Examius

🇺🇸 Cisco Certified Network Associate (CCNA) · subject

Cisco Certified Network Associate (CCNA) Security Fundamentals Syllabus

The Security Fundamentals syllabus for Cisco Certified Network Associate (CCNA) in full: 4 chapters, 14 topics and 23 sub-topics, every one listed below, plus 50 Security Fundamentals flashcards with answers.

4Chapters
14Topics
23Sub-topics
50Flashcards

Security Fundamentals syllabus: all 4 chapters

Expand any chapter to see its topics and sub-topics.

  1. Security Concepts and Threats

     3 topics
    • Key security terms
      • Threats, vulnerabilities, and exploits
      • Mitigation techniques
    • CIA triad
      • Confidentiality, integrity, availability
    • Common attack types
      • Denial of service and DDoS
      • Spoofing and reflection/amplification
      • Social engineering and phishing

  2. Access Control and AAA

     4 topics
    • Authentication, authorization, and accounting concepts
    • Password policies and management
      • Complexity and rotation
      • Local authentication and password storage
    • RADIUS and TACACS+ overview
    • Multifactor authentication, certificates, and biometrics

  3. Device Hardening and Secure Access

     3 topics
    • Securing device access
      • Enable secret and line passwords
      • Console and VTY protection
      • Login banners
    • Remote access security with SSH
      • Disabling Telnet
      • Key generation and version 2
    • Access control lists
      • Standard numbered and named ACLs
      • Extended ACLs
      • Applying and verifying ACLs

  4. Layer 2 Security and VPNs

     4 topics
    • Port security configuration
      • Static, dynamic, and sticky MAC
      • Violation modes
      • Maximum addresses and aging
    • Layer 2 mitigation features
      • DHCP snooping
      • Dynamic ARP Inspection
    • Remote access and site-to-site VPNs
      • IPsec overview
      • Use cases for VPNs
    • Wireless security protocols (WPA, WPA2, WPA3)

Cisco Certified Network Associate (CCNA) Security Fundamentals flashcards — 50 questions with answers

  1. In information security, what is the difference between a vulnerability, a threat, and an exploit?

    A vulnerability is a weakness in a system. A threat is any potential danger that could exploit a vulnerability. An exploit is the actual tool, code, or technique used to take advantage of a vulnerability.

  2. What is the difference between a threat actor and an attack vector?

    A threat actor is the person or entity that carries out (or intends to carry out) a malicious act. An attack vector is the path or method the threat actor uses to gain access to a target.

  3. What does the CIA triad stand for in network security?

    Confidentiality, Integrity, and Availability.

  4. In the CIA triad, what does Confidentiality protect against?

    Unauthorized disclosure of data; it ensures only authorized users can view sensitive information, typically enforced through encryption and access controls.

  5. In the CIA triad, what does Integrity ensure?

    That data is not altered by unauthorized parties and remains accurate and trustworthy; it is commonly verified using hashing and checksums.

  6. In the CIA triad, what does Availability ensure?

    That systems, data, and services are accessible to authorized users when needed; protected against disruptions like DoS attacks and hardware failure through redundancy.

  7. What is a Denial-of-Service (DoS) attack, and how does a DDoS attack differ from it?

    A DoS attack overwhelms a system or network to make it unavailable to legitimate users. A DDoS (Distributed DoS) does the same but launches the attack from many distributed sources, often a botnet.

  8. What is a man-in-the-middle (on-path) attack?

    An attack where the attacker secretly intercepts and possibly alters communication between two parties who believe they are communicating directly with each other.

  9. What is the difference between phishing, spear phishing, and whaling?

    Phishing is a broad fraudulent message sent to many people. Spear phishing targets a specific individual or group. Whaling targets high-profile individuals such as executives.

  10. What is a reflection/amplification attack?

    An attack where the attacker spoofs the victim's source IP and sends small requests to third-party servers, which then send large responses (amplified traffic) to the victim, magnifying the attack.

  11. In security, what do the terms 'malware,' 'virus,' 'worm,' and 'trojan' mean?

    Malware is any malicious software. A virus attaches to a file and needs user action to spread. A worm self-replicates and spreads across networks without user action. A trojan disguises itself as legitimate software.

