Cisco ENCOR Ultimate 4

Question 1

Which technology provides network-wide device profiling, posture assessment, and 802.1X authentication for endpoint access control in Cisco environments?

Accepted Answer

Cisco ISE (Identity Services Engine)

Answer

Cisco ISE provides centralized AAA, profiling, and posture services, enforcing granular access control policies via 802.1X, MAB, and Web Authentication.

Question 2

What is the role of the Cisco TrustSec SGT (Security Group Tag) in a campus network?

Accepted Answer

It assigns a logical group identity to traffic for policy enforcement regardless of IP address

Answer

SGTs are 16-bit tags assigned at ingress that identify the security group of the traffic source, enabling policy enforcement anywhere in the fabric without relying on IP addresses.

Question 3

An engineer configures 'spanning-tree portfast bpduguard default' globally. What happens when a PortFast-enabled port receives a BPDU?

Accepted Answer

The port is immediately placed in err-disabled state

Answer

BPDU Guard shuts down the port by placing it in err-disabled state when a BPDU is received, protecting the STP topology from unauthorized switches.

Question 4

Which OSPF LSA type is generated by an ASBR to advertise external routes into the OSPF domain?

Accepted Answer

Type 5 (AS External LSA)

Answer

Type 5 LSAs are originated by ASBRs and flooded throughout the OSPF domain (except stub and NSSA areas) to advertise externally redistributed routes.

Question 5

In a Cisco ACI fabric, what is the function of the APIC (Application Policy Infrastructure Controller)?

Accepted Answer

It acts as the centralized policy manager and REST API endpoint for the fabric

Answer

The APIC is the centralized automation and policy management controller for ACI, providing a REST API interface but not participating in data-plane forwarding.

Cisco ENCOR Practice Test

Cisco ENCOR Practice Test

Cisco ENCOR Ultimate 4