5.0 Security

What this domain tests

Domain 5 is 20% of the ENCOR exam. It is the largest single domain. It has four topics: device access control, infrastructure security features, REST API security, and network security design components.

Each topic asks the same question: what are you protecting, and how do you prove the protection works? For each control, learn to name three things:

• Protected plane: management, control, or data.
• Enforcement point: the device or system that makes the permit or deny decision.
• Proof: the command or counter that shows the control works.

Note: The exam uses two verbs. Configure and verify means you type the commands. Describe means you explain the design and the tradeoffs.

The four topics

• 5.1 Device access control: lines, local users, and AAA. Enforcement point: the line and the AAA server. Proof: show users, show aaa servers.
• 5.2 Infrastructure security features: ACLs filter traffic. Control Plane Policing (CoPP) protects the device CPU. Proof: show access-lists counters, show policy-map control-plane.
• 5.3 REST API security: HTTPS, authentication, authorization, and rate limiting for automation. Proof: the HTTP status code and the token scope.
• 5.4 Network security design: threat defense, endpoint security, Next-Generation Firewall (NGFW), TrustSec, and MACsec. Proof: session state and policy hits on each component.

Articles

• 5.1 Device access control
• 5.1.a Lines and local user authentication
• 5.1.b AAA authentication and authorization
• 5.2 Infrastructure security features
• 5.2.a ACLs
• 5.2.b CoPP
• 5.3 REST API security
• 5.4 Network security design components
• 5.4.a Threat defense
• 5.4.b Endpoint security
• 5.4.c Next-generation firewall
• 5.4.d TrustSec and MACsec

Study plan

Lab the configure topics in this order:

1. Lock down SSH and local access on one device.
2. Add AAA with local fallback.
3. Apply an ACL and prove it with match counters.
4. Add a CoPP policy and prove the class counters increase.

Then read the describe topics. For each one, write one sentence: what problem it solves, and what it does not solve.

Exam traps

• login local uses the local username database. A line password alone does not identify the admin.
• AAA fallback applies on server ERROR, not on a FAIL from a bad password.
• A wildcard mask is not a subnet mask. It is inverted.
• ACL direction is from the interface point of view. Inbound means entering the interface.
• CoPP protects the CPU. It does not replace interface ACLs or firewall policy.
• TrustSec is identity-based segmentation. MACsec is Layer 2 encryption. They solve different problems.

Pass check

You are ready for Domain 5 when you can do these things:

• Configure SSH-only VTY access with local users and prove it with show users.
• Explain AAA method-list order and the difference between FAIL and ERROR.
• Write an extended ACL with wildcard masks and prove it with match counters.
• Explain what CoPP protects and show its per-class counters.
• Explain the difference between a 401 and a 403 API response.
• Choose the correct design component for a scenario: NGFW, TrustSec, MACsec, or endpoint security.