Cisco CCNP Enterprise (350-401 ENCOR) — All Questions

Which feature protects a switch against a rogue device sending spoofed DHCP offers by trusting only specified ports for DHCP server responses?

• a.Port security
• b.BPDU guard
• c.DHCP snooping✓
• d.Storm control

DHCP snooping classifies switch ports as trusted or untrusted and permits DHCP server responses only from trusted ports, blocking rogue or spoofed DHCP servers on untrusted ports. It also builds a binding table used by features like Dynamic ARP Inspection. Port security limits MAC addresses, and BPDU guard protects the spanning tree edge.

In an 802.1X port-based authentication deployment, which device plays the role of the authenticator?

• a.The switch or wireless controller that controls port access and relays credentials✓
• b.The RADIUS server that validates credentials
• c.The end-user client (supplicant) requesting access
• d.The DNS server resolving names

In 802.1X, the authenticator is the network access device, typically a switch or WLC, that controls port access and relays authentication messages between the supplicant and the authentication server. The supplicant is the client requesting access, and the authentication server (usually RADIUS) makes the accept or reject decision.

Which pair correctly matches the AAA protocols to a typical use case in a Cisco enterprise?

• a.TACACS+ for network access control of end users; RADIUS for device administration
• b.TACACS+ for device administration with command authorization; RADIUS for network access authentication of endpoints✓
• c.Both TACACS+ and RADIUS can only do accounting, not authentication
• d.RADIUS encrypts the entire packet; TACACS+ encrypts only the password

TACACS+ is commonly used for device administration because it separates authentication, authorization, and accounting and supports per-command authorization, while RADIUS is widely used for network access authentication of endpoints and users. It is TACACS+ that encrypts the full payload, whereas RADIUS traditionally protects mainly the password.

Which management access method should be preferred over Telnet to administer a device securely?

• a.HTTP
• b.SNMPv1
• c.Telnet on a nonstandard port
• d.SSH✓

SSH encrypts the management session, protecting credentials and commands, and should be used instead of Telnet, which sends everything in clear text. Moving Telnet to a nonstandard port does not add encryption, HTTP is likewise unencrypted, and SNMPv1 has weak security; SNMPv3 and SSH are the secure choices.