Overview
Security is 20% of ENCOR and has four exam topics. Two are configure-and-verify items: device access control (lines, local user authentication, and authentication and authorization using AAA) and infrastructure security features (ACLs and CoPP). Two are describe items: REST API security, and the components of network security design (threat defense, endpoint security, next-generation firewall, and TrustSec and MACsec).
The domain moves from the device outward. First you control who can log in and what they can do, then you control which traffic reaches and crosses the device, then you secure the APIs used by controllers and scripts, and finally you place firewalls, endpoint protection and segmentation into a design. It draws on Infrastructure for the protocols being protected and on Automation and Artificial Intelligence for the APIs being secured.
How it's tested
Configure items show a device access, AAA, ACL or CoPP configuration and ask what it permits, denies or falls back to. Describe items present a requirement, such as encrypting switch-to-switch links or enforcing policy by user role instead of IP address, and ask which component meets it. Pay attention to direction, order and fallback behavior.
-
Predict the login result
An AAA method list, line configuration or user database is shown with a scenario, and you decide whether a login succeeds, which method is used, and what privilege results.
-
Trace the packet through the filter
An ACL or CoPP policy is shown, and you determine whether specific traffic is permitted, dropped or rate limited, including the implicit deny.
-
Match the security component
A design requirement is described, and you choose threat defense, endpoint security, an NGFW capability, TrustSec or MACsec.
A requirement says access between departments must follow user role, not IP subnets, because users move between floors and receive different addresses. IP-based ACLs would need constant rewriting. TrustSec assigns a scalable group tag at authentication, carries it with the traffic and enforces SGACLs between groups, so policy follows the user regardless of address.
Exam topics 4
Official exam topics from the Cisco outline, in outline order.
5.1 Configure and verify device access controlSecuring lines and local users, and authentication and authorization with AAA.
- What it means
- This topic covers protecting console and vty lines (login local, transport input ssh, exec-timeout, access-class), creating local users with secret passwords and privilege levels, and configuring AAA authentication and authorization method lists with TACACS+ or RADIUS servers and local fallback.
- What to understand
- aaa new-model changes how lines authenticate, and a method list such as aaa authentication login default group tacacs+ local tries the server first and uses the local database only when the server returns an error or does not respond, not when it rejects the user. TACACS+ uses TCP 49, encrypts the whole payload and separates authentication, authorization and accounting, which allows per-command authorization; RADIUS uses UDP 1812 and 1813, encrypts only the password and combines authentication and authorization. SSH needs a hostname, a domain name, an RSA key (2048-bit is a common choice) and ip ssh version 2.
- How it shows up
- A scenario shows a method list and a server state, then asks whether a local user can log in, or asks which protocol supports authorizing each command an administrator enters.
- Common confusion
- Expecting the local fallback to work when the AAA server is reachable but rejects the credentials; a rejection is a final answer, and only an unreachable server triggers the next method.
5.2 Configure and verify infrastructure security featuresACLs and Control Plane Policing.
- What it means
- This topic covers standard, extended and named ACLs, wildcard masks, sequence-numbered editing and placement, and Control Plane Policing (CoPP), which uses MQC to rate-limit traffic destined to the device's route processor.
- What to understand
- ACLs are processed top-down, stop at the first match and end with an implicit deny, so permit statements for routing protocols and management must be explicit. Standard ACLs match only the source and are placed close to the destination, extended ACLs match source, destination, protocol and ports and are placed close to the source. CoPP applies a policy-map with service-policy input under control-plane, policing classes such as management, routing and ICMP to protect the CPU.
- How it shows up
- An exhibit ACL is applied and some traffic stops unexpectedly, or a CoPP policy is shown and you predict which traffic is dropped during a flood.
- Common confusion
- Applying an ACL to a vty line with ip access-group; lines use access-class, and interfaces use ip access-group with in or out.
5.3 Describe REST API securityProtecting API access with HTTPS, tokens, authorization and good credential handling.
- What it means
- This topic covers how REST APIs on controllers and devices are protected: TLS encryption, authentication with basic credentials exchanged for tokens, API keys or OAuth, role-based authorization of what an authenticated client may do, and secure handling of credentials in scripts.
- What to understand
- Catalyst Center issues a token after a POST to its authentication endpoint with basic credentials, and the token is then sent in the X-Auth-Token header until it expires. Certificate validation should stay enabled in production, credentials should come from environment variables or a vault rather than hard-coded scripts, and the principle of least privilege should apply to API accounts. HTTP 401 means the client is not authenticated, while 403 means it is authenticated but not authorized.
