5Security

• 5.1Device access control (lines, local authentication, AAA)

  Covers applying local user authentication to line vty / line console and centralizing control with AAA (authentication, authorization, accounting). It frames the difference between TACACS+ (TCP 49, separates the AAA functions, encrypts the entire packet) and RADIUS (UDP 1812/1813, combines authentication and authorization, encrypts only the password) as design judgment: who may run which commands, and whether you get locked out when the server fails.

• 5.2Protecting infrastructure with ACLs

  Covers the difference between a standard ACL (matching only the source IP) and an extended ACL (matching source/destination IP, protocol, and port), sequential evaluation (the first matching entry decides) with the trailing implicit deny, and the placement judgment of which interface and direction to apply it to. It also covers editing named ACLs by sequence number and verifying with log, so you can build a configuration that passes only the intended traffic.

• 5.3CoPP (Control Plane Policing)

  CoPP classifies and rate-limits traffic punted to the device's own CPU (the control plane), protecting routing protocols and management access from DoS and excessive control traffic. You build classes and rate design with MQC (class-map, policy-map, service-policy) and apply the policy to control-plane. The goal is to be able to judge why an ACL alone cannot protect the CPU and why an adjacency went down.

• 5.4REST API security

  Covers what it takes to use the REST APIs of controllers such as Catalyst Center and SD-WAN Manager safely: protecting the channel with HTTPS/TLS, authenticating and authorizing with tokens and OAuth 2.0, handling rate limiting (HTTP 429), designing roles on least privilege, and never embedding credentials in code—framed as design judgment for automation scripts.

• 5.5Components of network security design

  Organizes threat defense (IPS, sandboxing, threat intelligence), endpoint security (EDR, posture assessment), the next-generation firewall (NGFW) (control with application/user identity), TrustSec (group-based control via SGTs), and MACsec (IEEE 802.1AE hop-by-hop L2 encryption) as the design judgment of which mechanism at which layer satisfies a given requirement.