5Security Fundamentals

• 5.1Security concepts and the security program

  Covers the core vocabulary of threat, vulnerability, exploit, and mitigation and how they relate to risk, countermeasures against common attacks (malware/phishing/DoS/man-in-the-middle/spoofing), and defense in depth that combines user awareness, training, and physical access control—things technology alone cannot cover—so you can judge which mitigation is most effective in a given situation.

• 5.2Device access control and AAA

  Covers local passwords that protect access to routers/switches (enable secret, line passwords, username secret) and SSH, which is safer than Telnet; password policy (complexity, management, MFA, certificates, biometrics); and AAA, which centrally manages authentication, authorization, and accounting, together with the choice between the external-server protocols TACACS+ (TCP 49, Cisco-proprietary, per-command authorization) and RADIUS (UDP, open standard, combined authentication/authorization)—judged from real device config and requirements.

• 5.3Access control lists (ACLs)

  Covers the types of ACL that permit/deny traffic on IOS (numbered/named, standard (1-99/1300-1999, source only) versus extended (100-199, source/destination/protocol/port)), the implicit deny at the end, the wildcard mask, and the placement rule that standard goes near the destination and extended goes near the source—together with configuration/verification commands—so you can judge how to filter exactly as required.

• 5.4Layer 2 security

  Covers port security that limits which MACs can connect to a switch port (violation modes protect/restrict/shutdown, sticky MAC), DHCP snooping that eliminates rogue DHCP servers (trusted/untrusted ports and the binding table), and Dynamic ARP Inspection (DAI) that uses those bindings to prevent ARP spoofing—so you can judge which L2 controls to combine from an attack scenario.

• 5.5VPN and wireless security

  Covers VPNs that build a secure path over public networks (a remote-access VPN connecting an individual to a site, a site-to-site VPN joining sites, and IPsec providing confidentiality/integrity/authentication), the wireless encryption standards WPA/WPA2/WPA3 (WPA3's SAE and mandatory PMF), the personal/enterprise distinction, and WPA2 PSK GUI configuration—judged as scheme selection to fit requirements.