I85PREP
⌘ K
Cisco ENCOR 350-401 study materials
Cisco ENCOR 350-401 study resources

Cisco ENCOR 350-401: Security

Cisco ENCOR 350-401 · Work through your exam, one topic at a time.

All guide sections

Security

Security (about 15%) tests identity and access control at Layer 2 and Layer 3, control-plane protection, and encrypted transport.

AAA and identity

  • AAA separates authentication, authorization, and accounting. RADIUS uses UDP 1812/1813 and encrypts only the password; TACACS+ uses TCP 49, encrypts the entire payload, and separates authorization.
  • 802.1X roles: supplicant (client), authenticator (switch/AP), authentication server (ISE/RADIUS). EAP-TLS uses certificates on both sides; PEAP uses a server certificate and an inner MS-CHAPv2/EAP method. MAB uses the MAC address as both username and password and is not strong authentication.
  • Configure authentication order (dot1x then mab), host mode (single-host, multi-auth, multi-domain), and a critical VLAN for when the server is unreachable.

Layer 2 hardening

  • Port security limits MAC addresses per port; violations can protect, restrict, or shut down.
  • DHCP snooping marks server-facing ports trusted and builds a binding table. Dynamic ARP Inspection uses that table to drop invalid ARP; IP Source Guard uses it to filter source IP/MAC.
  • Storm control, BPDU Guard, root guard, and CoPP protect the switching/control plane.

VPN and encryption

  • IPsec provides confidentiality, integrity, and authentication. IKEv2 negotiates SAs; ESP is the common data-plane protocol. DMVPN uses mGRE and NHRP for hub-spoke; FlexVPN uses IKEv2.
  • MACsec encrypts on the Ethernet link. TrustSec uses SGTs and SGACLs to enforce group policy rather than pure IP ACLs.

Worked example

A switch port must authenticate PCs with 802.1X but also allow a printer without a supplicant. Configure dot1x pae authenticator, authentication host-mode multi-auth, and authentication order dot1x mab. The PC authenticates with EAP; the printer times out on 802.1X and falls back to MAB, where ISE authorizes its MAC. Reasoning: MAB is a fallback, not a replacement, and the order determines that 802.1X is attempted first. Do not put the printer on an open critical VLAN unless that is the intended policy.

Traps

  • Saying RADIUS encrypts the whole packet; it does not.
  • Enabling DAI without DHCP snooping or static ARP ACLs.
  • Using port security as a substitute for 802.1X.
  • Forgetting that MAB is MAC-spoofable.
  • Mixing up IKE (control) and ESP (data).