Cisco ENCOR Infrastructure Security 1 — Questions and Answers
Question 1: What is the purpose of Control Plane Policing (CoPP) on a Cisco router?
- Encrypt control plane traffic
- Rate-limit traffic destined to the route processor (Correct answer)
- Filter data plane traffic
- Authenticate routing protocol neighbors
Correct answer: Rate-limit traffic destined to the route processor
CoPP protects the router's control plane by rate-limiting or dropping traffic directed to the route processor to prevent DoS attacks.
Question 2: Which Cisco IOS feature can detect and block rogue DHCP servers on a LAN segment?
- Dynamic ARP Inspection
- DHCP Snooping (Correct answer)
- IP Source Guard
- Port Security
Correct answer: DHCP Snooping
DHCP Snooping filters DHCP messages, trusting only designated ports and blocking rogue DHCP server responses on untrusted ports.
Question 3: In a Zone-Based Firewall (ZBF), what happens to traffic between two zones that have no zone-pair policy defined?
- Traffic is permitted by default
- Traffic is inspected
- Traffic is dropped (Correct answer)
- Traffic is logged only
Correct answer: Traffic is dropped
In ZBF, traffic between zones is implicitly denied unless a zone-pair with a service policy explicitly permits or inspects it.
Question 4: What does AAA stand for in Cisco network security?
- Authentication, Authorization, Accounting (Correct answer)
- Access, Audit, Administration
- Authentication, Audit, Authorization
- Access, Authentication, Accounting
Correct answer: Authentication, Authorization, Accounting
AAA stands for Authentication (who you are), Authorization (what you can do), and Accounting (what you did).
Question 5: Which protocol does Cisco TACACS+ use for transport?
- UDP port 49
- TCP port 49 (Correct answer)
- UDP port 1812
- TCP port 1812
Correct answer: TCP port 49
TACACS+ uses TCP port 49 for reliable transport and encrypts the entire packet body.
Question 6: Which feature builds upon DHCP Snooping to prevent hosts from sending traffic with a spoofed source IP?
- Dynamic ARP Inspection
- IP Source Guard (Correct answer)
- 802.1X
- BPDU Guard
Correct answer: IP Source Guard
IP Source Guard uses the DHCP Snooping binding table to filter packets with source IPs that don't match the legitimate binding.
Cisco ENCOR Infrastructure Security 1
What is the purpose of Control Plane Policing (CoPP) on a Cisco router?