Chapter 5 of 6 · Cisco CCNP 350-401 ENCOR
Security
Device access, AAA, ACLs, CoPP, REST API security, threat defense, next generation firewalls, TrustSec and MACsec.
- 7topics
- 38 minfast track
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Device Access Lines and Local UsersSecure console and vty access on IOS XE with local users, enable secret, SSH, exec timeouts, access classes and login blocking…5 min
- 2AAA with RADIUS and TACACS+Configure AAA on IOS XE with RADIUS and TACACS+: method lists, authentication, authorisation, accounting, server groups, local…5 min
- 3Access Control ListsConfigure and verify standard, extended, named and IPv6 ACLs on IOS XE: wildcard masks, rule order, direction, placement and…6 min
- 4Control Plane PolicingUnderstand and configure Control Plane Policing on IOS XE to protect the CPU: the three planes, MQC classes, police actions and…6 min
- 5REST API SecurityDescribe how REST APIs are secured: HTTPS, basic authentication, tokens, API keys, OAuth 2.0 scopes, rate limiting, input…5 min
- 6Threat Defense, Endpoint Security and Next Generation FirewallsDescribe layered threat defense, endpoint security with EDR and posture, and next generation firewall features such as…5 min
- 7TrustSec and MACsecUnderstand Cisco TrustSec security group tags with classification, propagation and enforcement through SGACLs and SXP, and MACsec…6 min
About this chapter
What this chapter covers
Security is about controlling who can reach your network devices, what traffic they accept and how the wider design defends the network.
It starts at the device itself, with logins, users and AAA. It then moves to filtering traffic and protecting the CPU, and to securing the APIs that automation uses. It ends with the design level, where firewalls, endpoint tools, group based policy and link encryption work together.
The chapter follows the Security domain of the CCNP 350-401 ENCOR outline. It has four outline topics, and they are spread across seven pages.
How the topics fit together
The pages move from one device outward to the whole design.
- Lines and local users control the console and remote logins.
- AAA moves that control to a central server with accounting.
- ACLs filter the traffic that crosses the device.
- CoPP protects the CPU from traffic aimed at the device.
- REST API security protects the programmable interfaces.
- Threat defense, endpoints and firewalls form the layers of the design.
- TrustSec and MACsec add group based policy and link encryption.
Several features here have a partner in other chapters, such as the vty ACL in the access page and the SGT in the SD-Access page.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise the device pages in a lab, and be careful while you do. A wrong ACL, AAA list or CoPP policy can lock you out, so keep a console session open. For the design pages, learn which component does which job, and where in the network it sits.
Ready for more practice?
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.