CCNA 200-301 Security Fundamentals (15%) — CHEAT SHEET

Quick Cue-Answer Guide

|-----|--------|

---

Access Control Lists (ACLs)

Standard vs. Extended

|---------|----------|----------|

Key Rules

Wildcard mask = inverse of subnet mask (e.g., /24 → 0.0.0.255)

Implicit deny at end = any traffic not explicitly matched is dropped

order matters = first match wins; more specific rules first

host keyword = 0.0.0.0 wildcard (single IP)

any keyword = 0.0.0.0 0.0.0.0 (all traffic)

VTY Access (Critical for SSH/Telnet)

``access-list 100 permit tcp 10.0.0.0 0.0.0.255 any eq 22 line vty 0 4 access-class 100 in`

in = filter incoming connections

out = filter outgoing (rare)

SSH = port 22 | Telnet = port 23

---

`Device Access & Passwords`

`Enable Secret vs. Password`


|--------|------------------|-----------------|

`SSH Configuration (6-Step Sequence) — SIMULATION CRITICAL`

hostname R1


   (MUST set hostname first — RSA key needs it)
ip domain-name example.com
   (Required for RSA key generation)
crypto key generate rsa
   (Creates public/private key pair; 2048-bit minimum recommended)
username admin privilege 15 secret P@ssw0rd
   (Local user for authentication)
line vty 0 4
   transport input ssh
   login local
   (SSH only on VTY lines 0–4)
ip ssh version 2
   (Force SSHv2; v1 is deprecated)


Telnet = insecure; SSH = encrypted — always use SSH on exam.
---
Layer 2 Security
Port Security


|---|---|---|

`Port Security Config`


switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky

Other Layer 2 Defenses

|---------|---------|

---

VPN Fundamentals

Site-to-Site vs. Remote-Access

|------|----------|---|---|

IPsec Components

|----------|-------|----------|

Common Alternatives

GRE = unencrypted tunnel; often combined with IPsec

SSL/TLS VPN = web-browser based; port 443

WireGuard = modern, lightweight (not on CCNA but trending)

---

Security Concepts (Threat-to-Mitigation Mapping)

Common Attacks & Counters

|--------|-----------|---|

CIA triad	Confidentiality, Integrity, Availability
Cue	Answer
AAA order	Authentication → Authorization → Accounting
Malware types	Virus, Worm, Trojan, Ransomware, Botnet, Rootkit
DoS vs. DDoS	DoS = single attacker; DDoS = multiple sources
Social engineering	Phishing, Vishing, Pretexting, Baiting (non-technical attack)
Feature	Standard	Extended
Number range	1–99, 1300–1999	100–199, 2000–2699
Filter by	Source IP only	Source, destination, protocol, port
Placement	Close to destination	Close to source
Typical use	Route filtering	Interface access control
Aspect	enable password	enable secret
Encryption	Cisco Type 7 (weak)	Cisco Type 5/9 (strong bcrypt)
Override?	enable secret `wins if both set`	Always used
Current best	Deprecated	Use Type 9 (best)
Violation Mode	Action	Use Case
shutdown	Err-disable port (default)	Maximum security; manual recovery
restrict	Drop offending frames; log	Monitor without downtime
protect	Drop only offending frames (silent)	Least disruptive
Feature	Purpose
DHCP Snooping	Block rogue DHCP servers; trust upstream only
DAI (Dynamic ARP Inspection)	Validate ARP requests against DHCP bindings
802.1X (Port-Based NAC)	EAP authentication before network access
Spanning Tree PortFast + BPDU Guard	Prevent VLAN hopping; fast convergence
Type	Topology	Authentication	Use Case
Site-to-Site	Network-to-Network	Certificates/Pre-shared key	Branch-to-HQ
Remote-Access	Client-to-Network	Username/password or certificate	VPN client to corporate
Protocol	Layer	Function
AH (Authentication Header)	Layer 3	Integrity only (no encryption)
ESP (Encapsulating Security Payload)	Layer 3	Encryption + integrity
IKE (Internet Key Exchange)	Control plane	Negotiate SA parameters
Attack	Mechanism	Countermeasure
MAC Spoofing	Fake Layer 2 address	Port security; DHCP snooping
DHCP Starvation	Exhaust IP pool	DHCP snooping; rate limit
ARP Spoofing	Fake ARP reply	DAI; static ARP entries
VLAN Hopping	Trunk negotiation exploit	Disable DTP; hardcode access ports
802.1X Bypass

Security Fundamentals (15%)