Examius
🇺🇸 Cisco Certified Network Associate (CCNA) · flashcards
Cisco Certified Network Associate (CCNA) Security Fundamentals Flashcards
50 question-and-answer cards covering Security Fundamentals as it is examined in Cisco Certified Network Associate (CCNA). 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Security Fundamentals deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What are the key steps to secure administrative access on a Cisco device?
Set strong enable secret and line passwords, use local or AAA authentication, encrypt passwords (service password-encryption / secret), restrict access via ACLs, use SSH instead of Telnet, and configure exec-timeout and login banners.
What is the difference between the 'enable password' and 'enable secret' commands on a Cisco device?
'enable password' stores the password in weak/clear form, while 'enable secret' stores it as a strong MD5 (or stronger) hash. enable secret takes precedence and is preferred.
Why is SSH preferred over Telnet for remote device access?
SSH encrypts the entire session including credentials, while Telnet sends everything, including passwords, in cleartext, making it vulnerable to interception.
What are the required steps to enable SSH on a Cisco device?
Configure a hostname and domain name, generate an RSA key pair (crypto key generate rsa), create a local user, set transport input ssh on the VTY lines, and enable SSH (ideally version 2).
What command sets SSH version 2 on a Cisco router?
ip ssh version 2
What is an Access Control List (ACL) in Cisco networking?
An ordered set of rules that filter traffic by permitting or denying packets based on criteria such as source/destination IP, protocol, and port.
What is the difference between a standard and an extended ACL?
A standard ACL filters based only on the source IP address (numbered 1-99/1300-1999). An extended ACL filters on source and destination IP, protocol, and port numbers (numbered 100-199/2000-2699).
Where should standard and extended ACLs ideally be placed?
Standard ACLs should be placed as close to the destination as possible; extended ACLs should be placed as close to the source as possible to drop unwanted traffic early.
What is the implicit rule at the end of every Cisco ACL?
An implicit 'deny any' (deny all) rule; any traffic not explicitly permitted is dropped.
How does a wildcard mask differ from a subnet mask in an ACL?
A wildcard mask is the inverse of a subnet mask: a 0 bit means the corresponding address bit must match exactly, and a 1 bit means it can be ignored (any value).
What is the purpose of switchport port security?
It restricts which MAC addresses can send traffic on a switch port, limiting the number of devices and protecting against MAC flooding and unauthorized device connections.
What are the three port-security violation modes on a Cisco switch?
Protect (drops offending frames silently), Restrict (drops frames and logs/increments counters), and Shutdown (err-disables the port; the default mode).
What is a sticky MAC address in port security?
A dynamically learned MAC address that the switch automatically adds to the running configuration, configured with 'switchport port-security mac-address sticky'.
How do you re-enable a port that was err-disabled by a port-security violation?
Manually issue 'shutdown' followed by 'no shutdown' on the interface, or configure errdisable recovery to re-enable it automatically after a timeout.
What is DHCP snooping and what does it protect against?
A Layer 2 security feature that filters DHCP messages, treating ports as trusted or untrusted, to prevent rogue DHCP server attacks and starvation attacks.
What is Dynamic ARP Inspection (DAI) and what does it mitigate?
A Layer 2 feature that validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing/poisoning man-in-the-middle attacks.
What does BPDU Guard do, and on which ports is it typically enabled?
BPDU Guard err-disables a port if it receives a BPDU; it is enabled on PortFast-configured access ports to prevent unauthorized switches from affecting the spanning-tree topology.
What Layer 2 attack does port security primarily mitigate, and how?
It mitigates MAC address flooding (CAM table overflow) attacks by limiting the number of MAC addresses allowed on a port, preventing the switch from being forced into hub-like behavior.
What is the difference between a remote-access VPN and a site-to-site VPN?
A remote-access VPN connects individual remote users to a network (often via client software like AnyConnect/SSL). A site-to-site VPN connects entire networks/locations together via gateways, transparent to end users.
What is IPsec and what two main security services does it provide?
IPsec is a framework of protocols for securing IP communications. It provides confidentiality (via encryption/ESP) and integrity/authentication (via AH or ESP), commonly used for site-to-site VPNs.
What is the difference between IPsec's AH and ESP protocols?
AH (Authentication Header) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload) provides confidentiality (encryption) plus integrity and authentication.
List the wireless security protocols in order from least to most secure: WEP, WPA, WPA2, WPA3.
WEP (weakest, deprecated), WPA, WPA2, then WPA3 (strongest, current standard).
What encryption standard does WPA2 use, and how does WPA3 improve on it?
WPA2 uses AES with CCMP. WPA3 also uses AES but adds SAE (Simultaneous Authentication of Equals) to replace the pre-shared key handshake, providing stronger protection against offline dictionary attacks and forward secrecy.
What is the difference between WPA personal (PSK) mode and enterprise (802.1X) mode?
Personal mode uses a shared pre-shared key for all users. Enterprise mode uses 802.1X with a RADIUS server to authenticate each user individually with unique credentials.
What this deck covers
The Security Fundamentals deck follows the Cisco Certified Network Associate (CCNA) Security Fundamentals syllabus — 4 chapters and 14 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 12.5 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 163 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Security Fundamentals flashcards FAQ
How many Security Fundamentals flashcards are in this Cisco Certified Network Associate (CCNA) deck?
50 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Cisco Certified Network Associate (CCNA) flashcards free?
Yes. The preview here is free to read with no signup, and the full 50-card deck is free inside the Examius app.
What do the Security Fundamentals cards cover?
They follow the Cisco Certified Network Associate (CCNA) Security Fundamentals syllabus — 4 chapters and 14 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.