Cisco ENCOR Infrastructure Security 2

Question 1

What is the main difference between TACACS+ and RADIUS regarding authorization?

Accepted Answer

TACACS+ separates authentication and authorization; RADIUS combines them

Answer

TACACS+ separates the AAA functions, allowing granular per-command authorization, while RADIUS combines authentication and authorization.

Question 2

Which 802.1X component authenticates the supplicant and communicates with the authentication server?

Accepted Answer

Authenticator

Answer

The authenticator (typically a switch or wireless AP) intercepts the supplicant's credentials and forwards them to the authentication server.

Question 3

What is the purpose of Dynamic ARP Inspection (DAI)?

Accepted Answer

Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table

Answer

DAI validates ARP packets by checking the IP-to-MAC binding against the DHCP Snooping table, preventing ARP poisoning attacks.

Question 4

In a ZBF configuration, which zone do router interfaces belong to by default?

Accepted Answer

no zone (no default)

Answer

Router interfaces are not automatically placed in any zone; they must be explicitly assigned to a zone for ZBF to apply.

Question 5

Which Cisco feature uses cryptographic hashes to verify that routing updates have not been tampered with?

Accepted Answer

HMAC-MD5 or SHA authentication on routing protocols

Answer

Routing protocols like OSPF and BGP support HMAC-MD5 or SHA-based neighbor authentication to ensure update integrity.

Cisco ENCOR Practice Test