routers to install the black hole.
NetFlow is a traffic telemetry and accounting tool used to observe flows; it plays no role in the forwarding-plane drop mechanism required by RTBH.
The static route to Null0 is the black hole itself - it must exist on all enforcing routers so that when the triggered next hop is resolved, traffic matching the prefix is silently discarded rather than forwarded.
Infrastructure ACLs protect routing and management plane resources and are a completely separate security construct not involved in the RTBH trigger-and-drop architecture.
A triggered iBGP update advertising a predetermined unused IP address as the BGP next hop is the signaling mechanism that distributes the black hole instruction from the trigger router to all other participating routers in the network.
uRPF is specifically required for source-based RTBH to validate and drop packets whose source address is tagged for black-holing, but it is not a component of destination-based RTBH and therefore not common to both variants.
Concept tested: Remotely triggered black hole filtering base architecture
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16/sec-data-acl-xe-16-book/sec-remotely-trig-bhole.html
Topics
Community Discussion
No community discussion yet for this question.