Exam 350-401 All QuestionsBrowse all questions from this exam
Go to Exam
Question 597

Refer to the exhibit. An attacker can advertise OSPF fake routes from 172.16.20.0 network to the OSPF domain and black hole traffic. Which action must be taken to avoid this attack and still be able to advertise this subnet into OSPF?

    Correct Answer: C

    Configuring a passive interface on R2 toward 172.16.20.0 ensures that OSPF advertisements for this network are still seen in the OSPF domain, but the router will not form OSPF neighbor relationships through that interface. This effectively prevents an attacker from advertising fake OSPF routes into the network via the 172.16.20.0 interface, thus enhancing security while still allowing the network to be advertised in OSPF.

Discussion
BrandOption: C

The question itself is the definition of "passive interface"

snarkymarkOption: C

Agree C, https://study-ccna.com/ospf-passive-interface/#:~:text=The%20%27passive%2Dinterface%27%20command,interface%20is%20to%20increase%20security.

civanOption: C

C. Passive interface means R2 won't form neighbor relationships out that interface, and therefore can't learn routes via that subnet

AndreasThornusOption: C

We labbed this in EVE-NG and setting the interface facing 172.16.20.0/24 does indeed mean this network remains in OSPF but any relationship between a router on that subnet will fail to establish. C is correct.

CCNPWILLOption: C

C. Gimme question.

forccnpOption: C

C is correct

shoo83Option: C

agree with passive interface I choose C

MegonOption: D

D is the answer as if you look at the question, it is to stop fake routes from being injected into OSPF but we still need to advertise this subnet so there is OSPF neighborship and passive interface is not relevant. Applying filter to reject other router is more realistic

SeMo0o0oOption: C

C is correct without reading other options

HaidaryOption: C

C is correct Passive interface

milovnik1Option: C

I choose C

DatasetOption: C

i think is C

DarudeOption: C

reference: https://networklessons.com/ospf/ospf-passive-interface

testcom680Option: C

i choose C