Skip to content
Log in Sign up My account

Security Practice Questions

15 original questions covering ENCOR 5.1 to 5.4. Answer every one before opening any explanation. Target: 12 of 15 (80%).

1. Refer to the exhibit. An auditor copies the running configuration. Which credential can be recovered as plain text with freely available tools?

Blueprint 5.1.a

service password-encryption
enable algorithm-type scrypt secret En@ble-9
username ops privilege 15 password Ops-Pass1
username audit privilege 1 algorithm-type sha256 secret Aud1t-Pass
  • A. The audit secret
  • B. The enable secret
  • C. None of them, because service password-encryption is enabled
  • D. The ops password
Answer: D

service password-encryption turns the ops password into type 7, which is reversible obfuscation and can be decoded in seconds. The enable secret is a type 9 (scrypt) hash and the audit secret is a type 8 (PBKDF2 with SHA-256) hash; both are one-way. C is the trap: the encryption service hides passwords from casual viewing, but it does not protect them.

2. Refer to the exhibit. An engineer connects to R1 with SSH from 192.168.100.10 and gets the error "Password required, but none set". What is the cause?

Blueprint 5.1.a

username netadmin privilege 15 algorithm-type scrypt secret N3t-Adm1n!
ip domain name encor.lab
crypto key generate rsa modulus 2048
!
line vty 0 4
 login
 transport input ssh
  • A. The RSA key is too short for SSH version 2
  • B. The VTY lines use login, which checks a line password that is not configured
  • C. The user needs a privilege level below 15 to use SSH
  • D. transport input ssh blocks password authentication
Answer: B

Plain login authenticates against the line password. None is set, so every session is refused. login local would use the netadmin account. A 2048-bit key is well above the 768-bit minimum for SSH version 2 (A), and privilege level has nothing to do with whether SSH is allowed (C).

3. Which configuration locks out logins for 120 seconds after five failed attempts within one minute, while still allowing logins from the management subnet during that time?

Blueprint 5.1.a

  • A. login block-for 120 attempts 5 within 60 and login quiet-mode access-class MGMT
  • B. login delay 120 and access-class MGMT in
  • C. exec-timeout 2 0 and login on-failure log
  • D. security passwords min-length 5 and login block-for 60 attempts 120 within 5
Answer: A

login block-for triggers quiet mode after the stated number of failures in the time window, and login quiet-mode access-class lists the sources still accepted during quiet mode. login delay only adds a pause between attempts (B). exec-timeout is an idle timer (C). D has the arguments in the wrong positions.

4. Refer to the exhibit. User jdoe exists on the TACACS+ server with priv-lvl=15 in the exec service. The server is reachable. At which prompt does jdoe land after an SSH login?

Blueprint 5.1.b

aaa new-model
aaa group server tacacs+ TAC
 server name ISE-1
aaa authentication login default group TAC local
aaa accounting exec default start-stop group TAC
line vty 0 4
 transport input ssh
  • A. R1#, because the server profile sets privilege 15
  • B. R1#, because accounting is enabled
  • C. R1>, because EXEC authorization is not configured
  • D. The login fails, because no method list is applied to the VTY lines
Answer: C

The privilege level is an authorization attribute. Without aaa authorization exec, the router does not ask the server for it, and the user lands at level 1. D is wrong because lines without a named list use the default list. Accounting only records the session (B).

5. An administrator configures aaa authorization commands 15 default group tacacs+ local and tests from the console. Commands are not sent to the TACACS+ server, although they are from SSH sessions. What is missing?

Blueprint 5.1.b

  • A. login authentication default under line con 0
  • B. aaa accounting commands 15 default start-stop group tacacs+
  • C. aaa authorization exec default group tacacs+
  • D. aaa authorization console
Answer: D

Authorization is not applied to the console line unless aaa authorization console is configured. This is deliberate, so that a broken AAA setup does not lock out someone standing at the device. Accounting (B) records commands but does not authorize them.

Free account required for the rest

This page has 15 questions and the first 5 are shown here. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.

Create a free account Log in