- How it shows up
- A scenario asks how to avoid sending credentials with every API call, why a script disabling certificate verification is a risk, or what a 401 versus 403 response indicates.
- Common confusion
- Thinking HTTPS alone secures an API; encryption protects data in transit, but authentication, authorization and credential handling are separate controls.
5.4 Describe the components of network security designThreat defense, endpoint security, next-generation firewalls, and TrustSec and MACsec.
- What it means
- This topic covers how security components fit into an enterprise design: threat defense capabilities (intrusion prevention, threat intelligence, malware analysis, DNS-layer security and network behavior analytics), endpoint security (anti-malware and endpoint detection and response on hosts), next-generation firewalls, and the TrustSec and MACsec technologies built into Cisco switching.
- What to understand
- An NGFW adds application visibility and control, integrated IPS, URL filtering, malware inspection and identity-aware policy to stateful filtering. TrustSec classifies traffic with a scalable group tag at ingress, propagates it inline or with SXP, and enforces SGACLs at egress. MACsec (IEEE 802.1AE) encrypts Ethernet frames hop by hop using AES-GCM, with keys from the MACsec Key Agreement protocol.
- How it shows up
- A requirement such as encrypting a link between two switches, enforcing policy by user group, or blocking a specific application on a common port is matched to the right component.
- Common confusion
- Treating MACsec as end-to-end encryption; it protects each Layer 2 hop separately, and frames are decrypted and re-encrypted at every MACsec-enabled device.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
AAA method list fallback
A method list such as group tacacs+ local tries each method in order, moving on only when a method returns an error, such as an unreachable server.
- Remember
- A server that answers with a reject ends the authentication attempt; the local database is not consulted.
- Tested as
- The most common AAA exhibit question in topic 5.1.
- Trap
- Expecting a local account to work while the TACACS+ server is up and denying the user.
-
TACACS+ vs. RADIUS
TACACS+ is Cisco-developed, uses TCP 49, encrypts the entire body and separates authentication, authorization and accounting; RADIUS is an open standard on UDP 1812 and 1813 that encrypts only the password.
- Remember
- Choose TACACS+ for device administration with per-command authorization, and RADIUS for network access such as 802.1X and VPN users.
- Tested as
- Scenario questions pick the protocol from the stated requirement.
- Trap
- Selecting RADIUS for command-by-command authorization of administrators.
-
Line and SSH hardening
Vty lines are secured with transport input ssh, login local or AAA, exec-timeout and an access-class restricting source addresses.
- Remember
- SSH requires a hostname, an ip domain-name and an RSA key pair, and ip ssh version 2 disables the weaker version 1.
- Tested as
- Configure-and-verify items ask what is missing for SSH or why Telnet still works.
- Trap
- Forgetting that transport input all still permits Telnet.
-
Password types
username secret and enable secret store strong hashes (type 8 PBKDF2 or type 9 scrypt when chosen), while service password-encryption only applies reversible type 7 obfuscation to plain passwords.
- Remember
- Prefer secret over password; type 7 can be reversed and should not be treated as protection.
- Tested as
- Local user authentication questions compare these options.
- Trap
- Believing service password-encryption makes stored passwords secure.
-
Privilege levels and authorization
IOS uses privilege levels 0 to 15, and AAA exec and command authorization can assign or restrict them per user from the server.
- Remember
- aaa authorization exec lets the server place a user directly at level 15; aaa authorization commands 15 checks each level-15 command with the server.
- Tested as
- Asked when users log in successfully but land in user EXEC mode.
- Trap
- Assuming authentication alone sets the privilege level.
-
ACL processing rules
ACL entries are checked top-down, the first match decides, and an implicit deny any ends every ACL.
- Remember
- Explicitly permit routing protocol, management and ICMP traffic you still need before the end of the list.
- Tested as
- Exhibit questions ask why OSPF dropped or why a host lost access after an ACL was applied.
- Trap
- Placing a broad permit above a specific deny so the deny never matches.
-
Wildcard masks
A wildcard mask uses 0 bits for positions that must match and 1 bits for positions that are ignored.
- Remember
- 0.0.0.255 matches a /24, 0.0.0.0 (host) matches one address, and the inverse of the subnet mask gives the wildcard for that subnet.
- Tested as
- Most ACL exhibit questions require reading wildcards quickly.
- Trap
- Writing a subnet mask where a wildcard mask is required.
