nerdexam
Cisco

352-001 · Question #68

You are a network designer and have been asked to consult with your server operations team to further enhance the security of the network. The operations team provides you with these details about…

The correct answer is D. Unicast Reverse Path Forwarding in loose mode. uRPF loose mode blocks packets with source IP addresses absent from the routing table, stopping spoofed or attacker-originated traffic while remaining compatible with the asymmetric routing present in this environment.

Designing Security

Question

You are a network designer and have been asked to consult with your server operations team to further enhance the security of the network. The operations team provides you with these details about the network:

  • A pool of servers is accessed by numerous data centers and remote sites.
  • The servers are accessed via a cluster of firewalls.
  • The firewalls are configured properly and are not dropping traffic.
  • The firewalls occasionally cause asymmetric routing of traffic within the server data center.

Which technology would you recommend to enhance security by limiting traffic that could originate from a hacker compromising a workstation and redirecting flows at the servers?

Options

  • AAccess control lists to limit sources of traffic that exits the server-facing interface of the firewall cluster
  • BPoison certain subnets by adding static routes to Null0 on the server farm core switches.
  • CUnicast Reverse Path Forwarding in strict mode
  • DUnicast Reverse Path Forwarding in loose mode

How the community answered

(33 responses)
  • A
    9% (3)
  • B
    21% (7)
  • C
    6% (2)
  • D
    64% (21)

Why each option

uRPF loose mode blocks packets with source IP addresses absent from the routing table, stopping spoofed or attacker-originated traffic while remaining compatible with the asymmetric routing present in this environment.

AAccess control lists to limit sources of traffic that exits the server-facing interface of the firewall cluster

ACLs on the firewall's server-facing interface require manual maintenance as legitimate sources change and do not dynamically prevent spoofed source addresses generated from within the network.

BPoison certain subnets by adding static routes to Null0 on the server farm core switches.

Adding static routes to Null0 discards all traffic destined for those subnets including legitimate users, making it an overly disruptive approach that causes an outage rather than targeted security enforcement.

CUnicast Reverse Path Forwarding in strict mode

uRPF strict mode requires that the best reverse path for the source IP exits the same interface the packet arrived on; because this network has asymmetric routing, strict mode would drop legitimate traffic and is therefore unsuitable.

DUnicast Reverse Path Forwarding in loose modeCorrect

uRPF loose mode only verifies that the packet's source IP address exists somewhere in the routing table, so it drops spoofed/non-routable source addresses used by a compromised workstation without requiring the reverse path to exit the same interface - this makes it functional even when asymmetric routing is in place, unlike strict mode which would drop legitimate asymmetric traffic.

Concept tested: uRPF loose mode for asymmetric routing security

Source: https://www.cisco.com/c/en/us/support/docs/ip/unicast-reverse-path-forwarding-urpf/13116-uRPF.html

Topics

#uRPF#asymmetric routing#firewall cluster#loose mode

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice