400-007 · Question #288
The Layer 3 control plane is the intelligence over the network that steers traffic toward its intended destination. Which two techniques can be used in service provider-style networks to offer a…
The correct answer is B. remote black-holing trigger C. prefix lists. In service provider networks, remote triggered black-holing and prefix lists are purpose-built control plane techniques that enable dynamic traffic manipulation and precise route policy enforcement.
Question
The Layer 3 control plane is the intelligence over the network that steers traffic toward its intended destination. Which two techniques can be used in service provider-style networks to offer a more dynamic, flexible, controlled, and secure control plane design? (Choose two.)
Options
- AQoS policy propagation with BGP
- Bremote black-holing trigger
- Cprefix lists
- Daccess control lists
- Efirewalls
How the community answered
(28 responses)- A25% (7)
- B54% (15)
- D7% (2)
- E14% (4)
Why each option
In service provider networks, remote triggered black-holing and prefix lists are purpose-built control plane techniques that enable dynamic traffic manipulation and precise route policy enforcement.
QoS policy propagation with BGP uses BGP communities to carry traffic-class markings for quality-of-service purposes; it is a data plane traffic-engineering mechanism and does not add security or flexibility to the control plane itself.
Remote triggered black-holing (RTBH) uses BGP to dynamically propagate null-route entries across SP infrastructure, enabling rapid network-wide mitigation of DDoS attacks or unwanted traffic without manual per-device changes - making the control plane both dynamic and secure.
Prefix lists filter which routes are accepted or advertised in BGP and IGP processes, giving operators explicit, fine-grained control over the routing information base - directly satisfying the requirements for a controlled and secure control plane design in SP environments.
Access control lists operate on the data/forwarding plane to permit or deny packets in transit and do not influence how routing protocols exchange or process control plane routing information.
Firewalls are data plane appliances that inspect and filter forwarded traffic; they do not participate in or enhance the Layer 3 control plane's dynamic routing, reachability, or route policy functions.
Concept tested: SP control plane security using RTBH and prefix lists
Source: https://www.cisco.com/c/en/us/about/security-center/intelligent-network-protection.html
Topics
Community Discussion
No community discussion yet for this question.