MENU
Refer to the exhibit.
An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim's spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?
Suggested Answer: A
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
30 comments · newest first
AN
Annabelle
11 months ago
I’m not sure about that, C seems too simplistic for such a complex attack.
CA
Catalina
11 months ago
No way, option D is the way to go for logging issues!
JA
Jamal
11 months ago
Surprised that people still use directed broadcasts in 2023!
AN
Annmarie
11 months ago
I think option A could help too, but not as effective as C.
MY
My
12 months ago
Definitely go with option C, it’s the best way to stop those broadcasts.
TY
Ty
12 months ago
I was leaning towards A as well, but I remember something about logging traps being useful in monitoring attacks. It's a bit confusing!
ST
Stephaine
1 year ago
I recall that directed broadcasts can cause issues, so C makes sense, but I wonder if there are other configurations that could help too.
NG
Ngoc
1 year ago
I'm not entirely sure, but I feel like option A could also be relevant. The reverse-path verification seems like it could help with spoofed IPs.
BR
Brice
1 year ago
I think the right answer might be C, using the no ip directed-broadcast command. I remember it being mentioned in a similar practice question about mitigating broadcast storms.
SC
Scot
1 year ago
I'm not too familiar with the "service tcp-keepalives-out" command in option B, so I'm not sure how that would help mitigate the ICMP packet attack. I think I'll have to rule that one out and focus on the other options.
AB
Abel
1 year ago
Okay, I've got it! The attack is using broadcast addresses to cause devices to respond to the spoofed source IP, so disabling directed broadcasts with the "no ip directed-broadcast" command in option C seems like the right move. I'm confident that's the best solution here.
FE
Felix
1 year ago
Hmm, I'm a bit confused here. The question mentions spoofed source IP addresses, so I'm not sure if the "ip verify reverse-path" command in option A would be the best approach. I'll need to think this through a bit more.
AL
Albina
1 year ago
This looks like a tricky one, but I think the key is to focus on mitigating the ICMP packet attack. I'm leaning towards option C - using the "no ip directed-broadcast" command to disable directed broadcasts on the subinterface.
NA
Nadine
1 year ago
I bet the engineer's next recommendation is to just unplug the router and hope the problem goes away. Problem solved!
VA
Valentin
1 year ago
C) Good point, that would definitely help mitigate the attack
LA
Lai
1 year ago
B) That might help, but I think the engineer should also consider using subinterface command no ip directed-broadcast
GE
Gerri
1 year ago
A) Use command ip verify reverse-path interface
NE
Nettie
2 years ago
Option A seems promising, but I'm not sure it's the complete solution. Verifying reverse-path forwarding is a good start, but we might need to do more.
DI
Dick
1 year ago
User 2: I agree, we should consider other options as well to fully protect the network.
RO
Rosann
1 year ago
User 1: Option A is a good start, but we might need to do more to mitigate the attack.
DE
Deeanna
2 years ago
Haha, Option D is a classic! Logging everything at level 6 is definitely not the way to go. Way too much data!
MA
Malcolm
2 years ago
I'm not sure Option B is relevant here. Enabling TCP keepalives doesn't seem to address the ICMP flooding issue.
HI
Hillary
2 years ago
Option C looks like the right choice here. Disabling IP directed broadcasts on the subinterface should help mitigate the attack.
SH
Shaquana
1 year ago
Let's implement the recommended solution and monitor the network for any improvements.
MA
Maryann
1 year ago
It's important to take action quickly to mitigate the impact of the attack.
LO
Louisa
1 year ago
Disabling IP directed broadcasts on the subinterface will definitely help in this situation.
AN
Annelle
1 year ago
I agree, option C is the best choice to prevent the attack.
HY
Hyun
2 years ago
I'm not sure, but I think option C could also be a good choice to prevent the attack.
HO
Honey
2 years ago
I agree with Alecia, that option makes sense to mitigate the attack.
AL
Alecia
2 years ago
I think the engineer should recommend using command ip verify reverse-path interface.