300-445 Question 205
Select 3A multinational enterprise has been experiencing intermittent network disruptions and degraded performance. Upon analysis, the network team suspects multiple security issues affecting the network. Which of the following actions would help identify and mitigate the threats of DNS hijacking and BGP hijacking?
- A
Enable RPKI (Resource Public Key Infrastructure) to validate BGP routes.
- B
Implement DNSSEC to secure DNS queries and responses.
- C
Monitor network traffic for unusual spikes indicative of DDoS attacks.
- D
Configure rate-limiting on edge routers to prevent route leaking.
- E
Use prefix filtering to ensure only authorized prefixes are advertised.
Show answer and explanation
Correct answers: A, B, E
Explanation
DNS hijacking and BGP hijacking are critical security threats that can significantly impact network performance and availability. Enabling RPKI and implementing DNSSEC are specific measures that directly address these issues by securing BGP route validation and DNS queries, respectively. Additionally, prefix filtering ensures that unauthorized prefixes are not advertised, reducing the risk of route leaks and BGP hijacking. These measures together help secure the enterprise network against these threats.
- A. Correct.
RPKI (Resource Public Key Infrastructure) is a security framework that helps prevent BGP hijacking by validating the origination of BGP routes, ensuring that only authorized entities can advertise specific IP prefixes.
- B. Correct.
DNSSEC (Domain Name System Security Extensions) adds a layer of security to DNS by enabling validation of DNS responses, effectively mitigating DNS hijacking threats.
- C. Incorrect.
While monitoring traffic for unusual spikes is useful for detecting DDoS attacks, it is not directly applicable for identifying or mitigating DNS hijacking or BGP hijacking.
- D. Incorrect.
Rate-limiting on edge routers is a mitigation technique for controlling traffic flow and preventing DDoS attacks but does not directly address route leaking or hijacking.
- E. Correct.
Prefix filtering ensures that only authorized prefixes are advertised and accepted, making it an effective method to prevent route leaks and mitigate BGP hijacking.