Study Hub / Cisco CCNA (200-301) / Domain 5.0
Cisco CCNA (200-301) Domain 5.0: Security Fundamentals — Explained
Domain 5.0 is security at the network layer: the concepts every secure network assumes (CIA, AAA), hardening the devices themselves, filtering traffic with ACLs, and closing the Layer 2 holes attackers love.
Concepts: CIA and AAA
- CIA triad — Confidentiality (only authorized eyes: encryption, access control), Integrity (data unaltered: hashes, signatures), Availability (there when needed: redundancy, DDoS defense). Every security control serves at least one.
- AAA — Authentication (who are you?), Authorization (what may you do?), Accounting (what did you do?). Three distinct jobs — a login without authorization is a locked door with the key under the mat.
- RADIUS vs. TACACS+ — both centralize AAA; TACACS+ (Cisco) encrypts the entire exchange and separates auth/authz/accounting — the device-admin choice; RADIUS encrypts only the password and combines auth+authz — the network-access (Wi-Fi/VPN) choice.
- Threat vocabulary — malware, phishing, spoofing (forged identity), MITM (silent interception), DoS (availability attack). Name the threat to pick the control.
Device hardening: secure the infrastructure itself
- Access control — SSH only (never Telnet), strong local passwords / enable secret (hashed, not plaintext), privilege levels limiting what each admin can do, login banners (the legal "you are being watched" notice).
- Password hygiene on devices —
service password-encryptionobscures plaintext passwords in configs (weak obfuscation, but better than cleartext); enable secret uses real hashing. Neither survives a determined offline attack — they're speed bumps, not vaults. - Control plane protection — limit what can talk to the device: management ACLs on VTY lines, disabling unused services (HTTP, CDP where unneeded). A router you can't reach is a router you can't reconfigure — for attackers too.
- Physical and boot security — console access = game over eventually; password recovery procedures exist for owners, which is exactly why physical access control matters.
ACLs and Layer 2 security
- ACLs — ordered lists of permit/deny rules evaluated top-down, first match wins, with an implicit deny all at the end. Standard ACLs filter on source IP only (place near the destination); extended ACLs filter on source/destination/protocol/port (place near the source).
- Placement logic — standard near destination (it's blunt — don't block legitimate traffic upstream); extended near source (it's precise — stop unwanted traffic early). Backwards placement is the classic ACL question.
- DHCP snooping — the switch learns which ports are trusted (uplinks to the real DHCP server) and drops DHCP offers from untrusted ports — killing rogue-DHCP attacks.
- Dynamic ARP Inspection (DAI) — validates ARP packets against the DHCP snooping binding table; forged ARP (the MITM setup) gets dropped. DAI depends on DHCP snooping's table.
- Port security — limits MAC addresses per switch port (and what happens on violation: protect, restrict, shutdown). One port, one device — no rogue switches or MAC flooding.
The must-memorize table: standard vs. extended ACLs
Filter precision determines placement.
| Trait | Standard ACL | Extended ACL |
|---|---|---|
| Filters on | Source IP only | Source + destination IP, protocol, ports |
| Place it | Near the destination | Near the source |
| Why there | Blunt — don't block good traffic early | Precise — stop bad traffic early |
| Number ranges | 1–99, 1300–1999 | 100–199, 2000–2699 |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An admin needs to block Telnet (TCP 23) from a specific subnet to all servers, while allowing everything else. Which ACL type and placement?
- A. A. Standard ACL near the destination
- B. B. Extended ACL near the source — it can match protocol/port and stop the traffic early
- C. C. Extended ACL near the destination
- D. D. No ACL — Telnet can't be filtered
Show answer & reasoning
B. Filtering on port (TCP 23) requires an extended ACL (standard sees only source IP), and extended ACLs go near the source so unwanted traffic dies before crossing the network. Standard (A) can't see ports at all.
2. A user plugs a home router into the office network and it starts handing out wrong DHCP addresses. Which feature would have prevented this?
- A. A. Port security
- B. B. DHCP snooping — drops DHCP server messages from untrusted ports
- C. C. DAI
- D. D. NAT
Show answer & reasoning
B. DHCP snooping classifies ports: only trusted uplinks may send DHCP offers; the rogue router's offers arrive on an untrusted access port and die. That's exactly the rogue-DHCP scenario. DAI (C) fights ARP spoofing (and needs snooping's table); port security (A) limits MACs, not DHCP roles.
3. Why does TACACS+ suit device administration better than RADIUS?
- A. A. It's faster
- B. B. It encrypts the entire AAA exchange and separates authentication, authorization, and accounting — fine-grained control over admin sessions
- C. C. It doesn't need a server
- D. D. RADIUS can't do authentication
Show answer & reasoning
B. TACACS+'s two advantages are exactly the admin use case: full-packet encryption (RADIUS encrypts only the password) and separate auth/authz/accounting (per-command authorization: "this admin may run show commands but not configure"). RADIUS (combined auth+authz) fits network access like Wi-Fi.
4. An ACL ends without an explicit permit or deny. What happens to traffic matching no rule?
- A. A. It's permitted — ACLs default to allow
- B. B. It's denied — every ACL ends with an implicit deny all
- C. C. It's sent to the CPU for review
- D. D. The ACL is ignored
Show answer & reasoning
B. The invisible final line of every ACL is deny ip any any. Traffic matching nothing is dropped — which is why a new ACL that "isn't working" usually just needs its permit lines checked: the implicit deny is doing exactly what it always does.
This was one domain. The simulator drills all 6.
This free preview covered Security Fundamentals (Domain 5.0, 15%). Not covered here: IP Connectivity (Domain 3.0, 25%); Automation & Programmability (Domain 6.0, 10%). Routing configuration and automation — the heaviest hands-on CCNA material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CCNA Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy