Chapter 5 · CCNA 200-301 Study Guide · Based on the CCNA 200-301 v2.0 exam blueprint (effective February 2027)

Chapter 5: Security Fundamentals

Security is one of the largest CCNA domains, and it is where memorized definitions meet real incidents. This chapter covers threats, VPNs, access control lists, Layer 2 defenses, device hardening, and wireless security. Cisco loves testing the differences between similar technologies — watch for every comparison table.

5.1 Security Concepts: Know Your Enemy

5.1.1 Malware

5.1.2 Social Engineering and Phishing

Social engineering attacks the human. Phishing: fraudulent messages impersonating a trusted sender to steal credentials or deliver malware. Variants: spear phishing (targeted at a person/org), whaling (aimed at executives), vishing (voice calls), smishing (SMS), pretexting (invented scenario, e.g. fake IT support), baiting (lure such as a free USB drive), tailgating (following someone through a secured door).

5.1.3 Denial of Service

DoS overwhelms a target from a single source so legitimate users can't get through. DDoS does it from many sources at once — typically a botnet of compromised devices — making it far harder to stop. Mitigations: rate limiting, filtering, and cloud scrubbing services that absorb the flood upstream.

5.1.4 Man-in-the-Middle

In a MITM attack, the attacker secretly sits between two parties, intercepting or altering traffic. Examples: ARP spoofing on a LAN (poisoned ARP caches redirect traffic through the attacker) and evil-twin access points mimicking a legitimate SSID. Defenses: encryption, mutual authentication, VPNs, and Dynamic ARP Inspection (5.4.2).

5.2 VPNs

A VPN builds an encrypted tunnel across an untrusted network (usually the internet) so private traffic travels safely.

5.2.1 Site-to-Site vs. Remote-Access

5.2.2 IPsec Fundamentals

IPsec secures IP traffic, most often for site-to-site VPNs. Its two core protocols are a classic exam trap:

• AH (Authentication Header, IP protocol 51) — authentication and integrity only. No encryption.
• ESP (Encapsulating Security Payload, IP protocol 50) — encryption plus authentication/integrity.

Two modes: transport mode encrypts only the payload (original IP header visible) — used host-to-host. Tunnel mode encrypts the entire packet inside a new IP header — used gateway-to-gateway (site-to-site).

IKE (Internet Key Exchange) sets up the tunnel: Phase 1 builds a secure channel between peers (authentication plus Diffie-Hellman key exchange); Phase 2 negotiates the IPsec security associations that protect the data.

5.2.3 SSL VPNs

SSL/TLS VPNs use web-style encryption. Clientless mode needs only a browser; full-tunnel client mode (e.g. Cisco AnyConnect) gives complete network access like IPsec remote-access. Advantage: easy firewall traversal over TCP 443.

5.3 Access Control Lists

An ACL is an ordered permit/deny list checked top-down, first match wins. No match hits the implicit deny all at the end — the most tested ACL fact on the exam.

5.3.1 Standard vs. Extended

Named ACLs (ip access-list extended BLOCK-TELNET) allow descriptive names and per-line editing — numbered ACLs force you to rebuild the list to remove a line.

R1(config)# ip access-list extended BLOCK-TELNET
R1(config-ext-nacl)# deny tcp 192.168.10.0 0.0.0.255 host 192.168.20.5 eq 23
R1(config-ext-nacl)# permit ip any any
R1(config-ext-nacl)# exit
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip access-group BLOCK-TELNET in

The explicit permit ip any any is mandatory — otherwise the implicit deny kills everything else. One ACL per interface, per direction (in/out), per protocol.

5.3.2 Wildcard Masks

A wildcard mask is the inverse of a subnet mask: 0 = bit must match, 1 = bit ignored.

5.4 Layer 2 Security

Switches forward frames without asking questions, so Layer 2 needs explicit defenses. These four work as a team.

5.4.1 DHCP Snooping

Stops rogue DHCP servers handing out bogus gateways/DNS to redirect traffic. Ports are trusted (uplinks toward the real DHCP server) or untrusted (everything else, the default); DHCP server messages (OFFER, ACK) on untrusted ports are dropped. It also builds a binding table (MAC–IP–port–VLAN) that powers DAI.

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10
SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# ip dhcp snooping trust

5.4.2 Dynamic ARP Inspection

DAI stops ARP spoofing (the classic MITM setup) by checking ARP packets on untrusted ports against the DHCP snooping binding table and dropping mismatches. No binding table = nothing to validate, so DAI requires DHCP snooping. Static-IP devices need static mappings or ARP ACLs.

5.4.3 Port Security

Limits MAC addresses per port, defeating MAC flooding and rogue devices:

SW1(config)# interface gigabitEthernet 0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security violation restrict
SW1(config-if)# switchport port-security mac-address sticky

Sticky MACs learn and remember the first MACs seen — no manual entry needed. Port security requires an access port (switchport mode access first). Default maximum is 1 MAC.

5.4.4 Spanning-Tree Guards and VLAN Best Practices

• BPDU Guard: on PortFast edge ports — err-disables the port if any BPDU arrives. No rogue switches in your spanning tree.
• Root Guard: on downstream-facing ports — blocks superior BPDUs so no switch can steal the root bridge role.
• Native VLAN: default VLAN 1 carries untagged trunk traffic and invites VLAN hopping (double-tagging). Harden it: move the native VLAN to an unused VLAN, never put users on VLAN 1, tag native traffic where supported, prune unused VLANs from trunks.

5.5 Device Hardening

5.5.1 Passwords, SSH, and Banners

• enable secret hashes the privileged password; enable password stores it in clear text — always use enable secret.
• service password-encryption hides other passwords with weak, reversible encryption. Better than clear text, not real security.
• SSH vs Telnet: Telnet (TCP 23) sends everything in clear text; SSH (TCP 22) encrypts. Disable Telnet. SSH needs a hostname, domain name, and RSA key:

R1(config)# hostname R1
R1(config)# ip domain-name certcrack.lab
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# exit
R1(config)# username admin privilege 15 secret Str0ngP@ss!

transport input ssh is what actually kills Telnet on the VTY lines.

• Banners (banner motd, banner login): legal "authorized access only" warnings. They don't stop attackers, but they establish unauthorized access legally.

5.5.2 Disable What You Don't Use

Every running service is attack surface: no ip http server, disable CDP/LLDP on untrusted edges, and shut down unused switch ports (or park them in a dead-end VLAN). An enabled, unconfigured port is an open door.

5.5.3 AAA: TACACS+ vs. RADIUS

AAA = Authentication (who are you?), Authorization (what may you do?), Accounting (what did you do?). Centralize it on a server (e.g. Cisco ISE) instead of local passwords per device.

5.6 Wireless Security

Wireless frames reach anyone listening, so encryption and strong authentication are mandatory. WEP is broken — know it only to reject it. WPA was interim and is deprecated. The real comparison:

WPA2 was weakened by the KRACK attack (2017) on its handshake. WPA3 comes in Personal (passphrase) and Enterprise (802.1X/EAP with RADIUS — see 5.5.3) modes.

End-of-Chapter Test