Chapter 1 of 5 · Cisco CCNA 200-201 CBROPS
Security Concepts
CIA triad, deployments, terms, risk, access control, CVSS, visibility and detection methods.
- 8topics
- 35 minfast track
- 2diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1The CIA Triad and Defense in DepthLearn the CIA triad of confidentiality, integrity and availability, and how defense in depth layers several controls so one…4 min
- 2Comparing Security DeploymentsCompare network, endpoint and application security, agent and agentless protection, antivirus, SIEM and SOAR, containers and…Diagram5 min
- 3Core Security TermsDefine threat intelligence, threat hunting, malware analysis, threat actors, run book automation, reverse engineering, anomaly…5 min
- 4Risk, Threat, Vulnerability and ExploitCompare risk, threat, vulnerability and exploit, and learn how risk is assessed, scored, weighted, reduced or accepted in a…4 min
- 5Access Control Models and AAACompare discretionary, mandatory, nondiscretionary, rule based, time based, role based and attribute based access control, and…4 min
- 6CVSS Metrics and ScoringLearn the CVSS terms attack vector, attack complexity, privileges required, user interaction, scope, and the temporal and…4 min
- 7Data Visibility Challenges and Data LossUnderstand why network, host and cloud visibility is hard for detection, and how traffic profiles such as volume and timing…4 min
- 8The Five Tuple and Detection MethodsUse the five tuple to isolate a compromised host in grouped logs, and compare rule based detection with behavioural and…Diagram5 min
About this chapter
What this chapter covers
Security Concepts builds the vocabulary and the mental models that every later chapter depends on.
It starts with the goals of security and the strategy of layered defence. It then moves through deployment choices, key terms, risk, access control and vulnerability scoring.
The last topics are about detection. They ask why some activity is hard to see, how a profile of normal traffic exposes data loss, and how analysts narrow a log set down to one host.
How the topics fit together
The chapter moves from principles, to people and processes, to the evidence an analyst reads.
The first pages set the goals and the layers. The deployment page shows where controls run and how a SIEM and SOAR platform tie them together.
The terms page names the activities of a security team, such as hunting and malware analysis. The risk and CVSS pages then explain how a team ranks problems, and the access control page covers who may do what.
The final two pages turn to detection. They show where visibility fails, how traffic profiles reveal data loss, how the five tuple isolates a compromised host, and how rule based detection compares with behavioural and statistical detection.
Many later topics reuse ideas from this chapter, especially the CIA goals, the five tuple and the difference between rule based and behavioural detection.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and diagrams.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
This chapter is mostly about definitions and comparisons. Practise by describing a short scenario and naming the term, model or method that fits it.
Ready for more practice?
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.