nerdexam
Cisco

400-007 · Question #288

The Layer 3 control plane is the intelligence over the network that steers traffic toward its intended destination. Which two techniques can be used in service provider-style networks to offer a…

The correct answer is B. remote black-holing trigger C. prefix lists. In service provider networks, remote triggered black-holing and prefix lists are purpose-built control plane techniques that enable dynamic traffic manipulation and precise route policy enforcement.

Designing Network Infrastructure

Question

The Layer 3 control plane is the intelligence over the network that steers traffic toward its intended destination. Which two techniques can be used in service provider-style networks to offer a more dynamic, flexible, controlled, and secure control plane design? (Choose two.)

Options

  • AQoS policy propagation with BGP
  • Bremote black-holing trigger
  • Cprefix lists
  • Daccess control lists
  • Efirewalls

How the community answered

(28 responses)
  • A
    25% (7)
  • B
    54% (15)
  • D
    7% (2)
  • E
    14% (4)

Why each option

In service provider networks, remote triggered black-holing and prefix lists are purpose-built control plane techniques that enable dynamic traffic manipulation and precise route policy enforcement.

AQoS policy propagation with BGP

QoS policy propagation with BGP uses BGP communities to carry traffic-class markings for quality-of-service purposes; it is a data plane traffic-engineering mechanism and does not add security or flexibility to the control plane itself.

Bremote black-holing triggerCorrect

Remote triggered black-holing (RTBH) uses BGP to dynamically propagate null-route entries across SP infrastructure, enabling rapid network-wide mitigation of DDoS attacks or unwanted traffic without manual per-device changes - making the control plane both dynamic and secure.

Cprefix listsCorrect

Prefix lists filter which routes are accepted or advertised in BGP and IGP processes, giving operators explicit, fine-grained control over the routing information base - directly satisfying the requirements for a controlled and secure control plane design in SP environments.

Daccess control lists

Access control lists operate on the data/forwarding plane to permit or deny packets in transit and do not influence how routing protocols exchange or process control plane routing information.

Efirewalls

Firewalls are data plane appliances that inspect and filter forwarded traffic; they do not participate in or enhance the Layer 3 control plane's dynamic routing, reachability, or route policy functions.

Concept tested: SP control plane security using RTBH and prefix lists

Source: https://www.cisco.com/c/en/us/about/security-center/intelligent-network-protection.html

Topics

#control plane design#RTBH#prefix lists#service provider

Community Discussion

No community discussion yet for this question.

Full 400-007 Practice