Cisco CCNA Preparation · lesson 27 of 36 · 25 min
Security Concepts — Threats, Vulnerabilities, Exploits
The CCNA exam expects you to distinguish these terms precisely:
Vulnerability — a weakness in a system (unpatched software, misconfiguration, weak password).
Threat — a potential danger that could exploit a vulnerability (malware, insider, natural disaster).
Exploit — the actual mechanism used to take advantage of a vulnerability.
Risk — the likelihood and impact of a threat exploiting a vulnerability.
Common attack types: DoS/DDoS (flood a target to deny service), Spoofing (fake source address), Reflection/Amplification (use third parties to amplify attack traffic), Man-in-the-Middle (intercept communications), Reconnaissance (gather information before attacking).
Password Policies and MFA
Strong authentication requires: complex passwords (length + character variety), password history (prevent reuse), account lockout (after failed attempts), and MFA (something you know + something you have + something you are). Certificates and biometrics are additional factors.
Access Control Lists (ACLs)
ACLs filter traffic based on packet header fields. They are processed top-down — the first matching entry wins. There is an implicit deny any at the end of every ACL.
Standard ACLs (1–99, 1300–1999) — match on source IP only. Place as close to the destination as possible (to avoid blocking traffic unnecessarily).
Extended ACLs (100–199, 2000–2699) — match on source IP, destination IP, protocol, and port. Place as close to the source as possible (to stop unwanted traffic early).
Named ACLs — use descriptive names instead of numbers. Allow editing individual entries with sequence numbers.
ACL Wildcard Masks — the inverse of a subnet mask. 0 = must match, 1 = ignore. Examples: 0.0.0.255 matches any host in a /24. 0.0.0.0 matches exactly one host. 255.255.255.255 matches any host (same as any).
Applying ACLs: ip access-group ACL-NAME in|out on an interface. in = filter traffic entering the interface; out = filter traffic leaving. Verify: show ip access-lists.
Layer 2 Security Features
Port Security — limits the number of MAC addresses on a switch port. Violation modes: Protect (drop, no log), Restrict (drop + log), Shutdown (err-disable port — default). Config: switchport port-security maximum 2 → switchport port-security violation shutdown → switchport port-security.
DHCP Snooping — prevents rogue DHCP servers. Marks ports as trusted (uplinks to real DHCP server) or untrusted (access ports). Untrusted ports drop DHCP Offer and Ack messages. Builds a binding table (MAC, IP, port, VLAN) used by DAI.
Dynamic ARP Inspection (DAI) — validates ARP packets against the DHCP snooping binding table. Drops ARP packets with mismatched MAC-IP pairs, preventing ARP poisoning/spoofing attacks.
802.1X (Port-Based NAC) — requires authentication before granting network access. Three roles: Supplicant (client), Authenticator (switch), Authentication Server (RADIUS). Uses EAP (Extensible Authentication Protocol).
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security Fundamentals — ACLs & Layer 2
Standard ACLs should be placed:
- Close to the source
- Close to the destination
- On the WAN interface
- On trunk ports only
- Answer: Close to the destination
Standard ACLs match only source IP — placing them close to the destination avoids blocking traffic to other destinations. Extended ACLs should be placed:
- Close to the destination
- Close to the source
- On all interfaces
- Only on Layer 3 switches
- Answer: Close to the source
Extended ACLs can match source, destination, protocol, and port — placing them close to the source stops unwanted traffic early.
What is the wildcard mask for matching exactly one host (e.g., 10.1.1.1)?
- 255.255.255.255
- 0.0.0.255
- 0.0.0.0
- 255.0.0.0
Answer: 0.0.0.0
0.0.0.0 means all bits must match — equivalent to using the host keyword.
Which port security violation mode disables the port and sends an SNMP trap?
- Protect
- Restrict
- Shutdown
- Err-disable
Answer: Shutdown
Shutdown (the default) places the port in err-disable state and generates a syslog/SNMP notification.
Every ACL has an implicit permit any at the end.
- True
- False
Answer: False
Every ACL has an implicit DENY any at the end — if no rule matches, traffic is dropped.
DHCP Snooping prevents which type of attack?
- ARP poisoning
- Rogue DHCP server attacks
- MAC flooding
- VLAN hopping
Answer: Rogue DHCP server attacks
DHCP Snooping blocks DHCP Offer/Ack messages from untrusted ports, preventing rogue DHCP servers from assigning addresses.
Dynamic ARP Inspection (DAI) uses which database to validate ARP packets?
- MAC address table
- ARP cache
- DHCP snooping binding table
- Routing table
Answer: DHCP snooping binding table
DAI checks ARP packets against the DHCP snooping binding table to verify MAC-IP mappings.
In 802.1X, which device acts as the authenticator?
- The end-user PC (supplicant)
- The RADIUS server
- The switch
- The router
Answer: The switch
In 802.1X: Supplicant = client, Authenticator = switch (enforces access), Authentication Server = RADIUS.
The command to apply ACL 101 to inbound traffic on an interface is: ip access-group 101 _____
Answer: in
ip access-group 101 in applies the ACL to traffic entering the interface.
Which ACL number range is used for extended ACLs?
- 1–99
- 100–199
- 1300–1999
- 200–299
Answer: 100–199
Extended ACLs use numbers 100–199 (and 2000–2699 for extended named ranges).
A vulnerability is best defined as:
- An active attack in progress
- A weakness that could be exploited
- The probability of an attack
- A security policy violation
- Answer: A weakness that could be exploited
A vulnerability is a weakness (unpatched software, misconfiguration). A threat exploits it; risk measures likelihood and impact.
Which command verifies ACL matches and statistics on a Cisco router?
- show access-list
- show ip access-lists
- debug ip acl
- show ip interface
Answer: show ip access-lists
show ip access-lists displays all IP ACLs with match counters for each entry.
Previous lesson: DHCP server configuration on IOS: pools, exclusions, options, relay agent
Back to Cisco CCNA Preparation
Next lesson: ACLs: standard and extended; Layer 2 security: DHCP snooping, dynamic ARP inspection, port security