  12. What do the three A's in AAA stand for?

    Authentication, Authorization, and Accounting.

  13. In AAA, what is the purpose of Authentication?

    To verify the identity of a user or device, confirming they are who they claim to be (e.g., via username/password or certificate).

  14. In AAA, what is the purpose of Authorization?

    To determine what actions or resources an authenticated user is permitted to access.

  15. In AAA, what is the purpose of Accounting?

    To record and track what an authenticated user does, including resources used, session duration, and commands executed, for auditing and billing.

  16. What are the three factors of authentication?

    Something you know (password/PIN), something you have (token/smart card), and something you are (biometrics).

  17. What is multifactor authentication (MFA)?

    An authentication method that requires two or more independent factors from different categories (know, have, are) to verify identity, greatly increasing security.

  18. What characteristics define a strong password policy?

    Minimum length, complexity (mix of upper/lower case, numbers, symbols), regular expiration/rotation, password history to prevent reuse, and account lockout after failed attempts.

  19. Why should default credentials be changed on network devices?

    Default usernames and passwords are publicly known and documented, making devices trivially easy for attackers to access if left unchanged.

  20. What is the primary difference between RADIUS and TACACS+?

    RADIUS is an open standard that combines authentication and authorization and is commonly used for network access; TACACS+ is Cisco-proprietary, separates authentication, authorization, and accounting, and is commonly used for device administration.

Show the other 30 Security Fundamentals flashcards

  1. Which transport protocol and ports does RADIUS use?

    RADIUS uses UDP, typically ports 1812/1813 (or legacy 1645/1646) for authentication and accounting.

  2. Which transport protocol and port does TACACS+ use?

    TACACS+ uses TCP port 49.

  3. How do RADIUS and TACACS+ differ in what they encrypt?

    RADIUS encrypts only the password in the access-request packet, leaving the rest in cleartext. TACACS+ encrypts the entire packet body.

  4. What is the advantage of TACACS+ separating authentication, authorization, and accounting?

    It allows granular, per-command authorization control over device administration, ideal for controlling exactly what commands an admin can run.

  5. How does biometric authentication satisfy the authentication factor model?

    Biometrics (fingerprint, retina, facial recognition) represent the 'something you are' factor, identifying users by unique physical characteristics.

  6. What role does a digital certificate play in authentication?

    A digital certificate binds a public key to an identity and is issued by a trusted Certificate Authority (CA), allowing parties to verify identity and establish encrypted, trusted communication.

  7. What are the key steps to secure administrative access on a Cisco device?

    Set strong enable secret and line passwords, use local or AAA authentication, encrypt passwords (service password-encryption / secret), restrict access via ACLs, use SSH instead of Telnet, and configure exec-timeout and login banners.

  8. What is the difference between the 'enable password' and 'enable secret' commands on a Cisco device?

    'enable password' stores the password in weak/clear form, while 'enable secret' stores it as a strong MD5 (or stronger) hash. enable secret takes precedence and is preferred.

  9. Why is SSH preferred over Telnet for remote device access?

    SSH encrypts the entire session including credentials, while Telnet sends everything, including passwords, in cleartext, making it vulnerable to interception.

  10. What are the required steps to enable SSH on a Cisco device?

    Configure a hostname and domain name, generate an RSA key pair (crypto key generate rsa), create a local user, set transport input ssh on the VTY lines, and enable SSH (ideally version 2).

  11. What command sets SSH version 2 on a Cisco router?

    ip ssh version 2

  12. What is an Access Control List (ACL) in Cisco networking?

    An ordered set of rules that filter traffic by permitting or denying packets based on criteria such as source/destination IP, protocol, and port.

  13. What is the difference between a standard and an extended ACL?

    A standard ACL filters based only on the source IP address (numbered 1-99/1300-1999). An extended ACL filters on source and destination IP, protocol, and port numbers (numbered 100-199/2000-2699).

  14. Where should standard and extended ACLs ideally be placed?

    Standard ACLs should be placed as close to the destination as possible; extended ACLs should be placed as close to the source as possible to drop unwanted traffic early.

