Implementing Cisco Enterprise Network Core Technologies (ENCOR)1,003 questions across 101 pages are complete and free, with no account or card.
1003 questions in this bank
Free access · progress saved on this device
Which feature does Cisco TrustSec use to provide scalable, secure communication throughout a network?
Answer: B
According to the Cisco Press official study guide "Cisco TrustSec SGT tags are assigned to authenticated groups of users or end devices". Since the rest mention networks and B mentions users, I'd argue that the correct answer is B.
Source: Adapted from community discussion — nep1019
Which technology provides a secure communication channel for all traffic at Layer 2 of the OSI model?
Answer: C
Some additional information: Reference: https://www.curtisswrightds.com/news/blog/enhancing-network-security-with-macsec.html MACsec vs IPsec – What’s the Difference? MACsec is for authentication and encryption of traffic over Ethernet on Layer 2 LAN networks. Alternatively, for Layer 3 networks, IPSec is used. Since MACsec and IPsec operate on different network layers, IPsec works on IP packets at Layer 3, while MACsec operates on Ethernet frames at Layer 2. Thus, MACsec can protect all Dynamic Host Configuration Protocol (DHCP) and Address Resolution Protocol (ARP) traffic, which IPsec cannot secure. On the other hand, IPsec can work across the wide area network (WAN) for routers, while MACsec is limited to switches or end-nodes on a LAN.
Source: Adapted from community discussion — edg
An engineer is configuring local web authentication on a WLAN. The engineer chooses the Authentication radio button under the Layer 3 Security options for Web Policy. Which device presents the web authentication for the WLAN?
Answer: D
When configuring local web authentication on a WLAN and choosing the Authentication radio button under Layer 3 Security options for Web Policy, the device that presents the web authentication for the WLAN is: D. local WLC The local WLC hosts the web authentication portal where users will be redirected to enter their credentials or required information to gain access to the network.
Source: Adapted from community discussion — teems5uk
Which method does the enable secret password option use to encrypt device passwords?
Answer: A
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/107614-64.html
Source: Adapted from community discussion — danny_f
On which protocol or technology is the fabric data plane based in Cisco SD-Access fabric?
Answer: A
The tunneling technology used for the fabric data plane is based on Virtual Extensible LAN (VXLAN). VXLAN encapsulation is UDP based, meaning that it can be forwarded by any IP-based network (legacy or third party) and creates the overlay network for the SD-Access fabric. Although LISP is the control plane for the SD-Access fabric, it does not use LISP data encapsulation for the data plane; instead, it uses VXLAN encapsulation because it is capable of encapsulating the original Ethernet header to perform MAC-in-IP encapsulation, while LISP does not. Using VXLAN allows the SD-Access fabric to support Layer 2 and Layer 3 virtual topologies (overlays) and the ability to operate over any IP-based network with built-in network segmentation (VRF instance/VN) and built-in group-based policy.
Source: Adapted from community discussion — skh
What is the difference between the enable password and the enable secret password when service password encryption is enabled on an IOS device?
Answer: A
The “enable secret” password is always encrypted (independent of the “service passwordencryption” command) using MD5 hash algorithm. The “enable password” does not encrypt the password and can be view in clear text in the running-config. In order to encrypt the “enable password”, use the “service password-encryption” command. This command will encrypt the passwords by using the Vigenere encryption algorithm. Unfortunately, the Vigenere encryption method is cryptographically weak and trivial to reverse. The MD5 hash is a stronger algorithm than Vigenere so answer ‘The enable secret password is protected via stronger cryptography mechanisms’ is correct.
Source: Adapted from community discussion — skh
Which access control list allows only TCP traffic with a destination port range of 22-443, excluding port 80?
Answer: D
No answer is correct A. gt and lt not allowed on same ACE B. Would work if permit and deny ACEs were the other way around C. Permits ALL ports other than 80 D. Allows port 80. Could be typo. If ne 80 was eq 80, then the ACEs would work
Source: Adapted from community discussion — nead
A network administrator applies the following configuration to an IOS device: aaa new-model aaa authentication login default local group tacacs+ What is the process of password checks when a login attempt is made to the device?
Answer: D
D correct Explanation: The “aaa authentication login default local group tacacs+” command is broken down as follows: + The ‘aaa authentication’ part is simply saying we want to configure authentication settings. + The ‘login’ is stating that we want to prompt for a username/ password when a connection is made to the device. + The ‘default’ means we want to apply for all login connections (such as tty, vty, console and aux). If we use this keyword, we don’t need to configure anything else under tty, vty and aux lines. If we don’t use this keyword then we have to specify which line(s) we want to apply the authentication feature. + The ‘local group tacacs+” means all users are authenticated using router’s local database (the first method). If the credentials are not found on the local database, then the TACACS+ server is used (the second method).
Source: Adapted from community discussion — skh
Refer to the exhibit.
Assuming the WLC's interfaces are not in the same subnet as the RADIUS server, which interface would the WLC use as the source for all RADIUS-related traffic?
Answer: C
Check the RADIUS Server Overwrite interface check box to enable the per-WLAN RADIUS source support, the controller uses the interface specified on the WLAN configuration as identity and source for all RADIUS related traffic on that WLAN. When disabled, the controller uses the management interface as the identity in the NAS-IP-Address attribute. If the RADIUS server is on a directly connected dynamic interface, the RADIUS traffic will be sourced from that interface. Otherwise, the management IP address is used
Source: Adapted from community discussion — Ayman_B
Which component of the Cisco Cyber Threat Defense solution provides user and flow context analysis?
Answer: B
Stealthwatch collects telemetry from every part of the network and applies advanced security analytics to the data. It creates a baseline of normal web and network activity for a network host, and applies context-aware analysis to automatically detect anomalous behaviors.
Source: Adapted from community discussion — kebkim
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
350-401 practice, question 241. 1003 questions available.
Version 1.0.0. How we source questions