Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Security fundamentals: controls that reinforce one another

Network security is not one feature applied at the perimeter. It is a chain of identity, authorization, segmentation, traffic policy, endpoint trust, protected management, monitoring, and recovery. CCNA-level security becomes manageable when every control is tied to a specific abuse case and its trust boundary.

Use precise risk language

A threat is a potential cause of harm. A vulnerability is a weakness. An exploit is a method or action that takes advantage of a weakness. A mitigation reduces likelihood or impact. Risk connects likelihood and consequence in context. Installing a control does not erase the underlying vulnerability from history or guarantee that exploitation is impossible.

This vocabulary keeps incident reports honest. “The firewall was the threat” is usually imprecise; a misconfiguration may be the vulnerability, an attacker the threat actor, crafted traffic the exploit path, and a corrected rule plus review the mitigation.

Include people and physical boundaries

Awareness teaches all users to recognize and report common danger. Training builds role-specific skill through practice. Physical access controls protect equipment, consoles, cabling, and removable media. A locked room does not replace device authentication, and a strong password does not protect a reset button an unauthorized person can reach.

Programs need reporting paths, periodic refresh, exercises, and measurement. The goal is reliable behavior, not a completed slide deck.

Protect device access in layers

Use a protected enable secret rather than a reversible or clear-text privileged password. Create named local accounts where centralized AAA is unavailable, and apply authentication to console and VTY lines. Limit remote management to secure transport and trusted source networks. Test recovery before an outage.

Password policy should emphasize length, uniqueness, protected storage, breach response, and controlled reset. Complexity rules that produce predictable patterns are not enough. Multifactor authentication combines independent factor types. Certificates bind a key to an identity under a trust model. Biometrics are inherence factors and need fallback and privacy handling.

Understand VPN protection scope

IPsec can protect confidentiality, integrity, and peer authenticity across an untrusted IP network. Remote-access VPNs connect an individual client to an organization. Site-to-site VPNs connect networks through security gateways. IKE negotiates peers and security associations; ESP commonly protects payloads.

A tunnel does not decide which internal resources a user should reach, secure a compromised endpoint, or guarantee application identity. Layer authorization, segmentation, endpoint controls, and logging around it.

Treat ACLs as ordered policy

An IPv4 ACL processes entries from top to bottom and stops on a match. An implicit deny follows the explicit rules. Standard ACLs match source addresses; extended ACLs can include source, destination, protocol, and ports. Wildcard masks identify which address bits matter. Named and numbered lists differ in identification, not in the need for precise ordering.

Placement and direction are part of the control. An excellent ACL attached to the wrong interface or direction enforces the wrong path. State the traffic tuple, place the narrowest sufficient rules before broad ones, preserve required management and routing traffic, and inspect hit counts after controlled tests.

Establish trust at Layer 2

DHCP snooping permits server responses only from trusted directions and builds bindings from legitimate leases. Dynamic ARP inspection can use those bindings to reject inconsistent ARP claims. Port security limits or controls learned MAC addresses on an access port. These features depend on deliberate trust markings and accurate topology.

If DHCP snooping has no binding for a legitimate statically addressed host, DAI needs an appropriate alternative validation design. If every uplink is marked untrusted, real server replies fail. If an access port allows unlimited learned addresses, port security provides no meaningful limit. Verify bindings, drops, violations, and recovery behavior.

Separate AAA questions

Authentication asks who the subject is. Authorization asks what that authenticated subject may do. Accounting records what occurred. TACACS+ and RADIUS can support centralized workflows, but protocol choice does not replace resilient server design, local emergency access, protected transport, time synchronization, and log review.

A login success proves authentication, not that command authorization or accounting works. Test each phase separately.

Choose modern wireless protection

WPA was a transitional improvement over older wireless security. WPA2 commonly uses AES-based CCMP protection, while WPA3 adds modern improvements including a stronger personal-mode exchange. Personal mode uses a shared secret; enterprise mode uses per-user or per-device authentication through an AAA design.

For a WPA2-PSK WLAN, set the SSID, select the WPA2/AES policy, configure a strong shared key through an approved channel, map the correct client segment, and test with a supported client. A hidden SSID is not encryption, and a shared key does not identify which individual used it.

Validate the whole control path

Security troubleshooting must preserve access while identifying the first failed control. Capture source, destination, protocol, identity, interface, direction, and time. Check AAA logs, ACL counters, snooping bindings, DAI drops, port-security state, VPN associations, and wireless policy. Change one element with a rollback plan; do not disable the entire control stack to make the symptom disappear.