Cisco ENCOR Infrastructure Security 2 — Questions and Answers
Question 1: What is the main difference between TACACS+ and RADIUS regarding authorization?
- RADIUS separates authentication and authorization; TACACS+ combines them
- TACACS+ separates authentication and authorization; RADIUS combines them (Correct answer)
- Both combine all three AAA functions
- RADIUS uses per-command authorization; TACACS+ does not
Correct answer: TACACS+ separates authentication and authorization; RADIUS combines them
TACACS+ separates the AAA functions, allowing granular per-command authorization, while RADIUS combines authentication and authorization.
Question 2: Which 802.1X component authenticates the supplicant and communicates with the authentication server?
- Supplicant
- Authenticator (Correct answer)
- Authentication Server
- RADIUS proxy
Correct answer: Authenticator
The authenticator (typically a switch or wireless AP) intercepts the supplicant's credentials and forwards them to the authentication server.
Question 3: What is the purpose of Dynamic ARP Inspection (DAI)?
- Block ARP broadcasts
- Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table (Correct answer)
- Rate-limit ARP traffic
- Encrypt ARP replies
Correct answer: Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table
DAI validates ARP packets by checking the IP-to-MAC binding against the DHCP Snooping table, preventing ARP poisoning attacks.
Question 4: In a ZBF configuration, which zone do router interfaces belong to by default?
- self zone
- outside zone
- trust zone
- no zone (no default) (Correct answer)
Correct answer: no zone (no default)
Router interfaces are not automatically placed in any zone; they must be explicitly assigned to a zone for ZBF to apply.
Question 5: Which Cisco feature uses cryptographic hashes to verify that routing updates have not been tampered with?
- HMAC-MD5 or SHA authentication on routing protocols (Correct answer)
- IPsec AH
- MACsec
- SSL/TLS
Correct answer: HMAC-MD5 or SHA authentication on routing protocols
Routing protocols like OSPF and BGP support HMAC-MD5 or SHA-based neighbor authentication to ensure update integrity.
Question 6: What type of ACL can filter traffic based on both source and destination IP, and also TCP/UDP port numbers?
- Standard ACL
- Extended ACL (Correct answer)
- Named ACL
- Reflexive ACL
Correct answer: Extended ACL
Extended ACLs filter traffic based on source IP, destination IP, protocol, and Layer 4 port numbers.
Cisco ENCOR Infrastructure Security 2
What is the main difference between TACACS+ and RADIUS regarding authorization?