350-401 Question 540
Select 2A network engineer is tasked with securing an OSPF routing domain in a multi-area network. The engineer must ensure that OSPF neighbor relationships are protected against unauthorized devices joining the network and that routing information integrity is maintained. Which of the following configurations should the engineer implement?
- A
Enable OSPF authentication using MD5 or SHA on all OSPF interfaces.
- B
Configure OSPF passive interfaces on non-routing links.
- C
Deploy route filtering to restrict specific prefixes from being advertised.
- D
Use a prefix list to limit OSPF LSAs from entering specific areas.
- E
Implement IPsec to secure all OSPF traffic.
Show answer and explanation
Correct answers: A, B
Explanation
To secure an OSPF routing domain, it is crucial to implement OSPF authentication to protect neighbor relationships and ensure integrity of routing information. Additionally, configuring OSPF passive interfaces restricts unnecessary OSPF communication on non-routing links, reducing exposure to potential attacks. These measures address the specific security challenges in OSPF without adding excessive complexity, such as deploying IPsec.
- A. Correct.
Enabling OSPF authentication using MD5 or SHA ensures that OSPF neighbors must authenticate themselves before forming an adjacency, protecting the network from unauthorized devices.
- B. Correct.
Configuring OSPF passive interfaces on non-routing links prevents OSPF hello packets from being sent on interfaces where neighbor relationships are not required, reducing the attack surface.
- C. Incorrect.
Route filtering is used to control route propagation but does not directly secure OSPF neighbor relationships or routing information integrity.
- D. Incorrect.
Using a prefix list to limit OSPF LSAs can help manage routing information but does not provide authentication or integrity protection for OSPF.
- E. Incorrect.
While IPsec can secure OSPF traffic, it is not a standard approach to securing OSPF in most enterprise networks and can add unnecessary complexity.