Core Security Concepts: Threats, Vulnerabilities and Mitigations
Security work starts with precise vocabulary. A vulnerability is a weakness, a threat is something or someone capable of exploiting it, an exploit is the method used, and risk is the combination of likelihood and impact. Controls are the mitigations you put in place, and they are usually described as physical, technical or administrative, and as preventive, detective or corrective. Everything a control protects maps back to the CIA triad: confidentiality keeps data from unauthorised eyes, integrity keeps it from unauthorised change, and availability keeps it reachable when it is needed. On a network you will meet denial of service and its distributed form, on-path attacks where an attacker inserts themselves into a conversation, spoofing of MAC or IP addresses, reflection and amplification abuse of open services, and social engineering including phishing which bypasses technical controls entirely by targeting people. Defence in depth means layering controls so that no single failure is fatal.
Exam tip. Get the vocabulary exact. A weakness is a vulnerability, the actor is the threat, and the calculated exposure is the risk. Questions frequently test whether you can tell these apart rather than testing any configuration.
Device Access Control and Password Policies
A router or switch is a computer with an operating system, and securing access to it is the first control on the list. IOS separates user EXEC from privileged EXEC and protects the latter with enable secret, which stores a hashed value, rather than the obsolete enable password which can be stored reversibly. Line-level protection covers the console, the auxiliary port and the vty lines, and best practice is to move away from shared line passwords to individual local usernames with username <name> secret <password>, or better, to central authentication. Supporting settings matter just as much: service password-encryption hides plain passwords in the configuration from casual reading but is weak and reversible, exec-timeout disconnects idle sessions, login block-for slows down brute force attempts, and a banner motd warns unauthorised users. A password policy should require length and complexity, forbid reuse and defaults, and require multi-factor authentication for administrative access where it is available.
Exam tip. Never accept an answer that relies on enable password or on service password-encryption for real protection. Individual accounts plus enable secret plus SSH is the expected combination.
AAA with RADIUS, TACACS+ and 802.1X
AAA separates three questions: authentication asks who you are, authorisation asks what you may do, and accounting records what you did. Rather than keeping accounts on every device, AAA points them at a central server so that adding or removing an administrator is one change. RADIUS is an open standard using UDP, it combines authentication and authorisation into one exchange, and it encrypts only the password field, which makes it the usual choice for network access such as 802.1X. TACACS+ is Cisco proprietary, uses TCP port 49, separates all three A's and encrypts the entire packet body, which makes it far better for administering devices because you can authorise individual commands. 802.1X applies the same idea to the edge port itself: the supplicant on the endpoint talks EAP to the authenticator, which is the switch or wireless AP, and the authenticator relays it to the authentication server, leaving the port blocked for everything else until authentication succeeds.
Exam tip. If the requirement is per-command authorisation for network administrators, answer TACACS+. If the requirement is authenticating users or devices onto the network, answer RADIUS with 802.1X.
Access Control Lists: Standard, Extended and Placement
An ACL is an ordered list of permit and deny statements evaluated from the top down, stopping at the first match, with an invisible deny any at the end of every list. A standard ACL, numbered 1 to 99 or 1300 to 1999, can filter only on source address, so it must be placed close to the destination to avoid blocking traffic that should have been allowed elsewhere. An extended ACL, numbered 100 to 199 or 2000 to 2699, filters on source and destination address, protocol and port, so it should be placed as close to the source as possible to drop unwanted traffic before it consumes bandwidth. Named ACLs are preferred in modern configurations because they are readable and support sequence numbers for editing individual lines. Wildcard masks are the inverse of subnet masks: a zero bit means the bit must match and a one bit means it is ignored, so 0.0.0.255 matches a whole /24. Remember an ACL affects only traffic passing through the interface in the direction applied, and that host and any are shorthand for 0.0.0.0 and 255.255.255.255 wildcards.
Exam tip. Convert the required subnet into a wildcard mask before you read the answer options, and always account for the implicit deny at the end of the list.
Port Security and Violation Modes
Port security limits which and how many MAC addresses may be seen on an access port, which stops a user plugging an unauthorised switch or hub into a wall socket and stops MAC flooding attacks that try to overwhelm the MAC address table and turn the switch into a hub. It works only on access or trunk ports, not on dynamic ports, so the port must be statically configured before switchport port-security will apply. You set a maximum number of addresses, and the allowed addresses are either configured statically or learned; sticky learning takes the first addresses seen, converts them to static entries and writes them into the running configuration so they survive a reload once saved. When the limit is exceeded, or a configured address appears on a different port, the violation action decides what happens: shutdown err-disables the port and is the default, restrict drops offending frames while logging and incrementing counters, and protect drops them silently with no notification at all.
Exam tip. The default violation mode is shutdown and the default maximum is one MAC address. The only difference between protect and restrict is whether you are told the violation happened.
DHCP Snooping and Dynamic ARP Inspection
DHCP and ARP were designed with no authentication, so both are easy to abuse on a local segment. A rogue DHCP server can hand out its own address as the default gateway and become an on-path attacker, and ARP poisoning can achieve the same by claiming to own the gateway's IP address. DHCP snooping fixes the first by classifying every switch port as trusted or untrusted: server replies such as Offer and Acknowledgement are accepted only on trusted ports, which are the uplinks towards the real server, and untrusted user ports may send only client messages. While it filters, it also builds the DHCP snooping binding table recording the MAC, IP, VLAN, lease and port of every legitimate client. Dynamic ARP inspection then uses that binding table to validate ARP packets on untrusted ports and drops any whose sender MAC and IP pairing does not match, which shuts down ARP poisoning. Because both features can drop legitimate bursts, rate limiting on untrusted ports is applied and err-disable recovery should be planned.
Exam tip. Remember the dependency: DAI needs the DHCP snooping binding table, so enable snooping first. A question describing an attacker becoming the default gateway is pointing at DHCP snooping, DAI, or both.
Wireless Security: WPA2, WPA3 and Authentication Modes
Wireless traffic is broadcast into the air, so encryption and authentication are not optional. WEP and the original WPA with TKIP are broken and must never be used. WPA2 introduced AES with CCMP and is still widespread, offering a personal mode using a pre-shared key and an enterprise mode using 802.1X with a RADIUS server so each user has individual credentials. WPA3 improves on all of it: personal mode replaces the pre-shared key handshake with Simultaneous Authentication of Equals, which resists offline dictionary attacks and provides forward secrecy so a captured session cannot be decrypted later even if the password is learned; enterprise mode adds stronger cryptographic suites; and management frame protection becomes mandatory rather than optional, which blocks deauthentication attacks. WPA3 also brings Opportunistic Wireless Encryption for open networks, encrypting traffic on a guest SSID that requires no password at all. Any network using the 6 GHz band must use WPA3.
Exam tip. WPA3-Personal uses SAE and WPA2-Personal uses a pre-shared key. Also remember that hiding the SSID and MAC filtering are not security controls, since both are easily defeated by passive capture.
Site-to-Site and Remote Access VPNs
A VPN builds an encrypted tunnel across an untrusted network so traffic behaves as if it were on a private link. A site-to-site VPN joins two networks permanently: the VPN devices at each end do the encryption, users and hosts are unaware of it, and IPsec is the usual protocol suite. IPsec provides confidentiality through encryption, integrity through hashing, authentication of the peers using pre-shared keys or certificates, and anti-replay protection; it uses ESP for encrypted payloads and can run in tunnel mode, which encapsulates the whole original packet, or transport mode, which protects only the payload. GRE is often paired with IPsec because GRE can carry multicast and routing protocols that plain IPsec tunnels cannot. A remote access VPN connects one user, typically running client software that builds an SSL or TLS tunnel over TCP 443 so it passes through firewalls easily, or an IPsec client. Split tunnelling sends only corporate traffic through the tunnel while other traffic goes direct, which saves bandwidth but weakens inspection.
Exam tip. Remember that plain IPsec cannot carry multicast or routing protocol traffic, which is exactly why GRE over IPsec exists. That single fact answers a common design question.