Security questions are strongest when you connect a control to a specific threat and enforcement point. State what is being protected, where the control acts, and how you would verify the result.
What to know and how to practise it
Threats, vulnerabilities, programs, and device access
Distinguish threat, vulnerability, exploit, and mitigation. Recognize the purpose of user awareness, physical access control, password policy, multifactor authentication, certificates, and secure management. Harden local device access with appropriate secrets and protected remote administration.
IPsec concepts and IPv4 ACLs
Understand the role of IPsec in protecting traffic across an untrusted network. For ACLs, apply top-down first-match processing, account for the implicit deny, select standard or extended matching appropriately, and choose interface direction from the router’s perspective.
Layer 2 security features
Relate DHCP snooping, Dynamic ARP Inspection, port security, and common spanning-tree protections to their trust boundaries. Configure trusted ports only where authoritative infrastructure traffic should enter, and ensure dependent features have the bindings they need.
AAA and wireless security
Distinguish authentication, authorization, and accounting and compare local control with centralized services. Recognize WPA, WPA2, WPA3, pre-shared key, and enterprise authentication roles, and configure a WLAN security profile that agrees with the intended identity source.
Example enforcement-point decision
An employee subnet may reach one HTTPS server but no other destination. An extended ACL can match source, destination, protocol, and port close to the source. Order the specific permit before the broader deny, apply it in the traced direction, then verify counters with representative traffic.
show access-lists
show ip interface
show port-security interface
show ip dhcp snooping
show ip arp inspectionReadiness checklist
- Match threats and vulnerabilities to effective mitigations.
- Harden local and remote device-management access.
- Trace ACL first-match logic and interface direction.
- Set Layer 2 trust boundaries deliberately.
- Distinguish AAA functions and wireless authentication choices.
Common mistakes to remove
- Using a security feature because its name sounds relevant without locating the trust boundary.
- Placing a broad ACL entry before the required exception.
- Confusing authentication with authorization or accounting.