Question 300
A tenant controller sends a FlowSpec discard rule for a broad prefix. Observed: Normal customer traffic is dropped because the match covers the entire tenant aggregate. Which ongoing validation gate would best detect a recurrence of this problem?
Explanation
Correct Answer
A useful regression gate tests whether the attack is filtered while unaffected flows remain reachable and alerts when normal customer traffic is dropped because the match covers the entire tenant aggregate. This directly checks the technical weakness: FlowSpec match components are less specific than the approved attack signature. The gate is derived from the fictional incident and is not an independent Juniper engineer signoff.
Incorrect Answers
The proposed control is tied to update-source and reachability design disagree across the peers, typically observed when one router silently sources TCP from a physical interface instead of its loopback. Here the target is flowspec match components are less specific than the approved attack signature; monitor the attack is filtered while unaffected flows remain reachable.
It is valid for another service scenario but checks an unexpected memory spike occurs although only a few prefixes should be accepted. This case instead needs a gate for normal customer traffic is dropped because the match covers the entire tenant aggregate and evidence that the attack is filtered while unaffected flows remain reachable.
This gate monitors a different failure, new prepended announcements do not influence the chosen inbound route. It would not detect the current problem: Normal customer traffic is dropped because the match covers the entire tenant aggregate. The appropriate check requires the attack is filtered while unaffected flows remain reachable.