Cisco ENCOR Ultimate 4 — Questions and Answers
Question 1: Which technology provides network-wide device profiling, posture assessment, and 802.1X authentication for endpoint access control in Cisco environments?
- Cisco TrustSec
- Cisco ISE (Identity Services Engine) (Correct answer)
- Cisco Umbrella
- Cisco StealthWatch
Correct answer: Cisco ISE (Identity Services Engine)
Cisco ISE provides centralized AAA, profiling, and posture services, enforcing granular access control policies via 802.1X, MAB, and Web Authentication.
Question 2: What is the role of the Cisco TrustSec SGT (Security Group Tag) in a campus network?
- It marks packets with a VLAN ID for inter-switch communication
- It assigns a logical group identity to traffic for policy enforcement regardless of IP address (Correct answer)
- It encrypts traffic between campus switches
- It replaces 802.1Q trunk encapsulation
Correct answer: It assigns a logical group identity to traffic for policy enforcement regardless of IP address
SGTs are 16-bit tags assigned at ingress that identify the security group of the traffic source, enabling policy enforcement anywhere in the fabric without relying on IP addresses.
Question 3: An engineer configures 'spanning-tree portfast bpduguard default' globally. What happens when a PortFast-enabled port receives a BPDU?
- The port transitions to root port state
- The port is immediately placed in err-disabled state (Correct answer)
- The BPDU is silently dropped
- The port disables PortFast but remains forwarding
Correct answer: The port is immediately placed in err-disabled state
BPDU Guard shuts down the port by placing it in err-disabled state when a BPDU is received, protecting the STP topology from unauthorized switches.
Question 4: Which OSPF LSA type is generated by an ASBR to advertise external routes into the OSPF domain?
- Type 1 (Router LSA)
- Type 3 (Summary LSA)
- Type 5 (AS External LSA) (Correct answer)
- Type 7 (NSSA External LSA)
Correct answer: Type 5 (AS External LSA)
Type 5 LSAs are originated by ASBRs and flooded throughout the OSPF domain (except stub and NSSA areas) to advertise externally redistributed routes.
Question 5: In a Cisco ACI fabric, what is the function of the APIC (Application Policy Infrastructure Controller)?
- It forwards all data-plane traffic between leaf switches
- It acts as the centralized policy manager and REST API endpoint for the fabric (Correct answer)
- It performs hardware-based packet forwarding in the spine layer
- It provides DHCP services to connected endpoints
Correct answer: It acts as the centralized policy manager and REST API endpoint for the fabric
The APIC is the centralized automation and policy management controller for ACI, providing a REST API interface but not participating in data-plane forwarding.
Question 6: Which Ansible module is used to send a CLI command to a Cisco IOS device and return the output as a structured variable?
- ios_config
- ios_command (Correct answer)
- ios_facts
- net_get
Correct answer: ios_command
The 'ios_command' module sends one or more show commands to an IOS device and captures the output in registered variables for further processing.
Question 7: What is the purpose of Bidirectional Forwarding Detection (BFD) when used with OSPF?
- To encrypt OSPF hello packets
- To provide sub-second failure detection faster than OSPF dead timer expiry (Correct answer)
- To load-balance OSPF traffic across equal-cost paths
- To authenticate OSPF neighbor relationships
Correct answer: To provide sub-second failure detection faster than OSPF dead timer expiry
BFD provides rapid link failure detection in milliseconds, allowing OSPF to trigger reconvergence far faster than waiting for the default 40-second dead interval.
Cisco ENCOR Ultimate 4
Which technology provides network-wide device profiling, posture assessment, and 802.1X authentication for endpoint access control in Cisco environments?