Cisco ENCOR Infrastructure Security 3

Question 1

Which Cisco feature automatically shuts down a switchport when a BPDU is received on a PortFast-enabled port?

Accepted Answer

BPDU Guard

Answer

BPDU Guard disables a PortFast-enabled port upon receiving a BPDU, protecting the STP topology from unauthorized switches.

Question 2

What is the purpose of Unicast Reverse Path Forwarding (uRPF) in strict mode?

Accepted Answer

Verify that the return path for a packet's source IP goes back out the same interface

Answer

Strict uRPF drops packets if the best return path to the source IP is not through the same interface the packet arrived on, preventing IP spoofing.

Question 3

Which type of VPN uses IPsec in tunnel mode to protect traffic between two site gateways?

Accepted Answer

Site-to-site VPN

Answer

Site-to-site VPNs use IPsec tunnel mode to encapsulate and encrypt entire IP packets between two gateway routers.

Question 4

In IKEv2, what does the term 'IKE_AUTH' exchange accomplish?

Accepted Answer

Authenticates peers and creates the first Child SA (IPsec SA)

Answer

The IKE_AUTH exchange authenticates both peers using certificates or pre-shared keys and establishes the first Child SA for IPsec.

Question 5

What is the primary function of MACsec (IEEE 802.1AE)?

Accepted Answer

Encrypt and integrity-protect traffic at Layer 2 on a hop-by-hop basis

Answer

MACsec provides line-rate Layer 2 encryption and integrity verification between directly connected devices on each hop.

Cisco ENCOR Practice Test