  15. What is the implicit rule at the end of every Cisco ACL?

    An implicit 'deny any' (deny all) rule; any traffic not explicitly permitted is dropped.

  16. How does a wildcard mask differ from a subnet mask in an ACL?

    A wildcard mask is the inverse of a subnet mask: a 0 bit means the corresponding address bit must match exactly, and a 1 bit means it can be ignored (any value).

  17. What is the purpose of switchport port security?

    It restricts which MAC addresses can send traffic on a switch port, limiting the number of devices and protecting against MAC flooding and unauthorized device connections.

  18. What are the three port-security violation modes on a Cisco switch?

    Protect (drops offending frames silently), Restrict (drops frames and logs/increments counters), and Shutdown (err-disables the port; the default mode).

  19. What is a sticky MAC address in port security?

    A dynamically learned MAC address that the switch automatically adds to the running configuration, configured with 'switchport port-security mac-address sticky'.

  20. How do you re-enable a port that was err-disabled by a port-security violation?

    Manually issue 'shutdown' followed by 'no shutdown' on the interface, or configure errdisable recovery to re-enable it automatically after a timeout.

  21. What is DHCP snooping and what does it protect against?

    A Layer 2 security feature that filters DHCP messages, treating ports as trusted or untrusted, to prevent rogue DHCP server attacks and starvation attacks.

  22. What is Dynamic ARP Inspection (DAI) and what does it mitigate?

    A Layer 2 feature that validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing/poisoning man-in-the-middle attacks.

  23. What does BPDU Guard do, and on which ports is it typically enabled?

    BPDU Guard err-disables a port if it receives a BPDU; it is enabled on PortFast-configured access ports to prevent unauthorized switches from affecting the spanning-tree topology.

  24. What Layer 2 attack does port security primarily mitigate, and how?

    It mitigates MAC address flooding (CAM table overflow) attacks by limiting the number of MAC addresses allowed on a port, preventing the switch from being forced into hub-like behavior.

  25. What is the difference between a remote-access VPN and a site-to-site VPN?

    A remote-access VPN connects individual remote users to a network (often via client software like AnyConnect/SSL). A site-to-site VPN connects entire networks/locations together via gateways, transparent to end users.

  26. What is IPsec and what two main security services does it provide?

    IPsec is a framework of protocols for securing IP communications. It provides confidentiality (via encryption/ESP) and integrity/authentication (via AH or ESP), commonly used for site-to-site VPNs.

  27. What is the difference between IPsec's AH and ESP protocols?

    AH (Authentication Header) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload) provides confidentiality (encryption) plus integrity and authentication.

  28. List the wireless security protocols in order from least to most secure: WEP, WPA, WPA2, WPA3.

    WEP (weakest, deprecated), WPA, WPA2, then WPA3 (strongest, current standard).

  29. What encryption standard does WPA2 use, and how does WPA3 improve on it?

    WPA2 uses AES with CCMP. WPA3 also uses AES but adds SAE (Simultaneous Authentication of Equals) to replace the pre-shared key handshake, providing stronger protection against offline dictionary attacks and forward secrecy.

  30. What is the difference between WPA personal (PSK) mode and enterprise (802.1X) mode?

    Personal mode uses a shared pre-shared key for all users. Enterprise mode uses 802.1X with a RADIUS server to authenticate each user individually with unique credentials.

Cisco Certified Network Associate (CCNA) Security Fundamentals FAQ

What is in the Cisco Certified Network Associate (CCNA) Security Fundamentals syllabus?

Cisco Certified Network Associate (CCNA) Security Fundamentals is split into 4 chapters: Security Concepts and Threats, Access Control and AAA, Device Hardening and Secure Access and Layer 2 Security and VPNs. Together they contain 14 topics and 23 sub-topics.

How many chapters are in Cisco Certified Network Associate (CCNA) Security Fundamentals?

4 chapters, containing 14 topics and 23 sub-topics. The largest chapter is Access Control and AAA, with 4 topics.

Are there flashcards for Cisco Certified Network Associate (CCNA) Security Fundamentals?

Yes — a 50-card Security Fundamentals deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.