Cisco Certified Network Associate (CCNA) Security Fundamentals Syllabus

Security Fundamentals syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Fundamentals in Cisco Certified Network Associate (CCNA), not a summary of it.

1. 1

   Security Concepts and Threats

   3 topics

   • Key security terms
     • Threats, vulnerabilities, and exploits
     • Mitigation techniques
   • CIA triad
     • Confidentiality, integrity, availability
   • Common attack types
     • Denial of service and DDoS
     • Spoofing and reflection/amplification
     • Social engineering and phishing
2. 2

   Access Control and AAA

   4 topics

   • Authentication, authorization, and accounting concepts
   • Password policies and management
     • Complexity and rotation
     • Local authentication and password storage
   • RADIUS and TACACS+ overview
   • Multifactor authentication, certificates, and biometrics
3. 3

   Device Hardening and Secure Access

   3 topics

   • Securing device access
     • Enable secret and line passwords
     • Console and VTY protection
     • Login banners
   • Remote access security with SSH
     • Disabling Telnet
     • Key generation and version 2
   • Access control lists
     • Standard numbered and named ACLs
     • Extended ACLs
     • Applying and verifying ACLs
4. 4

   Layer 2 Security and VPNs

   4 topics

   • Port security configuration
     • Static, dynamic, and sticky MAC
     • Violation modes
     • Maximum addresses and aging
   • Layer 2 mitigation features
     • DHCP snooping
     • Dynamic ARP Inspection
   • Remote access and site-to-site VPNs
     • IPsec overview
     • Use cases for VPNs
   • Wireless security protocols (WPA, WPA2, WPA3)

Security Fundamentals flashcards for Cisco Certified Network Associate (CCNA)

24 of 50 cards from the Security Fundamentals deck — real questions with worked answers.

1. In information security, what is the difference between a vulnerability, a threat, and an exploit?

   A vulnerability is a weakness in a system. A threat is any potential danger that could exploit a vulnerability. An exploit is the actual tool, code, or technique used to take advantage of a vulnerability.

2. What is the difference between a threat actor and an attack vector?

   A threat actor is the person or entity that carries out (or intends to carry out) a malicious act. An attack vector is the path or method the threat actor uses to gain access to a target.

3. What does the CIA triad stand for in network security?

   Confidentiality, Integrity, and Availability.

4. In the CIA triad, what does Confidentiality protect against?

   Unauthorized disclosure of data; it ensures only authorized users can view sensitive information, typically enforced through encryption and access controls.

5. In the CIA triad, what does Integrity ensure?

   That data is not altered by unauthorized parties and remains accurate and trustworthy; it is commonly verified using hashing and checksums.

6. In the CIA triad, what does Availability ensure?

   That systems, data, and services are accessible to authorized users when needed; protected against disruptions like DoS attacks and hardware failure through redundancy.

7. What is a Denial-of-Service (DoS) attack, and how does a DDoS attack differ from it?

   A DoS attack overwhelms a system or network to make it unavailable to legitimate users. A DDoS (Distributed DoS) does the same but launches the attack from many distributed sources, often a botnet.

8. What is a man-in-the-middle (on-path) attack?

   An attack where the attacker secretly intercepts and possibly alters communication between two parties who believe they are communicating directly with each other.

9. What is the difference between phishing, spear phishing, and whaling?

   Phishing is a broad fraudulent message sent to many people. Spear phishing targets a specific individual or group. Whaling targets high-profile individuals such as executives.

10. What is a reflection/amplification attack?

    An attack where the attacker spoofs the victim's source IP and sends small requests to third-party servers, which then send large responses (amplified traffic) to the victim, magnifying the attack.

11. In security, what do the terms 'malware,' 'virus,' 'worm,' and 'trojan' mean?

    Malware is any malicious software. A virus attaches to a file and needs user action to spread. A worm self-replicates and spreads across networks without user action. A trojan disguises itself as legitimate software.

12. What do the three A's in AAA stand for?

    Authentication, Authorization, and Accounting.

13. In AAA, what is the purpose of Authentication?

    To verify the identity of a user or device, confirming they are who they claim to be (e.g., via username/password or certificate).

14. In AAA, what is the purpose of Authorization?

    To determine what actions or resources an authenticated user is permitted to access.

15. In AAA, what is the purpose of Accounting?

    To record and track what an authenticated user does, including resources used, session duration, and commands executed, for auditing and billing.

16. What are the three factors of authentication?

    Something you know (password/PIN), something you have (token/smart card), and something you are (biometrics).

17. What is multifactor authentication (MFA)?

    An authentication method that requires two or more independent factors from different categories (know, have, are) to verify identity, greatly increasing security.

18. What characteristics define a strong password policy?

    Minimum length, complexity (mix of upper/lower case, numbers, symbols), regular expiration/rotation, password history to prevent reuse, and account lockout after failed attempts.

19. Why should default credentials be changed on network devices?

    Default usernames and passwords are publicly known and documented, making devices trivially easy for attackers to access if left unchanged.

20. What is the primary difference between RADIUS and TACACS+?

    RADIUS is an open standard that combines authentication and authorization and is commonly used for network access; TACACS+ is Cisco-proprietary, separates authentication, authorization, and accounting, and is commonly used for device administration.

21. Which transport protocol and ports does RADIUS use?

    RADIUS uses UDP, typically ports 1812/1813 (or legacy 1645/1646) for authentication and accounting.

22. Which transport protocol and port does TACACS+ use?

    TACACS+ uses TCP port 49.

23. How do RADIUS and TACACS+ differ in what they encrypt?

    RADIUS encrypts only the password in the access-request packet, leaving the rest in cleartext. TACACS+ encrypts the entire packet body.

24. What is the advantage of TACACS+ separating authentication, authorization, and accounting?

    It allows granular, per-command authorization control over device administration, ideal for controlling exactly what commands an admin can run.

See more Security Fundamentals flashcards →

Planning Security Fundamentals for Cisco Certified Network Associate (CCNA)

Security Fundamentals (Cisco Certified Network Associate (CCNA)) FAQ