Skip to content
Log in Sign up My account

ENCOR 5.0 Security (20%)

Security is the second-largest ENCOR domain, worth about one question in five. It splits into two kinds of objective. Objectives 5.1 and 5.2 are configure and verify: expect exhibits of AAA, line and ACL configuration where you must predict the result, and lab items where you build AAA, a VTY restriction or a CoPP policy and prove it with show commands. Objectives 5.3 and 5.4 are describe: expect questions that match products and protocols to their function, put an 802.1X exchange in order, or pick the right tool for a stated security problem.

Objective Verb Page
5.1.a Lines and local user authentication (console, VTY, password types, privilege levels, SSH) Configure, verify Lines, Passwords and Local Users
5.1.b Authorization and accounting using AAA (TACACS+, RADIUS, method lists) Configure, verify AAA
5.2 Infrastructure security: ACLs (standard, extended, named, VTY) and CoPP Configure, verify ACLs and CoPP
5.3 REST API security Describe REST API Security
5.4 Network security design: threat defense, endpoint security (802.1X, MAB, WebAuth), NGFW, TrustSec, MACsec Describe Network Security Design

Time budget: weeks 8 and 9 of the study plan. Do 5.1 (local access and AAA) at the end of week 8, after NETCONF and RESTCONF. Spend week 9 on 5.2 to 5.4, with the CoPP lab as the week's deliverable. If you manage AAA and ACLs daily, skim those pages for the exam traps and put the time into 5.3 and 5.4, which are mostly product and protocol knowledge.

How the pieces fit

graph TB
  subgraph "Protect the device: 5.1 and 5.2"
    L["Lines, SSH, local users"] --> AAA["AAA: TACACS+ and RADIUS"]
    ACL["VTY access-class and interface ACLs"]
    COPP["CoPP protects the CPU"]
  end
  subgraph "Protect the APIs: 5.3"
    API["HTTPS, tokens, RBAC"]
  end
  subgraph "Protect the network: 5.4"
    NAC["802.1X, MAB, WebAuth with ISE"] --> TS["TrustSec SGTs"]
    MS["MACsec link encryption"]
    TD["Threat defense: NGFW, IPS, Umbrella, Secure Endpoint"]
  end
  AAA -. "same ISE" .- NAC

When you finish, take the Security practice questions. Aim for 80% or better before moving on.