nerdexam
Cisco

352-001 · Question #665

What are two base components of both a source-based remotely triggered black hole and a destination- based remotely triggered black hole filtering solution? (Choose two.)

The correct answer is B. static route withthe next hop pointing to the Null0 interface D. triggered IBGP update setting next hop to a predetermined, unused IP address. Both source-based and destination-based RTBH require a Null0 static route as the actual drop mechanism and an iBGP trigger to signal all routers to install the black hole.

Designing Security

Question

What are two base components of both a source-based remotely triggered black hole and a destination- based remotely triggered black hole filtering solution? (Choose two.)

Options

  • ANetFlow
  • Bstatic route withthe next hop pointing to the Null0 interface
  • Cinfrastructure access list
  • Dtriggered IBGP update setting next hop to a predetermined, unused IP address
  • EuRPF

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    83% (24)
  • C
    7% (2)
  • E
    7% (2)

Why each option

Both source-based and destination-based RTBH require a Null0 static route as the actual drop mechanism and an iBGP trigger to signal all routers to install the black hole.

ANetFlow

NetFlow is a traffic telemetry and accounting tool used to observe flows; it plays no role in the forwarding-plane drop mechanism required by RTBH.

Bstatic route withthe next hop pointing to the Null0 interfaceCorrect

The static route to Null0 is the black hole itself - it must exist on all enforcing routers so that when the triggered next hop is resolved, traffic matching the prefix is silently discarded rather than forwarded.

Cinfrastructure access list

Infrastructure ACLs protect routing and management plane resources and are a completely separate security construct not involved in the RTBH trigger-and-drop architecture.

Dtriggered IBGP update setting next hop to a predetermined, unused IP addressCorrect

A triggered iBGP update advertising a predetermined unused IP address as the BGP next hop is the signaling mechanism that distributes the black hole instruction from the trigger router to all other participating routers in the network.

EuRPF

uRPF is specifically required for source-based RTBH to validate and drop packets whose source address is tagged for black-holing, but it is not a component of destination-based RTBH and therefore not common to both variants.

Concept tested: Remotely triggered black hole filtering base architecture

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16/sec-data-acl-xe-16-book/sec-remotely-trig-bhole.html

Topics

#RTBH#black hole filtering#BGP triggered update#Null0 route

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice