Chapter 2 of 5 · Cisco CCST 100-160 Cybersecurity
Basic Network Security Concepts
Protocol weaknesses, addressing, architecture, wireless, ACLs, firewalls, VPN and NAC.
- 7topics
- 35 minfast track
- 6diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1TCP/IP Protocol VulnerabilitiesLearn the security weaknesses of TCP, UDP, HTTP, ARP, ICMP, DHCP and DNS, the attacks that abuse them, and the simple controls…Diagram6 min
- 2Network Addresses, Segmentation and NATLearn how IPv4, IPv6 and MAC addresses, CIDR notation, NAT, private and public networks and network segmentation affect the…5 min
- 3Security Architecture, DMZ, Virtualization and CloudLearn how a secure network is laid out in zones, what a DMZ does, and the security points of virtualization and cloud including…Diagram5 min
- 4Honeypots, Proxy Servers, IDS and IPSLearn what honeypots, proxy servers, intrusion detection systems and intrusion prevention systems do, how they differ, and where…Diagram5 min
- 5Securing a SoHo Wireless NetworkLearn how to secure a small office or home wireless network with strong encryption, a sensible SSID, careful use of MAC filtering…4 min
- 6Access Control Lists and FirewallsLearn how ACLs and firewalls filter traffic, how rules are processed top down with an implicit deny, and the main firewall types…5 min
- 7VPNs and Network Access ControlLearn how VPNs protect traffic with encrypted tunnels, how site to site and remote access VPNs differ, and how NAC checks devices…Diagram5 min
About this chapter
What this chapter covers
This chapter explains how networks work and how they are made safer.
It begins with the weaknesses built into common protocols, then looks at addressing and how a network is divided and laid out. It finishes with the technologies that filter, inspect and control access.
The content is written for beginners. Each page defines its terms, and the few commands shown are short and read like a plain recipe.
How the topics fit together
The chapter moves from the problem to the design to the controls.
Here is how the pieces connect:
- Protocol vulnerabilities show where attackers find weak spots in TCP, UDP, HTTP, ARP, ICMP, DHCP and DNS.
- Addresses and segmentation explain how IPv4, IPv6, MAC addresses, CIDR and NAT shape what can reach what.
- Architecture arranges systems into zones such as a DMZ, and covers virtualization and the cloud.
- Detection and decoys add honeypots, proxies, IDS and IPS to watch and shape traffic.
- Wireless shows how to secure a small wireless network.
- Access technologies such as ACLs, firewalls, VPNs and NAC decide who and what may pass.
Many exam questions describe a problem and ask for the best control. Work out which protocol or layer is at risk first, then choose the control that fits.
How to use these pages
Each topic page has the same five sections, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams, tables and short examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions with short answers.
If you can, try a few things yourself. View the ARP table on your own computer, look at the settings page of a home router, or read a short ACL and say what it allows. A simulator such as Cisco Packet Tracer is a safe place to practise.
Ready for more practice?
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.