352-001 · Question #738
Which two effects of using ingress filtering to prevent spoofed address on a network design are true? (Choose two)
The correct answer is A. It protects the network infrastructure against spoofed DDoS attacks C. It makes DoS attacks more traceable. Ingress filtering validates source IP addresses at network ingress points, blocking spoofed-source attacks and preserving the true source address for traceability.
Question
Which two effects of using ingress filtering to prevent spoofed address on a network design are true? (Choose two)
Options
- AIt protects the network infrastructure against spoofed DDoS attacks
- BIt reduces the effectiveness of DDoS attacks when associated with DSCP remarking to
- CIt makes DoS attacks more traceable
- DIt classifies bogon traffic and remarks it with DSCP bulk
- EIt filters RFC 1918 IP addresses
How the community answered
(58 responses)- A81% (47)
- B7% (4)
- D3% (2)
- E9% (5)
Why each option
Ingress filtering validates source IP addresses at network ingress points, blocking spoofed-source attacks and preserving the true source address for traceability.
Ingress filtering (BCP38/uRPF) verifies that packets entering the network have source addresses reachable via the interface they arrived on, blocking the spoofed source IPs that are the prerequisite for reflected and amplified DDoS attacks.
DSCP remarking is a QoS classification mechanism unrelated to source address validation; combining ingress filtering with DSCP remarking is not a recognized method for reducing DDoS effectiveness.
When attackers cannot spoof source addresses, the true origin IP is preserved in every packet, allowing network operators and law enforcement to trace DoS attack traffic directly back to the actual attacking host.
Ingress filtering drops or blocks packets with invalid source addresses rather than classifying them and remarking them with a DSCP bulk value.
Filtering RFC 1918 addresses is a separate policy applied at Internet-facing borders; ingress filtering specifically validates source addresses against the routing table and does not inherently target private address ranges.
Concept tested: Ingress filtering and anti-spoofing source address validation
Source: https://www.cisco.com/c/en/us/about/security-center/unicast-reverse-path-forwarding.html
Topics
Community Discussion
No community discussion yet for this question.