Which of the following statements about BGP security are correct? (Multiple choice)

Question

Options

• AKeychain authentication can be used between BGP neighbors to reduce the possibility of being attacked, and Keychain has a set of passwords, which can be dynamically exchanged between BGP neighbors
• BWhen configuring the MD5 authentication password, if the simple option is used, the password will be saved in the configuration file in plain text, which poses a security risk
• CYou can use the display bgp peer verbose command to view the authentication details of BGP peers
• DTo prevent attackers from simulating real BGP protocol packets to attack the device, you can configure the GTSM function to detect the TTL value in the IP packet header

• A
  100% (38)

Explanation

All four options are correct, each covering a distinct layer of BGP security.

A is correct because Keychain authentication allows multiple time-bound passwords in a single keychain, enabling seamless rolling key rotation between BGP neighbors without session resets - a significant improvement over static single-password MD5.

B is correct because on Huawei (and similar vendors), the simple keyword stores the MD5 authentication password in plaintext within the configuration file, meaning anyone with config-viewing access can read it; always use cipher to store it encrypted.

C is correct because display bgp peer verbose outputs detailed per-peer state including authentication mode and status, making it the go-to diagnostic command for verifying peer security settings.

D is correct because GTSM (Generalized TTL Security Mechanism, RFC 5082) instructs the router to drop BGP packets whose TTL falls below a threshold (e.g., 255 for directly connected peers), since a forged packet injected from a distant attacker cannot arrive with a near-maximum TTL, effectively blocking spoofed BGP session attacks.

There are no distractors here - all four choices are correct.

Memory tip: Think of BGP security in layers - Key rotation (A), Config exposure (B), Command visibility (C), TTL filtering (D). The acronym KCCT (Keys, Config, Command, TTL) can help you recall that BGP security spans authentication, configuration hygiene, observability, and packet-level validation.

No community discussion yet for this question.