CCNA quiz 5: security fundamentals

Standard ACLs match source addresses only, so placing them near the source could block that host from everything. Place them near the destination.

Every ACL ends with an invisible deny. If no line matches, the traffic is dropped, so an ACL with only deny lines blocks everything.

SSH encrypts the session including the password. Telnet and HTTP send credentials in clear text; SNMPv1 uses plain community strings.

Authentication proves who you are, authorisation decides what you may do, and accounting records what you did.

TACACS+ (TCP 49) encrypts the whole body. RADIUS (UDP 1812/1813) encrypts only the password. TACACS+ is common for device administration.

WPA3 adds SAE, which resists offline password guessing. WEP and TKIP are broken; WPA2-AES is still acceptable where WPA3 is not available.

DHCP snooping only allows DHCP offers from trusted ports (towards the real server) and drops them from user ports.

Dynamic ARP Inspection (DAI) checks ARP replies against the DHCP snooping bindings and drops forged ones.

Phishing tricks people into revealing information or clicking malicious links. Training and MFA are key defences.

service password-encryption applies weak type 7 encryption to plain passwords. It only stops shoulder-surfing; use enable secret and strong hashing for real protection.

Standard numbered ACLs use 1-99 (and 1300-1999). Extended ACLs use 100-199 (and 2000-2699).

Extended ACLs match source and destination addresses, protocol and port numbers, so they can be placed close to the source.

ip access-group applies an ACL to an interface. access-class applies one to VTY lines.

Confidentiality, integrity and availability are the three core goals of information security.

transport input ssh on the VTY lines allows only SSH. The other commands are also part of SSH setup but do not block Telnet.

MAC flooding fills the CAM table with fake addresses. Port security limits the number of MACs per port to stop it.

Biometrics such as fingerprints are something you are. PINs are something you know; cards and codes come from something you have.

WPA-Enterprise uses 802.1X with a RADIUS server so each user has their own credentials.

A VPN encrypts traffic between sites or between a remote user and the network across the internet.

enable secret stores a hashed password. enable password is plain text unless weakly obscured by service password-encryption.