-
access-class vs. ip access-group
access-class applies an ACL to vty or console lines to control management sessions, while ip access-group applies an ACL to an interface in a direction.
- Remember
- Restrict who can SSH to the device with access-class in under line vty.
- Tested as
- A common missing-command question in topic 5.1 and 5.2.
- Trap
- Applying an interface ACL to block management access and accidentally blocking transit traffic.
-
Control Plane Policing
CoPP applies an MQC policy to the control-plane to police traffic destined to the route processor, protecting the CPU from floods.
- Remember
- Classify routing protocols, management and ICMP into separate classes with suitable rates, and apply with service-policy input under control-plane.
- Tested as
- Configure items in topic 5.2 and design questions on protecting the device.
- Trap
- Policing routing protocol traffic so tightly that adjacencies drop during normal operation.
-
Token-based API authentication
The client authenticates once with credentials and receives a time-limited token, which is sent in a header on later requests.
- Remember
- Catalyst Center uses the X-Auth-Token header; tokens expire and must be renewed.
- Tested as
- Topic 5.3 and the Catalyst Center API topic in Automation and Artificial Intelligence.
- Trap
- Sending basic credentials on every request when a token mechanism is available.
-
Next-generation firewall
An NGFW combines stateful filtering with application visibility and control, intrusion prevention, URL filtering, malware protection and identity-based policy.
- Remember
- Application control identifies traffic by behavior and signatures, not by port, so it can block an application on TCP 443.
- Tested as
- Design questions ask which component can enforce policy per application.
- Trap
- Choosing an extended ACL to block an application that shares a port with permitted traffic.
-
TrustSec SGT and SGACL
TrustSec assigns a scalable group tag at network entry, usually from ISE after authentication, and enforces scalable group ACLs between source and destination groups.
- Remember
- Tags propagate inline in the frame or through SXP where hardware cannot tag; enforcement typically happens at egress.
- Tested as
- Policy by role or group, independent of IP addressing, points to TrustSec.
- Trap
- Assuming SGACLs need to know IP subnets.
-
MACsec
MACsec (IEEE 802.1AE) provides Layer 2 encryption and integrity on a link using AES-GCM, with keys negotiated by MACsec Key Agreement.
- Remember
- Switch-to-switch links commonly use pre-shared keys, while host-to-switch MACsec uses 802.1X with MKA.
- Tested as
- Requirements to encrypt traffic on campus or data center links point to MACsec.
- Trap
- Choosing IPsec for a requirement that names Ethernet links between switches in the same building.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
TACACS+ vs. RADIUS
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| TACACS+ | AAA protocol favored for device administration | TCP 49; full payload encryption; separate authentication, authorization and accounting; per-command authorization | Choosing it for 802.1X network access, which uses RADIUS |
| RADIUS | Open-standard AAA protocol for network access | UDP 1812 and 1813; encrypts only the password; combines authentication and authorization | Expecting per-command authorization granularity |
Standard vs. extended ACL vs. CoPP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Standard ACL | Filters on source address only | Placed near the destination to avoid blocking other paths | Placing it near the source and cutting off unrelated destinations |
| Extended ACL | Filters on source, destination, protocol and ports | Placed near the source to drop unwanted traffic early | Forgetting the implicit deny blocks routing protocols |
| CoPP | MQC policy applied to the control plane | Rate-limits traffic to the route processor rather than filtering transit traffic | Expecting it to filter traffic passing through the router |
TrustSec vs. MACsec
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| TrustSec | Group-based segmentation using scalable group tags | Controls who may talk to whom based on role | Assuming it encrypts traffic |
| MACsec | IEEE 802.1AE Layer 2 link encryption | Protects confidentiality and integrity on each hop | Assuming it enforces access policy between user groups |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Local fallback after rejection
- What candidates pick
- The administrator can log in with the local account after TACACS+ denies the user.
- Why it looks right
- The method list ends with local, which looks like a backup.
- Why it's wrong
- The next method is used only when the current one returns an error, such as no response; a reject is a definitive answer.
Clue to watch for The scenario says the server is reachable and responded.
-
RADIUS for command authorization
- What candidates pick
- Use RADIUS to authorize each configuration command an administrator enters.
- Why it looks right
- RADIUS is the most widely used AAA protocol.
- Why it's wrong
- TACACS+ separates authorization from authentication and supports command authorization; RADIUS combines them and lacks that granularity.
Clue to watch for The requirement mentions per-command control or detailed command accounting for device administrators.
