Chapter 6 of 6 · Cisco CCNA 200-301

Security Fundamentals

Threats, passwords, VPNs, ACLs, Layer 2 protections, AAA and wireless security topics.

  • 10topics
  • 54 minfast track
  • 4diagrams and exhibits
  • 15%of the exam
Start with Key Security Concepts

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Key Security ConceptsLearn how threats, vulnerabilities, exploits and risk differ, the CIA triad, common attack types and the main mitigation…5 min
  2. 2Security Program ElementsLearn why user awareness, training and physical access control are part of a security program, and how each one reduces risk…5 min
  3. 3Device Access Control with Local PasswordsConfigure and verify local passwords on a Cisco device: console and vty lines, enable secret, local usernames, password…5 min
  4. 4Security Password Policies and AlternativesLearn what makes a strong password policy, covering management and complexity, plus alternatives such as MFA, certificates and…5 min
  5. 5IPsec Remote Access and Site-to-Site VPNsUnderstand what a VPN does, how site-to-site and remote access VPNs differ, and how IPsec uses IKE, ESP and AH to protect traffic…Diagram6 min
  6. 6Access Control ListsLearn how Cisco standard and extended ACLs filter traffic, how wildcard masks and the implicit deny work, where to place them…Diagram6 min
  7. 7Layer 2 Security FeaturesConfigure and verify port security, DHCP snooping and dynamic ARP inspection on a Cisco switch to stop rogue devices, rogue DHCP…Diagram6 min
  8. 8Authentication, Authorization and AccountingCompare the three parts of AAA, what authentication, authorization and accounting each do, and how RADIUS, TACACS+ and 802.1X…6 min
  9. 9Wireless Security Protocols: WPA, WPA2 and WPA3Compare WEP, WPA, WPA2 and WPA3, learn the difference between Personal and Enterprise modes, and understand the encryption and…5 min
  10. 10Configuring a WPA2 PSK WLAN in the GUIA step-by-step guide to creating a WPA2 PSK wireless network in a Cisco controller GUI, with the fields to set, how to check it…5 min

About this chapter

What this chapter covers

Security Fundamentals explains how networks are attacked and how they are defended.

It starts with the vocabulary of threats and risk, moves through the human and physical side of security, and then covers the main technical controls a Cisco network engineer configures or recognises.

The chapter follows domain 5.0 of the Cisco CCNA 200-301 version 1.1 exam topics. It has ten published objectives, and each gets its own page.

Weight in the exam

Domain 5.0 carries about 15 percent of the published exam objectives.

Several of its topics, such as access control lists and Layer 2 security features, ask for configuration and verification skills. Others ask for clear explanations of concepts.

How the topics fit together

The pages move from ideas to controls.

Conceptsthreats and riskPeopleawareness and physicalIdentitypasswords and AAATraffic controlsVPN ACL Layer 2WirelessWPA2 and WPA3

The first two pages set the scene. Key security concepts define threats, vulnerabilities, exploits and mitigation. Security program elements show that awareness, training and physical access control matter as much as technology.

The next two pages are about proving identity. Device access with local passwords covers the console, vty lines and privileged mode on a Cisco device. Password policies goes further, with complexity, multifactor authentication, certificates and biometrics.

Then come the controls that protect traffic:

  • IPsec VPNs protect data across untrusted networks.
  • Access control lists filter traffic at a router.
  • Layer 2 security features, namely port security, DHCP snooping and dynamic ARP inspection, defend the local network from inside threats.

AAA concepts show how identity, permissions and records are managed centrally, with RADIUS, TACACS+ and 802.1X.

The final two pages cover wireless. Wireless security protocols compare WPA, WPA2 and WPA3, and the last page applies them in a worked WPA2 PSK WLAN configuration in the controller GUI.

Exam tip

Learn the pages in order, because identity and AAA ideas return in the wireless pages.

How to use these pages

Each topic page has the same shape, so you always know where to look.

  • What the topic is.
  • How it works.
  • What to remember.
  • Common mistakes.
  • Prompts to test yourself.

The configuration topics, especially ACLs and Layer 2 security, are best learned by practising in a simulator.

Ready for more practice?

The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.