-
CoPP that drops routing
- What candidates pick
- Police all traffic to the control plane to a low rate to stop attacks.
- Why it looks right
- Lower limits sound more secure.
- Why it's wrong
- Routing protocol and management traffic also reach the control plane; over-policing them causes adjacency flaps and lockouts.
Clue to watch for After CoPP is applied, OSPF or BGP neighbors start dropping.
-
ACL to block an application on 443
- What candidates pick
- Use an extended ACL denying TCP 443 to block a file-sharing application.
- Why it looks right
- ACLs are the familiar filtering tool.
- Why it's wrong
- Blocking TCP 443 stops all HTTPS; identifying one application on a shared port requires the application visibility and control of an NGFW.
Clue to watch for The requirement names an application rather than a port and other web traffic must keep working.
-
Disabling certificate checks
- What candidates pick
- Set verify=False in the API script so it connects to the controller reliably.
- Why it looks right
- Lab examples often do this and it removes errors.
- Why it's wrong
- Skipping certificate validation exposes the token and credentials to interception; production should trust the controller's certificate properly.
Clue to watch for The question asks for the most secure way to call the API.
-
401 vs. 403
- What candidates pick
- A 403 response means the token is missing or expired.
- Why it looks right
- Both codes sound like 'access denied'.
- Why it's wrong
- 401 Unauthorized means authentication failed or is missing; 403 Forbidden means the client is authenticated but lacks permission for that resource.
Clue to watch for The scenario says the same token works for read calls but fails for a write call.
Answer framework
Use this sequence for Security questions, which reward precise reading of order, direction and fallback.
- Classify the requirement as management access, traffic filtering, control plane protection, API protection or design component selection.
- For AAA, read the method list left to right and decide whether each method returns an answer or an error in the scenario.
- For ACLs, trace the packet from the top, stop at the first match, and remember the implicit deny and the direction applied.
- For CoPP and APIs, check that legitimate routing, management and authenticated calls still pass at reasonable rates and privileges.
- For design questions, match the stated goal, such as role-based policy, link encryption or application control, to TrustSec, MACsec or an NGFW.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with topic 5.1 in a lab: secure the vty lines, create local users, then add AAA with a TACACS+ or RADIUS server and local fallback. Test login with the server up, down and rejecting, so the method-list behavior becomes something you have seen rather than memorized.
Next, practise ACLs until reading wildcard masks and implicit denies is automatic, then build a CoPP policy that polices ICMP and management traffic while leaving routing protocol classes generous. Watch show policy-map control-plane counters while you ping the router.
The describe topics need structured reading rather than labs. Build one table for 5.4 listing threat defense, endpoint security, NGFW, TrustSec and MACsec with the requirement each one meets, and a short note on API security covering TLS, tokens, least privilege and credential storage. Candidates commonly underestimate REST API security because it looks like an automation topic. Afterwards, study the Automation and Artificial Intelligence domain, where the same APIs are called from scripts, and finish with mixed practice questions.
FAQ
How much is Security worth on ENCOR?
Cisco weights Security at 20% of the v1.2 exam, second only to Infrastructure at 30%.
Is 802.1X or MAB configuration on ENCOR v1.2?
No. The v1.2 security topics list device access control, ACLs, CoPP, REST API security and design components, and do not name 802.1X, MAB or WebAuth. 802.1X still appears as background for host-to-switch MACsec and TrustSec classification.
Do I need to configure TrustSec or MACsec?
No. Topic 5.4 asks you to describe network security design components, so focus on what TrustSec and MACsec do and when to choose them.
Which AAA protocol should I pick in a scenario?
Pick TACACS+ for device administration with command authorization and detailed accounting. Pick RADIUS for network access such as 802.1X and VPN users.
Does Cisco test specific security products by name?
The outline names categories such as threat defense, endpoint security and next-generation firewall rather than products. Knowing Cisco examples helps you recognize scenarios, but the capability is what is tested.
How does this domain connect to Architecture?
SD-Access in the Architecture domain uses TrustSec scalable group tags as its policy plane. Learning TrustSec here explains how the fabric enforces micro-segmentation.
Are CoPP questions about syntax or design?
Both can appear, since topic 5.2 says configure and verify. Know the MQC structure applied under control-plane and the design rule of protecting the CPU without starving routing and management traffic.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have worked through AAA fallback rules, ACL and CoPP behavior, API protection and the roles of TrustSec, MACsec and NGFWs. Check how well that holds up in practice questions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way